[PATCH 6.6 00/93] 6.6.119-rc1 review

[PATCH 6.6 00/93] 6.6.119-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 6.6.119 release.
There are 93 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.6.119-rc1

Alan Stern <stern@rowland.harvard.edu>
    HID: core: Harden s32ton() against conversion to 0 bits

Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
    net: dsa: microchip: Free previously initialized ports on init failures

Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
    net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()

Sean Heelan <seanheelan@gmail.com>
    ksmbd: fix use-after-free in session logoff

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix duplicate reset on fastclose

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    selftests: mptcp: join: properly kill background tasks

Philipp Hortmann <philipp.g.hortmann@gmail.com>
    staging: rtl8712: Remove driver using deprecated API wext

luoguangfei <15388634752@163.com>
    net: macb: fix unregister_netdev call order in macb_remove()

ChiYuan Huang <cy_huang@richtek.com>
    iio: adc: rtq6056: Correct the sign bit index

Biju Das <biju.das.jz@bp.renesas.com>
    can: rcar_canfd: Fix CAN-FD mode as default

Jameson Thies <jthies@google.com>
    usb: typec: ucsi: psy: Set max current to zero when disconnected

Jimmy Hu <hhhuuu@google.com>
    usb: gadget: udc: fix use-after-free in usb_gadget_state_work

Kuen-Han Tsai <khtsai@google.com>
    usb: udc: Add trace event for usb_gadget_set_state

NeilBrown <neil@brown.name>
    nfsd: Replace clamp_t in nfsd4_get_drc_mem()

Wang Liang <wangliang74@huawei.com>
    bonding: check xdp prog when set bond mode

Hangbin Liu <liuhangbin@gmail.com>
    bonding: return detailed error when loading native XDP fails

ziming zhang <ezrakiez@gmail.com>
    libceph: replace BUG_ON with bounds check for map->max_osd

ziming zhang <ezrakiez@gmail.com>
    libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

Ilya Dryomov <idryomov@gmail.com>
    libceph: fix potential use-after-free in have_mon_and_osd_map()

Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
    net: dsa: microchip: ptp: Fix checks on irq_find_mapping()

Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
    net: dsa: microchip: common: Fix checks on irq_find_mapping()

Alex Hung <alex.hung@amd.com>
    drm/amd/display: Check NULL before accessing

Johan Hovold <johan@kernel.org>
    drm: sti: fix device leaks at component probe

Vanillan Wang <vanillanwang@163.com>
    USB: serial: option: add support for Rolling RW101R-GL

Oleksandr Suvorov <cryosay@gmail.com>
    USB: serial: ftdi_sio: add support for u-blox EVK-M101

Łukasz Bartosik <ukaszb@chromium.org>
    xhci: dbgtty: fix device unregister

Mathias Nyman <mathias.nyman@linux.intel.com>
    xhci: dbgtty: Fix data corruption when transmitting data form DbC to host

Manish Nagar <manish.nagar@oss.qualcomm.com>
    usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

Heikki Krogerus <heikki.krogerus@linux.intel.com>
    usb: dwc3: pci: Sort out the Intel device IDs

Heikki Krogerus <heikki.krogerus@linux.intel.com>
    usb: dwc3: pci: add support for the Intel Nova Lake -S

Owen Gu <guhuinan@xiaomi.com>
    usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer

Tianchu Chen <flynnnchen@tencent.com>
    usb: storage: sddr55: Reject out-of-bound new_pba

Alan Stern <stern@rowland.harvard.edu>
    USB: storage: Remove subclass and protocol overrides from Novatek quirk

Desnes Nunes <desnesn@redhat.com>
    usb: storage: Fix memory leak in USB bulk transport

Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
    usb: renesas_usbhs: Fix synchronous external abort on unbind

Kuen-Han Tsai <khtsai@google.com>
    usb: gadget: f_eem: Fix memory leak in eem_unwrap

Miaoqian Lin <linmq006@gmail.com>
    usb: cdns3: Fix double resource release in cdns3_pci_probe

Johan Hovold <johan@kernel.org>
    most: usb: fix double free on late probe failure

Miaoqian Lin <linmq006@gmail.com>
    serial: amba-pl011: prefer dma_mapping_error() over explicit address checking

Paolo Abeni <pabeni@redhat.com>
    mptcp: clear scheduled subflows on retransmit

Khairul Anuar Romli <khairul.anuar.romli@altera.com>
    firmware: stratix10-svc: fix bug in saving controller data

Miaoqian Lin <linmq006@gmail.com>
    slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves

Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
    thunderbolt: Add support for Intel Wildcat Lake

Paulo Alcantara <pc@manguebit.org>
    smb: client: fix memory leak in cifs_construct_tcon()

Jamie Iles <jamie.iles@oss.qualcomm.com>
    drivers/usb/dwc3: fix PCI parent check

Mikulas Patocka <mpatocka@redhat.com>
    dm-verity: fix unreliable memory allocation

Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
    ceph: fix crash in process_v2_sparse_read() for encrypted directories

Marc Kleine-Budde <mkl@pengutronix.de>
    can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling

Thomas Mühlbacher <tmuehlbacher@posteo.net>
    can: sja1000: fix max irq loop handling

Gui-Dong Han <hanguidong02@gmail.com>
    atm/fore200e: Fix possible data race in fore200e_open()

Maarten Zanders <maarten@zanders.be>
    ARM: dts: nxp: imx6ul: correct SAI3 interrupt line

Ivan Zhaldak <i.v.zhaldak@gmail.com>
    ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230

Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow

Maciej W. Rozycki <macro@orcam.me.uk>
    MIPS: mm: Prevent a TLB shutdown on initial uniquification

David Lechner <dlechner@baylibre.com>
    iio: adc: ad7280a: fix ad7280_store_balance_timer()

Valek Andrej <andrej.v@skyrain.eu>
    iio: accel: fix ADXL355 startup race condition

Linus Walleij <linus.walleij@linaro.org>
    iio: accel: bmc150: Fix irq assumption regression

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    iio:common:ssp_sensors: Fix an error handling path ssp_probe()

Francesco Lavra <flavra@baylibre.com>
    iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields

Jiri Olsa <jolsa@kernel.org>
    Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"

Hang Zhou <929513338@qq.com>
    spi: bcm63xx: fix premature CS deassertion on RX-only transactions

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    spi: nxp-fspi: Propagate fwnode in ACPI case as well

Miquel Raynal <miquel.raynal@bootlin.com>
    spi: nxp-fspi: Support per spi-mem operation frequency switches

Miquel Raynal <miquel.raynal@bootlin.com>
    spi: spi-mem: Add a new controller capability

Miquel Raynal <miquel.raynal@bootlin.com>
    spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency

Tudor Ambarus <tudor.ambarus@linaro.org>
    spi: spi-mem: Allow specifying the byte order in Octal DTR mode

Haotian Zhang <vulab@iscas.ac.cn>
    spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors

Francesco Lavra <flavra@baylibre.com>
    spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA

Jamie Iles <jamie.iles@oss.qualcomm.com>
    mailbox: pcc: don't zero error register

Sudeep Holla <sudeep.holla@arm.com>
    mailbox: pcc: Refactor error handling in irq handler into separate function

Haotian Zhang <vulab@iscas.ac.cn>
    mailbox: mailbox-test: Fix debugfs_create_dir error checking

Haotian Zhang <vulab@iscas.ac.cn>
    usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors

Mario Tesi <martepisa@gmail.com>
    iio: st_lsm6dsx: Fixed calibrated timestamp calculation

Wei Fang <wei.fang@nxp.com>
    net: fec: do not register PPS event for PEROUT

Wei Fang <wei.fang@nxp.com>
    net: fec: do not allow enabling PPS and PEROUT simultaneously

Wei Fang <wei.fang@nxp.com>
    net: fec: do not update PEROUT if it is enabled

Wei Fang <wei.fang@nxp.com>
    net: fec: cancel perout_timer when PEROUT is disabled

Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
    net: atlantic: fix fragment overflow handling in RX path

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    net: dsa: sja1105: simplify static configuration reload

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: fix cyan_skillfish2 gpu info fw handling

Alexey Kodanev <aleksei.kodanev@bell-sw.com>
    net: sxgbe: fix potential NULL dereference in sxgbe_rx()

Danielle Costantino <dcostantino@meta.com>
    net/mlx5e: Fix validation logic in rate limiting

Horatiu Vultur <horatiu.vultur@microchip.com>
    net: lan966x: Fix the initialization of taprio

Kai-Heng Feng <kaihengf@nvidia.com>
    net: aquantia: Add missing descriptor cache invalidation on ATL2

Dan Carpenter <dan.carpenter@linaro.org>
    platform/x86: intel: punit_ipc: fix memory corruption

Daniel Golle <daniel@makrotopia.org>
    net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: SMP: Fix not generating mackey and ltk when repairing

Edward Adam Davis <eadavis@qq.com>
    Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

Marc Kleine-Budde <mkl@pengutronix.de>
    can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

Marc Kleine-Budde <mkl@pengutronix.de>
    can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header

Marc Kleine-Budde <mkl@pengutronix.de>
    can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs

Seungjin Bae <eeodqql09@gmail.com>
    can: kvaser_usb: leaf: Fix potential infinite loop in command parsers


-------------

Diffstat:

 MAINTAINERS                                        |    6 -
 Makefile                                           |    4 +-
 arch/arm/boot/dts/nxp/imx/imx6ul.dtsi              |    2 +-
 arch/mips/mm/tlb-r4k.c                             |  118 +-
 arch/x86/events/core.c                             |   10 +-
 drivers/atm/fore200e.c                             |    2 +
 drivers/firmware/stratix10-svc.c                   |    7 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |    2 +
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c    |   11 +-
 drivers/gpu/drm/sti/sti_vtg.c                      |    7 +-
 drivers/hid/hid-core.c                             |    7 +-
 drivers/iio/accel/adxl355_core.c                   |   44 +-
 drivers/iio/accel/bmc150-accel-core.c              |    5 +
 drivers/iio/accel/bmc150-accel.h                   |    1 +
 drivers/iio/adc/ad7280a.c                          |    2 +-
 drivers/iio/adc/rtq6056.c                          |    2 +-
 drivers/iio/common/ssp_sensors/ssp_dev.c           |    4 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h            |   40 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   19 +-
 drivers/mailbox/mailbox-test.c                     |    2 +-
 drivers/mailbox/pcc.c                              |   32 +-
 drivers/md/dm-verity-fec.c                         |    6 +-
 drivers/most/most_usb.c                            |   14 +-
 drivers/mtd/nand/spi/core.c                        |    2 +
 drivers/net/bonding/bond_main.c                    |   11 +-
 drivers/net/bonding/bond_options.c                 |    3 +
 drivers/net/can/rcar/rcar_canfd.c                  |   53 +-
 drivers/net/can/sja1000/sja1000.c                  |    4 +-
 drivers/net/can/sun4i_can.c                        |    4 +-
 drivers/net/can/usb/gs_usb.c                       |  102 +-
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c   |    4 +-
 drivers/net/dsa/microchip/ksz_common.c             |   30 +-
 drivers/net/dsa/microchip/ksz_ptp.c                |   22 +-
 drivers/net/dsa/sja1105/sja1105_main.c             |   66 +-
 .../net/ethernet/aquantia/atlantic/aq_hw_utils.c   |   22 +
 .../net/ethernet/aquantia/atlantic/aq_hw_utils.h   |    1 +
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c   |    5 +
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c  |   19 +-
 .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c   |    2 +-
 drivers/net/ethernet/cadence/macb_main.c           |    2 +-
 drivers/net/ethernet/freescale/fec.h               |    1 +
 drivers/net/ethernet/freescale/fec_ptp.c           |   64 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |    2 +-
 .../net/ethernet/microchip/lan966x/lan966x_ptp.c   |    5 +-
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c    |    4 +-
 drivers/net/phy/mxl-gpy.c                          |    2 +-
 drivers/platform/x86/intel/punit_ipc.c             |    2 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |    1 +
 drivers/spi/Kconfig                                |    4 +-
 drivers/spi/spi-amlogic-spifc-a1.c                 |    4 +-
 drivers/spi/spi-bcm63xx.c                          |   14 +
 drivers/spi/spi-mem.c                              |   37 +
 drivers/spi/spi-nxp-fspi.c                         |   22 +-
 drivers/staging/Kconfig                            |    2 -
 drivers/staging/Makefile                           |    1 -
 drivers/staging/rtl8712/Kconfig                    |   21 -
 drivers/staging/rtl8712/Makefile                   |   35 -
 drivers/staging/rtl8712/TODO                       |   13 -
 drivers/staging/rtl8712/basic_types.h              |   28 -
 drivers/staging/rtl8712/drv_types.h                |  175 --
 drivers/staging/rtl8712/ethernet.h                 |   21 -
 drivers/staging/rtl8712/hal_init.c                 |  401 ----
 drivers/staging/rtl8712/ieee80211.c                |  415 ----
 drivers/staging/rtl8712/ieee80211.h                |  165 --
 drivers/staging/rtl8712/mlme_linux.c               |  160 --
 drivers/staging/rtl8712/mlme_osdep.h               |   31 -
 drivers/staging/rtl8712/mp_custom_oid.h            |  287 ---
 drivers/staging/rtl8712/os_intfs.c                 |  482 ----
 drivers/staging/rtl8712/osdep_intf.h               |   32 -
 drivers/staging/rtl8712/osdep_service.h            |   60 -
 drivers/staging/rtl8712/recv_linux.c               |  139 --
 drivers/staging/rtl8712/recv_osdep.h               |   39 -
 drivers/staging/rtl8712/rtl8712_bitdef.h           |   26 -
 drivers/staging/rtl8712/rtl8712_cmd.c              |  409 ----
 drivers/staging/rtl8712/rtl8712_cmd.h              |  231 --
 drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h   |   95 -
 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h   |   19 -
 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h |   41 -
 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h |   32 -
 .../staging/rtl8712/rtl8712_edcasetting_bitdef.h   |   65 -
 .../staging/rtl8712/rtl8712_edcasetting_regdef.h   |   24 -
 drivers/staging/rtl8712/rtl8712_efuse.c            |  564 -----
 drivers/staging/rtl8712/rtl8712_efuse.h            |   44 -
 drivers/staging/rtl8712/rtl8712_event.h            |   86 -
 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h  |  131 --
 drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h  |   61 -
 drivers/staging/rtl8712/rtl8712_gp_bitdef.h        |   68 -
 drivers/staging/rtl8712/rtl8712_gp_regdef.h        |   29 -
 drivers/staging/rtl8712/rtl8712_hal.h              |  142 --
 drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h |   44 -
 drivers/staging/rtl8712/rtl8712_io.c               |   99 -
 drivers/staging/rtl8712/rtl8712_led.c              | 1830 ---------------
 .../staging/rtl8712/rtl8712_macsetting_bitdef.h    |   31 -
 .../staging/rtl8712/rtl8712_macsetting_regdef.h    |   20 -
 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h |   39 -
 drivers/staging/rtl8712/rtl8712_powersave_regdef.h |   26 -
 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h  |   36 -
 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h  |   43 -
 drivers/staging/rtl8712/rtl8712_recv.c             | 1080 ---------
 drivers/staging/rtl8712/rtl8712_recv.h             |  145 --
 drivers/staging/rtl8712/rtl8712_regdef.h           |   32 -
 drivers/staging/rtl8712/rtl8712_security_bitdef.h  |   34 -
 drivers/staging/rtl8712/rtl8712_spec.h             |  121 -
 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h    |  163 --
 drivers/staging/rtl8712/rtl8712_syscfg_regdef.h    |   42 -
 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h  |   49 -
 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h  |   26 -
 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h      |   49 -
 drivers/staging/rtl8712/rtl8712_wmac_regdef.h      |   36 -
 drivers/staging/rtl8712/rtl8712_xmit.c             |  744 -------
 drivers/staging/rtl8712/rtl8712_xmit.h             |  108 -
 drivers/staging/rtl8712/rtl871x_cmd.c              |  796 -------
 drivers/staging/rtl8712/rtl871x_cmd.h              |  761 -------
 drivers/staging/rtl8712/rtl871x_debug.h            |  130 --
 drivers/staging/rtl8712/rtl871x_eeprom.c           |  220 --
 drivers/staging/rtl8712/rtl871x_eeprom.h           |   88 -
 drivers/staging/rtl8712/rtl871x_event.h            |  109 -
 drivers/staging/rtl8712/rtl871x_ht.h               |   33 -
 drivers/staging/rtl8712/rtl871x_io.c               |  147 --
 drivers/staging/rtl8712/rtl871x_io.h               |  236 --
 drivers/staging/rtl8712/rtl871x_ioctl.h            |   94 -
 drivers/staging/rtl8712/rtl871x_ioctl_linux.c      | 2330 --------------------
 drivers/staging/rtl8712/rtl871x_ioctl_rtl.c        |  519 -----
 drivers/staging/rtl8712/rtl871x_ioctl_rtl.h        |  109 -
 drivers/staging/rtl8712/rtl871x_ioctl_set.c        |  354 ---
 drivers/staging/rtl8712/rtl871x_ioctl_set.h        |   45 -
 drivers/staging/rtl8712/rtl871x_led.h              |  118 -
 drivers/staging/rtl8712/rtl871x_mlme.c             | 1710 --------------
 drivers/staging/rtl8712/rtl871x_mlme.h             |  205 --
 drivers/staging/rtl8712/rtl871x_mp.c               |  724 ------
 drivers/staging/rtl8712/rtl871x_mp.h               |  275 ---
 drivers/staging/rtl8712/rtl871x_mp_ioctl.c         |  883 --------
 drivers/staging/rtl8712/rtl871x_mp_ioctl.h         |  328 ---
 drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h    | 1034 ---------
 drivers/staging/rtl8712/rtl871x_pwrctrl.c          |  234 --
 drivers/staging/rtl8712/rtl871x_pwrctrl.h          |  113 -
 drivers/staging/rtl8712/rtl871x_recv.c             |  671 ------
 drivers/staging/rtl8712/rtl871x_recv.h             |  208 --
 drivers/staging/rtl8712/rtl871x_rf.h               |   55 -
 drivers/staging/rtl8712/rtl871x_security.c         | 1386 ------------
 drivers/staging/rtl8712/rtl871x_security.h         |  218 --
 drivers/staging/rtl8712/rtl871x_sta_mgt.c          |  263 ---
 drivers/staging/rtl8712/rtl871x_wlan_sme.h         |   35 -
 drivers/staging/rtl8712/rtl871x_xmit.c             | 1059 ---------
 drivers/staging/rtl8712/rtl871x_xmit.h             |  288 ---
 drivers/staging/rtl8712/sta_info.h                 |  132 --
 drivers/staging/rtl8712/usb_halinit.c              |  307 ---
 drivers/staging/rtl8712/usb_intf.c                 |  638 ------
 drivers/staging/rtl8712/usb_ops.c                  |  195 --
 drivers/staging/rtl8712/usb_ops.h                  |   38 -
 drivers/staging/rtl8712/usb_ops_linux.c            |  515 -----
 drivers/staging/rtl8712/usb_osintf.h               |   35 -
 drivers/staging/rtl8712/wifi.h                     |  196 --
 drivers/staging/rtl8712/wlan_bssdef.h              |  223 --
 drivers/staging/rtl8712/xmit_linux.c               |  181 --
 drivers/staging/rtl8712/xmit_osdep.h               |   52 -
 drivers/thunderbolt/nhi.c                          |    2 +
 drivers/thunderbolt/nhi.h                          |    1 +
 drivers/tty/serial/amba-pl011.c                    |    2 +-
 drivers/usb/cdns3/cdns3-pci-wrap.c                 |    5 +-
 drivers/usb/dwc3/core.c                            |    3 +-
 drivers/usb/dwc3/dwc3-pci.c                        |   82 +-
 drivers/usb/dwc3/ep0.c                             |    1 +
 drivers/usb/dwc3/gadget.c                          |    7 +
 drivers/usb/gadget/function/f_eem.c                |    7 +-
 drivers/usb/gadget/udc/core.c                      |   18 +-
 drivers/usb/gadget/udc/renesas_usbf.c              |    4 +-
 drivers/usb/gadget/udc/trace.h                     |    5 +
 drivers/usb/host/xhci-dbgcap.h                     |    1 +
 drivers/usb/host/xhci-dbgtty.c                     |   23 +-
 drivers/usb/renesas_usbhs/common.c                 |   14 +-
 drivers/usb/serial/ftdi_sio.c                      |    1 +
 drivers/usb/serial/ftdi_sio_ids.h                  |    1 +
 drivers/usb/serial/option.c                        |   10 +-
 drivers/usb/storage/sddr55.c                       |    6 +
 drivers/usb/storage/transport.c                    |   16 +
 drivers/usb/storage/uas.c                          |    5 +
 drivers/usb/storage/unusual_devs.h                 |    2 +-
 drivers/usb/typec/ucsi/psy.c                       |    5 +
 fs/nfsd/nfs4state.c                                |    6 +-
 fs/smb/client/connect.c                            |    1 +
 fs/smb/server/smb2pdu.c                            |    4 -
 include/linux/spi/spi-mem.h                        |   22 +-
 include/linux/usb/gadget.h                         |    5 +
 include/net/bonding.h                              |    1 +
 net/bluetooth/hci_sock.c                           |    2 +
 net/bluetooth/smp.c                                |   31 +-
 net/ceph/auth_x.c                                  |    2 +
 net/ceph/ceph_common.c                             |   53 +-
 net/ceph/debugfs.c                                 |   16 +-
 net/ceph/messenger_v2.c                            |   11 +-
 net/ceph/osdmap.c                                  |   18 +-
 net/mptcp/protocol.c                               |   48 +-
 sound/usb/quirks.c                                 |    3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   14 +-
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   21 +
 196 files changed, 914 insertions(+), 28087 deletions(-)

[PATCH 6.6 01/93] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Seungjin Bae <eeodqql09@gmail.com>

[ Upstream commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec ]

The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback`
functions contain logic to zero-length commands. These commands are used
to align data to the USB endpoint's wMaxPacketSize boundary.

The driver attempts to skip these placeholders by aligning the buffer
position `pos` to the next packet boundary using `round_up()` function.

However, if zero-length command is found exactly on a packet boundary
(i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up`
function will return the unchanged value of `pos`. This prevents `pos`
to be increased, causing an infinite loop in the parsing logic.

This patch fixes this in the function by using `pos + 1` instead.
This ensures that even if `pos` is on a boundary, the calculation is
based on `pos + 1`, forcing `round_up()` to always return the next
aligned boundary.

Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
index 23bd7574b1c7e..7b931953dadc4 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -611,7 +611,7 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
 			 * for further details.
 			 */
 			if (tmp->len == 0) {
-				pos = round_up(pos,
+				pos = round_up(pos + 1,
 					       le16_to_cpu
 						(dev->bulk_in->wMaxPacketSize));
 				continue;
@@ -1590,7 +1590,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,
 		 * number of events in case of a heavy rx load on the bus.
 		 */
 		if (cmd->len == 0) {
-			pos = round_up(pos, le16_to_cpu
+			pos = round_up(pos + 1, le16_to_cpu
 						(dev->bulk_in->wMaxPacketSize));
 			continue;
 		}
-- 
2.51.0

[PATCH 6.6 02/93] can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 516a0cd1c03fa266bb67dd87940a209fd4e53ce7 ]

The driver lacks the cleanup of failed transfers of URBs. This reduces the
number of available URBs per error by 1. This leads to reduced performance
and ultimately to a complete stop of the transmission.

If the sending of a bulk URB fails do proper cleanup:
- increase netdev stats
- mark the echo_sbk as free
- free the driver's context and do accounting
- wake the send queue

Closes: https://github.com/candle-usb/candleLight_fw/issues/187
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-1-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/gs_usb.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 9bd61fd8e5013..1ba6395a5a667 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -747,8 +747,21 @@ static void gs_usb_xmit_callback(struct urb *urb)
 	struct gs_can *dev = txc->dev;
 	struct net_device *netdev = dev->netdev;
 
-	if (urb->status)
-		netdev_info(netdev, "usb xmit fail %u\n", txc->echo_id);
+	if (!urb->status)
+		return;
+
+	if (urb->status != -ESHUTDOWN && net_ratelimit())
+		netdev_info(netdev, "failed to xmit URB %u: %pe\n",
+			    txc->echo_id, ERR_PTR(urb->status));
+
+	netdev->stats.tx_dropped++;
+	netdev->stats.tx_errors++;
+
+	can_free_echo_skb(netdev, txc->echo_id, NULL);
+	gs_free_tx_context(txc);
+	atomic_dec(&dev->active_tx_urbs);
+
+	netif_wake_queue(netdev);
 }
 
 static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
-- 
2.51.0

[PATCH 6.6 03/93] can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf ]

The driver expects to receive a struct gs_host_frame in
gs_usb_receive_bulk_callback().

Use struct_group to describe the header of the struct gs_host_frame and
check that we have at least received the header before accessing any
members of it.

To resubmit the URB, do not dereference the pointer chain
"dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since
"urb->context" contains "parent", it is always defined, while "dev" is not
defined if the URB it too short.

Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-2-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/gs_usb.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 1ba6395a5a667..e786616d167b8 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -259,13 +259,15 @@ struct canfd_quirk {
 } __packed;
 
 struct gs_host_frame {
-	u32 echo_id;
-	__le32 can_id;
+	struct_group(header,
+		u32 echo_id;
+		__le32 can_id;
 
-	u8 can_dlc;
-	u8 channel;
-	u8 flags;
-	u8 reserved;
+		u8 can_dlc;
+		u8 channel;
+		u8 flags;
+		u8 reserved;
+	);
 
 	union {
 		DECLARE_FLEX_ARRAY(struct classic_can, classic_can);
@@ -573,6 +575,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 	int rc;
 	struct net_device_stats *stats;
 	struct gs_host_frame *hf = urb->transfer_buffer;
+	unsigned int minimum_length;
 	struct gs_tx_context *txc;
 	struct can_frame *cf;
 	struct canfd_frame *cfd;
@@ -591,6 +594,15 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 		return;
 	}
 
+	minimum_length = sizeof(hf->header);
+	if (urb->actual_length < minimum_length) {
+		dev_err_ratelimited(&parent->udev->dev,
+				    "short read (actual_length=%u, minimum_length=%u)\n",
+				    urb->actual_length, minimum_length);
+
+		goto resubmit_urb;
+	}
+
 	/* device reports out of range channel id */
 	if (hf->channel >= parent->channel_cnt)
 		goto device_detach;
@@ -684,7 +696,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 resubmit_urb:
 	usb_fill_bulk_urb(urb, parent->udev,
 			  parent->pipe_in,
-			  hf, dev->parent->hf_size_rx,
+			  hf, parent->hf_size_rx,
 			  gs_usb_receive_bulk_callback, parent);
 
 	rc = usb_submit_urb(urb, GFP_ATOMIC);
-- 
2.51.0

[PATCH 6.6 04/93] can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 395d988f93861101ec89d0dd9e3b876ae9392a5b ]

The URB received in gs_usb_receive_bulk_callback() contains a struct
gs_host_frame. The length of the data after the header depends on the
gs_host_frame hf::flags and the active device features (e.g. time
stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have
at least received the required amount of data before accessing it. Only
copy the data to that skb that has actually been received.

Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de
[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/gs_usb.c | 59 +++++++++++++++++++++++++++++++++---
 1 file changed, 54 insertions(+), 5 deletions(-)

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index e786616d167b8..72997312c9567 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -258,6 +258,11 @@ struct canfd_quirk {
 	u8 quirk;
 } __packed;
 
+/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates
+ * a regular RX'ed CAN frame
+ */
+#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff
+
 struct gs_host_frame {
 	struct_group(header,
 		u32 echo_id;
@@ -567,6 +572,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb,
 	return len;
 }
 
+static unsigned int
+gs_usb_get_minimum_rx_length(const struct gs_can *dev, const struct gs_host_frame *hf,
+			     unsigned int *data_length_p)
+{
+	unsigned int minimum_length, data_length = 0;
+
+	if (hf->flags & GS_CAN_FLAG_FD) {
+		if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX)
+			data_length = can_fd_dlc2len(hf->can_dlc);
+
+		if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
+			/* timestamp follows data field of max size */
+			minimum_length = struct_size(hf, canfd_ts, 1);
+		else
+			minimum_length = sizeof(hf->header) + data_length;
+	} else {
+		if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX &&
+		    !(hf->can_id & cpu_to_le32(CAN_RTR_FLAG)))
+			data_length = can_cc_dlc2len(hf->can_dlc);
+
+		if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
+			/* timestamp follows data field of max size */
+			minimum_length = struct_size(hf, classic_can_ts, 1);
+		else
+			minimum_length = sizeof(hf->header) + data_length;
+	}
+
+	*data_length_p = data_length;
+	return minimum_length;
+}
+
 static void gs_usb_receive_bulk_callback(struct urb *urb)
 {
 	struct gs_usb *parent = urb->context;
@@ -575,7 +611,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 	int rc;
 	struct net_device_stats *stats;
 	struct gs_host_frame *hf = urb->transfer_buffer;
-	unsigned int minimum_length;
+	unsigned int minimum_length, data_length;
 	struct gs_tx_context *txc;
 	struct can_frame *cf;
 	struct canfd_frame *cfd;
@@ -618,20 +654,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 	if (!netif_running(netdev))
 		goto resubmit_urb;
 
-	if (hf->echo_id == -1) { /* normal rx */
+	minimum_length = gs_usb_get_minimum_rx_length(dev, hf, &data_length);
+	if (urb->actual_length < minimum_length) {
+		stats->rx_errors++;
+		stats->rx_length_errors++;
+
+		if (net_ratelimit())
+			netdev_err(netdev,
+				   "short read (actual_length=%u, minimum_length=%u)\n",
+				   urb->actual_length, minimum_length);
+
+		goto resubmit_urb;
+	}
+
+	if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) { /* normal rx */
 		if (hf->flags & GS_CAN_FLAG_FD) {
 			skb = alloc_canfd_skb(netdev, &cfd);
 			if (!skb)
 				return;
 
 			cfd->can_id = le32_to_cpu(hf->can_id);
-			cfd->len = can_fd_dlc2len(hf->can_dlc);
+			cfd->len = data_length;
 			if (hf->flags & GS_CAN_FLAG_BRS)
 				cfd->flags |= CANFD_BRS;
 			if (hf->flags & GS_CAN_FLAG_ESI)
 				cfd->flags |= CANFD_ESI;
 
-			memcpy(cfd->data, hf->canfd->data, cfd->len);
+			memcpy(cfd->data, hf->canfd->data, data_length);
 		} else {
 			skb = alloc_can_skb(netdev, &cf);
 			if (!skb)
@@ -640,7 +689,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 			cf->can_id = le32_to_cpu(hf->can_id);
 			can_frame_set_cc_len(cf, hf->can_dlc, dev->can.ctrlmode);
 
-			memcpy(cf->data, hf->classic_can->data, 8);
+			memcpy(cf->data, hf->classic_can->data, data_length);
 
 			/* ERROR frames tell us information about the controller */
 			if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)
-- 
2.51.0

[PATCH 6.6 05/93] Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Edward Adam Davis <eadavis@qq.com>

[ Upstream commit 89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392 ]

There is a potential race condition between sock bind and socket write
iter. bind may free the same cmd via mgmt_pending before write iter sends
the cmd, just as syzbot reported in UAF[1].

Here we use hci_dev_lock to synchronize the two, thereby avoiding the
UAF mentioned in [1].

[1]
syzbot reported:
BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316
Read of size 8 at addr ffff888077164818 by task syz.0.17/5989
Call Trace:
 mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316
 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918
 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:742
 sock_write_iter+0x279/0x360 net/socket.c:1195

Allocated by task 5989:
 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296
 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910
 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:742
 sock_write_iter+0x279/0x360 net/socket.c:1195

Freed by task 5991:
 mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]
 mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477
 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314

Fixes: 6fe26f694c82 ("Bluetooth: MGMT: Protect mgmt_pending list with its own lock")
Reported-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9aa47cd4633a3cf92a80
Tested-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index d2613bd3e6db0..8b3ef088ed14e 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1304,7 +1304,9 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
 			goto done;
 		}
 
+		hci_dev_lock(hdev);
 		mgmt_index_removed(hdev);
+		hci_dev_unlock(hdev);
 
 		err = hci_dev_open(hdev->id);
 		if (err) {
-- 
2.51.0

[PATCH 6.6 06/93] Bluetooth: SMP: Fix not generating mackey and ltk when repairing

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

[ Upstream commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 ]

The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
introduced a goto that bypasses the creation of temporary mackey and ltk
which are later used by the likes of DHKey Check step.

Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for
Just Works (LE SC)") which means confirm_hint is always set in case
JUST_WORKS so the branch checking for an existing LTK becomes pointless
as confirm_hint will always be set, so this just merge both cases of
malicious or legitimate devices to be confirmed before continuing with the
pairing procedure.

Link: https://github.com/bluez/bluez/issues/1622
Fixes: eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/smp.c | 31 +++++++------------------------
 1 file changed, 7 insertions(+), 24 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4c00bc50de811..e7ee13fe83a74 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2137,7 +2137,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 	struct smp_chan *smp = chan->data;
 	struct hci_conn *hcon = conn->hcon;
 	u8 *pkax, *pkbx, *na, *nb, confirm_hint;
-	u32 passkey;
+	u32 passkey = 0;
 	int err;
 
 	bt_dev_dbg(hcon->hdev, "conn %p", conn);
@@ -2189,24 +2189,6 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
 			     smp->prnd);
 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
-
-		/* Only Just-Works pairing requires extra checks */
-		if (smp->method != JUST_WORKS)
-			goto mackey_and_ltk;
-
-		/* If there already exists long term key in local host, leave
-		 * the decision to user space since the remote device could
-		 * be legitimate or malicious.
-		 */
-		if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
-				 hcon->role)) {
-			/* Set passkey to 0. The value can be any number since
-			 * it'll be ignored anyway.
-			 */
-			passkey = 0;
-			confirm_hint = 1;
-			goto confirm;
-		}
 	}
 
 mackey_and_ltk:
@@ -2227,11 +2209,12 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 	if (err)
 		return SMP_UNSPECIFIED;
 
-	confirm_hint = 0;
-
-confirm:
-	if (smp->method == JUST_WORKS)
-		confirm_hint = 1;
+	/* Always require user confirmation for Just-Works pairing to prevent
+	 * impersonation attacks, or in case of a legitimate device that is
+	 * repairing use the confirmation as acknowledgment to proceed with the
+	 * creation of new keys.
+	 */
+	confirm_hint = smp->method == JUST_WORKS ? 1 : 0;
 
 	err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
 					hcon->dst_type, passkey, confirm_hint);
-- 
2.51.0

[PATCH 6.6 07/93] net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Golle <daniel@makrotopia.org>

[ Upstream commit ec3803b5917b6ff2f86ea965d0985c95d8a85119 ]

As the interface mode doesn't need to be updated on PHYs connected with
USXGMII and integrated PHYs, gpy_update_interface() should just return 0
in these cases rather than -EINVAL which has wrongly been introduced by
commit 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface()
function return type"), as this breaks support for those PHYs.

Fixes: 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/f744f721a1fcc5e2e936428c62ff2c7d94d2a293.1763648168.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mxl-gpy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/mxl-gpy.c b/drivers/net/phy/mxl-gpy.c
index 034f5c4d03377..5868a0747097f 100644
--- a/drivers/net/phy/mxl-gpy.c
+++ b/drivers/net/phy/mxl-gpy.c
@@ -515,7 +515,7 @@ static int gpy_update_interface(struct phy_device *phydev)
 	/* Interface mode is fixed for USXGMII and integrated PHY */
 	if (phydev->interface == PHY_INTERFACE_MODE_USXGMII ||
 	    phydev->interface == PHY_INTERFACE_MODE_INTERNAL)
-		return -EINVAL;
+		return 0;
 
 	/* Automatically switch SERDES interface between SGMII and 2500-BaseX
 	 * according to speed. Disable ANEG in 2500-BaseX mode.
-- 
2.51.0

[PATCH 6.6 08/93] platform/x86: intel: punit_ipc: fix memory corruption

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@linaro.org>

[ Upstream commit 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 ]

This passes the address of the pointer "&punit_ipcdev" when the intent
was to pass the pointer itself "punit_ipcdev" (without the ampersand).
This means that the:

	complete(&ipcdev->cmd_complete);

in intel_punit_ioc() will write to a wrong memory address corrupting it.

Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/punit_ipc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/punit_ipc.c b/drivers/platform/x86/intel/punit_ipc.c
index cd0ba84cc8e4a..9e48229538a5e 100644
--- a/drivers/platform/x86/intel/punit_ipc.c
+++ b/drivers/platform/x86/intel/punit_ipc.c
@@ -283,7 +283,7 @@ static int intel_punit_ipc_probe(struct platform_device *pdev)
 	} else {
 		ret = devm_request_irq(&pdev->dev, irq, intel_punit_ioc,
 				       IRQF_NO_SUSPEND, "intel_punit_ipc",
-				       &punit_ipcdev);
+				       punit_ipcdev);
 		if (ret) {
 			dev_err(&pdev->dev, "Failed to request irq: %d\n", irq);
 			return ret;
-- 
2.51.0

[PATCH 6.6 09/93] net: aquantia: Add missing descriptor cache invalidation on ATL2

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kai-Heng Feng <kaihengf@nvidia.com>

[ Upstream commit 7526183cfdbe352c51c285762f0e15b7c428ea06 ]

ATL2 hardware was missing descriptor cache invalidation in hw_stop(),
causing SMMU translation faults during device shutdown and module removal:
[   70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received:
[   70.361893] arm-smmu-v3 arm-smmu-v3.5.auto:  0x0002060000000010
[   70.367948] arm-smmu-v3 arm-smmu-v3.5.auto:  0x0000020000000000
[   70.374002] arm-smmu-v3 arm-smmu-v3.5.auto:  0x00000000ff9bc000
[   70.380055] arm-smmu-v3 arm-smmu-v3.5.auto:  0x0000000000000000
[   70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0
[   70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0

Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after
driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning
hw cache it should be toggled") fixed cache invalidation for ATL B0, but
ATL2 was left with only interrupt disabling. This allowed hardware to
write to cached descriptors after DMA memory was unmapped, triggering
SMMU faults. Once cache invalidation is applied to ATL2, the translation
fault can't be observed anymore.

Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both
ATL B0 and ATL2 hw_stop() implementations for consistent behavior.

Fixes: e54dcf4bba3e ("net: atlantic: basic A2 init/deinit hw_ops")
Tested-by: Carol Soto <csoto@nvidia.com>
Signed-off-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120041537.62184-1-kaihengf@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/aquantia/atlantic/aq_hw_utils.c  | 22 +++++++++++++++++++
 .../ethernet/aquantia/atlantic/aq_hw_utils.h  |  1 +
 .../aquantia/atlantic/hw_atl/hw_atl_b0.c      | 19 +---------------
 .../aquantia/atlantic/hw_atl2/hw_atl2.c       |  2 +-
 4 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
index 1921741f7311d..18b08277d2e1a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
@@ -15,6 +15,7 @@
 
 #include "aq_hw.h"
 #include "aq_nic.h"
+#include "hw_atl/hw_atl_llh.h"
 
 void aq_hw_write_reg_bit(struct aq_hw_s *aq_hw, u32 addr, u32 msk,
 			 u32 shift, u32 val)
@@ -81,6 +82,27 @@ void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value)
 		lo_hi_writeq(value, hw->mmio + reg);
 }
 
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw)
+{
+	int err;
+	u32 val;
+
+	/* Invalidate Descriptor Cache to prevent writing to the cached
+	 * descriptors and to the data pointer of those descriptors
+	 */
+	hw_atl_rdm_rx_dma_desc_cache_init_tgl(hw);
+
+	err = aq_hw_err_from_flags(hw);
+	if (err)
+		goto err_exit;
+
+	readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
+				  hw, val, val == 1, 1000U, 10000U);
+
+err_exit:
+	return err;
+}
+
 int aq_hw_err_from_flags(struct aq_hw_s *hw)
 {
 	int err = 0;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
index ffa6e4067c211..d89c63d88e4a4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
@@ -35,6 +35,7 @@ u32 aq_hw_read_reg(struct aq_hw_s *hw, u32 reg);
 void aq_hw_write_reg(struct aq_hw_s *hw, u32 reg, u32 value);
 u64 aq_hw_read_reg64(struct aq_hw_s *hw, u32 reg);
 void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value);
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw);
 int aq_hw_err_from_flags(struct aq_hw_s *hw);
 int aq_hw_num_tcs(struct aq_hw_s *hw);
 int aq_hw_q_per_tc(struct aq_hw_s *hw);
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 54e70f07b5734..7b4814b3ba442 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -1198,26 +1198,9 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
 
 static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
 {
-	int err;
-	u32 val;
-
 	hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
 
-	/* Invalidate Descriptor Cache to prevent writing to the cached
-	 * descriptors and to the data pointer of those descriptors
-	 */
-	hw_atl_rdm_rx_dma_desc_cache_init_tgl(self);
-
-	err = aq_hw_err_from_flags(self);
-
-	if (err)
-		goto err_exit;
-
-	readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
-				  self, val, val == 1, 1000U, 10000U);
-
-err_exit:
-	return err;
+	return aq_hw_invalidate_descriptor_cache(self);
 }
 
 int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self, struct aq_ring_s *ring)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
index 220400a633f5e..a7bef9da823da 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
@@ -759,7 +759,7 @@ static int hw_atl2_hw_stop(struct aq_hw_s *self)
 {
 	hw_atl_b0_hw_irq_disable(self, HW_ATL2_INT_MASK);
 
-	return 0;
+	return aq_hw_invalidate_descriptor_cache(self);
 }
 
 static struct aq_stats_s *hw_atl2_utils_get_hw_stats(struct aq_hw_s *self)
-- 
2.51.0

[PATCH 6.6 10/93] net: lan966x: Fix the initialization of taprio

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Horatiu Vultur <horatiu.vultur@microchip.com>

[ Upstream commit 9780f535f8e0f20b4632b5a173ead71aa8f095d2 ]

To initialize the taprio block in lan966x, it is required to configure
the register REVISIT_DLY. The purpose of this register is to set the
delay before revisit the next gate and the value of this register depends
on the system clock. The problem is that the we calculated wrong the value
of the system clock period in picoseconds. The actual system clock is
~165.617754MHZ and this correspond to a period of 6038 pico seconds and
not 15125 as currently set.

Fixes: e462b2717380b4 ("net: lan966x: Add offload support for taprio")
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251121061411.810571-1-horatiu.vultur@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
index 87e5e81d40dc6..84f5b4410e48e 100644
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c
@@ -1,11 +1,14 @@
 // SPDX-License-Identifier: GPL-2.0+
 
 #include <linux/ptp_classify.h>
+#include <linux/units.h>
 
 #include "lan966x_main.h"
 #include "vcap_api.h"
 #include "vcap_api_client.h"
 
+#define LAN9X66_CLOCK_RATE	165617754
+
 #define LAN966X_MAX_PTP_ID	512
 
 /* Represents 1ppm adjustment in 2^59 format with 6.037735849ns as reference
@@ -1132,5 +1135,5 @@ void lan966x_ptp_rxtstamp(struct lan966x *lan966x, struct sk_buff *skb,
 u32 lan966x_ptp_get_period_ps(void)
 {
 	/* This represents the system clock period in picoseconds */
-	return 15125;
+	return PICO / LAN9X66_CLOCK_RATE;
 }
-- 
2.51.0

[PATCH 6.6 11/93] net/mlx5e: Fix validation logic in rate limiting

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Danielle Costantino <dcostantino@meta.com>

[ Upstream commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 ]

The rate limiting validation condition currently checks the output
variable max_bw_value[i] instead of the input value
maxrate->tc_maxrate[i]. This causes the validation to compare an
uninitialized or stale value rather than the actual requested rate.

The condition should check the input rate to properly validate against
the upper limit:

    } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {

This aligns with the pattern used in the first branch, which correctly
checks maxrate->tc_maxrate[i] against upper_limit_mbps.

The current implementation can lead to unreliable validation behavior:

- For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0
  from initialization, the GBPS path may be taken regardless of whether
  the actual rate is within bounds

- When processing multiple TCs (i > 0), max_bw_value[i] contains the
  value computed for the previous TC, affecting the validation logic

- The overflow check for rates exceeding 255 Gbps may not trigger
  consistently depending on previous array values

This patch ensures the validation correctly examines the requested rate
value for proper bounds checking.

Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps")
Signed-off-by: Danielle Costantino <dcostantino@meta.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 29e633e6dd3f0..e29a8ed7e7ac1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -619,7 +619,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
 						  MLX5E_100MB);
 			max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
 			max_bw_unit[i]  = MLX5_100_MBPS_UNIT;
-		} else if (max_bw_value[i] <= upper_limit_gbps) {
+		} else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {
 			max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
 						  MLX5E_1GB);
 			max_bw_unit[i]  = MLX5_GBPS_UNIT;
-- 
2.51.0

[PATCH 6.6 12/93] net: sxgbe: fix potential NULL dereference in sxgbe_rx()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>

[ Upstream commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 ]

Currently, when skb is null, the driver prints an error and then
dereferences skb on the next line.

To fix this, let's add a 'break' after the error message to switch
to sxgbe_rx_refill(), which is similar to the approach taken by the
other drivers in this particular case, e.g. calxeda with xgmac_rx().

Found during a code review.

Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 71439825ea4e0..d662679c29832 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1521,8 +1521,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit)
 
 		skb = priv->rxq[qnum]->rx_skbuff[entry];
 
-		if (unlikely(!skb))
+		if (unlikely(!skb)) {
 			netdev_err(priv->dev, "rx descriptor is not consistent\n");
+			break;
+		}
 
 		prefetch(skb->data - NET_IP_ALIGN);
 		priv->rxq[qnum]->rx_skbuff[entry] = NULL;
-- 
2.51.0

[PATCH 6.6 13/93] drm/amdgpu: fix cyan_skillfish2 gpu info fw handling

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

[ Upstream commit 7fa666ab07ba9e08f52f357cb8e1aad753e83ac6 ]

If the board supports IP discovery, we don't need to
parse the gpu info firmware.

Backport to 6.18.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4721
Fixes: fa819e3a7c1e ("drm/amdgpu: add support for cyan skillfish gpu_info")
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 5427e32fa3a0ba9a016db83877851ed277b065fb)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index b2a1dc193cb8f..c1b9333d7b78a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1941,6 +1941,8 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
 		chip_name = "navi12";
 		break;
 	case CHIP_CYAN_SKILLFISH:
+		if (adev->mman.discovery_bin)
+			return 0;
 		chip_name = "cyan_skillfish";
 		break;
 	}
-- 
2.51.0

[PATCH 6.6 14/93] net: dsa: sja1105: simplify static configuration reload

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

[ Upstream commit a18891b55703a45b700618ef40edd5e9aaecc345 ]

The static configuration reload saves the port speed in the static
configuration tables by first converting it from the internal
respresentation to the SPEED_xxx ethtool representation, and then
converts it back to restore the setting. This is because
sja1105_adjust_port_config() takes the speed as SPEED_xxx.

However, this is unnecessarily complex. If we split
sja1105_adjust_port_config() up, we can simply save and restore the
mac[port].speed member in the static configuration tables.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/E1svfMa-005ZIX-If@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: da62abaaa268 ("net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/sja1105/sja1105_main.c | 65 ++++++++++++++------------
 1 file changed, 34 insertions(+), 31 deletions(-)

diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 843e50b5a0ec5..0de73a6257f9a 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1261,29 +1261,11 @@ static int sja1105_parse_dt(struct sja1105_private *priv)
 	return rc;
 }
 
-/* Convert link speed from SJA1105 to ethtool encoding */
-static int sja1105_port_speed_to_ethtool(struct sja1105_private *priv,
-					 u64 speed)
-{
-	if (speed == priv->info->port_speed[SJA1105_SPEED_10MBPS])
-		return SPEED_10;
-	if (speed == priv->info->port_speed[SJA1105_SPEED_100MBPS])
-		return SPEED_100;
-	if (speed == priv->info->port_speed[SJA1105_SPEED_1000MBPS])
-		return SPEED_1000;
-	if (speed == priv->info->port_speed[SJA1105_SPEED_2500MBPS])
-		return SPEED_2500;
-	return SPEED_UNKNOWN;
-}
-
-/* Set link speed in the MAC configuration for a specific port. */
-static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
-				      int speed_mbps)
+static int sja1105_set_port_speed(struct sja1105_private *priv, int port,
+				  int speed_mbps)
 {
 	struct sja1105_mac_config_entry *mac;
-	struct device *dev = priv->ds->dev;
 	u64 speed;
-	int rc;
 
 	/* On P/Q/R/S, one can read from the device via the MAC reconfiguration
 	 * tables. On E/T, MAC reconfig tables are not readable, only writable.
@@ -1317,7 +1299,7 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
 		speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
 		break;
 	default:
-		dev_err(dev, "Invalid speed %iMbps\n", speed_mbps);
+		dev_err(priv->ds->dev, "Invalid speed %iMbps\n", speed_mbps);
 		return -EINVAL;
 	}
 
@@ -1329,11 +1311,31 @@ static int sja1105_adjust_port_config(struct sja1105_private *priv, int port,
 	 * we need to configure the PCS only (if even that).
 	 */
 	if (priv->phy_mode[port] == PHY_INTERFACE_MODE_SGMII)
-		mac[port].speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
+		speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
 	else if (priv->phy_mode[port] == PHY_INTERFACE_MODE_2500BASEX)
-		mac[port].speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
-	else
-		mac[port].speed = speed;
+		speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
+
+	mac[port].speed = speed;
+
+	return 0;
+}
+
+/* Write the MAC Configuration Table entry and, if necessary, the CGU settings,
+ * after a link speedchange for this port.
+ */
+static int sja1105_set_port_config(struct sja1105_private *priv, int port)
+{
+	struct sja1105_mac_config_entry *mac;
+	struct device *dev = priv->ds->dev;
+	int rc;
+
+	/* On P/Q/R/S, one can read from the device via the MAC reconfiguration
+	 * tables. On E/T, MAC reconfig tables are not readable, only writable.
+	 * We have to *know* what the MAC looks like.  For the sake of keeping
+	 * the code common, we'll use the static configuration tables as a
+	 * reasonable approximation for both E/T and P/Q/R/S.
+	 */
+	mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries;
 
 	/* Write to the dynamic reconfiguration tables */
 	rc = sja1105_dynamic_config_write(priv, BLK_IDX_MAC_CONFIG, port,
@@ -1383,7 +1385,8 @@ static void sja1105_mac_link_up(struct dsa_switch *ds, int port,
 {
 	struct sja1105_private *priv = ds->priv;
 
-	sja1105_adjust_port_config(priv, port, speed);
+	if (!sja1105_set_port_speed(priv, port, speed))
+		sja1105_set_port_config(priv, port);
 
 	sja1105_inhibit_tx(priv, BIT(port), false);
 }
@@ -2284,8 +2287,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
 {
 	struct ptp_system_timestamp ptp_sts_before;
 	struct ptp_system_timestamp ptp_sts_after;
-	int speed_mbps[SJA1105_MAX_NUM_PORTS];
 	u16 bmcr[SJA1105_MAX_NUM_PORTS] = {0};
+	u64 mac_speed[SJA1105_MAX_NUM_PORTS];
 	struct sja1105_mac_config_entry *mac;
 	struct dsa_switch *ds = priv->ds;
 	s64 t1, t2, t3, t4;
@@ -2298,14 +2301,13 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
 
 	mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries;
 
-	/* Back up the dynamic link speed changed by sja1105_adjust_port_config
+	/* Back up the dynamic link speed changed by sja1105_set_port_speed()
 	 * in order to temporarily restore it to SJA1105_SPEED_AUTO - which the
 	 * switch wants to see in the static config in order to allow us to
 	 * change it through the dynamic interface later.
 	 */
 	for (i = 0; i < ds->num_ports; i++) {
-		speed_mbps[i] = sja1105_port_speed_to_ethtool(priv,
-							      mac[i].speed);
+		mac_speed[i] = mac[i].speed;
 		mac[i].speed = priv->info->port_speed[SJA1105_SPEED_AUTO];
 
 		if (priv->xpcs[i])
@@ -2368,7 +2370,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv,
 		struct dw_xpcs *xpcs = priv->xpcs[i];
 		unsigned int neg_mode;
 
-		rc = sja1105_adjust_port_config(priv, i, speed_mbps[i]);
+		mac[i].speed = mac_speed[i];
+		rc = sja1105_set_port_config(priv, i);
 		if (rc < 0)
 			goto out;
 
-- 
2.51.0

[PATCH 6.6 15/93] net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit da62abaaa268357b1aa66b372ace562189a05df1 ]

When using the SGMII PCS as a fixed-link chip-to-chip connection, it is
easy to miss the fact that traffic passes only at 1G, since that's what
any normal such connection would use.

When using the SGMII PCS connected towards an on-board PHY or an SFP
module, it is immediately noticeable that when the link resolves to a
speed other than 1G, traffic from the MAC fails to pass: TX counters
increase, but nothing gets decoded by the other end, and no local RX
counters increase either.

Artificially lowering a fixed-link rate to speed = <100> makes us able
to see the same issue as in the case of having an SGMII PHY.

Some debugging shows that the XPCS configuration is A-OK, but that the
MAC Configuration Table entry for the port has the SPEED bits still set
to 1000Mbps, due to a special condition in the driver. Deleting that
condition, and letting the resolved link speed be programmed directly
into the MAC speed field, results in a functional link at all 3 speeds.

This piece of evidence, based on testing on both generations with SGMII
support (SJA1105S and SJA1110A) directly contradicts the statement from
the blamed commit that "the MAC is fixed at 1 Gbps and we need to
configure the PCS only (if even that)". Worse, that statement is not
backed by any documentation, and no one from NXP knows what it might
refer to.

I am unable to recall sufficient context regarding my testing from March
2020 to understand what led me to draw such a braindead and factually
incorrect conclusion. Yet, there is nothing of value regarding forcing
the MAC speed, either for SGMII or 2500Base-X (introduced at a later
stage), so remove all such logic.

Fixes: ffe10e679cec ("net: dsa: sja1105: Add support for the SGMII port")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20251122111324.136761-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/sja1105/sja1105_main.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 0de73a6257f9a..1acc5d912d161 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1307,14 +1307,7 @@ static int sja1105_set_port_speed(struct sja1105_private *priv, int port,
 	 * table, since this will be used for the clocking setup, and we no
 	 * longer need to store it in the static config (already told hardware
 	 * we want auto during upload phase).
-	 * Actually for the SGMII port, the MAC is fixed at 1 Gbps and
-	 * we need to configure the PCS only (if even that).
 	 */
-	if (priv->phy_mode[port] == PHY_INTERFACE_MODE_SGMII)
-		speed = priv->info->port_speed[SJA1105_SPEED_1000MBPS];
-	else if (priv->phy_mode[port] == PHY_INTERFACE_MODE_2500BASEX)
-		speed = priv->info->port_speed[SJA1105_SPEED_2500MBPS];
-
 	mac[port].speed = speed;
 
 	return 0;
-- 
2.51.0

[PATCH 6.6 16/93] net: atlantic: fix fragment overflow handling in RX path

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>

[ Upstream commit 5ffcb7b890f61541201461580bb6622ace405aec ]

The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)
fragments when handling large multi-descriptor packets. This causes an
out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.

The issue occurs because the driver doesn't check the total number of
fragments before calling skb_add_rx_frag(). When a packet requires more
than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.

Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
then all fragments are accounted for. And reusing the existing check to
prevent the overflow earlier in the code path.

This crash occurred in production with an Aquantia AQC113 10G NIC.

Stack trace from production environment:
```
RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0
Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89
ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90
c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48
89 fa 83
RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287
RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:
fffffffe0a0c8000
RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:
0000000000037a40
RBP: 0000000000000024 R08: 0000000000000000 R09:
0000000000000021
R10: 0000000000000848 R11: 0000000000000000 R12:
ffffa9bec02a8e24
R13: ffff925ad8615570 R14: 0000000000000000 R15:
ffff925b22e80a00
FS: 0000000000000000(0000)
GS:ffff925e47880000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:
0000000000f72ef0
PKRU: 55555554
Call Trace:
<IRQ>
aq_ring_rx_clean+0x175/0xe60 [atlantic]
? aq_ring_rx_clean+0x14d/0xe60 [atlantic]
? aq_ring_tx_clean+0xdf/0x190 [atlantic]
? kmem_cache_free+0x348/0x450
? aq_vec_poll+0x81/0x1d0 [atlantic]
? __napi_poll+0x28/0x1c0
? net_rx_action+0x337/0x420
```

Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS")
Changes in v4:
- Add Fixes: tag to satisfy patch validation requirements.

Changes in v3:
- Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
  then all fragments are accounted for.

Signed-off-by: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index f7433abd65915..3f004d08307fb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -547,6 +547,11 @@ static int __aq_ring_rx_clean(struct aq_ring_s *self, struct napi_struct *napi,
 
 		if (!buff->is_eop) {
 			unsigned int frag_cnt = 0U;
+
+			/* There will be an extra fragment */
+			if (buff->len > AQ_CFG_RX_HDR_SIZE)
+				frag_cnt++;
+
 			buff_ = buff;
 			do {
 				bool is_rsc_completed = true;
-- 
2.51.0

[PATCH 6.6 17/93] net: fec: cancel perout_timer when PEROUT is disabled

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Fang <wei.fang@nxp.com>

[ Upstream commit 50caa744689e505414673c20359b04aa918439e3 ]

The PEROUT allows the user to set a specified future time to output the
periodic signal. If the future time is far from the current time, the FEC
driver will use hrtimer to configure PEROUT one second before the future
time. However, the hrtimer will not be canceled if the PEROUT is disabled
before the hrtimer expires. So the PEROUT will be configured when the
hrtimer expires, which is not as expected. Therefore, cancel the hrtimer
in fec_ptp_pps_disable() to fix this issue.

Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20251125085210.1094306-2-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_ptp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 7f6b574320716..cb3f05da3eee6 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -498,6 +498,8 @@ static int fec_ptp_pps_disable(struct fec_enet_private *fep, uint channel)
 {
 	unsigned long flags;
 
+	hrtimer_cancel(&fep->perout_timer);
+
 	spin_lock_irqsave(&fep->tmreg_lock, flags);
 	writel(0, fep->hwp + FEC_TCSR(channel));
 	spin_unlock_irqrestore(&fep->tmreg_lock, flags);
-- 
2.51.0

[PATCH 6.6 18/93] net: fec: do not update PEROUT if it is enabled

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Fang <wei.fang@nxp.com>

[ Upstream commit e97faa0c20ea8840f45569ba434e30538fff8fc9 ]

If the previously set PEROUT is already active, updating it will cause
the new PEROUT to start immediately instead of at the specified time.
This is because fep->reload_period is updated whithout check whether
the PEROUT is enabled, and the old PEROUT is not disabled. Therefore,
the pulse period will be updated immediately in the pulse interrupt
handler fec_pps_interrupt().

Currently, the driver does not support directly updating PEROUT and it
will make the logic be more complicated. To fix the current issue, add
a check before enabling the PEROUT, the driver will return an error if
PEROUT is enabled. If users wants to update a new PEROUT, they should
disable the old PEROUT first.

Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20251125085210.1094306-3-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec.h     |  1 +
 drivers/net/ethernet/freescale/fec_ptp.c | 43 ++++++++++++++++++------
 2 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 733af928caffc..d80a8c07c0200 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -683,6 +683,7 @@ struct fec_enet_private {
 	unsigned int reload_period;
 	int pps_enable;
 	unsigned int next_counter;
+	bool perout_enable;
 	struct hrtimer perout_timer;
 	u64 perout_stime;
 
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index cb3f05da3eee6..a3853fccdc7b6 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -244,6 +244,7 @@ static int fec_ptp_pps_perout(struct fec_enet_private *fep)
 	 * the FEC_TCCR register in time and missed the start time.
 	 */
 	if (fep->perout_stime < curr_time + 100 * NSEC_PER_MSEC) {
+		fep->perout_enable = false;
 		dev_err(&fep->pdev->dev, "Current time is too close to the start time!\n");
 		spin_unlock_irqrestore(&fep->tmreg_lock, flags);
 		return -1;
@@ -501,6 +502,7 @@ static int fec_ptp_pps_disable(struct fec_enet_private *fep, uint channel)
 	hrtimer_cancel(&fep->perout_timer);
 
 	spin_lock_irqsave(&fep->tmreg_lock, flags);
+	fep->perout_enable = false;
 	writel(0, fep->hwp + FEC_TCSR(channel));
 	spin_unlock_irqrestore(&fep->tmreg_lock, flags);
 
@@ -532,6 +534,8 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,
 
 		return ret;
 	} else if (rq->type == PTP_CLK_REQ_PEROUT) {
+		u32 reload_period;
+
 		/* Reject requests with unsupported flags */
 		if (rq->perout.flags)
 			return -EOPNOTSUPP;
@@ -551,12 +555,14 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,
 			return -EOPNOTSUPP;
 		}
 
-		fep->reload_period = div_u64(period_ns, 2);
-		if (on && fep->reload_period) {
+		reload_period = div_u64(period_ns, 2);
+		if (on && reload_period) {
+			u64 perout_stime;
+
 			/* Convert 1588 timestamp to ns*/
 			start_time.tv_sec = rq->perout.start.sec;
 			start_time.tv_nsec = rq->perout.start.nsec;
-			fep->perout_stime = timespec64_to_ns(&start_time);
+			perout_stime = timespec64_to_ns(&start_time);
 
 			mutex_lock(&fep->ptp_clk_mutex);
 			if (!fep->ptp_clk_on) {
@@ -565,18 +571,35 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,
 				return -EOPNOTSUPP;
 			}
 			spin_lock_irqsave(&fep->tmreg_lock, flags);
+
+			if (fep->perout_enable) {
+				dev_err(&fep->pdev->dev,
+					"PEROUT has been enabled\n");
+				ret = -EBUSY;
+				goto unlock;
+			}
+
 			/* Read current timestamp */
 			curr_time = timecounter_read(&fep->tc);
-			spin_unlock_irqrestore(&fep->tmreg_lock, flags);
-			mutex_unlock(&fep->ptp_clk_mutex);
+			if (perout_stime <= curr_time) {
+				dev_err(&fep->pdev->dev,
+					"Start time must be greater than current time\n");
+				ret = -EINVAL;
+				goto unlock;
+			}
 
 			/* Calculate time difference */
-			delta = fep->perout_stime - curr_time;
+			delta = perout_stime - curr_time;
+			fep->reload_period = reload_period;
+			fep->perout_stime = perout_stime;
+			fep->perout_enable = true;
 
-			if (fep->perout_stime <= curr_time) {
-				dev_err(&fep->pdev->dev, "Start time must larger than current time!\n");
-				return -EINVAL;
-			}
+unlock:
+			spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+			mutex_unlock(&fep->ptp_clk_mutex);
+
+			if (ret)
+				return ret;
 
 			/* Because the timer counter of FEC only has 31-bits, correspondingly,
 			 * the time comparison register FEC_TCCR also only low 31 bits can be
-- 
2.51.0

[PATCH 6.6 19/93] net: fec: do not allow enabling PPS and PEROUT simultaneously

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Fang <wei.fang@nxp.com>

[ Upstream commit c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8 ]

In the current driver, PPS and PEROUT use the same channel to generate
the events, so they cannot be enabled at the same time. Otherwise, the
later configuration will overwrite the earlier configuration. Therefore,
when configuring PPS, the driver will check whether PEROUT is enabled.
Similarly, when configuring PEROUT, the driver will check whether PPS
is enabled.

Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20251125085210.1094306-4-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_ptp.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index a3853fccdc7b6..beb1d98fa741a 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -129,6 +129,12 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable)
 
 	spin_lock_irqsave(&fep->tmreg_lock, flags);
 
+	if (fep->perout_enable) {
+		spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+		dev_err(&fep->pdev->dev, "PEROUT is running");
+		return -EBUSY;
+	}
+
 	if (fep->pps_enable == enable) {
 		spin_unlock_irqrestore(&fep->tmreg_lock, flags);
 		return 0;
@@ -572,6 +578,12 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,
 			}
 			spin_lock_irqsave(&fep->tmreg_lock, flags);
 
+			if (fep->pps_enable) {
+				dev_err(&fep->pdev->dev, "PPS is running");
+				ret = -EBUSY;
+				goto unlock;
+			}
+
 			if (fep->perout_enable) {
 				dev_err(&fep->pdev->dev,
 					"PEROUT has been enabled\n");
-- 
2.51.0

[PATCH 6.6 20/93] net: fec: do not register PPS event for PEROUT

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wei Fang <wei.fang@nxp.com>

[ Upstream commit 9a060d0fac9e75524f72864adec6d8cdb70a5bca ]

There are currently two situations that can trigger the PTP interrupt,
one is the PPS event, the other is the PEROUT event. However, the irq
handler fec_pps_interrupt() does not check the irq event type and
directly registers a PPS event into the system, but the event may be
a PEROUT event. This is incorrect because PEROUT is an output signal,
while PPS is the input of the kernel PPS system. Therefore, add a check
for the event type, if pps_enable is true, it means that the current
event is a PPS event, and then the PPS event is registered.

Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20251125085210.1094306-5-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index beb1d98fa741a..4bb894b5afcb9 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -719,8 +719,11 @@ static irqreturn_t fec_pps_interrupt(int irq, void *dev_id)
 		fep->next_counter = (fep->next_counter + fep->reload_period) &
 				fep->cc.mask;
 
-		event.type = PTP_CLOCK_PPS;
-		ptp_clock_event(fep->ptp_clock, &event);
+		if (fep->pps_enable) {
+			event.type = PTP_CLOCK_PPS;
+			ptp_clock_event(fep->ptp_clock, &event);
+		}
+
 		return IRQ_HANDLED;
 	}
 
-- 
2.51.0

[PATCH 6.6 21/93] iio: st_lsm6dsx: Fixed calibrated timestamp calculation

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mario Tesi <martepisa@gmail.com>

[ Upstream commit 8abbf45fcda028c2c05ba38eb14ede9fa9e7341b ]

The calibrated timestamp is calculated from the nominal value using the
formula:
  ts_gain[ns] ≈ ts_sensitivity - (ts_trim_coeff * val) / 1000.

The values of ts_sensitivity and ts_trim_coeff are not the same for all
devices, so it is necessary to differentiate them based on the part name.
For the correct values please consult the relevant AN.

Fixes: cb3b6b8e1bc0 ("iio: imu: st_lsm6dsx: add odr calibration feature")
Signed-off-by: Mario Tesi <mario.tesi@st.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h      | 18 ++++++++++++++++++
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 19 ++++++++-----------
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
index c19237717e812..0f347684f6fc9 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
@@ -190,6 +190,22 @@ struct st_lsm6dsx_fifo_ops {
  * @fifo_en: Hw timer FIFO enable register info (addr + mask).
  * @decimator: Hw timer FIFO decimator register info (addr + mask).
  * @freq_fine: Difference in % of ODR with respect to the typical.
+ * @ts_sensitivity: Nominal timestamp sensitivity.
+ * @ts_trim_coeff: Coefficient for calculating the calibrated timestamp gain.
+ *                 This coefficient comes into play when linearizing the formula
+ *                 used to calculate the calibrated timestamp (please see the
+ *                 relevant formula in the AN for the specific IMU).
+ *                 For example, in the case of LSM6DSO we have:
+ *
+ *                  1 / (1 + x) ~= 1 - x (Taylor’s Series)
+ *                  ttrim[s] = 1 / (40000 * (1 + 0.0015 * val)) (from AN5192)
+ *                  ttrim[ns] ~= 25000 - 37.5 * val
+ *                  ttrim[ns] ~= 25000 - (37500 * val) / 1000
+ *
+ *                  so, replacing ts_sensitivity = 25000 and
+ *                  ts_trim_coeff = 37500
+ *
+ *                  ttrim[ns] ~= ts_sensitivity - (ts_trim_coeff * val) / 1000
  */
 struct st_lsm6dsx_hw_ts_settings {
 	struct st_lsm6dsx_reg timer_en;
@@ -197,6 +213,8 @@ struct st_lsm6dsx_hw_ts_settings {
 	struct st_lsm6dsx_reg fifo_en;
 	struct st_lsm6dsx_reg decimator;
 	u8 freq_fine;
+	u16 ts_sensitivity;
+	u16 ts_trim_coeff;
 };
 
 /**
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
index b6e6b1df8a618..6e42e0c659e0c 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
@@ -77,8 +77,6 @@
 
 #define ST_LSM6DSX_REG_WHOAMI_ADDR		0x0f
 
-#define ST_LSM6DSX_TS_SENSITIVITY		25000UL /* 25us */
-
 static const struct iio_chan_spec st_lsm6dsx_acc_channels[] = {
 	ST_LSM6DSX_CHANNEL_ACC(IIO_ACCEL, 0x28, IIO_MOD_X, 0),
 	ST_LSM6DSX_CHANNEL_ACC(IIO_ACCEL, 0x2a, IIO_MOD_Y, 1),
@@ -962,6 +960,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = {
 				.mask = GENMASK(7, 6),
 			},
 			.freq_fine = 0x63,
+			.ts_sensitivity = 25000,
+			.ts_trim_coeff = 37500,
 		},
 		.shub_settings = {
 			.page_mux = {
@@ -1175,6 +1175,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = {
 				.mask = GENMASK(7, 6),
 			},
 			.freq_fine = 0x63,
+			.ts_sensitivity = 25000,
+			.ts_trim_coeff = 37500,
 		},
 		.event_settings = {
 			.enable_reg = {
@@ -1350,6 +1352,8 @@ static const struct st_lsm6dsx_settings st_lsm6dsx_sensor_settings[] = {
 				.mask = GENMASK(7, 6),
 			},
 			.freq_fine = 0x4f,
+			.ts_sensitivity = 21701,
+			.ts_trim_coeff = 28212,
 		},
 		.shub_settings = {
 			.page_mux = {
@@ -2243,20 +2247,13 @@ static int st_lsm6dsx_init_hw_timer(struct st_lsm6dsx_hw *hw)
 	}
 
 	/* calibrate timestamp sensitivity */
-	hw->ts_gain = ST_LSM6DSX_TS_SENSITIVITY;
+	hw->ts_gain = ts_settings->ts_sensitivity;
 	if (ts_settings->freq_fine) {
 		err = regmap_read(hw->regmap, ts_settings->freq_fine, &val);
 		if (err < 0)
 			return err;
 
-		/*
-		 * linearize the AN5192 formula:
-		 * 1 / (1 + x) ~= 1 - x (Taylor’s Series)
-		 * ttrim[s] = 1 / (40000 * (1 + 0.0015 * val))
-		 * ttrim[ns] ~= 25000 - 37.5 * val
-		 * ttrim[ns] ~= 25000 - (37500 * val) / 1000
-		 */
-		hw->ts_gain -= ((s8)val * 37500) / 1000;
+		hw->ts_gain -= ((s8)val * ts_settings->ts_trim_coeff) / 1000;
 	}
 
 	return 0;
-- 
2.51.0

[PATCH 6.6 22/93] usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haotian Zhang <vulab@iscas.ac.cn>

[ Upstream commit 74851fbb6d647304f8a7dc491434d3a335ef4b8d ]

devm_pm_runtime_enable() can fail due to memory allocation.
The current code ignores its return value, potentially causing
pm_runtime_resume_and_get() to operate on uninitialized runtime
PM state.

Check the return value of devm_pm_runtime_enable() and return on failure.

Fixes: 3e6e14ffdea4 ("usb: gadget: udc: add Renesas RZ/N1 USBF controller support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Acked-by: Herve Codina <herve.codina@bootlin.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251124022215.1619-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/renesas_usbf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/renesas_usbf.c b/drivers/usb/gadget/udc/renesas_usbf.c
index 657f265ac7cc5..8463f681ae673 100644
--- a/drivers/usb/gadget/udc/renesas_usbf.c
+++ b/drivers/usb/gadget/udc/renesas_usbf.c
@@ -3262,7 +3262,9 @@ static int usbf_probe(struct platform_device *pdev)
 	if (IS_ERR(udc->regs))
 		return PTR_ERR(udc->regs);
 
-	devm_pm_runtime_enable(&pdev->dev);
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;
 	ret = pm_runtime_resume_and_get(&pdev->dev);
 	if (ret < 0)
 		return ret;
-- 
2.51.0

[PATCH 6.6 23/93] mailbox: mailbox-test: Fix debugfs_create_dir error checking

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haotian Zhang <vulab@iscas.ac.cn>

[ Upstream commit 3acf1028f5003731977f750a7070f3321a9cb740 ]

The debugfs_create_dir() function returns ERR_PTR() on error, not NULL.
The current null-check fails to catch errors.

Use IS_ERR() to correctly check for errors.

Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mailbox-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
index 22d6018ceec3c..6bdee87f30836 100644
--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -268,7 +268,7 @@ static int mbox_test_add_debugfs(struct platform_device *pdev,
 		return 0;
 
 	tdev->root_debugfs_dir = debugfs_create_dir(dev_name(&pdev->dev), NULL);
-	if (!tdev->root_debugfs_dir) {
+	if (IS_ERR(tdev->root_debugfs_dir)) {
 		dev_err(&pdev->dev, "Failed to create Mailbox debugfs\n");
 		return -EINVAL;
 	}
-- 
2.51.0

[PATCH 6.6 24/93] mailbox: pcc: Refactor error handling in irq handler into separate function

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sudeep Holla <sudeep.holla@arm.com>

[ Upstream commit 3a675f50415b95f2ae10bfd932e2154ba1a08ee7 ]

The existing error handling logic in pcc_mbox_irq() is intermixed with the
main flow of the function. The command complete check and the complete
complete update/acknowledgment are nicely factored into separate functions.

Moves error detection and clearing logic into a separate function called:
pcc_mbox_error_check_and_clear() by extracting error-handling logic from
pcc_mbox_irq().

This ensures error checking and clearing are handled separately and it
improves maintainability by keeping the IRQ handler focused on processing
events.

Acked-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Adam Young <admiyo@os.amperecomputing.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Stable-dep-of: ff0e4d4c97c9 ("mailbox: pcc: don't zero error register")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/pcc.c | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 49254d99a8ad6..bb977cf8ad423 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -269,6 +269,25 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
 	return !!val;
 }
 
+static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan)
+{
+	u64 val;
+	int ret;
+
+	ret = pcc_chan_reg_read(&pchan->error, &val);
+	if (ret)
+		return ret;
+
+	val &= pchan->error.status_mask;
+	if (val) {
+		val &= ~pchan->error.status_mask;
+		pcc_chan_reg_write(&pchan->error, val);
+		return -EIO;
+	}
+
+	return 0;
+}
+
 static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan)
 {
 	struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
@@ -309,8 +328,6 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
 {
 	struct pcc_chan_info *pchan;
 	struct mbox_chan *chan = p;
-	u64 val;
-	int ret;
 
 	pchan = chan->con_priv;
 
@@ -324,15 +341,8 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
 	if (!pcc_mbox_cmd_complete_check(pchan))
 		return IRQ_NONE;
 
-	ret = pcc_chan_reg_read(&pchan->error, &val);
-	if (ret)
+	if (pcc_mbox_error_check_and_clear(pchan))
 		return IRQ_NONE;
-	val &= pchan->error.status_mask;
-	if (val) {
-		val &= ~pchan->error.status_mask;
-		pcc_chan_reg_write(&pchan->error, val);
-		return IRQ_NONE;
-	}
 
 	/*
 	 * Clear this flag after updating interrupt ack register and just
-- 
2.51.0

[PATCH 6.6 25/93] mailbox: pcc: dont zero error register

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jamie Iles <jamie.iles@oss.qualcomm.com>

[ Upstream commit ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0 ]

The error status mask for a type 3/4 subspace is used for reading the
error status, and the bitwise inverse is used for clearing the error
with the intent being to preserve any of the non-error bits.  However,
we were previously applying the mask to extract the status and then
applying the inverse to the result which ended up clearing all bits.

Instead, store the inverse mask in the preserve mask and then use that
on the original value read from the error status so that only the error
is cleared.

Fixes: c45ded7e1135 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)")
Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com>
Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/pcc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index bb977cf8ad423..2b7d0bc920726 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -278,9 +278,8 @@ static int pcc_mbox_error_check_and_clear(struct pcc_chan_info *pchan)
 	if (ret)
 		return ret;
 
-	val &= pchan->error.status_mask;
-	if (val) {
-		val &= ~pchan->error.status_mask;
+	if (val & pchan->error.status_mask) {
+		val &= pchan->error.preserve_mask;
 		pcc_chan_reg_write(&pchan->error, val);
 		return -EIO;
 	}
@@ -673,7 +672,8 @@ static int pcc_parse_subspace_db_reg(struct pcc_chan_info *pchan,
 
 		ret = pcc_chan_reg_init(&pchan->error,
 					&pcct_ext->error_status_register,
-					0, 0, pcct_ext->error_status_mask,
+					~pcct_ext->error_status_mask, 0,
+					pcct_ext->error_status_mask,
 					"Error Status");
 	}
 	return ret;
-- 
2.51.0

[PATCH 6.6 26/93] spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Francesco Lavra <flavra@baylibre.com>

[ Upstream commit 3dcf44ab56e1d3ca3532083c0d5390b758e45b45 ]

This driver runs also on Tegra SoCs without a Tegra20 APB DMA controller
(e.g. Tegra234).
Remove the Kconfig dependency on TEGRA20_APB_DMA; in addition, amend the
help text to reflect the fact that this driver works on SoCs different from
Tegra114.

Fixes: bb9667d8187b ("arm64: tegra: Add SPI device tree nodes for Tegra234")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Link: https://patch.msgid.link/20251126095027.4102004-1-flavra@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 3ce0fd5df8e9c..cda333f226b66 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -1059,10 +1059,10 @@ config SPI_TEGRA210_QUAD
 
 config SPI_TEGRA114
 	tristate "NVIDIA Tegra114 SPI Controller"
-	depends on (ARCH_TEGRA && TEGRA20_APB_DMA) || COMPILE_TEST
+	depends on ARCH_TEGRA || COMPILE_TEST
 	depends on RESET_CONTROLLER
 	help
-	  SPI driver for NVIDIA Tegra114 SPI Controller interface. This controller
+	  SPI controller driver for NVIDIA Tegra114 and later SoCs. This controller
 	  is different than the older SoCs SPI controller and also register interface
 	  get changed with this controller.
 
-- 
2.51.0

[PATCH 6.6 27/93] spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haotian Zhang <vulab@iscas.ac.cn>

[ Upstream commit a90903c2a3c38bce475f46ea3f93dbf6a9971553 ]

devm_pm_runtime_enable() can fail due to memory allocation. The current
code ignores its return value, potentially causing runtime PM operations
to fail silently after autosuspend configuration.

Check the return value of devm_pm_runtime_enable() and return on failure.

Fixes: 909fac05b926 ("spi: add support for Amlogic A1 SPI Flash Controller")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251124015852.937-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-amlogic-spifc-a1.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-amlogic-spifc-a1.c b/drivers/spi/spi-amlogic-spifc-a1.c
index fadf6667cd51c..b430bca4f8bce 100644
--- a/drivers/spi/spi-amlogic-spifc-a1.c
+++ b/drivers/spi/spi-amlogic-spifc-a1.c
@@ -349,7 +349,9 @@ static int amlogic_spifc_a1_probe(struct platform_device *pdev)
 
 	pm_runtime_set_autosuspend_delay(spifc->dev, 500);
 	pm_runtime_use_autosuspend(spifc->dev);
-	devm_pm_runtime_enable(spifc->dev);
+	ret = devm_pm_runtime_enable(spifc->dev);
+	if (ret)
+		return ret;
 
 	ctrl->num_chipselect = 1;
 	ctrl->dev.of_node = pdev->dev.of_node;
-- 
2.51.0

[PATCH 6.6 28/93] spi: spi-mem: Allow specifying the byte order in Octal DTR mode

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tudor Ambarus <tudor.ambarus@linaro.org>

[ Upstream commit 030ace430afcf847f537227afceb22dfe8fb8fc8 ]

There are NOR flashes (Macronix) that swap the bytes on a 16-bit
boundary when configured in Octal DTR mode. The byte order of
16-bit words is swapped when read or written in Octal Double
Transfer Rate (DTR) mode compared to Single Transfer Rate (STR)
modes. If one writes D0 D1 D2 D3 bytes using 1-1-1 mode, and uses
8D-8D-8D SPI mode for reading, it will read back D1 D0 D3 D2.
Swapping the bytes may introduce some endianness problems. It can
affect the boot sequence if the entire boot sequence is not handled
in either 8D-8D-8D mode or 1-1-1 mode. Therefore, it is necessary
to swap the bytes back to ensure the same byte order as in STR modes.
Fortunately there are controllers that could swap the bytes back at
runtime, addressing the flash's endianness requirements. Provide a
way for the upper layers to specify the byte order in Octal DTR mode.

Merge Tudor's patch and add modifications for suiting newer version
of Linux kernel.

Suggested-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: JaimeLiao <jaimeliao@mxic.com.tw>
Signed-off-by: AlvinZhou <alvinzhou@mxic.com.tw>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240926141956.2386374-3-alvinzhou.tw@gmail.com
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mem.c       | 3 +++
 include/linux/spi/spi-mem.h | 8 +++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index edd7430d4c052..84b250703e138 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -172,6 +172,9 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
 		if (!spi_mem_controller_is_capable(ctlr, dtr))
 			return false;
 
+		if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
+			return false;
+
 		if (op->cmd.nbytes != 2)
 			return false;
 	} else {
diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h
index 6b0a7dc48a4b7..eed6e016d69cc 100644
--- a/include/linux/spi/spi-mem.h
+++ b/include/linux/spi/spi-mem.h
@@ -90,6 +90,8 @@ enum spi_mem_data_dir {
  * @data.buswidth: number of IO lanes used to send/receive the data
  * @data.dtr: whether the data should be sent in DTR mode or not
  * @data.ecc: whether error correction is required or not
+ * @data.swap16: whether the byte order of 16-bit words is swapped when read
+ *		 or written in Octal DTR mode compared to STR mode.
  * @data.dir: direction of the transfer
  * @data.nbytes: number of data bytes to send/receive. Can be zero if the
  *		 operation does not involve transferring data
@@ -124,7 +126,8 @@ struct spi_mem_op {
 		u8 buswidth;
 		u8 dtr : 1;
 		u8 ecc : 1;
-		u8 __pad : 6;
+		u8 swap16 : 1;
+		u8 __pad : 5;
 		enum spi_mem_data_dir dir;
 		unsigned int nbytes;
 		union {
@@ -295,10 +298,13 @@ struct spi_controller_mem_ops {
  * struct spi_controller_mem_caps - SPI memory controller capabilities
  * @dtr: Supports DTR operations
  * @ecc: Supports operations with error correction
+ * @swap16: Supports swapping bytes on a 16 bit boundary when configured in
+ *	    Octal DTR
  */
 struct spi_controller_mem_caps {
 	bool dtr;
 	bool ecc;
+	bool swap16;
 };
 
 #define spi_mem_controller_is_capable(ctlr, cap)	\
-- 
2.51.0

[PATCH 6.6 29/93] spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <miquel.raynal@bootlin.com>

[ Upstream commit 0fefeade90e74bc8f40ab0e460f483565c492e28 ]

In the spi subsystem, the bus frequency is derived as follows:
- the controller may expose a minimum and maximum operating frequency
- the hardware description, through the spi peripheral properties,
  advise what is the maximum acceptable frequency from a device/wiring
  point of view.
Transfers must be observed at a frequency which fits both (so in
practice, the lowest maximum).

Actually, this second point mixes two information and already takes the
lowest frequency among:
- what the spi device is capable of (what is written in the component
  datasheet)
- what the wiring allows (electromagnetic sensibility, crossovers,
  terminations, antenna effect, etc).

This logic works until spi devices are no longer capable of sustaining
their highest frequency regardless of the operation. Spi memories are
typically subject to such variation. Some devices are capable of
spitting their internally stored data (essentially in read mode) at a
very fast rate, typically up to 166MHz on Winbond SPI-NAND chips, using
"fast" commands. However, some of the low-end operations, such as
regular page read-from-cache commands, are more limited and can only be
executed at 54MHz at most. This is currently a problem in the SPI-NAND
subsystem. Another situation, even if not yet supported, will be with
DTR commands, when the data is latched on both edges of the clock. The
same chips as mentioned previously are in this case limited to
80MHz. Yet another example might be continuous reads, which, under
certain circumstances, can also run at most at 104 or 120MHz.

As a matter of fact, the "one frequency per chip" policy is outdated and
more fine grain configuration is needed: we need to allow per-operation
frequency limitations. So far, all datasheets I encountered advertise a
maximum default frequency, which need to be lowered for certain specific
operations. So based on the current infrastructure, we can still expect
firmware (device trees in general) to continued advertising the same
maximum speed which is a mix between the PCB limitations and the chip
maximum capability, and expect per-operation lower frequencies when this
is relevant.

Add a `struct spi_mem_op` member to carry this information. Not
providing this field explicitly from upper layers means that there is no
further constraint and the default spi device maximum speed will be
carried instead. The SPI_MEM_OP() macro is also expanded with an
optional frequency argument, because virtually all operations can be
subject to such a limitation, and this will allow for a smooth and
discrete transition.

For controller drivers which do not implement the spi-mem interface, the
per-transfer speed is also set acordingly to a lower (than the maximum
default) speed when relevant.

Acked-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20241224-winbond-6-11-rc1-quad-support-v2-1-ad218dbc406f@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/spi/core.c |  2 ++
 drivers/spi/spi-mem.c       | 28 ++++++++++++++++++++++++++++
 include/linux/spi/spi-mem.h | 12 +++++++++++-
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index ee61b2d882320..4c2776f52fee5 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -1044,6 +1044,8 @@ spinand_select_op_variant(struct spinand_device *spinand,
 			if (ret)
 				break;
 
+			spi_mem_adjust_op_freq(spinand->spimem, &op);
+
 			if (!spi_mem_supports_op(spinand->spimem, &op))
 				break;
 
diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index 84b250703e138..b73a659e268d6 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -187,6 +187,10 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
 			return false;
 	}
 
+	if (op->max_freq && mem->spi->controller->min_speed_hz &&
+	    op->max_freq < mem->spi->controller->min_speed_hz)
+		return false;
+
 	return spi_mem_check_buswidth(mem, op);
 }
 EXPORT_SYMBOL_GPL(spi_mem_default_supports_op);
@@ -321,6 +325,9 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 	u8 *tmpbuf;
 	int ret;
 
+	/* Make sure the operation frequency is correct before going futher */
+	spi_mem_adjust_op_freq(mem, (struct spi_mem_op *)op);
+
 	ret = spi_mem_check_op(op);
 	if (ret)
 		return ret;
@@ -363,6 +370,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 	xfers[xferpos].tx_buf = tmpbuf;
 	xfers[xferpos].len = op->cmd.nbytes;
 	xfers[xferpos].tx_nbits = op->cmd.buswidth;
+	xfers[xferpos].speed_hz = op->max_freq;
 	spi_message_add_tail(&xfers[xferpos], &msg);
 	xferpos++;
 	totalxferlen++;
@@ -377,6 +385,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 		xfers[xferpos].tx_buf = tmpbuf + 1;
 		xfers[xferpos].len = op->addr.nbytes;
 		xfers[xferpos].tx_nbits = op->addr.buswidth;
+		xfers[xferpos].speed_hz = op->max_freq;
 		spi_message_add_tail(&xfers[xferpos], &msg);
 		xferpos++;
 		totalxferlen += op->addr.nbytes;
@@ -388,6 +397,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 		xfers[xferpos].len = op->dummy.nbytes;
 		xfers[xferpos].tx_nbits = op->dummy.buswidth;
 		xfers[xferpos].dummy_data = 1;
+		xfers[xferpos].speed_hz = op->max_freq;
 		spi_message_add_tail(&xfers[xferpos], &msg);
 		xferpos++;
 		totalxferlen += op->dummy.nbytes;
@@ -403,6 +413,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 		}
 
 		xfers[xferpos].len = op->data.nbytes;
+		xfers[xferpos].speed_hz = op->max_freq;
 		spi_message_add_tail(&xfers[xferpos], &msg);
 		xferpos++;
 		totalxferlen += op->data.nbytes;
@@ -481,6 +492,23 @@ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
 }
 EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size);
 
+/**
+ * spi_mem_adjust_op_freq() - Adjust the frequency of a SPI mem operation to
+ *			      match controller, PCB and chip limitations
+ * @mem: the SPI memory
+ * @op: the operation to adjust
+ *
+ * Some chips have per-op frequency limitations and must adapt the maximum
+ * speed. This function allows SPI mem drivers to set @op->max_freq to the
+ * maximum supported value.
+ */
+void spi_mem_adjust_op_freq(struct spi_mem *mem, struct spi_mem_op *op)
+{
+	if (!op->max_freq || op->max_freq > mem->spi->max_speed_hz)
+		op->max_freq = mem->spi->max_speed_hz;
+}
+EXPORT_SYMBOL_GPL(spi_mem_adjust_op_freq);
+
 static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc,
 				      u64 offs, size_t len, void *buf)
 {
diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h
index eed6e016d69cc..cceebf8c78ba9 100644
--- a/include/linux/spi/spi-mem.h
+++ b/include/linux/spi/spi-mem.h
@@ -68,6 +68,9 @@ enum spi_mem_data_dir {
 	SPI_MEM_DATA_OUT,
 };
 
+#define SPI_MEM_OP_MAX_FREQ(__freq)				\
+	.max_freq = __freq
+
 /**
  * struct spi_mem_op - describes a SPI memory operation
  * @cmd.nbytes: number of opcode bytes (only 1 or 2 are valid). The opcode is
@@ -97,6 +100,9 @@ enum spi_mem_data_dir {
  *		 operation does not involve transferring data
  * @data.buf.in: input buffer (must be DMA-able)
  * @data.buf.out: output buffer (must be DMA-able)
+ * @max_freq: frequency limitation wrt this operation. 0 means there is no
+ *	      specific constraint and the highest achievable frequency can be
+ *	      attempted.
  */
 struct spi_mem_op {
 	struct {
@@ -135,14 +141,17 @@ struct spi_mem_op {
 			const void *out;
 		} buf;
 	} data;
+
+	unsigned int max_freq;
 };
 
-#define SPI_MEM_OP(__cmd, __addr, __dummy, __data)		\
+#define SPI_MEM_OP(__cmd, __addr, __dummy, __data, ...)		\
 	{							\
 		.cmd = __cmd,					\
 		.addr = __addr,					\
 		.dummy = __dummy,				\
 		.data = __data,					\
+		__VA_ARGS__					\
 	}
 
 /**
@@ -369,6 +378,7 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
 #endif /* CONFIG_SPI_MEM */
 
 int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op);
+void spi_mem_adjust_op_freq(struct spi_mem *mem, struct spi_mem_op *op);
 
 bool spi_mem_supports_op(struct spi_mem *mem,
 			 const struct spi_mem_op *op);
-- 
2.51.0

[PATCH 6.6 30/93] spi: spi-mem: Add a new controller capability

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <miquel.raynal@bootlin.com>

[ Upstream commit 1248c9b8d54120950fda10fbeb98fb8932b4d45c ]

There are spi devices with multiple frequency limitations depending on
the invoked command. We probably do not want to afford running at the
lowest supported frequency all the time, so if we want to get the most
of our hardware, we need to allow per-operation frequency limitations.

Among all the SPI memory controllers, I believe all are capable of
changing the spi frequency on the fly. Some of the drivers do not make
any frequency setup though. And some others will derive a per chip
prescaler value which will be used forever.

Actually changing the frequency on the fly is something new in Linux, so
we need to carefully flag the drivers which do and do not support it. A
controller capability is created for that, and the presence for this
capability will always be checked before accepting such pattern.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://patch.msgid.link/20241224-winbond-6-11-rc1-quad-support-v2-2-ad218dbc406f@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mem.c       | 6 ++++++
 include/linux/spi/spi-mem.h | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index b73a659e268d6..c581aa5fbf7cf 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -191,6 +191,12 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
 	    op->max_freq < mem->spi->controller->min_speed_hz)
 		return false;
 
+	if (op->max_freq &&
+	    op->max_freq < mem->spi->max_speed_hz) {
+		if (!spi_mem_controller_is_capable(ctlr, per_op_freq))
+			return false;
+	}
+
 	return spi_mem_check_buswidth(mem, op);
 }
 EXPORT_SYMBOL_GPL(spi_mem_default_supports_op);
diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h
index cceebf8c78ba9..6bd0b548bd1e9 100644
--- a/include/linux/spi/spi-mem.h
+++ b/include/linux/spi/spi-mem.h
@@ -309,11 +309,13 @@ struct spi_controller_mem_ops {
  * @ecc: Supports operations with error correction
  * @swap16: Supports swapping bytes on a 16 bit boundary when configured in
  *	    Octal DTR
+ * @per_op_freq: Supports per operation frequency switching
  */
 struct spi_controller_mem_caps {
 	bool dtr;
 	bool ecc;
 	bool swap16;
+	bool per_op_freq;
 };
 
 #define spi_mem_controller_is_capable(ctlr, cap)	\
-- 
2.51.0

[PATCH 6.6 31/93] spi: nxp-fspi: Support per spi-mem operation frequency switches

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miquel Raynal <miquel.raynal@bootlin.com>

[ Upstream commit 26851cf65ffca2d3a8d529a125e54cf0084d69e7 ]

Every ->exec_op() call correctly configures the spi bus speed to the
maximum allowed frequency for the memory using the constant spi default
parameter. Since we can now have per-operation constraints, let's use
the value that comes from the spi-mem operation structure instead. In
case there is no specific limitation for this operation, the default spi
device value will be given anyway.

The per-operation frequency capability is thus advertised to the spi-mem
core.

Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20241224-winbond-6-11-rc1-quad-support-v2-12-ad218dbc406f@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 40ad64ac25bb ("spi: nxp-fspi: Propagate fwnode in ACPI case as well")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-nxp-fspi.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
index 731504ec7ef8b..5d631f8c593e3 100644
--- a/drivers/spi/spi-nxp-fspi.c
+++ b/drivers/spi/spi-nxp-fspi.c
@@ -711,9 +711,10 @@ static void nxp_fspi_dll_calibration(struct nxp_fspi *f)
  * Value for rest of the CS FLSHxxCR0 register would be zero.
  *
  */
-static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi)
+static void nxp_fspi_select_mem(struct nxp_fspi *f, struct spi_device *spi,
+				const struct spi_mem_op *op)
 {
-	unsigned long rate = spi->max_speed_hz;
+	unsigned long rate = op->max_freq;
 	int ret;
 	uint64_t size_kb;
 
@@ -938,7 +939,7 @@ static int nxp_fspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 				   FSPI_STS0_ARB_IDLE, 1, POLL_TOUT, true);
 	WARN_ON(err);
 
-	nxp_fspi_select_mem(f, mem->spi);
+	nxp_fspi_select_mem(f, mem->spi, op);
 
 	nxp_fspi_prepare_lut(f, op);
 	/*
@@ -1156,6 +1157,10 @@ static const struct spi_controller_mem_ops nxp_fspi_mem_ops = {
 	.get_name = nxp_fspi_get_name,
 };
 
+static const struct spi_controller_mem_caps nxp_fspi_mem_caps = {
+	.per_op_freq = true,
+};
+
 static int nxp_fspi_probe(struct platform_device *pdev)
 {
 	struct spi_controller *ctlr;
@@ -1253,6 +1258,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	ctlr->bus_num = -1;
 	ctlr->num_chipselect = NXP_FSPI_MAX_CHIPSELECT;
 	ctlr->mem_ops = &nxp_fspi_mem_ops;
+	ctlr->mem_caps = &nxp_fspi_mem_caps;
 
 	nxp_fspi_default_setup(f);
 
-- 
2.51.0

[PATCH 6.6 32/93] spi: nxp-fspi: Propagate fwnode in ACPI case as well

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 40ad64ac25bb736740f895d99a4aebbda9b80991 ]

Propagate fwnode of the ACPI device to the SPI controller Linux device.
Currently only OF case propagates fwnode to the controller.

While at it, replace several calls to dev_fwnode() with a single one
cached in a local variable, and unify checks for fwnode type by using
is_*_node() APIs.

Fixes: 55ab8487e01d ("spi: spi-nxp-fspi: Add ACPI support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
Link: https://patch.msgid.link/20251126202501.2319679-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-nxp-fspi.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
index 5d631f8c593e3..ce110035a3597 100644
--- a/drivers/spi/spi-nxp-fspi.c
+++ b/drivers/spi/spi-nxp-fspi.c
@@ -1165,7 +1165,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 {
 	struct spi_controller *ctlr;
 	struct device *dev = &pdev->dev;
-	struct device_node *np = dev->of_node;
+	struct fwnode_handle *fwnode = dev_fwnode(dev);
 	struct resource *res;
 	struct nxp_fspi *f;
 	int ret;
@@ -1189,7 +1189,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, f);
 
 	/* find the resources - configuration register address space */
-	if (is_acpi_node(dev_fwnode(f->dev)))
+	if (is_acpi_node(fwnode))
 		f->iobase = devm_platform_ioremap_resource(pdev, 0);
 	else
 		f->iobase = devm_platform_ioremap_resource_byname(pdev, "fspi_base");
@@ -1200,7 +1200,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	}
 
 	/* find the resources - controller memory mapped space */
-	if (is_acpi_node(dev_fwnode(f->dev)))
+	if (is_acpi_node(fwnode))
 		res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
 	else
 		res = platform_get_resource_byname(pdev,
@@ -1216,7 +1216,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	f->memmap_phy_size = resource_size(res);
 
 	/* find the clocks */
-	if (dev_of_node(&pdev->dev)) {
+	if (is_of_node(fwnode)) {
 		f->clk_en = devm_clk_get(dev, "fspi_en");
 		if (IS_ERR(f->clk_en)) {
 			ret = PTR_ERR(f->clk_en);
@@ -1262,7 +1262,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 
 	nxp_fspi_default_setup(f);
 
-	ctlr->dev.of_node = np;
+	device_set_node(&ctlr->dev, fwnode);
 
 	ret = devm_spi_register_controller(&pdev->dev, ctlr);
 	if (ret)
-- 
2.51.0

[PATCH 6.6 33/93] spi: bcm63xx: fix premature CS deassertion on RX-only transactions

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hang Zhou <929513338@qq.com>

[ Upstream commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 ]

On BCM6358 (and also observed on BCM6368) the controller appears to
only generate as many SPI clocks as bytes that have been written into
the TX FIFO. For RX-only transfers the driver programs the transfer
length in SPI_MSG_CTL but does not write anything into the FIFO, so
chip select is deasserted early and the RX transfer segment is never
fully clocked in.

A concrete failing case is a three-transfer MAC address read from
SPI-NOR:
  - TX 0x03 (read command)
  - TX 3-byte address
  - RX 6 bytes (MAC)

In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works
because the driver uses prepend_len and writes dummy bytes into the
TX FIFO for the RX part.

Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only
segments so that the number of bytes written to the FIFO matches the
total message length seen by the controller.

Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up")

Signed-off-by: Hang Zhou <929513338@qq.com>
Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index a95badb7b7114..ba66fe9f1f543 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -247,6 +247,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first,
 
 		if (t->rx_buf) {
 			do_rx = true;
+
+			/*
+			 * In certain hardware implementations, there appears to be a
+			 * hidden accumulator that tracks the number of bytes written into
+			 * the hardware FIFO, and this accumulator overrides the length in
+			 * the SPI_MSG_CTL register.
+			 *
+			 * Therefore, for read-only transfers, we need to write some dummy
+			 * value into the FIFO to keep the accumulator tracking the correct
+			 * length.
+			 */
+			if (!t->tx_buf)
+				memset_io(bs->tx_io + len, 0xFF, t->len);
+
 			/* prepend is half-duplex write only */
 			if (t == first)
 				prepend_len = 0;
-- 
2.51.0

[PATCH 6.6 34/93] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Olsa <jolsa@kernel.org>

commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream.

This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3.

Currently we store initial stacktrace entry twice for non-HW ot_regs, which
means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel.

It's easy to reproduce this bpftrace:

  # bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }'
  Attaching 1 probe...

        bprm_execve+1767
        bprm_execve+1767
        do_execveat_common.isra.0+425
        __x64_sys_execve+56
        do_syscall_64+133
        entry_SYSCALL_64_after_hwframe+118

When perf_callchain_kernel calls unwind_start with first_frame, AFAICS
we do not skip regs->ip, but it's added as part of the unwind process.
Hence reverting the extra perf_callchain_store for non-hw regs leg.

I was not able to bisect this, so I'm not really sure why this was needed
in v5.2 and why it's not working anymore, but I could see double entries
as far as v5.10.

I did the test for both ORC and framepointer unwind with and without the
this fix and except for the initial entry the stacktraces are the same.

Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/core.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2769,13 +2769,13 @@ perf_callchain_kernel(struct perf_callch
 		return;
 	}
 
-	if (perf_callchain_store(entry, regs->ip))
-		return;
-
-	if (perf_hw_regs(regs))
+	if (perf_hw_regs(regs)) {
+		if (perf_callchain_store(entry, regs->ip))
+			return;
 		unwind_start(&state, current, regs, NULL);
-	else
+	} else {
 		unwind_start(&state, current, NULL, (void *)regs->sp);
+	}
 
 	for (; !unwind_done(&state); unwind_next_frame(&state)) {
 		addr = unwind_get_return_address(&state);

[PATCH 6.6 35/93] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Francesco Lavra <flavra@baylibre.com>

commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream.

The `decimator` and `batch` fields of struct st_lsm6dsx_settings
are arrays indexed by sensor type, not by sensor hardware
identifier; moreover, the `batch` field is only used for the
accelerometer and gyroscope.
Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to
ST_LSM6DSX_ID_MAX, and change the array size for `batch` from
ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id
definition so that the ST_LSM6DSX_ID_MAX value is usable within
the struct st_lsm6dsx_settings definition.

Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h |   22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
@@ -268,6 +268,15 @@ struct st_lsm6dsx_event_settings {
 	u8 wakeup_src_x_mask;
 };
 
+enum st_lsm6dsx_sensor_id {
+	ST_LSM6DSX_ID_GYRO,
+	ST_LSM6DSX_ID_ACC,
+	ST_LSM6DSX_ID_EXT0,
+	ST_LSM6DSX_ID_EXT1,
+	ST_LSM6DSX_ID_EXT2,
+	ST_LSM6DSX_ID_MAX
+};
+
 enum st_lsm6dsx_ext_sensor_id {
 	ST_LSM6DSX_ID_MAGN,
 };
@@ -353,23 +362,14 @@ struct st_lsm6dsx_settings {
 	struct st_lsm6dsx_odr_table_entry odr_table[2];
 	struct st_lsm6dsx_samples_to_discard samples_to_discard[2];
 	struct st_lsm6dsx_fs_table_entry fs_table[2];
-	struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID];
-	struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID];
+	struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX];
+	struct st_lsm6dsx_reg batch[2];
 	struct st_lsm6dsx_fifo_ops fifo_ops;
 	struct st_lsm6dsx_hw_ts_settings ts_settings;
 	struct st_lsm6dsx_shub_settings shub_settings;
 	struct st_lsm6dsx_event_settings event_settings;
 };
 
-enum st_lsm6dsx_sensor_id {
-	ST_LSM6DSX_ID_GYRO,
-	ST_LSM6DSX_ID_ACC,
-	ST_LSM6DSX_ID_EXT0,
-	ST_LSM6DSX_ID_EXT1,
-	ST_LSM6DSX_ID_EXT2,
-	ST_LSM6DSX_ID_MAX,
-};
-
 enum st_lsm6dsx_fifo_mode {
 	ST_LSM6DSX_FIFO_BYPASS = 0x0,
 	ST_LSM6DSX_FIFO_CONT = 0x6,

[PATCH 6.6 36/93] iio:common:ssp_sensors: Fix an error handling path ssp_probe()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

commit 21553258b94861a73d7f2cf15469d69240e1170d upstream.

If an error occurs after a successful mfd_add_devices() call, it should be
undone by a corresponding mfd_remove_devices() call, as already done in the
remove function.

Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/common/ssp_sensors/ssp_dev.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device *
 	ret = spi_setup(spi);
 	if (ret < 0) {
 		dev_err(&spi->dev, "Failed to setup spi\n");
-		return ret;
+		goto err_setup_spi;
 	}
 
 	data->fw_dl_state = SSP_FW_DL_STATE_NONE;
@@ -568,6 +568,8 @@ err_read_reg:
 err_setup_irq:
 	mutex_destroy(&data->pending_lock);
 	mutex_destroy(&data->comm_lock);
+err_setup_spi:
+	mfd_remove_devices(&spi->dev);
 
 	dev_err(&spi->dev, "Probe failed!\n");
 

[PATCH 6.6 37/93] iio: accel: bmc150: Fix irq assumption regression

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Walleij <linus.walleij@linaro.org>

commit 3aa385a9c75c09b59dcab2ff76423439d23673ab upstream.

The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual
  address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.

Cc: stable@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/bmc150-accel-core.c |    5 +++++
 drivers/iio/accel/bmc150-accel.h      |    1 +
 2 files changed, 6 insertions(+)

--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -569,6 +569,10 @@ static int bmc150_accel_set_interrupt(st
 	const struct bmc150_accel_interrupt_info *info = intr->info;
 	int ret;
 
+	/* We do not always have an IRQ */
+	if (data->irq <= 0)
+		return 0;
+
 	if (state) {
 		if (atomic_inc_return(&intr->users) > 1)
 			return 0;
@@ -1743,6 +1747,7 @@ int bmc150_accel_core_probe(struct devic
 	}
 
 	if (irq > 0) {
+		data->irq = irq;
 		ret = devm_request_threaded_irq(dev, irq,
 						bmc150_accel_irq_handler,
 						bmc150_accel_irq_thread_handler,
--- a/drivers/iio/accel/bmc150-accel.h
+++ b/drivers/iio/accel/bmc150-accel.h
@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id {
 
 struct bmc150_accel_data {
 	struct regmap *regmap;
+	int irq;
 	struct regulator_bulk_data regulators[2];
 	struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
 	struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];

[PATCH 6.6 38/93] iio: accel: fix ADXL355 startup race condition

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Valek Andrej <andrej.v@skyrain.eu>

commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 upstream.

There is an race-condition where device is not full working after SW reset.
Therefore it's necessary to wait some time after reset and verify shadow
registers values by reading and comparing the values before/after reset.
This mechanism is described in datasheet at least from revision D.

Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355")
Signed-off-by: Valek Andrej <andrej.v@skyrain.eu>
Signed-off-by: Kessler Markus <markus.kessler@hilti.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/adxl355_core.c |   44 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

--- a/drivers/iio/accel/adxl355_core.c
+++ b/drivers/iio/accel/adxl355_core.c
@@ -56,6 +56,8 @@
 #define  ADXL355_POWER_CTL_DRDY_MSK	BIT(2)
 #define ADXL355_SELF_TEST_REG		0x2E
 #define ADXL355_RESET_REG		0x2F
+#define ADXL355_BASE_ADDR_SHADOW_REG	0x50
+#define ADXL355_SHADOW_REG_COUNT	5
 
 #define ADXL355_DEVID_AD_VAL		0xAD
 #define ADXL355_DEVID_MST_VAL		0x1D
@@ -294,7 +296,12 @@ static void adxl355_fill_3db_frequency_t
 static int adxl355_setup(struct adxl355_data *data)
 {
 	unsigned int regval;
+	int retries = 5; /* the number is chosen based on empirical reasons */
 	int ret;
+	u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL);
+
+	if (!shadow_regs)
+		return -ENOMEM;
 
 	ret = regmap_read(data->regmap, ADXL355_DEVID_AD_REG, &regval);
 	if (ret)
@@ -321,14 +328,41 @@ static int adxl355_setup(struct adxl355_
 	if (regval != ADXL355_PARTID_VAL)
 		dev_warn(data->dev, "Invalid DEV ID 0x%02x\n", regval);
 
-	/*
-	 * Perform a software reset to make sure the device is in a consistent
-	 * state after start-up.
-	 */
-	ret = regmap_write(data->regmap, ADXL355_RESET_REG, ADXL355_RESET_CODE);
+	/* Read shadow registers to be compared after reset */
+	ret = regmap_bulk_read(data->regmap,
+			       ADXL355_BASE_ADDR_SHADOW_REG,
+			       shadow_regs, ADXL355_SHADOW_REG_COUNT);
 	if (ret)
 		return ret;
 
+	do {
+		if (--retries == 0) {
+			dev_err(data->dev, "Shadow registers mismatch\n");
+			return -EIO;
+		}
+
+		/*
+		 * Perform a software reset to make sure the device is in a consistent
+		 * state after start-up.
+		 */
+		ret = regmap_write(data->regmap, ADXL355_RESET_REG,
+				   ADXL355_RESET_CODE);
+		if (ret)
+			return ret;
+
+		/* Wait at least 5ms after software reset */
+		usleep_range(5000, 10000);
+
+		/* Read shadow registers for comparison */
+		ret = regmap_bulk_read(data->regmap,
+				       ADXL355_BASE_ADDR_SHADOW_REG,
+				       data->buffer.buf,
+				       ADXL355_SHADOW_REG_COUNT);
+		if (ret)
+			return ret;
+	} while (memcmp(shadow_regs, data->buffer.buf,
+			ADXL355_SHADOW_REG_COUNT));
+
 	ret = regmap_update_bits(data->regmap, ADXL355_POWER_CTL_REG,
 				 ADXL355_POWER_CTL_DRDY_MSK,
 				 FIELD_PREP(ADXL355_POWER_CTL_DRDY_MSK, 1));

[PATCH 6.6 39/93] iio: adc: ad7280a: fix ad7280_store_balance_timer()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Lechner <dlechner@baylibre.com>

commit bd886cdcbf9e746f61c74035a3acd42e9108e115 upstream.

Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places.

iio_str_to_fixpoint() has a bit of an unintuitive API where the
fract_mult parameter is the multiplier of the first decimal place as if
it was already an integer.  So to get 3 decimal places, fract_mult must
be 100 rather than 1000.

Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7280a.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/ad7280a.c
+++ b/drivers/iio/adc/ad7280a.c
@@ -540,7 +540,7 @@ static ssize_t ad7280_store_balance_time
 	int val, val2;
 	int ret;
 
-	ret = iio_str_to_fixpoint(buf, 1000, &val, &val2);
+	ret = iio_str_to_fixpoint(buf, 100, &val, &val2);
 	if (ret)
 		return ret;
 

[PATCH 6.6 40/93] MIPS: mm: Prevent a TLB shutdown on initial uniquification

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maciej W. Rozycki <macro@orcam.me.uk>

commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.

Depending on the particular CPU implementation a TLB shutdown may occur
if multiple matching entries are detected upon the execution of a TLBP
or the TLBWI/TLBWR instructions.  Given that we don't know what entries
we have been handed we need to be very careful with the initial TLB
setup and avoid all these instructions.

Therefore read all the TLB entries one by one with the TLBR instruction,
bypassing the content addressing logic, and truncate any large pages in
place so as to avoid a case in the second step where an incoming entry
for a large page at a lower address overlaps with a replacement entry
chosen at another index.  Then preinitialize the TLB using addresses
outside our usual unique range and avoiding clashes with any entries
received, before making the usual call to local_flush_tlb_all().

This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB
entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual
address).

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Cc: stable@vger.kernel.org
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> # Boston I6400, M5150 sim
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/mm/tlb-r4k.c |  102 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 64 insertions(+), 38 deletions(-)

--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -15,6 +15,7 @@
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
 #include <linux/export.h>
+#include <linux/sort.h>
 
 #include <asm/cpu.h>
 #include <asm/cpu-type.h>
@@ -506,55 +507,79 @@ static int __init set_ntlb(char *str)
 
 __setup("ntlb=", set_ntlb);
 
-/* Initialise all TLB entries with unique values */
+
+/* Comparison function for EntryHi VPN fields.  */
+static int r4k_vpn_cmp(const void *a, const void *b)
+{
+	long v = *(unsigned long *)a - *(unsigned long *)b;
+	int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0;
+	return s ? (v != 0) | v >> s : v;
+}
+
+/*
+ * Initialise all TLB entries with unique values that do not clash with
+ * what we have been handed over and what we'll be using ourselves.
+ */
 static void r4k_tlb_uniquify(void)
 {
-	int entry = num_wired_entries();
+	unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
+	int tlbsize = current_cpu_data.tlbsize;
+	int start = num_wired_entries();
+	unsigned long vpn_mask;
+	int cnt, ent, idx, i;
+
+	vpn_mask = GENMASK(cpu_vmbits - 1, 13);
+	vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
 
 	htw_stop();
-	write_c0_entrylo0(0);
-	write_c0_entrylo1(0);
 
-	while (entry < current_cpu_data.tlbsize) {
-		unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
-		unsigned long asid = 0;
-		int idx;
+	for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
+		unsigned long vpn;
 
-		/* Skip wired MMID to make ginvt_mmid work */
-		if (cpu_has_mmid)
-			asid = MMID_KERNEL_WIRED + 1;
+		write_c0_index(i);
+		mtc0_tlbr_hazard();
+		tlb_read();
+		tlb_read_hazard();
+		vpn = read_c0_entryhi();
+		vpn &= vpn_mask & PAGE_MASK;
+		tlb_vpns[cnt] = vpn;
 
-		/* Check for match before using UNIQUE_ENTRYHI */
-		do {
-			if (cpu_has_mmid) {
-				write_c0_memorymapid(asid);
-				write_c0_entryhi(UNIQUE_ENTRYHI(entry));
-			} else {
-				write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
-			}
-			mtc0_tlbw_hazard();
-			tlb_probe();
-			tlb_probe_hazard();
-			idx = read_c0_index();
-			/* No match or match is on current entry */
-			if (idx < 0 || idx == entry)
-				break;
-			/*
-			 * If we hit a match, we need to try again with
-			 * a different ASID.
-			 */
-			asid++;
-		} while (asid < asid_mask);
-
-		if (idx >= 0 && idx != entry)
-			panic("Unable to uniquify TLB entry %d", idx);
-
-		write_c0_index(entry);
+		/* Prevent any large pages from overlapping regular ones.  */
+		write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK);
 		mtc0_tlbw_hazard();
 		tlb_write_indexed();
-		entry++;
+		tlbw_use_hazard();
 	}
 
+	sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL);
+
+	write_c0_pagemask(PM_DEFAULT_MASK);
+	write_c0_entrylo0(0);
+	write_c0_entrylo1(0);
+
+	idx = 0;
+	ent = tlbsize;
+	for (i = start; i < tlbsize; i++)
+		while (1) {
+			unsigned long entryhi, vpn;
+
+			entryhi = UNIQUE_ENTRYHI(ent);
+			vpn = entryhi & vpn_mask & PAGE_MASK;
+
+			if (idx >= cnt || vpn < tlb_vpns[idx]) {
+				write_c0_entryhi(entryhi);
+				write_c0_index(i);
+				mtc0_tlbw_hazard();
+				tlb_write_indexed();
+				ent++;
+				break;
+			} else if (vpn == tlb_vpns[idx]) {
+				ent++;
+			} else {
+				idx++;
+			}
+		}
+
 	tlbw_use_hazard();
 	htw_start();
 	flush_micro_tlb();
@@ -600,6 +625,7 @@ static void r4k_tlb_configure(void)
 
 	/* From this point on the ARC firmware is dead.	 */
 	r4k_tlb_uniquify();
+	local_flush_tlb_all();
 
 	/* Did I tell you that ARC SUCKS?  */
 }

[PATCH 6.6 41/93] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.

Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+
cores can have more than 64 TLB entries.  Therefore allocate an array
for uniquification instead of placing too an small array on the stack.

Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Co-developed-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification
Cc: stable@vger.kernel.org # v6.17+
Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Tested-by: Klara Modin <klarasmodin@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/mm/tlb-r4k.c |   18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
+#include <linux/memblock.h>
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
 #include <linux/export.h>
@@ -520,17 +521,26 @@ static int r4k_vpn_cmp(const void *a, co
  * Initialise all TLB entries with unique values that do not clash with
  * what we have been handed over and what we'll be using ourselves.
  */
-static void r4k_tlb_uniquify(void)
+static void __ref r4k_tlb_uniquify(void)
 {
-	unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
 	int tlbsize = current_cpu_data.tlbsize;
+	bool use_slab = slab_is_available();
 	int start = num_wired_entries();
+	phys_addr_t tlb_vpn_size;
+	unsigned long *tlb_vpns;
 	unsigned long vpn_mask;
 	int cnt, ent, idx, i;
 
 	vpn_mask = GENMASK(cpu_vmbits - 1, 13);
 	vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
 
+	tlb_vpn_size = tlbsize * sizeof(*tlb_vpns);
+	tlb_vpns = (use_slab ?
+		    kmalloc(tlb_vpn_size, GFP_KERNEL) :
+		    memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns)));
+	if (WARN_ON(!tlb_vpns))
+		return; /* Pray local_flush_tlb_all() is good enough. */
+
 	htw_stop();
 
 	for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
@@ -583,6 +593,10 @@ static void r4k_tlb_uniquify(void)
 	tlbw_use_hazard();
 	htw_start();
 	flush_micro_tlb();
+	if (use_slab)
+		kfree(tlb_vpns);
+	else
+		memblock_free(tlb_vpns, tlb_vpn_size);
 }
 
 /*

[PATCH 6.6 42/93] ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ivan Zhaldak <i.v.zhaldak@gmail.com>

commit c83fc13960643c4429cd9dfef1321e6430a81b47 upstream.

Integrated amplifier LEAK Stereo 230 by IAG Limited has built-in
ESS9038Q2M DAC served by XMOS controller. It supports both DSD Native
and DSD-over-PCM (DoP) operational modes. But it doesn't work properly
by default and tries DSD-to-PCM conversion. USB quirks below allow it
to operate as designed.

Add DSD_RAW quirk flag for IAG Limited devices (vendor ID 0x2622)
Add DSD format quirk for LEAK Stereo 230 (USB ID 0x2622:0x0061)

Signed-off-by: Ivan Zhaldak <i.v.zhaldak@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251117125848.30769-1-i.v.zhaldak@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1928,6 +1928,7 @@ u64 snd_usb_interface_dsd_format_quirks(
 	case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */
 	case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
 	case USB_ID(0x2622, 0x0041): /* Audiolab M-DAC+ */
+	case USB_ID(0x2622, 0x0061): /* LEAK Stereo 230 */
 	case USB_ID(0x278b, 0x5100): /* Rotel RC-1590 */
 	case USB_ID(0x27f7, 0x3002): /* W4S DAC-2v2SE */
 	case USB_ID(0x29a2, 0x0086): /* Mutec MC3+ USB */
@@ -2311,6 +2312,8 @@ static const struct usb_audio_quirk_flag
 		   QUIRK_FLAG_DSD_RAW),
 	VENDOR_FLG(0x25ce, /* Mytek devices */
 		   QUIRK_FLAG_DSD_RAW),
+	VENDOR_FLG(0x2622, /* IAG Limited devices */
+		   QUIRK_FLAG_DSD_RAW),
 	VENDOR_FLG(0x278b, /* Rotel? */
 		   QUIRK_FLAG_DSD_RAW),
 	VENDOR_FLG(0x292b, /* Gustard/Ess based devices */

[PATCH 6.6 43/93] ARM: dts: nxp: imx6ul: correct SAI3 interrupt line

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maarten Zanders <maarten@zanders.be>

commit 1b03346314b791ad966d3c6d59253328226a2b2d upstream.

The i.MX6UL reference manual lists two possible interrupt lines for
SAI3 (56 and 57, offset +32). The current device tree entry uses
the first one (24), which prevents IRQs from being handled properly.

Use the second interrupt line (25), which does allow interrupts
to work as expected.

Fixes: 36e2edf6ac07 ("ARM: dts: imx6ul: add sai support")
Signed-off-by: Maarten Zanders <maarten@zanders.be>
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/nxp/imx/imx6ul.dtsi |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi
+++ b/arch/arm/boot/dts/nxp/imx/imx6ul.dtsi
@@ -333,7 +333,7 @@
 					#sound-dai-cells = <0>;
 					compatible = "fsl,imx6ul-sai", "fsl,imx6sx-sai";
 					reg = <0x02030000 0x4000>;
-					interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
+					interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
 					clocks = <&clks IMX6UL_CLK_SAI3_IPG>,
 						 <&clks IMX6UL_CLK_SAI3>,
 						 <&clks IMX6UL_CLK_DUMMY>, <&clks IMX6UL_CLK_DUMMY>;

[PATCH 6.6 44/93] atm/fore200e: Fix possible data race in fore200e_open()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <hanguidong02@gmail.com>

commit 82fca3d8a4a34667f01ec2351a607135249c9cff upstream.

Protect access to fore200e->available_cell_rate with rate_mtx lock in the
error handling path of fore200e_open() to prevent a data race.

The field fore200e->available_cell_rate is a shared resource used to track
available bandwidth. It is concurrently accessed by fore200e_open(),
fore200e_close(), and fore200e_change_qos().

In fore200e_open(), the lock rate_mtx is correctly held when subtracting
vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth.
However, if the subsequent call to fore200e_activate_vcin() fails, the
function restores the reserved bandwidth by adding back to
available_cell_rate without holding the lock.

This introduces a race condition because available_cell_rate is a global
device resource shared across all VCCs. If the error path in
fore200e_open() executes concurrently with operations like
fore200e_close() or fore200e_change_qos() on other VCCs, a
read-modify-write race occurs.

Specifically, the error path reads the rate without the lock. If another
CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in
fore200e_close()) between this read and the subsequent write, the error
path will overwrite the concurrent update with a stale value. This results
in incorrect bandwidth accounting.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/fore200e.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1377,7 +1377,9 @@ fore200e_open(struct atm_vcc *vcc)
 
 	vcc->dev_data = NULL;
 
+	mutex_lock(&fore200e->rate_mtx);
 	fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
+	mutex_unlock(&fore200e->rate_mtx);
 
 	kfree(fore200e_vcc);
 	return -EINVAL;

[PATCH 6.6 45/93] can: sja1000: fix max irq loop handling

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Mühlbacher <tmuehlbacher@posteo.net>

commit 30db4451c7f6aabcada029b15859a76962ec0cf8 upstream.

Reading the interrupt register `SJA1000_IR` causes all of its bits to be
reset. If we ever reach the condition of handling more than
`SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop
body.

This may, among other issues, cause us to never `netif_wake_queue()`
again after a transmission interrupt.

Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/sja1000/sja1000.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -548,8 +548,8 @@ irqreturn_t sja1000_interrupt(int irq, v
 	if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
 		goto out;
 
-	while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
-	       (n < SJA1000_MAX_IRQ)) {
+	while ((n < SJA1000_MAX_IRQ) &&
+	       (isrc = priv->read_reg(priv, SJA1000_IR))) {
 
 		status = priv->read_reg(priv, SJA1000_SR);
 		/* check for absent controller due to hw unplug */

[PATCH 6.6 46/93] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 upstream.

Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits
to be reset. If we ever reach the condition of handling more than
`SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop body.

This may, among other issues, cause us to never `netif_wake_queue()` again
after a transmission interrupt.

Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
Cc: stable@vger.kernel.org
Co-developed-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/sun4i_can.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -657,8 +657,8 @@ static irqreturn_t sun4i_can_interrupt(i
 	u8 isrc, status;
 	int n = 0;
 
-	while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) &&
-	       (n < SUN4I_CAN_MAX_IRQ)) {
+	while ((n < SUN4I_CAN_MAX_IRQ) &&
+	       (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) {
 		n++;
 		status = readl(priv->base + SUN4I_REG_STA_ADDR);
 

[PATCH 6.6 47/93] ceph: fix crash in process_v2_sparse_read() for encrypted directories

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>

commit 43962db4a6f593903340c85591056a0cef812dfd upstream.

The crash in process_v2_sparse_read() for fscrypt-encrypted directories
has been reported. Issue takes place for Ceph msgr2 protocol in secure
mode. It can be reproduced by the steps:

sudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure

(1) mkdir /mnt/cephfs/fscrypt-test-3
(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3
(3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3
(4) fscrypt lock /mnt/cephfs/fscrypt-test-3
(5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3
(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar
(7) Issue has been triggered

[  408.072247] ------------[ cut here ]------------
[  408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865
ceph_con_v2_try_read+0x4b39/0x72f0
[  408.072267] Modules linked in: intel_rapl_msr intel_rapl_common
intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery
pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass
polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse
serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg
pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore
[  408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+
[  408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.17.0-5.fc42 04/01/2014
[  408.072310] Workqueue: ceph-msgr ceph_con_workfn
[  408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0
[  408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8
8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff <0f> 0b e9 06
fe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85
[  408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246
[  408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38
[  408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8
[  408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8
[  408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000
[  408.072329] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)
knlGS:0000000000000000
[  408.072331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0
[  408.072336] PKRU: 55555554
[  408.072337] Call Trace:
[  408.072338]  <TASK>
[  408.072340]  ? sched_clock_noinstr+0x9/0x10
[  408.072344]  ? __pfx_ceph_con_v2_try_read+0x10/0x10
[  408.072347]  ? _raw_spin_unlock+0xe/0x40
[  408.072349]  ? finish_task_switch.isra.0+0x15d/0x830
[  408.072353]  ? __kasan_check_write+0x14/0x30
[  408.072357]  ? mutex_lock+0x84/0xe0
[  408.072359]  ? __pfx_mutex_lock+0x10/0x10
[  408.072361]  ceph_con_workfn+0x27e/0x10e0
[  408.072364]  ? metric_delayed_work+0x311/0x2c50
[  408.072367]  process_one_work+0x611/0xe20
[  408.072371]  ? __kasan_check_write+0x14/0x30
[  408.072373]  worker_thread+0x7e3/0x1580
[  408.072375]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  408.072378]  ? __pfx_worker_thread+0x10/0x10
[  408.072381]  kthread+0x381/0x7a0
[  408.072383]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[  408.072385]  ? __pfx_kthread+0x10/0x10
[  408.072387]  ? __kasan_check_write+0x14/0x30
[  408.072389]  ? recalc_sigpending+0x160/0x220
[  408.072392]  ? _raw_spin_unlock_irq+0xe/0x50
[  408.072394]  ? calculate_sigpending+0x78/0xb0
[  408.072395]  ? __pfx_kthread+0x10/0x10
[  408.072397]  ret_from_fork+0x2b6/0x380
[  408.072400]  ? __pfx_kthread+0x10/0x10
[  408.072402]  ret_from_fork_asm+0x1a/0x30
[  408.072406]  </TASK>
[  408.072407] ---[ end trace 0000000000000000 ]---
[  408.072418] Oops: general protection fault, probably for non-canonical
address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
[  408.072984] KASAN: null-ptr-deref in range [0x0000000000000000-
0x0000000000000007]
[  408.073350] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Tainted: G        W
6.17.0-rc7+ #1 PREEMPT(voluntary)
[  408.073886] Tainted: [W]=WARN
[  408.074042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.17.0-5.fc42 04/01/2014
[  408.074468] Workqueue: ceph-msgr ceph_con_workfn
[  408.074694] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80
[  408.074976] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00
00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16
84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03
[  408.075884] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246
[  408.076305] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000
[  408.076909] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378
[  408.077466] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8
[  408.078034] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71
[  408.078575] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378
[  408.079159] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)
knlGS:0000000000000000
[  408.079736] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  408.080039] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0
[  408.080376] PKRU: 55555554
[  408.080513] Call Trace:
[  408.080630]  <TASK>
[  408.080729]  ceph_con_v2_try_read+0x49b9/0x72f0
[  408.081115]  ? __pfx_ceph_con_v2_try_read+0x10/0x10
[  408.081348]  ? _raw_spin_unlock+0xe/0x40
[  408.081538]  ? finish_task_switch.isra.0+0x15d/0x830
[  408.081768]  ? __kasan_check_write+0x14/0x30
[  408.081986]  ? mutex_lock+0x84/0xe0
[  408.082160]  ? __pfx_mutex_lock+0x10/0x10
[  408.082343]  ceph_con_workfn+0x27e/0x10e0
[  408.082529]  ? metric_delayed_work+0x311/0x2c50
[  408.082737]  process_one_work+0x611/0xe20
[  408.082948]  ? __kasan_check_write+0x14/0x30
[  408.083156]  worker_thread+0x7e3/0x1580
[  408.083331]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  408.083557]  ? __pfx_worker_thread+0x10/0x10
[  408.083751]  kthread+0x381/0x7a0
[  408.083922]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[  408.084139]  ? __pfx_kthread+0x10/0x10
[  408.084310]  ? __kasan_check_write+0x14/0x30
[  408.084510]  ? recalc_sigpending+0x160/0x220
[  408.084708]  ? _raw_spin_unlock_irq+0xe/0x50
[  408.084917]  ? calculate_sigpending+0x78/0xb0
[  408.085138]  ? __pfx_kthread+0x10/0x10
[  408.085335]  ret_from_fork+0x2b6/0x380
[  408.085525]  ? __pfx_kthread+0x10/0x10
[  408.085720]  ret_from_fork_asm+0x1a/0x30
[  408.085922]  </TASK>
[  408.086036] Modules linked in: intel_rapl_msr intel_rapl_common
intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery
pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass
polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse
serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg
pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore
[  408.087778] ---[ end trace 0000000000000000 ]---
[  408.088007] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80
[  408.088260] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00
00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16
84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03
[  408.089118] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246
[  408.089357] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000
[  408.089678] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378
[  408.090020] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8
[  408.090360] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71
[  408.090687] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378
[  408.091035] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)
knlGS:0000000000000000
[  408.091452] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  408.092015] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0
[  408.092530] PKRU: 55555554
[  417.112915]
==================================================================
[  417.113491] BUG: KASAN: slab-use-after-free in
__mutex_lock.constprop.0+0x1522/0x1610
[  417.114014] Read of size 4 at addr ffff888124870034 by task kworker/2:0/4951

[  417.114587] CPU: 2 UID: 0 PID: 4951 Comm: kworker/2:0 Tainted: G      D W
6.17.0-rc7+ #1 PREEMPT(voluntary)
[  417.114592] Tainted: [D]=DIE, [W]=WARN
[  417.114593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.17.0-5.fc42 04/01/2014
[  417.114596] Workqueue: events handle_timeout
[  417.114601] Call Trace:
[  417.114602]  <TASK>
[  417.114604]  dump_stack_lvl+0x5c/0x90
[  417.114610]  print_report+0x171/0x4dc
[  417.114613]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  417.114617]  ? kasan_complete_mode_report_info+0x80/0x220
[  417.114621]  kasan_report+0xbd/0x100
[  417.114625]  ? __mutex_lock.constprop.0+0x1522/0x1610
[  417.114628]  ? __mutex_lock.constprop.0+0x1522/0x1610
[  417.114630]  __asan_report_load4_noabort+0x14/0x30
[  417.114633]  __mutex_lock.constprop.0+0x1522/0x1610
[  417.114635]  ? queue_con_delay+0x8d/0x200
[  417.114638]  ? __pfx___mutex_lock.constprop.0+0x10/0x10
[  417.114641]  ? __send_subscribe+0x529/0xb20
[  417.114644]  __mutex_lock_slowpath+0x13/0x20
[  417.114646]  mutex_lock+0xd4/0xe0
[  417.114649]  ? __pfx_mutex_lock+0x10/0x10
[  417.114652]  ? ceph_monc_renew_subs+0x2a/0x40
[  417.114654]  ceph_con_keepalive+0x22/0x110
[  417.114656]  handle_timeout+0x6b3/0x11d0
[  417.114659]  ? _raw_spin_unlock_irq+0xe/0x50
[  417.114662]  ? __pfx_handle_timeout+0x10/0x10
[  417.114664]  ? queue_delayed_work_on+0x8e/0xa0
[  417.114669]  process_one_work+0x611/0xe20
[  417.114672]  ? __kasan_check_write+0x14/0x30
[  417.114676]  worker_thread+0x7e3/0x1580
[  417.114678]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  417.114682]  ? __pfx_sched_setscheduler_nocheck+0x10/0x10
[  417.114687]  ? __pfx_worker_thread+0x10/0x10
[  417.114689]  kthread+0x381/0x7a0
[  417.114692]  ? __pfx__raw_spin_lock_irq+0x10/0x10
[  417.114694]  ? __pfx_kthread+0x10/0x10
[  417.114697]  ? __kasan_check_write+0x14/0x30
[  417.114699]  ? recalc_sigpending+0x160/0x220
[  417.114703]  ? _raw_spin_unlock_irq+0xe/0x50
[  417.114705]  ? calculate_sigpending+0x78/0xb0
[  417.114707]  ? __pfx_kthread+0x10/0x10
[  417.114710]  ret_from_fork+0x2b6/0x380
[  417.114713]  ? __pfx_kthread+0x10/0x10
[  417.114715]  ret_from_fork_asm+0x1a/0x30
[  417.114720]  </TASK>

[  417.125171] Allocated by task 2:
[  417.125333]  kasan_save_stack+0x26/0x60
[  417.125522]  kasan_save_track+0x14/0x40
[  417.125742]  kasan_save_alloc_info+0x39/0x60
[  417.125945]  __kasan_slab_alloc+0x8b/0xb0
[  417.126133]  kmem_cache_alloc_node_noprof+0x13b/0x460
[  417.126381]  copy_process+0x320/0x6250
[  417.126595]  kernel_clone+0xb7/0x840
[  417.126792]  kernel_thread+0xd6/0x120
[  417.126995]  kthreadd+0x85c/0xbe0
[  417.127176]  ret_from_fork+0x2b6/0x380
[  417.127378]  ret_from_fork_asm+0x1a/0x30

[  417.127692] Freed by task 0:
[  417.127851]  kasan_save_stack+0x26/0x60
[  417.128057]  kasan_save_track+0x14/0x40
[  417.128267]  kasan_save_free_info+0x3b/0x60
[  417.128491]  __kasan_slab_free+0x6c/0xa0
[  417.128708]  kmem_cache_free+0x182/0x550
[  417.128906]  free_task+0xeb/0x140
[  417.129070]  __put_task_struct+0x1d2/0x4f0
[  417.129259]  __put_task_struct_rcu_cb+0x15/0x20
[  417.129480]  rcu_do_batch+0x3d3/0xe70
[  417.129681]  rcu_core+0x549/0xb30
[  417.129839]  rcu_core_si+0xe/0x20
[  417.130005]  handle_softirqs+0x160/0x570
[  417.130190]  __irq_exit_rcu+0x189/0x1e0
[  417.130369]  irq_exit_rcu+0xe/0x20
[  417.130531]  sysvec_apic_timer_interrupt+0x9f/0xd0
[  417.130768]  asm_sysvec_apic_timer_interrupt+0x1b/0x20

[  417.131082] Last potentially related work creation:
[  417.131305]  kasan_save_stack+0x26/0x60
[  417.131484]  kasan_record_aux_stack+0xae/0xd0
[  417.131695]  __call_rcu_common+0xcd/0x14b0
[  417.131909]  call_rcu+0x31/0x50
[  417.132071]  delayed_put_task_struct+0x128/0x190
[  417.132295]  rcu_do_batch+0x3d3/0xe70
[  417.132478]  rcu_core+0x549/0xb30
[  417.132658]  rcu_core_si+0xe/0x20
[  417.132808]  handle_softirqs+0x160/0x570
[  417.132993]  __irq_exit_rcu+0x189/0x1e0
[  417.133181]  irq_exit_rcu+0xe/0x20
[  417.133353]  sysvec_apic_timer_interrupt+0x9f/0xd0
[  417.133584]  asm_sysvec_apic_timer_interrupt+0x1b/0x20

[  417.133921] Second to last potentially related work creation:
[  417.134183]  kasan_save_stack+0x26/0x60
[  417.134362]  kasan_record_aux_stack+0xae/0xd0
[  417.134566]  __call_rcu_common+0xcd/0x14b0
[  417.134782]  call_rcu+0x31/0x50
[  417.134929]  put_task_struct_rcu_user+0x58/0xb0
[  417.135143]  finish_task_switch.isra.0+0x5d3/0x830
[  417.135366]  __schedule+0xd30/0x5100
[  417.135534]  schedule_idle+0x5a/0x90
[  417.135712]  do_idle+0x25f/0x410
[  417.135871]  cpu_startup_entry+0x53/0x70
[  417.136053]  start_secondary+0x216/0x2c0
[  417.136233]  common_startup_64+0x13e/0x141

[  417.136894] The buggy address belongs to the object at ffff888124870000
                which belongs to the cache task_struct of size 10504
[  417.138122] The buggy address is located 52 bytes inside of
                freed 10504-byte region [ffff888124870000, ffff888124872908)

[  417.139465] The buggy address belongs to the physical page:
[  417.140016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
pfn:0x124870
[  417.140789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0
pincount:0
[  417.141519] memcg:ffff88811aa20e01
[  417.141874] anon flags:
0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
[  417.142600] page_type: f5(slab)
[  417.142922] raw: 0017ffffc0000040 ffff88810094f040 0000000000000000
dead000000000001
[  417.143554] raw: 0000000000000000 0000000000030003 00000000f5000000
ffff88811aa20e01
[  417.143954] head: 0017ffffc0000040 ffff88810094f040 0000000000000000
dead000000000001
[  417.144329] head: 0000000000000000 0000000000030003 00000000f5000000
ffff88811aa20e01
[  417.144710] head: 0017ffffc0000003 ffffea0004921c01 00000000ffffffff
00000000ffffffff
[  417.145106] head: ffffffffffffffff 0000000000000000 00000000ffffffff
0000000000000008
[  417.145485] page dumped because: kasan: bad access detected

[  417.145859] Memory state around the buggy address:
[  417.146094]  ffff88812486ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
fc
[  417.146439]  ffff88812486ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
fc
[  417.146791] >ffff888124870000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[  417.147145]                                      ^
[  417.147387]  ffff888124870080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[  417.147751]  ffff888124870100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
fb
[  417.148123]
==================================================================

First of all, we have warning in get_bvec_at() because
cursor->total_resid contains zero value. And, finally,
we have crash in ceph_msg_data_advance() because
cursor->data is NULL. It means that get_bvec_at()
receives not initialized ceph_msg_data_cursor structure
because data is NULL and total_resid contains zero.

Moreover, we don't have likewise issue for the case of
Ceph msgr1 protocol because ceph_msg_data_cursor_init()
has been called before reading sparse data.

This patch adds calling of ceph_msg_data_cursor_init()
in the beginning of process_v2_sparse_read() with
the goal to guarantee that logic of reading sparse data
works correctly for the case of Ceph msgr2 protocol.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/73152
Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/messenger_v2.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/net/ceph/messenger_v2.c
+++ b/net/ceph/messenger_v2.c
@@ -1091,13 +1091,16 @@ static int decrypt_control_remainder(str
 static int process_v2_sparse_read(struct ceph_connection *con,
 				  struct page **pages, int spos)
 {
-	struct ceph_msg_data_cursor *cursor = &con->v2.in_cursor;
+	struct ceph_msg_data_cursor cursor;
 	int ret;
 
+	ceph_msg_data_cursor_init(&cursor, con->in_msg,
+				  con->in_msg->sparse_read_total);
+
 	for (;;) {
 		char *buf = NULL;
 
-		ret = con->ops->sparse_read(con, cursor, &buf);
+		ret = con->ops->sparse_read(con, &cursor, &buf);
 		if (ret <= 0)
 			return ret;
 
@@ -1115,11 +1118,11 @@ static int process_v2_sparse_read(struct
 			} else {
 				struct bio_vec bv;
 
-				get_bvec_at(cursor, &bv);
+				get_bvec_at(&cursor, &bv);
 				len = min_t(int, len, bv.bv_len);
 				memcpy_page(bv.bv_page, bv.bv_offset,
 					    spage, soff, len);
-				ceph_msg_data_advance(cursor, len);
+				ceph_msg_data_advance(&cursor, len);
 			}
 			spos += len;
 			ret -= len;

[PATCH 6.6 48/93] dm-verity: fix unreliable memory allocation

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 upstream.

GFP_NOWAIT allocation may fail anytime. It needs to be changed to
GFP_NOIO. There's no need to handle an error because mempool_alloc with
GFP_NOIO can't fail.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-verity-fec.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -330,11 +330,7 @@ static int fec_alloc_bufs(struct dm_veri
 		if (fio->bufs[n])
 			continue;
 
-		fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOWAIT);
-		if (unlikely(!fio->bufs[n])) {
-			DMERR("failed to allocate FEC buffer");
-			return -ENOMEM;
-		}
+		fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOIO);
 	}
 
 	/* try to allocate the maximum number of buffers */

[PATCH 6.6 49/93] drivers/usb/dwc3: fix PCI parent check

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jamie Iles <jamie.iles@oss.qualcomm.com>

commit 40f8d17eed7533ed2bbb5e3cc680049b19411b2e upstream.

The sysdev_is_parent check was being used to infer PCI devices that have
the DMA mask set from the PCI capabilities, but sysdev_is_parent is also
used for non-PCI ACPI devices in which case the DMA mask would be the
bus default or as set by the _DMA method.

Without this fix the DMA mask would default to 32-bits and so allocation
would fail if there was no DRAM below 4GB.

Fixes: 47ce45906ca9 ("usb: dwc3: leave default DMA for PCI devices")
Cc: stable <stable@kernel.org>
Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com>
Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20251107104437.1602509-1-punit.agrawal@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -25,6 +25,7 @@
 #include <linux/of.h>
 #include <linux/of_graph.h>
 #include <linux/acpi.h>
+#include <linux/pci.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/reset.h>
 #include <linux/bitfield.h>
@@ -1990,7 +1991,7 @@ static int dwc3_probe(struct platform_de
 	platform_set_drvdata(pdev, dwc);
 	dwc3_cache_hwparams(dwc);
 
-	if (!dwc->sysdev_is_parent &&
+	if (!dev_is_pci(dwc->sysdev) &&
 	    DWC3_GHWPARAMS0_AWIDTH(dwc->hwparams.hwparams0) == 64) {
 		ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64));
 		if (ret)

[PATCH 6.6 50/93] smb: client: fix memory leak in cifs_construct_tcon()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paulo Alcantara <pc@manguebit.org>

commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 upstream.

When having a multiuser mount with domain= specified and using
cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname,
so it needs to be freed before leaving cifs_construct_tcon().

This fixes the following memory leak reported by kmemleak:

  mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...
  su - testuser
  cifscreds add -d ZELDA -u testuser
  ...
  ls /mnt/1
  ...
  umount /mnt
  echo scan > /sys/kernel/debug/kmemleak
  cat /sys/kernel/debug/kmemleak
  unreferenced object 0xffff8881203c3f08 (size 8):
    comm "ls", pid 5060, jiffies 4307222943
    hex dump (first 8 bytes):
      5a 45 4c 44 41 00 cc cc                          ZELDA...
    backtrace (crc d109a8cf):
      __kmalloc_node_track_caller_noprof+0x572/0x710
      kstrdup+0x3a/0x70
      cifs_sb_tlink+0x1209/0x1770 [cifs]
      cifs_get_fattr+0xe1/0xf50 [cifs]
      cifs_get_inode_info+0xb5/0x240 [cifs]
      cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]
      cifs_getattr+0x28e/0x450 [cifs]
      vfs_getattr_nosec+0x126/0x180
      vfs_statx+0xf6/0x220
      do_statx+0xab/0x110
      __x64_sys_statx+0xd5/0x130
      do_syscall_64+0xbb/0x380
      entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: f2aee329a68f ("cifs: set domainName when a domain-key is used in multiuser")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Jay Shin <jaeshin@redhat.com>
Cc: stable@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/connect.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -4224,6 +4224,7 @@ cifs_construct_tcon(struct cifs_sb_info
 
 out:
 	kfree(ctx->username);
+	kfree(ctx->domainname);
 	kfree_sensitive(ctx->password);
 	kfree(origin_fullpath);
 	kfree(ctx);

[PATCH 6.6 51/93] thunderbolt: Add support for Intel Wildcat Lake

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>

commit 3575254546a27210a4b661ea37fbbfb836c0815d upstream.

Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar
Lake platform. Add Wildcat Lake PCI ID to the driver list of supported
devices.

Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thunderbolt/nhi.c |    2 ++
 drivers/thunderbolt/nhi.h |    1 +
 2 files changed, 3 insertions(+)

--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -1536,6 +1536,8 @@ static struct pci_device_id nhi_ids[] =
 	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
 	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0),
+	  .driver_data = (kernel_ulong_t)&icl_nhi_ops },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
 	{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
 
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_o
 #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE	0x15ef
 #define PCI_DEVICE_ID_INTEL_ADL_NHI0			0x463e
 #define PCI_DEVICE_ID_INTEL_ADL_NHI1			0x466d
+#define PCI_DEVICE_ID_INTEL_WCL_NHI0			0x4d33
 #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI	0x5781
 #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI	0x5784
 #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786

[PATCH 6.6 52/93] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <linmq006@gmail.com>

commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e upstream.

The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which
internally uses device_find_child() to obtain a device reference.
According to the device_find_child() documentation,
the caller must drop the reference with put_device() after use.

Found via static analysis and this is similar to commit 4e65bda8273c
("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")

Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/slimbus/qcom-ngd-ctrl.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1239,6 +1239,7 @@ static void qcom_slim_ngd_notify_slaves(
 
 		if (slim_get_logical_addr(sbdev))
 			dev_err(ctrl->dev, "Failed to get logical address\n");
+		put_device(&sbdev->dev);
 	}
 }
 

[PATCH 6.6 53/93] firmware: stratix10-svc: fix bug in saving controller data

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>

commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 upstream.

Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They
both are of the same data and overrides each other. This resulted in the
rmmod of the svc driver to fail and throw a kernel panic for kthread_stop
and fifo free.

Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features")
Cc: stable@vger.kernel.org # 6.6+
Signed-off-by: Ang Tien Sung <tiensung.ang@altera.com>
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/stratix10-svc.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -134,6 +134,7 @@ struct stratix10_svc_data {
  * @complete_status: state for completion
  * @svc_fifo_lock: protect access to service message data queue
  * @invoke_fn: function to issue secure monitor call or hypervisor call
+ * @svc: manages the list of client svc drivers
  *
  * This struct is used to create communication channels for service clients, to
  * handle secure monitor or hypervisor call.
@@ -150,6 +151,7 @@ struct stratix10_svc_controller {
 	struct completion complete_status;
 	spinlock_t svc_fifo_lock;
 	svc_invoke_fn *invoke_fn;
+	struct stratix10_svc *svc;
 };
 
 /**
@@ -1209,6 +1211,7 @@ static int stratix10_svc_drv_probe(struc
 		ret = -ENOMEM;
 		goto err_free_kfifo;
 	}
+	controller->svc = svc;
 
 	svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0);
 	if (!svc->stratix10_svc_rsu) {
@@ -1236,8 +1239,6 @@ static int stratix10_svc_drv_probe(struc
 		goto err_unregister_dev;
 	}
 
-	dev_set_drvdata(dev, svc);
-
 	pr_info("Intel Service Layer Driver Initialized\n");
 
 	return 0;
@@ -1253,8 +1254,8 @@ err_destroy_pool:
 
 static int stratix10_svc_drv_remove(struct platform_device *pdev)
 {
-	struct stratix10_svc *svc = dev_get_drvdata(&pdev->dev);
 	struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+	struct stratix10_svc *svc = ctrl->svc;
 
 	platform_device_unregister(svc->intel_svc_fcs);
 	platform_device_unregister(svc->stratix10_svc_rsu);

[PATCH 6.6 54/93] mptcp: clear scheduled subflows on retransmit

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <pabeni@redhat.com>

commit 27fd02860164bfa78cec2640dfad630d832e302c upstream.

When __mptcp_retrans() kicks-in, it schedules one or more subflows for
retransmission, but such subflows could be actually left alone if there
is no more data to retransmit and/or in case of concurrent fallback.

Scheduled subflows could be processed much later in time, i.e. when new
data will be transmitted, leading to bad subflow selection.

Explicitly clear all scheduled subflows before leaving the
retransmission function.

Fixes: ee2708aedad0 ("mptcp: use get_retrans wrapper")
Cc: stable@vger.kernel.org
Reported-by: Filip Pokryvka <fpokryvk@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251125-net-mptcp-clear-sched-rtx-v1-1-1cea4ad2165f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/protocol.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2691,7 +2691,7 @@ static void __mptcp_retrans(struct sock
 		}
 
 		if (!mptcp_send_head(sk))
-			return;
+			goto clear_scheduled;
 
 		goto reset_timer;
 	}
@@ -2722,7 +2722,7 @@ static void __mptcp_retrans(struct sock
 			if (__mptcp_check_fallback(msk)) {
 				spin_unlock_bh(&msk->fallback_lock);
 				release_sock(ssk);
-				return;
+				goto clear_scheduled;
 			}
 
 			while (info.sent < info.limit) {
@@ -2754,6 +2754,15 @@ reset_timer:
 
 	if (!mptcp_rtx_timer_pending(sk))
 		mptcp_reset_rtx_timer(sk);
+
+clear_scheduled:
+	/* If no rtx data was available or in case of fallback, there
+	 * could be left-over scheduled subflows; clear them all
+	 * or later xmit could use bad ones
+	 */
+	mptcp_for_each_subflow(msk, subflow)
+		if (READ_ONCE(subflow->scheduled))
+			mptcp_subflow_set_scheduled(subflow, false);
 }
 
 /* schedule the timeout timer for the relevant event: either close timeout

[PATCH 6.6 55/93] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <linmq006@gmail.com>

commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a upstream.

Check for returned DMA addresses using specialized dma_mapping_error()
helper which is generally recommended for this purpose by
Documentation/core-api/dma-api.rst:

  "In some circumstances dma_map_single(), ...
will fail to create a mapping. A driver can check for these errors
by testing the returned DMA address with dma_mapping_error()."

Found via static analysis and this is similar to commit fa0308134d26
("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking")

Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/amba-pl011.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -636,7 +636,7 @@ static int pl011_dma_tx_refill(struct ua
 	dmatx->len = count;
 	dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count,
 				    DMA_TO_DEVICE);
-	if (dmatx->dma == DMA_MAPPING_ERROR) {
+	if (dma_mapping_error(dma_dev->dev, dmatx->dma)) {
 		uap->dmatx.queued = false;
 		dev_dbg(uap->port.dev, "unable to map TX DMA\n");
 		return -EBUSY;

[PATCH 6.6 56/93] most: usb: fix double free on late probe failure

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit baadf2a5c26e802a46573eaad331b427b49aaa36 upstream.

The MOST subsystem has a non-standard registration function which frees
the interface on registration failures and on deregistration.

This unsurprisingly leads to bugs in the MOST drivers, and a couple of
recent changes turned a reference underflow and use-after-free in the
USB driver into several double free and a use-after-free on late probe
failures.

Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect")
Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization")
Cc: stable@vger.kernel.org
Cc: Christian Gromm <christian.gromm@microchip.com>
Cc: Victoria Votokina <Victoria.Votokina@kaspersky.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/most/most_usb.c |   14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -1058,7 +1058,7 @@ hdm_probe(struct usb_interface *interfac
 
 	ret = most_register_interface(&mdev->iface);
 	if (ret)
-		goto err_free_busy_urbs;
+		return ret;
 
 	mutex_lock(&mdev->io_mutex);
 	if (le16_to_cpu(usb_dev->descriptor.idProduct) == USB_DEV_ID_OS81118 ||
@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interfac
 		if (!mdev->dci) {
 			mutex_unlock(&mdev->io_mutex);
 			most_deregister_interface(&mdev->iface);
-			ret = -ENOMEM;
-			goto err_free_busy_urbs;
+			return -ENOMEM;
 		}
 
 		mdev->dci->dev.init_name = "dci";
@@ -1078,18 +1077,15 @@ hdm_probe(struct usb_interface *interfac
 		mdev->dci->dev.release = release_dci;
 		if (device_register(&mdev->dci->dev)) {
 			mutex_unlock(&mdev->io_mutex);
+			put_device(&mdev->dci->dev);
 			most_deregister_interface(&mdev->iface);
-			ret = -ENOMEM;
-			goto err_free_dci;
+			return -ENOMEM;
 		}
 		mdev->dci->usb_device = mdev->usb_device;
 	}
 	mutex_unlock(&mdev->io_mutex);
 	return 0;
-err_free_dci:
-	put_device(&mdev->dci->dev);
-err_free_busy_urbs:
-	kfree(mdev->busy_urbs);
+
 err_free_ep_address:
 	kfree(mdev->ep_address);
 err_free_cap:

[PATCH 6.6 57/93] usb: cdns3: Fix double resource release in cdns3_pci_probe

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <linmq006@gmail.com>

commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d upstream.

The driver uses pcim_enable_device() to enable the PCI device,
the device will be automatically disabled on driver detach through
the managed device framework. The manual pci_disable_device() calls
in the error paths are therefore redundant and should be removed.

Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20251026090859.33107-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/cdns3/cdns3-pci-wrap.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/cdns3/cdns3-pci-wrap.c
+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c
@@ -101,10 +101,8 @@ static int cdns3_pci_probe(struct pci_de
 		wrap = pci_get_drvdata(func);
 	} else {
 		wrap = kzalloc(sizeof(*wrap), GFP_KERNEL);
-		if (!wrap) {
-			pci_disable_device(pdev);
+		if (!wrap)
 			return -ENOMEM;
-		}
 	}
 
 	res = wrap->dev_res;
@@ -163,7 +161,6 @@ static int cdns3_pci_probe(struct pci_de
 		/* register platform device */
 		wrap->plat_dev = platform_device_register_full(&plat_info);
 		if (IS_ERR(wrap->plat_dev)) {
-			pci_disable_device(pdev);
 			err = PTR_ERR(wrap->plat_dev);
 			kfree(wrap);
 			return err;

[PATCH 6.6 58/93] usb: gadget: f_eem: Fix memory leak in eem_unwrap

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kuen-Han Tsai <khtsai@google.com>

commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 upstream.

The existing code did not handle the failure case of usb_ep_queue in the
command path, potentially leading to memory leaks.

Improve error handling to free all allocated resources on usb_ep_queue
failure. This patch continues to use goto logic for error handling, as the
existing error handling is complex and not easily adaptable to auto-cleanup
helpers.

kmemleak results:
  unreferenced object 0xffffff895a512300 (size 240):
    backtrace:
      slab_post_alloc_hook+0xbc/0x3a4
      kmem_cache_alloc+0x1b4/0x358
      skb_clone+0x90/0xd8
      eem_unwrap+0x1cc/0x36c
  unreferenced object 0xffffff8a157f4000 (size 256):
    backtrace:
      slab_post_alloc_hook+0xbc/0x3a4
      __kmem_cache_alloc_node+0x1b4/0x2dc
      kmalloc_trace+0x48/0x140
      dwc3_gadget_ep_alloc_request+0x58/0x11c
      usb_ep_alloc_request+0x40/0xe4
      eem_unwrap+0x204/0x36c
  unreferenced object 0xffffff8aadbaac00 (size 128):
    backtrace:
      slab_post_alloc_hook+0xbc/0x3a4
      __kmem_cache_alloc_node+0x1b4/0x2dc
      __kmalloc+0x64/0x1a8
      eem_unwrap+0x218/0x36c
  unreferenced object 0xffffff89ccef3500 (size 64):
    backtrace:
      slab_post_alloc_hook+0xbc/0x3a4
      __kmem_cache_alloc_node+0x1b4/0x2dc
      kmalloc_trace+0x48/0x140
      eem_unwrap+0x238/0x36c

Fixes: 4249d6fbc10f ("usb: gadget: eem: fix echo command packet response issue")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20251103121814.1559719-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_eem.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -477,8 +477,13 @@ static int eem_unwrap(struct gether *por
 				req->complete = eem_cmd_complete;
 				req->zero = 1;
 				req->context = ctx;
-				if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+				if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) {
 					DBG(cdev, "echo response queue fail\n");
+					kfree(ctx);
+					kfree(req->buf);
+					usb_ep_free_request(ep, req);
+					dev_kfree_skb_any(skb2);
+				}
 				break;
 
 			case 1:  /* echo response */

[PATCH 6.6 59/93] usb: renesas_usbhs: Fix synchronous external abort on unbind

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

commit eb9ac779830b2235847b72cb15cf07c7e3333c5e upstream.

A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is
executed after the configuration sequence described above:

modprobe usb_f_ecm
modprobe libcomposite
modprobe configfs
cd /sys/kernel/config/usb_gadget
mkdir -p g1
cd g1
echo "0x1d6b" > idVendor
echo "0x0104" > idProduct
mkdir -p strings/0x409
echo "0123456789" > strings/0x409/serialnumber
echo "Renesas." > strings/0x409/manufacturer
echo "Ethernet Gadget" > strings/0x409/product
mkdir -p functions/ecm.usb0
mkdir -p configs/c.1
mkdir -p configs/c.1/strings/0x409
echo "ECM" > configs/c.1/strings/0x409/configuration

if [ ! -L configs/c.1/ecm.usb0 ]; then
        ln -s functions/ecm.usb0 configs/c.1
fi

echo 11e20000.usb > UDC
echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind

The displayed trace is as follows:

 Internal error: synchronous external abort: 0000000096000010 [#1] SMP
 CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT
 Tainted: [M]=MACHINE_CHECK
 Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT)
 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs]
 lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs]
 sp : ffff8000838b3920
 x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000
 x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810
 x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000
 x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020
 x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344
 x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000
 x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418
 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
 x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000
 x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80
 Call trace:
 usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P)
 usbhsg_pullup+0x4c/0x7c [renesas_usbhs]
 usb_gadget_disconnect_locked+0x48/0xd4
 gadget_unbind_driver+0x44/0x114
 device_remove+0x4c/0x80
 device_release_driver_internal+0x1c8/0x224
 device_release_driver+0x18/0x24
 bus_remove_device+0xcc/0x10c
 device_del+0x14c/0x404
 usb_del_gadget+0x88/0xc0
 usb_del_gadget_udc+0x18/0x30
 usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs]
 usbhs_mod_remove+0x20/0x30 [renesas_usbhs]
 usbhs_remove+0x98/0xdc [renesas_usbhs]
 platform_remove+0x20/0x30
 device_remove+0x4c/0x80
 device_release_driver_internal+0x1c8/0x224
 device_driver_detach+0x18/0x24
 unbind_store+0xb4/0xb8
 drv_attr_store+0x24/0x38
 sysfs_kf_write+0x7c/0x94
 kernfs_fop_write_iter+0x128/0x1b8
 vfs_write+0x2ac/0x350
 ksys_write+0x68/0xfc
 __arm64_sys_write+0x1c/0x28
 invoke_syscall+0x48/0x110
 el0_svc_common.constprop.0+0xc0/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x34/0xf0
 el0t_64_sync_handler+0xa0/0xe4
 el0t_64_sync+0x198/0x19c
 Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021)
 ---[ end trace 0000000000000000 ]---
 note: sh[188] exited with irqs disabled
 note: sh[188] exited with preempt_count 1

The issue occurs because usbhs_sys_function_pullup(), which accesses the IP
registers, is executed after the USBHS clocks have been disabled. The
problem is reproducible on the Renesas RZ/G3S SoC starting with the
addition of module stop in the clock enable/disable APIs. With module stop
functionality enabled, a bus error is expected if a master accesses a
module whose clock has been stopped and module stop activated.

Disable the IP clocks at the end of remove.

Cc: stable <stable@kernel.org>
Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251027140741.557198-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/renesas_usbhs/common.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -798,18 +798,18 @@ static void usbhs_remove(struct platform
 
 	flush_delayed_work(&priv->notify_hotplug_work);
 
-	/* power off */
-	if (!usbhs_get_dparam(priv, runtime_pwctrl))
-		usbhsc_power_ctrl(priv, 0);
-
-	pm_runtime_disable(&pdev->dev);
-
 	usbhs_platform_call(priv, hardware_exit, pdev);
-	usbhsc_clk_put(priv);
 	reset_control_assert(priv->rsts);
 	usbhs_mod_remove(priv);
 	usbhs_fifo_remove(priv);
 	usbhs_pipe_remove(priv);
+
+	/* power off */
+	if (!usbhs_get_dparam(priv, runtime_pwctrl))
+		usbhsc_power_ctrl(priv, 0);
+
+	usbhsc_clk_put(priv);
+	pm_runtime_disable(&pdev->dev);
 }
 
 static __maybe_unused int usbhsc_suspend(struct device *dev)

[PATCH 6.6 60/93] usb: storage: Fix memory leak in USB bulk transport

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Desnes Nunes <desnesn@redhat.com>

commit 41e99fe2005182139b1058db71f0d241f8f0078c upstream.

A kernel memory leak was identified by the 'ioctl_sg01' test from Linux
Test Project (LTP). The following bytes were mainly observed: 0x53425355.

When USB storage devices incorrectly skip the data phase with status data,
the code extracts/validates the CSW from the sg buffer, but fails to clear
it afterwards. This leaves status protocol data in srb's transfer buffer,
such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can
lead to USB protocols leaks to user space through SCSI generic (/dev/sg*)
interfaces, such as the one seen here when the LTP test requested 512 KiB.

Fix the leak by zeroing the CSW data in srb's transfer buffer immediately
after the validation of devices that skip data phase.

Note: Differently from CVE-2018-1000204, which fixed a big leak by zero-
ing pages at allocation time, this leak occurs after allocation, when USB
protocol data is written to already-allocated sg pages.

Fixes: a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()")
Cc: stable <stable@kernel.org>
Signed-off-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20251031043436.55929-1-desnesn@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/transport.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1204,7 +1204,23 @@ int usb_stor_Bulk_transport(struct scsi_
 						US_BULK_CS_WRAP_LEN &&
 					bcs->Signature ==
 						cpu_to_le32(US_BULK_CS_SIGN)) {
+				unsigned char buf[US_BULK_CS_WRAP_LEN];
+
 				usb_stor_dbg(us, "Device skipped data phase\n");
+
+				/*
+				 * Devices skipping data phase might leave CSW data in srb's
+				 * transfer buffer. Zero it to prevent USB protocol leakage.
+				 */
+				sg = NULL;
+				offset = 0;
+				memset(buf, 0, sizeof(buf));
+				if (usb_stor_access_xfer_buf(buf,
+						US_BULK_CS_WRAP_LEN, srb, &sg,
+						&offset, TO_XFER_BUF) !=
+							US_BULK_CS_WRAP_LEN)
+					usb_stor_dbg(us, "Failed to clear CSW data\n");
+
 				scsi_set_resid(srb, transfer_length);
 				goto skipped_data_phase;
 			}

[PATCH 6.6 61/93] USB: storage: Remove subclass and protocol overrides from Novatek quirk

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit df5fde297e617041449f603ed5f646861c80000b upstream.

A report from Oleg Smirnov indicates that the unusual_devs quirks
entry for the Novatek camera does not need to override the subclass
and protocol parameters:

[3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd
[3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00
[3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[3266355.333043] usb 1-3: Product: YICARCAM
[3266355.333045] usb 1-3: Manufacturer: XIAO-YI
[3266355.333047] usb 1-3: SerialNumber: 966110000000100
[3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected
[3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000
[3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1)
                    Please send a copy of this message to
<linux-usb@vger.kernel.org> and <usb-storage@lists.one-eyed-alien.net>

The overrides are harmless but they do provoke the driver into logging
this annoying message.  Update the entry to remove the unneeded entries.

Reported-by: stealth <oleg.smirnov.1988@gmail.com>
Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/
Fixes: 6ca8af3c8fb5 ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera")
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_devs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -938,7 +938,7 @@ UNUSUAL_DEV(  0x05e3, 0x0723, 0x9451, 0x
 UNUSUAL_DEV(  0x0603, 0x8611, 0x0000, 0xffff,
 		"Novatek",
 		"NTK96550-based camera",
-		USB_SC_SCSI, USB_PR_BULK, NULL,
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_BULK_IGNORE_TAG ),
 
 /*

[PATCH 6.6 62/93] usb: storage: sddr55: Reject out-of-bound new_pba

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tianchu Chen <flynnnchen@tencent.com>

commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 upstream.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.

Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.

Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/sddr55.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_d
 		new_pba = (status[3] + (status[4] << 8) + (status[5] << 16))
 						  >> info->blockshift;
 
+		/* check if device-reported new_pba is out of range */
+		if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) {
+			result = USB_STOR_TRANSPORT_FAILED;
+			goto leave;
+		}
+
 		/* check status for error */
 		if (status[0] == 0xff && status[1] == 0x4) {
 			info->pba_to_lba[new_pba] = BAD_BLOCK;

[PATCH 6.6 63/93] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Owen Gu <guhuinan@xiaomi.com>

commit 26d56a9fcb2014b99e654127960aa0a48a391e3c upstream.

When a UAS device is unplugged during data transfer, there is
a probability of a system panic occurring. The root cause is
an access to an invalid memory address during URB callback handling.
Specifically, this happens when the dma_direct_unmap_sg() function
is called within the usb_hcd_unmap_urb_for_dma() interface, but the
sg->dma_address field is 0 and the sg data structure has already been
freed.

The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()
in uas.c, using the uas_submit_urbs() function to submit requests to USB.
Within the uas_submit_urbs() implementation, three URBs (sense_urb,
data_urb, and cmd_urb) are sequentially submitted. Device removal may
occur at any point during uas_submit_urbs execution, which may result
in URB submission failure. However, some URBs might have been successfully
submitted before the failure, and uas_submit_urbs will return the -ENODEV
error code in this case. The current error handling directly calls
scsi_done(). In the SCSI driver, this eventually triggers scsi_complete()
to invoke scsi_end_request() for releasing the sgtable. The successfully
submitted URBs, when being unlinked to giveback, call
usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg
unmapping operations since the sg data structure has already been freed.

This patch modifies the error condition check in the uas_submit_urbs()
function. When a UAS device is removed but one or more URBs have already
been successfully submitted to USB, it avoids immediately invoking
scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully
submitted URBs is completed before devinfo->resetting being set, then
the scsi_done() function will be called within uas_try_complete() after
all pending URB operations are finalized. Otherwise, the scsi_done()
function will be called within uas_zap_pending(), which is executed after
usb_kill_anchored_urbs().

The error handling only takes effect when uas_queuecommand_lck() calls
uas_submit_urbs() and returns the error value -ENODEV . In this case,
the device is disconnected, and the flow proceeds to uas_disconnect(),
where uas_zap_pending() is invoked to call uas_try_complete().

Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub")
Cc: stable <stable@kernel.org>
Signed-off-by: Yu Chen <chenyu45@xiaomi.com>
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/uas.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -697,6 +697,10 @@ static int uas_queuecommand_lck(struct s
 	 * of queueing, no matter how fatal the error
 	 */
 	if (err == -ENODEV) {
+		if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT |
+				DATA_OUT_URB_INFLIGHT))
+			goto out;
+
 		set_host_byte(cmnd, DID_NO_CONNECT);
 		scsi_done(cmnd);
 		goto zombie;
@@ -710,6 +714,7 @@ static int uas_queuecommand_lck(struct s
 		uas_add_work(cmnd);
 	}
 
+out:
 	devinfo->cmnd[idx] = cmnd;
 zombie:
 	spin_unlock_irqrestore(&devinfo->lock, flags);

[PATCH 6.6 64/93] usb: dwc3: pci: add support for the Intel Nova Lake -S

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Heikki Krogerus <heikki.krogerus@linux.intel.com>

commit c57ce99ec6cb55b53910b6b3d7437f80159ff9d8 upstream.

This patch adds the necessary PCI ID for Intel Nova Lake -S
devices.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: stable <stable@kernel.org>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20251106115926.2317877-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/dwc3-pci.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -53,6 +53,7 @@
 #define PCI_DEVICE_ID_INTEL_MTLP		0x7ec1
 #define PCI_DEVICE_ID_INTEL_MTLS		0x7f6f
 #define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
+#define PCI_DEVICE_ID_INTEL_NVLS_PCH		0x6e6f
 #define PCI_DEVICE_ID_INTEL_ARLH_PCH		0x777e
 #define PCI_DEVICE_ID_INTEL_TGL			0x9a15
 #define PCI_DEVICE_ID_INTEL_PTLH		0xe332
@@ -443,6 +444,7 @@ static const struct pci_device_id dwc3_p
 	{ PCI_DEVICE_DATA(INTEL, MTLM, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLP, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, NVLS_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) },

[PATCH 6.6 65/93] usb: dwc3: pci: Sort out the Intel device IDs

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Heikki Krogerus <heikki.krogerus@linux.intel.com>

commit 46b28d2fbd13148981d91246bc0e13f4fc055987 upstream.

The PCI device IDs were organised based on the Intel
architecture generation in most cases, but not with every
ID. That left the device ID table with no real order.
Sorting the table based on the device ID.

Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20251107121548.2702900-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/dwc3-pci.c |   82 ++++++++++++++++++++++----------------------
 1 file changed, 41 insertions(+), 41 deletions(-)

--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -21,41 +21,41 @@
 #include <linux/acpi.h>
 #include <linux/delay.h>
 
+#define PCI_DEVICE_ID_INTEL_CMLLP		0x02ee
+#define PCI_DEVICE_ID_INTEL_CMLH		0x06ee
+#define PCI_DEVICE_ID_INTEL_BXT			0x0aaa
 #define PCI_DEVICE_ID_INTEL_BYT			0x0f37
 #define PCI_DEVICE_ID_INTEL_MRFLD		0x119e
-#define PCI_DEVICE_ID_INTEL_BSW			0x22b7
-#define PCI_DEVICE_ID_INTEL_SPTLP		0x9d30
-#define PCI_DEVICE_ID_INTEL_SPTH		0xa130
-#define PCI_DEVICE_ID_INTEL_BXT			0x0aaa
 #define PCI_DEVICE_ID_INTEL_BXT_M		0x1aaa
-#define PCI_DEVICE_ID_INTEL_APL			0x5aaa
-#define PCI_DEVICE_ID_INTEL_KBP			0xa2b0
-#define PCI_DEVICE_ID_INTEL_CMLLP		0x02ee
-#define PCI_DEVICE_ID_INTEL_CMLH		0x06ee
+#define PCI_DEVICE_ID_INTEL_BSW			0x22b7
 #define PCI_DEVICE_ID_INTEL_GLK			0x31aa
-#define PCI_DEVICE_ID_INTEL_CNPLP		0x9dee
-#define PCI_DEVICE_ID_INTEL_CNPH		0xa36e
-#define PCI_DEVICE_ID_INTEL_CNPV		0xa3b0
 #define PCI_DEVICE_ID_INTEL_ICLLP		0x34ee
-#define PCI_DEVICE_ID_INTEL_EHL			0x4b7e
-#define PCI_DEVICE_ID_INTEL_TGPLP		0xa0ee
 #define PCI_DEVICE_ID_INTEL_TGPH		0x43ee
-#define PCI_DEVICE_ID_INTEL_JSP			0x4dee
-#define PCI_DEVICE_ID_INTEL_WCL			0x4d7e
 #define PCI_DEVICE_ID_INTEL_ADL			0x460e
-#define PCI_DEVICE_ID_INTEL_ADL_PCH		0x51ee
 #define PCI_DEVICE_ID_INTEL_ADLN		0x465e
+#define PCI_DEVICE_ID_INTEL_EHL			0x4b7e
+#define PCI_DEVICE_ID_INTEL_WCL			0x4d7e
+#define PCI_DEVICE_ID_INTEL_JSP			0x4dee
+#define PCI_DEVICE_ID_INTEL_ADL_PCH		0x51ee
 #define PCI_DEVICE_ID_INTEL_ADLN_PCH		0x54ee
-#define PCI_DEVICE_ID_INTEL_ADLS		0x7ae1
-#define PCI_DEVICE_ID_INTEL_RPL			0xa70e
+#define PCI_DEVICE_ID_INTEL_APL			0x5aaa
+#define PCI_DEVICE_ID_INTEL_NVLS_PCH		0x6e6f
+#define PCI_DEVICE_ID_INTEL_ARLH_PCH		0x777e
 #define PCI_DEVICE_ID_INTEL_RPLS		0x7a61
+#define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
+#define PCI_DEVICE_ID_INTEL_ADLS		0x7ae1
 #define PCI_DEVICE_ID_INTEL_MTLM		0x7eb1
 #define PCI_DEVICE_ID_INTEL_MTLP		0x7ec1
 #define PCI_DEVICE_ID_INTEL_MTLS		0x7f6f
-#define PCI_DEVICE_ID_INTEL_MTL			0x7e7e
-#define PCI_DEVICE_ID_INTEL_NVLS_PCH		0x6e6f
-#define PCI_DEVICE_ID_INTEL_ARLH_PCH		0x777e
 #define PCI_DEVICE_ID_INTEL_TGL			0x9a15
+#define PCI_DEVICE_ID_INTEL_SPTLP		0x9d30
+#define PCI_DEVICE_ID_INTEL_CNPLP		0x9dee
+#define PCI_DEVICE_ID_INTEL_TGPLP		0xa0ee
+#define PCI_DEVICE_ID_INTEL_SPTH		0xa130
+#define PCI_DEVICE_ID_INTEL_KBP			0xa2b0
+#define PCI_DEVICE_ID_INTEL_CNPH		0xa36e
+#define PCI_DEVICE_ID_INTEL_CNPV		0xa3b0
+#define PCI_DEVICE_ID_INTEL_RPL			0xa70e
 #define PCI_DEVICE_ID_INTEL_PTLH		0xe332
 #define PCI_DEVICE_ID_INTEL_PTLH_PCH		0xe37e
 #define PCI_DEVICE_ID_INTEL_PTLU		0xe432
@@ -413,41 +413,41 @@ static void dwc3_pci_remove(struct pci_d
 }
 
 static const struct pci_device_id dwc3_pci_id_table[] = {
-	{ PCI_DEVICE_DATA(INTEL, BSW, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, BYT, &dwc3_pci_intel_byt_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, MRFLD, &dwc3_pci_intel_mrfld_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, CMLLP, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, CMLH, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, SPTLP, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, SPTH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, BXT, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, BYT, &dwc3_pci_intel_byt_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, MRFLD, &dwc3_pci_intel_mrfld_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, BXT_M, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, APL, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, KBP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, BSW, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, GLK, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, CNPLP, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ICLLP, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, EHL, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, TGPH, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ADL, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ADLN, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, EHL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, WCL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, JSP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, ADL_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, ADLN_PCH, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, ADLS, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, APL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, NVLS_PCH, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, RPLS, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, ADLS, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLM, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLP, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, MTL, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, NVLS_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) },
-	{ PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, SPTLP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, CNPLP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, TGPLP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, SPTH, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, KBP, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) },

[PATCH 6.6 66/93] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Manish Nagar <manish.nagar@oss.qualcomm.com>

commit e4037689a366743c4233966f0e74bc455820d316 upstream.

This patch addresses a race condition caused by unsynchronized
execution of multiple call paths invoking `dwc3_remove_requests()`,
leading to premature freeing of USB requests and subsequent crashes.

Three distinct execution paths interact with `dwc3_remove_requests()`:
Path 1:
Triggered via `dwc3_gadget_reset_interrupt()` during USB reset
handling. The call stack includes:
- `dwc3_ep0_reset_state()`
- `dwc3_ep0_stall_and_restart()`
- `dwc3_ep0_out_start()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`

Path 2:
Also initiated from `dwc3_gadget_reset_interrupt()`, but through
`dwc3_stop_active_transfers()`. The call stack includes:
- `dwc3_stop_active_transfers()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`

Path 3:
Occurs independently during `adb root` execution, which triggers
USB function unbind and bind operations. The sequence includes:
- `gserial_disconnect()`
- `usb_ep_disable()`
- `dwc3_gadget_ep_disable()`
- `dwc3_remove_requests()` with `-ESHUTDOWN` status

Path 3 operates asynchronously and lacks synchronization with Paths
1 and 2. When Path 3 completes, it disables endpoints and frees 'out'
requests. If Paths 1 or 2 are still processing these requests,
accessing freed memory leads to a crash due to use-after-free conditions.

To fix this added check for request completion and skip processing
if already completed and added the request status for ep0 while queue.

Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Manish Nagar <manish.nagar@oss.qualcomm.com>
Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/ep0.c    |    1 +
 drivers/usb/dwc3/gadget.c |    7 +++++++
 2 files changed, 8 insertions(+)

--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -94,6 +94,7 @@ static int __dwc3_gadget_ep0_queue(struc
 	req->request.actual	= 0;
 	req->request.status	= -EINPROGRESS;
 	req->epnum		= dep->number;
+	req->status		= DWC3_REQUEST_STATUS_QUEUED;
 
 	list_add_tail(&req->list, &dep->pending_list);
 
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -229,6 +229,13 @@ void dwc3_gadget_giveback(struct dwc3_ep
 {
 	struct dwc3			*dwc = dep->dwc;
 
+	/*
+	 * The request might have been processed and completed while the
+	 * spinlock was released. Skip processing if already completed.
+	 */
+	if (req->status == DWC3_REQUEST_STATUS_COMPLETED)
+		return;
+
 	dwc3_gadget_del_and_unmap_request(dep, req, status);
 	req->status = DWC3_REQUEST_STATUS_COMPLETED;
 

[PATCH 6.6 67/93] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit f6bb3b67be9af0cfb90075c60850b6af5338a508 upstream.

Data read from a DbC device may be corrupted due to a race between
ongoing write and write request completion handler both queuing new
transfer blocks (TRBs) if there are remining data in the kfifo.

TRBs may be in incorrct order compared to the data in the kfifo.

Driver fails to keep lock between reading data from kfifo into a
dbc request buffer, and queuing the request to the transfer ring.

This allows completed request to re-queue itself in the middle of
an ongoing transfer loop, forcing itself between a kfifo read and
request TRB write of another request

cpu0					cpu1 (re-queue completed req2)

lock(port_lock)
dbc_start_tx()
kfifo_out(fifo, req1->buffer)
unlock(port_lock)
					lock(port_lock)
					dbc_write_complete(req2)
					dbc_start_tx()
      					kfifo_out(fifo, req2->buffer)
					unlock(port_lock)
					lock(port_lock)
					req2->trb = ring->enqueue;
					ring->enqueue++
					unlock(port_lock)
lock(port_lock)
req1->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)

In the above scenario a kfifo containing "12345678" would read "1234" to
req1 and "5678" to req2, but req2 is queued before req1 leading to
data being transmitted as "56781234"

Solve this by adding a flag that prevents starting a new tx if we
are already mid dbc_start_tx() during the unlocked part.

The already running dbc_do_start_tx() will make sure the newly completed
request gets re-queued as it is added to the request write_pool while
holding the lock.

Cc: stable@vger.kernel.org
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20251107162819.1362579-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-dbgcap.h |    1 +
 drivers/usb/host/xhci-dbgtty.c |   17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -113,6 +113,7 @@ struct dbc_port {
 	unsigned int			tx_boundary;
 
 	bool				registered;
+	bool				tx_running;
 };
 
 struct dbc_driver {
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -47,7 +47,7 @@ dbc_kfifo_to_req(struct dbc_port *port,
 	return len;
 }
 
-static int dbc_start_tx(struct dbc_port *port)
+static int dbc_do_start_tx(struct dbc_port *port)
 	__releases(&port->port_lock)
 	__acquires(&port->port_lock)
 {
@@ -57,6 +57,8 @@ static int dbc_start_tx(struct dbc_port
 	bool			do_tty_wake = false;
 	struct list_head	*pool = &port->write_pool;
 
+	port->tx_running = true;
+
 	while (!list_empty(pool)) {
 		req = list_entry(pool->next, struct dbc_request, list_pool);
 		len = dbc_kfifo_to_req(port, req->buf);
@@ -77,12 +79,25 @@ static int dbc_start_tx(struct dbc_port
 		}
 	}
 
+	port->tx_running = false;
+
 	if (do_tty_wake && port->port.tty)
 		tty_wakeup(port->port.tty);
 
 	return status;
 }
 
+/* must be called with port->port_lock held */
+static int dbc_start_tx(struct dbc_port *port)
+{
+	lockdep_assert_held(&port->port_lock);
+
+	if (port->tx_running)
+		return -EBUSY;
+
+	return dbc_do_start_tx(port);
+}
+
 static void dbc_start_rx(struct dbc_port *port)
 	__releases(&port->port_lock)
 	__acquires(&port->port_lock)

[PATCH 6.6 68/93] xhci: dbgtty: fix device unregister

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Łukasz Bartosik <ukaszb@chromium.org>

commit 1f73b8b56cf35de29a433aee7bfff26cea98be3f upstream.

When DbC is disconnected then xhci_dbc_tty_unregister_device()
is called. However if there is any user space process blocked
on write to DbC terminal device then it will never be signalled
and thus stay blocked indifinitely.

This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device().
The tty_vhangup() wakes up any blocked writers and causes subsequent
write attempts to DbC terminal device to fail.

Cc: stable <stable@kernel.org>
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Signed-off-by: Łukasz Bartosik <ukaszb@chromium.org>
Link: https://patch.msgid.link/20251119212910.1245694-1-ukaszb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-dbgtty.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -518,6 +518,12 @@ static void xhci_dbc_tty_unregister_devi
 
 	if (!port->registered)
 		return;
+	/*
+	 * Hang up the TTY. This wakes up any blocked
+	 * writers and causes subsequent writes to fail.
+	 */
+	tty_vhangup(port->port.tty);
+
 	tty_unregister_device(dbc_tty_driver, port->minor);
 	xhci_dbc_tty_exit_port(port);
 	port->registered = false;

[PATCH 6.6 69/93] USB: serial: ftdi_sio: add support for u-blox EVK-M101

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksandr Suvorov <cryosay@gmail.com>

commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream.

The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces:
- EVK-M101 current sensors
- EVK-M101 I2C
- EVK-M101 UART
- EVK-M101 port D

Only the third USB interface is a UART. This change lets ftdi_sio probe
the VID/PID and registers only interface #3 as a TTY, leaving the rest
available for other drivers.

[1]
usb 5-1.3: new high-speed USB device number 11 using xhci_hcd
usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00
usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 5-1.3: Product: EVK-M101
usb 5-1.3: Manufacturer: u-blox AG

Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf

Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     |    1 +
 drivers/usb/serial/ftdi_sio_ids.h |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1074,6 +1074,7 @@ static const struct usb_device_id id_tab
 	/* U-Blox devices */
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+	{ USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },
 	/* FreeCalypso USB adapters */
 	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1614,6 +1614,7 @@
 #define UBLOX_VID			0x1546
 #define UBLOX_C099F9P_ZED_PID		0x0502
 #define UBLOX_C099F9P_ODIN_PID		0x0503
+#define UBLOX_EVK_M101_PID		0x0506
 
 /*
  * GMC devices

[PATCH 6.6 70/93] USB: serial: option: add support for Rolling RW101R-GL

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vanillan Wang <vanillanwang@163.com>

commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream.

- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM
  interface for Linux/Chrome OS)

  0x0301: mbim, pipe

T:  Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=33f8 ProdID=0301 Rev=05.04
S:  Manufacturer=Rolling Wireless S.a.r.l.
S:  Product=Rolling RW101R-GL Module
S:  SerialNumber=3ec4efdf
C:  #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms

- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM
  interface for Linux/Chrome OS)

  0x01a8: mbim, diag, AT, ADB, pipe1, pipe2

T:  Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=33f8 ProdID=01a8 Rev=05.04
S:  Manufacturer=Rolling Wireless S.a.r.l.
S:  Product=Rolling RW101R-GL Module
S:  SerialNumber=3ec4efdf
C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=89(I) Atr=03(Int.) MxPS=  10 Ivl=32ms

- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM
  interface for Linux/Chrome OS)

  0x0302: mbim, pipe

T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  6 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=33f8 ProdID=0302 Rev=05.04
S:  Manufacturer=Rolling Wireless S.a.r.l.
S:  Product=Rolling RW101R-GL Module
S:  SerialNumber=3ec4efdf
C:  #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms

- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM
  interface for Linux/Chrome OS)

  0x01a9: mbim, diag, AT, ADB, pipe1, pipe2

T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=33f8 ProdID=01a9 Rev=05.04
S:  Manufacturer=Rolling Wireless S.a.r.l.
S:  Product=Rolling RW101R-GL Module
S:  SerialNumber=3ec4efdf
C:  #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=89(I) Atr=03(Int.) MxPS=  10 Ivl=32ms

Signed-off-by: Vanillan Wang <vanillanwang@163.com>
Cc: stable@vger.kernel.org
[ johan: sort vendor entries, edit commit message slightly ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2424,12 +2424,18 @@ static const struct usb_device_id option
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
 	{ USB_DEVICE(0x33f8, 0x0104),						/* Rolling RW101-GL (laptop RMNET) */
 	  .driver_info = RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff),			/* Rolling RW135-GL (laptop MBIM) */
+	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff),			/* Rolling RW101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
-	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff),			/* Rolling RW135-GL (laptop MBIM) */
-	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff),			/* Rolling RW101R-GL (laptop MBIM) */
+	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff),			/* Rolling RW101R-GL (laptop MBIM) */
+	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) },			/* Rolling RW101R-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) },			/* Rolling RW101R-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff),			/* Rolling RW350-GL (laptop MBIM) */
 	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Global */

[PATCH 6.6 71/93] drm: sti: fix device leaks at component probe

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream.

Make sure to drop the references taken to the vtg devices by
of_find_device_by_node() when looking up their driver data during
component probe.

Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.

Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure")
Cc: stable@vger.kernel.org	# 4.16
Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/sti/sti_vtg.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/sti/sti_vtg.c
+++ b/drivers/gpu/drm/sti/sti_vtg.c
@@ -143,12 +143,17 @@ struct sti_vtg {
 struct sti_vtg *of_vtg_find(struct device_node *np)
 {
 	struct platform_device *pdev;
+	struct sti_vtg *vtg;
 
 	pdev = of_find_device_by_node(np);
 	if (!pdev)
 		return NULL;
 
-	return (struct sti_vtg *)platform_get_drvdata(pdev);
+	vtg = platform_get_drvdata(pdev);
+
+	put_device(&pdev->dev);
+
+	return vtg;
 }
 
 static void vtg_reset(struct sti_vtg *vtg)

[PATCH 6.6 72/93] drm/amd/display: Check NULL before accessing

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Hung <alex.hung@amd.com>

commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream.

[WHAT]
IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic
fails with NULL pointer dereference. This can be reproduced with
both an eDP panel and a DP monitors connected.

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP NOPTI
 CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted
6.16.0-99-custom #8 PREEMPT(voluntary)
 Hardware name: AMD ........
 RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu]
 Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49
 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30
 c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02
 RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668
 RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000
 RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760
 R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000
 R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c
 FS:  000071f631b68700(0000) GS:ffff8b399f114000(0000)
knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0
 PKRU: 55555554
 Call Trace:
 <TASK>
 dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu]
 amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu]
 ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu]
 amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu]
 drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400
 drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30
 drm_crtc_get_last_vbltimestamp+0x55/0x90
 drm_crtc_next_vblank_start+0x45/0xa0
 drm_atomic_helper_wait_for_fences+0x81/0x1f0
 ...

Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -634,9 +634,14 @@ bool dc_stream_get_scanoutpos(const stru
 {
 	uint8_t i;
 	bool ret = false;
-	struct dc  *dc = stream->ctx->dc;
-	struct resource_context *res_ctx =
-		&dc->current_state->res_ctx;
+	struct dc  *dc;
+	struct resource_context *res_ctx;
+
+	if (!stream->ctx)
+		return false;
+
+	dc = stream->ctx->dc;
+	res_ctx = &dc->current_state->res_ctx;
 
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;

[PATCH 6.6 73/93] net: dsa: microchip: common: Fix checks on irq_find_mapping()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>

commit 7b3c09e1667977edee11de94a85e2593a7c15e87 upstream.

irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found
but it never returns a negative value. However, on each
irq_find_mapping() call, we verify that the returned value isn't
negative.

Fix the irq_find_mapping() checks to enter error paths when 0 is
returned. Return -EINVAL in such cases.

CC: stable@vger.kernel.org
Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-1-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_common.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -1870,8 +1870,8 @@ static int ksz_irq_phy_setup(struct ksz_
 		if (BIT(phy) & ds->phys_mii_mask) {
 			irq = irq_find_mapping(dev->ports[phy].pirq.domain,
 					       PORT_SRC_PHY_INT);
-			if (irq < 0) {
-				ret = irq;
+			if (!irq) {
+				ret = -EINVAL;
 				goto out;
 			}
 			ds->slave_mii_bus->irq[phy] = irq;
@@ -2095,8 +2095,8 @@ static int ksz_pirq_setup(struct ksz_dev
 	snprintf(pirq->name, sizeof(pirq->name), "port_irq-%d", p);
 
 	pirq->irq_num = irq_find_mapping(dev->girq.domain, p);
-	if (pirq->irq_num < 0)
-		return pirq->irq_num;
+	if (!pirq->irq_num)
+		return -EINVAL;
 
 	return ksz_irq_common_setup(dev, pirq);
 }

[PATCH 6.6 74/93] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>

commit 9e059305be41a5bd27e03458d8333cf30d70be34 upstream.

irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found
but it never returns a negative value. However, during the PTP IRQ setup,
we verify that its returned value isn't negative.

Fix the irq_find_mapping() check to enter the error path when 0 is
returned. Return -EINVAL in such case.

Cc: stable@vger.kernel.org
Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-2-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_ptp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/dsa/microchip/ksz_ptp.c
+++ b/drivers/net/dsa/microchip/ksz_ptp.c
@@ -1145,8 +1145,8 @@ int ksz_ptp_irq_setup(struct dsa_switch
 		irq_create_mapping(ptpirq->domain, irq);
 
 	ptpirq->irq_num = irq_find_mapping(port->pirq.domain, PORT_SRC_PTP_INT);
-	if (ptpirq->irq_num < 0) {
-		ret = ptpirq->irq_num;
+	if (!ptpirq->irq_num) {
+		ret = -EINVAL;
 		goto out;
 	}
 

[PATCH 6.6 75/93] libceph: fix potential use-after-free in have_mon_and_osd_map()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit 076381c261374c587700b3accf410bdd2dba334e upstream.

The wait loop in __ceph_open_session() can race with the client
receiving a new monmap or osdmap shortly after the initial map is
received.  Both ceph_monc_handle_map() and handle_one_map() install
a new map immediately after freeing the old one

    kfree(monc->monmap);
    monc->monmap = monmap;

    ceph_osdmap_destroy(osdc->osdmap);
    osdc->osdmap = newmap;

under client->monc.mutex and client->osdc.lock respectively, but
because neither is taken in have_mon_and_osd_map() it's possible for
client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in

    client->monc.monmap && client->monc.monmap->epoch &&
        client->osdc.osdmap && client->osdc.osdmap->epoch;

condition to dereference an already freed map.  This happens to be
reproducible with generic/395 and generic/397 with KASAN enabled:

    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
    ...
    Call Trace:
    <TASK>
    have_mon_and_osd_map+0x56/0x70
    ceph_open_session+0x182/0x290
    ceph_get_tree+0x333/0x680
    vfs_get_tree+0x49/0x180
    do_new_mount+0x1a3/0x2d0
    path_mount+0x6dd/0x730
    do_mount+0x99/0xe0
    __do_sys_mount+0x141/0x180
    do_syscall_64+0x9f/0x100
    entry_SYSCALL_64_after_hwframe+0x76/0x7e
    </TASK>

    Allocated by task 13305:
    ceph_osdmap_alloc+0x16/0x130
    ceph_osdc_init+0x27a/0x4c0
    ceph_create_client+0x153/0x190
    create_fs_client+0x50/0x2a0
    ceph_get_tree+0xff/0x680
    vfs_get_tree+0x49/0x180
    do_new_mount+0x1a3/0x2d0
    path_mount+0x6dd/0x730
    do_mount+0x99/0xe0
    __do_sys_mount+0x141/0x180
    do_syscall_64+0x9f/0x100
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

    Freed by task 9475:
    kfree+0x212/0x290
    handle_one_map+0x23c/0x3b0
    ceph_osdc_handle_map+0x3c9/0x590
    mon_dispatch+0x655/0x6f0
    ceph_con_process_message+0xc3/0xe0
    ceph_con_v1_try_read+0x614/0x760
    ceph_con_workfn+0x2de/0x650
    process_one_work+0x486/0x7c0
    process_scheduled_works+0x73/0x90
    worker_thread+0x1c8/0x2a0
    kthread+0x2ec/0x300
    ret_from_fork+0x24/0x40
    ret_from_fork_asm+0x1a/0x30

Rewrite the wait loop to check the above condition directly with
client->monc.mutex and client->osdc.lock taken as appropriate.  While
at it, improve the timeout handling (previously mount_timeout could be
exceeded in case wait_event_interruptible_timeout() slept more than
once) and access client->auth_err under client->monc.mutex to match
how it's set in finish_auth().

monmap_show() and osdmap_show() now take the respective lock before
accessing the map as well.

Cc: stable@vger.kernel.org
Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/ceph_common.c |   53 +++++++++++++++++++++++++++++--------------------
 net/ceph/debugfs.c     |   14 +++++++++---
 2 files changed, 42 insertions(+), 25 deletions(-)

--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -786,41 +786,52 @@ void ceph_reset_client_addr(struct ceph_
 EXPORT_SYMBOL(ceph_reset_client_addr);
 
 /*
- * true if we have the mon map (and have thus joined the cluster)
- */
-static bool have_mon_and_osd_map(struct ceph_client *client)
-{
-	return client->monc.monmap && client->monc.monmap->epoch &&
-	       client->osdc.osdmap && client->osdc.osdmap->epoch;
-}
-
-/*
  * mount: join the ceph cluster, and open root directory.
  */
 int __ceph_open_session(struct ceph_client *client, unsigned long started)
 {
-	unsigned long timeout = client->options->mount_timeout;
-	long err;
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+	long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
+	bool have_monmap, have_osdmap;
+	int err;
 
 	/* open session, and wait for mon and osd maps */
 	err = ceph_monc_open_session(&client->monc);
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
-		err = wait_event_interruptible_timeout(client->auth_wq,
-			have_mon_and_osd_map(client) || (client->auth_err < 0),
-			ceph_timeout_jiffies(timeout));
-		if (err < 0)
-			return err;
-		if (client->auth_err < 0)
-			return client->auth_err;
+		timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
 	}
+	remove_wait_queue(&client->auth_wq, &wait);
+
+	if (err)
+		return err;
 
 	pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
 		&client->fsid);
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *
 	int i;
 	struct ceph_client *client = s->private;
 
+	mutex_lock(&client->monc.mutex);
 	if (client->monc.monmap == NULL)
-		return 0;
+		goto out_unlock;
 
 	seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
 	for (i = 0; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *
 			   ENTITY_NAME(inst->name),
 			   ceph_pr_addr(&inst->addr));
 	}
+
+out_unlock:
+	mutex_unlock(&client->monc.mutex);
 	return 0;
 }
 
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *
 	int i;
 	struct ceph_client *client = s->private;
 	struct ceph_osd_client *osdc = &client->osdc;
-	struct ceph_osdmap *map = osdc->osdmap;
+	struct ceph_osdmap *map;
 	struct rb_node *n;
 
+	down_read(&osdc->lock);
+	map = osdc->osdmap;
 	if (map == NULL)
-		return 0;
+		goto out_unlock;
 
-	down_read(&osdc->lock);
 	seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
 			osdc->epoch_barrier, map->flags);
 
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *
 		seq_printf(s, "]\n");
 	}
 
+out_unlock:
 	up_read(&osdc->lock);
 	return 0;
 }

[PATCH 6.6 76/93] libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: ziming zhang <ezrakiez@gmail.com>

commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc upstream.

The len field originates from untrusted network packets. Boundary
checks have been added to prevent potential out-of-bounds writes when
decrypting the connection secret or processing service tickets.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/auth_x.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -631,6 +631,7 @@ static int handle_auth_session_key(struc
 
 	/* connection secret */
 	ceph_decode_32_safe(p, end, len, e_inval);
+	ceph_decode_need(p, end, len, e_inval);
 	dout("%s connection secret blob len %d\n", __func__, len);
 	if (len > 0) {
 		dp = *p + ceph_x_encrypt_offset();
@@ -648,6 +649,7 @@ static int handle_auth_session_key(struc
 
 	/* service tickets */
 	ceph_decode_32_safe(p, end, len, e_inval);
+	ceph_decode_need(p, end, len, e_inval);
 	dout("%s service tickets blob len %d\n", __func__, len);
 	if (len > 0) {
 		ret = ceph_x_proc_ticket_reply(ac, &th->session_key,

[PATCH 6.6 77/93] libceph: replace BUG_ON with bounds check for map->max_osd

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: ziming zhang <ezrakiez@gmail.com>

commit ec3797f043756a94ea2d0f106022e14ac4946c02 upstream.

OSD indexes come from untrusted network packets. Boundary checks are
added to validate these against map->max_osd.

[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic
  edits ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/osdmap.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1504,8 +1504,6 @@ static int decode_new_primary_temp(void
 
 u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd)
 {
-	BUG_ON(osd >= map->max_osd);
-
 	if (!map->osd_primary_affinity)
 		return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
 
@@ -1514,8 +1512,6 @@ u32 ceph_get_primary_affinity(struct cep
 
 static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
 {
-	BUG_ON(osd >= map->max_osd);
-
 	if (!map->osd_primary_affinity) {
 		int i;
 
@@ -1577,6 +1573,8 @@ static int decode_new_primary_affinity(v
 
 		ceph_decode_32_safe(p, end, osd, e_inval);
 		ceph_decode_32_safe(p, end, aff, e_inval);
+		if (osd >= map->max_osd)
+			goto e_inval;
 
 		ret = set_primary_affinity(map, osd, aff);
 		if (ret)
@@ -1879,7 +1877,9 @@ static int decode_new_up_state_weight(vo
 		ceph_decode_need(p, end, 2*sizeof(u32), e_inval);
 		osd = ceph_decode_32(p);
 		w = ceph_decode_32(p);
-		BUG_ON(osd >= map->max_osd);
+		if (osd >= map->max_osd)
+			goto e_inval;
+
 		osdmap_info(map, "osd%d weight 0x%x %s\n", osd, w,
 			    w == CEPH_OSD_IN ? "(in)" :
 			    (w == CEPH_OSD_OUT ? "(out)" : ""));
@@ -1905,13 +1905,15 @@ static int decode_new_up_state_weight(vo
 		u32 xorstate;
 
 		osd = ceph_decode_32(p);
+		if (osd >= map->max_osd)
+			goto e_inval;
+
 		if (struct_v >= 5)
 			xorstate = ceph_decode_32(p);
 		else
 			xorstate = ceph_decode_8(p);
 		if (xorstate == 0)
 			xorstate = CEPH_OSD_UP;
-		BUG_ON(osd >= map->max_osd);
 		if ((map->osd_state[osd] & CEPH_OSD_UP) &&
 		    (xorstate & CEPH_OSD_UP))
 			osdmap_info(map, "osd%d down\n", osd);
@@ -1937,7 +1939,9 @@ static int decode_new_up_state_weight(vo
 		struct ceph_entity_addr addr;
 
 		osd = ceph_decode_32(p);
-		BUG_ON(osd >= map->max_osd);
+		if (osd >= map->max_osd)
+			goto e_inval;
+
 		if (struct_v >= 7)
 			ret = ceph_decode_entity_addrvec(p, end, msgr2, &addr);
 		else

[PATCH 6.6 78/93] bonding: return detailed error when loading native XDP fails

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hangbin Liu <liuhangbin@gmail.com>

[ Upstream commit 22ccb684c1cae37411450e6e86a379cd3c29cb8f ]

Bonding only supports native XDP for specific modes, which can lead to
confusion for users regarding why XDP loads successfully at times and
fails at others. This patch enhances error handling by returning detailed
error messages, providing users with clearer insights into the specific
reasons for the failure when loading native XDP.

Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20241021031211.814-2-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Rajani Kantha <681739313@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5622,8 +5622,11 @@ static int bond_xdp_set(struct net_devic
 
 	ASSERT_RTNL();
 
-	if (!bond_xdp_check(bond))
+	if (!bond_xdp_check(bond)) {
+		BOND_NL_ERR(dev, extack,
+			    "No native XDP support for the current bonding mode");
 		return -EOPNOTSUPP;
+	}
 
 	old_prog = bond->xdp_prog;
 	bond->xdp_prog = prog;

[PATCH 6.6 79/93] bonding: check xdp prog when set bond mode

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Liang <wangliang74@huawei.com>

[ Upstream commit 094ee6017ea09c11d6af187935a949df32803ce0 ]

Following operations can trigger a warning[1]:

    ip netns add ns1
    ip netns exec ns1 ip link add bond0 type bond mode balance-rr
    ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp
    ip netns exec ns1 ip link set bond0 type bond mode broadcast
    ip netns del ns1

When delete the namespace, dev_xdp_uninstall() is called to remove xdp
program on bond dev, and bond_xdp_set() will check the bond mode. If bond
mode is changed after attaching xdp program, the warning may occur.

Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode
with xdp program attached is not good. Add check for xdp program when set
bond mode.

    [1]
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930
    Modules linked in:
    CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
    Workqueue: netns cleanup_net
    RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930
    Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ...
    RSP: 0018:ffffc90000063d80 EFLAGS: 00000282
    RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff
    RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48
    RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb
    R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8
    R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000
    FS:  0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0
    Call Trace:
     <TASK>
     ? __warn+0x83/0x130
     ? unregister_netdevice_many_notify+0x8d9/0x930
     ? report_bug+0x18e/0x1a0
     ? handle_bug+0x54/0x90
     ? exc_invalid_op+0x18/0x70
     ? asm_exc_invalid_op+0x1a/0x20
     ? unregister_netdevice_many_notify+0x8d9/0x930
     ? bond_net_exit_batch_rtnl+0x5c/0x90
     cleanup_net+0x237/0x3d0
     process_one_work+0x163/0x390
     worker_thread+0x293/0x3b0
     ? __pfx_worker_thread+0x10/0x10
     kthread+0xec/0x1e0
     ? __pfx_kthread+0x10/0x10
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x2f/0x50
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    ---[ end trace 0000000000000000 ]---

Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Acked-by: Jussi Maki <joamaki@gmail.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://patch.msgid.link/20250321044852.1086551-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Rajani Kantha <681739313@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c    |    8 ++++----
 drivers/net/bonding/bond_options.c |    3 +++
 include/net/bonding.h              |    1 +
 3 files changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -322,9 +322,9 @@ static bool bond_sk_check(struct bonding
 	}
 }
 
-static bool bond_xdp_check(struct bonding *bond)
+bool bond_xdp_check(struct bonding *bond, int mode)
 {
-	switch (BOND_MODE(bond)) {
+	switch (mode) {
 	case BOND_MODE_ROUNDROBIN:
 	case BOND_MODE_ACTIVEBACKUP:
 		return true;
@@ -1855,7 +1855,7 @@ void bond_xdp_set_features(struct net_de
 
 	ASSERT_RTNL();
 
-	if (!bond_xdp_check(bond) || !bond_has_slaves(bond)) {
+	if (!bond_xdp_check(bond, BOND_MODE(bond)) || !bond_has_slaves(bond)) {
 		xdp_clear_features_flag(bond_dev);
 		return;
 	}
@@ -5622,7 +5622,7 @@ static int bond_xdp_set(struct net_devic
 
 	ASSERT_RTNL();
 
-	if (!bond_xdp_check(bond)) {
+	if (!bond_xdp_check(bond, BOND_MODE(bond))) {
 		BOND_NL_ERR(dev, extack,
 			    "No native XDP support for the current bonding mode");
 		return -EOPNOTSUPP;
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -868,6 +868,9 @@ static bool bond_set_xfrm_features(struc
 static int bond_option_mode_set(struct bonding *bond,
 				const struct bond_opt_value *newval)
 {
+	if (bond->xdp_prog && !bond_xdp_check(bond, newval->value))
+		return -EOPNOTSUPP;
+
 	if (!bond_mode_uses_arp(newval->value)) {
 		if (bond->params.arp_interval) {
 			netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -695,6 +695,7 @@ void bond_debug_register(struct bonding
 void bond_debug_unregister(struct bonding *bond);
 void bond_debug_reregister(struct bonding *bond);
 const char *bond_mode_name(int mode);
+bool bond_xdp_check(struct bonding *bond, int mode);
 void bond_setup(struct net_device *bond_dev);
 unsigned int bond_get_num_tx_queues(void);
 int bond_netlink_init(void);

[PATCH 6.6 80/93] nfsd: Replace clamp_t in nfsd4_get_drc_mem()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neil@brown.name>

A recent change to clamp_t() in 6.1.y caused fs/nfsd/nfs4state.c to fail
to compile with gcc-9. The code in nfsd4_get_drc_mem() was written with
the assumption that when "max < min",

   clamp(val, min, max)

would return max.  This assumption is not documented as an API promise
and the change caused a compile failure if it could be statically
determined that "max < min".

The relevant code was no longer present upstream when commit 1519fbc8832b
("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()")
landed there, so there is no upstream change to nfsd4_get_drc_mem() to
backport.

There is no clear case that the existing code in nfsd4_get_drc_mem()
is functioning incorrectly. The goal of this patch is to permit the clean
application of commit 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for
the lo < hi test in clamp()"), and any commits that depend on it, to LTS
kernels without affecting the ability to compile those kernels. This is
done by open-coding the __clamp() macro sans the built-in type checking.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220745#c0
Signed-off-by: NeilBrown <neil@brown.name>
Stable-dep-of: 1519fbc8832b ("minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed_by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Changes since Neil's post:
* Editorial changes to the commit message
* Attempt to address David's review comments
* Applied to linux-6.12.y, passed NFSD upstream CI suite

This patch is intended to be applied to linux-6.12.y, and should
apply cleanly to other LTS kernels since nfsd4_get_drc_mem hasn't
changed since v5.4.

--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1820,8 +1820,10 @@ static u32 nfsd4_get_drc_mem(struct nfsd
 	 */
 	scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads);
 
-	avail = clamp_t(unsigned long, avail, slotsize,
-			total_avail/scale_factor);
+	if (avail > total_avail / scale_factor)
+		avail = total_avail / scale_factor;
+	else if (avail < slotsize)
+		avail = slotsize;
 	num = min_t(int, num, avail / slotsize);
 	num = max_t(int, num, 1);
 	nfsd_drc_mem_used += num * slotsize;

[PATCH 6.6 81/93] usb: udc: Add trace event for usb_gadget_set_state

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kuen-Han Tsai <khtsai@google.com>

[ Upstream commit 7bf1158514e410310aec975e630cec99d4e4092f ]

While the userspace program can be notified of gadget state changes,
timing issue can lead to missed transitions when reading the state
value.

Introduce a trace event for usb_gadget_set_state to reliably track state
transitions.

Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://lore.kernel.org/r/20250818082722.2952867-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: baeb66fbd420 ("usb: gadget: udc: fix use-after-free in usb_gadget_state_work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/core.c  |    1 +
 drivers/usb/gadget/udc/trace.h |    5 +++++
 2 files changed, 6 insertions(+)

--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1123,6 +1123,7 @@ void usb_gadget_set_state(struct usb_gad
 {
 	gadget->state = state;
 	schedule_work(&gadget->work);
+	trace_usb_gadget_set_state(gadget, 0);
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
--- a/drivers/usb/gadget/udc/trace.h
+++ b/drivers/usb/gadget/udc/trace.h
@@ -81,6 +81,11 @@ DECLARE_EVENT_CLASS(udc_log_gadget,
 		__entry->ret)
 );
 
+DEFINE_EVENT(udc_log_gadget, usb_gadget_set_state,
+	TP_PROTO(struct usb_gadget *g, int ret),
+	TP_ARGS(g, ret)
+);
+
 DEFINE_EVENT(udc_log_gadget, usb_gadget_frame_number,
 	TP_PROTO(struct usb_gadget *g, int ret),
 	TP_ARGS(g, ret)

[PATCH 6.6 82/93] usb: gadget: udc: fix use-after-free in usb_gadget_state_work

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jimmy Hu <hhhuuu@google.com>

[ Upstream commit baeb66fbd4201d1c4325074e78b1f557dff89b5b ]

A race condition during gadget teardown can lead to a use-after-free
in usb_gadget_state_work(), as reported by KASAN:

  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0
  Workqueue: events usb_gadget_state_work

The fundamental race occurs because a concurrent event (e.g., an
interrupt) can call usb_gadget_set_state() and schedule gadget->work
at any time during the cleanup process in usb_del_gadget().

Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after
device removal") attempted to fix this by moving flush_work() to after
device_del(). However, this does not fully solve the race, as a new
work item can still be scheduled *after* flush_work() completes but
before the gadget's memory is freed, leading to the same use-after-free.

This patch fixes the race condition robustly by introducing a 'teardown'
flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is
set during cleanup in usb_del_gadget() *before* calling flush_work() to
prevent any new work from being scheduled once cleanup has commenced.
The scheduling site, usb_gadget_set_state(), now checks this flag under
the lock before queueing the work, thus safely closing the race window.

Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue")
Cc: stable <stable@kernel.org>
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/core.c |   17 ++++++++++++++++-
 include/linux/usb/gadget.h    |    5 +++++
 2 files changed, 21 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1121,8 +1121,13 @@ static void usb_gadget_state_work(struct
 void usb_gadget_set_state(struct usb_gadget *gadget,
 		enum usb_device_state state)
 {
+	unsigned long flags;
+
+	spin_lock_irqsave(&gadget->state_lock, flags);
 	gadget->state = state;
-	schedule_work(&gadget->work);
+	if (!gadget->teardown)
+		schedule_work(&gadget->work);
+	spin_unlock_irqrestore(&gadget->state_lock, flags);
 	trace_usb_gadget_set_state(gadget, 0);
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
@@ -1356,6 +1361,8 @@ static void usb_udc_nop_release(struct d
 void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget,
 		void (*release)(struct device *dev))
 {
+	spin_lock_init(&gadget->state_lock);
+	gadget->teardown = false;
 	INIT_WORK(&gadget->work, usb_gadget_state_work);
 	gadget->dev.parent = parent;
 
@@ -1530,6 +1537,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc);
 void usb_del_gadget(struct usb_gadget *gadget)
 {
 	struct usb_udc *udc = gadget->udc;
+	unsigned long flags;
 
 	if (!udc)
 		return;
@@ -1543,6 +1551,13 @@ void usb_del_gadget(struct usb_gadget *g
 	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
 	sysfs_remove_link(&udc->dev.kobj, "gadget");
 	device_del(&gadget->dev);
+	/*
+	 * Set the teardown flag before flushing the work to prevent new work
+	 * from being scheduled while we are cleaning up.
+	 */
+	spin_lock_irqsave(&gadget->state_lock, flags);
+	gadget->teardown = true;
+	spin_unlock_irqrestore(&gadget->state_lock, flags);
 	flush_work(&gadget->work);
 	ida_free(&gadget_id_numbers, gadget->id_number);
 	cancel_work_sync(&udc->vbus_work);
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -374,6 +374,9 @@ struct usb_gadget_ops {
  *	can handle. The UDC must support this and all slower speeds and lower
  *	number of lanes.
  * @state: the state we are now (attached, suspended, configured, etc)
+ * @state_lock: Spinlock protecting the `state` and `teardown` members.
+ * @teardown: True if the device is undergoing teardown, used to prevent
+ *	new work from being scheduled during cleanup.
  * @name: Identifies the controller hardware type.  Used in diagnostics
  *	and sometimes configuration.
  * @dev: Driver model state for this abstract device.
@@ -449,6 +452,8 @@ struct usb_gadget {
 	enum usb_ssp_rate		max_ssp_rate;
 
 	enum usb_device_state		state;
+	spinlock_t			state_lock;
+	bool				teardown;
 	const char			*name;
 	struct device			dev;
 	unsigned			isoch_delay;

[PATCH 6.6 83/93] usb: typec: ucsi: psy: Set max current to zero when disconnected

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jameson Thies <jthies@google.com>

[ Upstream commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c ]

The ucsi_psy_get_current_max function defaults to 0.1A when it is not
clear how much current the partner device can support. But this does
not check the port is connected, and will report 0.1A max current when
nothing is connected. Update ucsi_psy_get_current_max to report 0A when
there is no connection.

Fixes: af833e7f7db3 ("usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default")
Cc: stable@vger.kernel.org
Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Kenneth R. Crudup <kenny@panix.com>
Rule: add
Link: https://lore.kernel.org/stable/20251017000051.2094101-1-jthies%40google.com
Link: https://patch.msgid.link/20251106011446.2052583-1-jthies@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adapted UCSI_CONSTAT() macro to direct flag access ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/ucsi/psy.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/usb/typec/ucsi/psy.c
+++ b/drivers/usb/typec/ucsi/psy.c
@@ -144,6 +144,11 @@ static int ucsi_psy_get_current_max(stru
 {
 	u32 pdo;
 
+	if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+		val->intval = 0;
+		return 0;
+	}
+
 	switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
 	case UCSI_CONSTAT_PWR_OPMODE_PD:
 		if (con->num_pdos > 0) {

[PATCH 6.6 84/93] can: rcar_canfd: Fix CAN-FD mode as default

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit 6d849ff573722afcf5508d2800017bdd40f27eb9 ]

The commit 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting")
has aligned with the flow mentioned in the hardware manual for all SoCs
except R-Car Gen3 and RZ/G2L SoCs. On R-Car Gen4 and RZ/G3E SoCs, due to
the wrong logic in the commit[1] sets the default mode to FD-Only mode
instead of CAN-FD mode.

This patch sets the CAN-FD mode as the default for all SoCs by dropping
the rcar_canfd_set_mode() as some SoC requires mode setting in global
reset mode, and the rest of the SoCs in channel reset mode and update the
rcar_canfd_reset_controller() to take care of these constraints. Moreover,
the RZ/G3E and R-Car Gen4 SoCs support 3 modes compared to 2 modes on the
R-Car Gen3. Use inverted logic in rcar_canfd_reset_controller() to
simplify the code later to support FD-only mode.

[1]
commit 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC")

Fixes: 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting")
Cc: stable@vger.kernel.org
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20251118123926.193445-1-biju.das.jz@bp.renesas.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
[ adapted to use existing is_gen4() helper and RCANFD_GEN4_FDCFG() macro instead of new ch_interface_mode field and fcbase struct ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/rcar/rcar_canfd.c |   53 +++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 23 deletions(-)

--- a/drivers/net/can/rcar/rcar_canfd.c
+++ b/drivers/net/can/rcar/rcar_canfd.c
@@ -687,26 +687,6 @@ static void rcar_canfd_tx_failure_cleanu
 		can_free_echo_skb(ndev, i, NULL);
 }
 
-static void rcar_canfd_set_mode(struct rcar_canfd_global *gpriv)
-{
-	if (is_gen4(gpriv)) {
-		u32 ch, val = gpriv->fdmode ? RCANFD_GEN4_FDCFG_FDOE
-					    : RCANFD_GEN4_FDCFG_CLOE;
-
-		for_each_set_bit(ch, &gpriv->channels_mask,
-				 gpriv->info->max_channels)
-			rcar_canfd_set_bit(gpriv->base, RCANFD_GEN4_FDCFG(ch),
-					   val);
-	} else {
-		if (gpriv->fdmode)
-			rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG,
-					   RCANFD_GRMCFG_RCMC);
-		else
-			rcar_canfd_clear_bit(gpriv->base, RCANFD_GRMCFG,
-					     RCANFD_GRMCFG_RCMC);
-	}
-}
-
 static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
 {
 	u32 sts, ch;
@@ -738,6 +718,16 @@ static int rcar_canfd_reset_controller(s
 	/* Reset Global error flags */
 	rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
 
+	/* Set the controller into appropriate mode */
+	if (!is_gen4(gpriv)) {
+		if (gpriv->fdmode)
+			rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG,
+					   RCANFD_GRMCFG_RCMC);
+		else
+			rcar_canfd_clear_bit(gpriv->base, RCANFD_GRMCFG,
+					     RCANFD_GRMCFG_RCMC);
+	}
+
 	/* Transition all Channels to reset mode */
 	for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {
 		rcar_canfd_clear_bit(gpriv->base,
@@ -756,10 +746,27 @@ static int rcar_canfd_reset_controller(s
 				"channel %u reset failed\n", ch);
 			return err;
 		}
-	}
 
-	/* Set the controller into appropriate mode */
-	rcar_canfd_set_mode(gpriv);
+		/* Set the controller into appropriate mode */
+		if (is_gen4(gpriv)) {
+			/* Do not set CLOE and FDOE simultaneously */
+			if (!gpriv->fdmode) {
+				rcar_canfd_clear_bit(gpriv->base,
+						     RCANFD_GEN4_FDCFG(ch),
+						     RCANFD_GEN4_FDCFG_FDOE);
+				rcar_canfd_set_bit(gpriv->base,
+						   RCANFD_GEN4_FDCFG(ch),
+						   RCANFD_GEN4_FDCFG_CLOE);
+			} else {
+				rcar_canfd_clear_bit(gpriv->base,
+						     RCANFD_GEN4_FDCFG(ch),
+						     RCANFD_GEN4_FDCFG_FDOE);
+				rcar_canfd_clear_bit(gpriv->base,
+						     RCANFD_GEN4_FDCFG(ch),
+						     RCANFD_GEN4_FDCFG_CLOE);
+			}
+		}
+	}
 
 	return 0;
 }

[PATCH 6.6 85/93] iio: adc: rtq6056: Correct the sign bit index

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: ChiYuan Huang <cy_huang@richtek.com>

[ Upstream commit 9b45744bf09fc2a3287e05287141d6e123c125a7 ]

The vshunt/current reported register is a signed 16bit integer. The
sign bit index should be '15', not '16'.

Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support")
Reported-by: Andy Hsu <andy_ya_hsu@wiwynn.com>
Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ adapted switch statement to existing if-else structure for sign_extend32() fix ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/rtq6056.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/rtq6056.c
+++ b/drivers/iio/adc/rtq6056.c
@@ -171,7 +171,7 @@ static int rtq6056_adc_read_channel(stru
 	if (addr == RTQ6056_REG_BUSVOLT || addr == RTQ6056_REG_POWER)
 		*val = regval;
 	else
-		*val = sign_extend32(regval, 16);
+		*val = sign_extend32(regval, 15);
 
 	return IIO_VAL_INT;
 }

[PATCH 6.6 86/93] net: macb: fix unregister_netdev call order in macb_remove()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: luoguangfei <15388634752@163.com>

[ Upstream commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 ]

When removing a macb device, the driver calls phy_exit() before
unregister_netdev(). This leads to a WARN from kernfs:

  ------------[ cut here ]------------
  kernfs: can not remove 'attached_dev', no directory
  WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683
  Call trace:
    kernfs_remove_by_name_ns+0xd8/0xf0
    sysfs_remove_link+0x24/0x58
    phy_detach+0x5c/0x168
    phy_disconnect+0x4c/0x70
    phylink_disconnect_phy+0x6c/0xc0 [phylink]
    macb_close+0x6c/0x170 [macb]
    ...
    macb_remove+0x60/0x168 [macb]
    platform_remove+0x5c/0x80
    ...

The warning happens because the PHY is being exited while the netdev
is still registered. The correct order is to unregister the netdev
before shutting down the PHY and cleaning up the MDIO bus.

Fix this by moving unregister_netdev() ahead of phy_exit() in
macb_remove().

Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization")
Signed-off-by: luoguangfei <15388634752@163.com>
Link: https://patch.msgid.link/20250818232527.1316-1-15388634752@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Minor context change fixed. ]
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/cadence/macb_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5182,11 +5182,11 @@ static int macb_remove(struct platform_d
 
 	if (dev) {
 		bp = netdev_priv(dev);
+		unregister_netdev(dev);
 		phy_exit(bp->sgmii_phy);
 		mdiobus_unregister(bp->mii_bus);
 		mdiobus_free(bp->mii_bus);
 
-		unregister_netdev(dev);
 		tasklet_kill(&bp->hresp_err_tasklet);
 		pm_runtime_disable(&pdev->dev);
 		pm_runtime_dont_use_autosuspend(&pdev->dev);

[PATCH 6.6 87/93] staging: rtl8712: Remove driver using deprecated API wext

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Philipp Hortmann <philipp.g.hortmann@gmail.com>

commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 upstream.

This driver is in the staging area since 2010.

The following reasons lead to the removal:
- This driver generates maintenance workload for itself and for API wext
- A MAC80211 driver was available in 2016 time frame; This driver does
  not compile anymore but would be a better starting point than the
  current driver. Here the note from the TODO file:
  A replacement for this driver with MAC80211 support is available
  at https://github.com/chunkeey/rtl8192su
- no progress changing to mac80211
- Using this hardware is security wise not state of the art as WPA3 is
  not supported.

Find further discussions in the Link below.

Link: https://lore.kernel.org/linux-staging/a02e3e0b-8a9b-47d5-87cf-2c957a474daa@gmail.com/T/#t
Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
Tested-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com>
Link: https://lore.kernel.org/r/20241020144933.10956-1-philipp.g.hortmann@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[groeck: Resolved conflicts; dropped statement about hardware support in longterm kernels]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 MAINTAINERS                                          |    6 
 drivers/staging/Kconfig                              |    2 
 drivers/staging/Makefile                             |    1 
 drivers/staging/rtl8712/Kconfig                      |   21 
 drivers/staging/rtl8712/Makefile                     |   35 
 drivers/staging/rtl8712/TODO                         |   13 
 drivers/staging/rtl8712/basic_types.h                |   28 
 drivers/staging/rtl8712/drv_types.h                  |  175 -
 drivers/staging/rtl8712/ethernet.h                   |   21 
 drivers/staging/rtl8712/hal_init.c                   |  401 ---
 drivers/staging/rtl8712/ieee80211.c                  |  415 ---
 drivers/staging/rtl8712/ieee80211.h                  |  165 -
 drivers/staging/rtl8712/mlme_linux.c                 |  160 -
 drivers/staging/rtl8712/mlme_osdep.h                 |   31 
 drivers/staging/rtl8712/mp_custom_oid.h              |  287 --
 drivers/staging/rtl8712/os_intfs.c                   |  482 ---
 drivers/staging/rtl8712/osdep_intf.h                 |   32 
 drivers/staging/rtl8712/osdep_service.h              |   60 
 drivers/staging/rtl8712/recv_linux.c                 |  139 -
 drivers/staging/rtl8712/recv_osdep.h                 |   39 
 drivers/staging/rtl8712/rtl8712_bitdef.h             |   26 
 drivers/staging/rtl8712/rtl8712_cmd.c                |  409 ---
 drivers/staging/rtl8712/rtl8712_cmd.h                |  231 -
 drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h     |   95 
 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h     |   19 
 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h   |   41 
 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h   |   32 
 drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h |   65 
 drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h |   24 
 drivers/staging/rtl8712/rtl8712_efuse.c              |  564 ----
 drivers/staging/rtl8712/rtl8712_efuse.h              |   44 
 drivers/staging/rtl8712/rtl8712_event.h              |   86 
 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h    |  131 -
 drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h    |   61 
 drivers/staging/rtl8712/rtl8712_gp_bitdef.h          |   68 
 drivers/staging/rtl8712/rtl8712_gp_regdef.h          |   29 
 drivers/staging/rtl8712/rtl8712_hal.h                |  142 -
 drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h   |   44 
 drivers/staging/rtl8712/rtl8712_io.c                 |   99 
 drivers/staging/rtl8712/rtl8712_led.c                | 1830 --------------
 drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h  |   31 
 drivers/staging/rtl8712/rtl8712_macsetting_regdef.h  |   20 
 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h   |   39 
 drivers/staging/rtl8712/rtl8712_powersave_regdef.h   |   26 
 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h    |   36 
 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h    |   43 
 drivers/staging/rtl8712/rtl8712_recv.c               | 1080 --------
 drivers/staging/rtl8712/rtl8712_recv.h               |  145 -
 drivers/staging/rtl8712/rtl8712_regdef.h             |   32 
 drivers/staging/rtl8712/rtl8712_security_bitdef.h    |   34 
 drivers/staging/rtl8712/rtl8712_spec.h               |  121 
 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h      |  163 -
 drivers/staging/rtl8712/rtl8712_syscfg_regdef.h      |   42 
 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h    |   49 
 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h    |   26 
 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h        |   49 
 drivers/staging/rtl8712/rtl8712_wmac_regdef.h        |   36 
 drivers/staging/rtl8712/rtl8712_xmit.c               |  744 ------
 drivers/staging/rtl8712/rtl8712_xmit.h               |  108 
 drivers/staging/rtl8712/rtl871x_cmd.c                |  796 ------
 drivers/staging/rtl8712/rtl871x_cmd.h                |  761 ------
 drivers/staging/rtl8712/rtl871x_debug.h              |  130 -
 drivers/staging/rtl8712/rtl871x_eeprom.c             |  220 -
 drivers/staging/rtl8712/rtl871x_eeprom.h             |   88 
 drivers/staging/rtl8712/rtl871x_event.h              |  109 
 drivers/staging/rtl8712/rtl871x_ht.h                 |   33 
 drivers/staging/rtl8712/rtl871x_io.c                 |  147 -
 drivers/staging/rtl8712/rtl871x_io.h                 |  236 -
 drivers/staging/rtl8712/rtl871x_ioctl.h              |   94 
 drivers/staging/rtl8712/rtl871x_ioctl_linux.c        | 2330 -------------------
 drivers/staging/rtl8712/rtl871x_ioctl_rtl.c          |  519 ----
 drivers/staging/rtl8712/rtl871x_ioctl_rtl.h          |  109 
 drivers/staging/rtl8712/rtl871x_ioctl_set.c          |  354 --
 drivers/staging/rtl8712/rtl871x_ioctl_set.h          |   45 
 drivers/staging/rtl8712/rtl871x_led.h                |  118 
 drivers/staging/rtl8712/rtl871x_mlme.c               | 1710 -------------
 drivers/staging/rtl8712/rtl871x_mlme.h               |  205 -
 drivers/staging/rtl8712/rtl871x_mp.c                 |  724 -----
 drivers/staging/rtl8712/rtl871x_mp.h                 |  275 --
 drivers/staging/rtl8712/rtl871x_mp_ioctl.c           |  883 -------
 drivers/staging/rtl8712/rtl871x_mp_ioctl.h           |  328 --
 drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h      | 1034 --------
 drivers/staging/rtl8712/rtl871x_pwrctrl.c            |  234 -
 drivers/staging/rtl8712/rtl871x_pwrctrl.h            |  113 
 drivers/staging/rtl8712/rtl871x_recv.c               |  671 -----
 drivers/staging/rtl8712/rtl871x_recv.h               |  208 -
 drivers/staging/rtl8712/rtl871x_rf.h                 |   55 
 drivers/staging/rtl8712/rtl871x_security.c           | 1386 -----------
 drivers/staging/rtl8712/rtl871x_security.h           |  218 -
 drivers/staging/rtl8712/rtl871x_sta_mgt.c            |  263 --
 drivers/staging/rtl8712/rtl871x_wlan_sme.h           |   35 
 drivers/staging/rtl8712/rtl871x_xmit.c               | 1059 --------
 drivers/staging/rtl8712/rtl871x_xmit.h               |  288 --
 drivers/staging/rtl8712/sta_info.h                   |  132 -
 drivers/staging/rtl8712/usb_halinit.c                |  307 --
 drivers/staging/rtl8712/usb_intf.c                   |  638 -----
 drivers/staging/rtl8712/usb_ops.c                    |  195 -
 drivers/staging/rtl8712/usb_ops.h                    |   38 
 drivers/staging/rtl8712/usb_ops_linux.c              |  515 ----
 drivers/staging/rtl8712/usb_osintf.h                 |   35 
 drivers/staging/rtl8712/wifi.h                       |  196 -
 drivers/staging/rtl8712/wlan_bssdef.h                |  223 -
 drivers/staging/rtl8712/xmit_linux.c                 |  181 -
 drivers/staging/rtl8712/xmit_osdep.h                 |   52 
 104 files changed, 27667 deletions(-)
 delete mode 100644 drivers/staging/rtl8712/Kconfig
 delete mode 100644 drivers/staging/rtl8712/Makefile
 delete mode 100644 drivers/staging/rtl8712/TODO
 delete mode 100644 drivers/staging/rtl8712/basic_types.h
 delete mode 100644 drivers/staging/rtl8712/drv_types.h
 delete mode 100644 drivers/staging/rtl8712/ethernet.h
 delete mode 100644 drivers/staging/rtl8712/hal_init.c
 delete mode 100644 drivers/staging/rtl8712/ieee80211.c
 delete mode 100644 drivers/staging/rtl8712/ieee80211.h
 delete mode 100644 drivers/staging/rtl8712/mlme_linux.c
 delete mode 100644 drivers/staging/rtl8712/mlme_osdep.h
 delete mode 100644 drivers/staging/rtl8712/mp_custom_oid.h
 delete mode 100644 drivers/staging/rtl8712/os_intfs.c
 delete mode 100644 drivers/staging/rtl8712/osdep_intf.h
 delete mode 100644 drivers/staging/rtl8712/osdep_service.h
 delete mode 100644 drivers/staging/rtl8712/recv_linux.c
 delete mode 100644 drivers/staging/rtl8712/recv_osdep.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_cmd.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_efuse.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_event.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_gp_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_hal.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_io.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_led.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_macsetting_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_powersave_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_recv.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_security_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_spec.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_syscfg_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_timectrl_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_bitdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_wmac_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.c
 delete mode 100644 drivers/staging/rtl8712/rtl8712_xmit.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_cmd.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_debug.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_eeprom.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_event.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ht.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_io.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_io.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_linux.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_rtl.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_ioctl_set.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_led.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mlme.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mp.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_ioctl.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_pwrctrl.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_recv.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_rf.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_security.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_security.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_sta_mgt.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_wlan_sme.h
 delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.c
 delete mode 100644 drivers/staging/rtl8712/rtl871x_xmit.h
 delete mode 100644 drivers/staging/rtl8712/sta_info.h
 delete mode 100644 drivers/staging/rtl8712/usb_halinit.c
 delete mode 100644 drivers/staging/rtl8712/usb_intf.c
 delete mode 100644 drivers/staging/rtl8712/usb_ops.c
 delete mode 100644 drivers/staging/rtl8712/usb_ops.h
 delete mode 100644 drivers/staging/rtl8712/usb_ops_linux.c
 delete mode 100644 drivers/staging/rtl8712/usb_osintf.h
 delete mode 100644 drivers/staging/rtl8712/wifi.h
 delete mode 100644 drivers/staging/rtl8712/wlan_bssdef.h
 delete mode 100644 drivers/staging/rtl8712/xmit_linux.c
 delete mode 100644 drivers/staging/rtl8712/xmit_osdep.h

--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -20390,12 +20390,6 @@ S:	Maintained
 W:	http://wiki.laptop.org/go/DCON
 F:	drivers/staging/olpc_dcon/
 
-STAGING - REALTEK RTL8712U DRIVERS
-M:	Larry Finger <Larry.Finger@lwfinger.net>
-M:	Florian Schilhabel <florian.c.schilhabel@googlemail.com>.
-S:	Odd Fixes
-F:	drivers/staging/rtl8712/
-
 STAGING - SEPS525 LCD CONTROLLER DRIVERS
 M:	Michael Hennerich <michael.hennerich@analog.com>
 L:	linux-fbdev@vger.kernel.org
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -34,8 +34,6 @@ source "drivers/staging/rtl8192e/Kconfig
 
 source "drivers/staging/rtl8723bs/Kconfig"
 
-source "drivers/staging/rtl8712/Kconfig"
-
 source "drivers/staging/rts5208/Kconfig"
 
 source "drivers/staging/octeon/Kconfig"
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -7,7 +7,6 @@ obj-$(CONFIG_FB_OLPC_DCON)	+= olpc_dcon/
 obj-$(CONFIG_RTL8192U)		+= rtl8192u/
 obj-$(CONFIG_RTL8192E)		+= rtl8192e/
 obj-$(CONFIG_RTL8723BS)		+= rtl8723bs/
-obj-$(CONFIG_R8712U)		+= rtl8712/
 obj-$(CONFIG_RTS5208)		+= rts5208/
 obj-$(CONFIG_OCTEON_ETHERNET)	+= octeon/
 obj-$(CONFIG_VT6655)		+= vt6655/
--- a/drivers/staging/rtl8712/Kconfig
+++ /dev/null
@@ -1,21 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-config R8712U
-	tristate "RealTek RTL8712U (RTL8192SU) Wireless LAN NIC driver"
-	depends on WLAN && USB && CFG80211
-	select WIRELESS_EXT
-	select WEXT_PRIV
-	select FW_LOADER
-	help
-	    This option adds the Realtek RTL8712 USB device such as the
-	    D-Link DWA-130.
-
-	    If built as a module, it will be called r8712u.
-
-config R8712_TX_AGGR
-	bool "Realtek RTL8712U Transmit Aggregation code"
-	depends on R8712U && BROKEN
-	help
-	    This option provides transmit aggregation for the Realtek
-	    RTL8712 USB device.
-
-
--- a/drivers/staging/rtl8712/Makefile
+++ /dev/null
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-r8712u-y :=				\
-		rtl871x_cmd.o		\
-		rtl8712_cmd.o		\
-		rtl871x_security.o	\
-		rtl871x_eeprom.o	\
-		rtl8712_efuse.o		\
-		hal_init.o		\
-		usb_halinit.o		\
-		usb_ops.o		\
-		usb_ops_linux.o		\
-		rtl871x_io.o		\
-		rtl8712_io.o		\
-		rtl871x_ioctl_linux.o	\
-		rtl871x_ioctl_rtl.o	\
-		rtl871x_ioctl_set.o	\
-		rtl8712_led.o		\
-		rtl871x_mlme.o		\
-		ieee80211.o		\
-		rtl871x_mp_ioctl.o	\
-		rtl871x_mp.o		\
-		mlme_linux.o		\
-		recv_linux.o		\
-		xmit_linux.o		\
-		usb_intf.o		\
-		os_intfs.o		\
-		rtl871x_pwrctrl.o	\
-		rtl8712_recv.o		\
-		rtl871x_recv.o		\
-		rtl871x_sta_mgt.o	\
-		rtl871x_xmit.o		\
-		rtl8712_xmit.o
-
-obj-$(CONFIG_R8712U)	:= r8712u.o
-
--- a/drivers/staging/rtl8712/TODO
+++ /dev/null
@@ -1,13 +0,0 @@
-TODO:
-- merge Realtek's bugfixes and new features into the driver
-- switch to use LIB80211
-- switch to use MAC80211
-- checkpatch.pl fixes - only a few remain
-
-A replacement for this driver with MAC80211 support is available
-at https://github.com/chunkeey/rtl8192su
-
-Please send any patches to Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
-Larry Finger <Larry.Finger@lwfinger.net>,
-Florian Schilhabel <florian.c.schilhabel@googlemail.com> and
-Linux Driver Project Developer List <driverdev-devel@linuxdriverproject.org>.
--- a/drivers/staging/rtl8712/basic_types.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __BASIC_TYPES_H__
-#define __BASIC_TYPES_H__
-
-#include <linux/types.h>
-
-#define sint signed int
-
-/* Should we extend this to be host_addr_t and target_addr_t for case:
- *	host : x86_64
- *	target : mips64
- */
-#define addr_t unsigned long
-
-#endif /*__BASIC_TYPES_H__*/
-
--- a/drivers/staging/rtl8712/drv_types.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-/* ---------------------------------------------------------------------
- *
- *	For type defines and data structure defines
- *
- * ---------------------------------------------------------------------
- */
-#ifndef __DRV_TYPES_H__
-#define __DRV_TYPES_H__
-
-struct _adapter;
-
-#include "osdep_service.h"
-#include "wlan_bssdef.h"
-#include "rtl8712_spec.h"
-#include "rtl8712_hal.h"
-#include <linux/mutex.h>
-#include <linux/completion.h>
-
-enum _NIC_VERSION {
-	RTL8711_NIC,
-	RTL8712_NIC,
-	RTL8713_NIC,
-	RTL8716_NIC
-};
-
-struct	qos_priv	{
-	/* bit mask option: u-apsd, s-apsd, ts, block ack... */
-	unsigned int qos_option;
-};
-
-#include "rtl871x_ht.h"
-#include "rtl871x_cmd.h"
-#include "rtl871x_xmit.h"
-#include "rtl871x_recv.h"
-#include "rtl871x_security.h"
-#include "rtl871x_pwrctrl.h"
-#include "rtl871x_io.h"
-#include "rtl871x_eeprom.h"
-#include "sta_info.h"
-#include "rtl871x_mlme.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_debug.h"
-#include "rtl871x_rf.h"
-#include "rtl871x_event.h"
-#include "rtl871x_led.h"
-
-#define SPEC_DEV_ID_DISABLE_HT BIT(1)
-
-struct specific_device_id {
-	u32		flags;
-	u16		idVendor;
-	u16		idProduct;
-
-};
-
-struct registry_priv {
-	u8	chip_version;
-	u8	rfintfs;
-	u8	lbkmode;
-	u8	hci;
-	u8	network_mode;	/*infra, ad-hoc, auto*/
-	struct ndis_802_11_ssid	ssid;
-	u8	channel;/* ad-hoc support requirement */
-	u8	wireless_mode;/* A, B, G, auto */
-	u8	vrtl_carrier_sense; /*Enable, Disable, Auto*/
-	u8	vcs_type;/*RTS/CTS, CTS-to-self*/
-	u16	rts_thresh;
-	u16  frag_thresh;
-	u8	preamble;/*long, short, auto*/
-	u8  scan_mode;/*active, passive*/
-	u8  adhoc_tx_pwr;
-	u8  soft_ap;
-	u8  smart_ps;
-	u8 power_mgnt;
-	u8 radio_enable;
-	u8 long_retry_lmt;
-	u8 short_retry_lmt;
-	u16 busy_thresh;
-	u8 ack_policy;
-	u8 mp_mode;
-	u8 software_encrypt;
-	u8 software_decrypt;
-	/* UAPSD */
-	u8 wmm_enable;
-	u8 uapsd_enable;
-	u8 uapsd_max_sp;
-	u8 uapsd_acbk_en;
-	u8 uapsd_acbe_en;
-	u8 uapsd_acvi_en;
-	u8 uapsd_acvo_en;
-
-	struct wlan_bssid_ex dev_network;
-
-	u8 ht_enable;
-	u8 cbw40_enable;
-	u8 ampdu_enable;/*for tx*/
-	u8 rf_config;
-	u8 low_power;
-	u8 wifi_test;
-};
-
-struct dvobj_priv {
-	struct _adapter *padapter;
-	u32 nr_endpoint;
-	u8   ishighspeed;
-	uint (*inirp_init)(struct _adapter *adapter);
-	uint (*inirp_deinit)(struct _adapter *adapter);
-	struct usb_device *pusbdev;
-};
-
-/**
- * struct _adapter - the main adapter structure for this device.
- *
- * bup: True indicates that the interface is up.
- */
-struct _adapter {
-	struct	dvobj_priv dvobjpriv;
-	struct	mlme_priv mlmepriv;
-	struct	cmd_priv	cmdpriv;
-	struct	evt_priv	evtpriv;
-	struct	io_queue	*pio_queue;
-	struct	xmit_priv	xmitpriv;
-	struct	recv_priv	recvpriv;
-	struct	sta_priv	stapriv;
-	struct	security_priv	securitypriv;
-	struct	registry_priv	registrypriv;
-	struct	wlan_acl_pool	acl_list;
-	struct	pwrctrl_priv	pwrctrlpriv;
-	struct	eeprom_priv eeprompriv;
-	struct	hal_priv	halpriv;
-	struct	led_priv	ledpriv;
-	struct mp_priv  mppriv;
-	bool	driver_stopped;
-	bool	surprise_removed;
-	bool	suspended;
-	u8	eeprom_address_size;
-	u8	hw_init_completed;
-	struct task_struct *cmd_thread;
-	uint (*dvobj_init)(struct _adapter *adapter);
-	void (*dvobj_deinit)(struct _adapter *adapter);
-	struct net_device *pnetdev;
-	int bup;
-	struct net_device_stats stats;
-	struct iw_statistics iwstats;
-	int pid; /*process id from UI*/
-	struct work_struct wk_filter_rx_ff0;
-	const struct firmware *fw;
-	struct usb_interface *pusb_intf;
-	struct mutex mutex_start;
-	struct completion rtl8712_fw_ready;
-	struct completion rx_filter_ready;
-};
-
-static inline u8 *myid(struct eeprom_priv *peepriv)
-{
-	return peepriv->mac_addr;
-}
-
-u8 r8712_usb_hal_bus_init(struct _adapter *adapter);
-
-#endif /*__DRV_TYPES_H__*/
-
--- a/drivers/staging/rtl8712/ethernet.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __INC_ETHERNET_H
-#define __INC_ETHERNET_H
-
-#define ETHERNET_HEADER_SIZE		14	/*!< Ethernet Header Length*/
-#define LLC_HEADER_SIZE			6	/*!< LLC Header Length*/
-
-#endif /* #ifndef __INC_ETHERNET_H */
-
--- a/drivers/staging/rtl8712/hal_init.c
+++ /dev/null
@@ -1,401 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HAL_INIT_C_
-
-#include <linux/usb.h>
-#include <linux/device.h>
-#include <linux/usb/ch9.h>
-#include <linux/firmware.h>
-#include <linux/module.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "usb_osintf.h"
-
-#define FWBUFF_ALIGN_SZ 512
-#define MAX_DUMP_FWSZ (48 * 1024)
-
-static void rtl871x_load_fw_fail(struct _adapter *adapter)
-{
-	struct usb_device *udev = adapter->dvobjpriv.pusbdev;
-	struct device *dev = &udev->dev;
-	struct device *parent = dev->parent;
-
-	complete(&adapter->rtl8712_fw_ready);
-
-	dev_err(&udev->dev, "r8712u: Firmware request failed\n");
-
-	if (parent)
-		device_lock(parent);
-
-	device_release_driver(dev);
-
-	if (parent)
-		device_unlock(parent);
-}
-
-static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context)
-{
-	struct _adapter *adapter = context;
-
-	if (!firmware) {
-		rtl871x_load_fw_fail(adapter);
-		return;
-	}
-	adapter->fw = firmware;
-	/* firmware available - start netdev */
-	register_netdev(adapter->pnetdev);
-	complete(&adapter->rtl8712_fw_ready);
-}
-
-static const char firmware_file[] = "rtlwifi/rtl8712u.bin";
-
-int rtl871x_load_fw(struct _adapter *padapter)
-{
-	struct device *dev = &padapter->dvobjpriv.pusbdev->dev;
-	int rc;
-
-	init_completion(&padapter->rtl8712_fw_ready);
-	dev_info(dev, "r8712u: Loading firmware from \"%s\"\n", firmware_file);
-	rc = request_firmware_nowait(THIS_MODULE, 1, firmware_file, dev,
-				     GFP_KERNEL, padapter, rtl871x_load_fw_cb);
-	if (rc)
-		dev_err(dev, "r8712u: Firmware request error %d\n", rc);
-	return rc;
-}
-MODULE_FIRMWARE("rtlwifi/rtl8712u.bin");
-
-static u32 rtl871x_open_fw(struct _adapter *adapter, const u8 **mappedfw)
-{
-	if (adapter->fw->size > 200000) {
-		dev_err(&adapter->pnetdev->dev, "r8712u: Bad fw->size of %zu\n",
-			adapter->fw->size);
-		return 0;
-	}
-	*mappedfw = adapter->fw->data;
-	return adapter->fw->size;
-}
-
-static void fill_fwpriv(struct _adapter *adapter, struct fw_priv *fwpriv)
-{
-	struct dvobj_priv *dvobj = &adapter->dvobjpriv;
-	struct registry_priv *regpriv = &adapter->registrypriv;
-
-	memset(fwpriv, 0, sizeof(struct fw_priv));
-	/* todo: check if needs endian conversion */
-	fwpriv->hci_sel =  RTL8712_HCI_TYPE_72USB;
-	fwpriv->usb_ep_num = (u8)dvobj->nr_endpoint;
-	fwpriv->bw_40MHz_en = regpriv->cbw40_enable;
-	switch (regpriv->rf_config) {
-	case RTL8712_RF_1T1R:
-		fwpriv->rf_config = RTL8712_RFC_1T1R;
-		break;
-	case RTL8712_RF_2T2R:
-		fwpriv->rf_config = RTL8712_RFC_2T2R;
-		break;
-	case RTL8712_RF_1T2R:
-	default:
-		fwpriv->rf_config = RTL8712_RFC_1T2R;
-	}
-	fwpriv->mp_mode = (regpriv->mp_mode == 1);
-	/* 0:off 1:on 2:auto */
-	fwpriv->vcs_type = regpriv->vrtl_carrier_sense;
-	fwpriv->vcs_mode = regpriv->vcs_type; /* 1:RTS/CTS 2:CTS to self */
-	/* default enable turbo_mode */
-	fwpriv->turbo_mode = (regpriv->wifi_test != 1);
-	fwpriv->low_power_mode = regpriv->low_power;
-}
-
-static void update_fwhdr(struct fw_hdr	*pfwhdr, const u8 *pmappedfw)
-{
-	pfwhdr->signature = le16_to_cpu(*(__le16 *)pmappedfw);
-	pfwhdr->version = le16_to_cpu(*(__le16 *)(pmappedfw + 2));
-	/* define the size of boot loader */
-	pfwhdr->dmem_size = le32_to_cpu(*(__le32 *)(pmappedfw + 4));
-	/* define the size of FW in IMEM */
-	pfwhdr->img_IMEM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 8));
-	/* define the size of FW in SRAM */
-	pfwhdr->img_SRAM_size = le32_to_cpu(*(__le32 *)(pmappedfw + 12));
-	/* define the size of DMEM variable */
-	pfwhdr->fw_priv_sz = le32_to_cpu(*(__le32 *)(pmappedfw + 16));
-}
-
-static u8 chk_fwhdr(struct fw_hdr *pfwhdr, u32 ulfilelength)
-{
-	u32	fwhdrsz, fw_sz;
-
-	/* check signature */
-	if ((pfwhdr->signature != 0x8712) && (pfwhdr->signature != 0x8192))
-		return _FAIL;
-	/* check fw_priv_sze & sizeof(struct fw_priv) */
-	if (pfwhdr->fw_priv_sz != sizeof(struct fw_priv))
-		return _FAIL;
-	/* check fw_sz & image_fw_sz */
-	fwhdrsz = offsetof(struct fw_hdr, fwpriv) + pfwhdr->fw_priv_sz;
-	fw_sz =  fwhdrsz + pfwhdr->img_IMEM_size + pfwhdr->img_SRAM_size +
-		 pfwhdr->dmem_size;
-	if (fw_sz != ulfilelength)
-		return _FAIL;
-	return _SUCCESS;
-}
-
-static u8 rtl8712_dl_fw(struct _adapter *adapter)
-{
-	sint i;
-	u8 tmp8, tmp8_a;
-	u16 tmp16;
-	u32 maxlen = 0; /* for compare usage */
-	uint dump_imem_sz, imem_sz, dump_emem_sz, emem_sz; /* max = 49152; */
-	struct fw_hdr fwhdr;
-	u32 ulfilelength;	/* FW file size */
-	const u8 *mappedfw = NULL;
-	u8 *tmpchar = NULL, *payload, *ptr;
-	struct tx_desc *txdesc;
-	u32 txdscp_sz = sizeof(struct tx_desc);
-	u8 ret = _FAIL;
-
-	ulfilelength = rtl871x_open_fw(adapter, &mappedfw);
-	if (mappedfw && (ulfilelength > 0)) {
-		update_fwhdr(&fwhdr, mappedfw);
-		if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL)
-			return ret;
-		fill_fwpriv(adapter, &fwhdr.fwpriv);
-		/* firmware check ok */
-		maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ?
-			  fwhdr.img_IMEM_size : fwhdr.img_SRAM_size;
-		maxlen += txdscp_sz;
-		tmpchar = kmalloc(maxlen + FWBUFF_ALIGN_SZ, GFP_KERNEL);
-		if (!tmpchar)
-			return ret;
-
-		txdesc = (struct tx_desc *)(tmpchar + FWBUFF_ALIGN_SZ -
-			    ((addr_t)(tmpchar) & (FWBUFF_ALIGN_SZ - 1)));
-		payload = (u8 *)(txdesc) + txdscp_sz;
-		ptr = (u8 *)mappedfw + offsetof(struct fw_hdr, fwpriv) +
-		      fwhdr.fw_priv_sz;
-		/* Download FirmWare */
-		/* 1. determine IMEM code size and Load IMEM Code Section */
-		imem_sz = fwhdr.img_IMEM_size;
-		do {
-			memset(txdesc, 0, TXDESC_SIZE);
-			if (imem_sz >  MAX_DUMP_FWSZ/*49152*/) {
-				dump_imem_sz = MAX_DUMP_FWSZ;
-			} else {
-				dump_imem_sz = imem_sz;
-				txdesc->txdw0 |= cpu_to_le32(BIT(28));
-			}
-			txdesc->txdw0 |= cpu_to_le32(dump_imem_sz &
-						       0x0000ffff);
-			memcpy(payload, ptr, dump_imem_sz);
-			r8712_write_mem(adapter, RTL8712_DMA_VOQ,
-					dump_imem_sz + TXDESC_SIZE,
-					(u8 *)txdesc);
-			ptr += dump_imem_sz;
-			imem_sz -= dump_imem_sz;
-		} while (imem_sz > 0);
-		i = 10;
-		tmp16 = r8712_read16(adapter, TCR);
-		while (((tmp16 & _IMEM_CODE_DONE) == 0) && (i > 0)) {
-			usleep_range(10, 1000);
-			tmp16 = r8712_read16(adapter, TCR);
-			i--;
-		}
-		if (i == 0 || (tmp16 & _IMEM_CHK_RPT) == 0)
-			goto exit_fail;
-
-		/* 2.Download EMEM code size and Load EMEM Code Section */
-		emem_sz = fwhdr.img_SRAM_size;
-		do {
-			memset(txdesc, 0, TXDESC_SIZE);
-			if (emem_sz >  MAX_DUMP_FWSZ) { /* max=48k */
-				dump_emem_sz = MAX_DUMP_FWSZ;
-			} else {
-				dump_emem_sz = emem_sz;
-				txdesc->txdw0 |= cpu_to_le32(BIT(28));
-			}
-			txdesc->txdw0 |= cpu_to_le32(dump_emem_sz &
-						       0x0000ffff);
-			memcpy(payload, ptr, dump_emem_sz);
-			r8712_write_mem(adapter, RTL8712_DMA_VOQ,
-					dump_emem_sz + TXDESC_SIZE,
-					(u8 *)txdesc);
-			ptr += dump_emem_sz;
-			emem_sz -= dump_emem_sz;
-		} while (emem_sz > 0);
-		i = 5;
-		tmp16 = r8712_read16(adapter, TCR);
-		while (((tmp16 & _EMEM_CODE_DONE) == 0) && (i > 0)) {
-			usleep_range(10, 1000);
-			tmp16 = r8712_read16(adapter, TCR);
-			i--;
-		}
-		if (i == 0 || (tmp16 & _EMEM_CHK_RPT) == 0)
-			goto exit_fail;
-
-		/* 3.Enable CPU */
-		tmp8 = r8712_read8(adapter, SYS_CLKR);
-		r8712_write8(adapter, SYS_CLKR, tmp8 | BIT(2));
-		tmp8_a = r8712_read8(adapter, SYS_CLKR);
-		if (tmp8_a != (tmp8 | BIT(2)))
-			goto exit_fail;
-
-		tmp8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, tmp8 | BIT(2));
-		tmp8_a = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		if (tmp8_a != (tmp8 | BIT(2)))
-			goto exit_fail;
-
-		r8712_read32(adapter, TCR);
-
-		/* 4.polling IMEM Ready */
-		i = 100;
-		tmp16 = r8712_read16(adapter, TCR);
-		while (((tmp16 & _IMEM_RDY) == 0) && (i > 0)) {
-			msleep(20);
-			tmp16 = r8712_read16(adapter, TCR);
-			i--;
-		}
-		if (i == 0) {
-			r8712_write16(adapter, 0x10250348, 0xc000);
-			r8712_write16(adapter, 0x10250348, 0xc001);
-			r8712_write16(adapter, 0x10250348, 0x2000);
-			r8712_write16(adapter, 0x10250348, 0x2001);
-			r8712_write16(adapter, 0x10250348, 0x2002);
-			r8712_write16(adapter, 0x10250348, 0x2003);
-			goto exit_fail;
-		}
-		/* 5.Download DMEM code size and Load EMEM Code Section */
-		memset(txdesc, 0, TXDESC_SIZE);
-		txdesc->txdw0 |= cpu_to_le32(fwhdr.fw_priv_sz & 0x0000ffff);
-		txdesc->txdw0 |= cpu_to_le32(BIT(28));
-		memcpy(payload, &fwhdr.fwpriv, fwhdr.fw_priv_sz);
-		r8712_write_mem(adapter, RTL8712_DMA_VOQ,
-				fwhdr.fw_priv_sz + TXDESC_SIZE, (u8 *)txdesc);
-
-		/* polling dmem code done */
-		i = 100;
-		tmp16 = r8712_read16(adapter, TCR);
-		while (((tmp16 & _DMEM_CODE_DONE) == 0) && (i > 0)) {
-			msleep(20);
-			tmp16 = r8712_read16(adapter, TCR);
-			i--;
-		}
-		if (i == 0)
-			goto exit_fail;
-
-		tmp8 = r8712_read8(adapter, 0x1025000A);
-		if (tmp8 & BIT(4)) /* When boot from EEPROM,
-				    * & FW need more time to read EEPROM
-				    */
-			i = 60;
-		else			/* boot from EFUSE */
-			i = 30;
-		tmp16 = r8712_read16(adapter, TCR);
-		while (((tmp16 & _FWRDY) == 0) && (i > 0)) {
-			msleep(100);
-			tmp16 = r8712_read16(adapter, TCR);
-			i--;
-		}
-		if (i == 0)
-			goto exit_fail;
-	} else {
-		goto exit_fail;
-	}
-	ret = _SUCCESS;
-
-exit_fail:
-	kfree(tmpchar);
-	return ret;
-}
-
-uint rtl8712_hal_init(struct _adapter *padapter)
-{
-	u32 val32;
-	int i;
-
-	/* r8712 firmware download */
-	if (rtl8712_dl_fw(padapter) != _SUCCESS)
-		return _FAIL;
-
-	netdev_info(padapter->pnetdev, "1 RCR=0x%x\n",
-		    r8712_read32(padapter, RCR));
-	val32 = r8712_read32(padapter, RCR);
-	r8712_write32(padapter, RCR, (val32 | BIT(26))); /* Enable RX TCP
-							  * Checksum offload
-							  */
-	netdev_info(padapter->pnetdev, "2 RCR=0x%x\n",
-		    r8712_read32(padapter, RCR));
-	val32 = r8712_read32(padapter, RCR);
-	r8712_write32(padapter, RCR, (val32 | BIT(25))); /* Append PHY status */
-	val32 = r8712_read32(padapter, 0x10250040);
-	r8712_write32(padapter,  0x10250040, (val32 & 0x00FFFFFF));
-	/* for usb rx aggregation */
-	r8712_write8(padapter, 0x102500B5, r8712_read8(padapter, 0x102500B5) |
-	       BIT(0)); /* page = 128bytes */
-	r8712_write8(padapter, 0x102500BD, r8712_read8(padapter, 0x102500BD) |
-	       BIT(7)); /* enable usb rx aggregation */
-	r8712_write8(padapter, 0x102500D9, 1); /* TH=1 => means that invalidate
-						*  usb rx aggregation
-						*/
-	r8712_write8(padapter, 0x1025FE5B, 0x04); /* 1.7ms/4 */
-	/* Fix the RX FIFO issue(USB error) */
-	r8712_write8(padapter, 0x1025fe5C, r8712_read8(padapter, 0x1025fe5C)
-		     | BIT(7));
-	for (i = 0; i < ETH_ALEN; i++)
-		padapter->eeprompriv.mac_addr[i] = r8712_read8(padapter,
-							       MACID + i);
-	return _SUCCESS;
-}
-
-uint rtl8712_hal_deinit(struct _adapter *padapter)
-{
-	r8712_write8(padapter, RF_CTRL, 0x00);
-	/* Turn off BB */
-	msleep(20);
-	/* Turn off MAC	*/
-	r8712_write8(padapter, SYS_CLKR + 1, 0x38); /* Switch Control Path */
-	r8712_write8(padapter, SYS_FUNC_EN + 1, 0x70);
-	r8712_write8(padapter, PMC_FSM, 0x06);  /* Enable Loader Data Keep */
-	r8712_write8(padapter, SYS_ISO_CTRL, 0xF9); /* Isolation signals from
-						     * CORE, PLL
-						     */
-	r8712_write8(padapter, SYS_ISO_CTRL + 1, 0xe8); /* Enable EFUSE 1.2V */
-	r8712_write8(padapter, AFE_PLL_CTRL, 0x00); /* Disable AFE PLL. */
-	r8712_write8(padapter, LDOA15_CTRL, 0x54);  /* Disable A15V */
-	r8712_write8(padapter, SYS_FUNC_EN + 1, 0x50); /* Disable E-Fuse 1.2V */
-	r8712_write8(padapter, LDOV12D_CTRL, 0x24); /* Disable LDO12(for CE) */
-	r8712_write8(padapter, AFE_MISC, 0x30); /* Disable AFE BG&MB */
-	/* Option for Disable 1.6V LDO.	*/
-	r8712_write8(padapter, SPS0_CTRL, 0x56); /* Disable 1.6V LDO */
-	r8712_write8(padapter, SPS0_CTRL + 1, 0x43);  /* Set SW PFM */
-	return _SUCCESS;
-}
-
-uint rtl871x_hal_init(struct _adapter *padapter)
-{
-	padapter->hw_init_completed = false;
-	if (!padapter->halpriv.hal_bus_init)
-		return _FAIL;
-	if (padapter->halpriv.hal_bus_init(padapter) != _SUCCESS)
-		return _FAIL;
-	if (rtl8712_hal_init(padapter) == _SUCCESS) {
-		padapter->hw_init_completed = true;
-	} else {
-		padapter->hw_init_completed = false;
-		return _FAIL;
-	}
-	return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/ieee80211.c
+++ /dev/null
@@ -1,415 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * ieee80211.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _IEEE80211_C
-
-#include "drv_types.h"
-#include "ieee80211.h"
-#include "wifi.h"
-#include "osdep_service.h"
-#include "wlan_bssdef.h"
-
-static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1};
-static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0};
-static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1};
-static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2};
-static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4};
-static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5};
-
-static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0};
-static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1};
-static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2};
-static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4};
-static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5};
-
-/*-----------------------------------------------------------
- * for adhoc-master to generate ie and provide supported-rate to fw
- *-----------------------------------------------------------
- */
-
-static u8 WIFI_CCKRATES[] =  {
-	(IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
-	(IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
-	(IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
-	(IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)
-};
-
-static u8 WIFI_OFDMRATES[] = {
-	(IEEE80211_OFDM_RATE_6MB),
-	(IEEE80211_OFDM_RATE_9MB),
-	(IEEE80211_OFDM_RATE_12MB),
-	(IEEE80211_OFDM_RATE_18MB),
-	(IEEE80211_OFDM_RATE_24MB),
-	(IEEE80211_OFDM_RATE_36MB),
-	(IEEE80211_OFDM_RATE_48MB),
-	(IEEE80211_OFDM_RATE_54MB)
-};
-
-uint r8712_is_cckrates_included(u8 *rate)
-{
-	u32 i = 0;
-
-	while (rate[i] != 0) {
-		if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) ||
-		    (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22))
-			return true;
-		i++;
-	}
-	return false;
-}
-
-uint r8712_is_cckratesonly_included(u8 *rate)
-{
-	u32 i = 0;
-
-	while (rate[i] != 0) {
-		if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
-		    (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
-			return false;
-		i++;
-	}
-	return true;
-}
-
-/* r8712_set_ie will update frame length */
-u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen)
-{
-	*pbuf = (u8)index;
-	*(pbuf + 1) = (u8)len;
-	if (len > 0)
-		memcpy((void *)(pbuf + 2), (void *)source, len);
-	*frlen = *frlen + (len + 2);
-	return pbuf + len + 2;
-}
-
-/* ---------------------------------------------------------------------------
- * index: the information element id index, limit is the limit for search
- * ---------------------------------------------------------------------------
- */
-u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit)
-{
-	sint tmp, i;
-	u8 *p;
-
-	if (limit < 1)
-		return NULL;
-	p = pbuf;
-	i = 0;
-	*len = 0;
-	while (1) {
-		if (*p == index) {
-			*len = *(p + 1);
-			return p;
-		}
-		tmp = *(p + 1);
-		p += (tmp + 2);
-		i += (tmp + 2);
-		if (i >= limit)
-			break;
-	}
-	return NULL;
-}
-
-static void set_supported_rate(u8 *rates, uint mode)
-{
-	memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX);
-	switch (mode) {
-	case WIRELESS_11B:
-		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
-		break;
-	case WIRELESS_11G:
-	case WIRELESS_11A:
-		memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
-		break;
-	case WIRELESS_11BG:
-		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
-		memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES,
-		       IEEE80211_NUM_OFDM_RATESLEN);
-		break;
-	}
-}
-
-static uint r8712_get_rateset_len(u8 *rateset)
-{
-	uint i = 0;
-
-	while (1) {
-		if ((rateset[i]) == 0)
-			break;
-		if (i > 12)
-			break;
-		i++;
-	}
-	return i;
-}
-
-int r8712_generate_ie(struct registry_priv *registrypriv)
-{
-	int rate_len;
-	uint sz = 0;
-	struct wlan_bssid_ex *dev_network = &registrypriv->dev_network;
-	u8 *ie = dev_network->IEs;
-	u16 beacon_period = (u16)dev_network->Configuration.BeaconPeriod;
-
-	/*timestamp will be inserted by hardware*/
-	sz += 8;
-	ie += sz;
-	/*beacon interval : 2bytes*/
-	*(__le16 *)ie = cpu_to_le16(beacon_period);
-	sz += 2;
-	ie += 2;
-	/*capability info*/
-	*(u16 *)ie = 0;
-	*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS);
-	if (registrypriv->preamble == PREAMBLE_SHORT)
-		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
-	if (dev_network->Privacy)
-		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
-	sz += 2;
-	ie += 2;
-	/*SSID*/
-	ie = r8712_set_ie(ie, WLAN_EID_SSID, dev_network->Ssid.SsidLength,
-			  dev_network->Ssid.Ssid, &sz);
-	/*supported rates*/
-	set_supported_rate(dev_network->rates, registrypriv->wireless_mode);
-	rate_len = r8712_get_rateset_len(dev_network->rates);
-	if (rate_len > 8) {
-		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, 8,
-				  dev_network->rates, &sz);
-		ie = r8712_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8),
-				  (dev_network->rates + 8), &sz);
-	} else {
-		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES,
-				  rate_len, dev_network->rates, &sz);
-	}
-	/*DS parameter set*/
-	ie = r8712_set_ie(ie, WLAN_EID_DS_PARAMS, 1,
-			  (u8 *)&dev_network->Configuration.DSConfig, &sz);
-	/*IBSS Parameter Set*/
-	ie = r8712_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2,
-			  (u8 *)&dev_network->Configuration.ATIMWindow, &sz);
-	return sz;
-}
-
-unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit)
-{
-	u32 len;
-	u16 val16;
-	unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
-	u8 *buf = ie;
-
-	while (1) {
-		buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit);
-		if (buf) {
-			/*check if oui matches...*/
-			if (memcmp((buf + 2), wpa_oui_type,
-				   sizeof(wpa_oui_type)))
-				goto check_next_ie;
-			/*check version...*/
-			memcpy((u8 *)&val16, (buf + 6), sizeof(val16));
-			le16_to_cpus(&val16);
-			if (val16 != 0x0001)
-				goto check_next_ie;
-			*wpa_ie_len = *(buf + 1);
-			return buf;
-		}
-		*wpa_ie_len = 0;
-		return NULL;
-check_next_ie:
-		limit = limit - (buf - ie) - 2 - len;
-		if (limit <= 0)
-			break;
-		buf += (2 + len);
-	}
-	*wpa_ie_len = 0;
-	return NULL;
-}
-
-unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
-				 int limit)
-{
-	return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit);
-}
-
-static int r8712_get_wpa_cipher_suite(u8 *s)
-{
-	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN))
-		return WPA_CIPHER_NONE;
-	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN))
-		return WPA_CIPHER_WEP40;
-	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN))
-		return WPA_CIPHER_TKIP;
-	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN))
-		return WPA_CIPHER_CCMP;
-	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN))
-		return WPA_CIPHER_WEP104;
-	return 0;
-}
-
-static int r8712_get_wpa2_cipher_suite(u8 *s)
-{
-	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN))
-		return WPA_CIPHER_NONE;
-	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN))
-		return WPA_CIPHER_WEP40;
-	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN))
-		return WPA_CIPHER_TKIP;
-	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN))
-		return WPA_CIPHER_CCMP;
-	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN))
-		return WPA_CIPHER_WEP104;
-	return 0;
-}
-
-int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
-		       int *pairwise_cipher)
-{
-	int i;
-	int left, count;
-	u8 *pos;
-
-	if (wpa_ie_len <= 0) {
-		/* No WPA IE - fail silently */
-		return -EINVAL;
-	}
-	if ((*wpa_ie != _WPA_IE_ID_) ||
-	    (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
-	    (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
-		return -EINVAL;
-	pos = wpa_ie;
-	pos += 8;
-	left = wpa_ie_len - 8;
-	/*group_cipher*/
-	if (left >= WPA_SELECTOR_LEN) {
-		*group_cipher = r8712_get_wpa_cipher_suite(pos);
-		pos += WPA_SELECTOR_LEN;
-		left -= WPA_SELECTOR_LEN;
-	} else if (left > 0) {
-		return -EINVAL;
-	}
-	/*pairwise_cipher*/
-	if (left >= 2) {
-		count = le16_to_cpu(*(__le16 *)pos);
-		pos += 2;
-		left -= 2;
-		if (count == 0 || left < count * WPA_SELECTOR_LEN)
-			return -EINVAL;
-		for (i = 0; i < count; i++) {
-			*pairwise_cipher |= r8712_get_wpa_cipher_suite(pos);
-			pos += WPA_SELECTOR_LEN;
-			left -= WPA_SELECTOR_LEN;
-		}
-	} else if (left == 1) {
-		return -EINVAL;
-	}
-	return 0;
-}
-
-int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher,
-			int *pairwise_cipher)
-{
-	int i;
-	int left, count;
-	u8 *pos;
-
-	if (rsn_ie_len <= 0) {
-		/* No RSN IE - fail silently */
-		return -EINVAL;
-	}
-	if ((*rsn_ie != _WPA2_IE_ID_) ||
-	    (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
-		return -EINVAL;
-	pos = rsn_ie;
-	pos += 4;
-	left = rsn_ie_len - 4;
-	/*group_cipher*/
-	if (left >= RSN_SELECTOR_LEN) {
-		*group_cipher = r8712_get_wpa2_cipher_suite(pos);
-		pos += RSN_SELECTOR_LEN;
-		left -= RSN_SELECTOR_LEN;
-	} else if (left > 0) {
-		return -EINVAL;
-	}
-	/*pairwise_cipher*/
-	if (left >= 2) {
-		count = le16_to_cpu(*(__le16 *)pos);
-		pos += 2;
-		left -= 2;
-		if (count == 0 || left < count * RSN_SELECTOR_LEN)
-			return -EINVAL;
-		for (i = 0; i < count; i++) {
-			*pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos);
-			pos += RSN_SELECTOR_LEN;
-			left -= RSN_SELECTOR_LEN;
-		}
-	} else if (left == 1) {
-		return -EINVAL;
-	}
-	return 0;
-}
-
-int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
-		     u8 *wpa_ie, u16 *wpa_len)
-{
-	u8 authmode;
-	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
-	uint cnt;
-
-	/*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/
-	cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
-	while (cnt < in_len) {
-		authmode = in_ie[cnt];
-		if ((authmode == _WPA_IE_ID_) &&
-		    (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
-			memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
-			*wpa_len = in_ie[cnt + 1] + 2;
-			cnt += in_ie[cnt + 1] + 2;  /*get next */
-		} else {
-			if (authmode == _WPA2_IE_ID_) {
-				memcpy(rsn_ie, &in_ie[cnt],
-				       in_ie[cnt + 1] + 2);
-				*rsn_len = in_ie[cnt + 1] + 2;
-				cnt += in_ie[cnt + 1] + 2;  /*get next*/
-			} else {
-				cnt += in_ie[cnt + 1] + 2;   /*get next*/
-			}
-		}
-	}
-	return *rsn_len + *wpa_len;
-}
-
-int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
-{
-	int match;
-	uint cnt;
-	u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
-
-	cnt = 12;
-	match = false;
-	while (cnt < in_len) {
-		eid = in_ie[cnt];
-		if ((eid == _WPA_IE_ID_) &&
-		    (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
-			memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
-			*wps_ielen = in_ie[cnt + 1] + 2;
-			cnt += in_ie[cnt + 1] + 2;
-			match = true;
-			break;
-		}
-		cnt += in_ie[cnt + 1] + 2; /* goto next */
-	}
-	return match;
-}
--- a/drivers/staging/rtl8712/ieee80211.h
+++ /dev/null
@@ -1,165 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __IEEE80211_H
-#define __IEEE80211_H
-
-#include <linux/ieee80211.h>
-
-#define IEEE_CMD_SET_WPA_PARAM			1
-#define IEEE_CMD_SET_WPA_IE			2
-#define IEEE_CMD_SET_ENCRYPTION			3
-#define IEEE_CMD_MLME				4
-
-#define IEEE_PARAM_WPA_ENABLED			1
-#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
-#define IEEE_PARAM_DROP_UNENCRYPTED		3
-#define IEEE_PARAM_PRIVACY_INVOKED		4
-#define IEEE_PARAM_AUTH_ALGS			5
-#define IEEE_PARAM_IEEE_802_1X			6
-#define IEEE_PARAM_WPAX_SELECT			7
-
-#define AUTH_ALG_OPEN_SYSTEM			0x1
-#define AUTH_ALG_SHARED_KEY			0x2
-#define AUTH_ALG_LEAP				0x00000004
-
-#define IEEE_MLME_STA_DEAUTH			1
-#define IEEE_MLME_STA_DISASSOC			2
-
-#define IEEE_CRYPT_ERR_UNKNOWN_ALG		2
-#define IEEE_CRYPT_ERR_UNKNOWN_ADDR		3
-#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED	4
-#define IEEE_CRYPT_ERR_KEY_SET_FAILED		5
-#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED	6
-#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
-
-#define	IEEE_CRYPT_ALG_NAME_LEN			16
-
-#define WPA_CIPHER_NONE				BIT(0)
-#define WPA_CIPHER_WEP40			BIT(1)
-#define WPA_CIPHER_WEP104			BIT(2)
-#define WPA_CIPHER_TKIP				BIT(3)
-#define WPA_CIPHER_CCMP				BIT(4)
-
-#define WPA_SELECTOR_LEN			4
-#define RSN_HEADER_LEN				4
-
-#define RSN_SELECTOR_LEN 4
-
-enum NETWORK_TYPE {
-	WIRELESS_INVALID	= 0,
-	WIRELESS_11B		= 1,
-	WIRELESS_11G		= 2,
-	WIRELESS_11BG		= (WIRELESS_11B | WIRELESS_11G),
-	WIRELESS_11A		= 4,
-	WIRELESS_11N		= 8,
-	WIRELESS_11GN		= (WIRELESS_11G | WIRELESS_11N),
-	WIRELESS_11BGN		= (WIRELESS_11B | WIRELESS_11G | WIRELESS_11N),
-};
-
-struct ieee_param {
-	u32 cmd;
-	u8 sta_addr[ETH_ALEN];
-	union {
-		struct {
-			u8 name;
-			u32 value;
-		} wpa_param;
-		struct {
-			u32 len;
-			u8 reserved[32];
-			u8 data[];
-		} wpa_ie;
-		struct {
-			int command;
-			int reason_code;
-		} mlme;
-		struct {
-			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
-			u8 set_tx;
-			u32 err;
-			u8 idx;
-			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
-			u16 key_len;
-			u8 key[];
-		} crypt;
-	} u;
-};
-
-#define MIN_FRAG_THRESHOLD     256U
-#define	MAX_FRAG_THRESHOLD     2346U
-
-/* QoS,QOS */
-#define NORMAL_ACK			0
-
-/* IEEE 802.11 defines */
-
-#define P80211_OUI_LEN 3
-
-struct ieee80211_snap_hdr {
-	u8    dsap;   /* always 0xAA */
-	u8    ssap;   /* always 0xAA */
-	u8    ctrl;   /* always 0x03 */
-	u8    oui[P80211_OUI_LEN];    /* organizational universal id */
-} __packed;
-
-#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
-
-#define IEEE80211_CCK_RATE_LEN			4
-#define IEEE80211_NUM_OFDM_RATESLEN	8
-
-#define IEEE80211_CCK_RATE_1MB		        0x02
-#define IEEE80211_CCK_RATE_2MB		        0x04
-#define IEEE80211_CCK_RATE_5MB		        0x0B
-#define IEEE80211_CCK_RATE_11MB		        0x16
-#define IEEE80211_OFDM_RATE_6MB		        0x0C
-#define IEEE80211_OFDM_RATE_9MB		        0x12
-#define IEEE80211_OFDM_RATE_12MB		0x18
-#define IEEE80211_OFDM_RATE_18MB		0x24
-#define IEEE80211_OFDM_RATE_24MB		0x30
-#define IEEE80211_OFDM_RATE_36MB		0x48
-#define IEEE80211_OFDM_RATE_48MB		0x60
-#define IEEE80211_OFDM_RATE_54MB		0x6C
-#define IEEE80211_BASIC_RATE_MASK		0x80
-
-#define WEP_KEYS 4
-
-/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
- * only use 8, and then use extended rates for the remaining supported
- * rates.  Other APs, however, stick all of their supported rates on the
- * main rates information element...
- */
-#define MAX_RATES_LENGTH                  ((u8)12)
-#define MAX_WPA_IE_LEN 128
-
-struct registry_priv;
-
-u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen);
-u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit);
-unsigned char *r8712_get_wpa_ie(unsigned char *pie, uint *rsn_ie_len,
-				int limit);
-unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
-				 int limit);
-int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
-		       int *pairwise_cipher);
-int r8712_parse_wpa2_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
-			int *pairwise_cipher);
-int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
-		     u8 *wpa_ie, u16 *wpa_len);
-int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen);
-int r8712_generate_ie(struct registry_priv *pregistrypriv);
-uint r8712_is_cckrates_included(u8 *rate);
-uint r8712_is_cckratesonly_included(u8 *rate);
-
-#endif /* IEEE80211_H */
-
--- a/drivers/staging/rtl8712/mlme_linux.c
+++ /dev/null
@@ -1,160 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * mlme_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _MLME_OSDEP_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mlme_osdep.h"
-
-static void sitesurvey_ctrl_handler(struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t,
-			   mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer);
-
-	_r8712_sitesurvey_ctrl_handler(adapter);
-	mod_timer(&adapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer,
-		  jiffies + msecs_to_jiffies(3000));
-}
-
-static void join_timeout_handler (struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t, mlmepriv.assoc_timer);
-
-	_r8712_join_timeout_handler(adapter);
-}
-
-static void _scan_timeout_handler (struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t, mlmepriv.scan_to_timer);
-
-	r8712_scan_timeout_handler(adapter);
-}
-
-static void dhcp_timeout_handler (struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t, mlmepriv.dhcp_timer);
-
-	_r8712_dhcp_timeout_handler(adapter);
-}
-
-static void wdg_timeout_handler (struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t, mlmepriv.wdg_timer);
-
-	r8712_wdg_wk_cmd(adapter);
-
-	mod_timer(&adapter->mlmepriv.wdg_timer,
-		  jiffies + msecs_to_jiffies(2000));
-}
-
-void r8712_init_mlme_timer(struct _adapter *adapter)
-{
-	struct	mlme_priv *mlmepriv = &adapter->mlmepriv;
-
-	timer_setup(&mlmepriv->assoc_timer, join_timeout_handler, 0);
-	timer_setup(&mlmepriv->sitesurveyctrl.sitesurvey_ctrl_timer,
-		    sitesurvey_ctrl_handler, 0);
-	timer_setup(&mlmepriv->scan_to_timer, _scan_timeout_handler, 0);
-	timer_setup(&mlmepriv->dhcp_timer, dhcp_timeout_handler, 0);
-	timer_setup(&mlmepriv->wdg_timer, wdg_timeout_handler, 0);
-}
-
-void r8712_os_indicate_connect(struct _adapter *adapter)
-{
-	r8712_indicate_wx_assoc_event(adapter);
-	netif_carrier_on(adapter->pnetdev);
-}
-
-static struct RT_PMKID_LIST   backupPMKIDList[NUM_PMKID_CACHE];
-void r8712_os_indicate_disconnect(struct _adapter *adapter)
-{
-	u8 backupPMKIDIndex = 0;
-	u8 backupTKIPCountermeasure = 0x00;
-
-	r8712_indicate_wx_disassoc_event(adapter);
-	netif_carrier_off(adapter->pnetdev);
-	if (adapter->securitypriv.AuthAlgrthm == 2) { /*/802.1x*/
-		/* We have to backup the PMK information for WiFi PMK Caching
-		 * test item. Backup the btkip_countermeasure information.
-		 * When the countermeasure is trigger, the driver have to
-		 * disconnect with AP for 60 seconds.
-		 */
-
-		memcpy(&backupPMKIDList[0],
-		       &adapter->securitypriv.PMKIDList[0],
-		       sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
-		backupPMKIDIndex = adapter->securitypriv.PMKIDIndex;
-		backupTKIPCountermeasure =
-			adapter->securitypriv.btkip_countermeasure;
-		memset((unsigned char *)&adapter->securitypriv, 0,
-		       sizeof(struct security_priv));
-		timer_setup(&adapter->securitypriv.tkip_timer,
-			    r8712_use_tkipkey_handler, 0);
-		/* Restore the PMK information to securitypriv structure
-		 * for the following connection.
-		 */
-		memcpy(&adapter->securitypriv.PMKIDList[0],
-		       &backupPMKIDList[0],
-		       sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
-		adapter->securitypriv.PMKIDIndex = backupPMKIDIndex;
-		adapter->securitypriv.btkip_countermeasure =
-					 backupTKIPCountermeasure;
-	} else { /*reset values in securitypriv*/
-		struct security_priv *sec_priv = &adapter->securitypriv;
-
-		sec_priv->AuthAlgrthm = 0; /*open system*/
-		sec_priv->PrivacyAlgrthm = _NO_PRIVACY_;
-		sec_priv->PrivacyKeyIndex = 0;
-		sec_priv->XGrpPrivacy = _NO_PRIVACY_;
-		sec_priv->XGrpKeyid = 1;
-		sec_priv->ndisauthtype = Ndis802_11AuthModeOpen;
-		sec_priv->ndisencryptstatus = Ndis802_11WEPDisabled;
-		sec_priv->wps_phase = false;
-	}
-}
-
-void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
-{
-	uint len;
-	u8 *buff, *p, i;
-	union iwreq_data wrqu;
-
-	buff = NULL;
-	if (authmode == _WPA_IE_ID_) {
-		buff = kzalloc(IW_CUSTOM_MAX, GFP_ATOMIC);
-		if (!buff)
-			return;
-		p = buff;
-		p += sprintf(p, "ASSOCINFO(ReqIEs=");
-		len = sec_ie[1] + 2;
-		len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
-		for (i = 0; i < len; i++)
-			p += sprintf(p, "%02x", sec_ie[i]);
-		p += sprintf(p, ")");
-		memset(&wrqu, 0, sizeof(wrqu));
-		wrqu.data.length = p - buff;
-		wrqu.data.length = (wrqu.data.length < IW_CUSTOM_MAX) ?
-				   wrqu.data.length : IW_CUSTOM_MAX;
-		wireless_send_event(adapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
-		kfree(buff);
-	}
-}
--- a/drivers/staging/rtl8712/mlme_osdep.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef	__MLME_OSDEP_H_
-#define __MLME_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-void r8712_init_mlme_timer(struct _adapter *padapter);
-void r8712_os_indicate_disconnect(struct _adapter *adapter);
-void r8712_os_indicate_connect(struct _adapter *adapter);
-void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie);
-int r8712_recv_indicatepkts_in_order(struct _adapter *adapter,
-				     struct recv_reorder_ctrl *precvreorder_ctrl,
-				     int bforced);
-void r8712_indicate_wx_assoc_event(struct _adapter *padapter);
-void r8712_indicate_wx_disassoc_event(struct _adapter *padapter);
-
-#endif	/*_MLME_OSDEP_H_*/
-
--- a/drivers/staging/rtl8712/mp_custom_oid.h
+++ /dev/null
@@ -1,287 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef	__CUSTOM_OID_H
-#define __CUSTOM_OID_H
-
-/* 0xFF818000 - 0xFF81802F		RTL8180 Mass Production Kit
- * 0xFF818500 - 0xFF81850F		RTL8185 Setup Utility
- * 0xFF818580 - 0xFF81858F		RTL8185 Phy Status Utility
- *
- * by Owen for Production Kit
- * For Production Kit with Agilent Equipments
- * in order to make our custom oids hopefully somewhat unique
- * we will use 0xFF (indicating implementation specific OID)
- *	 81(first byte of non zero Realtek unique identifier)
- *	 80 (second byte of non zero Realtek unique identifier)
- *	 XX (the custom OID number - providing 255 possible custom oids)
- */
-#define OID_RT_PRO_RESET_DUT				0xFF818000
-#define OID_RT_PRO_SET_DATA_RATE			0xFF818001
-#define OID_RT_PRO_START_TEST				0xFF818002
-#define OID_RT_PRO_STOP_TEST				0xFF818003
-#define OID_RT_PRO_SET_PREAMBLE				0xFF818004
-#define OID_RT_PRO_SET_SCRAMBLER			0xFF818005
-#define OID_RT_PRO_SET_FILTER_BB			0xFF818006
-#define OID_RT_PRO_SET_MANUAL_DIVERSITY_BB		0xFF818007
-#define OID_RT_PRO_SET_CHANNEL_DIRECT_CALL		0xFF818008
-#define OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL		0xFF818009
-#define OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL		0xFF81800A
-
-#define OID_RT_PRO_SET_TX_ANTENNA_BB			0xFF81800D
-#define OID_RT_PRO_SET_ANTENNA_BB			0xFF81800E
-#define OID_RT_PRO_SET_CR_SCRAMBLER			0xFF81800F
-#define OID_RT_PRO_SET_CR_NEW_FILTER			0xFF818010
-#define OID_RT_PRO_SET_TX_POWER_CONTROL			0xFF818011
-#define OID_RT_PRO_SET_CR_TX_CONFIG			0xFF818012
-#define OID_RT_PRO_GET_TX_POWER_CONTROL			0xFF818013
-#define OID_RT_PRO_GET_CR_SIGNAL_QUALITY		0xFF818014
-#define OID_RT_PRO_SET_CR_SETPOINT			0xFF818015
-#define OID_RT_PRO_SET_INTEGRATOR			0xFF818016
-#define OID_RT_PRO_SET_SIGNAL_QUALITY			0xFF818017
-#define OID_RT_PRO_GET_INTEGRATOR			0xFF818018
-#define OID_RT_PRO_GET_SIGNAL_QUALITY			0xFF818019
-#define OID_RT_PRO_QUERY_EEPROM_TYPE			0xFF81801A
-#define OID_RT_PRO_WRITE_MAC_ADDRESS			0xFF81801B
-#define OID_RT_PRO_READ_MAC_ADDRESS			0xFF81801C
-#define OID_RT_PRO_WRITE_CIS_DATA			0xFF81801D
-#define OID_RT_PRO_READ_CIS_DATA			0xFF81801E
-#define OID_RT_PRO_WRITE_POWER_CONTROL			0xFF81801F
-#define OID_RT_PRO_READ_POWER_CONTROL			0xFF818020
-#define OID_RT_PRO_WRITE_EEPROM				0xFF818021
-#define OID_RT_PRO_READ_EEPROM				0xFF818022
-#define OID_RT_PRO_RESET_TX_PACKET_SENT			0xFF818023
-#define OID_RT_PRO_QUERY_TX_PACKET_SENT			0xFF818024
-#define OID_RT_PRO_RESET_RX_PACKET_RECEIVED		0xFF818025
-#define OID_RT_PRO_QUERY_RX_PACKET_RECEIVED		0xFF818026
-#define OID_RT_PRO_QUERY_RX_PACKET_CRC32_ERROR		0xFF818027
-#define OID_RT_PRO_QUERY_CURRENT_ADDRESS		0xFF818028
-#define OID_RT_PRO_QUERY_PERMANENT_ADDRESS		0xFF818029
-#define OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS		0xFF81802A
-#define OID_RT_PRO_RECEIVE_PACKET			0xFF81802C
-#define OID_RT_PRO_WRITE_EEPROM_BYTE			0xFF81802D
-#define OID_RT_PRO_READ_EEPROM_BYTE			0xFF81802E
-#define OID_RT_PRO_SET_MODULATION			0xFF81802F
-#define OID_RT_DRIVER_OPTION				0xFF818080
-#define OID_RT_RF_OFF					0xFF818081
-#define OID_RT_AUTH_STATUS				0xFF818082
-#define OID_RT_PRO_SET_CONTINUOUS_TX			0xFF81800B
-#define OID_RT_PRO_SET_SINGLE_CARRIER_TX		0xFF81800C
-#define OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX		0xFF81802B
-#define OID_RT_PRO_SET_SINGLE_TONE_TX			0xFF818043
-#define OID_RT_UTILITY_FALSE_ALARM_COUNTERS		0xFF818580
-#define OID_RT_UTILITY_SELECT_DEBUG_MODE		0xFF818581
-#define OID_RT_UTILITY_SELECT_SUBCARRIER_NUMBER		0xFF818582
-#define OID_RT_UTILITY_GET_RSSI_STATUS			0xFF818583
-#define OID_RT_UTILITY_GET_FRAME_DETECTION_STATUS	0xFF818584
-#define OID_RT_UTILITY_GET_AGC_AND_FREQUENCY_OFFSET_ESTIMATION_STATUS \
-							0xFF818585
-#define OID_RT_UTILITY_GET_CHANNEL_ESTIMATION_STATUS	0xFF818586
-#define OID_RT_WIRELESS_MODE				0xFF818500
-#define OID_RT_SUPPORTED_RATES				0xFF818501
-#define OID_RT_DESIRED_RATES				0xFF818502
-#define OID_RT_WIRELESS_MODE_STARTING_ADHOC		0xFF818503
-#define OID_RT_GET_CONNECT_STATE			0xFF030001
-#define OID_RT_RESCAN					0xFF030002
-#define OID_RT_SET_KEY_LENGTH				0xFF030003
-#define OID_RT_SET_DEFAULT_KEY_ID			0xFF030004
-#define OID_RT_SET_CHANNEL				0xFF010182
-#define OID_RT_SET_SNIFFER_MODE				0xFF010183
-#define OID_RT_GET_SIGNAL_QUALITY			0xFF010184
-#define OID_RT_GET_SMALL_PACKET_CRC			0xFF010185
-#define OID_RT_GET_MIDDLE_PACKET_CRC			0xFF010186
-#define OID_RT_GET_LARGE_PACKET_CRC			0xFF010187
-#define OID_RT_GET_TX_RETRY				0xFF010188
-#define OID_RT_GET_RX_RETRY				0xFF010189
-#define OID_RT_PRO_SET_FW_DIG_STATE			0xFF01018A
-#define OID_RT_PRO_SET_FW_RA_STATE			0xFF01018B
-#define OID_RT_GET_RX_TOTAL_PACKET			0xFF010190
-#define OID_RT_GET_TX_BEACON_OK				0xFF010191
-#define OID_RT_GET_TX_BEACON_ERR			0xFF010192
-#define OID_RT_GET_RX_ICV_ERR				0xFF010193
-#define OID_RT_SET_ENCRYPTION_ALGORITHM			0xFF010194
-#define OID_RT_SET_NO_AUTO_RESCAN			0xFF010195
-#define OID_RT_GET_PREAMBLE_MODE			0xFF010196
-#define OID_RT_GET_DRIVER_UP_DELTA_TIME			0xFF010197
-#define OID_RT_GET_AP_IP				0xFF010198
-#define OID_RT_GET_CHANNELPLAN				0xFF010199
-#define OID_RT_SET_PREAMBLE_MODE			0xFF01019A
-#define OID_RT_SET_BCN_INTVL				0xFF01019B
-#define OID_RT_GET_RF_VENDER				0xFF01019C
-#define OID_RT_DEDICATE_PROBE				0xFF01019D
-#define OID_RT_PRO_RX_FILTER_PATTERN			0xFF01019E
-#define OID_RT_GET_DCST_CURRENT_THRESHOLD		0xFF01019F
-#define OID_RT_GET_CCA_ERR				0xFF0101A0
-#define OID_RT_GET_CCA_UPGRADE_THRESHOLD		0xFF0101A1
-#define OID_RT_GET_CCA_FALLBACK_THRESHOLD		0xFF0101A2
-#define OID_RT_GET_CCA_UPGRADE_EVALUATE_TIMES		0xFF0101A3
-#define OID_RT_GET_CCA_FALLBACK_EVALUATE_TIMES		0xFF0101A4
-#define OID_RT_SET_RATE_ADAPTIVE			0xFF0101A5
-#define OID_RT_GET_DCST_EVALUATE_PERIOD			0xFF0101A5
-#define OID_RT_GET_DCST_TIME_UNIT_INDEX			0xFF0101A6
-#define OID_RT_GET_TOTAL_TX_BYTES			0xFF0101A7
-#define OID_RT_GET_TOTAL_RX_BYTES			0xFF0101A8
-#define OID_RT_CURRENT_TX_POWER_LEVEL			0xFF0101A9
-#define OID_RT_GET_ENC_KEY_MISMATCH_COUNT		0xFF0101AA
-#define OID_RT_GET_ENC_KEY_MATCH_COUNT			0xFF0101AB
-#define OID_RT_GET_CHANNEL				0xFF0101AC
-#define OID_RT_SET_CHANNELPLAN				0xFF0101AD
-#define OID_RT_GET_HARDWARE_RADIO_OFF			0xFF0101AE
-#define OID_RT_CHANNELPLAN_BY_COUNTRY			0xFF0101AF
-#define OID_RT_SCAN_AVAILABLE_BSSID			0xFF0101B0
-#define OID_RT_GET_HARDWARE_VERSION			0xFF0101B1
-#define OID_RT_GET_IS_ROAMING				0xFF0101B2
-#define OID_RT_GET_IS_PRIVACY				0xFF0101B3
-#define OID_RT_GET_KEY_MISMATCH				0xFF0101B4
-#define OID_RT_SET_RSSI_ROAM_TRAFFIC_TH			0xFF0101B5
-#define OID_RT_SET_RSSI_ROAM_SIGNAL_TH			0xFF0101B6
-#define OID_RT_RESET_LOG				0xFF0101B7
-#define OID_RT_GET_LOG					0xFF0101B8
-#define OID_RT_SET_INDICATE_HIDDEN_AP			0xFF0101B9
-#define OID_RT_GET_HEADER_FAIL				0xFF0101BA
-#define OID_RT_SUPPORTED_WIRELESS_MODE			0xFF0101BB
-#define OID_RT_GET_CHANNEL_LIST				0xFF0101BC
-#define OID_RT_GET_SCAN_IN_PROGRESS			0xFF0101BD
-#define OID_RT_GET_TX_INFO				0xFF0101BE
-#define OID_RT_RF_READ_WRITE_OFFSET			0xFF0101BF
-#define OID_RT_RF_READ_WRITE				0xFF0101C0
-#define OID_RT_FORCED_DATA_RATE				0xFF0101C1
-#define OID_RT_WIRELESS_MODE_FOR_SCAN_LIST		0xFF0101C2
-#define OID_RT_GET_BSS_WIRELESS_MODE			0xFF0101C3
-#define OID_RT_SCAN_WITH_MAGIC_PACKET			0xFF0101C4
-#define OID_RT_PRO_RX_FILTER				0xFF0111C0
-#define OID_CE_USB_WRITE_REGISTRY			0xFF0111C1
-#define OID_CE_USB_READ_REGISTRY			0xFF0111C2
-#define OID_RT_PRO_SET_INITIAL_GAIN			0xFF0111C3
-#define OID_RT_PRO_SET_BB_RF_STANDBY_MODE		0xFF0111C4
-#define OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE		0xFF0111C5
-#define OID_RT_PRO_SET_TX_CHARGE_PUMP			0xFF0111C6
-#define OID_RT_PRO_SET_RX_CHARGE_PUMP			0xFF0111C7
-#define OID_RT_PRO_RF_WRITE_REGISTRY			0xFF0111C8
-#define OID_RT_PRO_RF_READ_REGISTRY			0xFF0111C9
-#define OID_RT_PRO_QUERY_RF_TYPE			0xFF0111CA
-#define OID_RT_AP_GET_ASSOCIATED_STATION_LIST		0xFF010300
-#define OID_RT_AP_GET_CURRENT_TIME_STAMP		0xFF010301
-#define OID_RT_AP_SWITCH_INTO_AP_MODE			0xFF010302
-#define OID_RT_AP_SET_DTIM_PERIOD			0xFF010303
-#define OID_RT_AP_SUPPORTED				0xFF010304
-#define OID_RT_AP_SET_PASSPHRASE			0xFF010305
-#define OID_RT_PRO8187_WI_POLL				0xFF818780
-#define OID_RT_PRO_WRITE_BB_REG				0xFF818781
-#define OID_RT_PRO_READ_BB_REG				0xFF818782
-#define OID_RT_PRO_WRITE_RF_REG				0xFF818783
-#define OID_RT_PRO_READ_RF_REG				0xFF818784
-#define OID_RT_MH_VENDER_ID				0xFFEDC100
-#define OID_RT_PRO8711_JOIN_BSS				0xFF871100
-#define OID_RT_PRO_READ_REGISTER			0xFF871101
-#define OID_RT_PRO_WRITE_REGISTER			0xFF871102
-#define OID_RT_PRO_BURST_READ_REGISTER			0xFF871103
-#define OID_RT_PRO_BURST_WRITE_REGISTER			0xFF871104
-#define OID_RT_PRO_WRITE_TXCMD				0xFF871105
-#define OID_RT_PRO_READ16_EEPROM			0xFF871106
-#define OID_RT_PRO_WRITE16_EEPROM			0xFF871107
-#define OID_RT_PRO_H2C_SET_COMMAND			0xFF871108
-#define OID_RT_PRO_H2C_QUERY_RESULT			0xFF871109
-#define OID_RT_PRO8711_WI_POLL				0xFF87110A
-#define OID_RT_PRO8711_PKT_LOSS				0xFF87110B
-#define OID_RT_RD_ATTRIB_MEM				0xFF87110C
-#define OID_RT_WR_ATTRIB_MEM				0xFF87110D
-/*Method 2 for H2C/C2H*/
-#define OID_RT_PRO_H2C_CMD_MODE				0xFF871110
-#define OID_RT_PRO_H2C_CMD_RSP_MODE			0xFF871111
-#define OID_RT_PRO_H2C_CMD_EVENT_MODE			0xFF871112
-#define OID_RT_PRO_WAIT_C2H_EVENT			0xFF871113
-#define OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST		0xFF871114
-#define OID_RT_PRO_SCSI_ACCESS_TEST			0xFF871115
-#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT		0xFF871116
-#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN			0xFF871117
-#define OID_RT_RRO_RX_PKT_VIA_IOCTRL			0xFF871118
-#define OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL		0xFF871119
-#define OID_RT_RPO_SET_PWRMGT_TEST			0xFF87111A
-#define OID_RT_PRO_QRY_PWRMGT_TEST			0XFF87111B
-#define OID_RT_RPO_ASYNC_RWIO_TEST			0xFF87111C
-#define OID_RT_RPO_ASYNC_RWIO_POLL			0xFF87111D
-#define OID_RT_PRO_SET_RF_INTFS				0xFF87111E
-#define OID_RT_POLL_RX_STATUS				0xFF87111F
-#define OID_RT_PRO_CFG_DEBUG_MESSAGE			0xFF871120
-#define OID_RT_PRO_SET_DATA_RATE_EX			0xFF871121
-#define OID_RT_PRO_SET_BASIC_RATE			0xFF871122
-#define OID_RT_PRO_READ_TSSI				0xFF871123
-#define OID_RT_PRO_SET_POWER_TRACKING			0xFF871124
-#define OID_RT_PRO_QRY_PWRSTATE				0xFF871150
-#define OID_RT_PRO_SET_PWRSTATE				0xFF871151
-/*Method 2 , using workitem */
-#define OID_RT_SET_READ_REG				0xFF871181
-#define OID_RT_SET_WRITE_REG				0xFF871182
-#define OID_RT_SET_BURST_READ_REG			0xFF871183
-#define OID_RT_SET_BURST_WRITE_REG			0xFF871184
-#define OID_RT_SET_WRITE_TXCMD				0xFF871185
-#define OID_RT_SET_READ16_EEPROM			0xFF871186
-#define OID_RT_SET_WRITE16_EEPROM			0xFF871187
-#define OID_RT_QRY_POLL_WKITEM				0xFF871188
-
-/*For SDIO INTERFACE only*/
-#define OID_RT_PRO_SYNCPAGERW_SRAM			0xFF8711A0
-#define OID_RT_PRO_871X_DRV_EXT				0xFF8711A1
-
-/*For USB INTERFACE only*/
-#define OID_RT_PRO_USB_VENDOR_REQ			0xFF8711B0
-#define OID_RT_PRO_SCSI_AUTO_TEST			0xFF8711B1
-#define OID_RT_PRO_USB_MAC_AC_FIFO_WRITE		0xFF8711B2
-#define OID_RT_PRO_USB_MAC_RX_FIFO_READ			0xFF8711B3
-#define OID_RT_PRO_USB_MAC_RX_FIFO_POLLING		0xFF8711B4
-
-#define OID_RT_PRO_H2C_SET_RATE_TABLE			0xFF8711FB
-#define OID_RT_PRO_H2C_GET_RATE_TABLE			0xFF8711FC
-#define OID_RT_PRO_H2C_C2H_LBK_TEST			0xFF8711FE
-
-#define OID_RT_PRO_ENCRYPTION_CTRL			0xFF871200
-#define OID_RT_PRO_ADD_STA_INFO				0xFF871201
-#define OID_RT_PRO_DELE_STA_INFO			0xFF871202
-#define OID_RT_PRO_QUERY_DR_VARIABLE			0xFF871203
-
-#define OID_RT_PRO_RX_PACKET_TYPE			0xFF871204
-
-#define OID_RT_PRO_READ_EFUSE				0xFF871205
-#define OID_RT_PRO_WRITE_EFUSE				0xFF871206
-#define OID_RT_PRO_RW_EFUSE_PGPKT			0xFF871207
-#define OID_RT_GET_EFUSE_CURRENT_SIZE			0xFF871208
-
-#define OID_RT_SET_BANDWIDTH				0xFF871209
-#define OID_RT_SET_CRYSTAL_CAP				0xFF87120A
-
-#define OID_RT_SET_RX_PACKET_TYPE			0xFF87120B
-
-#define OID_RT_GET_EFUSE_MAX_SIZE			0xFF87120C
-
-#define OID_RT_PRO_SET_TX_AGC_OFFSET			0xFF87120D
-
-#define OID_RT_PRO_SET_PKT_TEST_MODE			0xFF87120E
-
-#define OID_RT_PRO_FOR_EVM_TEST_SETTING			0xFF87120F
-
-#define OID_RT_PRO_GET_THERMAL_METER			0xFF871210
-
-#define OID_RT_RESET_PHY_RX_PACKET_COUNT		0xFF871211
-#define OID_RT_GET_PHY_RX_PACKET_RECEIVED		0xFF871212
-#define OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR		0xFF871213
-
-#define OID_RT_SET_POWER_DOWN				0xFF871214
-
-#define OID_RT_GET_POWER_MODE				0xFF871215
-
-#define OID_RT_PRO_EFUSE				0xFF871216
-#define OID_RT_PRO_EFUSE_MAP				0xFF871217
-
-#endif /*#ifndef __CUSTOM_OID_H */
-
--- a/drivers/staging/rtl8712/os_intfs.c
+++ /dev/null
@@ -1,482 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * os_intfs.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _OS_INTFS_C_
-
-#include <linux/module.h>
-#include <linux/kthread.h>
-#include <linux/firmware.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "xmit_osdep.h"
-#include "recv_osdep.h"
-#include "rtl871x_ioctl.h"
-#include "usb_osintf.h"
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("rtl871x wireless lan driver");
-MODULE_AUTHOR("Larry Finger");
-
-static char ifname[IFNAMSIZ] = "wlan%d";
-
-/* module param defaults */
-static int chip_version = RTL8712_2ndCUT;
-static int rfintfs = HWPI;
-static int lbkmode = RTL8712_AIR_TRX;
-static int hci = RTL8712_USB;
-static int ampdu_enable = 1;/*for enable tx_ampdu*/
-
-/* The video_mode variable is for video mode.*/
-/* It may be specify when inserting module with video_mode=1 parameter.*/
-static int video_mode = 1;   /* enable video mode*/
-
-/*Ndis802_11Infrastructure; infra, ad-hoc, auto*/
-static int network_mode = Ndis802_11IBSS;
-static int channel = 1;/*ad-hoc support requirement*/
-static int wireless_mode = WIRELESS_11BG;
-static int vrtl_carrier_sense = AUTO_VCS;
-static int vcs_type = RTS_CTS;
-static int frag_thresh = 2346;
-static int preamble = PREAMBLE_LONG;/*long, short, auto*/
-static int scan_mode = 1;/*active, passive*/
-static int adhoc_tx_pwr = 1;
-static int soft_ap;
-static int smart_ps = 1;
-static int power_mgnt = PS_MODE_ACTIVE;
-static int radio_enable = 1;
-static int long_retry_lmt = 7;
-static int short_retry_lmt = 7;
-static int busy_thresh = 40;
-static int ack_policy = NORMAL_ACK;
-static int mp_mode;
-static int software_encrypt;
-static int software_decrypt;
-
-static int wmm_enable;/* default is set to disable the wmm.*/
-static int uapsd_enable;
-static int uapsd_max_sp = NO_LIMIT;
-static int uapsd_acbk_en;
-static int uapsd_acbe_en;
-static int uapsd_acvi_en;
-static int uapsd_acvo_en;
-
-static int ht_enable = 1;
-static int cbw40_enable = 1;
-static int rf_config = RTL8712_RF_1T2R;  /* 1T2R*/
-static int low_power;
-/* mac address to use instead of the one stored in Efuse */
-char *r8712_initmac;
-static char *initmac;
-/* if wifi_test = 1, driver will disable the turbo mode and pass it to
- * firmware private.
- */
-static int wifi_test;
-
-module_param_string(ifname, ifname, sizeof(ifname), 0644);
-module_param(wifi_test, int, 0644);
-module_param(initmac, charp, 0644);
-module_param(video_mode, int, 0644);
-module_param(chip_version, int, 0644);
-module_param(rfintfs, int, 0644);
-module_param(lbkmode, int, 0644);
-module_param(hci, int, 0644);
-module_param(network_mode, int, 0644);
-module_param(channel, int, 0644);
-module_param(mp_mode, int, 0644);
-module_param(wmm_enable, int, 0644);
-module_param(vrtl_carrier_sense, int, 0644);
-module_param(vcs_type, int, 0644);
-module_param(busy_thresh, int, 0644);
-module_param(ht_enable, int, 0644);
-module_param(cbw40_enable, int, 0644);
-module_param(ampdu_enable, int, 0644);
-module_param(rf_config, int, 0644);
-module_param(power_mgnt, int, 0644);
-module_param(low_power, int, 0644);
-
-MODULE_PARM_DESC(ifname, " Net interface name, wlan%d=default");
-MODULE_PARM_DESC(initmac, "MAC-Address, default: use FUSE");
-
-static int netdev_open(struct net_device *pnetdev);
-static int netdev_close(struct net_device *pnetdev);
-
-static void loadparam(struct _adapter *padapter, struct  net_device *pnetdev)
-{
-	struct registry_priv  *registry_par = &padapter->registrypriv;
-
-	registry_par->chip_version = (u8)chip_version;
-	registry_par->rfintfs = (u8)rfintfs;
-	registry_par->lbkmode = (u8)lbkmode;
-	registry_par->hci = (u8)hci;
-	registry_par->network_mode  = (u8)network_mode;
-	memcpy(registry_par->ssid.Ssid, "ANY", 3);
-	registry_par->ssid.SsidLength = 3;
-	registry_par->channel = (u8)channel;
-	registry_par->wireless_mode = (u8)wireless_mode;
-	registry_par->vrtl_carrier_sense = (u8)vrtl_carrier_sense;
-	registry_par->vcs_type = (u8)vcs_type;
-	registry_par->frag_thresh = (u16)frag_thresh;
-	registry_par->preamble = (u8)preamble;
-	registry_par->scan_mode = (u8)scan_mode;
-	registry_par->adhoc_tx_pwr = (u8)adhoc_tx_pwr;
-	registry_par->soft_ap = (u8)soft_ap;
-	registry_par->smart_ps = (u8)smart_ps;
-	registry_par->power_mgnt = (u8)power_mgnt;
-	registry_par->radio_enable = (u8)radio_enable;
-	registry_par->long_retry_lmt = (u8)long_retry_lmt;
-	registry_par->short_retry_lmt = (u8)short_retry_lmt;
-	registry_par->busy_thresh = (u16)busy_thresh;
-	registry_par->ack_policy = (u8)ack_policy;
-	registry_par->mp_mode = (u8)mp_mode;
-	registry_par->software_encrypt = (u8)software_encrypt;
-	registry_par->software_decrypt = (u8)software_decrypt;
-	/*UAPSD*/
-	registry_par->wmm_enable = (u8)wmm_enable;
-	registry_par->uapsd_enable = (u8)uapsd_enable;
-	registry_par->uapsd_max_sp = (u8)uapsd_max_sp;
-	registry_par->uapsd_acbk_en = (u8)uapsd_acbk_en;
-	registry_par->uapsd_acbe_en = (u8)uapsd_acbe_en;
-	registry_par->uapsd_acvi_en = (u8)uapsd_acvi_en;
-	registry_par->uapsd_acvo_en = (u8)uapsd_acvo_en;
-	registry_par->ht_enable = (u8)ht_enable;
-	registry_par->cbw40_enable = (u8)cbw40_enable;
-	registry_par->ampdu_enable = (u8)ampdu_enable;
-	registry_par->rf_config = (u8)rf_config;
-	registry_par->low_power = (u8)low_power;
-	registry_par->wifi_test = (u8)wifi_test;
-	r8712_initmac = initmac;
-}
-
-static int r871x_net_set_mac_address(struct net_device *pnetdev, void *p)
-{
-	struct _adapter *padapter = netdev_priv(pnetdev);
-	struct sockaddr *addr = p;
-
-	if (!padapter->bup)
-		eth_hw_addr_set(pnetdev, addr->sa_data);
-	return 0;
-}
-
-static struct net_device_stats *r871x_net_get_stats(struct net_device *pnetdev)
-{
-	struct _adapter *padapter = netdev_priv(pnetdev);
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-
-	padapter->stats.tx_packets = pxmitpriv->tx_pkts;
-	padapter->stats.rx_packets = precvpriv->rx_pkts;
-	padapter->stats.tx_dropped = pxmitpriv->tx_drop;
-	padapter->stats.rx_dropped = precvpriv->rx_drop;
-	padapter->stats.tx_bytes = pxmitpriv->tx_bytes;
-	padapter->stats.rx_bytes = precvpriv->rx_bytes;
-	return &padapter->stats;
-}
-
-static const struct net_device_ops rtl8712_netdev_ops = {
-	.ndo_open = netdev_open,
-	.ndo_stop = netdev_close,
-	.ndo_start_xmit = r8712_xmit_entry,
-	.ndo_set_mac_address = r871x_net_set_mac_address,
-	.ndo_get_stats = r871x_net_get_stats,
-	.ndo_do_ioctl = r871x_ioctl,
-};
-
-struct net_device *r8712_init_netdev(void)
-{
-	struct _adapter *padapter;
-	struct net_device *pnetdev;
-
-	pnetdev = alloc_etherdev(sizeof(struct _adapter));
-	if (!pnetdev)
-		return NULL;
-	if (dev_alloc_name(pnetdev, ifname) < 0) {
-		strscpy(ifname, "wlan%d", sizeof(ifname));
-		dev_alloc_name(pnetdev, ifname);
-	}
-	padapter = netdev_priv(pnetdev);
-	padapter->pnetdev = pnetdev;
-	pr_info("r8712u: register rtl8712_netdev_ops to netdev_ops\n");
-	pnetdev->netdev_ops = &rtl8712_netdev_ops;
-	pnetdev->watchdog_timeo = HZ; /* 1 second timeout */
-	pnetdev->wireless_handlers = (struct iw_handler_def *)
-				     &r871x_handlers_def;
-	loadparam(padapter, pnetdev);
-	netif_carrier_off(pnetdev);
-	padapter->pid = 0;  /* Initial the PID value used for HW PBC.*/
-	return pnetdev;
-}
-
-static u32 start_drv_threads(struct _adapter *padapter)
-{
-	padapter->cmd_thread = kthread_run(r8712_cmd_thread, padapter, "%s",
-					  padapter->pnetdev->name);
-	if (IS_ERR(padapter->cmd_thread))
-		return _FAIL;
-	return _SUCCESS;
-}
-
-void r8712_stop_drv_threads(struct _adapter *padapter)
-{
-	struct completion *completion =
-		&padapter->cmdpriv.terminate_cmdthread_comp;
-
-	/*Below is to terminate r8712_cmd_thread & event_thread...*/
-	complete(&padapter->cmdpriv.cmd_queue_comp);
-	if (padapter->cmd_thread)
-		wait_for_completion_interruptible(completion);
-	padapter->cmdpriv.cmd_seq = 1;
-}
-
-static void start_drv_timers(struct _adapter *padapter)
-{
-	mod_timer(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer,
-		  jiffies + msecs_to_jiffies(5000));
-	mod_timer(&padapter->mlmepriv.wdg_timer,
-		  jiffies + msecs_to_jiffies(2000));
-}
-
-void r8712_stop_drv_timers(struct _adapter *padapter)
-{
-	del_timer_sync(&padapter->mlmepriv.assoc_timer);
-	del_timer_sync(&padapter->securitypriv.tkip_timer);
-	del_timer_sync(&padapter->mlmepriv.scan_to_timer);
-	del_timer_sync(&padapter->mlmepriv.dhcp_timer);
-	del_timer_sync(&padapter->mlmepriv.wdg_timer);
-	del_timer_sync(&padapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer);
-}
-
-static void init_default_value(struct _adapter *padapter)
-{
-	struct registry_priv *pregistrypriv = &padapter->registrypriv;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-
-	/*xmit_priv*/
-	pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
-	pxmitpriv->vcs = pregistrypriv->vcs_type;
-	pxmitpriv->vcs_type = pregistrypriv->vcs_type;
-	pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
-	pxmitpriv->frag_len = pregistrypriv->frag_thresh;
-	/* mlme_priv */
-	/* Maybe someday we should rename this variable to "active_mode"(Jeff)*/
-	pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */
-	/*ht_priv*/
-	{
-		int i;
-		struct ht_priv	 *phtpriv = &pmlmepriv->htpriv;
-
-		phtpriv->ampdu_enable = false;/*set to disabled*/
-		for (i = 0; i < 16; i++)
-			phtpriv->baddbareq_issued[i] = false;
-	}
-	/*security_priv*/
-	psecuritypriv->sw_encrypt = pregistrypriv->software_encrypt;
-	psecuritypriv->sw_decrypt = pregistrypriv->software_decrypt;
-	psecuritypriv->binstallGrpkey = _FAIL;
-	/*pwrctrl_priv*/
-	/*registry_priv*/
-	r8712_init_registrypriv_dev_network(padapter);
-	r8712_update_registrypriv_dev_network(padapter);
-	/*misc.*/
-}
-
-int r8712_init_drv_sw(struct _adapter *padapter)
-{
-	int ret;
-
-	ret = r8712_init_cmd_priv(&padapter->cmdpriv);
-	if (ret)
-		return ret;
-	padapter->cmdpriv.padapter = padapter;
-	ret = r8712_init_evt_priv(&padapter->evtpriv);
-	if (ret)
-		goto free_cmd;
-	ret = r8712_init_mlme_priv(padapter);
-	if (ret)
-		goto free_evt;
-	ret = _r8712_init_xmit_priv(&padapter->xmitpriv, padapter);
-	if (ret)
-		goto free_mlme;
-	ret = _r8712_init_recv_priv(&padapter->recvpriv, padapter);
-	if (ret)
-		goto free_xmit;
-	memset((unsigned char *)&padapter->securitypriv, 0,
-	       sizeof(struct security_priv));
-	timer_setup(&padapter->securitypriv.tkip_timer,
-		    r8712_use_tkipkey_handler, 0);
-	ret = _r8712_init_sta_priv(&padapter->stapriv);
-	if (ret)
-		goto free_recv;
-	padapter->stapriv.padapter = padapter;
-	r8712_init_bcmc_stainfo(padapter);
-	r8712_init_pwrctrl_priv(padapter);
-	mp871xinit(padapter);
-	init_default_value(padapter);
-	r8712_InitSwLeds(padapter);
-	mutex_init(&padapter->mutex_start);
-
-	return 0;
-
-free_recv:
-	_r8712_free_recv_priv(&padapter->recvpriv);
-free_xmit:
-	_free_xmit_priv(&padapter->xmitpriv);
-free_mlme:
-	r8712_free_mlme_priv(&padapter->mlmepriv);
-free_evt:
-	r8712_free_evt_priv(&padapter->evtpriv);
-free_cmd:
-	r8712_free_cmd_priv(&padapter->cmdpriv);
-	return ret;
-}
-
-void r8712_free_drv_sw(struct _adapter *padapter)
-{
-	r8712_free_cmd_priv(&padapter->cmdpriv);
-	r8712_free_evt_priv(&padapter->evtpriv);
-	r8712_DeInitSwLeds(padapter);
-	r8712_free_mlme_priv(&padapter->mlmepriv);
-	_free_xmit_priv(&padapter->xmitpriv);
-	_r8712_free_sta_priv(&padapter->stapriv);
-	_r8712_free_recv_priv(&padapter->recvpriv);
-	mp871xdeinit(padapter);
-}
-
-static void enable_video_mode(struct _adapter *padapter, int cbw40_value)
-{
-	/*   bit 8:
-	 *   1 -> enable video mode to 96B AP
-	 *   0 -> disable video mode to 96B AP
-	 *   bit 9:
-	 *   1 -> enable 40MHz mode
-	 *   0 -> disable 40MHz mode
-	 *   bit 10:
-	 *   1 -> enable STBC
-	 *   0 -> disable STBC
-	 */
-	u32  intcmd = 0xf4000500;   /* enable bit8, bit10*/
-
-	if (cbw40_value) {
-		/* if the driver supports the 40M bandwidth,
-		 * we can enable the bit 9.
-		 */
-		intcmd |= 0x200;
-	}
-	r8712_fw_cmd(padapter, intcmd);
-}
-
-/*
- *
- * This function intends to handle the activation of an interface
- * i.e. when it is brought Up/Active from a Down state.
- *
- */
-static int netdev_open(struct net_device *pnetdev)
-{
-	struct _adapter *padapter = netdev_priv(pnetdev);
-
-	mutex_lock(&padapter->mutex_start);
-	if (!padapter->bup) {
-		padapter->driver_stopped = false;
-		padapter->surprise_removed = false;
-		padapter->bup = true;
-		if (rtl871x_hal_init(padapter) != _SUCCESS)
-			goto netdev_open_error;
-		if (!r8712_initmac) {
-			/* Use the mac address stored in the Efuse */
-			eth_hw_addr_set(pnetdev,
-					padapter->eeprompriv.mac_addr);
-		} else {
-			/* We have to inform f/w to use user-supplied MAC
-			 * address.
-			 */
-			msleep(200);
-			r8712_setMacAddr_cmd(padapter,
-					     (const u8 *)pnetdev->dev_addr);
-			/*
-			 * The "myid" function will get the wifi mac address
-			 * from eeprompriv structure instead of netdev
-			 * structure. So, we have to overwrite the mac_addr
-			 * stored in the eeprompriv structure. In this case,
-			 * the real mac address won't be used anymore. So that,
-			 * the eeprompriv.mac_addr should store the mac which
-			 * users specify.
-			 */
-			memcpy(padapter->eeprompriv.mac_addr,
-			       pnetdev->dev_addr, ETH_ALEN);
-		}
-		if (start_drv_threads(padapter) != _SUCCESS)
-			goto netdev_open_error;
-		if (!padapter->dvobjpriv.inirp_init)
-			goto netdev_open_error;
-		else
-			padapter->dvobjpriv.inirp_init(padapter);
-		r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt,
-				  padapter->registrypriv.smart_ps);
-	}
-	if (!netif_queue_stopped(pnetdev))
-		netif_start_queue(pnetdev);
-	else
-		netif_wake_queue(pnetdev);
-
-	if (video_mode)
-		enable_video_mode(padapter, cbw40_enable);
-	/* start driver mlme relation timer */
-	start_drv_timers(padapter);
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK);
-	mutex_unlock(&padapter->mutex_start);
-	return 0;
-netdev_open_error:
-	padapter->bup = false;
-	netif_carrier_off(pnetdev);
-	netif_stop_queue(pnetdev);
-	mutex_unlock(&padapter->mutex_start);
-	return -1;
-}
-
-/*
- *
- * This function intends to handle the shutdown of an interface
- * i.e. when it is brought Down from an Up/Active state.
- *
- */
-static int netdev_close(struct net_device *pnetdev)
-{
-	struct _adapter *padapter = netdev_priv(pnetdev);
-
-	/* Close LED*/
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_POWER_OFF);
-	msleep(200);
-
-	/*s1.*/
-	if (pnetdev) {
-		if (!netif_queue_stopped(pnetdev))
-			netif_stop_queue(pnetdev);
-	}
-	/*s2.*/
-	/*s2-1.  issue disassoc_cmd to fw*/
-	r8712_disassoc_cmd(padapter);
-	/*s2-2.  indicate disconnect to os*/
-	r8712_ind_disconnect(padapter);
-	/*s2-3.*/
-	r8712_free_assoc_resources(padapter);
-	/*s2-4.*/
-	r8712_free_network_queue(padapter);
-	return 0;
-}
-
-#include "mlme_osdep.h"
--- a/drivers/staging/rtl8712/osdep_intf.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __OSDEP_INTF_H_
-#define __OSDEP_INTF_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define RND4(x)	(((x >> 2) + ((x & 3) != 0)) << 2)
-
-struct intf_priv {
-	u8 *intf_dev;
-	/* when in USB, IO is through interrupt in/out endpoints */
-	struct usb_device *udev;
-	struct urb *piorw_urb;
-	struct completion io_retevt_comp;
-};
-
-int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-
-#endif	/*_OSDEP_INTF_H_*/
--- a/drivers/staging/rtl8712/osdep_service.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __OSDEP_SERVICE_H_
-#define __OSDEP_SERVICE_H_
-
-#define _SUCCESS	1
-#define _FAIL		0
-
-#include <linux/spinlock.h>
-
-#include <linux/interrupt.h>
-#include <linux/semaphore.h>
-#include <linux/sched/signal.h>
-#include <linux/sem.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <net/iw_handler.h>
-#include <linux/proc_fs.h>      /* Necessary because we use the proc fs */
-
-#include "basic_types.h"
-
-struct	__queue	{
-	struct	list_head	queue;
-	spinlock_t lock;
-};
-
-#define _pkt struct sk_buff
-#define _buffer unsigned char
-
-#define _init_queue(pqueue)				\
-	do {						\
-		INIT_LIST_HEAD(&((pqueue)->queue));	\
-		spin_lock_init(&((pqueue)->lock));	\
-	} while (0)
-
-static inline u32 end_of_queue_search(struct list_head *head,
-				      struct list_head *plist)
-{
-	return (head == plist);
-}
-
-static inline void flush_signals_thread(void)
-{
-	if (signal_pending(current))
-		flush_signals(current);
-}
-
-#endif
-
--- a/drivers/staging/rtl8712/recv_linux.c
+++ /dev/null
@@ -1,139 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * recv_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RECV_OSDEP_C_
-
-#include <linux/usb.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-#include "recv_osdep.h"
-#include "osdep_intf.h"
-#include "ethernet.h"
-#include <linux/if_arp.h>
-#include "usb_ops.h"
-
-/*init os related resource in struct recv_priv*/
-/*alloc os related resource in union recv_frame*/
-void r8712_os_recv_resource_alloc(struct _adapter *padapter,
-				  union recv_frame *precvframe)
-{
-	precvframe->u.hdr.pkt_newalloc = NULL;
-	precvframe->u.hdr.pkt = NULL;
-}
-
-/*alloc os related resource in struct recv_buf*/
-int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter,
-				    struct recv_buf *precvbuf)
-{
-	int res = 0;
-
-	precvbuf->irp_pending = false;
-	precvbuf->purb = usb_alloc_urb(0, GFP_KERNEL);
-	if (!precvbuf->purb)
-		res = -ENOMEM;
-	precvbuf->pskb = NULL;
-	precvbuf->pallocated_buf = NULL;
-	precvbuf->pbuf = NULL;
-	precvbuf->pdata = NULL;
-	precvbuf->phead = NULL;
-	precvbuf->ptail = NULL;
-	precvbuf->pend = NULL;
-	precvbuf->transfer_len = 0;
-	precvbuf->len = 0;
-	return res;
-}
-
-/*free os related resource in struct recv_buf*/
-void r8712_os_recvbuf_resource_free(struct _adapter *padapter,
-				    struct recv_buf *precvbuf)
-{
-	if (precvbuf->pskb)
-		dev_kfree_skb_any(precvbuf->pskb);
-	if (precvbuf->purb) {
-		usb_kill_urb(precvbuf->purb);
-		usb_free_urb(precvbuf->purb);
-	}
-}
-
-void r8712_handle_tkip_mic_err(struct _adapter *adapter, u8 bgroup)
-{
-	union iwreq_data wrqu;
-	struct iw_michaelmicfailure ev;
-	struct mlme_priv *mlmepriv  = &adapter->mlmepriv;
-
-	memset(&ev, 0x00, sizeof(ev));
-	if (bgroup)
-		ev.flags |= IW_MICFAILURE_GROUP;
-	else
-		ev.flags |= IW_MICFAILURE_PAIRWISE;
-	ev.src_addr.sa_family = ARPHRD_ETHER;
-	ether_addr_copy(ev.src_addr.sa_data, &mlmepriv->assoc_bssid[0]);
-	memset(&wrqu, 0x00, sizeof(wrqu));
-	wrqu.data.length = sizeof(ev);
-	wireless_send_event(adapter->pnetdev, IWEVMICHAELMICFAILURE, &wrqu,
-			    (char *)&ev);
-}
-
-void r8712_recv_indicatepkt(struct _adapter *adapter,
-			    union recv_frame *recvframe)
-{
-	struct recv_priv *recvpriv;
-	struct  __queue	*free_recv_queue;
-	_pkt *skb;
-	struct rx_pkt_attrib *attrib = &recvframe->u.hdr.attrib;
-
-	recvpriv = &adapter->recvpriv;
-	free_recv_queue = &recvpriv->free_recv_queue;
-	skb = recvframe->u.hdr.pkt;
-	if (!skb)
-		goto _recv_indicatepkt_drop;
-	skb->data = recvframe->u.hdr.rx_data;
-	skb->len = recvframe->u.hdr.len;
-	skb_set_tail_pointer(skb, skb->len);
-	if ((attrib->tcpchk_valid == 1) && (attrib->tcp_chkrpt == 1))
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
-	else
-		skb->ip_summed = CHECKSUM_NONE;
-	skb->dev = adapter->pnetdev;
-	skb->protocol = eth_type_trans(skb, adapter->pnetdev);
-	netif_rx(skb);
-	recvframe->u.hdr.pkt = NULL; /* pointers to NULL before
-				      * r8712_free_recvframe()
-				      */
-	r8712_free_recvframe(recvframe, free_recv_queue);
-	return;
-_recv_indicatepkt_drop:
-	 /*enqueue back to free_recv_queue*/
-	if (recvframe)
-		r8712_free_recvframe(recvframe, free_recv_queue);
-	recvpriv->rx_drop++;
-}
-
-static void _r8712_reordering_ctrl_timeout_handler (struct timer_list *t)
-{
-	struct recv_reorder_ctrl *reorder_ctrl =
-			 from_timer(reorder_ctrl, t, reordering_ctrl_timer);
-
-	r8712_reordering_ctrl_timeout_handler(reorder_ctrl);
-}
-
-void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl)
-{
-	timer_setup(&preorder_ctrl->reordering_ctrl_timer,
-		    _r8712_reordering_ctrl_timeout_handler, 0);
-}
--- a/drivers/staging/rtl8712/recv_osdep.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RECV_OSDEP_H_
-#define __RECV_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include <linux/skbuff.h>
-
-int _r8712_init_recv_priv(struct recv_priv *precvpriv,
-			  struct _adapter *padapter);
-void _r8712_free_recv_priv(struct recv_priv *precvpriv);
-void r8712_recv_entry(union recv_frame *precv_frame);
-void r8712_recv_indicatepkt(struct _adapter *adapter,
-			    union recv_frame *precv_frame);
-void r8712_handle_tkip_mic_err(struct _adapter *padapter, u8 bgroup);
-int r8712_init_recv_priv(struct recv_priv *precvpriv,
-			 struct _adapter *padapter);
-void r8712_free_recv_priv(struct recv_priv *precvpriv);
-void r8712_os_recv_resource_alloc(struct _adapter *padapter,
-				  union recv_frame *precvframe);
-int r8712_os_recvbuf_resource_alloc(struct _adapter *padapter,
-				    struct recv_buf *precvbuf);
-void r8712_os_recvbuf_resource_free(struct _adapter *padapter,
-				    struct recv_buf *precvbuf);
-void r8712_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl);
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_bitdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-
-#ifndef __RTL8712_BITDEF_H__
-#define __RTL8712_BITDEF_H__
-
-#include "rtl8712_cmdctrl_bitdef.h"
-#include "rtl8712_syscfg_bitdef.h"
-#include "rtl8712_macsetting_bitdef.h"
-#include "rtl8712_timectrl_bitdef.h"
-#include "rtl8712_fifoctrl_bitdef.h"
-#include "rtl8712_ratectrl_bitdef.h"
-#include "rtl8712_edcasetting_bitdef.h"
-#include "rtl8712_wmac_bitdef.h"
-#include "rtl8712_security_bitdef.h"
-#include "rtl8712_powersave_bitdef.h"
-#include "rtl8712_gp_bitdef.h"
-#include "rtl8712_interrupt_bitdef.h"
-#include "rtl8712_debugctrl_bitdef.h"
-
-#endif /* __RTL8712_BITDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_cmd.c
+++ /dev/null
@@ -1,409 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_cmd.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_CMD_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/sched/signal.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/usb.h>
-#include <linux/usb/ch9.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/semaphore.h>
-#include <linux/rtnetlink.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "rtl871x_ioctl_set.h"
-
-static void check_hw_pbc(struct _adapter *padapter)
-{
-	u8	tmp1byte;
-
-	r8712_write8(padapter, MAC_PINMUX_CTRL, (GPIOMUX_EN | GPIOSEL_GPIO));
-	tmp1byte = r8712_read8(padapter, GPIO_IO_SEL);
-	tmp1byte &= ~(HAL_8192S_HW_GPIO_WPS_BIT);
-	r8712_write8(padapter, GPIO_IO_SEL, tmp1byte);
-	tmp1byte = r8712_read8(padapter, GPIO_CTRL);
-	if (tmp1byte == 0xff)
-		return;
-	if (tmp1byte & HAL_8192S_HW_GPIO_WPS_BIT) {
-		/* Here we only set bPbcPressed to true
-		 * After trigger PBC, the variable will be set to false
-		 */
-		netdev_dbg(padapter->pnetdev, "CheckPbcGPIO - PBC is pressed !!!!\n");
-		/* 0 is the default value and it means the application monitors
-		 * the HW PBC doesn't provide its pid to driver.
-		 */
-		if (padapter->pid == 0)
-			return;
-		kill_pid(find_vpid(padapter->pid), SIGUSR1, 1);
-	}
-}
-
-/* query rx phy status from fw.
- * Adhoc mode: beacon.
- * Infrastructure mode: beacon , data.
- */
-static void query_fw_rx_phy_status(struct _adapter *padapter)
-{
-	u32 val32 = 0;
-	int pollingcnts = 50;
-
-	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
-		r8712_write32(padapter, IOCMD_CTRL_REG, 0xf4000001);
-		msleep(100);
-		/* Wait FW complete IO Cmd */
-		while ((r8712_read32(padapter, IOCMD_CTRL_REG)) &&
-		       (pollingcnts > 0)) {
-			pollingcnts--;
-			msleep(20);
-		}
-		if (pollingcnts != 0)
-			val32 = r8712_read32(padapter, IOCMD_DATA_REG);
-		else /* time out */
-			val32 = 0;
-		val32 >>= 4;
-		padapter->recvpriv.fw_rssi =
-			 (u8)r8712_signal_scale_mapping(val32);
-	}
-}
-
-/* check mlme, hw, phy, or dynamic algorithm status. */
-static void StatusWatchdogCallback(struct _adapter *padapter)
-{
-	check_hw_pbc(padapter);
-	query_fw_rx_phy_status(padapter);
-}
-
-static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	struct drvint_cmd_parm *pdrvcmd;
-
-	if (!pbuf)
-		return;
-	pdrvcmd = (struct drvint_cmd_parm *)pbuf;
-	switch (pdrvcmd->i_cid) {
-	case WDG_WK_CID:
-		StatusWatchdogCallback(padapter);
-		break;
-	default:
-		break;
-	}
-	kfree(pdrvcmd->pbuf);
-}
-
-static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-	r8712_free_cmd_obj(pcmd);
-	return H2C_SUCCESS;
-}
-
-static u8 write_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-	if (!pcmd_callback)
-		r8712_free_cmd_obj(pcmd);
-	else
-		pcmd_callback(padapter, pcmd);
-	return H2C_SUCCESS;
-}
-
-static u8 read_rfreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	u32 val;
-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-	if (pcmd->rsp && pcmd->rspsz > 0)
-		memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz);
-	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-	if (!pcmd_callback)
-		r8712_free_cmd_obj(pcmd);
-	else
-		pcmd_callback(padapter, pcmd);
-	return H2C_SUCCESS;
-}
-
-static u8 write_rfreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-	if (!pcmd_callback)
-		r8712_free_cmd_obj(pcmd);
-	else
-		pcmd_callback(padapter, pcmd);
-	return H2C_SUCCESS;
-}
-
-static u8 sys_suspend_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-	r8712_free_cmd_obj(pcmd);
-	return H2C_SUCCESS;
-}
-
-static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
-				      struct cmd_obj *pcmd)
-{
-	struct cmd_obj *pcmd_r;
-
-	if (!pcmd)
-		return pcmd;
-	pcmd_r = NULL;
-
-	switch (pcmd->cmdcode) {
-	case GEN_CMD_CODE(_Read_BBREG):
-		read_bbreg_hdl(padapter, (u8 *)pcmd);
-		break;
-	case GEN_CMD_CODE(_Write_BBREG):
-		write_bbreg_hdl(padapter, (u8 *)pcmd);
-		break;
-	case GEN_CMD_CODE(_Read_RFREG):
-		read_rfreg_hdl(padapter, (u8 *)pcmd);
-		break;
-	case GEN_CMD_CODE(_Write_RFREG):
-		write_rfreg_hdl(padapter, (u8 *)pcmd);
-		break;
-	case GEN_CMD_CODE(_SetUsbSuspend):
-		sys_suspend_hdl(padapter, (u8 *)pcmd);
-		break;
-	case GEN_CMD_CODE(_JoinBss):
-		r8712_joinbss_reset(padapter);
-		/* Before set JoinBss_CMD to FW, driver must ensure FW is in
-		 * PS_MODE_ACTIVE. Directly write rpwm to radio on and assign
-		 * new pwr_mode to Driver, instead of use workitem to change
-		 * state.
-		 */
-		if (padapter->pwrctrlpriv.pwr_mode > PS_MODE_ACTIVE) {
-			padapter->pwrctrlpriv.pwr_mode = PS_MODE_ACTIVE;
-			mutex_lock(&padapter->pwrctrlpriv.mutex_lock);
-			r8712_set_rpwm(padapter, PS_STATE_S4);
-			mutex_unlock(&padapter->pwrctrlpriv.mutex_lock);
-		}
-		pcmd_r = pcmd;
-		break;
-	case _DRV_INT_CMD_:
-		r871x_internal_cmd_hdl(padapter, pcmd->parmbuf);
-		r8712_free_cmd_obj(pcmd);
-		pcmd_r = NULL;
-		break;
-	default:
-		pcmd_r = pcmd;
-		break;
-	}
-	return pcmd_r; /* if returning pcmd_r == NULL, pcmd must be free. */
-}
-
-u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd)
-{
-	int pollingcnts = 50;
-
-	r8712_write32(pAdapter, IOCMD_CTRL_REG, cmd);
-	msleep(100);
-	while ((r8712_read32(pAdapter, IOCMD_CTRL_REG != 0)) &&
-	       (pollingcnts > 0)) {
-		pollingcnts--;
-		msleep(20);
-	}
-	if (pollingcnts == 0)
-		return false;
-	return true;
-}
-
-void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag)
-{
-	if (flag == 0)	/* set */
-		r8712_write32(pAdapter, IOCMD_DATA_REG, *value);
-	else		/* query */
-		*value = r8712_read32(pAdapter, IOCMD_DATA_REG);
-}
-
-int r8712_cmd_thread(void *context)
-{
-	struct cmd_obj *pcmd;
-	unsigned int cmdsz, wr_sz;
-	__le32 *pcmdbuf;
-	struct tx_desc *pdesc;
-	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
-	struct _adapter *padapter = context;
-	struct	cmd_priv *pcmdpriv = &padapter->cmdpriv;
-	struct completion *cmd_queue_comp =
-		&pcmdpriv->cmd_queue_comp;
-	struct mutex *pwctrl_lock = &padapter->pwrctrlpriv.mutex_lock;
-
-	allow_signal(SIGTERM);
-	while (1) {
-		if (wait_for_completion_interruptible(cmd_queue_comp))
-			break;
-		if (padapter->driver_stopped || padapter->surprise_removed)
-			break;
-		if (r8712_register_cmd_alive(padapter))
-			continue;
-_next:
-		pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue);
-		if (!(pcmd)) {
-			r8712_unregister_cmd_alive(padapter);
-			continue;
-		}
-		pcmdbuf = (__le32 *)pcmdpriv->cmd_buf;
-		pdesc = (struct tx_desc *)pcmdbuf;
-		memset(pdesc, 0, TXDESC_SIZE);
-		pcmd = cmd_hdl_filter(padapter, pcmd);
-		if (pcmd) { /* if pcmd != NULL, cmd will be handled by f/w */
-			struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-			u8 blnPending = 0;
-			u16 cmdcode = pcmd->cmdcode;
-
-			pcmdpriv->cmd_issued_cnt++;
-			cmdsz = round_up(pcmd->cmdsz, 8);
-			wr_sz = TXDESC_SIZE + 8 + cmdsz;
-			pdesc->txdw0 |= cpu_to_le32((wr_sz - TXDESC_SIZE) &
-						     0x0000ffff);
-			if (pdvobj->ishighspeed) {
-				if ((wr_sz % 512) == 0)
-					blnPending = 1;
-			} else {
-				if ((wr_sz % 64) == 0)
-					blnPending = 1;
-			}
-			if (blnPending) { /* 32 bytes for TX Desc - 8 offset */
-				pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE +
-						OFFSET_SZ + 8) << OFFSET_SHT) &
-						0x00ff0000);
-			} else {
-				pdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE +
-							      OFFSET_SZ) <<
-							      OFFSET_SHT) &
-							      0x00ff0000);
-			}
-			pdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
-			pdesc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) &
-						    0x00001f00);
-			pcmdbuf += (TXDESC_SIZE >> 2);
-			*pcmdbuf = cpu_to_le32((cmdsz & 0x0000ffff) |
-					       (pcmd->cmdcode << 16) |
-					       (pcmdpriv->cmd_seq << 24));
-			pcmdbuf += 2; /* 8 bytes alignment */
-			memcpy((u8 *)pcmdbuf, pcmd->parmbuf, pcmd->cmdsz);
-			if (blnPending)
-				wr_sz += 8;   /* Append 8 bytes */
-			r8712_write_mem(padapter, RTL8712_DMA_H2CCMD, wr_sz,
-					(u8 *)pdesc);
-			pcmdpriv->cmd_seq++;
-			if (cmdcode == GEN_CMD_CODE(_CreateBss)) {
-				pcmd->res = H2C_SUCCESS;
-				pcmd_callback = cmd_callback[cmdcode].callback;
-				if (pcmd_callback)
-					pcmd_callback(padapter, pcmd);
-				continue;
-			}
-			if (cmdcode == GEN_CMD_CODE(_SetPwrMode)) {
-				if (padapter->pwrctrlpriv.bSleep) {
-					mutex_lock(pwctrl_lock);
-					r8712_set_rpwm(padapter, PS_STATE_S2);
-					mutex_unlock(pwctrl_lock);
-				}
-			}
-			r8712_free_cmd_obj(pcmd);
-			if (list_empty(&pcmdpriv->cmd_queue.queue)) {
-				r8712_unregister_cmd_alive(padapter);
-				continue;
-			} else {
-				goto _next;
-			}
-		} else {
-			goto _next;
-		}
-		flush_signals_thread();
-	}
-	/* free all cmd_obj resources */
-	do {
-		pcmd = r8712_dequeue_cmd(&pcmdpriv->cmd_queue);
-		if (!pcmd)
-			break;
-		r8712_free_cmd_obj(pcmd);
-	} while (1);
-	complete(&pcmdpriv->terminate_cmdthread_comp);
-	return 0;
-}
-
-void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf)
-{
-	u8 evt_code, evt_seq;
-	u16 evt_sz;
-	void (*event_callback)(struct _adapter *dev, u8 *pbuf);
-	struct	evt_priv *pevt_priv = &padapter->evtpriv;
-
-	if (!peventbuf)
-		goto _abort_event_;
-	evt_sz = (u16)(le32_to_cpu(*peventbuf) & 0xffff);
-	evt_seq = (u8)((le32_to_cpu(*peventbuf) >> 24) & 0x7f);
-	evt_code = (u8)((le32_to_cpu(*peventbuf) >> 16) & 0xff);
-	/* checking event sequence... */
-	if ((evt_seq & 0x7f) != pevt_priv->event_seq) {
-		pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
-		goto _abort_event_;
-	}
-	/* checking if event code is valid */
-	if (evt_code >= MAX_C2HEVT) {
-		pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
-		goto _abort_event_;
-	} else if ((evt_code == GEN_EVT_CODE(_Survey)) &&
-		   (evt_sz > sizeof(struct wlan_bssid_ex))) {
-		pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
-		goto _abort_event_;
-	}
-	/* checking if event size match the event parm size */
-	if ((wlanevents[evt_code].parmsize) &&
-	    (wlanevents[evt_code].parmsize != evt_sz)) {
-		pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
-		goto _abort_event_;
-	} else if ((evt_sz == 0) && (evt_code != GEN_EVT_CODE(_WPS_PBC))) {
-		pevt_priv->event_seq = ((evt_seq + 1) & 0x7f);
-		goto _abort_event_;
-	}
-	pevt_priv->event_seq++;	/* update evt_seq */
-	if (pevt_priv->event_seq > 127)
-		pevt_priv->event_seq = 0;
-	/* move to event content, 8 bytes alignment */
-	peventbuf = peventbuf + 2;
-	event_callback = wlanevents[evt_code].event_callback;
-	if (event_callback)
-		event_callback(padapter, (u8 *)peventbuf);
-	pevt_priv->evt_done_cnt++;
-_abort_event_:
-	return;
-}
--- a/drivers/staging/rtl8712/rtl8712_cmd.h
+++ /dev/null
@@ -1,231 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMD_H_
-#define __RTL8712_CMD_H_
-
-#define CMD_HDR_SZ      8
-
-u8 r8712_fw_cmd(struct _adapter *pAdapter, u32 cmd);
-void r8712_fw_cmd_data(struct _adapter *pAdapter, u32 *value, u8 flag);
-
-struct cmd_hdr {
-	u32 cmd_dw0;
-	u32 cmd_dw1;
-};
-
-enum rtl8712_h2c_cmd {
-	GEN_CMD_CODE(_Read_MACREG),	/*0*/
-	GEN_CMD_CODE(_Write_MACREG),
-	GEN_CMD_CODE(_Read_BBREG),
-	GEN_CMD_CODE(_Write_BBREG),
-	GEN_CMD_CODE(_Read_RFREG),
-	GEN_CMD_CODE(_Write_RFREG), /*5*/
-	GEN_CMD_CODE(_Read_EEPROM),
-	GEN_CMD_CODE(_Write_EEPROM),
-	GEN_CMD_CODE(_Read_EFUSE),
-	GEN_CMD_CODE(_Write_EFUSE),
-
-	GEN_CMD_CODE(_Read_CAM),	/*10*/
-	GEN_CMD_CODE(_Write_CAM),
-	GEN_CMD_CODE(_setBCNITV),
-	GEN_CMD_CODE(_setMBIDCFG),
-	GEN_CMD_CODE(_JoinBss),   /*14*/
-	GEN_CMD_CODE(_DisConnect), /*15*/
-	GEN_CMD_CODE(_CreateBss),
-	GEN_CMD_CODE(_SetOpMode),
-	GEN_CMD_CODE(_SiteSurvey),  /*18*/
-	GEN_CMD_CODE(_SetAuth),
-
-	GEN_CMD_CODE(_SetKey),	/*20*/
-	GEN_CMD_CODE(_SetStaKey),
-	GEN_CMD_CODE(_SetAssocSta),
-	GEN_CMD_CODE(_DelAssocSta),
-	GEN_CMD_CODE(_SetStaPwrState),
-	GEN_CMD_CODE(_SetBasicRate), /*25*/
-	GEN_CMD_CODE(_GetBasicRate),
-	GEN_CMD_CODE(_SetDataRate),
-	GEN_CMD_CODE(_GetDataRate),
-	GEN_CMD_CODE(_SetPhyInfo),
-
-	GEN_CMD_CODE(_GetPhyInfo),	/*30*/
-	GEN_CMD_CODE(_SetPhy),
-	GEN_CMD_CODE(_GetPhy),
-	GEN_CMD_CODE(_readRssi),
-	GEN_CMD_CODE(_readGain),
-	GEN_CMD_CODE(_SetAtim), /*35*/
-	GEN_CMD_CODE(_SetPwrMode),
-	GEN_CMD_CODE(_JoinbssRpt),
-	GEN_CMD_CODE(_SetRaTable),
-	GEN_CMD_CODE(_GetRaTable),
-
-	GEN_CMD_CODE(_GetCCXReport), /*40*/
-	GEN_CMD_CODE(_GetDTMReport),
-	GEN_CMD_CODE(_GetTXRateStatistics),
-	GEN_CMD_CODE(_SetUsbSuspend),
-	GEN_CMD_CODE(_SetH2cLbk),
-	GEN_CMD_CODE(_AddBAReq), /*45*/
-
-	GEN_CMD_CODE(_SetChannel), /*46*/
-/* MP_OFFLOAD Start (47~54)*/
-	GEN_CMD_CODE(_SetTxPower),
-	GEN_CMD_CODE(_SwitchAntenna),
-	GEN_CMD_CODE(_SetCrystalCap),
-	GEN_CMD_CODE(_SetSingleCarrierTx), /*50*/
-	GEN_CMD_CODE(_SetSingleToneTx),
-	GEN_CMD_CODE(_SetCarrierSuppressionTx),
-	GEN_CMD_CODE(_SetContinuousTx),
-	GEN_CMD_CODE(_SwitchBandwidth), /*54*/
-/* MP_OFFLOAD End*/
-	GEN_CMD_CODE(_TX_Beacon), /*55*/
-	GEN_CMD_CODE(_SetPowerTracking),
-	GEN_CMD_CODE(_AMSDU_TO_AMPDU), /*57*/
-	GEN_CMD_CODE(_SetMacAddress), /*58*/
-
-	GEN_CMD_CODE(_DisconnectCtrl), /*59*/
-	GEN_CMD_CODE(_SetChannelPlan), /*60*/
-	GEN_CMD_CODE(_DisconnectCtrlEx), /*61*/
-
-	/* To do, modify these h2c cmd, add or delete */
-	GEN_CMD_CODE(_GetH2cLbk),
-
-	/* WPS extra IE */
-	GEN_CMD_CODE(_SetProbeReqExtraIE),
-	GEN_CMD_CODE(_SetAssocReqExtraIE),
-	GEN_CMD_CODE(_SetProbeRspExtraIE),
-	GEN_CMD_CODE(_SetAssocRspExtraIE),
-
-	/* the following is driver will do */
-	GEN_CMD_CODE(_GetCurDataRate),
-
-	GEN_CMD_CODE(_GetTxRetrycnt),  /* to record times that Tx retry to
-					* transmit packet after association
-					*/
-	GEN_CMD_CODE(_GetRxRetrycnt),  /* to record total number of the
-					* received frame with ReTry bit set in
-					* the WLAN header
-					*/
-
-	GEN_CMD_CODE(_GetBCNOKcnt),
-	GEN_CMD_CODE(_GetBCNERRcnt),
-	GEN_CMD_CODE(_GetCurTxPwrLevel),
-
-	GEN_CMD_CODE(_SetDIG),
-	GEN_CMD_CODE(_SetRA),
-	GEN_CMD_CODE(_SetPT),
-	GEN_CMD_CODE(_ReadTSSI),
-
-	MAX_H2CCMD
-};
-
-#define _GetBBReg_CMD_		_Read_BBREG_CMD_
-#define _SetBBReg_CMD_		_Write_BBREG_CMD_
-#define _GetRFReg_CMD_		_Read_RFREG_CMD_
-#define _SetRFReg_CMD_		_Write_RFREG_CMD_
-#define _DRV_INT_CMD_		(MAX_H2CCMD + 1)
-#define _SetRFIntFs_CMD_	(MAX_H2CCMD + 2)
-
-#ifdef _RTL8712_CMD_C_
-static struct _cmd_callback	cmd_callback[] = {
-	{GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
-	{GEN_CMD_CODE(_Write_MACREG), NULL},
-	{GEN_CMD_CODE(_Read_BBREG), NULL},
-	{GEN_CMD_CODE(_Write_BBREG), NULL},
-	{GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback},
-	{GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
-	{GEN_CMD_CODE(_Read_EEPROM), NULL},
-	{GEN_CMD_CODE(_Write_EEPROM), NULL},
-	{GEN_CMD_CODE(_Read_EFUSE), NULL},
-	{GEN_CMD_CODE(_Write_EFUSE), NULL},
-
-	{GEN_CMD_CODE(_Read_CAM),	NULL},	/*10*/
-	{GEN_CMD_CODE(_Write_CAM),	 NULL},
-	{GEN_CMD_CODE(_setBCNITV), NULL},
-	{GEN_CMD_CODE(_setMBIDCFG), NULL},
-	{GEN_CMD_CODE(_JoinBss), &r8712_joinbss_cmd_callback},  /*14*/
-	{GEN_CMD_CODE(_DisConnect), &r8712_disassoc_cmd_callback}, /*15*/
-	{GEN_CMD_CODE(_CreateBss), &r8712_createbss_cmd_callback},
-	{GEN_CMD_CODE(_SetOpMode), NULL},
-	{GEN_CMD_CODE(_SiteSurvey), &r8712_survey_cmd_callback}, /*18*/
-	{GEN_CMD_CODE(_SetAuth), NULL},
-
-	{GEN_CMD_CODE(_SetKey), NULL},	/*20*/
-	{GEN_CMD_CODE(_SetStaKey), &r8712_setstaKey_cmdrsp_callback},
-	{GEN_CMD_CODE(_SetAssocSta), &r8712_setassocsta_cmdrsp_callback},
-	{GEN_CMD_CODE(_DelAssocSta), NULL},
-	{GEN_CMD_CODE(_SetStaPwrState), NULL},
-	{GEN_CMD_CODE(_SetBasicRate), NULL}, /*25*/
-	{GEN_CMD_CODE(_GetBasicRate), NULL},
-	{GEN_CMD_CODE(_SetDataRate), NULL},
-	{GEN_CMD_CODE(_GetDataRate), NULL},
-	{GEN_CMD_CODE(_SetPhyInfo), NULL},
-
-	{GEN_CMD_CODE(_GetPhyInfo), NULL}, /*30*/
-	{GEN_CMD_CODE(_SetPhy), NULL},
-	{GEN_CMD_CODE(_GetPhy), NULL},
-	{GEN_CMD_CODE(_readRssi), NULL},
-	{GEN_CMD_CODE(_readGain), NULL},
-	{GEN_CMD_CODE(_SetAtim), NULL}, /*35*/
-	{GEN_CMD_CODE(_SetPwrMode), NULL},
-	{GEN_CMD_CODE(_JoinbssRpt), NULL},
-	{GEN_CMD_CODE(_SetRaTable), NULL},
-	{GEN_CMD_CODE(_GetRaTable), NULL},
-
-	{GEN_CMD_CODE(_GetCCXReport), NULL}, /*40*/
-	{GEN_CMD_CODE(_GetDTMReport),	NULL},
-	{GEN_CMD_CODE(_GetTXRateStatistics), NULL},
-	{GEN_CMD_CODE(_SetUsbSuspend), NULL},
-	{GEN_CMD_CODE(_SetH2cLbk), NULL},
-	{GEN_CMD_CODE(_AddBAReq), NULL}, /*45*/
-
-	{GEN_CMD_CODE(_SetChannel), NULL},		/*46*/
-/* MP_OFFLOAD Start (47~54)*/
-	{GEN_CMD_CODE(_SetTxPower), NULL},
-	{GEN_CMD_CODE(_SwitchAntenna), NULL},
-	{GEN_CMD_CODE(_SetCrystalCap), NULL},
-	{GEN_CMD_CODE(_SetSingleCarrierTx), NULL},	/*50*/
-	{GEN_CMD_CODE(_SetSingleToneTx), NULL},
-	{GEN_CMD_CODE(_SetCarrierSuppressionTx), NULL},
-	{GEN_CMD_CODE(_SetContinuousTx), NULL},
-	{GEN_CMD_CODE(_SwitchBandwidth), NULL},		/*54*/
-/* MP_OFFLOAD End*/
-	{GEN_CMD_CODE(_TX_Beacon), NULL}, /*55*/
-	{GEN_CMD_CODE(_SetPowerTracking), NULL},
-	{GEN_CMD_CODE(_AMSDU_TO_AMPDU), NULL}, /*57*/
-	{GEN_CMD_CODE(_SetMacAddress), NULL}, /*58*/
-
-	{GEN_CMD_CODE(_DisconnectCtrl), NULL}, /*59*/
-	{GEN_CMD_CODE(_SetChannelPlan), NULL}, /*60*/
-	{GEN_CMD_CODE(_DisconnectCtrlEx), NULL}, /*61*/
-
-	/* To do, modify these h2c cmd, add or delete */
-	{GEN_CMD_CODE(_GetH2cLbk), NULL},
-
-	{_SetProbeReqExtraIE_CMD_, NULL},
-	{_SetAssocReqExtraIE_CMD_, NULL},
-	{_SetProbeRspExtraIE_CMD_, NULL},
-	{_SetAssocRspExtraIE_CMD_, NULL},
-	{_GetCurDataRate_CMD_, NULL},
-	{_GetTxRetrycnt_CMD_, NULL},
-	{_GetRxRetrycnt_CMD_, NULL},
-	{_GetBCNOKcnt_CMD_, NULL},
-	{_GetBCNERRcnt_CMD_, NULL},
-	{_GetCurTxPwrLevel_CMD_, NULL},
-	{_SetDIG_CMD_, NULL},
-	{_SetRA_CMD_, NULL},
-	{_SetPT_CMD_, NULL},
-	{GEN_CMD_CODE(_ReadTSSI), &r8712_readtssi_cmdrsp_callback}
-};
-#endif
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_cmdctrl_bitdef.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMDCTRL_BITDEF_H__
-#define __RTL8712_CMDCTRL_BITDEF_H__
-
-/*
- * 2. Command Control Registers	 (Offset: 0x0040 - 0x004F)
- */
-/*--------------------------------------------------------------------------*/
-/*       8192S (CMD) command register bits	(Offset 0x40, 16 bits)*/
-/*--------------------------------------------------------------------------*/
-#define		_APSDOFF_STATUS		BIT(15)
-#define		_APSDOFF		BIT(14)
-#define		_BBRSTn			BIT(13)  /*Enable OFDM/CCK*/
-#define		_BB_GLB_RSTn		BIT(12)   /*Enable BB*/
-#define		_SCHEDULE_EN		BIT(10)  /*Enable MAC scheduler*/
-#define		_MACRXEN		BIT(9)
-#define		_MACTXEN		BIT(8)
-#define		_DDMA_EN		BIT(7)  /*FW off load function enable*/
-#define		_FW2HW_EN		BIT(6)  /*MAC every module reset */
-#define		_RXDMA_EN		BIT(5)
-#define		_TXDMA_EN		BIT(4)
-#define		_HCI_RXDMA_EN		BIT(3)
-#define		_HCI_TXDMA_EN		BIT(2)
-
-/*TXPAUSE*/
-#define	_STOPHCCA			BIT(6)
-#define	_STOPHIGH			BIT(5)
-#define	_STOPMGT			BIT(4)
-#define	_STOPVO				BIT(3)
-#define	_STOPVI				BIT(2)
-#define	_STOPBE				BIT(1)
-#define	_STOPBK				BIT(0)
-
-/*TCR*/
-#define	_DISCW				BIT(20)
-#define	_ICV				BIT(19)
-#define	_CFEND_FMT			BIT(17)
-#define	_CRC				BIT(16)
-#define	_FWRDY				BIT(7)
-#define _BASECHG			BIT(6)
-#define	_IMEM_RDY			BIT(5)
-#define _DMEM_CODE_DONE			BIT(4)
-#define _EMEM_CHK_RPT			BIT(3)
-#define _EMEM_CODE_DONE			BIT(2)
-#define _IMEM_CHK_RPT			BIT(1)
-#define _IMEM_CODE_DONE			BIT(0)
-
-#define	_TXDMA_INIT_VALUE	(_IMEM_CHK_RPT | _EMEM_CHK_RPT)
-
-/*RCR*/
-#define	_ENMBID				BIT(27)
-#define	_APP_PHYST_RXFF			BIT(25)
-#define	_APP_PHYST_STAFF		BIT(24)
-#define	_CBSSID				BIT(23)
-#define	_APWRMGT			BIT(22)
-#define	_ADD3				BIT(21)
-#define	_AMF				BIT(20)
-#define	_ACF				BIT(19)
-#define	_ADF				BIT(18)
-#define	_APP_MIC			BIT(17)
-#define	_APP_ICV			BIT(16)
-#define	_RXFTH_MSK			0x0000E000
-#define	_RXFTH_SHT			13
-#define	_AICV				BIT(12)
-#define	_RXPKTLMT_MSK			0x00000FC0
-#define	_RXPKTLMT_SHT			6
-#define	_ACRC32				BIT(5)
-#define	_AB				BIT(3)
-#define	_AM				BIT(2)
-#define	_APM				BIT(1)
-#define	_AAP				BIT(0)
-
-/*MSR*/
-#define	_NETTYPE_MSK			0x03
-#define	_NETTYPE_SHT			0
-
-/*BT*/
-#define _BTMODE_MSK			0x06
-#define _BTMODE_SHT			1
-#define _ENBT				BIT(0)
-
-/*MBIDCTRL*/
-#define	_ENMBID_MODE			BIT(15)
-#define	_BCNNO_MSK			0x7000
-#define	_BCNNO_SHT			12
-#define	_BCNSPACE_MSK			0x0FFF
-#define	_BCNSPACE_SHT			0
-
-#endif /* __RTL8712_CMDCTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_cmdctrl_regdef.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_CMDCTRL_REGDEF_H__
-#define __RTL8712_CMDCTRL_REGDEF_H__
-
-#define CR			(RTL8712_CMDCTRL_ + 0x0000)
-#define TXPAUSE			(RTL8712_CMDCTRL_ + 0x0002)
-#define TCR			(RTL8712_CMDCTRL_ + 0x0004)
-#define RCR			(RTL8712_CMDCTRL_ + 0x0008)
-#define MSR			(RTL8712_CMDCTRL_ + 0x000C)
-#define SYSF_CFG		(RTL8712_CMDCTRL_ + 0x000D)
-#define MBIDCTRL		(RTL8712_CMDCTRL_ + 0x000E)
-
-#endif /* __RTL8712_CMDCTRL_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_debugctrl_bitdef.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_DEBUGCTRL_BITDEF_H__
-#define __RTL8712_DEBUGCTRL_BITDEF_H__
-
-/*BIST*/
-#define	_BIST_RST			BIT(0)
-
-/*LMS*/
-#define	_LMS_MSK			0x03
-
-/*WDG_CTRL*/
-#define	_OVSEL_MSK			0x0600
-#define	_OVSEL_SHT			9
-#define	_WDGCLR				BIT(8)
-#define	_WDGEN_MSK			0x00FF
-#define	_WDGEN_SHT			0
-
-/*INTM*/
-#define	_TXTIMER_MSK		0xF000
-#define	_TXTIMER_SHT		12
-#define	_TXNUM_MSK			0x0F00
-#define	_TXNUM_SHT			8
-#define	_RXTIMER_MSK		0x00F0
-#define	_RXTIMER_SHT		4
-#define	_RXNUM_MSK			0x000F
-#define	_RXNUM_SHT			0
-
-/*FDLOCKTURN0*/
-/*FDLOCKTURN1*/
-#define	_TURN1				BIT(0)
-
-/*FDLOCKFLAG0*/
-/*FDLOCKFLAG1*/
-#define	_LOCKFLAG1_MSK		0x03
-
-#endif /* __RTL8712_DEBUGCTRL_BITDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_debugctrl_regdef.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_DEBUGCTRL_REGDEF_H__
-#define __RTL8712_DEBUGCTRL_REGDEF_H__
-
-#define BIST			(RTL8712_DEBUGCTRL_ + 0x00)
-#define DBS			(RTL8712_DEBUGCTRL_ + 0x04)
-#define LMS			(RTL8712_DEBUGCTRL_ + 0x05)
-#define CPUINST			(RTL8712_DEBUGCTRL_ + 0x08)
-#define CPUCAUSE		(RTL8712_DEBUGCTRL_ + 0x0C)
-#define LBUS_ERR_ADDR		(RTL8712_DEBUGCTRL_ + 0x10)
-#define LBUS_ERR_CMD		(RTL8712_DEBUGCTRL_ + 0x14)
-#define LBUS_ERR_DATA_L		(RTL8712_DEBUGCTRL_ + 0x18)
-#define LBUS_ERR_DATA_H		(RTL8712_DEBUGCTRL_ + 0x1C)
-#define LBUS_EXCEPTION_ADDR	(RTL8712_DEBUGCTRL_ + 0x20)
-#define WDG_CTRL		(RTL8712_DEBUGCTRL_ + 0x24)
-#define INTMTU			(RTL8712_DEBUGCTRL_ + 0x28)
-#define INTM			(RTL8712_DEBUGCTRL_ + 0x2A)
-#define FDLOCKTURN0		(RTL8712_DEBUGCTRL_ + 0x2C)
-#define FDLOCKTURN1		(RTL8712_DEBUGCTRL_ + 0x2D)
-#define FDLOCKFLAG0		(RTL8712_DEBUGCTRL_ + 0x2E)
-#define FDLOCKFLAG1		(RTL8712_DEBUGCTRL_ + 0x2F)
-#define TRXPKTBUF_DBG_DATA	(RTL8712_DEBUGCTRL_ + 0x30)
-#define TRXPKTBUF_DBG_CTRL	(RTL8712_DEBUGCTRL_ + 0x38)
-#define DPLL_MON		(RTL8712_DEBUGCTRL_ + 0x3A)
-
-#endif /* __RTL8712_DEBUGCTRL_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_edcasetting_bitdef.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_EDCASETTING_BITDEF_H__
-#define __RTL8712_EDCASETTING_BITDEF_H__
-
-/*EDCAPARAM*/
-#define	_TXOPLIMIT_MSK		0xFFFF0000
-#define	_TXOPLIMIT_SHT		16
-#define	_ECWIN_MSK		0x0000FF00
-#define	_ECWIN_SHT		8
-#define	_AIFS_MSK		0x000000FF
-#define	_AIFS_SHT		0
-
-/*BCNTCFG*/
-#define	_BCNECW_MSK		0xFF00
-#define	_BCNECW_SHT		8
-#define	_BCNIFS_MSK		0x00FF
-#define	_BCNIFS_SHT		0
-
-/*CWRR*/
-#define	_CWRR_MSK		0x03FF
-
-/*ACMAVG*/
-#define	_AVG_TIME_UP		BIT(3)
-#define	_AVGPERIOD_MSK		0x03
-
-/*ACMHWCTRL*/
-#define	_VOQ_ACM_STATUS		BIT(6)
-#define	_VIQ_ACM_STATUS		BIT(5)
-#define	_BEQ_ACM_STATUS		BIT(4)
-#define	_VOQ_ACM_EN		BIT(3)
-#define	_VIQ_ACM_EN		BIT(2)
-#define	_BEQ_ACM_EN		BIT(1)
-#define	_ACMHWEN		BIT(0)
-
-/*VO_ADMTIME*/
-#define	_VO_ACM_RUT		BIT(18)
-#define	_VO_ADMTIME_MSK		0x0003FFF
-
-/*VI_ADMTIME*/
-#define	_VI_ACM_RUT		BIT(18)
-#define	_VI_ADMTIME_MSK		0x0003FFF
-
-/*BE_ADMTIME*/
-#define	_BE_ACM_RUT		BIT(18)
-#define	_BE_ADMTIME_MSK		0x0003FFF
-
-/*Retry limit reg*/
-#define	_SRL_MSK		0xFF00
-#define	_SRL_SHT		8
-#define	_LRL_MSK		0x00FF
-#define	_LRL_SHT		0
-
-#endif /* __RTL8712_EDCASETTING_BITDEF_H__*/
--- a/drivers/staging/rtl8712/rtl8712_edcasetting_regdef.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_EDCASETTING_REGDEF_H__
-#define __RTL8712_EDCASETTING_REGDEF_H__
-
-#define EDCA_VO_PARAM		(RTL8712_EDCASETTING_ + 0x00)
-#define EDCA_VI_PARAM		(RTL8712_EDCASETTING_ + 0x04)
-#define EDCA_BE_PARAM		(RTL8712_EDCASETTING_ + 0x08)
-#define EDCA_BK_PARAM		(RTL8712_EDCASETTING_ + 0x0C)
-#define BCNTCFG			(RTL8712_EDCASETTING_ + 0x10)
-#define CWRR			(RTL8712_EDCASETTING_ + 0x12)
-#define ACMAVG			(RTL8712_EDCASETTING_ + 0x16)
-#define ACMHWCTRL		(RTL8712_EDCASETTING_ + 0x17)
-#define VO_ADMTIME		(RTL8712_EDCASETTING_ + 0x18)
-#define VI_ADMTIME		(RTL8712_EDCASETTING_ + 0x1C)
-#define BE_ADMTIME		(RTL8712_EDCASETTING_ + 0x20)
-#define RL			(RTL8712_EDCASETTING_ + 0x24)
-
-#endif /* __RTL8712_EDCASETTING_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_efuse.c
+++ /dev/null
@@ -1,564 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * rtl8712_efuse.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_EFUSE_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl8712_efuse.h"
-
-/* reserve 3 bytes for HW stop read */
-static int efuse_available_max_size = EFUSE_MAX_SIZE - 3 /*0x1FD*/;
-
-static void efuse_reg_ctrl(struct _adapter *adapter, u8 bPowerOn)
-{
-	u8 tmpu8 = 0;
-
-	if (bPowerOn) {
-		/* -----------------e-fuse pwr & clk reg ctrl ---------------
-		 * Enable LDOE25 Macro Block
-		 */
-		tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3);
-		tmpu8 |= 0x80;
-		r8712_write8(adapter, EFUSE_TEST + 3, tmpu8);
-		msleep(20); /* for some platform , need some delay time */
-		/* Change Efuse Clock for write action to 40MHZ */
-		r8712_write8(adapter, EFUSE_CLK_CTRL, 0x03);
-		msleep(20); /* for some platform , need some delay time */
-	} else {
-		/* -----------------e-fuse pwr & clk reg ctrl -----------------
-		 * Disable LDOE25 Macro Block
-		 */
-		tmpu8 = r8712_read8(adapter, EFUSE_TEST + 3);
-		tmpu8 &= 0x7F;
-		r8712_write8(adapter, EFUSE_TEST + 3, tmpu8);
-		/* Change Efuse Clock for write action to 500K */
-		r8712_write8(adapter, EFUSE_CLK_CTRL, 0x02);
-	}
-}
-
-/*
- * Before write E-Fuse, this function must be called.
- */
-u8 r8712_efuse_reg_init(struct _adapter *adapter)
-{
-	return true;
-}
-
-void r8712_efuse_reg_uninit(struct _adapter *adapter)
-{
-	efuse_reg_ctrl(adapter, false);
-}
-
-static u8 efuse_one_byte_read(struct _adapter *adapter, u16 addr, u8 *data)
-{
-	u8 tmpidx = 0, bResult;
-
-	/* -----------------e-fuse reg ctrl --------------------------------- */
-	r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
-	r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) |
-	       (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC));
-	r8712_write8(adapter, EFUSE_CTRL + 3, 0x72); /* read cmd */
-	/* wait for complete */
-	while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
-	       (tmpidx < 100))
-		tmpidx++;
-	if (tmpidx < 100) {
-		*data = r8712_read8(adapter, EFUSE_CTRL);
-		bResult = true;
-	} else {
-		*data = 0xff;
-		bResult = false;
-	}
-	return bResult;
-}
-
-static u8 efuse_one_byte_write(struct _adapter *adapter, u16 addr, u8 data)
-{
-	u8 tmpidx = 0, bResult;
-
-	/* -----------------e-fuse reg ctrl -------------------------------- */
-	r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
-	r8712_write8(adapter, EFUSE_CTRL + 2, ((u8)((addr >> 8) & 0x03)) |
-	       (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC));
-	r8712_write8(adapter, EFUSE_CTRL, data); /* data */
-	r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */
-	/* wait for complete */
-	while ((0x80 &  r8712_read8(adapter, EFUSE_CTRL + 3)) &&
-	       (tmpidx < 100))
-		tmpidx++;
-	if (tmpidx < 100)
-		bResult = true;
-	else
-		bResult = false;
-	return bResult;
-}
-
-static u8 efuse_one_byte_rw(struct _adapter *adapter, u8 bRead, u16 addr,
-			    u8 *data)
-{
-	u8 tmpidx = 0, tmpv8 = 0, bResult;
-
-	/* -----------------e-fuse reg ctrl --------------------------------- */
-	r8712_write8(adapter, EFUSE_CTRL + 1, (u8)(addr & 0xFF)); /* address */
-	tmpv8 = ((u8)((addr >> 8) & 0x03)) |
-		 (r8712_read8(adapter, EFUSE_CTRL + 2) & 0xFC);
-	r8712_write8(adapter, EFUSE_CTRL + 2, tmpv8);
-	if (bRead) {
-		r8712_write8(adapter, EFUSE_CTRL + 3,  0x72); /* read cmd */
-		while (!(0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
-		       (tmpidx < 100))
-			tmpidx++;
-		if (tmpidx < 100) {
-			*data = r8712_read8(adapter, EFUSE_CTRL);
-			bResult = true;
-		} else {
-			*data = 0;
-			bResult = false;
-		}
-	} else {
-		r8712_write8(adapter, EFUSE_CTRL, *data); /* data */
-		r8712_write8(adapter, EFUSE_CTRL + 3, 0xF2); /* write cmd */
-		while ((0x80 & r8712_read8(adapter, EFUSE_CTRL + 3)) &&
-		       (tmpidx < 100))
-			tmpidx++;
-		if (tmpidx < 100)
-			bResult = true;
-		else
-			bResult = false;
-	}
-	return bResult;
-}
-
-static u8 efuse_is_empty(struct _adapter *adapter, u8 *empty)
-{
-	u8 value, ret = true;
-
-	/* read one byte to check if E-Fuse is empty */
-	if (efuse_one_byte_rw(adapter, true, 0, &value)) {
-		if (value == 0xFF)
-			*empty = true;
-		else
-			*empty = false;
-	} else {
-		ret = false;
-	}
-	return ret;
-}
-
-void r8712_efuse_change_max_size(struct _adapter *adapter)
-{
-	u16 pre_pg_data_saddr = 0x1FB;
-	u16 i;
-	u16 pre_pg_data_size = 5;
-	u8 pre_pg_data[5];
-
-	for (i = 0; i < pre_pg_data_size; i++)
-		efuse_one_byte_read(adapter, pre_pg_data_saddr + i,
-				    &pre_pg_data[i]);
-	if ((pre_pg_data[0] == 0x03) && (pre_pg_data[1] == 0x00) &&
-	    (pre_pg_data[2] == 0x00) && (pre_pg_data[3] == 0x00) &&
-	    (pre_pg_data[4] == 0x0C))
-		efuse_available_max_size -= pre_pg_data_size;
-}
-
-int r8712_efuse_get_max_size(struct _adapter *adapter)
-{
-	return	efuse_available_max_size;
-}
-
-static u8 calculate_word_cnts(const u8 word_en)
-{
-	u8 word_cnts = 0;
-	u8 word_idx;
-
-	for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++)
-		if (!(word_en & BIT(word_idx)))
-			word_cnts++; /* 0 : write enable */
-	return word_cnts;
-}
-
-static void pgpacket_copy_data(const u8 word_en, const u8 *sourdata,
-			       u8 *targetdata)
-{
-	u8 tmpindex = 0;
-	u8 word_idx, byte_idx;
-
-	for (word_idx = 0; word_idx < PGPKG_MAX_WORDS; word_idx++) {
-		if (!(word_en & BIT(word_idx))) {
-			byte_idx = word_idx * 2;
-			targetdata[byte_idx] = sourdata[tmpindex++];
-			targetdata[byte_idx + 1] = sourdata[tmpindex++];
-		}
-	}
-}
-
-u16 r8712_efuse_get_current_size(struct _adapter *adapter)
-{
-	int bContinual = true;
-	u16 efuse_addr = 0;
-	u8 hworden = 0;
-	u8 efuse_data, word_cnts = 0;
-
-	while (bContinual && efuse_one_byte_read(adapter, efuse_addr,
-	       &efuse_data) && (efuse_addr < efuse_available_max_size)) {
-		if (efuse_data != 0xFF) {
-			hworden =  efuse_data & 0x0F;
-			word_cnts = calculate_word_cnts(hworden);
-			/* read next header */
-			efuse_addr = efuse_addr + (word_cnts * 2) + 1;
-		} else {
-			bContinual = false;
-		}
-	}
-	return efuse_addr;
-}
-
-u8 r8712_efuse_pg_packet_read(struct _adapter *adapter, u8 offset, u8 *data)
-{
-	u8 hoffset = 0, hworden = 0, word_cnts = 0;
-	u16 efuse_addr = 0;
-	u8 efuse_data;
-	u8 tmpidx = 0;
-	u8 tmpdata[PGPKT_DATA_SIZE];
-	u8 ret = true;
-
-	if (!data)
-		return false;
-	if (offset > 0x0f)
-		return false;
-	memset(data, 0xFF, sizeof(u8) * PGPKT_DATA_SIZE);
-	while (efuse_addr < efuse_available_max_size) {
-		if (efuse_one_byte_read(adapter, efuse_addr, &efuse_data)) {
-			if (efuse_data == 0xFF)
-				break;
-			hoffset = (efuse_data >> 4) & 0x0F;
-			hworden =  efuse_data & 0x0F;
-			word_cnts = calculate_word_cnts(hworden);
-			if (hoffset == offset) {
-				memset(tmpdata, 0xFF, PGPKT_DATA_SIZE);
-				for (tmpidx = 0; tmpidx < word_cnts * 2;
-				     tmpidx++) {
-					if (efuse_one_byte_read(adapter,
-					    efuse_addr + 1 + tmpidx,
-					    &efuse_data)) {
-						tmpdata[tmpidx] = efuse_data;
-					} else {
-						ret = false;
-					}
-				}
-				pgpacket_copy_data(hworden, tmpdata, data);
-			}
-			efuse_addr += 1 + (word_cnts * 2);
-		} else {
-			ret = false;
-			break;
-		}
-	}
-	return ret;
-}
-
-static u8 fix_header(struct _adapter *adapter, u8 header, u16 header_addr)
-{
-	struct PGPKT_STRUCT pkt;
-	u8 offset, word_en, value;
-	u16 addr;
-	int i;
-	u8 ret = true;
-
-	pkt.offset = GET_EFUSE_OFFSET(header);
-	pkt.word_en = GET_EFUSE_WORD_EN(header);
-	addr = header_addr + 1 + calculate_word_cnts(pkt.word_en) * 2;
-	if (addr > efuse_available_max_size)
-		return false;
-	/* retrieve original data */
-	addr = 0;
-	while (addr < header_addr) {
-		if (!efuse_one_byte_read(adapter, addr++, &value)) {
-			ret = false;
-			break;
-		}
-		offset = GET_EFUSE_OFFSET(value);
-		word_en = GET_EFUSE_WORD_EN(value);
-		if (pkt.offset != offset) {
-			addr += calculate_word_cnts(word_en) * 2;
-			continue;
-		}
-		for (i = 0; i < PGPKG_MAX_WORDS; i++) {
-			if (!(BIT(i) & word_en))
-				continue;
-			if (BIT(i) & pkt.word_en) {
-				if (efuse_one_byte_read(adapter,
-							addr,
-							&value))
-					pkt.data[i * 2] = value;
-				else
-					return false;
-				if (efuse_one_byte_read(adapter,
-							addr + 1,
-							&value))
-					pkt.data[i * 2 + 1] = value;
-				else
-					return false;
-			}
-			addr += 2;
-		}
-	}
-	if (addr != header_addr)
-		return false;
-	addr++;
-	/* fill original data */
-	for (i = 0; i < PGPKG_MAX_WORDS; i++) {
-		if (BIT(i) & pkt.word_en) {
-			efuse_one_byte_write(adapter, addr, pkt.data[i * 2]);
-			efuse_one_byte_write(adapter, addr + 1,
-					     pkt.data[i * 2 + 1]);
-			/* additional check */
-			if (!efuse_one_byte_read(adapter, addr, &value)) {
-				ret = false;
-			} else if (pkt.data[i * 2] != value) {
-				ret = false;
-				if (value == 0xFF) /* write again */
-					efuse_one_byte_write(adapter, addr,
-							     pkt.data[i * 2]);
-			}
-			if (!efuse_one_byte_read(adapter, addr + 1, &value)) {
-				ret = false;
-			} else if (pkt.data[i * 2 + 1] != value) {
-				ret = false;
-				if (value == 0xFF) /* write again */
-					efuse_one_byte_write(adapter, addr + 1,
-							     pkt.data[i * 2 +
-								      1]);
-			}
-		}
-		addr += 2;
-	}
-	return ret;
-}
-
-u8 r8712_efuse_pg_packet_write(struct _adapter *adapter, const u8 offset,
-			       const u8 word_en, const u8 *data)
-{
-	u8 pg_header = 0;
-	u16 efuse_addr = 0, curr_size = 0;
-	u8 efuse_data, target_word_cnts = 0;
-	int repeat_times;
-	int sub_repeat;
-	u8 bResult = true;
-
-	/* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */
-	efuse_data = r8712_read8(adapter, EFUSE_CLK_CTRL);
-	if (efuse_data != 0x03)
-		return false;
-	pg_header = MAKE_EFUSE_HEADER(offset, word_en);
-	target_word_cnts = calculate_word_cnts(word_en);
-	repeat_times = 0;
-	efuse_addr = 0;
-	while (efuse_addr < efuse_available_max_size) {
-		curr_size = r8712_efuse_get_current_size(adapter);
-		if ((curr_size + 1 + target_word_cnts * 2) >
-		     efuse_available_max_size)
-			return false; /*target_word_cnts + pg header(1 byte)*/
-		efuse_addr = curr_size; /* current size is also the last addr*/
-		efuse_one_byte_write(adapter, efuse_addr, pg_header); /*hdr*/
-		sub_repeat = 0;
-		/* check if what we read is what we write */
-		while (!efuse_one_byte_read(adapter, efuse_addr,
-					    &efuse_data)) {
-			if (++sub_repeat > _REPEAT_THRESHOLD_) {
-				bResult = false; /* continue to blind write */
-				break; /* continue to blind write */
-			}
-		}
-		if ((sub_repeat > _REPEAT_THRESHOLD_) ||
-		    (pg_header == efuse_data)) {
-			/* write header ok OR can't check header(creep) */
-			u8 i;
-
-			/* go to next address */
-			efuse_addr++;
-			for (i = 0; i < target_word_cnts * 2; i++) {
-				efuse_one_byte_write(adapter,
-						     efuse_addr + i,
-						     *(data + i));
-				if (!efuse_one_byte_read(adapter,
-							 efuse_addr + i,
-							 &efuse_data))
-					bResult = false;
-				else if (*(data + i) != efuse_data) /* fail */
-					bResult = false;
-			}
-			break;
-		}
-		/* write header fail */
-		bResult = false;
-		if (efuse_data == 0xFF)
-			return bResult; /* nothing damaged. */
-		/* call rescue procedure */
-		if (!fix_header(adapter, efuse_data, efuse_addr))
-			return false; /* rescue fail */
-
-		if (++repeat_times > _REPEAT_THRESHOLD_) /* fail */
-			break;
-		/* otherwise, take another risk... */
-	}
-	return bResult;
-}
-
-u8 r8712_efuse_access(struct _adapter *adapter, u8 bRead, u16 start_addr,
-		      u16 cnts, u8 *data)
-{
-	int i;
-	u8 res = true;
-
-	if (start_addr > EFUSE_MAX_SIZE)
-		return false;
-	if (!bRead && ((start_addr + cnts) >
-	   efuse_available_max_size))
-		return false;
-	if (!bRead && !r8712_efuse_reg_init(adapter))
-		return false;
-	/* -----------------e-fuse one byte read / write ---------------------*/
-	for (i = 0; i < cnts; i++) {
-		if ((start_addr + i) > EFUSE_MAX_SIZE) {
-			res = false;
-			break;
-		}
-		res = efuse_one_byte_rw(adapter, bRead, start_addr + i,
-					data + i);
-		if (!bRead && !res)
-			break;
-	}
-	if (!bRead)
-		r8712_efuse_reg_uninit(adapter);
-	return res;
-}
-
-u8 r8712_efuse_map_read(struct _adapter *adapter, u16 addr, u16 cnts, u8 *data)
-{
-	u8 offset, ret = true;
-	u8 pktdata[PGPKT_DATA_SIZE];
-	int i, idx;
-
-	if ((addr + cnts) > EFUSE_MAP_MAX_SIZE)
-		return false;
-	if (efuse_is_empty(adapter, &offset) && offset) {
-		for (i = 0; i < cnts; i++)
-			data[i] = 0xFF;
-		return ret;
-	}
-	offset = (addr >> 3) & 0xF;
-	ret = r8712_efuse_pg_packet_read(adapter, offset, pktdata);
-	i = addr & 0x7;	/* pktdata index */
-	idx = 0;	/* data index */
-
-	do {
-		for (; i < PGPKT_DATA_SIZE; i++) {
-			data[idx++] = pktdata[i];
-			if (idx == cnts)
-				return ret;
-		}
-		offset++;
-		if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata))
-			ret = false;
-		i = 0;
-	} while (1);
-	return ret;
-}
-
-u8 r8712_efuse_map_write(struct _adapter *adapter, u16 addr, u16 cnts,
-			 u8 *data)
-{
-	u8 offset, word_en, empty;
-	u8 pktdata[PGPKT_DATA_SIZE], newdata[PGPKT_DATA_SIZE];
-	int i, j, idx;
-
-	if ((addr + cnts) > EFUSE_MAP_MAX_SIZE)
-		return false;
-	/* check if E-Fuse Clock Enable and E-Fuse Clock is 40M */
-	empty = r8712_read8(adapter, EFUSE_CLK_CTRL);
-	if (empty != 0x03)
-		return false;
-	if (efuse_is_empty(adapter, &empty)) {
-		if (empty)
-			memset(pktdata, 0xFF, PGPKT_DATA_SIZE);
-	} else {
-		return false;
-	}
-	offset = (addr >> 3) & 0xF;
-	if (!empty)
-		if (!r8712_efuse_pg_packet_read(adapter, offset, pktdata))
-			return false;
-	word_en = 0xF;
-	memset(newdata, 0xFF, PGPKT_DATA_SIZE);
-	i = addr & 0x7;	/* pktdata index */
-	j = 0;		/* newdata index */
-	idx = 0;	/* data index */
-
-	if (i & 0x1) {
-		/*  odd start */
-		if (data[idx] != pktdata[i]) {
-			word_en &= ~BIT(i >> 1);
-			newdata[j++] = pktdata[i - 1];
-			newdata[j++] = data[idx];
-		}
-		i++;
-		idx++;
-	}
-	do {
-		for (; i < PGPKT_DATA_SIZE; i += 2) {
-			if ((cnts - idx) == 1) {
-				if (data[idx] != pktdata[i]) {
-					word_en &= ~BIT(i >> 1);
-					newdata[j++] = data[idx];
-					newdata[j++] = pktdata[1 + 1];
-				}
-				idx++;
-				break;
-			}
-
-			if ((data[idx] != pktdata[i]) || (data[idx + 1] !=
-			     pktdata[i + 1])) {
-				word_en &= ~BIT(i >> 1);
-				newdata[j++] = data[idx];
-				newdata[j++] = data[idx + 1];
-			}
-			idx += 2;
-
-			if (idx == cnts)
-				break;
-		}
-
-		if (word_en != 0xF)
-			if (!r8712_efuse_pg_packet_write(adapter, offset,
-							 word_en, newdata))
-				return false;
-		if (idx == cnts)
-			break;
-		offset++;
-		if (!empty)
-			if (!r8712_efuse_pg_packet_read(adapter, offset,
-							pktdata))
-				return false;
-		i = 0;
-		j = 0;
-		word_en = 0xF;
-		memset(newdata, 0xFF, PGPKT_DATA_SIZE);
-	} while (1);
-
-	return true;
-}
--- a/drivers/staging/rtl8712/rtl8712_efuse.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __RTL8712_EFUSE_H__
-#define __RTL8712_EFUSE_H__
-
-#include "osdep_service.h"
-
-#define _REPEAT_THRESHOLD_	3
-
-#define EFUSE_MAX_SIZE		512
-#define EFUSE_MAP_MAX_SIZE	128
-
-#define PGPKG_MAX_WORDS	4
-#define PGPKT_DATA_SIZE	8 /* PGPKG_MAX_WORDS*2; BYTES sizeof(u8)*8*/
-#define MAX_PGPKT_SIZE	9 /* 1 + PGPKT_DATA_SIZE; header + 2 * 4 words (BYTES)*/
-
-#define GET_EFUSE_OFFSET(header)	((header & 0xF0) >> 4)
-#define GET_EFUSE_WORD_EN(header)	(header & 0x0F)
-#define MAKE_EFUSE_HEADER(offset, word_en)	((((offset) & 0x0F) << 4) | \
-						((word_en) & 0x0F))
-/*--------------------------------------------------------------------------*/
-struct PGPKT_STRUCT {
-	u8 offset;
-	u8 word_en;
-	u8 data[PGPKT_DATA_SIZE];
-};
-
-/*--------------------------------------------------------------------------*/
-u8 r8712_efuse_reg_init(struct _adapter *padapter);
-void r8712_efuse_reg_uninit(struct _adapter *padapter);
-u16 r8712_efuse_get_current_size(struct _adapter *padapter);
-int r8712_efuse_get_max_size(struct _adapter *padapter);
-void r8712_efuse_change_max_size(struct _adapter *padapter);
-u8 r8712_efuse_pg_packet_read(struct _adapter *padapter,
-			      u8 offset, u8 *data);
-u8 r8712_efuse_pg_packet_write(struct _adapter *padapter,
-			       const u8 offset, const u8 word_en,
-			       const u8 *data);
-u8 r8712_efuse_access(struct _adapter *padapter, u8 bRead,
-		      u16 start_addr, u16 cnts, u8 *data);
-u8 r8712_efuse_map_read(struct _adapter *padapter, u16 addr,
-			u16 cnts, u8 *data);
-u8 r8712_efuse_map_write(struct _adapter *padapter, u16 addr,
-			 u16 cnts, u8 *data);
-#endif
--- a/drivers/staging/rtl8712/rtl8712_event.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_EVENT_H_
-#define _RTL8712_EVENT_H_
-
-void r8712_event_handle(struct _adapter *padapter, __le32 *peventbuf);
-void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf);
-
-enum rtl8712_c2h_event {
-	GEN_EVT_CODE(_Read_MACREG) = 0,		/*0*/
-	GEN_EVT_CODE(_Read_BBREG),
-	GEN_EVT_CODE(_Read_RFREG),
-	GEN_EVT_CODE(_Read_EEPROM),
-	GEN_EVT_CODE(_Read_EFUSE),
-	GEN_EVT_CODE(_Read_CAM),		/*5*/
-	GEN_EVT_CODE(_Get_BasicRate),
-	GEN_EVT_CODE(_Get_DataRate),
-	GEN_EVT_CODE(_Survey),			/*8*/
-	GEN_EVT_CODE(_SurveyDone),		/*9*/
-
-	GEN_EVT_CODE(_JoinBss),			/*10*/
-	GEN_EVT_CODE(_AddSTA),
-	GEN_EVT_CODE(_DelSTA),
-	GEN_EVT_CODE(_AtimDone),
-	GEN_EVT_CODE(_TX_Report),
-	GEN_EVT_CODE(_CCX_Report),		/*15*/
-	GEN_EVT_CODE(_DTM_Report),
-	GEN_EVT_CODE(_TX_Rate_Statistics),
-	GEN_EVT_CODE(_C2HLBK),
-	GEN_EVT_CODE(_FWDBG),
-	GEN_EVT_CODE(_C2HFEEDBACK),		/*20*/
-	GEN_EVT_CODE(_ADDBA),
-	GEN_EVT_CODE(_C2HBCN),
-	GEN_EVT_CODE(_ReportPwrState),		/*filen: only for PCIE, USB*/
-	GEN_EVT_CODE(_WPS_PBC),			/*24*/
-	GEN_EVT_CODE(_ADDBAReq_Report),		/*25*/
-	MAX_C2HEVT
-};
-
-#ifdef _RTL8712_CMD_C_
-
-static struct fwevent wlanevents[] = {
-	{0, NULL},	/*0*/
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, &r8712_survey_event_callback},		/*8*/
-	{sizeof(struct surveydone_event),
-		&r8712_surveydone_event_callback},	/*9*/
-
-	{0, &r8712_joinbss_event_callback},		/*10*/
-	{sizeof(struct stassoc_event), &r8712_stassoc_event_callback},
-	{sizeof(struct stadel_event), &r8712_stadel_event_callback},
-	{0, &r8712_atimdone_event_callback},
-	{0, NULL},
-	{0, NULL},	/*15*/
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},
-	{0, NULL},	/*fwdbg_event_callback},*/
-	{0, NULL},	/*20*/
-	{0, NULL},
-	{0, NULL},
-	{0, &r8712_cpwm_event_callback},
-	{0, &r8712_wpspbc_event_callback},
-	{0, &r8712_got_addbareq_event_callback},
-};
-
-#endif/*_RTL8712_CMD_C_*/
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_fifoctrl_bitdef.h
+++ /dev/null
@@ -1,131 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_FIFOCTRL_BITDEF_H__
-#define __RTL8712_FIFOCTRL_BITDEF_H__
-
-/*PBP*/
-#define	_PSTX_MSK			0xF0
-#define	_PSTX_SHT			4
-#define	_PSRX_MSK			0x0F
-#define	_PSRX_SHT			0
-
-/*TXFF_STATUS*/
-#define	_TXSTATUS_OVF		BIT(15)
-
-/*RXFF_STATUS*/
-#define	_STATUSFF1_OVF		BIT(7)
-#define	_STATUSFF1_EMPTY	BIT(6)
-#define	_STATUSFF0_OVF		BIT(5)
-#define	_STATUSFF0_EMPTY	BIT(4)
-#define	_RXFF1_OVF			BIT(3)
-#define	_RXFF1_EMPTY		BIT(2)
-#define	_RXFF0_OVF			BIT(1)
-#define	_RXFF0_EMPTY		BIT(0)
-
-/*TXFF_EMPTY_TH*/
-#define	_BKQ_EMPTY_TH_MSK	0x0F0000
-#define	_BKQ_EMPTY_TH_SHT	16
-#define	_BEQ_EMPTY_TH_MSK	0x00F000
-#define	_BEQ_EMPTY_TH_SHT	12
-#define	_VIQ_EMPTY_TH_MSK	0x000F00
-#define	_VIQ_EMPTY_TH_SHT	8
-#define	_VOQ_EMPTY_TH_MSK	0x0000F0
-#define	_VOQ_EMPTY_TH_SHT	4
-#define	_BMCQ_EMPTY_TH_MSK	0x00000F
-#define	_BMCQ_EMPTY_TH_SHT	0
-
-/*SDIO_RX_BLKSZ*/
-#define	_SDIO_RX_BLKSZ_MSK	0x07
-
-/*RXDMA_CTRL*/
-#define	_C2HFF_POLL		BIT(4)
-#define	_RXPKT_POLL		BIT(0)
-
-/*RXPKT_NUM*/
-#define	_RXCMD_NUM_MSK		0xFF00
-#define	_RXCMD_NUM_SHT		8
-#define	_RXFF0_NUM_MSK		0x00FF
-#define	_RXFF0_NUM_SHT		0
-
-/*FIFOPAGE2*/
-#define	_PUB_AVAL_PG_MSK	0xFFFF0000
-#define	_PUB_AVAL_PG_SHT	16
-#define	_BCN_AVAL_PG_MSK	0x0000FFFF
-#define	_BCN_AVAL_PG_SHT	0
-
-/*RX0PKTNUM*/
-#define	_RXFF0_DEC_POLL				BIT(15)
-#define	_RXFF0_PKT_DEC_NUM_MSK		0x3F00
-#define	_RXFF0_PKT_DEC_NUM_SHT		8
-#define	_RXFF0_PKTNUM_RPT_MSK		0x00FF
-#define	_RXFF0_PKTNUM_RPT_SHT		0
-
-/*RX1PKTNUM*/
-#define	_RXFF1_DEC_POLL				BIT(15)
-#define	_RXFF1_PKT_DEC_NUM_MSK		0x3F00
-#define	_RXFF1_PKT_DEC_NUM_SHT		8
-#define	_RXFF1_PKTNUM_RPT_MSK		0x00FF
-#define	_RXFF1_PKTNUM_RPT_SHT		0
-
-/*RXFLTMAP0*/
-#define	_MGTFLT13EN		BIT(13)
-#define	_MGTFLT12EN		BIT(12)
-#define	_MGTFLT11EN		BIT(11)
-#define	_MGTFLT10EN		BIT(10)
-#define	_MGTFLT9EN		BIT(9)
-#define	_MGTFLT8EN		BIT(8)
-#define	_MGTFLT5EN		BIT(5)
-#define	_MGTFLT4EN		BIT(4)
-#define	_MGTFLT3EN		BIT(3)
-#define	_MGTFLT2EN		BIT(2)
-#define	_MGTFLT1EN		BIT(1)
-#define	_MGTFLT0EN		BIT(0)
-
-/*RXFLTMAP1*/
-#define	_CTRLFLT15EN	BIT(15)
-#define	_CTRLFLT14EN	BIT(14)
-#define	_CTRLFLT13EN	BIT(13)
-#define	_CTRLFLT12EN	BIT(12)
-#define	_CTRLFLT11EN	BIT(11)
-#define	_CTRLFLT10EN	BIT(10)
-#define	_CTRLFLT9EN		BIT(9)
-#define	_CTRLFLT8EN		BIT(8)
-#define	_CTRLFLT7EN		BIT(7)
-#define	_CTRLFLT6EN		BIT(6)
-
-/*RXFLTMAP2*/
-#define	_DATAFLT15EN	BIT(15)
-#define	_DATAFLT14EN	BIT(14)
-#define	_DATAFLT13EN	BIT(13)
-#define	_DATAFLT12EN	BIT(12)
-#define	_DATAFLT11EN	BIT(11)
-#define	_DATAFLT10EN	BIT(10)
-#define	_DATAFLT9EN		BIT(9)
-#define	_DATAFLT8EN		BIT(8)
-#define	_DATAFLT7EN		BIT(7)
-#define	_DATAFLT6EN		BIT(6)
-#define	_DATAFLT5EN		BIT(5)
-#define	_DATAFLT4EN		BIT(4)
-#define	_DATAFLT3EN		BIT(3)
-#define	_DATAFLT2EN		BIT(2)
-#define	_DATAFLT1EN		BIT(1)
-#define	_DATAFLT0EN		BIT(0)
-
-/*RXFLTMAP3*/
-#define	_MESHAFLT1EN		BIT(1)
-#define	_MESHAFLT0EN		BIT(0)
-
-/*TXPKT_NUM_CTRL*/
-#define	_TXPKTNUM_DEC		BIT(8)
-#define	_TXPKTNUM_MSK		0x00FF
-#define	_TXPKTNUM_SHT		0
-
-/*TXFF_PG_NUM*/
-#define	_TXFF_PG_NUM_MSK	0x0FFF
-
-#endif	/*	__RTL8712_FIFOCTRL_BITDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_fifoctrl_regdef.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_FIFOCTRL_REGDEF_H__
-#define __RTL8712_FIFOCTRL_REGDEF_H__
-
-#define RQPN			(RTL8712_FIFOCTRL_ + 0x00)
-#define RXFF_BNDY		(RTL8712_FIFOCTRL_ + 0x0C)
-#define RXRPT_BNDY		(RTL8712_FIFOCTRL_ + 0x10)
-#define TXPKTBUF_PGBNDY		(RTL8712_FIFOCTRL_ + 0x14)
-#define PBP			(RTL8712_FIFOCTRL_ + 0x15)
-#define RX_DRVINFO_SZ		(RTL8712_FIFOCTRL_ + 0x16)
-#define TXFF_STATUS		(RTL8712_FIFOCTRL_ + 0x17)
-#define RXFF_STATUS		(RTL8712_FIFOCTRL_ + 0x18)
-#define TXFF_EMPTY_TH		(RTL8712_FIFOCTRL_ + 0x19)
-#define SDIO_RX_BLKSZ		(RTL8712_FIFOCTRL_ + 0x1C)
-#define RXDMA_RXCTRL		(RTL8712_FIFOCTRL_ + 0x1D)
-#define RXPKT_NUM		(RTL8712_FIFOCTRL_ + 0x1E)
-#define RXPKT_NUM_C2H		(RTL8712_FIFOCTRL_ + 0x1F)
-#define C2HCMD_UDT_SIZE		(RTL8712_FIFOCTRL_ + 0x20)
-#define C2HCMD_UDT_ADDR		(RTL8712_FIFOCTRL_ + 0x22)
-#define FIFOPAGE2		(RTL8712_FIFOCTRL_ + 0x24)
-#define FIFOPAGE1		(RTL8712_FIFOCTRL_ + 0x28)
-#define FW_RSVD_PG_CTRL		(RTL8712_FIFOCTRL_ + 0x30)
-#define TXRPTFF_RDPTR		(RTL8712_FIFOCTRL_ + 0x40)
-#define TXRPTFF_WTPTR		(RTL8712_FIFOCTRL_ + 0x44)
-#define C2HFF_RDPTR		(RTL8712_FIFOCTRL_ + 0x48)
-#define C2HFF_WTPTR		(RTL8712_FIFOCTRL_ + 0x4C)
-#define RXFF0_RDPTR		(RTL8712_FIFOCTRL_ + 0x50)
-#define RXFF0_WTPTR		(RTL8712_FIFOCTRL_ + 0x54)
-#define RXFF1_RDPTR		(RTL8712_FIFOCTRL_ + 0x58)
-#define RXFF1_WTPTR		(RTL8712_FIFOCTRL_ + 0x5C)
-#define RXRPT0FF_RDPTR		(RTL8712_FIFOCTRL_ + 0x60)
-#define RXRPT0FF_WTPTR		(RTL8712_FIFOCTRL_ + 0x64)
-#define RXRPT1FF_RDPTR		(RTL8712_FIFOCTRL_ + 0x68)
-#define RXRPT1FF_WTPTR		(RTL8712_FIFOCTRL_ + 0x6C)
-#define RX0PKTNUM		(RTL8712_FIFOCTRL_ + 0x72)
-#define RX1PKTNUM		(RTL8712_FIFOCTRL_ + 0x74)
-#define RXFLTMAP0		(RTL8712_FIFOCTRL_ + 0x76)
-#define RXFLTMAP1		(RTL8712_FIFOCTRL_ + 0x78)
-#define RXFLTMAP2		(RTL8712_FIFOCTRL_ + 0x7A)
-#define RXFLTMAP3		(RTL8712_FIFOCTRL_ + 0x7c)
-#define TBDA			(RTL8712_FIFOCTRL_ + 0x84)
-#define THPDA			(RTL8712_FIFOCTRL_ + 0x88)
-#define TCDA			(RTL8712_FIFOCTRL_ + 0x8C)
-#define TMDA			(RTL8712_FIFOCTRL_ + 0x90)
-#define HDA			(RTL8712_FIFOCTRL_ + 0x94)
-#define TVODA			(RTL8712_FIFOCTRL_ + 0x98)
-#define TVIDA			(RTL8712_FIFOCTRL_ + 0x9C)
-#define TBEDA			(RTL8712_FIFOCTRL_ + 0xA0)
-#define TBKDA			(RTL8712_FIFOCTRL_ + 0xA4)
-#define RCDA			(RTL8712_FIFOCTRL_ + 0xA8)
-#define RDSA			(RTL8712_FIFOCTRL_ + 0xAC)
-#define TXPKT_NUM_CTRL		(RTL8712_FIFOCTRL_ + 0xB0)
-#define TXQ_PGADD		(RTL8712_FIFOCTRL_ + 0xB3)
-#define TXFF_PG_NUM		(RTL8712_FIFOCTRL_ + 0xB4)
-
-#endif	/* __RTL8712_FIFOCTRL_REGDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_gp_bitdef.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_GP_BITDEF_H__
-#define __RTL8712_GP_BITDEF_H__
-
-/*GPIO_CTRL*/
-#define	_GPIO_MOD_MSK			0xFF000000
-#define	_GPIO_MOD_SHT			24
-#define	_GPIO_IO_SEL_MSK		0x00FF0000
-#define	_GPIO_IO_SEL_SHT		16
-#define	_GPIO_OUT_MSK			0x0000FF00
-#define	_GPIO_OUT_SHT			8
-#define	_GPIO_IN_MSK			0x000000FF
-#define	_GPIO_IN_SHT			0
-
-/*SYS_PINMUX_CFG*/
-#define	_GPIOSEL_MSK			0x0003
-#define	_GPIOSEL_SHT			0
-
-/*LED_CFG*/
-#define _LED1SV				BIT(7)
-#define _LED1CM_MSK			0x0070
-#define _LED1CM_SHT			4
-#define _LED0SV				BIT(3)
-#define _LED0CM_MSK			0x0007
-#define _LED0CM_SHT			0
-
-/*PHY_REG*/
-#define _HST_RDRDY_SHT			0
-#define _HST_RDRDY_MSK			0xFF
-#define _HST_RDRDY			BIT(_HST_RDRDY_SHT)
-#define _CPU_WTBUSY_SHT			1
-#define _CPU_WTBUSY_MSK			0xFF
-#define _CPU_WTBUSY			BIT(_CPU_WTBUSY_SHT)
-
-/* 11. General Purpose Registers   (Offset: 0x02E0 - 0x02FF)*/
-
-/*       8192S GPIO Config Setting (offset 0x2F1, 1 byte)*/
-
-/*----------------------------------------------------------------------------*/
-
-#define		GPIOMUX_EN	BIT(3)	/* When this bit is set to "1",
-					 * GPIO PINs will switch to MAC
-					 * GPIO Function
-					 */
-#define		GPIOSEL_GPIO	0	/* UART or JTAG or pure GPIO*/
-#define		GPIOSEL_PHYDBG	1	/* PHYDBG*/
-#define		GPIOSEL_BT	2	/* BT_coex*/
-#define		GPIOSEL_WLANDBG	3	/* WLANDBG*/
-#define		GPIOSEL_GPIO_MASK	(~(BIT(0) | BIT(1)))
-/* HW Radio OFF switch (GPIO BIT) */
-#define		HAL_8192S_HW_GPIO_OFF_BIT	BIT(3)
-#define		HAL_8192S_HW_GPIO_OFF_MASK	0xF7
-#define		HAL_8192S_HW_GPIO_WPS_BIT	BIT(4)
-
-#endif	/*__RTL8712_GP_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_gp_regdef.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_GP_REGDEF_H__
-#define __RTL8712_GP_REGDEF_H__
-
-#define PSTIMER			(RTL8712_GP_ + 0x00)
-#define TIMER1			(RTL8712_GP_ + 0x04)
-#define TIMER2			(RTL8712_GP_ + 0x08)
-#define GPIO_CTRL		(RTL8712_GP_ + 0x0C)
-#define GPIO_IO_SEL		(RTL8712_GP_ + 0x0E)
-#define GPIO_INTCTRL		(RTL8712_GP_ + 0x10)
-#define MAC_PINMUX_CTRL		(RTL8712_GP_ + 0x11)
-#define LEDCFG			(RTL8712_GP_ + 0x12)
-#define PHY_REG_RPT		(RTL8712_GP_ + 0x13)
-#define PHY_REG_DATA		(RTL8712_GP_ + 0x14)
-
-#endif	/*__RTL8712_GP_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_hal.h
+++ /dev/null
@@ -1,142 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_HAL_H__
-#define __RTL8712_HAL_H__
-
-enum _HW_VERSION {
-	RTL8712_FPGA,
-	RTL8712_1stCUT,	/*A Cut (RTL8712_ASIC)*/
-	RTL8712_2ndCUT,	/*B Cut*/
-	RTL8712_3rdCUT,	/*C Cut*/
-};
-
-enum _LOOPBACK_TYPE {
-	RTL8712_AIR_TRX = 0,
-	RTL8712_MAC_LBK,
-	RTL8712_BB_LBK,
-	RTL8712_MAC_FW_LBK = 4,
-	RTL8712_BB_FW_LBK = 8,
-};
-
-enum RTL871X_HCI_TYPE {
-	RTL8712_SDIO,
-	RTL8712_USB,
-};
-
-enum RTL8712_RF_CONFIG {
-	RTL8712_RF_1T1R,
-	RTL8712_RF_1T2R,
-	RTL8712_RF_2T2R
-};
-
-enum _RTL8712_HCI_TYPE_ {
-	RTL8712_HCI_TYPE_PCIE = 0x01,
-	RTL8712_HCI_TYPE_AP_PCIE = 0x81,
-	RTL8712_HCI_TYPE_USB = 0x02,
-	RTL8712_HCI_TYPE_92USB = 0x02,
-	RTL8712_HCI_TYPE_AP_USB = 0x82,
-	RTL8712_HCI_TYPE_72USB = 0x12,
-	RTL8712_HCI_TYPE_SDIO = 0x04,
-	RTL8712_HCI_TYPE_72SDIO = 0x14
-};
-
-struct fw_priv {   /*8-bytes alignment required*/
-	/*--- long word 0 ----*/
-	unsigned char signature_0;  /*0x12: CE product, 0x92: IT product*/
-	unsigned char signature_1;  /*0x87: CE product, 0x81: IT product*/
-	unsigned char hci_sel; /*0x81: PCI-AP, 01:PCIe, 02: 92S-U, 0x82: USB-AP,
-				* 0x12: 72S-U, 03:SDIO
-				*/
-	unsigned char chip_version; /*the same value as register value*/
-	unsigned char customer_ID_0; /*customer  ID low byte*/
-	unsigned char customer_ID_1; /*customer  ID high byte*/
-	unsigned char rf_config;  /*0x11:  1T1R, 0x12: 1T2R, 0x92: 1T2R turbo,
-				   * 0x22: 2T2R
-				   */
-	unsigned char usb_ep_num;  /* 4: 4EP, 6: 6EP, 11: 11EP*/
-	/*--- long word 1 ----*/
-	unsigned char regulatory_class_0; /*regulatory class bit map 0*/
-	unsigned char regulatory_class_1; /*regulatory class bit map 1*/
-	unsigned char regulatory_class_2; /*regulatory class bit map 2*/
-	unsigned char regulatory_class_3; /*regulatory class bit map 3*/
-	unsigned char rfintfs;    /* 0:SWSI, 1:HWSI, 2:HWPI*/
-	unsigned char def_nettype;
-	unsigned char turbo_mode;
-	unsigned char low_power_mode;/* 0: normal mode, 1: low power mode*/
-	/*--- long word 2 ----*/
-	unsigned char lbk_mode; /*0x00: normal, 0x03: MACLBK, 0x01: PHYLBK*/
-	unsigned char mp_mode; /* 1: for MP use, 0: for normal driver */
-	unsigned char vcs_type; /* 0:off 1:on 2:auto */
-	unsigned char vcs_mode; /* 1:RTS/CTS 2:CTS to self */
-	unsigned char rsvd022;
-	unsigned char rsvd023;
-	unsigned char rsvd024;
-	unsigned char rsvd025;
-	/*--- long word 3 ----*/
-	unsigned char qos_en;    /*1: QoS enable*/
-	unsigned char bw_40MHz_en;   /*1: 40MHz BW enable*/
-	unsigned char AMSDU2AMPDU_en;   /*1: 4181 convert AMSDU to AMPDU,
-					 * 0: disable
-					 */
-	unsigned char AMPDU_en;   /*1: 11n AMPDU enable*/
-	unsigned char rate_control_offload; /*1: FW offloads,0: driver handles*/
-	unsigned char aggregation_offload;  /*1: FW offloads,0: driver handles*/
-	unsigned char rsvd030;
-	unsigned char rsvd031;
-	/*--- long word 4 ----*/
-	unsigned char beacon_offload;   /* 1. FW offloads, 0: driver handles*/
-	unsigned char MLME_offload;   /* 2. FW offloads, 0: driver handles*/
-	unsigned char hwpc_offload;   /* 3. FW offloads, 0: driver handles*/
-	unsigned char tcp_checksum_offload; /*4. FW offloads,0: driver handles*/
-	unsigned char tcp_offload;    /* 5. FW offloads, 0: driver handles*/
-	unsigned char ps_control_offload; /* 6. FW offloads, 0: driver handles*/
-	unsigned char WWLAN_offload;   /* 7. FW offloads, 0: driver handles*/
-	unsigned char rsvd040;
-	/*--- long word 5 ----*/
-	unsigned char tcp_tx_frame_len_L;  /*tcp tx packet length low byte*/
-	unsigned char tcp_tx_frame_len_H;  /*tcp tx packet length high byte*/
-	unsigned char tcp_rx_frame_len_L;  /*tcp rx packet length low byte*/
-	unsigned char tcp_rx_frame_len_H;  /*tcp rx packet length high byte*/
-	unsigned char rsvd050;
-	unsigned char rsvd051;
-	unsigned char rsvd052;
-	unsigned char rsvd053;
-};
-
-struct fw_hdr {/*8-byte alignment required*/
-	unsigned short	signature;
-	unsigned short	version;	/* 0x8000 ~ 0x8FFF for FPGA version,
-					 * 0x0000 ~ 0x7FFF for ASIC version,
-					 */
-	unsigned int		dmem_size;    /*define the size of boot loader*/
-	unsigned int		img_IMEM_size; /*define the size of FW in IMEM*/
-	unsigned int		img_SRAM_size; /*define the size of FW in SRAM*/
-	unsigned int		fw_priv_sz; /*define the size of DMEM variable*/
-	unsigned short	efuse_addr;
-	unsigned short	h2ccnd_resp_addr;
-	unsigned int		SVNRevision;
-	unsigned int		release_time; /*Mon:Day:Hr:Min*/
-	struct fw_priv	fwpriv;
-};
-
-struct hal_priv {
-	/*Endpoint handles*/
-	struct  net_device *pipehdls_r8712[10];
-	u8 (*hal_bus_init)(struct _adapter *adapter);
-};
-
-uint	 rtl8712_hal_init(struct _adapter *padapter);
-int rtl871x_load_fw(struct _adapter *padapter);
-
-#endif
--- a/drivers/staging/rtl8712/rtl8712_interrupt_bitdef.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_INTERRUPT_BITDEF_H__
-#define __RTL8712_INTERRUPT_BITDEF_H__
-
-/*HIMR*/
-/*HISR*/
-#define	_CPUERR					BIT(29)
-#define	_ATIMEND				BIT(28)
-#define	_TXBCNOK				BIT(27)
-#define	_TXBCNERR				BIT(26)
-#define	_BCNDMAINT4				BIT(25)
-#define	_BCNDMAINT3				BIT(24)
-#define	_BCNDMAINT2				BIT(23)
-#define	_BCNDMAINT1				BIT(22)
-#define	_BCNDOK4				BIT(21)
-#define	_BCNDOK3				BIT(20)
-#define	_BCNDOK2				BIT(19)
-#define	_BCNDOK1				BIT(18)
-#define	_TIMEOUT2				BIT(17)
-#define	_TIMEOUT1				BIT(16)
-#define	_TXFOVW					BIT(15)
-#define	_PSTIMEOUT				BIT(14)
-#define	_BCNDMAINT0				BIT(13)
-#define	_FOVW					BIT(12)
-#define	_RDU					BIT(11)
-#define	_RXCMDOK				BIT(10)
-#define	_BCNDOK0				BIT(9)
-#define	_HIGHDOK				BIT(8)
-#define	_COMDOK					BIT(7)
-#define	_MGTDOK					BIT(6)
-#define	_HCCADOK				BIT(5)
-#define	_BKDOK					BIT(4)
-#define	_BEDOK					BIT(3)
-#define	_VIDOK					BIT(2)
-#define	_VODOK					BIT(1)
-#define	_RXOK					BIT(0)
-
-#endif	/*__RTL8712_INTERRUPT_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_io.c
+++ /dev/null
@@ -1,99 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_io.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>.
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_IO_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_io.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-u8 r8712_read8(struct _adapter *adapter, u32 addr)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	return hdl->io_ops._read8(hdl, addr);
-}
-
-u16 r8712_read16(struct _adapter *adapter, u32 addr)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	return hdl->io_ops._read16(hdl, addr);
-}
-
-u32 r8712_read32(struct _adapter *adapter, u32 addr)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	return hdl->io_ops._read32(hdl, addr);
-}
-
-void r8712_write8(struct _adapter *adapter, u32 addr, u8 val)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	hdl->io_ops._write8(hdl, addr, val);
-}
-
-void r8712_write16(struct _adapter *adapter, u32 addr, u16 val)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	hdl->io_ops._write16(hdl, addr, val);
-}
-
-void r8712_write32(struct _adapter *adapter, u32 addr, u32 val)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	hdl->io_ops._write32(hdl, addr, val);
-}
-
-void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	if (adapter->driver_stopped || adapter->surprise_removed)
-		return;
-
-	hdl->io_ops._read_mem(hdl, addr, cnt, pmem);
-}
-
-void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	hdl->io_ops._write_mem(hdl, addr, cnt, pmem);
-}
-
-void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	if (adapter->driver_stopped || adapter->surprise_removed)
-		return;
-
-	hdl->io_ops._read_port(hdl, addr, cnt, pmem);
-}
-
-void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
-{
-	struct intf_hdl *hdl = &adapter->pio_queue->intf;
-
-	hdl->io_ops._write_port(hdl, addr, cnt, pmem);
-}
--- a/drivers/staging/rtl8712/rtl8712_led.c
+++ /dev/null
@@ -1,1830 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_led.c
- *
- * Copyright(c) 2007 - 2010  Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#include "drv_types.h"
-
-/*===========================================================================
- *	Constant.
- *===========================================================================
-
- *
- * Default LED behavior.
- */
-#define LED_BLINK_NORMAL_INTERVAL	100
-#define LED_BLINK_SLOWLY_INTERVAL	200
-#define LED_BLINK_LONG_INTERVAL	400
-
-#define LED_BLINK_NO_LINK_INTERVAL_ALPHA	1000
-#define LED_BLINK_LINK_INTERVAL_ALPHA		500
-#define LED_BLINK_SCAN_INTERVAL_ALPHA		180
-#define LED_BLINK_FASTER_INTERVAL_ALPHA		50
-#define LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA	5000
-
-/*===========================================================================
- * LED object.
- *===========================================================================
- */
-enum _LED_STATE_871x {
-	LED_UNKNOWN = 0,
-	LED_STATE_ON = 1,
-	LED_STATE_OFF = 2,
-	LED_BLINK_NORMAL = 3,
-	LED_BLINK_SLOWLY = 4,
-	LED_POWER_ON_BLINK = 5,
-	LED_SCAN_BLINK = 6, /* LED is blinking during scanning period,
-			     * the # of times to blink is depend on time
-			     * for scanning.
-			     */
-	LED_NO_LINK_BLINK = 7, /* LED is blinking during no link state. */
-	LED_BLINK_StartToBlink = 8,/* Customized for Sercomm Printer
-				    * Server case
-				    */
-	LED_BLINK_WPS = 9,	/* LED is blinkg during WPS communication */
-	LED_TXRX_BLINK = 10,
-	LED_BLINK_WPS_STOP = 11,	/*for ALPHA */
-	LED_BLINK_WPS_STOP_OVERLAP = 12,	/*for BELKIN */
-};
-
-/*===========================================================================
- *	Prototype of protected function.
- *===========================================================================
- */
-static void BlinkTimerCallback(struct timer_list *t);
-
-static void BlinkWorkItemCallback(struct work_struct *work);
-/*===========================================================================
- * LED_819xUsb routines.
- *===========================================================================
- *
- *
- *
- *	Description:
- *		Initialize an LED_871x object.
- */
-static void InitLed871x(struct _adapter *padapter, struct LED_871x *pLed,
-			enum LED_PIN_871x	LedPin)
-{
-	pLed->padapter = padapter;
-	pLed->LedPin = LedPin;
-	pLed->CurrLedState = LED_STATE_OFF;
-	pLed->bLedOn = false;
-	pLed->bLedBlinkInProgress = false;
-	pLed->BlinkTimes = 0;
-	pLed->BlinkingLedState = LED_UNKNOWN;
-	timer_setup(&pLed->BlinkTimer, BlinkTimerCallback, 0);
-	INIT_WORK(&pLed->BlinkWorkItem, BlinkWorkItemCallback);
-}
-
-/*
- *	Description:
- *		DeInitialize an LED_871x object.
- */
-static void DeInitLed871x(struct LED_871x *pLed)
-{
-	del_timer_sync(&pLed->BlinkTimer);
-	/* We should reset bLedBlinkInProgress if we cancel
-	 * the LedControlTimer,
-	 */
-	pLed->bLedBlinkInProgress = false;
-}
-
-/*
- *	Description:
- *		Turn on LED according to LedPin specified.
- */
-static void SwLedOn(struct _adapter *padapter, struct LED_871x *pLed)
-{
-	u8	LedCfg;
-
-	if (padapter->surprise_removed || padapter->driver_stopped)
-		return;
-	LedCfg = r8712_read8(padapter, LEDCFG);
-	switch (pLed->LedPin) {
-	case LED_PIN_GPIO0:
-		break;
-	case LED_PIN_LED0:
-		/* SW control led0 on.*/
-		r8712_write8(padapter, LEDCFG, LedCfg & 0xf0);
-		break;
-	case LED_PIN_LED1:
-		/* SW control led1 on.*/
-		r8712_write8(padapter, LEDCFG, LedCfg & 0x0f);
-		break;
-	default:
-		break;
-	}
-	pLed->bLedOn = true;
-}
-
-/*
- *	Description:
- *		Turn off LED according to LedPin specified.
- */
-static void SwLedOff(struct _adapter *padapter, struct LED_871x *pLed)
-{
-	u8	LedCfg;
-
-	if (padapter->surprise_removed || padapter->driver_stopped)
-		return;
-	LedCfg = r8712_read8(padapter, LEDCFG);
-	switch (pLed->LedPin) {
-	case LED_PIN_GPIO0:
-		break;
-	case LED_PIN_LED0:
-		LedCfg &= 0xf0; /* Set to software control.*/
-		r8712_write8(padapter, LEDCFG, (LedCfg | BIT(3)));
-		break;
-	case LED_PIN_LED1:
-		LedCfg &= 0x0f; /* Set to software control.*/
-		r8712_write8(padapter, LEDCFG, (LedCfg | BIT(7)));
-		break;
-	default:
-		break;
-	}
-	pLed->bLedOn = false;
-}
-
-/*===========================================================================
- * Interface to manipulate LED objects.
- *===========================================================================
- *
- *	Description:
- *		Initialize all LED_871x objects.
- */
-void r8712_InitSwLeds(struct _adapter *padapter)
-{
-	struct led_priv	*pledpriv = &padapter->ledpriv;
-
-	pledpriv->LedControlHandler = LedControl871x;
-	InitLed871x(padapter, &pledpriv->SwLed0, LED_PIN_LED0);
-	InitLed871x(padapter, &pledpriv->SwLed1, LED_PIN_LED1);
-}
-
-/*	Description:
- *		DeInitialize all LED_819xUsb objects.
- */
-void r8712_DeInitSwLeds(struct _adapter *padapter)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-
-	DeInitLed871x(&ledpriv->SwLed0);
-	DeInitLed871x(&ledpriv->SwLed1);
-}
-
-/*	Description:
- *		Implementation of LED blinking behavior.
- *		It toggle off LED and schedule corresponding timer if necessary.
- */
-static void SwLedBlink(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	/* Determine if we shall change LED state again. */
-	pLed->BlinkTimes--;
-	switch (pLed->CurrLedState) {
-	case LED_BLINK_NORMAL:
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		break;
-	case LED_BLINK_StartToBlink:
-		if (check_fwstate(pmlmepriv, _FW_LINKED) &&
-		    (pmlmepriv->fw_state & WIFI_STATION_STATE))
-			bStopBlinking = true;
-		if (check_fwstate(pmlmepriv, _FW_LINKED) &&
-		    ((pmlmepriv->fw_state & WIFI_ADHOC_STATE) ||
-		    (pmlmepriv->fw_state & WIFI_ADHOC_MASTER_STATE)))
-			bStopBlinking = true;
-		else if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		break;
-	case LED_BLINK_WPS:
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		break;
-	default:
-		bStopBlinking = true;
-		break;
-	}
-	if (bStopBlinking) {
-		if (check_fwstate(pmlmepriv, _FW_LINKED) &&
-		    !pLed->bLedOn)
-			SwLedOn(padapter, pLed);
-		else if (check_fwstate(pmlmepriv, _FW_LINKED) &&  pLed->bLedOn)
-			SwLedOff(padapter, pLed);
-		pLed->BlinkTimes = 0;
-		pLed->bLedBlinkInProgress = false;
-	} else {
-		/* Assign LED state to toggle. */
-		if (pLed->BlinkingLedState == LED_STATE_ON)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-
-		/* Schedule a timer to toggle LED state. */
-		switch (pLed->CurrLedState) {
-		case LED_BLINK_NORMAL:
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-			break;
-		case LED_BLINK_SLOWLY:
-		case LED_BLINK_StartToBlink:
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-			break;
-		case LED_BLINK_WPS:
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_LONG_INTERVAL));
-			break;
-		default:
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-			break;
-		}
-	}
-}
-
-static void SwLedBlink1(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	struct led_priv *ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
-	struct LED_871x *pLed1 = &ledpriv->SwLed1;
-	u8 bStopBlinking = false;
-
-	if (peeprompriv->CustomerID == RT_CID_819x_CAMEO)
-		pLed = &ledpriv->SwLed1;
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	if (peeprompriv->CustomerID == RT_CID_DEFAULT) {
-		if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-			if (!pLed1->bSWLedCtrl) {
-				SwLedOn(padapter, pLed1);
-				pLed1->bSWLedCtrl = true;
-			} else if (!pLed1->bLedOn) {
-				SwLedOn(padapter, pLed1);
-			}
-		} else {
-			if (!pLed1->bSWLedCtrl) {
-				SwLedOff(padapter, pLed1);
-				pLed1->bSWLedCtrl = true;
-			} else if (pLed1->bLedOn) {
-				SwLedOff(padapter, pLed1);
-			}
-		}
-	}
-	switch (pLed->CurrLedState) {
-	case LED_BLINK_SLOWLY:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		break;
-	case LED_BLINK_NORMAL:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-		break;
-	case LED_SCAN_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->bLedLinkBlinkInProgress = true;
-				pLed->CurrLedState = LED_BLINK_NORMAL;
-				if (pLed->bLedOn)
-					pLed->BlinkingLedState = LED_STATE_OFF;
-				else
-					pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->bLedNoLinkBlinkInProgress = true;
-				pLed->CurrLedState = LED_BLINK_SLOWLY;
-				if (pLed->bLedOn)
-					pLed->BlinkingLedState = LED_STATE_OFF;
-				else
-					pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-			}
-			pLed->bLedScanBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->bLedLinkBlinkInProgress = true;
-				pLed->CurrLedState = LED_BLINK_NORMAL;
-				if (pLed->bLedOn)
-					pLed->BlinkingLedState = LED_STATE_OFF;
-				else
-					pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->bLedNoLinkBlinkInProgress = true;
-				pLed->CurrLedState = LED_BLINK_SLOWLY;
-				if (pLed->bLedOn)
-					pLed->BlinkingLedState = LED_STATE_OFF;
-				else
-					pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-			}
-			pLed->BlinkTimes = 0;
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_BLINK_WPS:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		break;
-	case LED_BLINK_WPS_STOP:	/* WPS success */
-		if (pLed->BlinkingLedState == LED_STATE_ON) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
-			bStopBlinking = false;
-		} else {
-			bStopBlinking = true;
-		}
-		if (bStopBlinking) {
-			pLed->bLedLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_NORMAL;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-		}
-		pLed->bLedWPSBlinkInProgress = false;
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedBlink2(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	switch (pLed->CurrLedState) {
-	case LED_SCAN_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_ON;
-				pLed->BlinkingLedState = LED_STATE_ON;
-				SwLedOn(padapter, pLed);
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_OFF;
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				SwLedOff(padapter, pLed);
-			}
-			pLed->bLedScanBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_ON;
-				pLed->BlinkingLedState = LED_STATE_ON;
-				SwLedOn(padapter, pLed);
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_OFF;
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				SwLedOff(padapter, pLed);
-			}
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedBlink3(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		if (pLed->CurrLedState != LED_BLINK_WPS_STOP)
-			SwLedOff(padapter, pLed);
-	switch (pLed->CurrLedState) {
-	case LED_SCAN_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_ON;
-				pLed->BlinkingLedState = LED_STATE_ON;
-				if (!pLed->bLedOn)
-					SwLedOn(padapter, pLed);
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_OFF;
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				if (pLed->bLedOn)
-					SwLedOff(padapter, pLed);
-			}
-			pLed->bLedScanBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_ON;
-				pLed->BlinkingLedState = LED_STATE_ON;
-				if (!pLed->bLedOn)
-					SwLedOn(padapter, pLed);
-			} else if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				pLed->CurrLedState = LED_STATE_OFF;
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				if (pLed->bLedOn)
-					SwLedOff(padapter, pLed);
-			}
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_BLINK_WPS:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		break;
-	case LED_BLINK_WPS_STOP:	/*WPS success*/
-		if (pLed->BlinkingLedState == LED_STATE_ON) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
-			bStopBlinking = false;
-		} else {
-			bStopBlinking = true;
-		}
-		if (bStopBlinking) {
-			pLed->CurrLedState = LED_STATE_ON;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			SwLedOn(padapter, pLed);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedBlink4(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-	struct LED_871x *pLed1 = &ledpriv->SwLed1;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	if (!pLed1->bLedWPSBlinkInProgress &&
-	    pLed1->BlinkingLedState == LED_UNKNOWN) {
-		pLed1->BlinkingLedState = LED_STATE_OFF;
-		pLed1->CurrLedState = LED_STATE_OFF;
-		SwLedOff(padapter, pLed1);
-	}
-	switch (pLed->CurrLedState) {
-	case LED_BLINK_SLOWLY:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		break;
-	case LED_BLINK_StartToBlink:
-		if (pLed->bLedOn) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-		} else {
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		}
-		break;
-	case LED_SCAN_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			pLed->bLedNoLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_SLOWLY;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-			pLed->bLedScanBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			pLed->bLedNoLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_SLOWLY;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_BLINK_WPS:
-		if (pLed->bLedOn) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-		} else {
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		}
-		break;
-	case LED_BLINK_WPS_STOP:	/*WPS authentication fail*/
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		break;
-	case LED_BLINK_WPS_STOP_OVERLAP:	/*WPS session overlap */
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0) {
-			if (pLed->bLedOn)
-				pLed->BlinkTimes = 1;
-			else
-				bStopBlinking = true;
-		}
-		if (bStopBlinking) {
-			pLed->BlinkTimes = 10;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		}
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedBlink5(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	switch (pLed->CurrLedState) {
-	case LED_SCAN_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			pLed->CurrLedState = LED_STATE_ON;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			if (!pLed->bLedOn)
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-			pLed->bLedScanBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			pLed->CurrLedState = LED_STATE_ON;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			if (!pLed->bLedOn)
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedBlink6(struct LED_871x *pLed)
-{
-	struct _adapter *padapter = pLed->padapter;
-	u8 bStopBlinking = false;
-
-	/* Change LED according to BlinkingLedState specified. */
-	if (pLed->BlinkingLedState == LED_STATE_ON)
-		SwLedOn(padapter, pLed);
-	else
-		SwLedOff(padapter, pLed);
-	switch (pLed->CurrLedState) {
-	case LED_TXRX_BLINK:
-		pLed->BlinkTimes--;
-		if (pLed->BlinkTimes == 0)
-			bStopBlinking = true;
-		if (bStopBlinking) {
-			pLed->CurrLedState = LED_STATE_ON;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			if (!pLed->bLedOn)
-				SwLedOn(padapter, pLed);
-			pLed->bLedBlinkInProgress = false;
-		} else {
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_BLINK_WPS:
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		break;
-
-	default:
-		break;
-	}
-}
-
-/*	Description:
- *		Callback function of LED BlinkTimer,
- *		it just schedules to corresponding BlinkWorkItem.
- */
-static void BlinkTimerCallback(struct timer_list *t)
-{
-	struct LED_871x  *pLed = from_timer(pLed, t, BlinkTimer);
-
-	/* This fixed the crash problem on Fedora 12 when trying to do the
-	 * insmod;ifconfig up;rmmod commands.
-	 */
-	if (pLed->padapter->surprise_removed || pLed->padapter->driver_stopped)
-		return;
-	schedule_work(&pLed->BlinkWorkItem);
-}
-
-/*	Description:
- *		Callback function of LED BlinkWorkItem.
- *		We dispatch actual LED blink action according to LedStrategy.
- */
-static void BlinkWorkItemCallback(struct work_struct *work)
-{
-	struct LED_871x *pLed = container_of(work, struct LED_871x,
-				BlinkWorkItem);
-	struct led_priv	*ledpriv = &pLed->padapter->ledpriv;
-
-	switch (ledpriv->LedStrategy) {
-	case SW_LED_MODE0:
-		SwLedBlink(pLed);
-		break;
-	case SW_LED_MODE1:
-		SwLedBlink1(pLed);
-		break;
-	case SW_LED_MODE2:
-		SwLedBlink2(pLed);
-		break;
-	case SW_LED_MODE3:
-		SwLedBlink3(pLed);
-		break;
-	case SW_LED_MODE4:
-		SwLedBlink4(pLed);
-		break;
-	case SW_LED_MODE5:
-		SwLedBlink5(pLed);
-		break;
-	case SW_LED_MODE6:
-		SwLedBlink6(pLed);
-		break;
-	default:
-		SwLedBlink(pLed);
-		break;
-	}
-}
-
-/*============================================================================
- * Default LED behavior.
- *============================================================================
- *
- *	Description:
- *		Implement each led action for SW_LED_MODE0.
- *		This is default strategy.
- */
-
-static void SwLedControlMode1(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv *ledpriv = &padapter->ledpriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct sitesurvey_ctrl *psitesurveyctrl = &pmlmepriv->sitesurveyctrl;
-
-	if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO)
-		pLed = &ledpriv->SwLed1;
-	switch (LedAction) {
-	case LED_CTL_START_TO_LINK:
-	case LED_CTL_NO_LINK:
-		if (!pLed->bLedNoLinkBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedNoLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_SLOWLY;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_LINK:
-		if (!pLed->bLedLinkBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_NORMAL;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_LINK_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_SITE_SURVEY:
-		if (psitesurveyctrl->traffic_busy &&
-		    check_fwstate(pmlmepriv, _FW_LINKED))
-			; /* dummy branch */
-		else if (!pLed->bLedScanBlinkInProgress) {
-			if (IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedScanBlinkInProgress = true;
-			pLed->CurrLedState = LED_SCAN_BLINK;
-			pLed->BlinkTimes = 24;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedLinkBlinkInProgress = false;
-			}
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-
-	case LED_CTL_START_WPS: /*wait until xinpin finish */
-	case LED_CTL_START_WPS_BOTTON:
-		if (!pLed->bLedWPSBlinkInProgress) {
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			if (pLed->bLedScanBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedScanBlinkInProgress = false;
-			}
-			pLed->bLedWPSBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_WPS;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_STOP_WPS:
-		if (pLed->bLedNoLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedNoLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress)
-			del_timer(&pLed->BlinkTimer);
-		else
-			pLed->bLedWPSBlinkInProgress = true;
-		pLed->CurrLedState = LED_BLINK_WPS_STOP;
-		if (pLed->bLedOn) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
-		} else {
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer,
-				  jiffies + msecs_to_jiffies(0));
-		}
-		break;
-	case LED_CTL_STOP_WPS_FAIL:
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->bLedNoLinkBlinkInProgress = true;
-		pLed->CurrLedState = LED_BLINK_SLOWLY;
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedNoLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedNoLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedControlMode2(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	 *ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-
-	switch (LedAction) {
-	case LED_CTL_SITE_SURVEY:
-		if (pmlmepriv->sitesurveyctrl.traffic_busy)
-			; /* dummy branch */
-		else if (!pLed->bLedScanBlinkInProgress) {
-			if (IS_LED_WPS_BLINKING(pLed))
-				return;
-
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedScanBlinkInProgress = true;
-			pLed->CurrLedState = LED_SCAN_BLINK;
-			pLed->BlinkTimes = 24;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress &&
-		    check_fwstate(pmlmepriv, _FW_LINKED)) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-
-	case LED_CTL_LINK:
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-
-	case LED_CTL_START_WPS: /*wait until xinpin finish*/
-	case LED_CTL_START_WPS_BOTTON:
-		if (!pLed->bLedWPSBlinkInProgress) {
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			if (pLed->bLedScanBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedScanBlinkInProgress = false;
-			}
-			pLed->bLedWPSBlinkInProgress = true;
-			pLed->CurrLedState = LED_STATE_ON;
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer,
-				  jiffies + msecs_to_jiffies(0));
-		}
-		break;
-
-	case LED_CTL_STOP_WPS:
-		pLed->bLedWPSBlinkInProgress = false;
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-
-	case LED_CTL_STOP_WPS_FAIL:
-		pLed->bLedWPSBlinkInProgress = false;
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-
-	case LED_CTL_START_TO_LINK:
-	case LED_CTL_NO_LINK:
-		if (!IS_LED_BLINKING(pLed)) {
-			pLed->CurrLedState = LED_STATE_OFF;
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer,
-				  jiffies + msecs_to_jiffies(0));
-		}
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedControlMode3(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-
-	switch (LedAction) {
-	case LED_CTL_SITE_SURVEY:
-		if (pmlmepriv->sitesurveyctrl.traffic_busy)
-			; /* dummy branch */
-		else if (!pLed->bLedScanBlinkInProgress) {
-			if (IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedScanBlinkInProgress = true;
-			pLed->CurrLedState = LED_SCAN_BLINK;
-			pLed->BlinkTimes = 24;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress &&
-		    check_fwstate(pmlmepriv, _FW_LINKED)) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_LINK:
-		if (IS_LED_WPS_BLINKING(pLed))
-			return;
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	case LED_CTL_START_WPS: /* wait until xinpin finish */
-	case LED_CTL_START_WPS_BOTTON:
-		if (!pLed->bLedWPSBlinkInProgress) {
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			if (pLed->bLedScanBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedScanBlinkInProgress = false;
-			}
-			pLed->bLedWPSBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_WPS;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_STOP_WPS:
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		} else {
-			pLed->bLedWPSBlinkInProgress = true;
-		}
-		pLed->CurrLedState = LED_BLINK_WPS_STOP;
-		if (pLed->bLedOn) {
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_WPS_SUCCESS_INTERVAL_ALPHA));
-		} else {
-			pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer,
-				  jiffies + msecs_to_jiffies(0));
-		}
-		break;
-	case LED_CTL_STOP_WPS_FAIL:
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	case LED_CTL_START_TO_LINK:
-	case LED_CTL_NO_LINK:
-		if (!IS_LED_BLINKING(pLed)) {
-			pLed->CurrLedState = LED_STATE_OFF;
-			pLed->BlinkingLedState = LED_STATE_OFF;
-			mod_timer(&pLed->BlinkTimer,
-				  jiffies + msecs_to_jiffies(0));
-		}
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedControlMode4(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-	struct LED_871x *pLed1 = &ledpriv->SwLed1;
-
-	switch (LedAction) {
-	case LED_CTL_START_TO_LINK:
-		if (pLed1->bLedWPSBlinkInProgress) {
-			pLed1->bLedWPSBlinkInProgress = false;
-			del_timer(&pLed1->BlinkTimer);
-			pLed1->BlinkingLedState = LED_STATE_OFF;
-			pLed1->CurrLedState = LED_STATE_OFF;
-			if (pLed1->bLedOn)
-				mod_timer(&pLed->BlinkTimer,
-					  jiffies + msecs_to_jiffies(0));
-		}
-		if (!pLed->bLedStartToLinkBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			pLed->bLedStartToLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_StartToBlink;
-			if (pLed->bLedOn) {
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-			} else {
-				pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-			}
-		}
-		break;
-	case LED_CTL_LINK:
-	case LED_CTL_NO_LINK:
-		/*LED1 settings*/
-		if (LedAction == LED_CTL_LINK) {
-			if (pLed1->bLedWPSBlinkInProgress) {
-				pLed1->bLedWPSBlinkInProgress = false;
-				del_timer(&pLed1->BlinkTimer);
-				pLed1->BlinkingLedState = LED_STATE_OFF;
-				pLed1->CurrLedState = LED_STATE_OFF;
-				if (pLed1->bLedOn)
-					mod_timer(&pLed->BlinkTimer,
-						  jiffies + msecs_to_jiffies(0));
-			}
-		}
-		if (!pLed->bLedNoLinkBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedNoLinkBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_SLOWLY;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_SITE_SURVEY:
-		if (pmlmepriv->sitesurveyctrl.traffic_busy &&
-		    check_fwstate(pmlmepriv, _FW_LINKED))
-			;
-		else if (!pLed->bLedScanBlinkInProgress) {
-			if (IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedScanBlinkInProgress = true;
-			pLed->CurrLedState = LED_SCAN_BLINK;
-			pLed->BlinkTimes = 24;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK ||
-			    IS_LED_WPS_BLINKING(pLed))
-				return;
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_START_WPS: /*wait until xinpin finish*/
-	case LED_CTL_START_WPS_BOTTON:
-		if (pLed1->bLedWPSBlinkInProgress) {
-			pLed1->bLedWPSBlinkInProgress = false;
-			del_timer(&pLed1->BlinkTimer);
-			pLed1->BlinkingLedState = LED_STATE_OFF;
-			pLed1->CurrLedState = LED_STATE_OFF;
-			if (pLed1->bLedOn)
-				mod_timer(&pLed->BlinkTimer,
-					  jiffies + msecs_to_jiffies(0));
-		}
-		if (!pLed->bLedWPSBlinkInProgress) {
-			if (pLed->bLedNoLinkBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedNoLinkBlinkInProgress = false;
-			}
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			if (pLed->bLedScanBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedScanBlinkInProgress = false;
-			}
-			pLed->bLedWPSBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_WPS;
-			if (pLed->bLedOn) {
-				pLed->BlinkingLedState = LED_STATE_OFF;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_SLOWLY_INTERVAL));
-			} else {
-				pLed->BlinkingLedState = LED_STATE_ON;
-				mod_timer(&pLed->BlinkTimer, jiffies +
-					  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-			}
-		}
-		break;
-	case LED_CTL_STOP_WPS:	/*WPS connect success*/
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->bLedNoLinkBlinkInProgress = true;
-		pLed->CurrLedState = LED_BLINK_SLOWLY;
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		break;
-	case LED_CTL_STOP_WPS_FAIL:	/*WPS authentication fail*/
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->bLedNoLinkBlinkInProgress = true;
-		pLed->CurrLedState = LED_BLINK_SLOWLY;
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		/*LED1 settings*/
-		if (pLed1->bLedWPSBlinkInProgress)
-			del_timer(&pLed1->BlinkTimer);
-		else
-			pLed1->bLedWPSBlinkInProgress = true;
-		pLed1->CurrLedState = LED_BLINK_WPS_STOP;
-		if (pLed1->bLedOn)
-			pLed1->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed1->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		break;
-	case LED_CTL_STOP_WPS_FAIL_OVERLAP:	/*WPS session overlap*/
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->bLedNoLinkBlinkInProgress = true;
-		pLed->CurrLedState = LED_BLINK_SLOWLY;
-		if (pLed->bLedOn)
-			pLed->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NO_LINK_INTERVAL_ALPHA));
-		/*LED1 settings*/
-		if (pLed1->bLedWPSBlinkInProgress)
-			del_timer(&pLed1->BlinkTimer);
-		else
-			pLed1->bLedWPSBlinkInProgress = true;
-		pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP;
-		pLed1->BlinkTimes = 10;
-		if (pLed1->bLedOn)
-			pLed1->BlinkingLedState = LED_STATE_OFF;
-		else
-			pLed1->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer, jiffies +
-			  msecs_to_jiffies(LED_BLINK_NORMAL_INTERVAL));
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedNoLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedNoLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedLinkBlinkInProgress = false;
-		}
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		if (pLed->bLedScanBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedScanBlinkInProgress = false;
-		}
-		if (pLed->bLedStartToLinkBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedStartToLinkBlinkInProgress = false;
-		}
-		if (pLed1->bLedWPSBlinkInProgress) {
-			del_timer(&pLed1->BlinkTimer);
-			pLed1->bLedWPSBlinkInProgress = false;
-		}
-		pLed1->BlinkingLedState = LED_UNKNOWN;
-		SwLedOff(padapter, pLed);
-		SwLedOff(padapter, pLed1);
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedControlMode5(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-
-	if (padapter->eeprompriv.CustomerID == RT_CID_819x_CAMEO)
-		pLed = &ledpriv->SwLed1;
-
-	switch (LedAction) {
-	case LED_CTL_POWER_ON:
-	case LED_CTL_NO_LINK:
-	case LED_CTL_LINK:	/* solid blue */
-		if (pLed->CurrLedState == LED_SCAN_BLINK)
-			return;
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		pLed->bLedBlinkInProgress = false;
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	case LED_CTL_SITE_SURVEY:
-		if (pmlmepriv->sitesurveyctrl.traffic_busy &&
-		    check_fwstate(pmlmepriv, _FW_LINKED))
-			; /* dummy branch */
-		else if (!pLed->bLedScanBlinkInProgress) {
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedScanBlinkInProgress = true;
-			pLed->CurrLedState = LED_SCAN_BLINK;
-			pLed->BlinkTimes = 24;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress) {
-			if (pLed->CurrLedState == LED_SCAN_BLINK)
-				return;
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		SwLedOff(padapter, pLed);
-		break;
-	default:
-		break;
-	}
-}
-
-static void SwLedControlMode6(struct _adapter *padapter,
-			      enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct LED_871x *pLed = &ledpriv->SwLed0;
-
-	switch (LedAction) {
-	case LED_CTL_POWER_ON:
-	case LED_CTL_NO_LINK:
-	case LED_CTL_LINK:	/*solid blue*/
-	case LED_CTL_SITE_SURVEY:
-		if (IS_LED_WPS_BLINKING(pLed))
-			return;
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		pLed->bLedBlinkInProgress = false;
-		mod_timer(&pLed->BlinkTimer, jiffies + msecs_to_jiffies(0));
-		break;
-	case LED_CTL_TX:
-	case LED_CTL_RX:
-		if (!pLed->bLedBlinkInProgress &&
-		    check_fwstate(pmlmepriv, _FW_LINKED)) {
-			if (IS_LED_WPS_BLINKING(pLed))
-				return;
-			pLed->bLedBlinkInProgress = true;
-			pLed->CurrLedState = LED_TXRX_BLINK;
-			pLed->BlinkTimes = 2;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_FASTER_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_START_WPS: /*wait until xinpin finish*/
-	case LED_CTL_START_WPS_BOTTON:
-		if (!pLed->bLedWPSBlinkInProgress) {
-			if (pLed->bLedBlinkInProgress) {
-				del_timer(&pLed->BlinkTimer);
-				pLed->bLedBlinkInProgress = false;
-			}
-			pLed->bLedWPSBlinkInProgress = true;
-			pLed->CurrLedState = LED_BLINK_WPS;
-			if (pLed->bLedOn)
-				pLed->BlinkingLedState = LED_STATE_OFF;
-			else
-				pLed->BlinkingLedState = LED_STATE_ON;
-			mod_timer(&pLed->BlinkTimer, jiffies +
-				  msecs_to_jiffies(LED_BLINK_SCAN_INTERVAL_ALPHA));
-		}
-		break;
-	case LED_CTL_STOP_WPS_FAIL:
-	case LED_CTL_STOP_WPS:
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		pLed->CurrLedState = LED_STATE_ON;
-		pLed->BlinkingLedState = LED_STATE_ON;
-		mod_timer(&pLed->BlinkTimer,
-			  jiffies + msecs_to_jiffies(0));
-		break;
-	case LED_CTL_POWER_OFF:
-		pLed->CurrLedState = LED_STATE_OFF;
-		pLed->BlinkingLedState = LED_STATE_OFF;
-		if (pLed->bLedBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedBlinkInProgress = false;
-		}
-		if (pLed->bLedWPSBlinkInProgress) {
-			del_timer(&pLed->BlinkTimer);
-			pLed->bLedWPSBlinkInProgress = false;
-		}
-		SwLedOff(padapter, pLed);
-		break;
-	default:
-		break;
-	}
-}
-
-/*	Description:
- *		Dispatch LED action according to pHalData->LedStrategy.
- */
-void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction)
-{
-	struct led_priv	*ledpriv = &padapter->ledpriv;
-
-	if (!ledpriv->bRegUseLed)
-		return;
-	switch (ledpriv->LedStrategy) {
-	case SW_LED_MODE0:
-		break;
-	case SW_LED_MODE1:
-		SwLedControlMode1(padapter, LedAction);
-		break;
-	case SW_LED_MODE2:
-		SwLedControlMode2(padapter, LedAction);
-		break;
-	case SW_LED_MODE3:
-		SwLedControlMode3(padapter, LedAction);
-		break;
-	case SW_LED_MODE4:
-		SwLedControlMode4(padapter, LedAction);
-		break;
-	case SW_LED_MODE5:
-		SwLedControlMode5(padapter, LedAction);
-		break;
-	case SW_LED_MODE6:
-		SwLedControlMode6(padapter, LedAction);
-		break;
-	default:
-		break;
-	}
-}
-
-void r8712_flush_led_works(struct _adapter *padapter)
-{
-	struct led_priv *pledpriv = &padapter->ledpriv;
-
-	flush_work(&pledpriv->SwLed0.BlinkWorkItem);
-	flush_work(&pledpriv->SwLed1.BlinkWorkItem);
-}
--- a/drivers/staging/rtl8712/rtl8712_macsetting_bitdef.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_MACSETTING_BITDEF_H__
-#define __RTL8712_MACSETTING_BITDEF_H__
-
-/*MACID*/
-/*BSSID*/
-
-/*HWVID*/
-#define	_HWVID_MSK				0x0F
-
-/*MAR*/
-/*MBIDCANCONTENT*/
-
-/*MBIDCANCFG*/
-#define	_POOLING				BIT(31)
-#define	_WRITE_EN				BIT(16)
-#define	_CAM_ADDR_MSK			0x001F
-#define	_CAM_ADDR_SHT			0
-
-/*BUILDTIME*/
-#define _BUILDTIME_MSK			0x3FFFFFFF
-
-/*BUILDUSER*/
-
-#endif /* __RTL8712_MACSETTING_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_macsetting_regdef.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_MACSETTING_REGDEF_H__
-#define __RTL8712_MACSETTING_REGDEF_H__
-
-#define MACID				(RTL8712_MACIDSETTING_ + 0x0000)
-#define BSSIDR				(RTL8712_MACIDSETTING_ + 0x0008)
-#define HWVID				(RTL8712_MACIDSETTING_ + 0x000E)
-#define MAR				(RTL8712_MACIDSETTING_ + 0x0010)
-#define MBIDCANCONTENT			(RTL8712_MACIDSETTING_ + 0x0018)
-#define MBIDCANCFG			(RTL8712_MACIDSETTING_ + 0x0020)
-#define BUILDTIME			(RTL8712_MACIDSETTING_ + 0x0024)
-#define BUILDUSER			(RTL8712_MACIDSETTING_ + 0x0028)
-
-#endif /*__RTL8712_MACSETTING_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_powersave_bitdef.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_POWERSAVE_BITDEF_H__
-#define __RTL8712_POWERSAVE_BITDEF_H__
-
-/*WOWCTRL*/
-#define	_UWF			BIT(3)
-#define	_MAGIC			BIT(2)
-#define	_WOW_EN			BIT(1)
-#define	_PMEN			BIT(0)
-
-/*PSSTATUS*/
-#define	_PSSTATUS_SEL_MSK		0x0F
-
-/*PSSWITCH*/
-#define	_PSSWITCH_ACT			BIT(7)
-#define	_PSSWITCH_SEL_MSK		0x0F
-#define	_PSSWITCH_SEL_SHT		0
-
-/*LPNAV_CTRL*/
-#define	_LPNAV_EN			BIT(31)
-#define	_LPNAV_EARLY_MSK		0x7FFF0000
-#define	_LPNAV_EARLY_SHT		16
-#define	_LPNAV_TH_MSK			0x0000FFFF
-#define	_LPNAV_TH_SHT			0
-
-/*RPWM*/
-/*CPWM*/
-#define	_TOGGLING			BIT(7)
-#define	_WWLAN				BIT(3)
-#define	_RPS_ST				BIT(2)
-#define	_WLAN_TRX			BIT(1)
-#define	_SYS_CLK			BIT(0)
-
-#endif /* __RTL8712_POWERSAVE_BITDEF_H__*/
--- a/drivers/staging/rtl8712/rtl8712_powersave_regdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_POWERSAVE_REGDEF_H__
-#define __RTL8712_POWERSAVE_REGDEF_H__
-
-#define WOWCTRL				(RTL8712_POWERSAVE_ + 0x00)
-#define PSSTATUS			(RTL8712_POWERSAVE_ + 0x01)
-#define PSSWITCH			(RTL8712_POWERSAVE_ + 0x02)
-#define MIMOPS_WAITPERIOD		(RTL8712_POWERSAVE_ + 0x03)
-#define LPNAV_CTRL			(RTL8712_POWERSAVE_ + 0x04)
-#define WFM0				(RTL8712_POWERSAVE_ + 0x10)
-#define WFM1				(RTL8712_POWERSAVE_ + 0x20)
-#define WFM2				(RTL8712_POWERSAVE_ + 0x30)
-#define WFM3				(RTL8712_POWERSAVE_ + 0x40)
-#define WFM4				(RTL8712_POWERSAVE_ + 0x50)
-#define WFM5				(RTL8712_POWERSAVE_ + 0x60)
-#define WFCRC				(RTL8712_POWERSAVE_ + 0x70)
-#define RPWM				(RTL8712_POWERSAVE_ + 0x7C)
-#define CPWM				(RTL8712_POWERSAVE_ + 0x7D)
-
-#endif /* __RTL8712_POWERSAVE_REGDEF_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_ratectrl_bitdef.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_RATECTRL_BITDEF_H__
-#define __RTL8712_RATECTRL_BITDEF_H__
-
-/*INIRTSMCS_SEL*/
-#define	_INIRTSMCS_SEL_MSK		0x3F
-
-/* RRSR*/
-#define	_RRSR_SHORT			BIT(23)
-#define	_RRSR_RSC_MSK		0x600000
-#define	_RRSR_RSC_SHT		21
-#define	_RRSR_BITMAP_MSK	0x0FFFFF
-#define	_RRSR_BITMAP_SHT	0
-
-/* AGGLEN_LMT_H*/
-#define	_AGGLMT_MCS32_MSK			0xF0
-#define	_AGGLMT_MCS32_SHT			4
-#define	_AGGLMT_MCS15_SGI_MSK		0x0F
-#define	_AGGLMT_MCS15_SGI_SHT		0
-
-/* DARFRC*/
-/* RARFRC*/
-/* MCS_TXAGC*/
-/* CCK_TXAGC*/
-#define	_CCK_MSK			0xFF00
-#define	_CCK_SHT			8
-#define	_BARKER_MSK			0x00FF
-#define	_BARKER_SHT			0
-
-#endif	/*	__RTL8712_RATECTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_ratectrl_regdef.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_RATECTRL_REGDEF_H__
-#define __RTL8712_RATECTRL_REGDEF_H__
-
-#define INIMCS_SEL			(RTL8712_RATECTRL_ + 0x00)
-#define INIRTSMCS_SEL		(RTL8712_RATECTRL_ + 0x20)
-#define RRSR				(RTL8712_RATECTRL_ + 0x21)
-#define ARFR0				(RTL8712_RATECTRL_ + 0x24)
-#define ARFR1				(RTL8712_RATECTRL_ + 0x28)
-#define ARFR2				(RTL8712_RATECTRL_ + 0x2C)
-#define ARFR3				(RTL8712_RATECTRL_ + 0x30)
-#define ARFR4				(RTL8712_RATECTRL_ + 0x34)
-#define ARFR5				(RTL8712_RATECTRL_ + 0x38)
-#define ARFR6				(RTL8712_RATECTRL_ + 0x3C)
-#define ARFR7				(RTL8712_RATECTRL_ + 0x40)
-#define AGGLEN_LMT_H		(RTL8712_RATECTRL_ + 0x47)
-#define AGGLEN_LMT_L		(RTL8712_RATECTRL_ + 0x48)
-#define DARFRC				(RTL8712_RATECTRL_ + 0x50)
-#define RARFRC				(RTL8712_RATECTRL_ + 0x58)
-#define MCS_TXAGC0			(RTL8712_RATECTRL_ + 0x60)
-#define MCS_TXAGC1			(RTL8712_RATECTRL_ + 0x61)
-#define MCS_TXAGC2			(RTL8712_RATECTRL_ + 0x62)
-#define MCS_TXAGC3			(RTL8712_RATECTRL_ + 0x63)
-#define MCS_TXAGC4			(RTL8712_RATECTRL_ + 0x64)
-#define MCS_TXAGC5			(RTL8712_RATECTRL_ + 0x65)
-#define MCS_TXAGC6			(RTL8712_RATECTRL_ + 0x66)
-#define MCS_TXAGC7			(RTL8712_RATECTRL_ + 0x67)
-#define CCK_TXAGC			(RTL8712_RATECTRL_ + 0x68)
-
-#endif	/*__RTL8712_RATECTRL_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ /dev/null
@@ -1,1080 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_recv.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_RECV_C_
-
-#include <linux/if_ether.h>
-#include <linux/ip.h>
-#include <net/cfg80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "ethernet.h"
-#include "usb_ops.h"
-#include "wifi.h"
-
-static void recv_tasklet(struct tasklet_struct *t);
-
-int r8712_init_recv_priv(struct recv_priv *precvpriv,
-			 struct _adapter *padapter)
-{
-	int i;
-	struct recv_buf *precvbuf;
-	addr_t tmpaddr = 0;
-	int alignment = 0;
-	struct sk_buff *pskb = NULL;
-
-	/*init recv_buf*/
-	_init_queue(&precvpriv->free_recv_buf_queue);
-	precvpriv->pallocated_recv_buf =
-		kzalloc(NR_RECVBUFF * sizeof(struct recv_buf) + 4, GFP_ATOMIC);
-	if (!precvpriv->pallocated_recv_buf)
-		return -ENOMEM;
-	precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 -
-			      ((addr_t)(precvpriv->pallocated_recv_buf) & 3);
-	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
-	for (i = 0; i < NR_RECVBUFF; i++) {
-		INIT_LIST_HEAD(&precvbuf->list);
-		spin_lock_init(&precvbuf->recvbuf_lock);
-		if (r8712_os_recvbuf_resource_alloc(padapter, precvbuf))
-			break;
-		precvbuf->ref_cnt = 0;
-		precvbuf->adapter = padapter;
-		list_add_tail(&precvbuf->list,
-			      &precvpriv->free_recv_buf_queue.queue);
-		precvbuf++;
-	}
-	precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
-	tasklet_setup(&precvpriv->recv_tasklet, recv_tasklet);
-	skb_queue_head_init(&precvpriv->rx_skb_queue);
-
-	skb_queue_head_init(&precvpriv->free_recv_skb_queue);
-	for (i = 0; i < NR_PREALLOC_RECV_SKB; i++) {
-		pskb = netdev_alloc_skb(padapter->pnetdev, MAX_RECVBUF_SZ +
-		       RECVBUFF_ALIGN_SZ);
-		if (pskb) {
-			tmpaddr = (addr_t)pskb->data;
-			alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1);
-			skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment));
-			skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
-		}
-		pskb = NULL;
-	}
-	return 0;
-}
-
-void r8712_free_recv_priv(struct recv_priv *precvpriv)
-{
-	int i;
-	struct recv_buf *precvbuf;
-	struct _adapter *padapter = precvpriv->adapter;
-
-	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
-	for (i = 0; i < NR_RECVBUFF; i++) {
-		r8712_os_recvbuf_resource_free(padapter, precvbuf);
-		precvbuf++;
-	}
-	kfree(precvpriv->pallocated_recv_buf);
-	skb_queue_purge(&precvpriv->rx_skb_queue);
-	if (skb_queue_len(&precvpriv->rx_skb_queue))
-		netdev_warn(padapter->pnetdev, "r8712u: rx_skb_queue not empty\n");
-	skb_queue_purge(&precvpriv->free_recv_skb_queue);
-	if (skb_queue_len(&precvpriv->free_recv_skb_queue))
-		netdev_warn(padapter->pnetdev, "r8712u: free_recv_skb_queue not empty %d\n",
-			    skb_queue_len(&precvpriv->free_recv_skb_queue));
-}
-
-void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf)
-{
-	precvbuf->transfer_len = 0;
-	precvbuf->len = 0;
-	precvbuf->ref_cnt = 0;
-	if (precvbuf->pbuf) {
-		precvbuf->pdata = precvbuf->pbuf;
-		precvbuf->phead = precvbuf->pbuf;
-		precvbuf->ptail = precvbuf->pbuf;
-		precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ;
-	}
-}
-
-void r8712_free_recvframe(union recv_frame *precvframe,
-			  struct  __queue *pfree_recv_queue)
-{
-	unsigned long irqL;
-	struct _adapter *padapter = precvframe->u.hdr.adapter;
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-
-	if (precvframe->u.hdr.pkt) {
-		dev_kfree_skb_any(precvframe->u.hdr.pkt);/*free skb by driver*/
-		precvframe->u.hdr.pkt = NULL;
-	}
-	spin_lock_irqsave(&pfree_recv_queue->lock, irqL);
-	list_del_init(&precvframe->u.hdr.list);
-	list_add_tail(&precvframe->u.hdr.list, &pfree_recv_queue->queue);
-	if (padapter) {
-		if (pfree_recv_queue == &precvpriv->free_recv_queue)
-			precvpriv->free_recvframe_cnt++;
-	}
-	spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL);
-}
-
-static void update_recvframe_attrib_from_recvstat(struct rx_pkt_attrib *pattrib,
-						  struct recv_stat *prxstat)
-{
-	u16 drvinfo_sz;
-
-	drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
-	drvinfo_sz <<= 3;
-	/*TODO:
-	 * Offset 0
-	 */
-	pattrib->bdecrypted = (le32_to_cpu(prxstat->rxdw0) & BIT(27)) == 0;
-	pattrib->crc_err = (le32_to_cpu(prxstat->rxdw0) & BIT(14)) != 0;
-	/*Offset 4*/
-	/*Offset 8*/
-	/*Offset 12*/
-	if (le32_to_cpu(prxstat->rxdw3) & BIT(13)) {
-		pattrib->tcpchk_valid = 1; /* valid */
-		if (le32_to_cpu(prxstat->rxdw3) & BIT(11))
-			pattrib->tcp_chkrpt = 1; /* correct */
-		else
-			pattrib->tcp_chkrpt = 0; /* incorrect */
-		if (le32_to_cpu(prxstat->rxdw3) & BIT(12))
-			pattrib->ip_chkrpt = 1; /* correct */
-		else
-			pattrib->ip_chkrpt = 0; /* incorrect */
-	} else {
-		pattrib->tcpchk_valid = 0; /* invalid */
-	}
-	pattrib->mcs_rate = (u8)((le32_to_cpu(prxstat->rxdw3)) & 0x3f);
-	pattrib->htc = (u8)((le32_to_cpu(prxstat->rxdw3) >> 14) & 0x1);
-	/*Offset 16*/
-	/*Offset 20*/
-	/*phy_info*/
-}
-
-/*perform defrag*/
-static union recv_frame *recvframe_defrag(struct _adapter *adapter,
-					  struct  __queue *defrag_q)
-{
-	struct list_head *plist, *phead;
-	u8 wlanhdr_offset;
-	u8	curfragnum;
-	struct recv_frame_hdr *pfhdr, *pnfhdr;
-	union recv_frame *prframe, *pnextrframe;
-	struct  __queue	*pfree_recv_queue;
-
-	pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
-	phead = &defrag_q->queue;
-	plist = phead->next;
-	prframe = container_of(plist, union recv_frame, u.list);
-	list_del_init(&prframe->u.list);
-	pfhdr = &prframe->u.hdr;
-	curfragnum = 0;
-	if (curfragnum != pfhdr->attrib.frag_num) {
-		/*the first fragment number must be 0
-		 *free the whole queue
-		 */
-		r8712_free_recvframe(prframe, pfree_recv_queue);
-		r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
-		return NULL;
-	}
-	curfragnum++;
-	plist = &defrag_q->queue;
-	plist = plist->next;
-	while (!end_of_queue_search(phead, plist)) {
-		pnextrframe = container_of(plist, union recv_frame, u.list);
-		pnfhdr = &pnextrframe->u.hdr;
-		/*check the fragment sequence  (2nd ~n fragment frame) */
-		if (curfragnum != pnfhdr->attrib.frag_num) {
-			/* the fragment number must increase  (after decache)
-			 * release the defrag_q & prframe
-			 */
-			r8712_free_recvframe(prframe, pfree_recv_queue);
-			r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
-			return NULL;
-		}
-		curfragnum++;
-		/* copy the 2nd~n fragment frame's payload to the first fragment
-		 * get the 2nd~last fragment frame's payload
-		 */
-		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
-		recvframe_pull(pnextrframe, wlanhdr_offset);
-		/* append  to first fragment frame's tail (if privacy frame,
-		 * pull the ICV)
-		 */
-		recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
-		memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
-		recvframe_put(prframe, pnfhdr->len);
-		pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
-		plist = plist->next;
-	}
-	/* free the defrag_q queue and return the prframe */
-	r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
-	return prframe;
-}
-
-/* check if need to defrag, if needed queue the frame to defrag_q */
-union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *padapter,
-					     union recv_frame *precv_frame)
-{
-	u8	ismfrag;
-	u8	fragnum;
-	u8   *psta_addr;
-	struct recv_frame_hdr *pfhdr;
-	struct sta_info *psta;
-	struct	sta_priv *pstapriv;
-	struct list_head *phead;
-	union recv_frame *prtnframe = NULL;
-	struct  __queue *pfree_recv_queue, *pdefrag_q;
-
-	pstapriv = &padapter->stapriv;
-	pfhdr = &precv_frame->u.hdr;
-	pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
-	/* need to define struct of wlan header frame ctrl */
-	ismfrag = pfhdr->attrib.mfrag;
-	fragnum = pfhdr->attrib.frag_num;
-	psta_addr = pfhdr->attrib.ta;
-	psta = r8712_get_stainfo(pstapriv, psta_addr);
-	if (!psta)
-		pdefrag_q = NULL;
-	else
-		pdefrag_q = &psta->sta_recvpriv.defrag_q;
-
-	if ((ismfrag == 0) && (fragnum == 0))
-		prtnframe = precv_frame;/*isn't a fragment frame*/
-	if (ismfrag == 1) {
-		/* 0~(n-1) fragment frame
-		 * enqueue to defraf_g
-		 */
-		if (pdefrag_q) {
-			if (fragnum == 0) {
-				/*the first fragment*/
-				if (!list_empty(&pdefrag_q->queue)) {
-					/*free current defrag_q */
-					r8712_free_recvframe_queue(pdefrag_q,
-							     pfree_recv_queue);
-				}
-			}
-			/* Then enqueue the 0~(n-1) fragment to the defrag_q */
-			phead = &pdefrag_q->queue;
-			list_add_tail(&pfhdr->list, phead);
-			prtnframe = NULL;
-		} else {
-			/* can't find this ta's defrag_queue, so free this
-			 * recv_frame
-			 */
-			r8712_free_recvframe(precv_frame, pfree_recv_queue);
-			prtnframe = NULL;
-		}
-	}
-	if ((ismfrag == 0) && (fragnum != 0)) {
-		/* the last fragment frame
-		 * enqueue the last fragment
-		 */
-		if (pdefrag_q) {
-			phead = &pdefrag_q->queue;
-			list_add_tail(&pfhdr->list, phead);
-			/*call recvframe_defrag to defrag*/
-			precv_frame = recvframe_defrag(padapter, pdefrag_q);
-			prtnframe = precv_frame;
-		} else {
-			/* can't find this ta's defrag_queue, so free this
-			 *  recv_frame
-			 */
-			r8712_free_recvframe(precv_frame, pfree_recv_queue);
-			prtnframe = NULL;
-		}
-	}
-	if (prtnframe && (prtnframe->u.hdr.attrib.privacy)) {
-		/* after defrag we must check tkip mic code */
-		if (r8712_recvframe_chkmic(padapter, prtnframe) == _FAIL) {
-			r8712_free_recvframe(prtnframe, pfree_recv_queue);
-			prtnframe = NULL;
-		}
-	}
-	return prtnframe;
-}
-
-static void amsdu_to_msdu(struct _adapter *padapter, union recv_frame *prframe)
-{
-	int	a_len, padding_len;
-	u16	eth_type, nSubframe_Length;
-	u8	nr_subframes, i;
-	unsigned char *pdata;
-	struct rx_pkt_attrib *pattrib;
-	_pkt *sub_skb, *subframes[MAX_SUBFRAME_COUNT];
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-	struct  __queue *pfree_recv_queue = &precvpriv->free_recv_queue;
-
-	nr_subframes = 0;
-	pattrib = &prframe->u.hdr.attrib;
-	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
-	if (prframe->u.hdr.attrib.iv_len > 0)
-		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
-	a_len = prframe->u.hdr.len;
-	pdata = prframe->u.hdr.rx_data;
-	while (a_len > ETH_HLEN) {
-		/* Offset 12 denote 2 mac address */
-		nSubframe_Length = *((u16 *)(pdata + 12));
-		/*==m==>change the length order*/
-		nSubframe_Length = (nSubframe_Length >> 8) +
-				   (nSubframe_Length << 8);
-		if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
-			netdev_warn(padapter->pnetdev, "r8712u: nRemain_Length is %d and nSubframe_Length is: %d\n",
-				    a_len, nSubframe_Length);
-			goto exit;
-		}
-		/* move the data point to data content */
-		pdata += ETH_HLEN;
-		a_len -= ETH_HLEN;
-		/* Allocate new skb for releasing to upper layer */
-		sub_skb = dev_alloc_skb(nSubframe_Length + 12);
-		if (!sub_skb)
-			break;
-		skb_reserve(sub_skb, 12);
-		skb_put_data(sub_skb, pdata, nSubframe_Length);
-		subframes[nr_subframes++] = sub_skb;
-		if (nr_subframes >= MAX_SUBFRAME_COUNT) {
-			netdev_warn(padapter->pnetdev, "r8712u: ParseSubframe(): Too many Subframes! Packets dropped!\n");
-			break;
-		}
-		pdata += nSubframe_Length;
-		a_len -= nSubframe_Length;
-		if (a_len != 0) {
-			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & 3);
-			if (padding_len == 4)
-				padding_len = 0;
-			if (a_len < padding_len)
-				goto exit;
-			pdata += padding_len;
-			a_len -= padding_len;
-		}
-	}
-	for (i = 0; i < nr_subframes; i++) {
-		sub_skb = subframes[i];
-		/* convert hdr + possible LLC headers into Ethernet header */
-		eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7];
-		if (sub_skb->len >= 8 &&
-		    ((!memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) &&
-		      eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
-		     !memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE))) {
-			/* remove RFC1042 or Bridge-Tunnel encapsulation and
-			 * replace EtherType
-			 */
-			skb_pull(sub_skb, SNAP_SIZE);
-			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
-			       ETH_ALEN);
-			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
-			       ETH_ALEN);
-		} else {
-			__be16 len;
-			/* Leave Ethernet header part of hdr and full payload */
-			len = htons(sub_skb->len);
-			memcpy(skb_push(sub_skb, 2), &len, 2);
-			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
-			       ETH_ALEN);
-			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
-			       ETH_ALEN);
-		}
-		/* Indicate the packets to upper layer */
-		if (sub_skb) {
-			sub_skb->protocol =
-				 eth_type_trans(sub_skb, padapter->pnetdev);
-			sub_skb->dev = padapter->pnetdev;
-			if ((pattrib->tcpchk_valid == 1) &&
-			    (pattrib->tcp_chkrpt == 1)) {
-				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
-			} else {
-				sub_skb->ip_summed = CHECKSUM_NONE;
-			}
-			netif_rx(sub_skb);
-		}
-	}
-exit:
-	prframe->u.hdr.len = 0;
-	r8712_free_recvframe(prframe, pfree_recv_queue);
-}
-
-void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf)
-{
-	__le32 voffset;
-	u8 *poffset;
-	u16 cmd_len, drvinfo_sz;
-	struct recv_stat *prxstat;
-
-	poffset = prxcmdbuf;
-	voffset = *(__le32 *)poffset;
-	prxstat = prxcmdbuf;
-	drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
-	drvinfo_sz <<= 3;
-	poffset += RXDESC_SIZE + drvinfo_sz;
-	do {
-		voffset  = *(__le32 *)poffset;
-		cmd_len = (u16)(le32_to_cpu(voffset) & 0xffff);
-		r8712_event_handle(padapter, (__le32 *)poffset);
-		poffset += (cmd_len + 8);/*8 bytes alignment*/
-	} while (le32_to_cpu(voffset) & BIT(31));
-}
-
-static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl,
-			      u16 seq_num)
-{
-	u8 wsize = preorder_ctrl->wsize_b;
-	u16 wend = (preorder_ctrl->indicate_seq + wsize - 1) % 4096;
-
-	/* Rx Reorder initialize condition.*/
-	if (preorder_ctrl->indicate_seq == 0xffff)
-		preorder_ctrl->indicate_seq = seq_num;
-	/* Drop out the packet which SeqNum is smaller than WinStart */
-	if (SN_LESS(seq_num, preorder_ctrl->indicate_seq))
-		return false;
-	/*
-	 * Sliding window manipulation. Conditions includes:
-	 * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
-	 * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
-	 */
-	if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq))
-		preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq +
-					      1) % 4096;
-	else if (SN_LESS(wend, seq_num)) {
-		if (seq_num >= (wsize - 1))
-			preorder_ctrl->indicate_seq = seq_num + 1 - wsize;
-		else
-			preorder_ctrl->indicate_seq = 4095 - (wsize -
-						      (seq_num + 1)) + 1;
-	}
-	return true;
-}
-
-static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl,
-				     union recv_frame *prframe)
-{
-	struct list_head *phead, *plist;
-	union recv_frame *pnextrframe;
-	struct rx_pkt_attrib *pnextattrib;
-	struct  __queue *ppending_recvframe_queue =
-					&preorder_ctrl->pending_recvframe_queue;
-	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
-
-	phead = &ppending_recvframe_queue->queue;
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist)) {
-		pnextrframe = container_of(plist, union recv_frame, u.list);
-		pnextattrib = &pnextrframe->u.hdr.attrib;
-
-		if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
-			return false;
-
-		if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
-			plist = plist->next;
-		else
-			break;
-	}
-	list_del_init(&prframe->u.hdr.list);
-	list_add_tail(&prframe->u.hdr.list, plist);
-	return true;
-}
-
-int r8712_recv_indicatepkts_in_order(struct _adapter *padapter,
-				     struct recv_reorder_ctrl *preorder_ctrl,
-				     int bforced)
-{
-	struct list_head *phead, *plist;
-	union recv_frame *prframe;
-	struct rx_pkt_attrib *pattrib;
-	int bPktInBuf = false;
-	struct  __queue *ppending_recvframe_queue =
-			 &preorder_ctrl->pending_recvframe_queue;
-
-	phead = &ppending_recvframe_queue->queue;
-	plist = phead->next;
-	/* Handling some condition for forced indicate case.*/
-	if (bforced) {
-		if (list_empty(phead))
-			return true;
-
-		prframe = container_of(plist, union recv_frame, u.list);
-		pattrib = &prframe->u.hdr.attrib;
-		preorder_ctrl->indicate_seq = pattrib->seq_num;
-	}
-	/* Prepare indication list and indication.
-	 * Check if there is any packet need indicate.
-	 */
-	while (!list_empty(phead)) {
-		prframe = container_of(plist, union recv_frame, u.list);
-		pattrib = &prframe->u.hdr.attrib;
-		if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) {
-			plist = plist->next;
-			list_del_init(&prframe->u.hdr.list);
-			if (SN_EQUAL(preorder_ctrl->indicate_seq,
-				     pattrib->seq_num))
-				preorder_ctrl->indicate_seq =
-				  (preorder_ctrl->indicate_seq + 1) % 4096;
-			/*indicate this recv_frame*/
-			if (!pattrib->amsdu) {
-				if (!padapter->driver_stopped &&
-				    !padapter->surprise_removed) {
-					/* indicate this recv_frame */
-					r8712_recv_indicatepkt(padapter,
-							       prframe);
-				}
-			} else if (pattrib->amsdu == 1) {
-				amsdu_to_msdu(padapter, prframe);
-			}
-			/* Update local variables. */
-			bPktInBuf = false;
-		} else {
-			bPktInBuf = true;
-			break;
-		}
-	}
-	return bPktInBuf;
-}
-
-static int recv_indicatepkt_reorder(struct _adapter *padapter,
-				    union recv_frame *prframe)
-{
-	unsigned long irql;
-	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
-	struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl;
-	struct  __queue *ppending_recvframe_queue =
-			 &preorder_ctrl->pending_recvframe_queue;
-
-	if (!pattrib->amsdu) {
-		/* s1. */
-		r8712_wlanhdr_to_ethhdr(prframe);
-		if (pattrib->qos != 1) {
-			if (!padapter->driver_stopped &&
-			    !padapter->surprise_removed) {
-				r8712_recv_indicatepkt(padapter, prframe);
-				return 0;
-			} else {
-				return -EINVAL;
-			}
-		}
-	}
-	spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
-	/*s2. check if winstart_b(indicate_seq) needs to be updated*/
-	if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num))
-		goto _err_exit;
-	/*s3. Insert all packet into Reorder Queue to maintain its ordering.*/
-	if (!enqueue_reorder_recvframe(preorder_ctrl, prframe))
-		goto _err_exit;
-	/*s4.
-	 * Indication process.
-	 * After Packet dropping and Sliding Window shifting as above, we can
-	 * now just indicate the packets with the SeqNum smaller than latest
-	 * WinStart and buffer other packets.
-	 *
-	 * For Rx Reorder condition:
-	 * 1. All packets with SeqNum smaller than WinStart => Indicate
-	 * 2. All packets with SeqNum larger than or equal to
-	 * WinStart => Buffer it.
-	 */
-	if (r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, false)) {
-		mod_timer(&preorder_ctrl->reordering_ctrl_timer,
-			  jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
-		spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
-	} else {
-		spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
-		del_timer(&preorder_ctrl->reordering_ctrl_timer);
-	}
-	return 0;
-_err_exit:
-	spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
-	return -ENOMEM;
-}
-
-void r8712_reordering_ctrl_timeout_handler(void *pcontext)
-{
-	unsigned long irql;
-	struct recv_reorder_ctrl *preorder_ctrl = pcontext;
-	struct _adapter *padapter = preorder_ctrl->padapter;
-	struct  __queue *ppending_recvframe_queue =
-				 &preorder_ctrl->pending_recvframe_queue;
-
-	if (padapter->driver_stopped || padapter->surprise_removed)
-		return;
-	spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
-	r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, true);
-	spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
-}
-
-static int r8712_process_recv_indicatepkts(struct _adapter *padapter,
-					   union recv_frame *prframe)
-{
-	int retval = _SUCCESS;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct ht_priv	*phtpriv = &pmlmepriv->htpriv;
-
-	if (phtpriv->ht_option == 1) { /*B/G/N Mode*/
-		if (recv_indicatepkt_reorder(padapter, prframe)) {
-			/* including perform A-MPDU Rx Ordering Buffer Control*/
-			if (!padapter->driver_stopped &&
-			    !padapter->surprise_removed)
-				return _FAIL;
-		}
-	} else { /*B/G mode*/
-		retval = r8712_wlanhdr_to_ethhdr(prframe);
-		if (retval)
-			return _FAIL;
-		if (!padapter->driver_stopped && !padapter->surprise_removed) {
-			/* indicate this recv_frame */
-			r8712_recv_indicatepkt(padapter, prframe);
-		} else {
-			return _FAIL;
-		}
-	}
-	return retval;
-}
-
-static u8 query_rx_pwr_percentage(s8 antpower)
-{
-	if ((antpower <= -100) || (antpower >= 20))
-		return	0;
-	else if (antpower >= 0)
-		return	100;
-	else
-		return 100 + antpower;
-}
-
-static u8 evm_db2percentage(s8 value)
-{
-	/*
-	 * -33dB~0dB to 0%~99%
-	 */
-	s8 ret_val = clamp(-value, 0, 33) * 3;
-
-	if (ret_val == 99)
-		ret_val = 100;
-
-	return ret_val;
-}
-
-s32 r8712_signal_scale_mapping(s32 cur_sig)
-{
-	s32 ret_sig;
-
-	if (cur_sig >= 51 && cur_sig <= 100)
-		ret_sig = 100;
-	else if (cur_sig >= 41 && cur_sig <= 50)
-		ret_sig = 80 + ((cur_sig - 40) * 2);
-	else if (cur_sig >= 31 && cur_sig <= 40)
-		ret_sig = 66 + (cur_sig - 30);
-	else if (cur_sig >= 21 && cur_sig <= 30)
-		ret_sig = 54 + (cur_sig - 20);
-	else if (cur_sig >= 10 && cur_sig <= 20)
-		ret_sig = 42 + (((cur_sig - 10) * 2) / 3);
-	else if (cur_sig >= 5 && cur_sig <= 9)
-		ret_sig = 22 + (((cur_sig - 5) * 3) / 2);
-	else if (cur_sig >= 1 && cur_sig <= 4)
-		ret_sig = 6 + (((cur_sig - 1) * 3) / 2);
-	else
-		ret_sig = cur_sig;
-	return ret_sig;
-}
-
-static s32  translate2dbm(struct _adapter *padapter, u8 signal_strength_idx)
-{
-	s32 signal_power; /* in dBm.*/
-	/* Translate to dBm (x=0.5y-95).*/
-	signal_power = (s32)((signal_strength_idx + 1) >> 1);
-	signal_power -= 95;
-	return signal_power;
-}
-
-static void query_rx_phy_status(struct _adapter *padapter,
-				union recv_frame *prframe)
-{
-	u8 i, max_spatial_stream, evm;
-	struct recv_stat *prxstat = (struct recv_stat *)prframe->u.hdr.rx_head;
-	struct phy_stat *pphy_stat = (struct phy_stat *)(prxstat + 1);
-	u8 *pphy_head = (u8 *)(prxstat + 1);
-	s8 rx_pwr[4], rx_pwr_all;
-	u8 pwdb_all;
-	u32 rssi, total_rssi = 0;
-	u8 bcck_rate = 0, rf_rx_num = 0, cck_highpwr = 0;
-	struct phy_cck_rx_status *pcck_buf;
-	u8 sq;
-
-	/* Record it for next packet processing*/
-	bcck_rate = (prframe->u.hdr.attrib.mcs_rate <= 3 ? 1 : 0);
-	if (bcck_rate) {
-		u8 report;
-
-		/* CCK Driver info Structure is not the same as OFDM packet.*/
-		pcck_buf = (struct phy_cck_rx_status *)pphy_stat;
-		/* (1)Hardware does not provide RSSI for CCK
-		 * (2)PWDB, Average PWDB calculated by hardware
-		 * (for rate adaptive)
-		 */
-		if (!cck_highpwr) {
-			report = pcck_buf->cck_agc_rpt & 0xc0;
-			report >>= 6;
-			switch (report) {
-			/* Modify the RF RNA gain value to -40, -20,
-			 * -2, 14 by Jenyu's suggestion
-			 * Note: different RF with the different
-			 * RNA gain.
-			 */
-			case 0x3:
-				rx_pwr_all = -40 - (pcck_buf->cck_agc_rpt &
-					     0x3e);
-				break;
-			case 0x2:
-				rx_pwr_all = -20 - (pcck_buf->cck_agc_rpt &
-					     0x3e);
-				break;
-			case 0x1:
-				rx_pwr_all = -2 - (pcck_buf->cck_agc_rpt &
-					     0x3e);
-				break;
-			case 0x0:
-				rx_pwr_all = 14 - (pcck_buf->cck_agc_rpt &
-					     0x3e);
-				break;
-			}
-		} else {
-			report = ((u8)(le32_to_cpu(pphy_stat->phydw1) >> 8)) &
-				 0x60;
-			report >>= 5;
-			switch (report) {
-			case 0x3:
-				rx_pwr_all = -40 - ((pcck_buf->cck_agc_rpt &
-					     0x1f) << 1);
-				break;
-			case 0x2:
-				rx_pwr_all = -20 - ((pcck_buf->cck_agc_rpt &
-					     0x1f) << 1);
-				break;
-			case 0x1:
-				rx_pwr_all = -2 - ((pcck_buf->cck_agc_rpt &
-					     0x1f) << 1);
-				break;
-			case 0x0:
-				rx_pwr_all = 14 - ((pcck_buf->cck_agc_rpt &
-					     0x1f) << 1);
-				break;
-			}
-		}
-		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
-		/* CCK gain is smaller than OFDM/MCS gain,*/
-		/* so we add gain diff by experiences, the val is 6 */
-		pwdb_all += 6;
-		if (pwdb_all > 100)
-			pwdb_all = 100;
-		/* modify the offset to make the same gain index with OFDM.*/
-		if (pwdb_all > 34 && pwdb_all <= 42)
-			pwdb_all -= 2;
-		else if (pwdb_all > 26 && pwdb_all <= 34)
-			pwdb_all -= 6;
-		else if (pwdb_all > 14 && pwdb_all <= 26)
-			pwdb_all -= 8;
-		else if (pwdb_all > 4 && pwdb_all <= 14)
-			pwdb_all -= 4;
-		/*
-		 * (3) Get Signal Quality (EVM)
-		 */
-		if (pwdb_all > 40) {
-			sq = 100;
-		} else {
-			sq = pcck_buf->sq_rpt;
-			if (pcck_buf->sq_rpt > 64)
-				sq = 0;
-			else if (pcck_buf->sq_rpt < 20)
-				sq = 100;
-			else
-				sq = ((64 - sq) * 100) / 44;
-		}
-		prframe->u.hdr.attrib.signal_qual = sq;
-		prframe->u.hdr.attrib.rx_mimo_signal_qual[0] = sq;
-		prframe->u.hdr.attrib.rx_mimo_signal_qual[1] = -1;
-	} else {
-		/* (1)Get RSSI for HT rate */
-		for (i = 0; i < ((padapter->registrypriv.rf_config) &
-			    0x0f); i++) {
-			rf_rx_num++;
-			rx_pwr[i] = ((pphy_head[PHY_STAT_GAIN_TRSW_SHT + i]
-				    & 0x3F) * 2) - 110;
-			/* Translate DBM to percentage. */
-			rssi = query_rx_pwr_percentage(rx_pwr[i]);
-			total_rssi += rssi;
-		}
-		/* (2)PWDB, Average PWDB calculated by hardware (for
-		 * rate adaptive)
-		 */
-		rx_pwr_all = (((pphy_head[PHY_STAT_PWDB_ALL_SHT]) >> 1) & 0x7f)
-			     - 106;
-		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
-
-		{
-			/* (3)EVM of HT rate */
-			if (prframe->u.hdr.attrib.htc &&
-			    prframe->u.hdr.attrib.mcs_rate >= 20 &&
-			    prframe->u.hdr.attrib.mcs_rate <= 27) {
-				/* both spatial stream make sense */
-				max_spatial_stream = 2;
-			} else {
-				/* only spatial stream 1 makes sense */
-				max_spatial_stream = 1;
-			}
-			for (i = 0; i < max_spatial_stream; i++) {
-				evm = evm_db2percentage((pphy_head
-				      [PHY_STAT_RXEVM_SHT + i]));/*dbm*/
-				prframe->u.hdr.attrib.signal_qual =
-					 (u8)(evm & 0xff);
-				prframe->u.hdr.attrib.rx_mimo_signal_qual[i] =
-					 (u8)(evm & 0xff);
-			}
-		}
-	}
-	/* UI BSS List signal strength(in percentage), make it good looking,
-	 * from 0~100. It is assigned to the BSS List in
-	 * GetValueFromBeaconOrProbeRsp().
-	 */
-	if (bcck_rate) {
-		prframe->u.hdr.attrib.signal_strength =
-			 (u8)r8712_signal_scale_mapping(pwdb_all);
-	} else {
-		if (rf_rx_num != 0)
-			prframe->u.hdr.attrib.signal_strength =
-				 (u8)(r8712_signal_scale_mapping(total_rssi /=
-				 rf_rx_num));
-	}
-}
-
-static void process_link_qual(struct _adapter *padapter,
-			      union recv_frame *prframe)
-{
-	u32	last_evm = 0, tmpVal;
-	struct rx_pkt_attrib *pattrib;
-	struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data;
-
-	if (!prframe || !padapter)
-		return;
-	pattrib = &prframe->u.hdr.attrib;
-	if (pattrib->signal_qual != 0) {
-		/*
-		 * 1. Record the general EVM to the sliding window.
-		 */
-		if (sqd->total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX) {
-			sqd->total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
-			last_evm = sqd->elements[sqd->index];
-			sqd->total_val -= last_evm;
-		}
-		sqd->total_val += pattrib->signal_qual;
-		sqd->elements[sqd->index++] = pattrib->signal_qual;
-		if (sqd->index >= PHY_LINKQUALITY_SLID_WIN_MAX)
-			sqd->index = 0;
-
-		/* <1> Showed on UI for user, in percentage. */
-		tmpVal = sqd->total_val / sqd->total_num;
-		padapter->recvpriv.signal = (u8)tmpVal;
-	}
-}
-
-static void process_rssi(struct _adapter *padapter, union recv_frame *prframe)
-{
-	u32 last_rssi, tmp_val;
-	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
-	struct smooth_rssi_data *ssd = &padapter->recvpriv.signal_strength_data;
-
-	if (ssd->total_num++ >= PHY_RSSI_SLID_WIN_MAX) {
-		ssd->total_num = PHY_RSSI_SLID_WIN_MAX;
-		last_rssi = ssd->elements[ssd->index];
-		ssd->total_val -= last_rssi;
-	}
-	ssd->total_val += pattrib->signal_strength;
-	ssd->elements[ssd->index++] = pattrib->signal_strength;
-	if (ssd->index >= PHY_RSSI_SLID_WIN_MAX)
-		ssd->index = 0;
-	tmp_val = ssd->total_val / ssd->total_num;
-	padapter->recvpriv.rssi = (s8)translate2dbm(padapter, (u8)tmp_val);
-}
-
-static void process_phy_info(struct _adapter *padapter,
-			     union recv_frame *prframe)
-{
-	query_rx_phy_status(padapter, prframe);
-	process_rssi(padapter, prframe);
-	process_link_qual(padapter,  prframe);
-}
-
-int recv_func(struct _adapter *padapter, void *pcontext)
-{
-	struct rx_pkt_attrib *pattrib;
-	union recv_frame *prframe, *orig_prframe;
-	int retval = _SUCCESS;
-	struct  __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
-	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-
-	prframe = pcontext;
-	orig_prframe = prframe;
-	pattrib = &prframe->u.hdr.attrib;
-	if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		if (pattrib->crc_err == 1)
-			padapter->mppriv.rx_crcerrpktcount++;
-		else
-			padapter->mppriv.rx_pktcount++;
-		if (!check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE)) {
-			/* free this recv_frame */
-			r8712_free_recvframe(orig_prframe, pfree_recv_queue);
-			goto _exit_recv_func;
-		}
-	}
-	/* check the frame crtl field and decache */
-	retval = r8712_validate_recv_frame(padapter, prframe);
-	if (retval != _SUCCESS) {
-		/* free this recv_frame */
-		r8712_free_recvframe(orig_prframe, pfree_recv_queue);
-		goto _exit_recv_func;
-	}
-	process_phy_info(padapter, prframe);
-	prframe = r8712_decryptor(padapter, prframe);
-	if (!prframe) {
-		retval = _FAIL;
-		goto _exit_recv_func;
-	}
-	prframe = r8712_recvframe_chk_defrag(padapter, prframe);
-	if (!prframe)
-		goto _exit_recv_func;
-	prframe = r8712_portctrl(padapter, prframe);
-	if (!prframe) {
-		retval = _FAIL;
-		goto _exit_recv_func;
-	}
-	retval = r8712_process_recv_indicatepkts(padapter, prframe);
-	if (retval != _SUCCESS) {
-		r8712_free_recvframe(orig_prframe, pfree_recv_queue);
-		goto _exit_recv_func;
-	}
-_exit_recv_func:
-	return retval;
-}
-
-static void recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
-{
-	u8 *pbuf, shift_sz = 0;
-	u8	frag, mf;
-	uint	pkt_len;
-	u32 transfer_len;
-	struct recv_stat *prxstat;
-	u16	pkt_cnt, drvinfo_sz, pkt_offset, tmp_len, alloc_sz;
-	struct  __queue *pfree_recv_queue;
-	_pkt  *pkt_copy = NULL;
-	union recv_frame *precvframe = NULL;
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-
-	pfree_recv_queue = &precvpriv->free_recv_queue;
-	pbuf = pskb->data;
-	prxstat = (struct recv_stat *)pbuf;
-	pkt_cnt = (le32_to_cpu(prxstat->rxdw2) >> 16) & 0xff;
-	pkt_len =  le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
-	transfer_len = pskb->len;
-	/* Test throughput with Netgear 3700 (No security) with Chariot 3T3R
-	 * pairs. The packet count will be a big number so that the containing
-	 * packet will effect the Rx reordering.
-	 */
-	if (transfer_len < pkt_len) {
-		/* In this case, it means the MAX_RECVBUF_SZ is too small to
-		 * get the data from 8712u.
-		 */
-		return;
-	}
-	do {
-		prxstat = (struct recv_stat *)pbuf;
-		pkt_len =  le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
-		/* more fragment bit */
-		mf = (le32_to_cpu(prxstat->rxdw1) >> 27) & 0x1;
-		/* ragmentation number */
-		frag = (le32_to_cpu(prxstat->rxdw2) >> 12) & 0xf;
-		/* uint 2^3 = 8 bytes */
-		drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
-		drvinfo_sz <<= 3;
-		if (pkt_len <= 0)
-			return;
-		/* Qos data, wireless lan header length is 26 */
-		if ((le32_to_cpu(prxstat->rxdw0) >> 23) & 0x01)
-			shift_sz = 2;
-		precvframe = r8712_alloc_recvframe(pfree_recv_queue);
-		if (!precvframe)
-			return;
-		INIT_LIST_HEAD(&precvframe->u.hdr.list);
-		precvframe->u.hdr.precvbuf = NULL; /*can't access the precvbuf*/
-		precvframe->u.hdr.len = 0;
-		tmp_len = pkt_len + drvinfo_sz + RXDESC_SIZE;
-		pkt_offset = (u16)round_up(tmp_len, 128);
-		/* for first fragment packet, driver need allocate 1536 +
-		 * drvinfo_sz + RXDESC_SIZE to defrag packet.
-		 */
-		if ((mf == 1) && (frag == 0))
-			/*1658+6=1664, 1664 is 128 alignment.*/
-			alloc_sz = max_t(u16, tmp_len, 1658);
-		else
-			alloc_sz = tmp_len;
-		/* 2 is for IP header 4 bytes alignment in QoS packet case.
-		 * 4 is for skb->data 4 bytes alignment.
-		 */
-		alloc_sz += 6;
-		pkt_copy = netdev_alloc_skb(padapter->pnetdev, alloc_sz);
-		if (!pkt_copy)
-			return;
-
-		precvframe->u.hdr.pkt = pkt_copy;
-		skb_reserve(pkt_copy, 4 - ((addr_t)(pkt_copy->data) % 4));
-		skb_reserve(pkt_copy, shift_sz);
-		memcpy(pkt_copy->data, pbuf, tmp_len);
-		precvframe->u.hdr.rx_head = pkt_copy->data;
-		precvframe->u.hdr.rx_data = pkt_copy->data;
-		precvframe->u.hdr.rx_tail = pkt_copy->data;
-		precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
-
-		recvframe_put(precvframe, tmp_len);
-		recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);
-		/* because the endian issue, driver avoid reference to the
-		 * rxstat after calling update_recvframe_attrib_from_recvstat();
-		 */
-		update_recvframe_attrib_from_recvstat(&precvframe->u.hdr.attrib,
-						      prxstat);
-		r8712_recv_entry(precvframe);
-		transfer_len -= pkt_offset;
-		pbuf += pkt_offset;
-		pkt_cnt--;
-		precvframe = NULL;
-		pkt_copy = NULL;
-	} while ((transfer_len > 0) && pkt_cnt > 0);
-}
-
-static void recv_tasklet(struct tasklet_struct *t)
-{
-	struct sk_buff *pskb;
-	struct _adapter *padapter = from_tasklet(padapter, t,
-						 recvpriv.recv_tasklet);
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-
-	while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue))) {
-		recvbuf2recvframe(padapter, pskb);
-		skb_reset_tail_pointer(pskb);
-		pskb->len = 0;
-		if (!skb_cloned(pskb))
-			skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
-		else
-			consume_skb(pskb);
-	}
-}
--- a/drivers/staging/rtl8712/rtl8712_recv.h
+++ /dev/null
@@ -1,145 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_RECV_H_
-#define _RTL8712_RECV_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/* Realtek's v2.6.6 reduced this to 4. However, under heavy network and CPU
- * loads, even 8 receive buffers might not be enough; cutting it to 4 seemed
- * unwise.
- */
-#define NR_RECVBUFF (8)
-
-#define NR_PREALLOC_RECV_SKB (8)
-#define RXDESC_SIZE	24
-#define RXDESC_OFFSET RXDESC_SIZE
-#define RECV_BLK_SZ 512
-#define RECV_BLK_CNT 16
-#define RECV_BLK_TH RECV_BLK_CNT
-#define MAX_RECVBUF_SZ 9100
-#define RECVBUFF_ALIGN_SZ 512
-#define RSVD_ROOM_SZ (0)
-/*These definition is used for Rx packet reordering.*/
-#define SN_LESS(a, b)		(((a-b) & 0x800) != 0)
-#define SN_EQUAL(a, b)	(a == b)
-#define REORDER_WAIT_TIME	30 /* (ms)*/
-
-struct recv_stat {
-	__le32 rxdw0;
-	__le32 rxdw1;
-	__le32 rxdw2;
-	__le32 rxdw3;
-	__le32 rxdw4;
-	__le32 rxdw5;
-};
-
-struct phy_cck_rx_status {
-	/* For CCK rate descriptor. This is a unsigned 8:1 variable.
-	 * LSB bit present 0.5. And MSB 7 bts present a signed value.
-	 * Range from -64~+63.5.
-	 */
-	u8	adc_pwdb_X[4];
-	u8	sq_rpt;
-	u8	cck_agc_rpt;
-};
-
-struct phy_stat {
-	__le32 phydw0;
-	__le32 phydw1;
-	__le32 phydw2;
-	__le32 phydw3;
-	__le32 phydw4;
-	__le32 phydw5;
-	__le32 phydw6;
-	__le32 phydw7;
-};
-
-#define PHY_STAT_GAIN_TRSW_SHT 0
-#define PHY_STAT_PWDB_ALL_SHT 4
-#define PHY_STAT_CFOSHO_SHT 5
-#define PHY_STAT_CCK_AGC_RPT_SHT 5
-#define PHY_STAT_CFOTAIL_SHT 9
-#define PHY_STAT_RXEVM_SHT 13
-#define PHY_STAT_RXSNR_SHT 15
-#define PHY_STAT_PDSNR_SHT 19
-#define PHY_STAT_CSI_CURRENT_SHT 21
-#define PHY_STAT_CSI_TARGET_SHT 23
-#define PHY_STAT_SIGEVM_SHT 25
-#define PHY_STAT_MAX_EX_PWR_SHT 26
-
-union recvstat {
-	struct recv_stat recv_stat;
-	unsigned int value[RXDESC_SIZE>>2];
-};
-
-struct recv_buf {
-	struct list_head list;
-	spinlock_t recvbuf_lock;
-	u32	ref_cnt;
-	struct _adapter  *adapter;
-	struct urb *purb;
-	_pkt *pskb;
-	u8  irp_pending;
-	u32  transfer_len;
-	uint  len;
-	u8 *phead;
-	u8 *pdata;
-	u8 *ptail;
-	u8 *pend;
-	u8 *pbuf;
-	u8 *pallocated_buf;
-};
-
-/*
- *	head  ----->
- *		data  ----->
- *			payload
- *		tail  ----->
- *	end   ----->
- *	len = (unsigned int )(tail - data);
- */
-struct recv_frame_hdr {
-	struct list_head list;
-	_pkt	*pkt;
-	_pkt *pkt_newalloc;
-	struct _adapter  *adapter;
-	u8 fragcnt;
-	struct rx_pkt_attrib attrib;
-	uint  len;
-	u8 *rx_head;
-	u8 *rx_data;
-	u8 *rx_tail;
-	u8 *rx_end;
-	void *precvbuf;
-	struct sta_info *psta;
-	/*for A-MPDU Rx reordering buffer control*/
-	struct recv_reorder_ctrl *preorder_ctrl;
-};
-
-union recv_frame {
-	union {
-		struct list_head list;
-		struct recv_frame_hdr hdr;
-	} u;
-};
-
-void r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf);
-void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf);
-s32 r8712_signal_scale_mapping(s32 cur_sig);
-void r8712_reordering_ctrl_timeout_handler(void *pcontext);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl8712_regdef.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_REGDEF_H__
-#define __RTL8712_REGDEF_H__
-
-#include "rtl8712_syscfg_regdef.h"
-#include "rtl8712_cmdctrl_regdef.h"
-#include "rtl8712_macsetting_regdef.h"
-#include "rtl8712_timectrl_regdef.h"
-#include "rtl8712_fifoctrl_regdef.h"
-#include "rtl8712_ratectrl_regdef.h"
-#include "rtl8712_edcasetting_regdef.h"
-#include "rtl8712_wmac_regdef.h"
-#include "rtl8712_powersave_regdef.h"
-#include "rtl8712_gp_regdef.h"
-#include "rtl8712_debugctrl_regdef.h"
-
-#define HIMR	(RTL8712_INTERRUPT_ + 0x08)
-
-#endif /* __RTL8712_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_security_bitdef.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_SECURITY_BITDEF_H__
-#define __RTL8712_SECURITY_BITDEF_H__
-
-/*CAMCMD*/
-#define	_SECCAM_POLLING				BIT(31)
-#define	_SECCAM_CLR					BIT(30)
-#define	_SECCAM_WE					BIT(16)
-#define	_SECCAM_ADR_MSK				0x000000FF
-#define	_SECCAM_ADR_SHT				0
-
-/*CAMDBG*/
-#define	_SECCAM_INFO				BIT(31)
-#define	_SEC_KEYFOUND				BIT(30)
-#define	_SEC_CONFIG_MSK				0x3F000000
-#define	_SEC_CONFIG_SHT				24
-#define	_SEC_KEYCONTENT_MSK			0x00FFFFFF
-#define	_SEC_KEYCONTENT_SHT			0
-
-/*SECCFG*/
-#define	_NOSKMC						BIT(5)
-#define	_SKBYA2						BIT(4)
-#define	_RXDEC						BIT(3)
-#define	_TXENC						BIT(2)
-#define	_RXUSEDK					BIT(1)
-#define	_TXUSEDK					BIT(0)
-
-#endif	/*__RTL8712_SECURITY_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_spec.h
+++ /dev/null
@@ -1,121 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SPEC_H__
-#define __RTL8712_SPEC_H__
-
-#define RTL8712_IOBASE_TXPKT		0x10200000	/*IOBASE_TXPKT*/
-#define RTL8712_IOBASE_RXPKT		0x10210000	/*IOBASE_RXPKT*/
-#define RTL8712_IOBASE_RXCMD		0x10220000	/*IOBASE_RXCMD*/
-#define RTL8712_IOBASE_TXSTATUS		0x10230000	/*IOBASE_TXSTATUS*/
-#define RTL8712_IOBASE_RXSTATUS		0x10240000	/*IOBASE_RXSTATUS*/
-#define RTL8712_IOBASE_IOREG		0x10250000	/*IOBASE_IOREG ADDR*/
-#define RTL8712_IOBASE_SCHEDULER	0x10260000	/*IOBASE_SCHEDULE*/
-
-#define RTL8712_IOBASE_TRXDMA		0x10270000	/*IOBASE_TRXDMA*/
-#define RTL8712_IOBASE_TXLLT		0x10280000	/*IOBASE_TXLLT*/
-#define RTL8712_IOBASE_WMAC		0x10290000	/*IOBASE_WMAC*/
-#define RTL8712_IOBASE_FW2HW		0x102A0000	/*IOBASE_FW2HW*/
-#define RTL8712_IOBASE_ACCESS_PHYREG	0x102B0000	/*IOBASE_ACCESS_PHYREG*/
-
-#define RTL8712_IOBASE_FF	0x10300000 /*IOBASE_FIFO 0x1031000~0x103AFFFF*/
-
-/*IOREG Offset for 8712*/
-#define RTL8712_SYSCFG_		RTL8712_IOBASE_IOREG
-#define RTL8712_CMDCTRL_	(RTL8712_IOBASE_IOREG + 0x40)
-#define RTL8712_MACIDSETTING_	(RTL8712_IOBASE_IOREG + 0x50)
-#define RTL8712_TIMECTRL_	(RTL8712_IOBASE_IOREG + 0x80)
-#define RTL8712_FIFOCTRL_	(RTL8712_IOBASE_IOREG + 0xA0)
-#define RTL8712_RATECTRL_	(RTL8712_IOBASE_IOREG + 0x160)
-#define RTL8712_EDCASETTING_	(RTL8712_IOBASE_IOREG + 0x1D0)
-#define RTL8712_WMAC_		(RTL8712_IOBASE_IOREG + 0x200)
-#define RTL8712_SECURITY_	(RTL8712_IOBASE_IOREG + 0x240)
-#define RTL8712_POWERSAVE_	(RTL8712_IOBASE_IOREG + 0x260)
-#define RTL8712_GP_		(RTL8712_IOBASE_IOREG + 0x2E0)
-#define RTL8712_INTERRUPT_	(RTL8712_IOBASE_IOREG + 0x300)
-#define RTL8712_DEBUGCTRL_	(RTL8712_IOBASE_IOREG + 0x310)
-#define RTL8712_OFFLOAD_	(RTL8712_IOBASE_IOREG + 0x2D0)
-
-/*FIFO for 8712*/
-#define RTL8712_DMA_BCNQ	(RTL8712_IOBASE_FF + 0x10000)
-#define RTL8712_DMA_MGTQ	(RTL8712_IOBASE_FF + 0x20000)
-#define RTL8712_DMA_BMCQ	(RTL8712_IOBASE_FF + 0x30000)
-#define RTL8712_DMA_VOQ		(RTL8712_IOBASE_FF + 0x40000)
-#define RTL8712_DMA_VIQ		(RTL8712_IOBASE_FF + 0x50000)
-#define RTL8712_DMA_BEQ		(RTL8712_IOBASE_FF + 0x60000)
-#define RTL8712_DMA_BKQ		(RTL8712_IOBASE_FF + 0x70000)
-#define RTL8712_DMA_RX0FF	(RTL8712_IOBASE_FF + 0x80000)
-#define RTL8712_DMA_H2CCMD	(RTL8712_IOBASE_FF + 0x90000)
-#define RTL8712_DMA_C2HCMD	(RTL8712_IOBASE_FF + 0xA0000)
-
-/*------------------------------*/
-
-/*BIT 16 15*/
-#define	DID_SDIO_LOCAL			0	/* 0 0*/
-#define	DID_WLAN_IOREG			1	/* 0 1*/
-#define	DID_WLAN_FIFO			3	/* 1 1*/
-#define   DID_UNDEFINE				(-1)
-
-#define CMD_ADDR_MAPPING_SHIFT		2	/*SDIO CMD ADDR MAPPING,
-						 *shift 2 bit for match
-						 * offset[14:2]
-						 */
-
-/*Offset for SDIO LOCAL*/
-#define	OFFSET_SDIO_LOCAL				0x0FFF
-
-/*Offset for WLAN IOREG*/
-#define OFFSET_WLAN_IOREG				0x0FFF
-
-/*Offset for WLAN FIFO*/
-#define	OFFSET_TX_BCNQ				0x0300
-#define	OFFSET_TX_HIQ					0x0310
-#define	OFFSET_TX_CMDQ				0x0320
-#define	OFFSET_TX_MGTQ				0x0330
-#define	OFFSET_TX_HCCAQ				0x0340
-#define	OFFSET_TX_VOQ					0x0350
-#define	OFFSET_TX_VIQ					0x0360
-#define	OFFSET_TX_BEQ					0x0370
-#define	OFFSET_TX_BKQ					0x0380
-#define	OFFSET_RX_RX0FFQ				0x0390
-#define	OFFSET_RX_C2HFFQ				0x03A0
-
-#define	BK_QID_01	1
-#define	BK_QID_02	2
-#define	BE_QID_01	0
-#define	BE_QID_02	3
-#define	VI_QID_01	4
-#define	VI_QID_02	5
-#define	VO_QID_01	6
-#define	VO_QID_02	7
-#define	HCCA_QID_01	8
-#define	HCCA_QID_02	9
-#define	HCCA_QID_03	10
-#define	HCCA_QID_04	11
-#define	HCCA_QID_05	12
-#define	HCCA_QID_06	13
-#define	HCCA_QID_07	14
-#define	HCCA_QID_08	15
-#define	HI_QID		17
-#define	CMD_QID	19
-#define	MGT_QID	18
-#define	BCN_QID	16
-
-#include "rtl8712_regdef.h"
-
-#include "rtl8712_bitdef.h"
-
-#include "basic_types.h"
-
-#endif /* __RTL8712_SPEC_H__ */
-
--- a/drivers/staging/rtl8712/rtl8712_syscfg_bitdef.h
+++ /dev/null
@@ -1,163 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SYSCFG_BITDEF_H__
-#define __RTL8712_SYSCFG_BITDEF_H__
-
-/*SYS_PWR_CTRL*/
-/*SRCTRL0*/
-/*SRCTRL1*/
-/*SYS_CLKR*/
-
-/*SYS_IOS_CTRL*/
-#define iso_LDR2RP_SHT		8 /* EE Loader to Retention Path*/
-#define iso_LDR2RP		BIT(iso_LDR2RP_SHT) /* 1:isolation, 0:attach*/
-
-/*SYS_CTRL*/
-#define FEN_DIO_SDIO_SHT	0
-#define FEN_DIO_SDIO		BIT(FEN_DIO_SDIO_SHT)
-#define FEN_SDIO_SHT		1
-#define FEN_SDIO		BIT(FEN_SDIO_SHT)
-#define FEN_USBA_SHT		2
-#define FEN_USBA		BIT(FEN_USBA_SHT)
-#define FEN_UPLL_SHT		3
-#define FEN_UPLL		BIT(FEN_UPLL_SHT)
-#define FEN_USBD_SHT		4
-#define FEN_USBD		BIT(FEN_USBD_SHT)
-#define FEN_DIO_PCIE_SHT	5
-#define FEN_DIO_PCIE		BIT(FEN_DIO_PCIE_SHT)
-#define FEN_PCIEA_SHT		6
-#define FEN_PCIEA		BIT(FEN_PCIEA_SHT)
-#define FEN_PPLL_SHT		7
-#define FEN_PPLL		BIT(FEN_PPLL_SHT)
-#define FEN_PCIED_SHT		8
-#define FEN_PCIED		BIT(FEN_PCIED_SHT)
-#define FEN_CPUEN_SHT		10
-#define FEN_CPUEN		BIT(FEN_CPUEN_SHT)
-#define FEN_DCORE_SHT		11
-#define FEN_DCORE		BIT(FEN_DCORE_SHT)
-#define FEN_ELDR_SHT		12
-#define FEN_ELDR		BIT(FEN_ELDR_SHT)
-#define PWC_DV2LDR_SHT		13
-#define PWC_DV2LDR		BIT(PWC_DV2LDR_SHT) /* Loader Power Enable*/
-
-/*=== SYS_CLKR ===*/
-#define SYS_CLKSEL_SHT		0
-#define SYS_CLKSEL		BIT(SYS_CLKSEL_SHT) /* System Clock 80MHz*/
-#define PS_CLKSEL_SHT		1
-#define PS_CLKSEL		BIT(PS_CLKSEL_SHT) /*System power save
-						    * clock select.
-						    */
-#define CPU_CLKSEL_SHT		2
-#define CPU_CLKSEL		BIT(CPU_CLKSEL_SHT) /* System Clock select,
-						     * 1: AFE source,
-						     * 0: System clock(L-Bus)
-						     */
-#define INT32K_EN_SHT		3
-#define INT32K_EN		BIT(INT32K_EN_SHT)
-#define MACSLP_SHT		4
-#define MACSLP			BIT(MACSLP_SHT)
-#define MAC_CLK_EN_SHT		11
-#define MAC_CLK_EN		BIT(MAC_CLK_EN_SHT) /* MAC Clock Enable.*/
-#define SYS_CLK_EN_SHT		12
-#define SYS_CLK_EN		BIT(SYS_CLK_EN_SHT)
-#define RING_CLK_EN_SHT		13
-#define RING_CLK_EN		BIT(RING_CLK_EN_SHT)
-#define SWHW_SEL_SHT		14
-#define SWHW_SEL		BIT(SWHW_SEL_SHT) /* Load done,
-						   * control path switch.
-						   */
-#define FWHW_SEL_SHT		15
-#define FWHW_SEL		BIT(FWHW_SEL_SHT) /* Sleep exit,
-						   * control path switch.
-						   */
-
-/*9346CR*/
-#define	_VPDIDX_MSK		0xFF00
-#define	_VPDIDX_SHT		8
-#define	_EEM_MSK		0x00C0
-#define	_EEM_SHT		6
-#define	_EEM0			BIT(6)
-#define	_EEM1			BIT(7)
-#define	_EEPROM_EN		BIT(5)
-#define	_9356SEL		BIT(4)
-#define	_EECS			BIT(3)
-#define	_EESK			BIT(2)
-#define	_EEDI			BIT(1)
-#define	_EEDO			BIT(0)
-
-/*AFE_MISC*/
-#define	AFE_MISC_USB_MBEN_SHT	7
-#define	AFE_MISC_USB_MBEN	BIT(AFE_MISC_USB_MBEN_SHT)
-#define	AFE_MISC_USB_BGEN_SHT	6
-#define	AFE_MISC_USB_BGEN	BIT(AFE_MISC_USB_BGEN_SHT)
-#define	AFE_MISC_LD12_VDAJ_SHT	4
-#define	AFE_MISC_LD12_VDAJ_MSK	0X0030
-#define	AFE_MISC_LD12_VDAJ	BIT(AFE_MISC_LD12_VDAJ_SHT)
-#define	AFE_MISC_I32_EN_SHT	3
-#define	AFE_MISC_I32_EN		BIT(AFE_MISC_I32_EN_SHT)
-#define	AFE_MISC_E32_EN_SHT	2
-#define	AFE_MISC_E32_EN		BIT(AFE_MISC_E32_EN_SHT)
-#define	AFE_MISC_MBEN_SHT	1
-#define	AFE_MISC_MBEN		BIT(AFE_MISC_MBEN_SHT)/* Enable AFE Macro
-						       * Block's Mbias.
-						       */
-#define	AFE_MISC_BGEN_SHT	0
-#define	AFE_MISC_BGEN		BIT(AFE_MISC_BGEN_SHT)/* Enable AFE Macro
-						       * Block's Bandgap.
-						       */
-
-/*--------------------------------------------------------------------------*/
-/*       SPS1_CTRL bits				(Offset 0x18-1E, 56bits)*/
-/*--------------------------------------------------------------------------*/
-#define	SPS1_SWEN		BIT(1)	/* Enable vsps18 SW Macro Block.*/
-#define	SPS1_LDEN		BIT(0)	/* Enable VSPS12 LDO Macro block.*/
-
-/*----------------------------------------------------------------------------*/
-/*       LDOA15_CTRL bits		(Offset 0x20, 8bits)*/
-/*----------------------------------------------------------------------------*/
-#define	LDA15_EN		BIT(0)	/* Enable LDOA15 Macro Block*/
-
-/*----------------------------------------------------------------------------*/
-/*       8192S LDOV12D_CTRL bit		(Offset 0x21, 8bits)*/
-/*----------------------------------------------------------------------------*/
-#define	LDV12_EN		BIT(0)	/* Enable LDOVD12 Macro Block*/
-#define	LDV12_SDBY		BIT(1)	/* LDOVD12 standby mode*/
-
-/*CLK_PS_CTRL*/
-#define	_CLK_GATE_EN		BIT(0)
-
-/* EFUSE_CTRL*/
-#define EF_FLAG			BIT(31)		/* Access Flag, Write:1;
-						 *	        Read:0
-						 */
-#define EF_PGPD			0x70000000	/* E-fuse Program time*/
-#define EF_RDT			0x0F000000	/* E-fuse read time: in the
-						 * unit of cycle time
-						 */
-#define EF_PDN_EN		BIT(19)		/* EFuse Power down enable*/
-#define ALD_EN			BIT(18)		/* Autoload Enable*/
-#define EF_ADDR			0x0003FF00	/* Access Address*/
-#define EF_DATA			0x000000FF	/* Access Data*/
-
-/* EFUSE_TEST*/
-#define LDOE25_EN		BIT(31)		/* Enable LDOE25 Macro Block*/
-
-/* EFUSE_CLK_CTRL*/
-#define EFUSE_CLK_EN		BIT(1)		/* E-Fuse Clock Enable*/
-#define EFUSE_CLK_SEL		BIT(0)		/* E-Fuse Clock Select,
-						 * 0:500K, 1:40M
-						 */
-
-#endif	/*__RTL8712_SYSCFG_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_syscfg_regdef.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_SYSCFG_REGDEF_H__
-#define __RTL8712_SYSCFG_REGDEF_H__
-
-#define SYS_ISO_CTRL		(RTL8712_SYSCFG_ + 0x0000)
-#define SYS_FUNC_EN		(RTL8712_SYSCFG_ + 0x0002)
-#define PMC_FSM			(RTL8712_SYSCFG_ + 0x0004)
-#define SYS_CLKR		(RTL8712_SYSCFG_ + 0x0008)
-#define EE_9346CR		(RTL8712_SYSCFG_ + 0x000A)
-#define EE_VPD			(RTL8712_SYSCFG_ + 0x000C)
-#define AFE_MISC		(RTL8712_SYSCFG_ + 0x0010)
-#define SPS0_CTRL		(RTL8712_SYSCFG_ + 0x0011)
-#define SPS1_CTRL		(RTL8712_SYSCFG_ + 0x0018)
-#define RF_CTRL			(RTL8712_SYSCFG_ + 0x001F)
-#define LDOA15_CTRL		(RTL8712_SYSCFG_ + 0x0020)
-#define LDOV12D_CTRL		(RTL8712_SYSCFG_ + 0x0021)
-#define LDOHCI12_CTRL		(RTL8712_SYSCFG_ + 0x0022)
-#define LDO_USB_CTRL		(RTL8712_SYSCFG_ + 0x0023)
-#define LPLDO_CTRL		(RTL8712_SYSCFG_ + 0x0024)
-#define AFE_XTAL_CTRL		(RTL8712_SYSCFG_ + 0x0026)
-#define AFE_PLL_CTRL		(RTL8712_SYSCFG_ + 0x0028)
-#define EFUSE_CTRL		(RTL8712_SYSCFG_ + 0x0030)
-#define EFUSE_TEST		(RTL8712_SYSCFG_ + 0x0034)
-#define PWR_DATA		(RTL8712_SYSCFG_ + 0x0038)
-#define DPS_TIMER		(RTL8712_SYSCFG_ + 0x003C)
-#define RCLK_MON		(RTL8712_SYSCFG_ + 0x003E)
-#define EFUSE_CLK_CTRL		(RTL8712_SYSCFG_ + 0x02F8)
-
-#endif /*__RTL8712_SYSCFG_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_timectrl_bitdef.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_TIMECTRL_BITDEF_H__
-#define __RTL8712_TIMECTRL_BITDEF_H__
-
-/*TSFTR*/
-/*SLOT*/
-/*USTIME*/
-
-/*TUBASE*/
-#define	_TUBASE_MSK			0x07FF
-
-/*SIFS_CCK*/
-#define	_SIFS_CCK_TRX_MSK		0xFF00
-#define	_SIFS_CCK_TRX_SHT		0x8
-#define	_SIFS_CCK_CTX_MSK		0x00FF
-#define	_SIFS_CCK_CTX_SHT		0
-
-/*SIFS_OFDM*/
-#define	_SIFS_OFDM_TRX_MSK		0xFF00
-#define	_SIFS_OFDM_TRX_SHT		0x8
-#define	_SIFS_OFDM_CTX_MSK		0x00FF
-#define	_SIFS_OFDM_CTX_SHT		0
-
-/*PIFS*/
-/*ACKTO*/
-/*EIFS*/
-/*BCNITV*/
-/*ATIMWND*/
-
-/*DRVERLYINT*/
-#define	_ENSWBCN				BIT(15)
-#define	_DRVERLY_TU_MSK			0x0FF0
-#define	_DRVERLY_TU_SHT			4
-#define	_DRVERLY_US_MSK			0x000F
-#define	_DRVERLY_US_SHT			0
-
-/*BCNDMATIM*/
-#define	_BCNDMATIM_MSK			0x03FF
-
-/*BCNERRTH*/
-/*MLT*/
-
-#endif /* __RTL8712_TIMECTRL_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_timectrl_regdef.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL8712_TIMECTRL_REGDEF_H__
-#define __RTL8712_TIMECTRL_REGDEF_H__
-
-#define TSFTR			(RTL8712_TIMECTRL_ + 0x00)
-#define USTIME			(RTL8712_TIMECTRL_ + 0x08)
-#define SLOT			(RTL8712_TIMECTRL_ + 0x09)
-#define TUBASE			(RTL8712_TIMECTRL_ + 0x0A)
-#define SIFS_CCK		(RTL8712_TIMECTRL_ + 0x0C)
-#define SIFS_OFDM		(RTL8712_TIMECTRL_ + 0x0E)
-#define PIFS			(RTL8712_TIMECTRL_ + 0x10)
-#define ACKTO			(RTL8712_TIMECTRL_ + 0x11)
-#define EIFS			(RTL8712_TIMECTRL_ + 0x12)
-#define BCNITV			(RTL8712_TIMECTRL_ + 0x14)
-#define ATIMWND			(RTL8712_TIMECTRL_ + 0x16)
-#define DRVERLYINT		(RTL8712_TIMECTRL_ + 0x18)
-#define BCNDMATIM		(RTL8712_TIMECTRL_ + 0x1A)
-#define BCNERRTH		(RTL8712_TIMECTRL_ + 0x1C)
-#define MLT			(RTL8712_TIMECTRL_ + 0x1D)
-
-#endif /* __RTL8712_TIMECTRL_REGDEF_H__ */
--- a/drivers/staging/rtl8712/rtl8712_wmac_bitdef.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_WMAC_BITDEF_H__
-#define __RTL8712_WMAC_BITDEF_H__
-
-/*NAVCTRL*/
-#define	_NAV_UPPER_EN			BIT(18)
-#define	_NAV_MTO_EN				BIT(17)
-#define	_NAV_UPPER				BIT(16)
-#define	_NAV_MTO_MSK			0xFF00
-#define	_NAV_MTO_SHT			8
-#define	_RTSRST_MSK				0x00FF
-#define	_RTSRST_SHT				0
-
-/*BWOPMODE*/
-#define	_20MHZBW				BIT(2)
-
-/*BACAMCMD*/
-#define	_BACAM_POLL				BIT(31)
-#define	_BACAM_RST				BIT(17)
-#define	_BACAM_RW				BIT(16)
-#define	_BACAM_ADDR_MSK			0x0000007F
-#define	_BACAM_ADDR_SHT			0
-
-/*LBDLY*/
-#define	_LBDLY_MSK				0x1F
-
-/*FWDLY*/
-#define	_FWDLY_MSK				0x0F
-
-/*RXERR_RPT*/
-#define	_RXERR_RPT_SEL_MSK		0xF0000000
-#define	_RXERR_RPT_SEL_SHT		28
-#define	_RPT_CNT_MSK			0x000FFFFF
-#define	_RPT_CNT_SHT			0
-
-#endif	/*__RTL8712_WMAC_BITDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_wmac_regdef.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_WMAC_REGDEF_H__
-#define __RTL8712_WMAC_REGDEF_H__
-
-#define NAVCTRL				(RTL8712_WMAC_ + 0x00)
-#define BWOPMODE			(RTL8712_WMAC_ + 0x03)
-#define BACAMCMD			(RTL8712_WMAC_ + 0x04)
-#define BACAMCONTENT			(RTL8712_WMAC_ + 0x08)
-#define LBDLY				(RTL8712_WMAC_ + 0x10)
-#define FWDLY				(RTL8712_WMAC_ + 0x11)
-#define HWPC_RX_CTRL			(RTL8712_WMAC_ + 0x18)
-#define MQ				(RTL8712_WMAC_ + 0x20)
-#define MA				(RTL8712_WMAC_ + 0x22)
-#define MS				(RTL8712_WMAC_ + 0x24)
-#define CLM_RESULT			(RTL8712_WMAC_ + 0x27)
-#define NHM_RPI_CNT			(RTL8712_WMAC_ + 0x28)
-#define RXERR_RPT			(RTL8712_WMAC_ + 0x30)
-#define NAV_PROT_LEN			(RTL8712_WMAC_ + 0x34)
-#define CFEND_TH			(RTL8712_WMAC_ + 0x36)
-#define AMPDU_MIN_SPACE			(RTL8712_WMAC_ + 0x37)
-#define	TXOP_STALL_CTRL			(RTL8712_WMAC_ + 0x38)
-
-#endif /*__RTL8712_WMAC_REGDEF_H__*/
-
--- a/drivers/staging/rtl8712/rtl8712_xmit.c
+++ /dev/null
@@ -1,744 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl8712_xmit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL8712_XMIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-static void dump_xframe(struct _adapter *padapter,
-			struct xmit_frame *pxmitframe);
-static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz);
-
-sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag)
-{
-	phw_txqueue->ac_tag = ac_tag;
-	switch (ac_tag) {
-	case BE_QUEUE_INX:
-		phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ;
-		break;
-	case BK_QUEUE_INX:
-		phw_txqueue->ff_hwaddr = RTL8712_DMA_BKQ;
-		break;
-	case VI_QUEUE_INX:
-		phw_txqueue->ff_hwaddr = RTL8712_DMA_VIQ;
-		break;
-	case VO_QUEUE_INX:
-		phw_txqueue->ff_hwaddr = RTL8712_DMA_VOQ;
-		break;
-	case BMC_QUEUE_INX:
-		phw_txqueue->ff_hwaddr = RTL8712_DMA_BEQ;
-		break;
-	}
-	return _SUCCESS;
-}
-
-int r8712_txframes_sta_ac_pending(struct _adapter *padapter,
-				  struct pkt_attrib *pattrib)
-{
-	struct sta_info *psta;
-	struct tx_servq *ptxservq;
-	int priority = pattrib->priority;
-
-	psta = pattrib->psta;
-	switch (priority) {
-	case 1:
-	case 2:
-		ptxservq = &psta->sta_xmitpriv.bk_q;
-		break;
-	case 4:
-	case 5:
-		ptxservq = &psta->sta_xmitpriv.vi_q;
-		break;
-	case 6:
-	case 7:
-		ptxservq = &psta->sta_xmitpriv.vo_q;
-		break;
-	case 0:
-	case 3:
-	default:
-		ptxservq = &psta->sta_xmitpriv.be_q;
-	break;
-	}
-	return ptxservq->qcnt;
-}
-
-static u32 get_ff_hwaddr(struct xmit_frame *pxmitframe)
-{
-	u32 addr = 0;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-
-	if (pxmitframe->frame_tag == TXAGG_FRAMETAG) {
-		addr = RTL8712_DMA_H2CCMD;
-	} else if (pxmitframe->frame_tag == MGNT_FRAMETAG) {
-		addr = RTL8712_DMA_MGTQ;
-	} else if (pdvobj->nr_endpoint == 6) {
-		switch (pattrib->priority) {
-		case 0:
-		case 3:
-			addr = RTL8712_DMA_BEQ;
-			break;
-		case 1:
-		case 2:
-			addr = RTL8712_DMA_BKQ;
-			break;
-		case 4:
-		case 5:
-			addr = RTL8712_DMA_VIQ;
-			break;
-		case 6:
-		case 7:
-			addr = RTL8712_DMA_VOQ;
-			break;
-		case 0x10:
-		case 0x11:
-		case 0x12:
-		case 0x13:
-			addr = RTL8712_DMA_H2CCMD;
-			break;
-		default:
-			addr = RTL8712_DMA_BEQ;
-			break;
-		}
-	} else if (pdvobj->nr_endpoint == 4) {
-		switch (pattrib->qsel) {
-		case 0:
-		case 3:
-		case 1:
-		case 2:
-			addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/
-			break;
-		case 4:
-		case 5:
-		case 6:
-		case 7:
-			addr = RTL8712_DMA_VOQ;/*RTL8712_EP_HI;*/
-			break;
-		case 0x10:
-		case 0x11:
-		case 0x12:
-		case 0x13:
-			addr = RTL8712_DMA_H2CCMD;
-			break;
-		default:
-			addr = RTL8712_DMA_BEQ;/*RTL8712_EP_LO;*/
-			break;
-		}
-	}
-	return addr;
-}
-
-static struct xmit_frame *dequeue_one_xmitframe(struct xmit_priv *pxmitpriv,
-					 struct hw_xmit *phwxmit,
-					 struct tx_servq *ptxservq,
-					 struct  __queue *pframe_queue)
-{
-	struct list_head *xmitframe_plist, *xmitframe_phead;
-	struct	xmit_frame *pxmitframe = NULL;
-
-	xmitframe_phead = &pframe_queue->queue;
-	xmitframe_plist = xmitframe_phead->next;
-	if (!end_of_queue_search(xmitframe_phead, xmitframe_plist)) {
-		pxmitframe = container_of(xmitframe_plist,
-					  struct xmit_frame, list);
-		list_del_init(&pxmitframe->list);
-		ptxservq->qcnt--;
-		phwxmit->txcmdcnt++;
-	}
-	return pxmitframe;
-}
-
-static struct xmit_frame *dequeue_xframe_ex(struct xmit_priv *pxmitpriv,
-				     struct hw_xmit *phwxmit_i, sint entry)
-{
-	unsigned long irqL0;
-	struct list_head *sta_plist, *sta_phead;
-	struct hw_xmit *phwxmit;
-	struct tx_servq *ptxservq = NULL;
-	struct  __queue *pframe_queue = NULL;
-	struct	xmit_frame *pxmitframe = NULL;
-	int i, inx[4];
-	int j, acirp_cnt[4];
-
-	/*entry indx: 0->vo, 1->vi, 2->be, 3->bk.*/
-	inx[0] = 0; acirp_cnt[0] = pxmitpriv->voq_cnt;
-	inx[1] = 1; acirp_cnt[1] = pxmitpriv->viq_cnt;
-	inx[2] = 2; acirp_cnt[2] = pxmitpriv->beq_cnt;
-	inx[3] = 3; acirp_cnt[3] = pxmitpriv->bkq_cnt;
-	for (i = 0; i < 4; i++) {
-		for (j = i + 1; j < 4; j++) {
-			if (acirp_cnt[j] < acirp_cnt[i]) {
-				swap(acirp_cnt[i], acirp_cnt[j]);
-				swap(inx[i], inx[j]);
-			}
-		}
-	}
-	spin_lock_irqsave(&pxmitpriv->lock, irqL0);
-	for (i = 0; i < entry; i++) {
-		phwxmit = phwxmit_i + inx[i];
-		sta_phead = &phwxmit->sta_queue->queue;
-		sta_plist = sta_phead->next;
-		while (!end_of_queue_search(sta_phead, sta_plist)) {
-			ptxservq = container_of(sta_plist, struct tx_servq,
-						tx_pending);
-			pframe_queue = &ptxservq->sta_pending;
-			pxmitframe = dequeue_one_xmitframe(pxmitpriv, phwxmit,
-				     ptxservq, pframe_queue);
-			if (pxmitframe) {
-				phwxmit->accnt--;
-				goto exit_dequeue_xframe_ex;
-			}
-			sta_plist = sta_plist->next;
-			/*Remove sta node when there are no pending packets.*/
-			if (list_empty(&pframe_queue->queue)) {
-				/* must be done after sta_plist->next
-				 * and before break
-				 */
-				list_del_init(&ptxservq->tx_pending);
-			}
-		}
-	}
-exit_dequeue_xframe_ex:
-	spin_unlock_irqrestore(&pxmitpriv->lock, irqL0);
-	return pxmitframe;
-}
-
-void r8712_do_queue_select(struct _adapter *padapter,
-			   struct pkt_attrib *pattrib)
-{
-	unsigned int qsel = 0;
-	struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-
-	if (pdvobj->nr_endpoint == 6) {
-		qsel = (unsigned int)pattrib->priority;
-	} else if (pdvobj->nr_endpoint == 4) {
-		qsel = (unsigned int)pattrib->priority;
-		if (qsel == 0 || qsel == 3)
-			qsel = 3;
-		else if (qsel == 1 || qsel == 2)
-			qsel = 1;
-		else if (qsel == 4 || qsel == 5)
-			qsel = 5;
-		else if (qsel == 6 || qsel == 7)
-			qsel = 7;
-		else
-			qsel = 3;
-	}
-	pattrib->qsel = qsel;
-}
-
-#ifdef CONFIG_R8712_TX_AGGR
-void r8712_construct_txaggr_cmd_desc(struct xmit_buf *pxmitbuf)
-{
-	struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf;
-
-	/* Fill up TxCmd Descriptor according as USB FW Tx Aaggregation info.*/
-	/* dw0 */
-	ptx_desc->txdw0 = cpu_to_le32(CMD_HDR_SZ & 0xffff);
-	ptx_desc->txdw0 |=
-		cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) &
-			    0x00ff0000);
-	ptx_desc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
-
-	/* dw1 */
-	ptx_desc->txdw1 |= cpu_to_le32((0x13 << QSEL_SHT) & 0x00001f00);
-}
-
-void r8712_construct_txaggr_cmd_hdr(struct xmit_buf *pxmitbuf)
-{
-	struct xmit_frame *pxmitframe = (struct xmit_frame *)
-		pxmitbuf->priv_data;
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-	struct cmd_hdr *pcmd_hdr = (struct cmd_hdr  *)
-		(pxmitbuf->pbuf + TXDESC_SIZE);
-
-	/* Fill up Cmd Header for USB FW Tx Aggregation.*/
-	/* dw0 */
-	pcmd_hdr->cmd_dw0 = cpu_to_le32((GEN_CMD_CODE(_AMSDU_TO_AMPDU) << 16) |
-					(pcmdpriv->cmd_seq << 24));
-	pcmdpriv->cmd_seq++;
-}
-
-void r8712_append_mpdu_unit(struct xmit_buf *pxmitbuf,
-			    struct xmit_frame *pxmitframe)
-{
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct tx_desc *ptx_desc = (struct tx_desc *)pxmitbuf->pbuf;
-	int last_txcmdsz = 0;
-	int padding_sz = 0;
-
-	/* 802.3->802.11 converter */
-	r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
-	/* free skb struct */
-	r8712_xmit_complete(padapter, pxmitframe);
-	if (pxmitframe->attrib.ether_type != 0x0806) {
-		if ((pxmitframe->attrib.ether_type != 0x888e) &&
-			(pxmitframe->attrib.dhcp_pkt != 1)) {
-			r8712_issue_addbareq_cmd(padapter,
-					pxmitframe->attrib.priority);
-		}
-	}
-	pxmitframe->last[0] = 1;
-	update_txdesc(pxmitframe, (uint *)(pxmitframe->buf_addr),
-		pxmitframe->attrib.last_txcmdsz);
-	/*padding zero */
-	last_txcmdsz = pxmitframe->attrib.last_txcmdsz;
-	padding_sz = (8 - (last_txcmdsz % 8));
-	if ((last_txcmdsz % 8) != 0) {
-		int i;
-
-		for (i = 0; i < padding_sz; i++)
-			*(pxmitframe->buf_addr + TXDESC_SIZE + last_txcmdsz +
-			  i) = 0;
-	}
-	/* Add the new mpdu's length */
-	ptx_desc->txdw0 = cpu_to_le32((ptx_desc->txdw0 & 0xffff0000) |
-		((ptx_desc->txdw0 & 0x0000ffff) +
-			((TXDESC_SIZE + last_txcmdsz + padding_sz) &
-			 0x0000ffff)));
-}
-
-void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf,
-			      struct xmit_frame *pxmitframe)
-{
-	/* linux complete context doesn't need to protect */
-	pxmitframe->pxmitbuf = pxmitbuf;
-	pxmitbuf->priv_data = pxmitframe;
-	pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
-	/* buffer addr assoc */
-	pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE + CMD_HDR_SZ;
-	/*RTL8712_DMA_H2CCMD */
-	r8712_construct_txaggr_cmd_desc(pxmitbuf);
-	r8712_construct_txaggr_cmd_hdr(pxmitbuf);
-	r8712_append_mpdu_unit(pxmitbuf, pxmitframe);
-	pxmitbuf->aggr_nr = 1;
-}
-
-u16 r8712_xmitframe_aggr_next(struct xmit_buf *pxmitbuf,
-			struct xmit_frame *pxmitframe)
-{
-	pxmitframe->pxmitbuf = pxmitbuf;
-	pxmitbuf->priv_data = pxmitframe;
-	pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
-	/* buffer addr assoc */
-	pxmitframe->buf_addr = pxmitbuf->pbuf + TXDESC_SIZE +
-		(((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff);
-	r8712_append_mpdu_unit(pxmitbuf, pxmitframe);
-	r8712_free_xmitframe_ex(&pxmitframe->padapter->xmitpriv,
-				pxmitframe);
-	pxmitbuf->aggr_nr++;
-
-	return TXDESC_SIZE +
-		(((struct tx_desc *)pxmitbuf->pbuf)->txdw0 & 0x0000ffff);
-}
-
-void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf,
-			    struct xmit_frame *pxmitframe)
-{
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-	struct tx_desc *ptxdesc = pxmitbuf->pbuf;
-	struct cmd_hdr *pcmd_hdr = (struct cmd_hdr *)
-		(pxmitbuf->pbuf + TXDESC_SIZE);
-	u16 total_length = (u16)(ptxdesc->txdw0 & 0xffff);
-
-	/* use 1st xmitframe as media */
-	xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
-	pcmd_hdr->cmd_dw0 = cpu_to_le32(((total_length - CMD_HDR_SZ) &
-					 0x0000ffff) | (pcmd_hdr->cmd_dw0 &
-							0xffff0000));
-
-	/* urb length in cmd_dw1 */
-	pcmd_hdr->cmd_dw1 = cpu_to_le32((pxmitbuf->aggr_nr & 0xff) |
-					((total_length + TXDESC_SIZE) << 16));
-	pxmitframe->last[0] = 1;
-	pxmitframe->bpending[0] = false;
-	pxmitframe->mem_addr = pxmitbuf->pbuf;
-
-	if ((pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) % 0x200) ==
-	     0) || ((!pdvobj->ishighspeed && ((total_length + TXDESC_SIZE) %
-					      0x40) == 0))) {
-		ptxdesc->txdw0 |= cpu_to_le32
-			(((TXDESC_SIZE + OFFSET_SZ + 8) << OFFSET_SHT) &
-			 0x00ff0000);
-		/*32 bytes for TX Desc + 8 bytes pending*/
-	} else {
-		ptxdesc->txdw0 |= cpu_to_le32
-			(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) &
-			 0x00ff0000);
-		/*default = 32 bytes for TX Desc*/
-	}
-	r8712_write_port(pxmitframe->padapter, RTL8712_DMA_H2CCMD,
-			total_length + TXDESC_SIZE, (u8 *)pxmitframe);
-}
-
-#endif
-
-static void update_txdesc(struct xmit_frame *pxmitframe, uint *pmem, int sz)
-{
-	uint qsel;
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-	struct tx_desc *ptxdesc = (struct tx_desc *)pmem;
-	struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-#ifdef CONFIG_R8712_TX_AGGR
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-#endif
-	u8 blnSetTxDescOffset;
-	bool bmcst = is_multicast_ether_addr(pattrib->ra);
-	struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-	struct tx_desc txdesc_mp;
-
-	memcpy(&txdesc_mp, ptxdesc, sizeof(struct tx_desc));
-	memset(ptxdesc, 0, sizeof(struct tx_desc));
-	/* offset 0 */
-	ptxdesc->txdw0 |= cpu_to_le32(sz & 0x0000ffff);
-	if (pdvobj->ishighspeed) {
-		if (((sz + TXDESC_SIZE) % 512) == 0)
-			blnSetTxDescOffset = 1;
-		else
-			blnSetTxDescOffset = 0;
-	} else {
-		if (((sz + TXDESC_SIZE) % 64) == 0)
-			blnSetTxDescOffset = 1;
-		else
-			blnSetTxDescOffset = 0;
-	}
-	if (blnSetTxDescOffset) {
-		/* 32 bytes for TX Desc + 8 bytes pending */
-		ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ + 8) <<
-			      OFFSET_SHT) & 0x00ff0000);
-	} else {
-		/* default = 32 bytes for TX Desc */
-		ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) <<
-				  OFFSET_SHT) & 0x00ff0000);
-	}
-	ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
-	if (pxmitframe->frame_tag == DATA_FRAMETAG) {
-		/* offset 4 */
-		ptxdesc->txdw1 |= cpu_to_le32((pattrib->mac_id) & 0x1f);
-
-#ifdef CONFIG_R8712_TX_AGGR
-		/* dirty workaround, need to check if it is aggr cmd. */
-		if ((u8 *)pmem != (u8 *)pxmitframe->pxmitbuf->pbuf) {
-			ptxdesc->txdw0 |= cpu_to_le32
-				((0x3 << TYPE_SHT) & TYPE_MSK);
-			qsel = (uint)(pattrib->qsel & 0x0000001f);
-			if (qsel == 2)
-				qsel = 0;
-			ptxdesc->txdw1 |= cpu_to_le32
-				((qsel << QSEL_SHT) & 0x00001f00);
-			ptxdesc->txdw2 = cpu_to_le32
-				((qsel << RTS_RC_SHT) & 0x001f0000);
-			ptxdesc->txdw6 |= cpu_to_le32
-				((0x5 << RSVD6_SHT) & RSVD6_MSK);
-		} else {
-			ptxdesc->txdw0 |= cpu_to_le32
-				((0x3 << TYPE_SHT) & TYPE_MSK);
-			ptxdesc->txdw1 |= cpu_to_le32
-				((0x13 << QSEL_SHT) & 0x00001f00);
-			qsel = (uint)(pattrib->qsel & 0x0000001f);
-			if (qsel == 2)
-				qsel = 0;
-			ptxdesc->txdw2 = cpu_to_le32
-				((qsel << RTS_RC_SHT) & 0x0001f000);
-			ptxdesc->txdw7 |= cpu_to_le32
-				(pcmdpriv->cmd_seq << 24);
-			pcmdpriv->cmd_seq++;
-		}
-		pattrib->qsel = 0x13;
-#else
-		qsel = (uint)(pattrib->qsel & 0x0000001f);
-		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
-#endif
-		if (!pqospriv->qos_option)
-			ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/*Non-QoS*/
-		if ((pattrib->encrypt > 0) && !pattrib->bswenc) {
-			switch (pattrib->encrypt) {	/*SEC_TYPE*/
-			case _WEP40_:
-			case _WEP104_:
-				ptxdesc->txdw1 |= cpu_to_le32((0x01 << 22) &
-						  0x00c00000);
-				/*KEY_ID when WEP is used;*/
-				ptxdesc->txdw1 |=
-					cpu_to_le32((psecuritypriv->PrivacyKeyIndex << 17) &
-						    0x00060000);
-				break;
-			case _TKIP_:
-			case _TKIP_WTMIC_:
-				ptxdesc->txdw1 |= cpu_to_le32((0x02 << 22) &
-						  0x00c00000);
-				break;
-			case _AES_:
-				ptxdesc->txdw1 |= cpu_to_le32((0x03 << 22) &
-						  0x00c00000);
-				break;
-			case _NO_PRIVACY_:
-			default:
-				break;
-			}
-		}
-		/*offset 8*/
-		if (bmcst)
-			ptxdesc->txdw2 |= cpu_to_le32(BMC);
-
-		/*offset 12*/
-		/* f/w will increase the seqnum by itself, driver pass the
-		 * correct priority to fw.
-		 * fw will check the correct priority for increasing the
-		 * seqnum per tid. about usb using 4-endpoint, qsel points out
-		 * the correct mapping between AC&Endpoint,
-		 * the purpose is that correct mapping lets the MAC release
-		 * the AC Queue list correctly.
-		 */
-		ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) &
-				 0x0fff0000);
-		if ((pattrib->ether_type != 0x888e) &&
-		    (pattrib->ether_type != 0x0806) &&
-		    (pattrib->dhcp_pkt != 1)) {
-			/*Not EAP & ARP type data packet*/
-			if (phtpriv->ht_option == 1) { /*B/G/N Mode*/
-				if (!phtpriv->ampdu_enable)
-					ptxdesc->txdw2 |= cpu_to_le32(BK);
-			}
-		} else {
-			/* EAP data packet and ARP packet.
-			 * Use the 1M data rate to send the EAP/ARP packet.
-			 * This will maybe make the handshake smooth.
-			 */
-			/*driver uses data rate*/
-			ptxdesc->txdw4 = cpu_to_le32(0x80000000);
-			ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/*1M*/
-		}
-		if (pattrib->pctrl == 1) { /* mp tx packets */
-			struct tx_desc *ptxdesc_mp;
-
-			ptxdesc_mp = &txdesc_mp;
-			/* offset 8 */
-			ptxdesc->txdw2 = ptxdesc_mp->txdw2;
-			if (bmcst)
-				ptxdesc->txdw2 |= cpu_to_le32(BMC);
-			ptxdesc->txdw2 |= cpu_to_le32(BK);
-			/* offset 16 */
-			ptxdesc->txdw4 = ptxdesc_mp->txdw4;
-			/* offset 20 */
-			ptxdesc->txdw5 = ptxdesc_mp->txdw5;
-			pattrib->pctrl = 0;/* reset to zero; */
-		}
-	} else if (pxmitframe->frame_tag == MGNT_FRAMETAG) {
-		/* offset 4 */
-		/* CAM_ID(MAC_ID), default=5; */
-		ptxdesc->txdw1 |= cpu_to_le32((0x05) & 0x1f);
-		qsel = (uint)(pattrib->qsel & 0x0000001f);
-		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
-		ptxdesc->txdw1 |= cpu_to_le32(BIT(16));/* Non-QoS */
-		/* offset 8 */
-		if (bmcst)
-			ptxdesc->txdw2 |= cpu_to_le32(BMC);
-		/* offset 12 */
-		/* f/w will increase the seqnum by itself, driver pass the
-		 * correct priority to fw.
-		 * fw will check the correct priority for increasing the seqnum
-		 * per tid. about usb using 4-endpoint, qsel points out the
-		 * correct mapping between AC&Endpoint,
-		 * the purpose is that correct mapping let the MAC releases
-		 * the AC Queue list correctly.
-		 */
-		ptxdesc->txdw3 = cpu_to_le32((pattrib->priority << SEQ_SHT) &
-					      0x0fff0000);
-		/* offset 16 */
-		ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/
-		/* offset 20 */
-		ptxdesc->txdw5 = cpu_to_le32(0x001f8000);/* gtest 1M */
-	} else if (pxmitframe->frame_tag == TXAGG_FRAMETAG) {
-		/* offset 4 */
-		qsel = 0x13;
-		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
-	} else {
-		/* offset 4 */
-		qsel = (uint)(pattrib->priority & 0x0000001f);
-		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
-		/*offset 8*/
-		/*offset 12*/
-		ptxdesc->txdw3 = cpu_to_le32((pattrib->seqnum << SEQ_SHT) &
-					      0x0fff0000);
-		/*offset 16*/
-		ptxdesc->txdw4 = cpu_to_le32(0x80002040);/*gtest*/
-		/*offset 20*/
-		ptxdesc->txdw5 = cpu_to_le32(0x001f9600);/*gtest*/
-	}
-}
-
-int r8712_xmitframe_complete(struct _adapter *padapter,
-			     struct xmit_priv *pxmitpriv,
-			     struct xmit_buf *pxmitbuf)
-{
-	struct hw_xmit *phwxmits;
-	sint hwentry;
-	struct xmit_frame *pxmitframe = NULL;
-#ifdef CONFIG_R8712_TX_AGGR
-	struct xmit_frame *p2ndxmitframe = NULL;
-#else
-	int res = _SUCCESS;
-#endif
-
-	phwxmits = pxmitpriv->hwxmits;
-	hwentry = pxmitpriv->hwxmit_entry;
-	if (!pxmitbuf) {
-		pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv);
-		if (!pxmitbuf)
-			return false;
-#ifdef CONFIG_R8712_TX_AGGR
-		pxmitbuf->aggr_nr = 0;
-#endif
-	}
-	/* 1st frame dequeued */
-	pxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits, hwentry);
-	/* need to remember the 1st frame */
-	if (pxmitframe) {
-
-#ifdef CONFIG_R8712_TX_AGGR
-		/* 1. dequeue 2nd frame
-		 * 2. aggr if 2nd xframe is dequeued, else dump directly
-		 */
-		if (AGGR_NR_HIGH_BOUND > 1)
-			p2ndxmitframe = dequeue_xframe_ex(pxmitpriv, phwxmits,
-							hwentry);
-		if (pxmitframe->frame_tag != DATA_FRAMETAG) {
-			r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
-			return false;
-		}
-		if (p2ndxmitframe)
-			if (p2ndxmitframe->frame_tag != DATA_FRAMETAG) {
-				r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
-				return false;
-			}
-		r8712_xmitframe_aggr_1st(pxmitbuf, pxmitframe);
-		if (p2ndxmitframe) {
-			u16 total_length;
-
-			total_length = r8712_xmitframe_aggr_next(
-				pxmitbuf, p2ndxmitframe);
-			do {
-				p2ndxmitframe = dequeue_xframe_ex(
-					pxmitpriv, phwxmits, hwentry);
-				if (p2ndxmitframe)
-					total_length =
-						r8712_xmitframe_aggr_next(
-							pxmitbuf,
-							p2ndxmitframe);
-				else
-					break;
-			} while (total_length <= 0x1800 &&
-				pxmitbuf->aggr_nr <= AGGR_NR_HIGH_BOUND);
-		}
-		if (pxmitbuf->aggr_nr > 0)
-			r8712_dump_aggr_xframe(pxmitbuf, pxmitframe);
-
-#else
-
-		xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
-		if (pxmitframe->frame_tag == DATA_FRAMETAG) {
-			if (pxmitframe->attrib.priority <= 15)
-				res = r8712_xmitframe_coalesce(padapter,
-					pxmitframe->pkt, pxmitframe);
-			/* always return ndis_packet after
-			 * r8712_xmitframe_coalesce
-			 */
-			r8712_xmit_complete(padapter, pxmitframe);
-		}
-		if (res == _SUCCESS)
-			dump_xframe(padapter, pxmitframe);
-		else
-			r8712_free_xmitframe_ex(pxmitpriv, pxmitframe);
-#endif
-
-	} else { /* pxmitframe == NULL && p2ndxmitframe == NULL */
-		r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
-		return false;
-	}
-	return true;
-}
-
-static void dump_xframe(struct _adapter *padapter,
-			struct xmit_frame *pxmitframe)
-{
-	int t, sz, w_sz;
-	u8 *mem_addr;
-	u32 ff_hwaddr;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-
-	if (pxmitframe->attrib.ether_type != 0x0806) {
-		if (pxmitframe->attrib.ether_type != 0x888e)
-			r8712_issue_addbareq_cmd(padapter, pattrib->priority);
-	}
-	mem_addr = pxmitframe->buf_addr;
-	for (t = 0; t < pattrib->nr_frags; t++) {
-		if (t != (pattrib->nr_frags - 1)) {
-			sz = pxmitpriv->frag_len;
-			sz = sz - 4 - (psecuritypriv->sw_encrypt ? 0 :
-			     pattrib->icv_len);
-			pxmitframe->last[t] = 0;
-		} else {
-			sz = pattrib->last_txcmdsz;
-			pxmitframe->last[t] = 1;
-		}
-		update_txdesc(pxmitframe, (uint *)mem_addr, sz);
-		w_sz = sz + TXDESC_SIZE;
-		pxmitframe->mem_addr = mem_addr;
-		pxmitframe->bpending[t] = false;
-		ff_hwaddr = get_ff_hwaddr(pxmitframe);
-#ifdef CONFIG_R8712_TX_AGGR
-		r8712_write_port(padapter, RTL8712_DMA_H2CCMD, w_sz,
-				(unsigned char *)pxmitframe);
-#else
-		r8712_write_port(padapter, ff_hwaddr, w_sz,
-			   (unsigned char *)pxmitframe);
-#endif
-		mem_addr += w_sz;
-		mem_addr = (u8 *)RND4(((addr_t)(mem_addr)));
-	}
-}
-
-void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
-	int res;
-
-	res = r8712_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
-	pxmitframe->pkt = NULL;
-	if (res == _SUCCESS)
-		dump_xframe(padapter, pxmitframe);
-}
-
-int r8712_xmit_enqueue(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
-	if (r8712_xmit_classifier(padapter, pxmitframe)) {
-		pxmitframe->pkt = NULL;
-		return _FAIL;
-	}
-	return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl8712_xmit.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL8712_XMIT_H_
-#define _RTL8712_XMIT_H_
-
-#define HWXMIT_ENTRY	4
-
-#define VO_QUEUE_INX	0
-#define VI_QUEUE_INX	1
-#define BE_QUEUE_INX	2
-#define BK_QUEUE_INX	3
-#define TS_QUEUE_INX	4
-#define MGT_QUEUE_INX	5
-#define BMC_QUEUE_INX	6
-#define BCN_QUEUE_INX	7
-
-#define HW_QUEUE_ENTRY	8
-
-#define TXDESC_SIZE 32
-#define TXDESC_OFFSET TXDESC_SIZE
-
-#define NR_AMSDU_XMITFRAME 8
-#define NR_TXAGG_XMITFRAME 8
-
-#define MAX_AMSDU_XMITBUF_SZ 8704
-#define MAX_TXAGG_XMITBUF_SZ 16384 /*16k*/
-
-#define tx_cmd tx_desc
-
-/*
- *defined for TX DESC Operation
- */
-
-#define MAX_TID (15)
-
-/*OFFSET 0*/
-#define OFFSET_SZ (0)
-#define OFFSET_SHT (16)
-#define OWN	BIT(31)
-#define FSG	BIT(27)
-#define LSG	BIT(26)
-#define TYPE_SHT (24)
-#define TYPE_MSK (0x03000000)
-
-/*OFFSET 4*/
-#define PKT_OFFSET_SZ (0)
-#define QSEL_SHT (8)
-#define HWPC BIT(31)
-
-/*OFFSET 8*/
-#define BMC BIT(7)
-#define BK BIT(30)
-#define AGG_EN BIT(29)
-#define RTS_RC_SHT (16)
-
-/*OFFSET 12*/
-#define SEQ_SHT (16)
-
-/*OFFSET 16*/
-#define TXBW BIT(18)
-
-/*OFFSET 20*/
-#define DISFB BIT(15)
-#define RSVD6_MSK (0x00E00000)
-#define RSVD6_SHT (21)
-
-struct tx_desc {
-	/*DWORD 0*/
-	__le32 txdw0;
-	__le32 txdw1;
-	__le32 txdw2;
-	__le32 txdw3;
-	__le32 txdw4;
-	__le32 txdw5;
-	__le32 txdw6;
-	__le32 txdw7;
-};
-
-union txdesc {
-	struct tx_desc txdesc;
-	unsigned int value[TXDESC_SIZE >> 2];
-};
-
-int r8712_xmitframe_complete(struct _adapter *padapter,
-			     struct xmit_priv *pxmitpriv,
-			     struct xmit_buf *pxmitbuf);
-void r8712_do_queue_select(struct _adapter *padapter,
-			   struct pkt_attrib *pattrib);
-
-#ifdef CONFIG_R8712_TX_AGGR
-void r8712_xmitframe_aggr_1st(struct xmit_buf *pxmitbuf,
-			      struct xmit_frame *pxmitframe);
-void r8712_dump_aggr_xframe(struct xmit_buf *pxmitbuf,
-			    struct xmit_frame *pxmitframe);
-#endif
-
-#endif
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ /dev/null
@@ -1,796 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_cmd.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_CMD_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/usb.h>
-#include <linux/usb/ch9.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/semaphore.h>
-#include <linux/rtnetlink.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-
-/*
- * Caller and the r8712_cmd_thread can protect cmd_q by spin_lock.
- * No irqsave is necessary.
- */
-
-int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv)
-{
-	init_completion(&pcmdpriv->cmd_queue_comp);
-	init_completion(&pcmdpriv->terminate_cmdthread_comp);
-
-	_init_queue(&(pcmdpriv->cmd_queue));
-
-	/* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
-	pcmdpriv->cmd_seq = 1;
-	pcmdpriv->cmd_allocated_buf = kmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ,
-					      GFP_ATOMIC);
-	if (!pcmdpriv->cmd_allocated_buf)
-		return -ENOMEM;
-	pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf  +  CMDBUFF_ALIGN_SZ -
-			    ((addr_t)(pcmdpriv->cmd_allocated_buf) &
-			    (CMDBUFF_ALIGN_SZ - 1));
-	pcmdpriv->rsp_allocated_buf = kmalloc(MAX_RSPSZ + 4, GFP_ATOMIC);
-	if (!pcmdpriv->rsp_allocated_buf) {
-		kfree(pcmdpriv->cmd_allocated_buf);
-		pcmdpriv->cmd_allocated_buf = NULL;
-		return -ENOMEM;
-	}
-	pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf  +  4 -
-			    ((addr_t)(pcmdpriv->rsp_allocated_buf) & 3);
-	pcmdpriv->cmd_issued_cnt = 0;
-	pcmdpriv->cmd_done_cnt = 0;
-	pcmdpriv->rsp_cnt = 0;
-	return 0;
-}
-
-int r8712_init_evt_priv(struct evt_priv *pevtpriv)
-{
-	/* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
-	pevtpriv->event_seq = 0;
-	pevtpriv->evt_allocated_buf = kmalloc(MAX_EVTSZ + 4, GFP_ATOMIC);
-
-	if (!pevtpriv->evt_allocated_buf)
-		return -ENOMEM;
-	pevtpriv->evt_buf = pevtpriv->evt_allocated_buf  +  4 -
-			    ((addr_t)(pevtpriv->evt_allocated_buf) & 3);
-	pevtpriv->evt_done_cnt = 0;
-	return 0;
-}
-
-void r8712_free_evt_priv(struct evt_priv *pevtpriv)
-{
-	kfree(pevtpriv->evt_allocated_buf);
-}
-
-void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv)
-{
-	if (pcmdpriv) {
-		kfree(pcmdpriv->cmd_allocated_buf);
-		kfree(pcmdpriv->rsp_allocated_buf);
-	}
-}
-
-/*
- * Calling Context:
- *
- * r8712_enqueue_cmd can only be called between kernel thread,
- * since only spin_lock is used.
- *
- * ISR/Call-Back functions can't call this sub-function.
- *
- */
-
-void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj)
-{
-	struct __queue *queue;
-	unsigned long irqL;
-
-	if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag)
-		return;
-	if (!obj)
-		return;
-	queue = &pcmdpriv->cmd_queue;
-	spin_lock_irqsave(&queue->lock, irqL);
-	list_add_tail(&obj->list, &queue->queue);
-	spin_unlock_irqrestore(&queue->lock, irqL);
-	complete(&pcmdpriv->cmd_queue_comp);
-}
-
-struct cmd_obj *r8712_dequeue_cmd(struct  __queue *queue)
-{
-	unsigned long irqL;
-	struct cmd_obj *obj;
-
-	spin_lock_irqsave(&queue->lock, irqL);
-	obj = list_first_entry_or_null(&queue->queue,
-				       struct cmd_obj, list);
-	if (obj)
-		list_del_init(&obj->list);
-	spin_unlock_irqrestore(&queue->lock, irqL);
-	return obj;
-}
-
-void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj)
-{
-	unsigned long irqL;
-	struct  __queue *queue;
-
-	if (!obj)
-		return;
-	if (pcmdpriv->padapter->eeprompriv.bautoload_fail_flag)
-		return;
-	queue = &pcmdpriv->cmd_queue;
-	spin_lock_irqsave(&queue->lock, irqL);
-	list_add_tail(&obj->list, &queue->queue);
-	spin_unlock_irqrestore(&queue->lock, irqL);
-	complete(&pcmdpriv->cmd_queue_comp);
-}
-
-void r8712_free_cmd_obj(struct cmd_obj *pcmd)
-{
-	if ((pcmd->cmdcode != _JoinBss_CMD_) &&
-	    (pcmd->cmdcode != _CreateBss_CMD_))
-		kfree(pcmd->parmbuf);
-	if (pcmd->rsp) {
-		if (pcmd->rspsz != 0)
-			kfree(pcmd->rsp);
-	}
-	kfree(pcmd);
-}
-
-u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
-			struct ndis_802_11_ssid *pssid)
-	__must_hold(&padapter->mlmepriv.lock)
-{
-	struct cmd_obj	*ph2c;
-	struct sitesurvey_parm	*psurveyPara;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return _FAIL;
-	psurveyPara = kmalloc(sizeof(*psurveyPara), GFP_ATOMIC);
-	if (!psurveyPara) {
-		kfree(ph2c);
-		return _FAIL;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara,
-				   GEN_CMD_CODE(_SiteSurvey));
-	psurveyPara->bsslimit = cpu_to_le32(48);
-	psurveyPara->passive_mode = cpu_to_le32(pmlmepriv->passive_mode);
-	psurveyPara->ss_ssidlen = 0;
-	memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
-	if (pssid && pssid->SsidLength) {
-		int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
-
-		memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
-		psurveyPara->ss_ssidlen = cpu_to_le32(len);
-	}
-	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-	mod_timer(&pmlmepriv->scan_to_timer,
-		  jiffies + msecs_to_jiffies(SCANNING_TIMEOUT));
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_SITE_SURVEY);
-	complete(&padapter->rx_filter_ready);
-	return _SUCCESS;
-}
-
-int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset)
-{
-	struct cmd_obj		*ph2c;
-	struct setdatarate_parm	*pbsetdataratepara;
-	struct cmd_priv		*pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return -ENOMEM;
-	pbsetdataratepara = kmalloc(sizeof(*pbsetdataratepara), GFP_ATOMIC);
-	if (!pbsetdataratepara) {
-		kfree(ph2c);
-		return -ENOMEM;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, pbsetdataratepara,
-				   GEN_CMD_CODE(_SetDataRate));
-	pbsetdataratepara->mac_id = 5;
-	memcpy(pbsetdataratepara->datarates, rateset, NumRates);
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-	return 0;
-}
-
-void r8712_set_chplan_cmd(struct _adapter *padapter, int chplan)
-{
-	struct cmd_obj *ph2c;
-	struct SetChannelPlan_param *psetchplanpara;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	psetchplanpara = kmalloc(sizeof(*psetchplanpara), GFP_ATOMIC);
-	if (!psetchplanpara) {
-		kfree(ph2c);
-		return;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, psetchplanpara,
-				GEN_CMD_CODE(_SetChannelPlan));
-	psetchplanpara->ChannelPlan = chplan;
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-int r8712_setrfreg_cmd(struct _adapter  *padapter, u8 offset, u32 val)
-{
-	struct cmd_obj *ph2c;
-	struct writeRF_parm *pwriterfparm;
-	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return -ENOMEM;
-	pwriterfparm = kmalloc(sizeof(*pwriterfparm), GFP_ATOMIC);
-	if (!pwriterfparm) {
-		kfree(ph2c);
-		return -ENOMEM;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, pwriterfparm, GEN_CMD_CODE(_SetRFReg));
-	pwriterfparm->offset = offset;
-	pwriterfparm->value = val;
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-	return 0;
-}
-
-int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval)
-{
-	struct cmd_obj *ph2c;
-	struct readRF_parm *prdrfparm;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return -ENOMEM;
-	prdrfparm = kmalloc(sizeof(*prdrfparm), GFP_ATOMIC);
-	if (!prdrfparm) {
-		kfree(ph2c);
-		return -ENOMEM;
-	}
-	INIT_LIST_HEAD(&ph2c->list);
-	ph2c->cmdcode = GEN_CMD_CODE(_GetRFReg);
-	ph2c->parmbuf = (unsigned char *)prdrfparm;
-	ph2c->cmdsz =  sizeof(struct readRF_parm);
-	ph2c->rsp = pval;
-	ph2c->rspsz = sizeof(struct readRF_rsp);
-	prdrfparm->offset = offset;
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-	return 0;
-}
-
-void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter,
-				      struct cmd_obj *pcmd)
-{
-	kfree(pcmd->parmbuf);
-	kfree(pcmd);
-	padapter->mppriv.workparam.bcompleted = true;
-}
-
-void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter,
-				struct cmd_obj *pcmd)
-{
-	kfree(pcmd->parmbuf);
-	kfree(pcmd);
-
-	padapter->mppriv.workparam.bcompleted = true;
-}
-
-int r8712_createbss_cmd(struct _adapter *padapter)
-{
-	struct cmd_obj *pcmd;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-	struct wlan_bssid_ex *pdev_network =
-				 &padapter->registrypriv.dev_network;
-
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK);
-	pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
-	if (!pcmd)
-		return -ENOMEM;
-	INIT_LIST_HEAD(&pcmd->list);
-	pcmd->cmdcode = _CreateBss_CMD_;
-	pcmd->parmbuf = (unsigned char *)pdev_network;
-	pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(pdev_network);
-	pcmd->rsp = NULL;
-	pcmd->rspsz = 0;
-	/* notes: translate IELength & Length after assign to cmdsz; */
-	pdev_network->Length = pcmd->cmdsz;
-	pdev_network->IELength = pdev_network->IELength;
-	pdev_network->Ssid.SsidLength =	pdev_network->Ssid.SsidLength;
-	r8712_enqueue_cmd(pcmdpriv, pcmd);
-	return 0;
-}
-
-int r8712_joinbss_cmd(struct _adapter  *padapter, struct wlan_network *pnetwork)
-{
-	struct wlan_bssid_ex *psecnetwork;
-	struct cmd_obj		*pcmd;
-	struct cmd_priv		*pcmdpriv = &padapter->cmdpriv;
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct qos_priv		*pqospriv = &pmlmepriv->qospriv;
-	struct security_priv	*psecuritypriv = &padapter->securitypriv;
-	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
-	enum NDIS_802_11_NETWORK_INFRASTRUCTURE ndis_network_mode =
-		pnetwork->network.InfrastructureMode;
-
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_START_TO_LINK);
-	pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
-	if (!pcmd)
-		return -ENOMEM;
-
-	/* for hidden ap to set fw_state here */
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE) !=
-	    true) {
-		switch (ndis_network_mode) {
-		case Ndis802_11IBSS:
-			pmlmepriv->fw_state |= WIFI_ADHOC_STATE;
-			break;
-		case Ndis802_11Infrastructure:
-			pmlmepriv->fw_state |= WIFI_STATION_STATE;
-			break;
-		case Ndis802_11APMode:
-		case Ndis802_11AutoUnknown:
-		case Ndis802_11InfrastructureMax:
-			break;
-		}
-	}
-	psecnetwork = &psecuritypriv->sec_bss;
-	memcpy(psecnetwork, &pnetwork->network, sizeof(*psecnetwork));
-	psecuritypriv->authenticator_ie[0] = (unsigned char)
-					     psecnetwork->IELength;
-	if ((psecnetwork->IELength - 12) < (256 - 1))
-		memcpy(&psecuritypriv->authenticator_ie[1],
-			&psecnetwork->IEs[12], psecnetwork->IELength - 12);
-	else
-		memcpy(&psecuritypriv->authenticator_ie[1],
-			&psecnetwork->IEs[12], (256 - 1));
-	psecnetwork->IELength = 0;
-	/*
-	 * If the driver wants to use the bssid to create the connection.
-	 * If not, we copy the connecting AP's MAC address to it so that
-	 * the driver just has the bssid information for PMKIDList searching.
-	 */
-	if (!pmlmepriv->assoc_by_bssid)
-		ether_addr_copy(&pmlmepriv->assoc_bssid[0],
-				&pnetwork->network.MacAddress[0]);
-	psecnetwork->IELength = r8712_restruct_sec_ie(padapter,
-						&pnetwork->network.IEs[0],
-						&psecnetwork->IEs[0],
-						pnetwork->network.IELength);
-	pqospriv->qos_option = 0;
-	if (pregistrypriv->wmm_enable) {
-		u32 tmp_len;
-
-		tmp_len = r8712_restruct_wmm_ie(padapter,
-					  &pnetwork->network.IEs[0],
-					  &psecnetwork->IEs[0],
-					  pnetwork->network.IELength,
-					  psecnetwork->IELength);
-		if (psecnetwork->IELength != tmp_len) {
-			psecnetwork->IELength = tmp_len;
-			pqospriv->qos_option = 1; /* WMM IE in beacon */
-		} else {
-			pqospriv->qos_option = 0; /* no WMM IE in beacon */
-		}
-	}
-	if (pregistrypriv->ht_enable) {
-		/*
-		 * For WEP mode, we will use the bg mode to do the connection
-		 * to avoid some IOT issues, especially for Realtek 8192u
-		 * SoftAP.
-		 */
-		if ((padapter->securitypriv.PrivacyAlgrthm != _WEP40_) &&
-		    (padapter->securitypriv.PrivacyAlgrthm != _WEP104_)) {
-			/* restructure_ht_ie */
-			r8712_restructure_ht_ie(padapter,
-						&pnetwork->network.IEs[0],
-						&psecnetwork->IEs[0],
-						pnetwork->network.IELength,
-						&psecnetwork->IELength);
-		}
-	}
-	psecuritypriv->supplicant_ie[0] = (u8)psecnetwork->IELength;
-	if (psecnetwork->IELength < 255)
-		memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0],
-			psecnetwork->IELength);
-	else
-		memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0],
-			255);
-	/* get cmdsz before endian conversion */
-	pcmd->cmdsz = r8712_get_wlan_bssid_ex_sz(psecnetwork);
-#ifdef __BIG_ENDIAN
-	/* wlan_network endian conversion */
-	psecnetwork->Length = cpu_to_le32(psecnetwork->Length);
-	psecnetwork->Ssid.SsidLength = cpu_to_le32(
-				       psecnetwork->Ssid.SsidLength);
-	psecnetwork->Privacy = cpu_to_le32(psecnetwork->Privacy);
-	psecnetwork->Rssi = cpu_to_le32(psecnetwork->Rssi);
-	psecnetwork->NetworkTypeInUse = cpu_to_le32(
-					psecnetwork->NetworkTypeInUse);
-	psecnetwork->Configuration.ATIMWindow = cpu_to_le32(
-				psecnetwork->Configuration.ATIMWindow);
-	psecnetwork->Configuration.BeaconPeriod = cpu_to_le32(
-				 psecnetwork->Configuration.BeaconPeriod);
-	psecnetwork->Configuration.DSConfig = cpu_to_le32(
-				psecnetwork->Configuration.DSConfig);
-	psecnetwork->Configuration.FHConfig.DwellTime = cpu_to_le32(
-				psecnetwork->Configuration.FHConfig.DwellTime);
-	psecnetwork->Configuration.FHConfig.HopPattern = cpu_to_le32(
-				psecnetwork->Configuration.FHConfig.HopPattern);
-	psecnetwork->Configuration.FHConfig.HopSet = cpu_to_le32(
-				psecnetwork->Configuration.FHConfig.HopSet);
-	psecnetwork->Configuration.FHConfig.Length = cpu_to_le32(
-				psecnetwork->Configuration.FHConfig.Length);
-	psecnetwork->Configuration.Length = cpu_to_le32(
-				psecnetwork->Configuration.Length);
-	psecnetwork->InfrastructureMode = cpu_to_le32(
-				psecnetwork->InfrastructureMode);
-	psecnetwork->IELength = cpu_to_le32(psecnetwork->IELength);
-#endif
-	INIT_LIST_HEAD(&pcmd->list);
-	pcmd->cmdcode = _JoinBss_CMD_;
-	pcmd->parmbuf = (unsigned char *)psecnetwork;
-	pcmd->rsp = NULL;
-	pcmd->rspsz = 0;
-	r8712_enqueue_cmd(pcmdpriv, pcmd);
-	return 0;
-}
-
-void r8712_disassoc_cmd(struct _adapter *padapter) /* for sta_mode */
-{
-	struct cmd_obj *pdisconnect_cmd;
-	struct disconnect_parm *pdisconnect;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
-	pdisconnect_cmd = kmalloc(sizeof(*pdisconnect_cmd), GFP_ATOMIC);
-	if (!pdisconnect_cmd)
-		return;
-	pdisconnect = kmalloc(sizeof(*pdisconnect), GFP_ATOMIC);
-	if (!pdisconnect) {
-		kfree(pdisconnect_cmd);
-		return;
-	}
-	init_h2fwcmd_w_parm_no_rsp(pdisconnect_cmd, pdisconnect,
-				   _DisConnect_CMD_);
-	r8712_enqueue_cmd(pcmdpriv, pdisconnect_cmd);
-}
-
-void r8712_setopmode_cmd(struct _adapter *padapter,
-		 enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
-{
-	struct cmd_obj *ph2c;
-	struct setopmode_parm *psetop;
-
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	psetop = kmalloc(sizeof(*psetop), GFP_ATOMIC);
-	if (!psetop) {
-		kfree(ph2c);
-		return;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, psetop, _SetOpMode_CMD_);
-	psetop->mode = (u8)networktype;
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key)
-{
-	struct cmd_obj *ph2c;
-	struct set_stakey_parm *psetstakey_para;
-	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
-	struct set_stakey_rsp *psetstakey_rsp = NULL;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-	struct sta_info *sta = (struct sta_info *)psta;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	psetstakey_para = kmalloc(sizeof(*psetstakey_para), GFP_ATOMIC);
-	if (!psetstakey_para) {
-		kfree(ph2c);
-		return;
-	}
-	psetstakey_rsp = kmalloc(sizeof(*psetstakey_rsp), GFP_ATOMIC);
-	if (!psetstakey_rsp) {
-		kfree(ph2c);
-		kfree(psetstakey_para);
-		return;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
-	ph2c->rsp = (u8 *)psetstakey_rsp;
-	ph2c->rspsz = sizeof(struct set_stakey_rsp);
-	ether_addr_copy(psetstakey_para->addr, sta->hwaddr);
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
-		psetstakey_para->algorithm = (unsigned char)
-					    psecuritypriv->PrivacyAlgrthm;
-	else
-		GET_ENCRY_ALGO(psecuritypriv, sta,
-			       psetstakey_para->algorithm, false);
-	if (unicast_key)
-		memcpy(&psetstakey_para->key, &sta->x_UncstKey, 16);
-	else
-		memcpy(&psetstakey_para->key,
-			&psecuritypriv->XGrpKey[
-			psecuritypriv->XGrpKeyid - 1]. skey, 16);
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr)
-{
-	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
-	struct cmd_obj *ph2c;
-	struct SetMacAddr_param	*psetMacAddr_para;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	psetMacAddr_para = kmalloc(sizeof(*psetMacAddr_para), GFP_ATOMIC);
-	if (!psetMacAddr_para) {
-		kfree(ph2c);
-		return;
-	}
-	init_h2fwcmd_w_parm_no_rsp(ph2c, psetMacAddr_para,
-				   _SetMacAddress_CMD_);
-	ether_addr_copy(psetMacAddr_para->MacAddr, mac_addr);
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
-
-void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid)
-{
-	struct cmd_priv		*pcmdpriv = &padapter->cmdpriv;
-	struct cmd_obj		*ph2c;
-	struct addBaReq_parm	*paddbareq_parm;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	paddbareq_parm = kmalloc(sizeof(*paddbareq_parm), GFP_ATOMIC);
-	if (!paddbareq_parm) {
-		kfree(ph2c);
-		return;
-	}
-	paddbareq_parm->tid = tid;
-	init_h2fwcmd_w_parm_no_rsp(ph2c, paddbareq_parm,
-				   GEN_CMD_CODE(_AddBAReq));
-	r8712_enqueue_cmd_ex(pcmdpriv, ph2c);
-}
-
-void r8712_wdg_wk_cmd(struct _adapter *padapter)
-{
-	struct cmd_obj *ph2c;
-	struct drvint_cmd_parm  *pdrvintcmd_param;
-	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	pdrvintcmd_param = kmalloc(sizeof(*pdrvintcmd_param), GFP_ATOMIC);
-	if (!pdrvintcmd_param) {
-		kfree(ph2c);
-		return;
-	}
-	pdrvintcmd_param->i_cid = WDG_WK_CID;
-	pdrvintcmd_param->sz = 0;
-	pdrvintcmd_param->pbuf = NULL;
-	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvintcmd_param, _DRV_INT_CMD_);
-	r8712_enqueue_cmd_ex(pcmdpriv, ph2c);
-}
-
-void r8712_survey_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd)
-{
-	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (pcmd->res != H2C_SUCCESS)
-		clr_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_disassoc_cmd_callback(struct _adapter *padapter,
-				 struct cmd_obj *pcmd)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (pcmd->res != H2C_SUCCESS) {
-		spin_lock_irqsave(&pmlmepriv->lock, irqL);
-		set_fwstate(pmlmepriv, _FW_LINKED);
-		spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-		return;
-	}
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_joinbss_cmd_callback(struct _adapter *padapter, struct cmd_obj *pcmd)
-{
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (pcmd->res != H2C_SUCCESS)
-		mod_timer(&pmlmepriv->assoc_timer,
-			  jiffies + msecs_to_jiffies(1));
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_createbss_cmd_callback(struct _adapter *padapter,
-				  struct cmd_obj *pcmd)
-{
-	unsigned long irqL;
-	struct sta_info *psta = NULL;
-	struct wlan_network *pwlan = NULL;
-	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)pcmd->parmbuf;
-	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
-
-	if (pcmd->res != H2C_SUCCESS)
-		mod_timer(&pmlmepriv->assoc_timer,
-			  jiffies + msecs_to_jiffies(1));
-	del_timer(&pmlmepriv->assoc_timer);
-#ifdef __BIG_ENDIAN
-	/* endian_convert */
-	pnetwork->Length = le32_to_cpu(pnetwork->Length);
-	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
-	pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy);
-	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
-	pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse);
-	pnetwork->Configuration.ATIMWindow =
-		le32_to_cpu(pnetwork->Configuration.ATIMWindow);
-	pnetwork->Configuration.DSConfig =
-		le32_to_cpu(pnetwork->Configuration.DSConfig);
-	pnetwork->Configuration.FHConfig.DwellTime =
-		le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
-	pnetwork->Configuration.FHConfig.HopPattern =
-		le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
-	pnetwork->Configuration.FHConfig.HopSet =
-		le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
-	pnetwork->Configuration.FHConfig.Length =
-		le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
-	pnetwork->Configuration.Length =
-		le32_to_cpu(pnetwork->Configuration.Length);
-	pnetwork->InfrastructureMode =
-		le32_to_cpu(pnetwork->InfrastructureMode);
-	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
-#endif
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if ((pmlmepriv->fw_state) & WIFI_AP_STATE) {
-		psta = r8712_get_stainfo(&padapter->stapriv,
-					 pnetwork->MacAddress);
-		if (!psta) {
-			psta = r8712_alloc_stainfo(&padapter->stapriv,
-						   pnetwork->MacAddress);
-			if (!psta)
-				goto createbss_cmd_fail;
-		}
-		r8712_indicate_connect(padapter);
-	} else {
-		pwlan = _r8712_alloc_network(pmlmepriv);
-		if (!pwlan) {
-			pwlan = r8712_get_oldest_wlan_network(
-				&pmlmepriv->scanned_queue);
-			if (!pwlan)
-				goto createbss_cmd_fail;
-			pwlan->last_scanned = jiffies;
-		} else {
-			list_add_tail(&(pwlan->list),
-					 &pmlmepriv->scanned_queue.queue);
-		}
-		pnetwork->Length = r8712_get_wlan_bssid_ex_sz(pnetwork);
-		memcpy(&(pwlan->network), pnetwork, pnetwork->Length);
-		pwlan->fixed = true;
-		memcpy(&tgt_network->network, pnetwork,
-			(r8712_get_wlan_bssid_ex_sz(pnetwork)));
-		if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
-			pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
-		/*
-		 * we will set _FW_LINKED when there is one more sat to
-		 * join us (stassoc_event_callback)
-		 */
-	}
-createbss_cmd_fail:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_setstaKey_cmdrsp_callback(struct _adapter *padapter,
-				     struct cmd_obj *pcmd)
-{
-	struct sta_priv *pstapriv = &padapter->stapriv;
-	struct set_stakey_rsp *psetstakey_rsp = (struct set_stakey_rsp *)
-						(pcmd->rsp);
-	struct sta_info *psta = r8712_get_stainfo(pstapriv,
-						  psetstakey_rsp->addr);
-
-	if (!psta)
-		goto exit;
-	psta->aid = psta->mac_id = psetstakey_rsp->keyid; /*CAM_ID(CAM_ENTRY)*/
-exit:
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_setassocsta_cmdrsp_callback(struct _adapter *padapter,
-				       struct cmd_obj *pcmd)
-{
-	unsigned long	irqL;
-	struct sta_priv *pstapriv = &padapter->stapriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct set_assocsta_parm *passocsta_parm =
-				(struct set_assocsta_parm *)(pcmd->parmbuf);
-	struct set_assocsta_rsp *passocsta_rsp =
-				(struct set_assocsta_rsp *) (pcmd->rsp);
-	struct sta_info *psta = r8712_get_stainfo(pstapriv,
-						  passocsta_parm->addr);
-
-	if (!psta)
-		return;
-	psta->aid = psta->mac_id = passocsta_rsp->cam_id;
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE)) &&
-	    (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)))
-		pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
-	set_fwstate(pmlmepriv, _FW_LINKED);
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	r8712_free_cmd_obj(pcmd);
-}
-
-void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl,
-			u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO)
-{
-	struct cmd_obj *ph2c;
-	struct DisconnectCtrlEx_param *param;
-	struct cmd_priv *pcmdpriv = &adapter->cmdpriv;
-
-	ph2c = kmalloc(sizeof(*ph2c), GFP_ATOMIC);
-	if (!ph2c)
-		return;
-	param = kzalloc(sizeof(*param), GFP_ATOMIC);
-	if (!param) {
-		kfree(ph2c);
-		return;
-	}
-
-	param->EnableDrvCtrl = (unsigned char)enableDrvCtrl;
-	param->TryPktCnt = (unsigned char)tryPktCnt;
-	param->TryPktInterval = (unsigned char)tryPktInterval;
-	param->FirstStageTO = (unsigned int)firstStageTO;
-
-	init_h2fwcmd_w_parm_no_rsp(ph2c, param,
-				GEN_CMD_CODE(_DisconnectCtrlEx));
-	r8712_enqueue_cmd(pcmdpriv, ph2c);
-}
--- a/drivers/staging/rtl8712/rtl871x_cmd.h
+++ /dev/null
@@ -1,761 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_CMD_H_
-#define __RTL871X_CMD_H_
-
-#include "wlan_bssdef.h"
-#include "rtl871x_rf.h"
-#define C2H_MEM_SZ (16*1024)
-
-#include "osdep_service.h"
-#include "ieee80211.h"
-
-#define FREE_CMDOBJ_SZ	128
-#define MAX_CMDSZ	512
-#define MAX_RSPSZ	512
-#define MAX_EVTSZ	1024
-#define CMDBUFF_ALIGN_SZ 512
-
-struct cmd_obj {
-	u16	cmdcode;
-	u8	res;
-	u8	*parmbuf;
-	u32	cmdsz;
-	u8	*rsp;
-	u32	rspsz;
-	struct list_head list;
-};
-
-struct cmd_priv {
-	struct completion cmd_queue_comp;
-	struct completion terminate_cmdthread_comp;
-	struct  __queue	cmd_queue;
-	u8 cmd_seq;
-	u8 *cmd_buf;	/*shall be non-paged, and 4 bytes aligned*/
-	u8 *cmd_allocated_buf;
-	u8 *rsp_buf;	/*shall be non-paged, and 4 bytes aligned*/
-	u8 *rsp_allocated_buf;
-	u32 cmd_issued_cnt;
-	u32 cmd_done_cnt;
-	u32 rsp_cnt;
-	struct _adapter *padapter;
-};
-
-struct evt_obj {
-	u16 evtcode;
-	u8 res;
-	u8 *parmbuf;
-	u32 evtsz;
-	struct list_head list;
-};
-
-struct	evt_priv {
-	struct  __queue	evt_queue;
-	u8	event_seq;
-	u8	*evt_buf;	/*shall be non-paged, and 4 bytes aligned*/
-	u8	*evt_allocated_buf;
-	u32	evt_done_cnt;
-};
-
-#define init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code) \
-do {\
-	INIT_LIST_HEAD(&pcmd->list);\
-	pcmd->cmdcode = code;\
-	pcmd->parmbuf = (u8 *)(pparm);\
-	pcmd->cmdsz = sizeof(*pparm);\
-	pcmd->rsp = NULL;\
-	pcmd->rspsz = 0;\
-} while (0)
-
-void r8712_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
-void r8712_enqueue_cmd_ex(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
-struct cmd_obj *r8712_dequeue_cmd(struct  __queue *queue);
-void r8712_free_cmd_obj(struct cmd_obj *pcmd);
-int r8712_cmd_thread(void *context);
-int r8712_init_cmd_priv(struct cmd_priv *pcmdpriv);
-void r8712_free_cmd_priv(struct cmd_priv *pcmdpriv);
-int r8712_init_evt_priv(struct evt_priv *pevtpriv);
-void r8712_free_evt_priv(struct evt_priv *pevtpriv);
-
-enum rtl871x_drvint_cid {
-	NONE_WK_CID,
-	WDG_WK_CID,
-	MAX_WK_CID
-};
-
-enum RFINTFS {
-	SWSI,
-	HWSI,
-	HWPI,
-};
-
-/*
- * Caller Mode: Infra, Ad-HoC(C)
- * Notes: To enter USB suspend mode
- * Command Mode
- */
-struct usb_suspend_parm {
-	u32 action; /* 1: sleep, 0:resume */
-};
-
-/*
- * Caller Mode: Infra, Ad-HoC(C)
- * Notes: To disconnect the current associated BSS
- * Command Mode
- */
-struct disconnect_parm {
-	u32 rsvd;
-};
-
-/*
- * Caller Mode: AP, Ad-HoC, Infra
- * Notes: To set the NIC mode of RTL8711
- * Command Mode
- * The definition of mode:
- *
- * #define IW_MODE_AUTO	0	// Let the driver decides which AP to join
- * #define IW_MODE_ADHOC	1	// Single cell network (Ad-Hoc Clients)
- * #define IW_MODE_INFRA	2	// Multi cell network, roaming, ..
- * #define IW_MODE_MASTER	3	// Synchronisation master or AP
- * #define IW_MODE_REPEAT	4	// Wireless Repeater (forwarder)
- * #define IW_MODE_SECOND	5	// Secondary master/repeater (backup)
- * #define IW_MODE_MONITOR	6	// Passive monitor (listen only)
- */
-struct	setopmode_parm {
-	u8	mode;
-	u8	rsvd[3];
-};
-
-/*
- * Caller Mode: AP, Ad-HoC, Infra
- * Notes: To ask RTL8711 performing site-survey
- * Command-Event Mode
- */
-struct sitesurvey_parm {
-	__le32	passive_mode;	/*active: 1, passive: 0 */
-	__le32	bsslimit;	/* 1 ~ 48 */
-	__le32	ss_ssidlen;
-	u8	ss_ssid[IW_ESSID_MAX_SIZE + 1];
-};
-
-/*
- * Caller Mode: Any
- * Notes: To set the auth type of RTL8711. open/shared/802.1x
- * Command Mode
- */
-struct setauth_parm {
-	u8 mode;  /*0: legacy open, 1: legacy shared 2: 802.1x*/
-	u8 _1x;   /*0: PSK, 1: TLS*/
-	u8 rsvd[2];
-};
-
-/*
- * Caller Mode: Infra
- * a. algorithm: wep40, wep104, tkip & aes
- * b. keytype: grp key/unicast key
- * c. key contents
- *
- * when shared key ==> keyid is the camid
- * when 802.1x ==> keyid [0:1] ==> grp key
- * when 802.1x ==> keyid > 2 ==> unicast key
- */
-struct setkey_parm {
-	u8	algorithm;	/* encryption algorithm, could be none, wep40,
-				 * TKIP, CCMP, wep104
-				 */
-	u8	keyid;
-	u8	grpkey;		/* 1: this is the grpkey for 802.1x.
-				 * 0: this is the unicast key for 802.1x
-				 */
-	u8	key[16];	/* this could be 40 or 104 */
-};
-
-/*
- * When in AP or Ad-Hoc mode, this is used to
- * allocate an sw/hw entry for a newly associated sta.
- * Command
- * when shared key ==> algorithm/keyid
- */
-struct set_stakey_parm {
-	u8	addr[ETH_ALEN];
-	u8	algorithm;
-	u8	key[16];
-};
-
-struct set_stakey_rsp {
-	u8	addr[ETH_ALEN];
-	u8	keyid;
-	u8	rsvd;
-};
-
-struct SetMacAddr_param {
-	u8	MacAddr[ETH_ALEN];
-};
-
-/*
- *	Caller Ad-Hoc/AP
- *
- *	Command -Rsp(AID == CAMID) mode
- *
- *	This is to force fw to add an sta_data entry per driver's request.
- *
- *	FW will write an cam entry associated with it.
- *
- */
-struct set_assocsta_parm {
-	u8	addr[ETH_ALEN];
-};
-
-struct set_assocsta_rsp {
-	u8	cam_id;
-	u8	rsvd[3];
-};
-
-/*
- *	Caller Ad-Hoc/AP
- *
- *	Command mode
- *
- *	This is to force fw to del an sta_data entry per driver's request
- *
- *	FW will invalidate the cam entry associated with it.
- *
- */
-struct del_assocsta_parm {
-	u8	addr[ETH_ALEN];
-};
-
-/*
- *	Caller Mode: AP/Ad-HoC(M)
- *
- *	Notes: To notify fw that given staid has changed its power state
- *
- *	Command Mode
- *
- */
-struct setstapwrstate_parm {
-	u8	staid;
-	u8	status;
-	u8	hwaddr[6];
-};
-
-/*
- *	Caller Mode: Any
- *
- *	Notes: To setup the basic rate of RTL8711
- *
- *	Command Mode
- *
- */
-struct	setbasicrate_parm {
-	u8	basicrates[NumRates];
-};
-
-/*
- *	Caller Mode: Any
- *
- *	Notes: To read the current basic rate
- *
- *	Command-Rsp Mode
- *
- */
-struct getbasicrate_parm {
-	u32 rsvd;
-};
-
-struct getbasicrate_rsp {
-	u8 basicrates[NumRates];
-};
-
-/*
- *	Caller Mode: Any
- *
- *	Notes: To setup the data rate of RTL8711
- *
- *	Command Mode
- *
- */
-struct setdatarate_parm {
-	u8	mac_id;
-	u8	datarates[NumRates];
-};
-
-enum _RT_CHANNEL_DOMAIN {
-	RT_CHANNEL_DOMAIN_FCC = 0,
-	RT_CHANNEL_DOMAIN_IC = 1,
-	RT_CHANNEL_DOMAIN_ETSI = 2,
-	RT_CHANNEL_DOMAIN_SPAIN = 3,
-	RT_CHANNEL_DOMAIN_FRANCE = 4,
-	RT_CHANNEL_DOMAIN_MKK = 5,
-	RT_CHANNEL_DOMAIN_MKK1 = 6,
-	RT_CHANNEL_DOMAIN_ISRAEL = 7,
-	RT_CHANNEL_DOMAIN_TELEC = 8,
-
-	/* Be compatible with old channel plan. No good! */
-	RT_CHANNEL_DOMAIN_MIC = 9,
-	RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN = 10,
-	RT_CHANNEL_DOMAIN_WORLD_WIDE_13 = 11,
-	RT_CHANNEL_DOMAIN_TELEC_NETGEAR = 12,
-
-	RT_CHANNEL_DOMAIN_NCC = 13,
-	RT_CHANNEL_DOMAIN_5G = 14,
-	RT_CHANNEL_DOMAIN_5G_40M = 15,
- /*===== Add new channel plan above this line===============*/
-	RT_CHANNEL_DOMAIN_MAX,
-};
-
-struct SetChannelPlan_param {
-	enum _RT_CHANNEL_DOMAIN ChannelPlan;
-};
-
-/*
- *	Caller Mode: Any
- *
- *	Notes: To read the current data rate
- *
- *	Command-Rsp Mode
- *
- */
-struct getdatarate_parm {
-	u32 rsvd;
-
-};
-
-struct getdatarate_rsp {
-	u8 datarates[NumRates];
-};
-
-/*
- *	Caller Mode: Any
- *	AP: AP can use the info for the contents of beacon frame
- *	Infra: STA can use the info when sitesurveying
- *	Ad-HoC(M): Like AP
- *	Ad-HoC(C): Like STA
- *
- *
- *	Notes: To set the phy capability of the NIC
- *
- *	Command Mode
- *
- */
-
-/*
- *	Caller Mode: Any
- *
- *	Notes: To set the channel/modem/band
- *	This command will be used when channel/modem/band is changed.
- *
- *	Command Mode
- *
- */
-/*
- *	Caller Mode: Any
- *
- *	Notes: To get the current setting of channel/modem/band
- *
- *	Command-Rsp Mode
- *
- */
-struct	getphy_rsp {
-	u8	rfchannel;
-	u8	modem;
-};
-
-struct readBB_parm {
-	u8	offset;
-};
-
-struct readBB_rsp {
-	u8	value;
-};
-
-struct readTSSI_parm {
-	u8	offset;
-};
-
-struct readTSSI_rsp {
-	u8	value;
-};
-
-struct writeBB_parm {
-	u8	offset;
-	u8	value;
-};
-
-struct writePTM_parm {
-	u8	type;
-};
-
-struct readRF_parm {
-	u8	offset;
-};
-
-struct readRF_rsp {
-	u32	value;
-};
-
-struct writeRF_parm {
-	u32	offset;
-	u32	value;
-};
-
-struct setrfintfs_parm {
-	u8	rfintfs;
-};
-
-struct getrfintfs_parm {
-	u8	rfintfs;
-};
-
-/*
- *	Notes: This command is used for H2C/C2H loopback testing
- *
- *	mac[0] == 0
- *	==> CMD mode, return H2C_SUCCESS.
- *	The following condition must be true under CMD mode
- *		mac[1] == mac[4], mac[2] == mac[3], mac[0]=mac[5]= 0;
- *		s0 == 0x1234, s1 == 0xabcd, w0 == 0x78563412, w1 == 0x5aa5def7;
- *		s2 == (b1 << 8 | b0);
- *
- *	mac[0] == 1
- *	==> CMD_RSP mode, return H2C_SUCCESS_RSP
- *
- *	The rsp layout shall be:
- *	rsp:			parm:
- *		mac[0]  =   mac[5];
- *		mac[1]  =   mac[4];
- *		mac[2]  =   mac[3];
- *		mac[3]  =   mac[2];
- *		mac[4]  =   mac[1];
- *		mac[5]  =   mac[0];
- *		s0		=   s1;
- *		s1		=   swap16(s0);
- *		w0		=	swap32(w1);
- *		b0		=	b1
- *		s2		=	s0 + s1
- *		b1		=	b0
- *		w1		=	w0
- *
- *	mac[0] ==	2
- *	==> CMD_EVENT mode, return	H2C_SUCCESS
- *	The event layout shall be:
- *	event:	     parm:
- *	mac[0]  =   mac[5];
- *	mac[1]  =   mac[4];
- *	mac[2]  =   event's sequence number, starting from 1 to parm's marc[3]
- *	mac[3]  =   mac[2];
- *	mac[4]  =   mac[1];
- *	mac[5]  =   mac[0];
- *	s0		=   swap16(s0) - event.mac[2];
- *	s1		=   s1 + event.mac[2];
- *	w0		=	swap32(w0);
- *	b0		=	b1
- *	s2		=	s0 + event.mac[2]
- *	b1		=	b0
- *	w1		=	swap32(w1) - event.mac[2];
- *
- *	parm->mac[3] is the total event counts that host requested.
- *
- *
- *	event will be the same with the cmd's param.
- *
- */
-
-/* CMD param Formart for DRV INTERNAL CMD HDL*/
-struct drvint_cmd_parm {
-	int i_cid; /*internal cmd id*/
-	int sz; /* buf sz*/
-	unsigned char *pbuf;
-};
-
-/*------------------- Below are used for RF/BB tuning ---------------------*/
-
-struct	setantenna_parm {
-	u8	tx_antset;
-	u8	rx_antset;
-	u8	tx_antenna;
-	u8	rx_antenna;
-};
-
-struct	enrateadaptive_parm {
-	u32	en;
-};
-
-struct settxagctbl_parm {
-	u32	txagc[MAX_RATES_LENGTH];
-};
-
-struct gettxagctbl_parm {
-	u32 rsvd;
-};
-
-struct gettxagctbl_rsp {
-	u32	txagc[MAX_RATES_LENGTH];
-};
-
-struct setagcctrl_parm {
-	u32	agcctrl;	/* 0: pure hw, 1: fw */
-};
-
-struct setssup_parm	{
-	u32	ss_ForceUp[MAX_RATES_LENGTH];
-};
-
-struct getssup_parm	{
-	u32 rsvd;
-};
-
-struct getssup_rsp	{
-	u8	ss_ForceUp[MAX_RATES_LENGTH];
-};
-
-struct setssdlevel_parm	{
-	u8	ss_DLevel[MAX_RATES_LENGTH];
-};
-
-struct getssdlevel_parm	{
-	u32 rsvd;
-};
-
-struct getssdlevel_rsp	{
-	u8	ss_DLevel[MAX_RATES_LENGTH];
-};
-
-struct setssulevel_parm	{
-	u8	ss_ULevel[MAX_RATES_LENGTH];
-};
-
-struct getssulevel_parm	{
-	u32 rsvd;
-};
-
-struct getssulevel_rsp	{
-	u8	ss_ULevel[MAX_RATES_LENGTH];
-};
-
-struct	setcountjudge_parm {
-	u8	count_judge[MAX_RATES_LENGTH];
-};
-
-struct	getcountjudge_parm {
-	u32 rsvd;
-};
-
-struct	getcountjudge_rsp {
-	u8	count_judge[MAX_RATES_LENGTH];
-};
-
-struct setpwrmode_parm  {
-	u8	mode;
-	u8	flag_low_traffic_en;
-	u8	flag_lpnav_en;
-	u8	flag_rf_low_snr_en;
-	u8	flag_dps_en; /* 1: dps, 0: 32k */
-	u8	bcn_rx_en;
-	u8	bcn_pass_cnt;	  /* fw report one beacon information to
-				   * driver  when it receives bcn_pass_cnt
-				   * beacons.
-				   */
-	u8	bcn_to;		  /* beacon TO (ms). ¡§=0¡¨ no limit.*/
-	u16	bcn_itv;
-	u8	app_itv; /* only for VOIP mode. */
-	u8	awake_bcn_itv;
-	u8	smart_ps;
-	u8	bcn_pass_time;	/* unit: 100ms */
-};
-
-struct setatim_parm {
-	u8 op;   /*0: add, 1:del*/
-	u8 txid; /* id of dest station.*/
-};
-
-struct setratable_parm {
-	u8 ss_ForceUp[NumRates];
-	u8 ss_ULevel[NumRates];
-	u8 ss_DLevel[NumRates];
-	u8 count_judge[NumRates];
-};
-
-struct getratable_parm {
-	uint rsvd;
-};
-
-struct getratable_rsp {
-	u8 ss_ForceUp[NumRates];
-	u8 ss_ULevel[NumRates];
-	u8 ss_DLevel[NumRates];
-	u8 count_judge[NumRates];
-};
-
-/*to get TX,RX retry count*/
-struct gettxretrycnt_parm {
-	unsigned int rsvd;
-};
-
-struct gettxretrycnt_rsp {
-	unsigned long tx_retrycnt;
-};
-
-struct getrxretrycnt_parm {
-	unsigned int rsvd;
-};
-
-struct getrxretrycnt_rsp {
-	unsigned long rx_retrycnt;
-};
-
-/*to get BCNOK,BCNERR count*/
-struct getbcnokcnt_parm {
-	unsigned int rsvd;
-};
-
-struct getbcnokcnt_rsp {
-	unsigned long bcnokcnt;
-};
-
-struct getbcnerrcnt_parm {
-	unsigned int rsvd;
-};
-
-struct getbcnerrcnt_rsp {
-	unsigned long bcnerrcnt;
-};
-
-/* to get current TX power level*/
-struct getcurtxpwrlevel_parm {
-	unsigned int rsvd;
-};
-
-struct getcurtxpwrlevel_rsp {
-	unsigned short tx_power;
-};
-
-/*dynamic on/off DIG*/
-struct setdig_parm {
-	unsigned char dig_on;	/* 1:on , 0:off */
-};
-
-/*dynamic on/off RA*/
-struct setra_parm {
-	unsigned char ra_on;	/* 1:on , 0:off */
-};
-
-struct setprobereqextraie_parm {
-	unsigned char e_id;
-	unsigned char ie_len;
-	unsigned char ie[];
-};
-
-struct setassocreqextraie_parm {
-	unsigned char e_id;
-	unsigned char ie_len;
-	unsigned char ie[];
-};
-
-struct setproberspextraie_parm {
-	unsigned char e_id;
-	unsigned char ie_len;
-	unsigned char ie[];
-};
-
-struct setassocrspextraie_parm {
-	unsigned char e_id;
-	unsigned char ie_len;
-	unsigned char ie[];
-};
-
-struct addBaReq_parm {
-	unsigned int tid;
-};
-
-/*H2C Handler index: 46 */
-struct SetChannel_parm {
-	u32 curr_ch;
-};
-
-/*H2C Handler index: 61 */
-struct DisconnectCtrlEx_param {
-	/* MAXTIME = (2 * FirstStageTO) + (TryPktCnt * TryPktInterval) */
-	unsigned char EnableDrvCtrl;
-	unsigned char TryPktCnt;
-	unsigned char TryPktInterval; /* Unit: ms */
-	unsigned char rsvd;
-	unsigned int  FirstStageTO; /* Unit: ms */
-};
-
-#define GEN_CMD_CODE(cmd)	cmd ## _CMD_
-
-/*
- * Result:
- * 0x00: success
- * 0x01: success, and check Response.
- * 0x02: cmd ignored due to duplicated sequence number
- * 0x03: cmd dropped due to invalid cmd code
- * 0x04: reserved.
- */
-
-#define H2C_RSP_OFFSET			512
-#define H2C_SUCCESS			0x00
-#define H2C_SUCCESS_RSP			0x01
-#define H2C_DUPLICATED			0x02
-#define H2C_DROPPED			0x03
-#define H2C_PARAMETERS_ERROR		0x04
-#define H2C_REJECTED			0x05
-#define H2C_CMD_OVERFLOW		0x06
-#define H2C_RESERVED			0x07
-
-void r8712_setMacAddr_cmd(struct _adapter *padapter, const u8 *mac_addr);
-u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
-			struct ndis_802_11_ssid *pssid);
-int r8712_createbss_cmd(struct _adapter *padapter);
-void r8712_setstakey_cmd(struct _adapter *padapter, u8 *psta, u8 unicast_key);
-int r8712_joinbss_cmd(struct _adapter *padapter,
-		      struct wlan_network *pnetwork);
-void r8712_disassoc_cmd(struct _adapter *padapter);
-void r8712_setopmode_cmd(struct _adapter *padapter,
-		 enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
-int r8712_setdatarate_cmd(struct _adapter *padapter, u8 *rateset);
-void r8712_set_chplan_cmd(struct _adapter  *padapter, int chplan);
-int r8712_getrfreg_cmd(struct _adapter *padapter, u8 offset, u8 *pval);
-int r8712_setrfreg_cmd(struct _adapter  *padapter, u8 offset, u32 val);
-void r8712_addbareq_cmd(struct _adapter *padapter, u8 tid);
-void r8712_wdg_wk_cmd(struct _adapter *padapter);
-void r8712_survey_cmd_callback(struct _adapter  *padapter,
-			       struct cmd_obj *pcmd);
-void r8712_disassoc_cmd_callback(struct _adapter  *padapter,
-				 struct cmd_obj *pcmd);
-void r8712_joinbss_cmd_callback(struct _adapter  *padapter,
-				struct cmd_obj *pcmd);
-void r8712_createbss_cmd_callback(struct _adapter *padapter,
-				  struct cmd_obj *pcmd);
-void r8712_getbbrfreg_cmdrsp_callback(struct _adapter *padapter,
-				      struct cmd_obj *pcmd);
-void r8712_readtssi_cmdrsp_callback(struct _adapter *padapter,
-				struct cmd_obj *pcmd);
-void r8712_setstaKey_cmdrsp_callback(struct _adapter  *padapter,
-				     struct cmd_obj *pcmd);
-void r8712_setassocsta_cmdrsp_callback(struct _adapter  *padapter,
-				       struct cmd_obj *pcmd);
-void r8712_disconnectCtrlEx_cmd(struct _adapter *adapter, u32 enableDrvCtrl,
-			u32 tryPktCnt, u32 tryPktInterval, u32 firstStageTO);
-
-struct _cmd_callback {
-	u32	cmd_code;
-	void (*callback)(struct _adapter  *padapter, struct cmd_obj *cmd);
-};
-
-#include "rtl8712_cmd.h"
-
-#endif /* _CMD_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_debug.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_DEBUG_H__
-#define __RTL871X_DEBUG_H__
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define _drv_emerg_			1
-#define _drv_alert_			2
-#define _drv_crit_			3
-#define _drv_err_			4
-#define	_drv_warning_			5
-#define _drv_notice_			6
-#define _drv_info_			7
-#define _drv_dump_			8
-#define	_drv_debug_			9
-
-#define _module_rtl871x_xmit_c_		BIT(0)
-#define _module_xmit_osdep_c_		BIT(1)
-#define _module_rtl871x_recv_c_		BIT(2)
-#define _module_recv_osdep_c_		BIT(3)
-#define _module_rtl871x_mlme_c_		BIT(4)
-#define	_module_mlme_osdep_c_		BIT(5)
-#define _module_rtl871x_sta_mgt_c_	BIT(6)
-#define _module_rtl871x_cmd_c_		BIT(7)
-#define	_module_cmd_osdep_c_		BIT(8)
-#define _module_rtl871x_io_c_		BIT(9)
-#define	_module_io_osdep_c_		BIT(10)
-#define _module_os_intfs_c_		BIT(11)
-#define _module_rtl871x_security_c_	BIT(12)
-#define _module_rtl871x_eeprom_c_	BIT(13)
-#define _module_hal_init_c_		BIT(14)
-#define _module_hci_hal_init_c_		BIT(15)
-#define _module_rtl871x_ioctl_c_	BIT(16)
-#define _module_rtl871x_ioctl_set_c_	BIT(17)
-#define _module_rtl871x_pwrctrl_c_	BIT(19)
-#define _module_hci_intfs_c_		BIT(20)
-#define _module_hci_ops_c_		BIT(21)
-#define _module_osdep_service_c_	BIT(22)
-#define _module_rtl871x_mp_ioctl_c_	BIT(23)
-#define _module_hci_ops_os_c_		BIT(24)
-#define _module_rtl871x_ioctl_os_c	BIT(25)
-#define _module_rtl8712_cmd_c_		BIT(26)
-#define _module_rtl871x_mp_c_		BIT(27)
-#define _module_rtl8712_xmit_c_		BIT(28)
-#define _module_rtl8712_efuse_c_	BIT(29)
-#define _module_rtl8712_recv_c_		BIT(30)
-#define _module_rtl8712_led_c_		BIT(31)
-
-#undef _MODULE_DEFINE_
-
-#if defined _RTL871X_XMIT_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_xmit_c_
-#elif defined _XMIT_OSDEP_C_
-	#define _MODULE_DEFINE_	_module_xmit_osdep_c_
-#elif defined _RTL871X_RECV_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_recv_c_
-#elif defined _RECV_OSDEP_C_
-	#define _MODULE_DEFINE_	_module_recv_osdep_c_
-#elif defined _RTL871X_MLME_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_mlme_c_
-#elif defined _MLME_OSDEP_C_
-	#define _MODULE_DEFINE_	_module_mlme_osdep_c_
-#elif defined _RTL871X_STA_MGT_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_sta_mgt_c_
-#elif defined _RTL871X_CMD_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_cmd_c_
-#elif defined _CMD_OSDEP_C_
-	#define _MODULE_DEFINE_	_module_cmd_osdep_c_
-#elif defined _RTL871X_IO_C_
-	#define _MODULE_DEFINE_	_module_rtl871x_io_c_
-#elif defined _IO_OSDEP_C_
-	#define _MODULE_DEFINE_	_module_io_osdep_c_
-#elif defined _OS_INTFS_C_
-	#define	_MODULE_DEFINE_	_module_os_intfs_c_
-#elif defined _RTL871X_SECURITY_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_security_c_
-#elif defined _RTL871X_EEPROM_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_eeprom_c_
-#elif defined _HAL_INIT_C_
-	#define	_MODULE_DEFINE_	_module_hal_init_c_
-#elif defined _HCI_HAL_INIT_C_
-	#define	_MODULE_DEFINE_	_module_hci_hal_init_c_
-#elif defined _RTL871X_IOCTL_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_c_
-#elif defined _RTL871X_IOCTL_SET_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_set_c_
-#elif defined _RTL871X_PWRCTRL_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_pwrctrl_c_
-#elif defined _HCI_INTF_C_
-	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
-#elif defined _HCI_OPS_C_
-	#define	_MODULE_DEFINE_	_module_hci_ops_c_
-#elif defined _OSDEP_HCI_INTF_C_
-	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
-#elif defined _OSDEP_SERVICE_C_
-	#define	_MODULE_DEFINE_	_module_osdep_service_c_
-#elif defined _RTL871X_MP_IOCTL_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_mp_ioctl_c_
-#elif defined _HCI_OPS_OS_C_
-	#define	_MODULE_DEFINE_	_module_hci_ops_os_c_
-#elif defined _RTL871X_IOCTL_LINUX_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_os_c
-#elif defined _RTL871X_MP_C_
-	#define	_MODULE_DEFINE_	_module_rtl871x_mp_c_
-#elif defined _RTL8712_CMD_C_
-	#define	_MODULE_DEFINE_	_module_rtl8712_cmd_c_
-#elif defined _RTL8712_XMIT_C_
-	#define	_MODULE_DEFINE_	_module_rtl8712_xmit_c_
-#elif defined _RTL8712_EFUSE_C_
-	#define	_MODULE_DEFINE_	_module_rtl8712_efuse_c_
-#elif defined _RTL8712_RECV_C_
-	#define	_MODULE_DEFINE_	_module_rtl8712_recv_c_
-#else
-	#undef	_MODULE_DEFINE_
-#endif
-
-#endif	/*__RTL871X_DEBUG_H__*/
--- a/drivers/staging/rtl8712/rtl871x_eeprom.c
+++ /dev/null
@@ -1,220 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_eeprom.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_EEPROM_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-static void up_clk(struct _adapter *padapter, u16 *x)
-{
-	*x = *x | _EESK;
-	r8712_write8(padapter, EE_9346CR, (u8)*x);
-	udelay(CLOCK_RATE);
-}
-
-static void down_clk(struct _adapter *padapter, u16 *x)
-{
-	*x = *x & ~_EESK;
-	r8712_write8(padapter, EE_9346CR, (u8)*x);
-	udelay(CLOCK_RATE);
-}
-
-static void shift_out_bits(struct _adapter *padapter, u16 data, u16 count)
-{
-	u16 x, mask;
-
-	if (padapter->surprise_removed)
-		goto out;
-	mask = 0x01 << (count - 1);
-	x = r8712_read8(padapter, EE_9346CR);
-	x &= ~(_EEDO | _EEDI);
-	do {
-		x &= ~_EEDI;
-		if (data & mask)
-			x |= _EEDI;
-		if (padapter->surprise_removed)
-			goto out;
-		r8712_write8(padapter, EE_9346CR, (u8)x);
-		udelay(CLOCK_RATE);
-		up_clk(padapter, &x);
-		down_clk(padapter, &x);
-		mask >>= 1;
-	} while (mask);
-	if (padapter->surprise_removed)
-		goto out;
-	x &= ~_EEDI;
-	r8712_write8(padapter, EE_9346CR, (u8)x);
-out:;
-}
-
-static u16 shift_in_bits(struct _adapter *padapter)
-{
-	u16 x, d = 0, i;
-
-	if (padapter->surprise_removed)
-		goto out;
-	x = r8712_read8(padapter, EE_9346CR);
-	x &= ~(_EEDO | _EEDI);
-	d = 0;
-	for (i = 0; i < 16; i++) {
-		d <<= 1;
-		up_clk(padapter, &x);
-		if (padapter->surprise_removed)
-			goto out;
-		x = r8712_read8(padapter, EE_9346CR);
-		x &= ~(_EEDI);
-		if (x & _EEDO)
-			d |= 1;
-		down_clk(padapter, &x);
-	}
-out:
-	return d;
-}
-
-static void standby(struct _adapter *padapter)
-{
-	u8   x;
-
-	x = r8712_read8(padapter, EE_9346CR);
-	x &= ~(_EECS | _EESK);
-	r8712_write8(padapter, EE_9346CR, x);
-	udelay(CLOCK_RATE);
-	x |= _EECS;
-	r8712_write8(padapter, EE_9346CR, x);
-	udelay(CLOCK_RATE);
-}
-
-static u16 wait_eeprom_cmd_done(struct _adapter *padapter)
-{
-	u8	x;
-	u16	i;
-
-	standby(padapter);
-	for (i = 0; i < 200; i++) {
-		x = r8712_read8(padapter, EE_9346CR);
-		if (x & _EEDO)
-			return true;
-		udelay(CLOCK_RATE);
-	}
-	return false;
-}
-
-static void eeprom_clean(struct _adapter *padapter)
-{
-	u16 x;
-
-	if (padapter->surprise_removed)
-		return;
-	x = r8712_read8(padapter, EE_9346CR);
-	if (padapter->surprise_removed)
-		return;
-	x &= ~(_EECS | _EEDI);
-	r8712_write8(padapter, EE_9346CR, (u8)x);
-	if (padapter->surprise_removed)
-		return;
-	up_clk(padapter, &x);
-	if (padapter->surprise_removed)
-		return;
-	down_clk(padapter, &x);
-}
-
-void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data)
-{
-	u8 x;
-	u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new;
-
-	tmp8_ori = r8712_read8(padapter, 0x102502f1);
-	tmp8_new = tmp8_ori & 0xf7;
-	if (tmp8_ori != tmp8_new)
-		r8712_write8(padapter, 0x102502f1, tmp8_new);
-	tmp8_clk_ori = r8712_read8(padapter, 0x10250003);
-	tmp8_clk_new = tmp8_clk_ori | 0x20;
-	if (tmp8_clk_new != tmp8_clk_ori)
-		r8712_write8(padapter, 0x10250003, tmp8_clk_new);
-	x = r8712_read8(padapter, EE_9346CR);
-	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
-	x |= _EEM1 | _EECS;
-	r8712_write8(padapter, EE_9346CR, x);
-	shift_out_bits(padapter, EEPROM_EWEN_OPCODE, 5);
-	if (padapter->eeprom_address_size == 8)	/*CF+ and SDIO*/
-		shift_out_bits(padapter, 0, 6);
-	else	/* USB */
-		shift_out_bits(padapter, 0, 4);
-	standby(padapter);
-	/* Erase this particular word.  Write the erase opcode and register
-	 * number in that order. The opcode is 3bits in length; reg is 6
-	 * bits long.
-	 */
-	standby(padapter);
-	/* write the new word to the EEPROM
-	 * send the write opcode the EEPORM
-	 */
-	shift_out_bits(padapter, EEPROM_WRITE_OPCODE, 3);
-	/* select which word in the EEPROM that we are writing to. */
-	shift_out_bits(padapter, reg, padapter->eeprom_address_size);
-	/* write the data to the selected EEPROM word. */
-	shift_out_bits(padapter, data, 16);
-	if (wait_eeprom_cmd_done(padapter)) {
-		standby(padapter);
-		shift_out_bits(padapter, EEPROM_EWDS_OPCODE, 5);
-		shift_out_bits(padapter, reg, 4);
-		eeprom_clean(padapter);
-	}
-	if (tmp8_clk_new != tmp8_clk_ori)
-		r8712_write8(padapter, 0x10250003, tmp8_clk_ori);
-	if (tmp8_new != tmp8_ori)
-		r8712_write8(padapter, 0x102502f1, tmp8_ori);
-}
-
-u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg) /*ReadEEprom*/
-{
-	u16 x;
-	u16 data = 0;
-	u8 tmp8_ori, tmp8_new, tmp8_clk_ori, tmp8_clk_new;
-
-	tmp8_ori = r8712_read8(padapter, 0x102502f1);
-	tmp8_new = tmp8_ori & 0xf7;
-	if (tmp8_ori != tmp8_new)
-		r8712_write8(padapter, 0x102502f1, tmp8_new);
-	tmp8_clk_ori = r8712_read8(padapter, 0x10250003);
-	tmp8_clk_new = tmp8_clk_ori | 0x20;
-	if (tmp8_clk_new != tmp8_clk_ori)
-		r8712_write8(padapter, 0x10250003, tmp8_clk_new);
-	if (padapter->surprise_removed)
-		goto out;
-	/* select EEPROM, reset bits, set _EECS */
-	x = r8712_read8(padapter, EE_9346CR);
-	if (padapter->surprise_removed)
-		goto out;
-	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
-	x |= _EEM1 | _EECS;
-	r8712_write8(padapter, EE_9346CR, (unsigned char)x);
-	/* write the read opcode and register number in that order
-	 * The opcode is 3bits in length, reg is 6 bits long
-	 */
-	shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
-	shift_out_bits(padapter, reg, padapter->eeprom_address_size);
-	/* Now read the data (16 bits) in from the selected EEPROM word */
-	data = shift_in_bits(padapter);
-	eeprom_clean(padapter);
-out:
-	if (tmp8_clk_new != tmp8_clk_ori)
-		r8712_write8(padapter, 0x10250003, tmp8_clk_ori);
-	if (tmp8_new != tmp8_ori)
-		r8712_write8(padapter, 0x102502f1, tmp8_ori);
-	return data;
-}
--- a/drivers/staging/rtl8712/rtl871x_eeprom.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- ******************************************************************************/
-#ifndef __RTL871X_EEPROM_H__
-#define __RTL871X_EEPROM_H__
-
-#include "osdep_service.h"
-
-#define	RTL8712_EEPROM_ID		0x8712
-#define	EEPROM_MAX_SIZE			256
-#define	CLOCK_RATE			50	/*100us*/
-
-/*- EEPROM opcodes*/
-#define EEPROM_READ_OPCODE		06
-#define EEPROM_WRITE_OPCODE		05
-#define EEPROM_ERASE_OPCODE		07
-#define EEPROM_EWEN_OPCODE		19      /* Erase/write enable*/
-#define EEPROM_EWDS_OPCODE		16      /* Erase/write disable*/
-
-#define	EEPROM_CID_DEFAULT		0x0
-#define	EEPROM_CID_ALPHA		0x1
-#define	EEPROM_CID_Senao		0x3
-#define	EEPROM_CID_NetCore		0x5
-#define	EEPROM_CID_CAMEO		0X8
-#define	EEPROM_CID_SITECOM		0x9
-#define	EEPROM_CID_COREGA		0xB
-#define	EEPROM_CID_EDIMAX_BELKIN	0xC
-#define	EEPROM_CID_SERCOMM_BELKIN	0xE
-#define	EEPROM_CID_CAMEO1		0xF
-#define	EEPROM_CID_WNC_COREGA		0x12
-#define	EEPROM_CID_CLEVO		0x13
-#define	EEPROM_CID_WHQL			0xFE
-
-enum RT_CUSTOMER_ID {
-	RT_CID_DEFAULT = 0,
-	RT_CID_8187_ALPHA0 = 1,
-	RT_CID_8187_SERCOMM_PS = 2,
-	RT_CID_8187_HW_LED = 3,
-	RT_CID_8187_NETGEAR = 4,
-	RT_CID_WHQL = 5,
-	RT_CID_819x_CAMEO  = 6,
-	RT_CID_819x_RUNTOP = 7,
-	RT_CID_819x_Senao = 8,
-	RT_CID_TOSHIBA = 9,
-	RT_CID_819x_Netcore = 10,
-	RT_CID_Nettronix = 11,
-	RT_CID_DLINK = 12,
-	RT_CID_PRONET = 13,
-	RT_CID_COREGA = 14,
-	RT_CID_819x_ALPHA = 15,
-	RT_CID_819x_Sitecom = 16,
-	RT_CID_CCX = 17,
-	RT_CID_819x_Lenovo = 18,
-	RT_CID_819x_QMI = 19,
-	RT_CID_819x_Edimax_Belkin = 20,
-	RT_CID_819x_Sercomm_Belkin = 21,
-	RT_CID_819x_CAMEO1 = 22,
-	RT_CID_819x_MSI = 23,
-	RT_CID_819x_Acer = 24,
-	RT_CID_819x_AzWave_ASUS = 25,
-	RT_CID_819x_AzWave = 26,
-	RT_CID_819x_WNC_COREGA = 27,
-	RT_CID_819x_CLEVO = 28,
-};
-
-struct eeprom_priv {
-	u8 bautoload_fail_flag;
-	u8 bempty;
-	u8 sys_config;
-	u8 mac_addr[6];
-	u8 config0;
-	u16 channel_plan;
-	u8 country_string[3];
-	u8 tx_power_b[15];
-	u8 tx_power_g[15];
-	u8 tx_power_a[201];
-	u8 efuse_eeprom_data[EEPROM_MAX_SIZE];
-	enum RT_CUSTOMER_ID CustomerID;
-};
-
-void r8712_eeprom_write16(struct _adapter *padapter, u16 reg, u16 data);
-u16 r8712_eeprom_read16(struct _adapter *padapter, u16 reg);
-
-#endif  /*__RTL871X_EEPROM_H__*/
-
--- a/drivers/staging/rtl8712/rtl871x_event.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871x_EVENT_H_
-#define _RTL871x_EVENT_H_
-
-#include "osdep_service.h"
-
-#include "wlan_bssdef.h"
-#include <linux/semaphore.h>
-#include <linux/sem.h>
-
-/*
- * Used to report a bss has been scanned
- */
-struct survey_event	{
-	struct wlan_bssid_ex bss;
-};
-
-/*
- * Used to report that the requested site survey has been done.
- * bss_cnt indicates the number of bss that has been reported.
- */
-struct surveydone_event {
-	unsigned int	bss_cnt;
-
-};
-
-/*
- * Used to report the link result of joinning the given bss
- * join_res:
- *  -1: authentication fail
- *  -2: association fail
- *  > 0: TID
- */
-struct joinbss_event {
-	struct	wlan_network	network;
-};
-
-/*
- * Used to report a given STA has joinned the created BSS.
- * It is used in AP/Ad-HoC(M) mode.
- */
-struct stassoc_event {
-	unsigned char macaddr[6];
-	unsigned char rsvd[2];
-	__le32    cam_id;
-};
-
-struct stadel_event {
-	unsigned char macaddr[6];
-	unsigned char rsvd[2];
-};
-
-struct addba_event {
-	unsigned int tid;
-};
-
-#define GEN_EVT_CODE(event)	event ## _EVT_
-
-struct fwevent {
-	u32	parmsize;
-	void (*event_callback)(struct _adapter *dev, u8 *pbuf);
-};
-
-#define C2HEVENT_SZ			32
-struct event_node {
-	unsigned char *node;
-	unsigned char evt_code;
-	unsigned short evt_sz;
-	/*volatile*/ int *caller_ff_tail;
-	int	caller_ff_sz;
-};
-
-struct c2hevent_queue {
-	/*volatile*/ int	head;
-	/*volatile*/ int	tail;
-	struct	event_node	nodes[C2HEVENT_SZ];
-	unsigned char	seq;
-};
-
-#define NETWORK_QUEUE_SZ	4
-
-struct network_queue {
-	/*volatile*/ int	head;
-	/*volatile*/ int	tail;
-	struct wlan_bssid_ex networks[NETWORK_QUEUE_SZ];
-};
-
-struct ADDBA_Req_Report_parm {
-	unsigned char MacAddress[ETH_ALEN];
-	unsigned short StartSeqNum;
-	unsigned char tid;
-};
-
-#include "rtl8712_event.h"
-
-#endif /* _WLANEVENT_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_ht.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_HT_H_
-#define _RTL871X_HT_H_
-
-#include "osdep_service.h"
-#include "wifi.h"
-
-struct ht_priv {
-	unsigned int	ht_option;
-	unsigned int	ampdu_enable;/*for enable Tx A-MPDU*/
-	unsigned char	baddbareq_issued[16];
-	unsigned int	tx_amsdu_enable;/*for enable Tx A-MSDU */
-	unsigned int	tx_amdsu_maxlen; /* 1: 8k, 0:4k ; default:8k, for tx */
-	unsigned int	rx_ampdu_maxlen; /* for rx reordering ctrl win_sz,
-					  * updated when join_callback.
-					  */
-	struct ieee80211_ht_cap ht_cap;
-};
-
-#endif	/*_RTL871X_HT_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_io.c
+++ /dev/null
@@ -1,147 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_io.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-/*
- *
- * The purpose of rtl871x_io.c
- *
- * a. provides the API
- * b. provides the protocol engine
- * c. provides the software interface between caller and the hardware interface
- *
- * For r8712u, both sync/async operations are provided.
- *
- * Only sync read/write_mem operations are provided.
- *
- */
-
-#define _RTL871X_IO_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_io.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-static uint _init_intf_hdl(struct _adapter *padapter,
-			   struct intf_hdl *pintf_hdl)
-{
-	struct	intf_priv	*pintf_priv;
-	void (*set_intf_option)(u32 *poption) = NULL;
-	void (*set_intf_funs)(struct intf_hdl *pintf_hdl);
-	void (*set_intf_ops)(struct _io_ops	*pops);
-	uint (*init_intf_priv)(struct intf_priv *pintfpriv);
-
-	set_intf_option = &(r8712_usb_set_intf_option);
-	set_intf_funs = &(r8712_usb_set_intf_funs);
-	set_intf_ops = &r8712_usb_set_intf_ops;
-	init_intf_priv = &r8712_usb_init_intf_priv;
-	pintf_priv = pintf_hdl->pintfpriv = kmalloc(sizeof(struct intf_priv),
-						    GFP_ATOMIC);
-	if (!pintf_priv)
-		goto _init_intf_hdl_fail;
-	pintf_hdl->adapter = (u8 *)padapter;
-	set_intf_option(&pintf_hdl->intf_option);
-	set_intf_funs(pintf_hdl);
-	set_intf_ops(&pintf_hdl->io_ops);
-	pintf_priv->intf_dev = (u8 *)&padapter->dvobjpriv;
-	if (init_intf_priv(pintf_priv) == _FAIL)
-		goto _init_intf_hdl_fail;
-	return _SUCCESS;
-_init_intf_hdl_fail:
-	kfree(pintf_priv);
-	return _FAIL;
-}
-
-static void _unload_intf_hdl(struct intf_priv *pintfpriv)
-{
-	void (*unload_intf_priv)(struct intf_priv *pintfpriv);
-
-	unload_intf_priv = &r8712_usb_unload_intf_priv;
-	unload_intf_priv(pintfpriv);
-	kfree(pintfpriv);
-}
-
-static uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl)
-{
-	struct _adapter *adapter = (struct _adapter *)dev;
-
-	pintfhdl->intf_option = 0;
-	pintfhdl->adapter = dev;
-	pintfhdl->intf_dev = (u8 *)&adapter->dvobjpriv;
-	if (!_init_intf_hdl(adapter, pintfhdl))
-		goto register_intf_hdl_fail;
-	return _SUCCESS;
-register_intf_hdl_fail:
-	return false;
-}
-
-static  void unregister_intf_hdl(struct intf_hdl *pintfhdl)
-{
-	_unload_intf_hdl(pintfhdl->pintfpriv);
-	memset((u8 *)pintfhdl, 0, sizeof(struct intf_hdl));
-}
-
-uint r8712_alloc_io_queue(struct _adapter *adapter)
-{
-	u32 i;
-	struct io_queue *pio_queue;
-	struct io_req *pio_req;
-
-	pio_queue = kmalloc(sizeof(*pio_queue), GFP_ATOMIC);
-	if (!pio_queue)
-		goto alloc_io_queue_fail;
-	INIT_LIST_HEAD(&pio_queue->free_ioreqs);
-	INIT_LIST_HEAD(&pio_queue->processing);
-	INIT_LIST_HEAD(&pio_queue->pending);
-	spin_lock_init(&pio_queue->lock);
-	pio_queue->pallocated_free_ioreqs_buf = kzalloc(NUM_IOREQ *
-						(sizeof(struct io_req)) + 4,
-						GFP_ATOMIC);
-	if ((pio_queue->pallocated_free_ioreqs_buf) == NULL)
-		goto alloc_io_queue_fail;
-	pio_queue->free_ioreqs_buf = pio_queue->pallocated_free_ioreqs_buf + 4
-			- ((addr_t)(pio_queue->pallocated_free_ioreqs_buf)
-			& 3);
-	pio_req = (struct io_req *)(pio_queue->free_ioreqs_buf);
-	for (i = 0; i < NUM_IOREQ; i++) {
-		INIT_LIST_HEAD(&pio_req->list);
-		list_add_tail(&pio_req->list, &pio_queue->free_ioreqs);
-		pio_req++;
-	}
-	if ((register_intf_hdl((u8 *)adapter, &pio_queue->intf)) == _FAIL)
-		goto alloc_io_queue_fail;
-	adapter->pio_queue = pio_queue;
-	return _SUCCESS;
-alloc_io_queue_fail:
-	if (pio_queue) {
-		kfree(pio_queue->pallocated_free_ioreqs_buf);
-		kfree(pio_queue);
-	}
-	adapter->pio_queue = NULL;
-	return _FAIL;
-}
-
-void r8712_free_io_queue(struct _adapter *adapter)
-{
-	struct io_queue *pio_queue = adapter->pio_queue;
-
-	if (pio_queue) {
-		kfree(pio_queue->pallocated_free_ioreqs_buf);
-		adapter->pio_queue = NULL;
-		unregister_intf_hdl(&pio_queue->intf);
-		kfree(pio_queue);
-	}
-}
--- a/drivers/staging/rtl8712/rtl871x_io.h
+++ /dev/null
@@ -1,236 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_IO_H_
-#define _RTL871X_IO_H_
-
-#include "osdep_service.h"
-#include "osdep_intf.h"
-
-#define NUM_IOREQ		8
-
-#define MAX_PROT_SZ	(64-16)
-
-#define _IOREADY			0
-#define _IO_WAIT_COMPLETE   1
-#define _IO_WAIT_RSP        2
-
-/* IO COMMAND TYPE */
-#define _IOSZ_MASK_		(0x7F)
-#define _IO_WRITE_		BIT(7)
-#define _IO_FIXED_		BIT(8)
-#define _IO_BURST_		BIT(9)
-#define _IO_BYTE_		BIT(10)
-#define _IO_HW_			BIT(11)
-#define _IO_WORD_		BIT(12)
-#define _IO_SYNC_		BIT(13)
-#define _IO_CMDMASK_	(0x1F80)
-
-/*
- *	For prompt mode accessing, caller shall free io_req
- *	Otherwise, io_handler will free io_req
- */
-/* IO STATUS TYPE */
-#define _IO_ERR_		BIT(2)
-#define _IO_SUCCESS_	BIT(1)
-#define _IO_DONE_		BIT(0)
-#define IO_RD32			(_IO_SYNC_ | _IO_WORD_)
-#define IO_RD16			(_IO_SYNC_ | _IO_HW_)
-#define IO_RD8			(_IO_SYNC_ | _IO_BYTE_)
-#define IO_RD32_ASYNC	(_IO_WORD_)
-#define IO_RD16_ASYNC	(_IO_HW_)
-#define IO_RD8_ASYNC	(_IO_BYTE_)
-#define IO_WR32			(_IO_WRITE_ | _IO_SYNC_ | _IO_WORD_)
-#define IO_WR16			(_IO_WRITE_ | _IO_SYNC_ | _IO_HW_)
-#define IO_WR8			(_IO_WRITE_ | _IO_SYNC_ | _IO_BYTE_)
-#define IO_WR32_ASYNC	(_IO_WRITE_ | _IO_WORD_)
-#define IO_WR16_ASYNC	(_IO_WRITE_ | _IO_HW_)
-#define IO_WR8_ASYNC	(_IO_WRITE_ | _IO_BYTE_)
-/*
- *	Only Sync. burst accessing is provided.
- */
-#define IO_WR_BURST(x)		(IO_WRITE_ | _IO_SYNC_ | _IO_BURST_ | \
-				((x) & _IOSZ_MASK_))
-#define IO_RD_BURST(x)		(_IO_SYNC_ | _IO_BURST_ | ((x) & _IOSZ_MASK_))
-/*below is for the intf_option bit defition...*/
-#define _INTF_ASYNC_	BIT(0)	/*support async io*/
-struct intf_priv;
-struct	intf_hdl;
-struct io_queue;
-struct	_io_ops {
-	uint (*_sdbus_read_bytes_to_membuf)(struct intf_priv *pintfpriv,
-					    u32 addr, u32 cnt, u8 *pbuf);
-	uint (*_sdbus_read_blocks_to_membuf)(struct intf_priv *pintfpriv,
-					     u32 addr, u32 cnt, u8 *pbuf);
-	u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
-	u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
-	u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
-	uint (*_sdbus_write_blocks_from_membuf)(struct intf_priv *pintfpriv,
-						u32 addr, u32 cnt, u8 *pbuf,
-						u8 async);
-	uint (*_sdbus_write_bytes_from_membuf)(struct intf_priv *pintfpriv,
-					       u32 addr, u32 cnt, u8 *pbuf);
-	u8 (*_cmd52r)(struct intf_priv *pintfpriv, u32 addr);
-	void (*_cmd52w)(struct intf_priv *pintfpriv, u32 addr, u8 val8);
-	u8 (*_cmdfunc152r)(struct intf_priv *pintfpriv, u32 addr);
-	void (*_cmdfunc152w)(struct intf_priv *pintfpriv, u32 addr, u8 val8);
-	void (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
-	void (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
-	void (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
-	void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
-			  u8 *pmem);
-	void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
-			   u8 *pmem);
-	void (*_sync_irp_protocol_rw)(struct io_queue *pio_q);
-	u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
-			  u8 *pmem);
-	u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
-			   u8 *pmem);
-};
-
-struct io_req {
-	struct list_head list;
-	u32	addr;
-	/*volatile*/ u32	val;
-	u32	command;
-	u32	status;
-	u8	*pbuf;
-	void (*_async_io_callback)(struct _adapter *padapter,
-				   struct io_req *pio_req, u8 *cnxt);
-	u8 *cnxt;
-};
-
-struct	intf_hdl {
-	u32	intf_option;
-	u8	*adapter;
-	u8	*intf_dev;
-	struct intf_priv	*pintfpriv;
-	void (*intf_hdl_init)(u8 *priv);
-	void (*intf_hdl_unload)(u8 *priv);
-	void (*intf_hdl_open)(u8 *priv);
-	void (*intf_hdl_close)(u8 *priv);
-	struct	_io_ops	io_ops;
-};
-
-struct reg_protocol_rd {
-#ifdef __LITTLE_ENDIAN
-	/* DW1 */
-	u32		NumOfTrans:4;
-	u32		Reserved1:4;
-	u32		Reserved2:24;
-	/* DW2 */
-	u32		ByteCount:7;
-	u32		WriteEnable:1;		/*0:read, 1:write*/
-	u32		FixOrContinuous:1;	/*0:continuous, 1: Fix*/
-	u32		BurstMode:1;
-	u32		Byte1Access:1;
-	u32		Byte2Access:1;
-	u32		Byte4Access:1;
-	u32		Reserved3:3;
-	u32		Reserved4:16;
-	/*DW3*/
-	u32		BusAddress;
-	/*DW4*/
-#else
-/*DW1*/
-	u32 Reserved1:4;
-	u32 NumOfTrans:4;
-	u32 Reserved2:24;
-	/*DW2*/
-	u32 WriteEnable:1;
-	u32 ByteCount:7;
-	u32 Reserved3:3;
-	u32 Byte4Access:1;
-	u32 Byte2Access:1;
-	u32 Byte1Access:1;
-	u32 BurstMode:1;
-	u32 FixOrContinuous:1;
-	u32 Reserved4:16;
-	/*DW3*/
-	u32 BusAddress;
-	/*DW4*/
-#endif
-};
-
-struct reg_protocol_wt {
-#ifdef __LITTLE_ENDIAN
-	/*DW1*/
-	u32 NumOfTrans:4;
-	u32 Reserved1:4;
-	u32 Reserved2:24;
-	/*DW2*/
-	u32 ByteCount:7;
-	u32 WriteEnable:1;	/*0:read, 1:write*/
-	u32 FixOrContinuous:1;	/*0:continuous, 1: Fix*/
-	u32 BurstMode:1;
-	u32 Byte1Access:1;
-	u32 Byte2Access:1;
-	u32 Byte4Access:1;
-	u32 Reserved3:3;
-	u32 Reserved4:16;
-	/*DW3*/
-	u32 BusAddress;
-	/*DW4*/
-	u32 Value;
-#else
-	/*DW1*/
-	u32 Reserved1:4;
-	u32 NumOfTrans:4;
-	u32 Reserved2:24;
-	/*DW2*/
-	u32 WriteEnable:1;
-	u32 ByteCount:7;
-	u32 Reserved3:3;
-	u32 Byte4Access:1;
-	u32 Byte2Access:1;
-	u32 Byte1Access:1;
-	u32 BurstMode:1;
-	u32 FixOrContinuous:1;
-	u32 Reserved4:16;
-	/*DW3*/
-	u32 BusAddress;
-	/*DW4*/
-	u32 Value;
-#endif
-};
-
-/*
- * Below is the data structure used by _io_handler
- */
-
-struct io_queue {
-	spinlock_t lock;
-	struct list_head free_ioreqs;
-	/*The io_req list that will be served in the single protocol r/w.*/
-	struct list_head pending;
-	struct list_head processing;
-	u8 *free_ioreqs_buf; /* 4-byte aligned */
-	u8 *pallocated_free_ioreqs_buf;
-	struct	intf_hdl intf;
-};
-
-u8 r8712_read8(struct _adapter *adapter, u32 addr);
-u16 r8712_read16(struct _adapter *adapter, u32 addr);
-u32 r8712_read32(struct _adapter *adapter, u32 addr);
-void r8712_read_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_read_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_write8(struct _adapter *adapter, u32 addr, u8 val);
-void r8712_write16(struct _adapter *adapter, u32 addr, u16 val);
-void r8712_write32(struct _adapter *adapter, u32 addr, u32 val);
-void r8712_write_mem(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-void r8712_write_port(struct _adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
-/*ioreq */
-uint r8712_alloc_io_queue(struct _adapter *adapter);
-void r8712_free_io_queue(struct _adapter *adapter);
-
-#endif	/*_RTL871X_IO_H_*/
--- a/drivers/staging/rtl8712/rtl871x_ioctl.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __IOCTL_H
-#define __IOCTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#ifndef OID_802_11_CAPABILITY
-	#define OID_802_11_CAPABILITY                   0x0d010122
-#endif
-
-#ifndef OID_802_11_PMKID
-	#define OID_802_11_PMKID                        0x0d010123
-#endif
-
-/* For DDK-defined OIDs*/
-#define OID_NDIS_SEG1	0x00010100
-#define OID_NDIS_SEG2	0x00010200
-#define OID_NDIS_SEG3	0x00020100
-#define OID_NDIS_SEG4	0x01010100
-#define OID_NDIS_SEG5	0x01020100
-#define OID_NDIS_SEG6	0x01020200
-#define OID_NDIS_SEG7	0xFD010100
-#define OID_NDIS_SEG8	0x0D010100
-#define OID_NDIS_SEG9	0x0D010200
-#define OID_NDIS_SEG10	0x0D020200
-#define SZ_OID_NDIS_SEG1	23
-#define SZ_OID_NDIS_SEG2	3
-#define SZ_OID_NDIS_SEG3	6
-#define SZ_OID_NDIS_SEG4	6
-#define SZ_OID_NDIS_SEG5	4
-#define SZ_OID_NDIS_SEG6	8
-#define SZ_OID_NDIS_SEG7	7
-#define SZ_OID_NDIS_SEG8	36
-#define SZ_OID_NDIS_SEG9	24
-#define SZ_OID_NDIS_SEG10	19
-
-/* For Realtek-defined OIDs*/
-#define OID_MP_SEG1	0xFF871100
-#define OID_MP_SEG2	0xFF818000
-#define OID_MP_SEG3	0xFF818700
-#define OID_MP_SEG4	0xFF011100
-
-enum oid_type {
-	QUERY_OID,
-	SET_OID
-};
-
-struct oid_funs_node {
-	unsigned int oid_start; /*the starting number for OID*/
-	unsigned int oid_end; /*the ending number for OID*/
-	struct oid_obj_priv *node_array;
-	unsigned int array_sz; /*the size of node_array*/
-	int query_counter; /*count the number of query hits for this segment*/
-	int set_counter; /*count the number of set hits for this segment*/
-};
-
-struct oid_par_priv {
-	void	*adapter_context;
-	uint oid;
-	void *information_buf;
-	unsigned long information_buf_len;
-	unsigned long *bytes_rw;
-	unsigned long *bytes_needed;
-	enum oid_type	type_of_oid;
-	unsigned int dbg;
-};
-
-struct oid_obj_priv {
-	unsigned char	dbg; /* 0: without OID debug message
-			      * 1: with OID debug message
-			      */
-	uint (*oidfuns)(struct oid_par_priv *poid_par_priv);
-};
-
-uint oid_null_function(struct oid_par_priv *poid_par_priv);
-
-extern struct iw_handler_def  r871x_handlers_def;
-
-uint drv_query_info(struct net_device *MiniportAdapterContext,
-		    uint Oid,
-		    void *InformationBuffer,
-		    u32 InformationBufferLength,
-		    u32 *BytesWritten,
-		    u32 *BytesNeeded);
-
-uint drv_set_info(struct net_device *MiniportAdapterContext,
-		  uint Oid,
-		  void *InformationBuffer,
-		  u32 InformationBufferLength,
-		  u32 *BytesRead,
-		  u32 *BytesNeeded);
-
-#endif
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ /dev/null
@@ -1,2330 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_IOCTL_LINUX_C_
-#define _RTL871X_MP_IOCTL_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-#include "rtl871x_debug.h"
-#include "wifi.h"
-#include "rtl871x_mlme.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_set.h"
-#include "rtl871x_mp_ioctl.h"
-#include "mlme_osdep.h"
-#include <linux/wireless.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/io.h>
-#include <linux/semaphore.h>
-#include <net/iw_handler.h>
-#include <linux/if_arp.h>
-#include <linux/etherdevice.h>
-
-#define RTL_IOCTL_WPA_SUPPLICANT	(SIOCIWFIRSTPRIV + 0x1E)
-
-#define SCAN_ITEM_SIZE 768
-#define MAX_CUSTOM_LEN 64
-#define RATE_COUNT 4
-
-static const u32 rtl8180_rates[] = {1000000, 2000000, 5500000, 11000000,
-		       6000000, 9000000, 12000000, 18000000,
-		       24000000, 36000000, 48000000, 54000000};
-
-static const long ieee80211_wlan_frequencies[] = {
-	2412, 2417, 2422, 2427,
-	2432, 2437, 2442, 2447,
-	2452, 2457, 2462, 2467,
-	2472, 2484
-};
-
-void r8712_indicate_wx_assoc_event(struct _adapter *padapter)
-{
-	union iwreq_data wrqu;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-	memcpy(wrqu.ap_addr.sa_data, pmlmepriv->cur_network.network.MacAddress,
-		ETH_ALEN);
-	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
-}
-
-void r8712_indicate_wx_disassoc_event(struct _adapter *padapter)
-{
-	union iwreq_data wrqu;
-
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-	eth_zero_addr(wrqu.ap_addr.sa_data);
-	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
-}
-
-static inline void handle_pairwise_key(struct sta_info *psta,
-				       struct ieee_param *param,
-				       struct _adapter *padapter)
-{
-	/* pairwise key */
-	memcpy(psta->x_UncstKey.skey, param->u.crypt.key,
-	       (param->u.crypt. key_len > 16 ? 16 : param->u.crypt.key_len));
-	if (strcmp(param->u.crypt.alg, "TKIP") == 0) { /* set mic key */
-		memcpy(psta->tkiptxmickey. skey,
-		       &param->u.crypt.key[16], 8);
-		memcpy(psta->tkiprxmickey. skey,
-		       &param->u.crypt.key[24], 8);
-		padapter->securitypriv. busetkipkey = false;
-		mod_timer(&padapter->securitypriv.tkip_timer,
-			  jiffies + msecs_to_jiffies(50));
-	}
-	r8712_setstakey_cmd(padapter, (unsigned char *)psta, true);
-}
-
-static inline void handle_group_key(struct ieee_param *param,
-				    struct _adapter *padapter)
-{
-	union Keytype *gk = padapter->securitypriv.XGrpKey;
-	union Keytype *gtk = padapter->securitypriv.XGrptxmickey;
-	union Keytype *grk = padapter->securitypriv.XGrprxmickey;
-
-	if (param->u.crypt.idx > 0 &&
-	    param->u.crypt.idx < 3) {
-		/* group key idx is 1 or 2 */
-		memcpy(gk[param->u.crypt.idx - 1].skey,
-		       param->u.crypt.key,
-		       (param->u.crypt.key_len > 16 ? 16 :
-			param->u.crypt.key_len));
-		memcpy(gtk[param->u.crypt.idx - 1].skey,
-		       &param->u.crypt.key[16], 8);
-		memcpy(grk[param->u.crypt.idx - 1].skey,
-		       &param->u.crypt.key[24], 8);
-		padapter->securitypriv.binstallGrpkey = true;
-		r8712_set_key(padapter, &padapter->securitypriv,
-			param->u.crypt.idx);
-		if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE) {
-			if (padapter->registrypriv.power_mgnt !=
-			    padapter->pwrctrlpriv.pwr_mode)
-				mod_timer(&padapter->mlmepriv.dhcp_timer,
-					  jiffies + msecs_to_jiffies(60000));
-		}
-	}
-}
-
-static noinline_for_stack char *translate_scan_wpa(struct iw_request_info *info,
-						   struct wlan_network *pnetwork,
-						   struct iw_event *iwe,
-						   char *start, char *stop)
-{
-	/* parsing WPA/WPA2 IE */
-	u8 buf[MAX_WPA_IE_LEN];
-	u8 wpa_ie[255], rsn_ie[255];
-	u16 wpa_len = 0, rsn_len = 0;
-	int n, i;
-
-	r8712_get_sec_ie(pnetwork->network.IEs,
-			 pnetwork->network.IELength, rsn_ie, &rsn_len,
-			 wpa_ie, &wpa_len);
-	if (wpa_len > 0) {
-		memset(buf, 0, MAX_WPA_IE_LEN);
-		n = sprintf(buf, "wpa_ie=");
-		for (i = 0; i < wpa_len; i++) {
-			n += scnprintf(buf + n, MAX_WPA_IE_LEN - n,
-						"%02x", wpa_ie[i]);
-			if (n == MAX_WPA_IE_LEN - 1)
-				break;
-		}
-		memset(iwe, 0, sizeof(*iwe));
-		iwe->cmd = IWEVCUSTOM;
-		iwe->u.data.length = (u16)strlen(buf);
-		start = iwe_stream_add_point(info, start, stop,
-			iwe, buf);
-		memset(iwe, 0, sizeof(*iwe));
-		iwe->cmd = IWEVGENIE;
-		iwe->u.data.length = (u16)wpa_len;
-		start = iwe_stream_add_point(info, start, stop,
-			iwe, wpa_ie);
-	}
-	if (rsn_len > 0) {
-		memset(buf, 0, MAX_WPA_IE_LEN);
-		n = sprintf(buf, "rsn_ie=");
-		for (i = 0; i < rsn_len; i++) {
-			n += scnprintf(buf + n, MAX_WPA_IE_LEN - n,
-						"%02x", rsn_ie[i]);
-			if (n == MAX_WPA_IE_LEN - 1)
-				break;
-		}
-		memset(iwe, 0, sizeof(*iwe));
-		iwe->cmd = IWEVCUSTOM;
-		iwe->u.data.length = strlen(buf);
-		start = iwe_stream_add_point(info, start, stop,
-			iwe, buf);
-		memset(iwe, 0, sizeof(*iwe));
-		iwe->cmd = IWEVGENIE;
-		iwe->u.data.length = rsn_len;
-		start = iwe_stream_add_point(info, start, stop, iwe,
-			rsn_ie);
-	}
-
-	return start;
-}
-
-static noinline_for_stack char *translate_scan_wps(struct iw_request_info *info,
-						   struct wlan_network *pnetwork,
-						   struct iw_event *iwe,
-						   char *start, char *stop)
-{
-	/* parsing WPS IE */
-	u8 wps_ie[512];
-	uint wps_ielen;
-
-	if (r8712_get_wps_ie(pnetwork->network.IEs,
-	    pnetwork->network.IELength,
-	    wps_ie, &wps_ielen)) {
-		if (wps_ielen > 2) {
-			iwe->cmd = IWEVGENIE;
-			iwe->u.data.length = (u16)wps_ielen;
-			start = iwe_stream_add_point(info, start, stop,
-				iwe, wps_ie);
-		}
-	}
-
-	return start;
-}
-
-static char *translate_scan(struct _adapter *padapter,
-			    struct iw_request_info *info,
-			    struct wlan_network *pnetwork,
-			    char *start, char *stop)
-{
-	struct iw_event iwe;
-	char *current_val;
-	s8 *p;
-	u32 i = 0, ht_ielen = 0;
-	u16	cap, ht_cap = false;
-	u8 rssi;
-
-	if ((pnetwork->network.Configuration.DSConfig < 1) ||
-	    (pnetwork->network.Configuration.DSConfig > 14)) {
-		if (pnetwork->network.Configuration.DSConfig < 1)
-			pnetwork->network.Configuration.DSConfig = 1;
-		else
-			pnetwork->network.Configuration.DSConfig = 14;
-	}
-	/* AP MAC address */
-	iwe.cmd = SIOCGIWAP;
-	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-	ether_addr_copy(iwe.u.ap_addr.sa_data, pnetwork->network.MacAddress);
-	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
-	/* Add the ESSID */
-	iwe.cmd = SIOCGIWESSID;
-	iwe.u.data.flags = 1;
-	iwe.u.data.length = min_t(u32, pnetwork->network.Ssid.SsidLength, 32);
-	start = iwe_stream_add_point(info, start, stop, &iwe,
-				     pnetwork->network.Ssid.Ssid);
-	/* parsing HT_CAP_IE */
-	p = r8712_get_ie(&pnetwork->network.IEs[12], WLAN_EID_HT_CAPABILITY,
-			 &ht_ielen, pnetwork->network.IELength - 12);
-	if (p && ht_ielen > 0)
-		ht_cap = true;
-	/* Add the protocol name */
-	iwe.cmd = SIOCGIWNAME;
-	if (r8712_is_cckratesonly_included(pnetwork->network.rates)) {
-		if (ht_cap)
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bn");
-		else
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
-	} else if (r8712_is_cckrates_included(pnetwork->network.rates)) {
-		if (ht_cap)
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bgn");
-		else
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg");
-	} else {
-		if (ht_cap)
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn");
-		else
-			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
-	}
-	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
-	/* Add mode */
-	iwe.cmd = SIOCGIWMODE;
-	memcpy((u8 *)&cap, r8712_get_capability_from_ie(pnetwork->network.IEs),
-		2);
-	le16_to_cpus(&cap);
-	if (cap & (WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_ESS)) {
-		if (cap & WLAN_CAPABILITY_ESS)
-			iwe.u.mode = (u32)IW_MODE_MASTER;
-		else
-			iwe.u.mode = (u32)IW_MODE_ADHOC;
-		start = iwe_stream_add_event(info, start, stop, &iwe,
-			IW_EV_UINT_LEN);
-	}
-	/* Add frequency/channel */
-	iwe.cmd = SIOCGIWFREQ;
-	{
-		/*  check legal index */
-		u8 dsconfig = pnetwork->network.Configuration.DSConfig;
-
-		if (dsconfig >= 1 && dsconfig <= sizeof(
-		    ieee80211_wlan_frequencies) / sizeof(long))
-			iwe.u.freq.m =
-				(s32)(ieee80211_wlan_frequencies
-				      [dsconfig - 1] * 100000);
-		else
-			iwe.u.freq.m = 0;
-	}
-	iwe.u.freq.e = (s16)1;
-	iwe.u.freq.i = (u8)pnetwork->network.Configuration.DSConfig;
-	start = iwe_stream_add_event(info, start, stop, &iwe,
-		IW_EV_FREQ_LEN);
-	/* Add encryption capability */
-	iwe.cmd = SIOCGIWENCODE;
-	if (cap & WLAN_CAPABILITY_PRIVACY)
-		iwe.u.data.flags = (u16)(IW_ENCODE_ENABLED |
-				    IW_ENCODE_NOKEY);
-	else
-		iwe.u.data.flags = (u16)(IW_ENCODE_DISABLED);
-	iwe.u.data.length = (u16)0;
-	start = iwe_stream_add_point(info, start, stop, &iwe,
-		pnetwork->network.Ssid.Ssid);
-	/*Add basic and extended rates */
-	current_val = start + iwe_stream_lcp_len(info);
-	iwe.cmd = SIOCGIWRATE;
-	iwe.u.bitrate.fixed = 0;
-	iwe.u.bitrate.disabled = 0;
-	iwe.u.bitrate.value = 0;
-	i = 0;
-	while (pnetwork->network.rates[i] != 0) {
-		/* Bit rate given in 500 kb/s units */
-		iwe.u.bitrate.value = (pnetwork->network.rates[i++] &
-				      0x7F) * 500000;
-		current_val = iwe_stream_add_value(info, start, current_val,
-			      stop, &iwe, IW_EV_PARAM_LEN);
-	}
-	/* Check if we added any event */
-	if ((current_val - start) > iwe_stream_lcp_len(info))
-		start = current_val;
-
-	start = translate_scan_wpa(info, pnetwork, &iwe, start, stop);
-
-	start = translate_scan_wps(info, pnetwork, &iwe, start, stop);
-
-	/* Add quality statistics */
-	iwe.cmd = IWEVQUAL;
-	rssi = r8712_signal_scale_mapping(pnetwork->network.Rssi);
-	/* we only update signal_level (signal strength) that is rssi. */
-	iwe.u.qual.updated = (u8)(IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_UPDATED |
-				  IW_QUAL_NOISE_INVALID);
-	iwe.u.qual.level = rssi;  /* signal strength */
-	iwe.u.qual.qual = 0; /* signal quality */
-	iwe.u.qual.noise = 0; /* noise level */
-	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
-	/* how to translate rssi to ?% */
-	return start;
-}
-
-static int wpa_set_auth_algs(struct net_device *dev, u32 value)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	int ret = 0;
-
-	if ((value & AUTH_ALG_SHARED_KEY) && (value & AUTH_ALG_OPEN_SYSTEM)) {
-		padapter->securitypriv.ndisencryptstatus =
-						 Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.ndisauthtype =
-						 Ndis802_11AuthModeAutoSwitch;
-		padapter->securitypriv.AuthAlgrthm = 3;
-	} else if (value & AUTH_ALG_SHARED_KEY) {
-		padapter->securitypriv.ndisencryptstatus =
-						 Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
-		padapter->securitypriv.AuthAlgrthm = 1;
-	} else if (value & AUTH_ALG_OPEN_SYSTEM) {
-		if (padapter->securitypriv.ndisauthtype <
-						 Ndis802_11AuthModeWPAPSK) {
-			padapter->securitypriv.ndisauthtype =
-						 Ndis802_11AuthModeOpen;
-			padapter->securitypriv.AuthAlgrthm = 0;
-		}
-	} else {
-		ret = -EINVAL;
-	}
-	return ret;
-}
-
-static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param,
-			      u32 param_len)
-{
-	int ret = 0;
-	u32 wep_key_idx, wep_key_len = 0;
-	struct NDIS_802_11_WEP	 *pwep = NULL;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-
-	param->u.crypt.err = 0;
-	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
-	if (param_len != (u32)((u8 *) param->u.crypt.key - (u8 *)param) +
-			 param->u.crypt.key_len)
-		return -EINVAL;
-	if (!is_broadcast_ether_addr(param->sta_addr))
-		return -EINVAL;
-
-	if (param->u.crypt.idx >= WEP_KEYS) {
-		/* for large key indices, set the default (0) */
-		param->u.crypt.idx = 0;
-	}
-	if (strcmp(param->u.crypt.alg, "WEP") == 0) {
-		netdev_info(dev, "r8712u: %s: crypt.alg = WEP\n", __func__);
-		padapter->securitypriv.ndisencryptstatus =
-			     Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
-		padapter->securitypriv.XGrpPrivacy = _WEP40_;
-		wep_key_idx = param->u.crypt.idx;
-		wep_key_len = param->u.crypt.key_len;
-		if (wep_key_idx >= WEP_KEYS)
-			wep_key_idx = 0;
-		if (wep_key_len <= 0)
-			return -EINVAL;
-
-		wep_key_len = wep_key_len <= 5 ? 5 : 13;
-		pwep = kzalloc(sizeof(*pwep), GFP_ATOMIC);
-		if (!pwep)
-			return -ENOMEM;
-		pwep->KeyLength = wep_key_len;
-		pwep->Length = wep_key_len +
-			offsetof(struct NDIS_802_11_WEP, KeyMaterial);
-		if (wep_key_len == 13) {
-			padapter->securitypriv.PrivacyAlgrthm = _WEP104_;
-			padapter->securitypriv.XGrpPrivacy = _WEP104_;
-		}
-		pwep->KeyIndex = wep_key_idx;
-		pwep->KeyIndex |= 0x80000000;
-		memcpy(pwep->KeyMaterial, param->u.crypt.key, pwep->KeyLength);
-		if (param->u.crypt.set_tx) {
-			if (r8712_set_802_11_add_wep(padapter, pwep))
-				ret = -EOPNOTSUPP;
-		} else {
-			/* don't update "psecuritypriv->PrivacyAlgrthm" and
-			 * "psecuritypriv->PrivacyKeyIndex=keyid", but can
-			 * r8712_set_key to fw/cam
-			 */
-			if (wep_key_idx >= WEP_KEYS) {
-				ret = -EOPNOTSUPP;
-				goto exit;
-			}
-			memcpy(&psecuritypriv->DefKey[wep_key_idx].skey[0],
-			       pwep->KeyMaterial,
-			       pwep->KeyLength);
-			psecuritypriv->DefKeylen[wep_key_idx] =
-				pwep->KeyLength;
-			r8712_set_key(padapter, psecuritypriv, wep_key_idx);
-		}
-		goto exit;
-	}
-	if (padapter->securitypriv.AuthAlgrthm == 2) { /* 802_1x */
-		struct sta_info *psta, *pbcmc_sta;
-		struct sta_priv *pstapriv = &padapter->stapriv;
-		struct security_priv *spriv = &padapter->securitypriv;
-
-		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE |
-		    WIFI_MP_STATE)) { /* sta mode */
-			psta = r8712_get_stainfo(pstapriv,
-						 get_bssid(pmlmepriv));
-			if (psta) {
-				psta->ieee8021x_blocked = false;
-				if (spriv->ndisencryptstatus ==
-				    Ndis802_11Encryption2Enabled ||
-				    spriv->ndisencryptstatus ==
-				    Ndis802_11Encryption3Enabled)
-					psta->XPrivacy = spriv->PrivacyAlgrthm;
-				if (param->u.crypt.set_tx == 1)
-					handle_pairwise_key(psta, param,
-							    padapter);
-				else /* group key */
-					handle_group_key(param, padapter);
-			}
-			pbcmc_sta = r8712_get_bcmc_stainfo(padapter);
-			if (pbcmc_sta) {
-				pbcmc_sta->ieee8021x_blocked = false;
-				if (spriv->ndisencryptstatus ==
-				    Ndis802_11Encryption2Enabled ||
-				    spriv->ndisencryptstatus ==
-				    Ndis802_11Encryption3Enabled)
-					pbcmc_sta->XPrivacy =
-						spriv->PrivacyAlgrthm;
-			}
-		}
-	}
-exit:
-	kfree(pwep);
-	return ret;
-}
-
-static int r871x_set_wpa_ie(struct _adapter *padapter, char *pie,
-			    unsigned short ielen)
-{
-	u8 *buf = NULL;
-	int group_cipher = 0, pairwise_cipher = 0;
-	int ret = 0;
-
-	if (ielen > MAX_WPA_IE_LEN || !pie)
-		return -EINVAL;
-	if (ielen) {
-		buf = kmemdup(pie, ielen, GFP_ATOMIC);
-		if (!buf)
-			return -ENOMEM;
-		if (ielen < RSN_HEADER_LEN) {
-			ret  = -EINVAL;
-			goto exit;
-		}
-		if (r8712_parse_wpa_ie(buf, ielen, &group_cipher,
-		    &pairwise_cipher) == 0) {
-			padapter->securitypriv.AuthAlgrthm = 2;
-			padapter->securitypriv.ndisauthtype =
-				  Ndis802_11AuthModeWPAPSK;
-		}
-		if (r8712_parse_wpa2_ie(buf, ielen, &group_cipher,
-		    &pairwise_cipher) == 0) {
-			padapter->securitypriv.AuthAlgrthm = 2;
-			padapter->securitypriv.ndisauthtype =
-				  Ndis802_11AuthModeWPA2PSK;
-		}
-		switch (group_cipher) {
-		case WPA_CIPHER_NONE:
-			padapter->securitypriv.XGrpPrivacy =
-				 _NO_PRIVACY_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11EncryptionDisabled;
-			break;
-		case WPA_CIPHER_WEP40:
-			padapter->securitypriv.XGrpPrivacy = _WEP40_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-			break;
-		case WPA_CIPHER_TKIP:
-			padapter->securitypriv.XGrpPrivacy = _TKIP_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption2Enabled;
-			break;
-		case WPA_CIPHER_CCMP:
-			padapter->securitypriv.XGrpPrivacy = _AES_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption3Enabled;
-			break;
-		case WPA_CIPHER_WEP104:
-			padapter->securitypriv.XGrpPrivacy = _WEP104_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-			break;
-		}
-		switch (pairwise_cipher) {
-		case WPA_CIPHER_NONE:
-			padapter->securitypriv.PrivacyAlgrthm =
-				 _NO_PRIVACY_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11EncryptionDisabled;
-			break;
-		case WPA_CIPHER_WEP40:
-			padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-			break;
-		case WPA_CIPHER_TKIP:
-			padapter->securitypriv.PrivacyAlgrthm = _TKIP_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption2Enabled;
-			break;
-		case WPA_CIPHER_CCMP:
-			padapter->securitypriv.PrivacyAlgrthm = _AES_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption3Enabled;
-			break;
-		case WPA_CIPHER_WEP104:
-			padapter->securitypriv.PrivacyAlgrthm = _WEP104_;
-			padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-			break;
-		}
-		padapter->securitypriv.wps_phase = false;
-		{/* set wps_ie */
-			u16 cnt = 0;
-			u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
-
-			while (cnt < ielen) {
-				eid = buf[cnt];
-
-				if ((eid == WLAN_EID_VENDOR_SPECIFIC) &&
-				    (!memcmp(&buf[cnt + 2], wps_oui, 4))) {
-					netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE\n");
-					padapter->securitypriv.wps_ie_len =
-					    ((buf[cnt + 1] + 2) <
-					    (MAX_WPA_IE_LEN << 2)) ?
-					    (buf[cnt + 1] + 2) :
-					    (MAX_WPA_IE_LEN << 2);
-					memcpy(padapter->securitypriv.wps_ie,
-					    &buf[cnt],
-					    padapter->securitypriv.wps_ie_len);
-					padapter->securitypriv.wps_phase =
-								 true;
-					netdev_info(padapter->pnetdev, "r8712u: SET WPS_IE, wps_phase==true\n");
-					cnt += buf[cnt + 1] + 2;
-					break;
-				}
-
-				cnt += buf[cnt + 1] + 2;
-			}
-		}
-	}
-exit:
-	kfree(buf);
-	return ret;
-}
-
-static int r8711_wx_get_name(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	u32 ht_ielen = 0;
-	char *p;
-	u8 ht_cap = false;
-	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-	u8 *prates;
-
-	if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE) ==
-	    true) {
-		/* parsing HT_CAP_IE */
-		p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY,
-				 &ht_ielen, pcur_bss->IELength - 12);
-		if (p && ht_ielen > 0)
-			ht_cap = true;
-		prates = pcur_bss->rates;
-		if (r8712_is_cckratesonly_included(prates)) {
-			if (ht_cap)
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11bn");
-			else
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11b");
-		} else if (r8712_is_cckrates_included(prates)) {
-			if (ht_cap)
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11bgn");
-			else
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11bg");
-		} else {
-			if (ht_cap)
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11gn");
-			else
-				snprintf(wrqu->name, IFNAMSIZ,
-					 "IEEE 802.11g");
-		}
-	} else {
-		snprintf(wrqu->name, IFNAMSIZ, "unassociated");
-	}
-	return 0;
-}
-
-static const long frequency_list[] = {
-	2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462,
-	2467, 2472, 2484, 4915, 4920, 4925, 4935, 4940, 4945, 4960, 4980,
-	5035, 5040, 5045, 5055, 5060, 5080, 5170, 5180, 5190, 5200, 5210,
-	5220, 5230, 5240, 5260, 5280, 5300, 5320, 5500, 5520, 5540, 5560,
-	5580, 5600, 5620, 5640, 5660, 5680, 5700, 5745, 5765, 5785, 5805,
-	5825
-};
-
-static int r8711_wx_set_freq(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_freq *fwrq = &wrqu->freq;
-	int rc = 0;
-
-/* If setting by frequency, convert to a channel */
-	if ((fwrq->e == 1) &&
-	  (fwrq->m >= 241200000) &&
-	  (fwrq->m <= 248700000)) {
-		int f = fwrq->m / 100000;
-		int c = 0;
-
-		while ((c < 14) && (f != frequency_list[c]))
-			c++;
-		fwrq->e = 0;
-		fwrq->m = c + 1;
-	}
-	/* Setting by channel number */
-	if ((fwrq->m > 14) || (fwrq->e > 0)) {
-		rc = -EOPNOTSUPP;
-	} else {
-		int channel = fwrq->m;
-
-		if ((channel < 1) || (channel > 14)) {
-			rc = -EINVAL;
-		} else {
-			/* Yes ! We can set it !!! */
-			padapter->registrypriv.channel = channel;
-		}
-	}
-	return rc;
-}
-
-static int r8711_wx_get_freq(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-
-	if (!check_fwstate(pmlmepriv, _FW_LINKED))
-		return -ENOLINK;
-
-	wrqu->freq.m = ieee80211_wlan_frequencies[
-		       pcur_bss->Configuration.DSConfig - 1] * 100000;
-	wrqu->freq.e = 1;
-	wrqu->freq.i = pcur_bss->Configuration.DSConfig;
-
-	return 0;
-}
-
-static int r8711_wx_set_mode(struct net_device *dev,
-			     struct iw_request_info *a,
-			     union iwreq_data *wrqu, char *b)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	enum NDIS_802_11_NETWORK_INFRASTRUCTURE networkType;
-
-	switch (wrqu->mode) {
-	case IW_MODE_AUTO:
-		networkType = Ndis802_11AutoUnknown;
-		break;
-	case IW_MODE_ADHOC:
-		networkType = Ndis802_11IBSS;
-		break;
-	case IW_MODE_MASTER:
-		networkType = Ndis802_11APMode;
-		break;
-	case IW_MODE_INFRA:
-		networkType = Ndis802_11Infrastructure;
-		break;
-	default:
-		return -EINVAL;
-	}
-	if (Ndis802_11APMode == networkType)
-		r8712_setopmode_cmd(padapter, networkType);
-	else
-		r8712_setopmode_cmd(padapter, Ndis802_11AutoUnknown);
-
-	r8712_set_802_11_infrastructure_mode(padapter, networkType);
-	return 0;
-}
-
-static int r8711_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
-			     union iwreq_data *wrqu, char *b)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
-		wrqu->mode = IW_MODE_INFRA;
-	else if (check_fwstate(pmlmepriv,
-		 WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE))
-		wrqu->mode = IW_MODE_ADHOC;
-	else if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
-		wrqu->mode = IW_MODE_MASTER;
-	else
-		wrqu->mode = IW_MODE_AUTO;
-	return 0;
-}
-
-static int r871x_wx_set_pmkid(struct net_device *dev,
-			     struct iw_request_info *a,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-	struct iw_pmksa *pPMK = (struct iw_pmksa *) extra;
-	struct RT_PMKID_LIST *pl = psecuritypriv->PMKIDList;
-	u8 strZeroMacAddress[ETH_ALEN] = {0x00};
-	u8 strIssueBssid[ETH_ALEN] = {0x00};
-	u8 j, blInserted = false;
-	int intReturn = false;
-
-/*
- *	There are the BSSID information in the bssid.sa_data array.
- *	If cmd is IW_PMKSA_FLUSH, it means the wpa_supplicant wants to clear
- *	all the PMKID information. If cmd is IW_PMKSA_ADD, it means the
- *	wpa_supplicant wants to add a PMKID/BSSID to driver.
- *	If cmd is IW_PMKSA_REMOVE, it means the wpa_supplicant wants to
- *	remove a PMKID/BSSID from driver.
- */
-	if (!pPMK)
-		return -EINVAL;
-	memcpy(strIssueBssid, pPMK->bssid.sa_data, ETH_ALEN);
-	switch (pPMK->cmd) {
-	case IW_PMKSA_ADD:
-		if (!memcmp(strIssueBssid, strZeroMacAddress, ETH_ALEN))
-			return intReturn;
-		intReturn = true;
-		blInserted = false;
-		/* overwrite PMKID */
-		for (j = 0; j < NUM_PMKID_CACHE; j++) {
-			if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) {
-				/* BSSID is matched, the same AP => rewrite
-				 * with new PMKID.
-				 */
-				netdev_info(dev, "r8712u: %s: BSSID exists in the PMKList.\n",
-					    __func__);
-				memcpy(pl[j].PMKID, pPMK->pmkid, IW_PMKID_LEN);
-				pl[j].bUsed = true;
-				psecuritypriv->PMKIDIndex = j + 1;
-				blInserted = true;
-				break;
-			}
-		}
-		if (!blInserted) {
-			/* Find a new entry */
-			netdev_info(dev, "r8712u: %s: Use the new entry index = %d for this PMKID.\n",
-				    __func__, psecuritypriv->PMKIDIndex);
-			memcpy(pl[psecuritypriv->PMKIDIndex].Bssid,
-			       strIssueBssid, ETH_ALEN);
-			memcpy(pl[psecuritypriv->PMKIDIndex].PMKID,
-			       pPMK->pmkid, IW_PMKID_LEN);
-			pl[psecuritypriv->PMKIDIndex].bUsed = true;
-			psecuritypriv->PMKIDIndex++;
-			if (psecuritypriv->PMKIDIndex == NUM_PMKID_CACHE)
-				psecuritypriv->PMKIDIndex = 0;
-		}
-		break;
-	case IW_PMKSA_REMOVE:
-		intReturn = true;
-		for (j = 0; j < NUM_PMKID_CACHE; j++) {
-			if (!memcmp(pl[j].Bssid, strIssueBssid, ETH_ALEN)) {
-				/* BSSID is matched, the same AP => Remove
-				 * this PMKID information and reset it.
-				 */
-				eth_zero_addr(pl[j].Bssid);
-				pl[j].bUsed = false;
-				break;
-			}
-		}
-		break;
-	case IW_PMKSA_FLUSH:
-		memset(psecuritypriv->PMKIDList, 0,
-			sizeof(struct RT_PMKID_LIST) * NUM_PMKID_CACHE);
-		psecuritypriv->PMKIDIndex = 0;
-		intReturn = true;
-		break;
-	default:
-		netdev_info(dev, "r8712u: %s: unknown Command\n", __func__);
-		intReturn = false;
-		break;
-	}
-	return intReturn;
-}
-
-static int r8711_wx_get_sens(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	wrqu->sens.value = 0;
-	wrqu->sens.fixed = 0;	/* no auto select */
-	wrqu->sens.disabled = 1;
-	return 0;
-}
-
-static int r8711_wx_get_range(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct iw_range *range = (struct iw_range *)extra;
-	u16 val;
-	int i;
-
-	wrqu->data.length = sizeof(*range);
-	memset(range, 0, sizeof(*range));
-	/* Let's try to keep this struct in the same order as in
-	 * linux/include/wireless.h
-	 */
-
-	/* TODO: See what values we can set, and remove the ones we can't
-	 * set, or fill them with some default data.
-	 */
-	/* ~5 Mb/s real (802.11b) */
-	range->throughput = 5 * 1000 * 1000;
-	/* TODO: 8711 sensitivity ? */
-	/* signal level threshold range */
-	/* percent values between 0 and 100. */
-	range->max_qual.qual = 100;
-	range->max_qual.level = 100;
-	range->max_qual.noise = 100;
-	range->max_qual.updated = 7; /* Updated all three */
-	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
-	range->avg_qual.level = 0x100 - 78;
-	range->avg_qual.noise = 0;
-	range->avg_qual.updated = 7; /* Updated all three */
-	range->num_bitrates = RATE_COUNT;
-	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++)
-		range->bitrate[i] = rtl8180_rates[i];
-	range->min_frag = MIN_FRAG_THRESHOLD;
-	range->max_frag = MAX_FRAG_THRESHOLD;
-	range->pm_capa = 0;
-	range->we_version_compiled = WIRELESS_EXT;
-	range->we_version_source = 16;
-	range->num_channels = 14;
-	for (i = 0, val = 0; i < 14; i++) {
-		/* Include only legal frequencies for some countries */
-		range->freq[val].i = i + 1;
-		range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000;
-		range->freq[val].e = 1;
-		val++;
-		if (val == IW_MAX_FREQUENCIES)
-			break;
-	}
-	range->num_frequency = val;
-	range->enc_capa = IW_ENC_CAPA_WPA |
-			  IW_ENC_CAPA_WPA2 |
-			  IW_ENC_CAPA_CIPHER_TKIP |
-			  IW_ENC_CAPA_CIPHER_CCMP;
-	return 0;
-}
-
-static int r8711_wx_get_rate(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra);
-
-static int r871x_wx_set_priv(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *awrq,
-				char *extra)
-{
-	int ret = 0, len = 0;
-	char *ext;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *dwrq = (struct iw_point *)awrq;
-
-	len = dwrq->length;
-	ext = strndup_user(dwrq->pointer, len);
-	if (IS_ERR(ext))
-		return PTR_ERR(ext);
-
-	if (!strcasecmp(ext, "RSSI")) {
-		/*Return received signal strength indicator in -db for */
-		/* current AP */
-		/*<ssid> Rssi xx */
-		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
-		struct wlan_network *pcur_network = &pmlmepriv->cur_network;
-		/*static u8 xxxx; */
-		if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-			sprintf(ext, "%s rssi %d",
-				pcur_network->network.Ssid.Ssid,
-				/*(xxxx=xxxx+10) */
-				((padapter->recvpriv.fw_rssi) >> 1) - 95
-				/*pcur_network->network.Rssi */
-				);
-		} else {
-			sprintf(ext, "OK");
-		}
-	} else if (!strcasecmp(ext, "LINKSPEED")) {
-		/*Return link speed in MBPS */
-		/*LinkSpeed xx */
-		union iwreq_data wrqd;
-		int ret_inner;
-		int mbps;
-
-		ret_inner = r8711_wx_get_rate(dev, info, &wrqd, extra);
-		if (ret_inner != 0)
-			mbps = 0;
-		else
-			mbps = wrqd.bitrate.value / 1000000;
-		sprintf(ext, "LINKSPEED %d", mbps);
-	} else if (!strcasecmp(ext, "MACADDR")) {
-		/*Return mac address of the station */
-		/* Macaddr = xx:xx:xx:xx:xx:xx */
-		sprintf(ext, "MACADDR = %pM", dev->dev_addr);
-	} else if (!strcasecmp(ext, "SCAN-ACTIVE")) {
-		/*Set scan type to active */
-		/*OK if successful */
-		struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-		pmlmepriv->passive_mode = 1;
-		sprintf(ext, "OK");
-	} else if (!strcasecmp(ext, "SCAN-PASSIVE")) {
-		/*Set scan type to passive */
-		/*OK if successful */
-		struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-		pmlmepriv->passive_mode = 0;
-		sprintf(ext, "OK");
-	} else if (!strncmp(ext, "DCE-E", 5)) {
-		/*Set scan type to passive */
-		/*OK if successful */
-		r8712_disconnectCtrlEx_cmd(padapter
-			, 1 /*u32 enableDrvCtrl */
-			, 5 /*u32 tryPktCnt */
-			, 100 /*u32 tryPktInterval */
-			, 5000 /*u32 firstStageTO */
-		);
-		sprintf(ext, "OK");
-	} else if (!strncmp(ext, "DCE-D", 5)) {
-		/*Set scan type to passive */
-		/*OK if successfu */
-		r8712_disconnectCtrlEx_cmd(padapter
-			, 0 /*u32 enableDrvCtrl */
-			, 5 /*u32 tryPktCnt */
-			, 100 /*u32 tryPktInterval */
-			, 5000 /*u32 firstStageTO */
-		);
-		sprintf(ext, "OK");
-	} else {
-		netdev_info(dev, "r8712u: %s: unknown Command %s.\n",
-			    __func__, ext);
-		goto FREE_EXT;
-	}
-	if (copy_to_user(dwrq->pointer, ext,
-				min(dwrq->length, (__u16)(strlen(ext) + 1))))
-		ret = -EFAULT;
-
-FREE_EXT:
-	kfree(ext);
-	return ret;
-}
-
-/* set bssid flow
- * s1. set_802_11_infrastructure_mode()
- * s2. set_802_11_authentication_mode()
- * s3. set_802_11_encryption_mode()
- * s4. set_802_11_bssid()
- *
- * This function intends to handle the Set AP command, which specifies the
- * MAC# of a preferred Access Point.
- * Currently, the request comes via Wireless Extensions' SIOCSIWAP ioctl.
- *
- * For this operation to succeed, there is no need for the interface to be up.
- *
- */
-static int r8711_wx_set_wap(struct net_device *dev,
-			 struct iw_request_info *info,
-			 union iwreq_data *awrq,
-			 char *extra)
-{
-	int ret = -EINPROGRESS;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-	struct sockaddr *temp = (struct sockaddr *)awrq;
-	unsigned long irqL;
-	struct list_head *phead;
-	u8 *dst_bssid;
-	struct wlan_network *pnetwork = NULL;
-	enum NDIS_802_11_AUTHENTICATION_MODE	authmode;
-
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
-		return -EBUSY;
-	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
-		return ret;
-	if (temp->sa_family != ARPHRD_ETHER)
-		return -EINVAL;
-	authmode = padapter->securitypriv.ndisauthtype;
-	spin_lock_irqsave(&queue->lock, irqL);
-	phead = &queue->queue;
-	pmlmepriv->pscanned = phead->next;
-	while (1) {
-		if (end_of_queue_search(phead, pmlmepriv->pscanned))
-			break;
-		pnetwork = container_of(pmlmepriv->pscanned,
-					struct wlan_network, list);
-		pmlmepriv->pscanned = pmlmepriv->pscanned->next;
-		dst_bssid = pnetwork->network.MacAddress;
-		if (!memcmp(dst_bssid, temp->sa_data, ETH_ALEN)) {
-			r8712_set_802_11_infrastructure_mode(padapter,
-			    pnetwork->network.InfrastructureMode);
-			break;
-		}
-	}
-	spin_unlock_irqrestore(&queue->lock, irqL);
-	if (!ret) {
-		if (!r8712_set_802_11_authentication_mode(padapter, authmode)) {
-			ret = -ENOMEM;
-		} else {
-			if (!r8712_set_802_11_bssid(padapter, temp->sa_data))
-				ret = -1;
-		}
-	}
-	return ret;
-}
-
-static int r8711_wx_get_wap(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-
-	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
-	if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE |
-				     WIFI_AP_STATE))
-		ether_addr_copy(wrqu->ap_addr.sa_data, pcur_bss->MacAddress);
-	else
-		eth_zero_addr(wrqu->ap_addr.sa_data);
-	return 0;
-}
-
-static int r871x_wx_set_mlme(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	int ret = 0;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_mlme *mlme = (struct iw_mlme *) extra;
-
-	if (!mlme)
-		return -1;
-	switch (mlme->cmd) {
-	case IW_MLME_DEAUTH:
-		if (!r8712_set_802_11_disassociate(padapter))
-			ret = -1;
-		break;
-	case IW_MLME_DISASSOC:
-		if (!r8712_set_802_11_disassociate(padapter))
-			ret = -1;
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return ret;
-}
-
-/*
- *
- * This function intends to handle the Set Scan command.
- * Currently, the request comes via Wireless Extensions' SIOCSIWSCAN ioctl.
- *
- * For this operation to succeed, the interface is brought Up beforehand.
- *
- */
-static int r8711_wx_set_scan(struct net_device *dev,
-			struct iw_request_info *a,
-			union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	u8 status = true;
-
-	if (padapter->driver_stopped) {
-		netdev_info(dev, "In %s: driver_stopped=%d\n",
-			    __func__, padapter->driver_stopped);
-		return -1;
-	}
-	if (!padapter->bup)
-		return -ENETDOWN;
-	if (!padapter->hw_init_completed)
-		return -1;
-	if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) ||
-	    (pmlmepriv->sitesurveyctrl.traffic_busy))
-		return 0;
-	if (wrqu->data.length == sizeof(struct iw_scan_req)) {
-		struct iw_scan_req *req = (struct iw_scan_req *)extra;
-
-		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-			struct ndis_802_11_ssid ssid;
-			unsigned long irqL;
-			u32 len = min_t(u8, req->essid_len, IW_ESSID_MAX_SIZE);
-
-			memset((unsigned char *)&ssid, 0,
-				 sizeof(struct ndis_802_11_ssid));
-			memcpy(ssid.Ssid, req->essid, len);
-			ssid.SsidLength = len;
-			spin_lock_irqsave(&pmlmepriv->lock, irqL);
-			if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
-			     _FW_UNDER_LINKING)) ||
-			    (pmlmepriv->sitesurveyctrl.traffic_busy)) {
-				if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
-					status = false;
-			} else {
-				status = r8712_sitesurvey_cmd(padapter, &ssid);
-			}
-			spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-		}
-	} else {
-		status = r8712_set_802_11_bssid_list_scan(padapter);
-	}
-	if (!status)
-		return -1;
-	return 0;
-}
-
-static int r8711_wx_get_scan(struct net_device *dev,
-				struct iw_request_info *a,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-	struct wlan_network *pnetwork = NULL;
-	unsigned long irqL;
-	struct list_head *plist, *phead;
-	char *ev = extra;
-	char *stop = ev + wrqu->data.length;
-	u32 ret = 0, cnt = 0;
-
-	if (padapter->driver_stopped)
-		return -EINVAL;
-	while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
-			     _FW_UNDER_LINKING)) {
-		msleep(30);
-		cnt++;
-		if (cnt > 100)
-			break;
-	}
-	spin_lock_irqsave(&queue->lock, irqL);
-	phead = &queue->queue;
-	plist = phead->next;
-	while (1) {
-		if (end_of_queue_search(phead, plist))
-			break;
-		if ((stop - ev) < SCAN_ITEM_SIZE) {
-			ret = -E2BIG;
-			break;
-		}
-		pnetwork = container_of(plist, struct wlan_network, list);
-		ev = translate_scan(padapter, a, pnetwork, ev, stop);
-		plist = plist->next;
-	}
-	spin_unlock_irqrestore(&queue->lock, irqL);
-	wrqu->data.length = ev - extra;
-	wrqu->data.flags = 0;
-	return ret;
-}
-
-/* set ssid flow
- * s1. set_802_11_infrastructure_mode()
- * s2. set_802_11_authenticaion_mode()
- * s3. set_802_11_encryption_mode()
- * s4. set_802_11_ssid()
- *
- * This function intends to handle the Set ESSID command.
- * Currently, the request comes via the Wireless Extensions' SIOCSIWESSID ioctl.
- *
- * For this operation to succeed, there is no need for the interface to be Up.
- *
- */
-static int r8711_wx_set_essid(struct net_device *dev,
-				struct iw_request_info *a,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-	struct wlan_network *pnetwork = NULL;
-	enum NDIS_802_11_AUTHENTICATION_MODE	authmode;
-	struct ndis_802_11_ssid ndis_ssid;
-	u8 *dst_ssid, *src_ssid;
-	struct list_head *phead;
-	u32 len;
-
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
-		return -EBUSY;
-	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
-		return 0;
-	if (wrqu->essid.length > IW_ESSID_MAX_SIZE)
-		return -E2BIG;
-	authmode = padapter->securitypriv.ndisauthtype;
-	if (wrqu->essid.flags && wrqu->essid.length) {
-		len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ?
-		       wrqu->essid.length : IW_ESSID_MAX_SIZE;
-		memset(&ndis_ssid, 0, sizeof(struct ndis_802_11_ssid));
-		ndis_ssid.SsidLength = len;
-		memcpy(ndis_ssid.Ssid, extra, len);
-		src_ssid = ndis_ssid.Ssid;
-		phead = &queue->queue;
-		pmlmepriv->pscanned = phead->next;
-		while (1) {
-			if (end_of_queue_search(phead, pmlmepriv->pscanned))
-				break;
-			pnetwork = container_of(pmlmepriv->pscanned,
-						struct wlan_network, list);
-			pmlmepriv->pscanned = pmlmepriv->pscanned->next;
-			dst_ssid = pnetwork->network.Ssid.Ssid;
-			if ((!memcmp(dst_ssid, src_ssid, ndis_ssid.SsidLength))
-			    && (pnetwork->network.Ssid.SsidLength ==
-			     ndis_ssid.SsidLength)) {
-				if (check_fwstate(pmlmepriv,
-							WIFI_ADHOC_STATE)) {
-					if (pnetwork->network.
-						InfrastructureMode
-						!=
-						padapter->mlmepriv.
-						cur_network.network.
-						InfrastructureMode)
-						continue;
-				}
-
-				r8712_set_802_11_infrastructure_mode(
-				     padapter,
-				     pnetwork->network.InfrastructureMode);
-				break;
-			}
-		}
-		r8712_set_802_11_authentication_mode(padapter, authmode);
-		r8712_set_802_11_ssid(padapter, &ndis_ssid);
-	}
-	return -EINPROGRESS;
-}
-
-static int r8711_wx_get_essid(struct net_device *dev,
-				struct iw_request_info *a,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-	u32 len, ret = 0;
-
-	if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
-		len = pcur_bss->Ssid.SsidLength;
-		wrqu->essid.length = len;
-		memcpy(extra, pcur_bss->Ssid.Ssid, len);
-		wrqu->essid.flags = 1;
-	} else {
-		ret = -ENOLINK;
-	}
-	return ret;
-}
-
-static int r8711_wx_set_rate(struct net_device *dev,
-				struct iw_request_info *a,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	u32 target_rate = wrqu->bitrate.value;
-	u32 fixed = wrqu->bitrate.fixed;
-	u32 ratevalue = 0;
-	u8 datarates[NumRates];
-	u8 mpdatarate[NumRates] = {11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, 0xff};
-	int i;
-
-	if (target_rate == -1) {
-		ratevalue = 11;
-		goto set_rate;
-	}
-	target_rate = target_rate / 100000;
-	switch (target_rate) {
-	case 10:
-		ratevalue = 0;
-		break;
-	case 20:
-		ratevalue = 1;
-		break;
-	case 55:
-		ratevalue = 2;
-		break;
-	case 60:
-		ratevalue = 3;
-		break;
-	case 90:
-		ratevalue = 4;
-		break;
-	case 110:
-		ratevalue = 5;
-		break;
-	case 120:
-		ratevalue = 6;
-		break;
-	case 180:
-		ratevalue = 7;
-		break;
-	case 240:
-		ratevalue = 8;
-		break;
-	case 360:
-		ratevalue = 9;
-		break;
-	case 480:
-		ratevalue = 10;
-		break;
-	case 540:
-		ratevalue = 11;
-		break;
-	default:
-		ratevalue = 11;
-		break;
-	}
-set_rate:
-	for (i = 0; i < NumRates; i++) {
-		if (ratevalue == mpdatarate[i]) {
-			datarates[i] = mpdatarate[i];
-			if (fixed == 0)
-				break;
-		} else {
-			datarates[i] = 0xff;
-		}
-	}
-	return r8712_setdatarate_cmd(padapter, datarates);
-}
-
-static int r8711_wx_get_rate(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
-	struct ieee80211_ht_cap *pht_capie;
-	unsigned char rf_type = padapter->registrypriv.rf_config;
-	int i;
-	u8 *p;
-	u16 rate, max_rate = 0, ht_cap = false;
-	u32 ht_ielen = 0;
-	u8 bw_40MHz = 0, short_GI = 0;
-	u16 mcs_rate = 0;
-
-	i = 0;
-	if (!check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE))
-		return -ENOLINK;
-	p = r8712_get_ie(&pcur_bss->IEs[12], WLAN_EID_HT_CAPABILITY, &ht_ielen,
-			 pcur_bss->IELength - 12);
-	if (p && ht_ielen > 0) {
-		ht_cap = true;
-		pht_capie = (struct ieee80211_ht_cap *)(p + 2);
-		memcpy(&mcs_rate, &pht_capie->mcs, 2);
-		bw_40MHz = (le16_to_cpu(pht_capie->cap_info) &
-			    IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0;
-		short_GI = (le16_to_cpu(pht_capie->cap_info) &
-			    (IEEE80211_HT_CAP_SGI_20 |
-			    IEEE80211_HT_CAP_SGI_40)) ? 1 : 0;
-	}
-	while ((pcur_bss->rates[i] != 0) &&
-	       (pcur_bss->rates[i] != 0xFF)) {
-		rate = pcur_bss->rates[i] & 0x7F;
-		if (rate > max_rate)
-			max_rate = rate;
-		wrqu->bitrate.fixed = 0;	/* no auto select */
-		wrqu->bitrate.value = rate * 500000;
-		i++;
-	}
-	if (ht_cap) {
-		if (mcs_rate & 0x8000 /* MCS15 */
-		    &&
-		    rf_type == RTL8712_RF_2T2R)
-			max_rate = (bw_40MHz) ? ((short_GI) ? 300 : 270) :
-			((short_GI) ? 144 : 130);
-		else /* default MCS7 */
-			max_rate = (bw_40MHz) ? ((short_GI) ? 150 : 135) :
-			((short_GI) ? 72 : 65);
-		max_rate *= 2; /* Mbps/2 */
-	}
-	wrqu->bitrate.value = max_rate * 500000;
-	return 0;
-}
-
-static int r8711_wx_get_rts(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	wrqu->rts.value = padapter->registrypriv.rts_thresh;
-	wrqu->rts.fixed = 0;	/* no auto select */
-	return 0;
-}
-
-static int r8711_wx_set_frag(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	if (wrqu->frag.disabled) {
-		padapter->xmitpriv.frag_len = MAX_FRAG_THRESHOLD;
-	} else {
-		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
-		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
-			return -EINVAL;
-		padapter->xmitpriv.frag_len = wrqu->frag.value & ~0x1;
-	}
-	return 0;
-}
-
-static int r8711_wx_get_frag(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	wrqu->frag.value = padapter->xmitpriv.frag_len;
-	wrqu->frag.fixed = 0;	/* no auto select */
-	return 0;
-}
-
-static int r8711_wx_get_retry(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	wrqu->retry.value = 7;
-	wrqu->retry.fixed = 0;	/* no auto select */
-	wrqu->retry.disabled = 1;
-	return 0;
-}
-
-static int r8711_wx_set_enc(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *keybuf)
-{
-	u32 key;
-	u32 keyindex_provided;
-	struct NDIS_802_11_WEP	 wep;
-	enum NDIS_802_11_AUTHENTICATION_MODE authmode;
-	struct iw_point *erq = &wrqu->encoding;
-	struct _adapter *padapter = netdev_priv(dev);
-
-	key = erq->flags & IW_ENCODE_INDEX;
-	memset(&wep, 0, sizeof(struct NDIS_802_11_WEP));
-	if (erq->flags & IW_ENCODE_DISABLED) {
-		netdev_info(dev, "r8712u: %s: EncryptionDisabled\n", __func__);
-		padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11EncryptionDisabled;
-		padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
-		padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
-		padapter->securitypriv.AuthAlgrthm = 0; /* open system */
-		authmode = Ndis802_11AuthModeOpen;
-		padapter->securitypriv.ndisauthtype = authmode;
-		return 0;
-	}
-	if (key) {
-		if (key > WEP_KEYS)
-			return -EINVAL;
-		key--;
-		keyindex_provided = 1;
-	} else {
-		keyindex_provided = 0;
-		key = padapter->securitypriv.PrivacyKeyIndex;
-	}
-	/* set authentication mode */
-	if (erq->flags & IW_ENCODE_OPEN) {
-		netdev_info(dev, "r8712u: %s: IW_ENCODE_OPEN\n", __func__);
-		padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.AuthAlgrthm = 0; /* open system */
-		padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
-		padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
-		authmode = Ndis802_11AuthModeOpen;
-		padapter->securitypriv.ndisauthtype = authmode;
-	} else if (erq->flags & IW_ENCODE_RESTRICTED) {
-		netdev_info(dev,
-				"r8712u: %s: IW_ENCODE_RESTRICTED\n", __func__);
-		padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.AuthAlgrthm = 1; /* shared system */
-		padapter->securitypriv.PrivacyAlgrthm = _WEP40_;
-		padapter->securitypriv.XGrpPrivacy = _WEP40_;
-		authmode = Ndis802_11AuthModeShared;
-		padapter->securitypriv.ndisauthtype = authmode;
-	} else {
-		padapter->securitypriv.ndisencryptstatus =
-				 Ndis802_11Encryption1Enabled;
-		padapter->securitypriv.AuthAlgrthm = 0; /* open system */
-		padapter->securitypriv.PrivacyAlgrthm = _NO_PRIVACY_;
-		padapter->securitypriv.XGrpPrivacy = _NO_PRIVACY_;
-		authmode = Ndis802_11AuthModeOpen;
-		padapter->securitypriv.ndisauthtype = authmode;
-	}
-	wep.KeyIndex = key;
-	if (erq->length > 0) {
-		wep.KeyLength = erq->length <= 5 ? 5 : 13;
-		wep.Length = wep.KeyLength +
-			     offsetof(struct NDIS_802_11_WEP, KeyMaterial);
-	} else {
-		wep.KeyLength = 0;
-		if (keyindex_provided == 1) { /* set key_id only, no given
-					       * KeyMaterial(erq->length==0).
-					       */
-			padapter->securitypriv.PrivacyKeyIndex = key;
-			switch (padapter->securitypriv.DefKeylen[key]) {
-			case 5:
-				padapter->securitypriv.PrivacyAlgrthm =
-						 _WEP40_;
-				break;
-			case 13:
-				padapter->securitypriv.PrivacyAlgrthm =
-						 _WEP104_;
-				break;
-			default:
-				padapter->securitypriv.PrivacyAlgrthm =
-						 _NO_PRIVACY_;
-				break;
-			}
-			return 0;
-		}
-	}
-	wep.KeyIndex |= 0x80000000;	/* transmit key */
-	memcpy(wep.KeyMaterial, keybuf, wep.KeyLength);
-	if (r8712_set_802_11_add_wep(padapter, &wep))
-		return -EOPNOTSUPP;
-	return 0;
-}
-
-static int r8711_wx_get_enc(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *keybuf)
-{
-	uint key;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *erq = &wrqu->encoding;
-	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	union Keytype *dk = padapter->securitypriv.DefKey;
-
-	if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-		if (!check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
-			erq->length = 0;
-			erq->flags |= IW_ENCODE_DISABLED;
-			return 0;
-		}
-	}
-	key = erq->flags & IW_ENCODE_INDEX;
-	if (key) {
-		if (key > WEP_KEYS)
-			return -EINVAL;
-		key--;
-	} else {
-		key = padapter->securitypriv.PrivacyKeyIndex;
-	}
-	erq->flags = key + 1;
-	switch (padapter->securitypriv.ndisencryptstatus) {
-	case Ndis802_11EncryptionNotSupported:
-	case Ndis802_11EncryptionDisabled:
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_DISABLED;
-		break;
-	case Ndis802_11Encryption1Enabled:
-		erq->length = padapter->securitypriv.DefKeylen[key];
-		if (erq->length) {
-			memcpy(keybuf, dk[key].skey,
-			       padapter->securitypriv.DefKeylen[key]);
-			erq->flags |= IW_ENCODE_ENABLED;
-			if (padapter->securitypriv.ndisauthtype ==
-			    Ndis802_11AuthModeOpen)
-				erq->flags |= IW_ENCODE_OPEN;
-			else if (padapter->securitypriv.ndisauthtype ==
-				 Ndis802_11AuthModeShared)
-				erq->flags |= IW_ENCODE_RESTRICTED;
-		} else {
-			erq->length = 0;
-			erq->flags |= IW_ENCODE_DISABLED;
-		}
-		break;
-	case Ndis802_11Encryption2Enabled:
-	case Ndis802_11Encryption3Enabled:
-		erq->length = 16;
-		erq->flags |= (IW_ENCODE_ENABLED | IW_ENCODE_OPEN |
-			       IW_ENCODE_NOKEY);
-		break;
-	default:
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_DISABLED;
-		break;
-	}
-	return 0;
-}
-
-static int r8711_wx_get_power(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	wrqu->power.value = 0;
-	wrqu->power.fixed = 0;	/* no auto select */
-	wrqu->power.disabled = 1;
-	return 0;
-}
-
-static int r871x_wx_set_gen_ie(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	return r871x_set_wpa_ie(padapter, extra, wrqu->data.length);
-}
-
-static int r871x_wx_set_auth(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_param *param = (struct iw_param *)&wrqu->param;
-	int paramid;
-	int paramval;
-	int ret = 0;
-
-	paramid = param->flags & IW_AUTH_INDEX;
-	paramval = param->value;
-	switch (paramid) {
-	case IW_AUTH_WPA_VERSION:
-		break;
-	case IW_AUTH_CIPHER_PAIRWISE:
-		break;
-	case IW_AUTH_CIPHER_GROUP:
-		break;
-	case IW_AUTH_KEY_MGMT:
-		/*
-		 *  ??? does not use these parameters
-		 */
-		break;
-	case IW_AUTH_TKIP_COUNTERMEASURES:
-		if (paramval) {
-			/* wpa_supplicant is enabling tkip countermeasure. */
-			padapter->securitypriv.btkip_countermeasure = true;
-		} else {
-			/* wpa_supplicant is disabling tkip countermeasure. */
-			padapter->securitypriv.btkip_countermeasure = false;
-		}
-		break;
-	case IW_AUTH_DROP_UNENCRYPTED:
-		/* HACK:
-		 *
-		 * wpa_supplicant calls set_wpa_enabled when the driver
-		 * is loaded and unloaded, regardless of if WPA is being
-		 * used.  No other calls are made which can be used to
-		 * determine if encryption will be used or not prior to
-		 * association being expected.  If encryption is not being
-		 * used, drop_unencrypted is set to false, else true -- we
-		 * can use this to determine if the CAP_PRIVACY_ON bit should
-		 * be set.
-		 */
-		if (padapter->securitypriv.ndisencryptstatus ==
-		    Ndis802_11Encryption1Enabled) {
-			/* it means init value, or using wep,
-			 * ndisencryptstatus =
-			 *	Ndis802_11Encryption1Enabled,
-			 * then it needn't reset it;
-			 */
-			break;
-		}
-
-		if (paramval) {
-			padapter->securitypriv.ndisencryptstatus =
-				   Ndis802_11EncryptionDisabled;
-			padapter->securitypriv.PrivacyAlgrthm =
-				  _NO_PRIVACY_;
-			padapter->securitypriv.XGrpPrivacy =
-				  _NO_PRIVACY_;
-			padapter->securitypriv.AuthAlgrthm = 0;
-			padapter->securitypriv.ndisauthtype =
-				  Ndis802_11AuthModeOpen;
-		}
-		break;
-	case IW_AUTH_80211_AUTH_ALG:
-		ret = wpa_set_auth_algs(dev, (u32)paramval);
-		break;
-	case IW_AUTH_WPA_ENABLED:
-		break;
-	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-		break;
-	case IW_AUTH_PRIVACY_INVOKED:
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-
-	return ret;
-}
-
-static int r871x_wx_set_enc_ext(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	struct iw_point *pencoding = &wrqu->encoding;
-	struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
-	struct ieee_param *param = NULL;
-	char *alg_name;
-	u32 param_len;
-	int ret = 0;
-
-	switch (pext->alg) {
-	case IW_ENCODE_ALG_NONE:
-		alg_name = "none";
-		break;
-	case IW_ENCODE_ALG_WEP:
-		alg_name = "WEP";
-		break;
-	case IW_ENCODE_ALG_TKIP:
-		alg_name = "TKIP";
-		break;
-	case IW_ENCODE_ALG_CCMP:
-		alg_name = "CCMP";
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	param_len = sizeof(struct ieee_param) + pext->key_len;
-	param = kzalloc(param_len, GFP_ATOMIC);
-	if (!param)
-		return -ENOMEM;
-	param->cmd = IEEE_CMD_SET_ENCRYPTION;
-	eth_broadcast_addr(param->sta_addr);
-	strscpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
-	if (pext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
-		param->u.crypt.set_tx = 0;
-	if (pext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-		param->u.crypt.set_tx = 1;
-	param->u.crypt.idx = (pencoding->flags & 0x00FF) - 1;
-	if (pext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
-		memcpy(param->u.crypt.seq, pext->rx_seq, 8);
-	if (pext->key_len) {
-		param->u.crypt.key_len = pext->key_len;
-		memcpy(param + 1, pext + 1, pext->key_len);
-	}
-	ret = wpa_set_encryption(dev, param, param_len);
-	kfree(param);
-	return ret;
-}
-
-static int r871x_wx_get_nick(struct net_device *dev,
-			     struct iw_request_info *info,
-			     union iwreq_data *wrqu, char *extra)
-{
-	if (extra) {
-		wrqu->data.length = 8;
-		wrqu->data.flags = 1;
-		memcpy(extra, "rtl_wifi", 8);
-	}
-	return 0;
-}
-
-static int r8711_wx_read32(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *keybuf)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	u32 addr;
-	u32 data32;
-
-	get_user(addr, (u32 __user *)wrqu->data.pointer);
-	data32 = r8712_read32(padapter, addr);
-	put_user(data32, (u32 __user *)wrqu->data.pointer);
-	wrqu->data.length = (data32 & 0xffff0000) >> 16;
-	wrqu->data.flags = data32 & 0xffff;
-	get_user(addr, (u32 __user *)wrqu->data.pointer);
-	return 0;
-}
-
-static int r8711_wx_write32(struct net_device *dev,
-				 struct iw_request_info *info,
-				 union iwreq_data *wrqu, char *keybuf)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	u32 addr;
-	u32 data32;
-
-	get_user(addr, (u32 __user *)wrqu->data.pointer);
-	data32 = ((u32)wrqu->data.length << 16) | (u32)wrqu->data.flags;
-	r8712_write32(padapter, addr, data32);
-	return 0;
-}
-
-static int dummy(struct net_device *dev,
-		struct iw_request_info *a,
-		union iwreq_data *wrqu, char *b)
-{
-	return -EINVAL;
-}
-
-static int r8711_drvext_hdl(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	return 0;
-}
-
-static int r871x_mp_ioctl_hdl(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *p = &wrqu->data;
-	struct oid_par_priv oid_par;
-	struct mp_ioctl_handler *phandler;
-	struct mp_ioctl_param *poidparam;
-	unsigned long BytesRead, BytesWritten, BytesNeeded;
-	u8 *pparmbuf, bset;
-	u16 len;
-	uint status;
-	int ret = 0;
-
-	if ((!p->length) || (!p->pointer))
-		return -EINVAL;
-
-	bset = (u8)(p->flags & 0xFFFF);
-	len = p->length;
-	pparmbuf = memdup_user(p->pointer, len);
-	if (IS_ERR(pparmbuf))
-		return PTR_ERR(pparmbuf);
-
-	poidparam = (struct mp_ioctl_param *)pparmbuf;
-	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
-		ret = -EINVAL;
-		goto _r871x_mp_ioctl_hdl_exit;
-	}
-	phandler = mp_ioctl_hdl + poidparam->subcode;
-	if ((phandler->paramsize != 0) &&
-	    (poidparam->len < phandler->paramsize)) {
-		ret = -EINVAL;
-		goto _r871x_mp_ioctl_hdl_exit;
-	}
-	if (phandler->oid == 0 && phandler->handler) {
-		status = phandler->handler(&oid_par);
-	} else if (phandler->handler) {
-		oid_par.adapter_context = padapter;
-		oid_par.oid = phandler->oid;
-		oid_par.information_buf = poidparam->data;
-		oid_par.information_buf_len = poidparam->len;
-		oid_par.dbg = 0;
-		BytesWritten = 0;
-		BytesNeeded = 0;
-		if (bset) {
-			oid_par.bytes_rw = &BytesRead;
-			oid_par.bytes_needed = &BytesNeeded;
-			oid_par.type_of_oid = SET_OID;
-		} else {
-			oid_par.bytes_rw = &BytesWritten;
-			oid_par.bytes_needed = &BytesNeeded;
-			oid_par.type_of_oid = QUERY_OID;
-		}
-		status = phandler->handler(&oid_par);
-		/* todo:check status, BytesNeeded, etc. */
-	} else {
-		netdev_info(dev, "r8712u: %s: err!, subcode=%d, oid=%d, handler=%p\n",
-			    __func__, poidparam->subcode, phandler->oid,
-			    phandler->handler);
-		ret = -EFAULT;
-		goto _r871x_mp_ioctl_hdl_exit;
-	}
-	if (bset == 0x00) { /* query info */
-		if (copy_to_user(p->pointer, pparmbuf, len))
-			ret = -EFAULT;
-	}
-	if (status) {
-		ret = -EFAULT;
-		goto _r871x_mp_ioctl_hdl_exit;
-	}
-_r871x_mp_ioctl_hdl_exit:
-	kfree(pparmbuf);
-	return ret;
-}
-
-static int r871x_get_ap_info(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-	struct iw_point *pdata = &wrqu->data;
-	struct wlan_network *pnetwork = NULL;
-	u32 cnt = 0, wpa_ielen;
-	unsigned long irqL;
-	struct list_head *plist, *phead;
-	unsigned char *pbuf;
-	u8 bssid[ETH_ALEN];
-	char data[33];
-
-	if (padapter->driver_stopped || !pdata)
-		return -EINVAL;
-	while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
-			     _FW_UNDER_LINKING)) {
-		msleep(30);
-		cnt++;
-		if (cnt > 100)
-			break;
-	}
-	pdata->flags = 0;
-	if (pdata->length < 32)
-		return -EINVAL;
-	if (copy_from_user(data, pdata->pointer, 32))
-		return -EINVAL;
-	data[32] = 0;
-
-	spin_lock_irqsave(&pmlmepriv->scanned_queue.lock, irqL);
-	phead = &queue->queue;
-	plist = phead->next;
-	while (1) {
-		if (end_of_queue_search(phead, plist))
-			break;
-		pnetwork = container_of(plist, struct wlan_network, list);
-		if (!mac_pton(data, bssid)) {
-			netdev_info(dev, "r8712u: Invalid BSSID '%s'.\n",
-				    (u8 *)data);
-			spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock,
-					       irqL);
-			return -EINVAL;
-		}
-		netdev_info(dev, "r8712u: BSSID:%pM\n", bssid);
-		if (ether_addr_equal(bssid, pnetwork->network.MacAddress)) {
-			/* BSSID match, then check if supporting wpa/wpa2 */
-			pbuf = r8712_get_wpa_ie(&pnetwork->network.IEs[12],
-			       &wpa_ielen, pnetwork->network.IELength - 12);
-			if (pbuf && (wpa_ielen > 0)) {
-				pdata->flags = 1;
-				break;
-			}
-			pbuf = r8712_get_wpa2_ie(&pnetwork->network.IEs[12],
-			       &wpa_ielen, pnetwork->network.IELength - 12);
-			if (pbuf && (wpa_ielen > 0)) {
-				pdata->flags = 2;
-				break;
-			}
-		}
-		plist = plist->next;
-	}
-	spin_unlock_irqrestore(&pmlmepriv->scanned_queue.lock, irqL);
-	if (pdata->length >= 34) {
-		if (copy_to_user((u8 __user *)pdata->pointer + 32,
-		    (u8 *)&pdata->flags, 1))
-			return -EINVAL;
-	}
-	return 0;
-}
-
-static int r871x_set_pid(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *pdata = &wrqu->data;
-
-	if (padapter->driver_stopped || !pdata)
-		return -EINVAL;
-	if (copy_from_user(&padapter->pid, pdata->pointer, sizeof(int)))
-		return -EINVAL;
-	return 0;
-}
-
-static int r871x_set_chplan(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	int ret = 0;
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *pdata = &wrqu->data;
-	int ch_plan = -1;
-
-	if (padapter->driver_stopped || !pdata) {
-		ret = -EINVAL;
-		goto exit;
-	}
-	ch_plan = (int)*extra;
-	r8712_set_chplan_cmd(padapter, ch_plan);
-
-exit:
-
-	return ret;
-}
-
-static int r871x_wps_start(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_point *pdata = &wrqu->data;
-	u32   u32wps_start = 0;
-
-	if (padapter->driver_stopped || !pdata)
-		return -EINVAL;
-	if (copy_from_user((void *)&u32wps_start, pdata->pointer, 4))
-		return -EFAULT;
-	if (u32wps_start == 0)
-		u32wps_start = *extra;
-	if (u32wps_start == 1) /* WPS Start */
-		padapter->ledpriv.LedControlHandler(padapter,
-			   LED_CTL_START_WPS);
-	else if (u32wps_start == 2) /* WPS Stop because of wps success */
-		padapter->ledpriv.LedControlHandler(padapter,
-			   LED_CTL_STOP_WPS);
-	else if (u32wps_start == 3) /* WPS Stop because of wps fail */
-		padapter->ledpriv.LedControlHandler(padapter,
-			   LED_CTL_STOP_WPS_FAIL);
-	return 0;
-}
-
-static int wpa_set_param(struct net_device *dev, u8 name, u32 value)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	switch (name) {
-	case IEEE_PARAM_WPA_ENABLED:
-		padapter->securitypriv.AuthAlgrthm = 2; /* 802.1x */
-		switch ((value) & 0xff) {
-		case 1: /* WPA */
-			padapter->securitypriv.ndisauthtype =
-				Ndis802_11AuthModeWPAPSK; /* WPA_PSK */
-			padapter->securitypriv.ndisencryptstatus =
-				Ndis802_11Encryption2Enabled;
-			break;
-		case 2: /* WPA2 */
-			padapter->securitypriv.ndisauthtype =
-				Ndis802_11AuthModeWPA2PSK; /* WPA2_PSK */
-			padapter->securitypriv.ndisencryptstatus =
-				Ndis802_11Encryption3Enabled;
-			break;
-		}
-		break;
-	case IEEE_PARAM_TKIP_COUNTERMEASURES:
-		break;
-	case IEEE_PARAM_DROP_UNENCRYPTED:
-		/* HACK:
-		 *
-		 * wpa_supplicant calls set_wpa_enabled when the driver
-		 * is loaded and unloaded, regardless of if WPA is being
-		 * used.  No other calls are made which can be used to
-		 * determine if encryption will be used or not prior to
-		 * association being expected.  If encryption is not being
-		 * used, drop_unencrypted is set to false, else true -- we
-		 * can use this to determine if the CAP_PRIVACY_ON bit should
-		 * be set.
-		 */
-		break;
-	case IEEE_PARAM_PRIVACY_INVOKED:
-		break;
-	case IEEE_PARAM_AUTH_ALGS:
-		return wpa_set_auth_algs(dev, value);
-	case IEEE_PARAM_IEEE_802_1X:
-		break;
-	case IEEE_PARAM_WPAX_SELECT:
-		/* added for WPA2 mixed mode */
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int wpa_mlme(struct net_device *dev, u32 command, u32 reason)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-
-	switch (command) {
-	case IEEE_MLME_STA_DEAUTH:
-		if (!r8712_set_802_11_disassociate(padapter))
-			return -1;
-		break;
-	case IEEE_MLME_STA_DISASSOC:
-		if (!r8712_set_802_11_disassociate(padapter))
-			return -1;
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
-{
-	struct ieee_param *param;
-	int ret = 0;
-	struct _adapter *padapter = netdev_priv(dev);
-
-	if (p->length < sizeof(struct ieee_param) || !p->pointer)
-		return -EINVAL;
-	param = memdup_user(p->pointer, p->length);
-	if (IS_ERR(param))
-		return PTR_ERR(param);
-	switch (param->cmd) {
-	case IEEE_CMD_SET_WPA_PARAM:
-		ret = wpa_set_param(dev, param->u.wpa_param.name,
-		      param->u.wpa_param.value);
-		break;
-	case IEEE_CMD_SET_WPA_IE:
-		ret =  r871x_set_wpa_ie(padapter, (char *)param->u.wpa_ie.data,
-		       (u16)param->u.wpa_ie.len);
-		break;
-	case IEEE_CMD_SET_ENCRYPTION:
-		ret = wpa_set_encryption(dev, param, p->length);
-		break;
-	case IEEE_CMD_MLME:
-		ret = wpa_mlme(dev, param->u.mlme.command,
-		      param->u.mlme.reason_code);
-		break;
-	default:
-		ret = -EOPNOTSUPP;
-		break;
-	}
-	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
-		ret = -EFAULT;
-	kfree(param);
-	return ret;
-}
-
-/* based on "driver_ipw" and for hostapd */
-int r871x_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-{
-	struct iwreq *wrq = (struct iwreq *)rq;
-
-	switch (cmd) {
-	case RTL_IOCTL_WPA_SUPPLICANT:
-		return wpa_supplicant_ioctl(dev, &wrq->u.data);
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static iw_handler r8711_handlers[] = {
-	NULL,				/* SIOCSIWCOMMIT */
-	r8711_wx_get_name,		/* SIOCGIWNAME */
-	dummy,				/* SIOCSIWNWID */
-	dummy,				/* SIOCGIWNWID */
-	r8711_wx_set_freq,		/* SIOCSIWFREQ */
-	r8711_wx_get_freq,		/* SIOCGIWFREQ */
-	r8711_wx_set_mode,		/* SIOCSIWMODE */
-	r8711_wx_get_mode,		/* SIOCGIWMODE */
-	dummy,				/* SIOCSIWSENS */
-	r8711_wx_get_sens,		/* SIOCGIWSENS */
-	NULL,				/* SIOCSIWRANGE */
-	r8711_wx_get_range,		/* SIOCGIWRANGE */
-	r871x_wx_set_priv,		/* SIOCSIWPRIV */
-	NULL,				/* SIOCGIWPRIV */
-	NULL,				/* SIOCSIWSTATS */
-	NULL,				/* SIOCGIWSTATS */
-	dummy,				/* SIOCSIWSPY */
-	dummy,				/* SIOCGIWSPY */
-	NULL,				/* SIOCGIWTHRSPY */
-	NULL,				/* SIOCWIWTHRSPY */
-	r8711_wx_set_wap,		/* SIOCSIWAP */
-	r8711_wx_get_wap,		/* SIOCGIWAP */
-	r871x_wx_set_mlme,		/* request MLME operation;
-					 *  uses struct iw_mlme
-					 */
-	dummy,				/* SIOCGIWAPLIST -- deprecated */
-	r8711_wx_set_scan,		/* SIOCSIWSCAN */
-	r8711_wx_get_scan,		/* SIOCGIWSCAN */
-	r8711_wx_set_essid,		/* SIOCSIWESSID */
-	r8711_wx_get_essid,		/* SIOCGIWESSID */
-	dummy,				/* SIOCSIWNICKN */
-	r871x_wx_get_nick,		/* SIOCGIWNICKN */
-	NULL,				/* -- hole -- */
-	NULL,				/* -- hole -- */
-	r8711_wx_set_rate,		/* SIOCSIWRATE */
-	r8711_wx_get_rate,		/* SIOCGIWRATE */
-	dummy,				/* SIOCSIWRTS */
-	r8711_wx_get_rts,		/* SIOCGIWRTS */
-	r8711_wx_set_frag,		/* SIOCSIWFRAG */
-	r8711_wx_get_frag,		/* SIOCGIWFRAG */
-	dummy,				/* SIOCSIWTXPOW */
-	dummy,				/* SIOCGIWTXPOW */
-	dummy,				/* SIOCSIWRETRY */
-	r8711_wx_get_retry,		/* SIOCGIWRETRY */
-	r8711_wx_set_enc,		/* SIOCSIWENCODE */
-	r8711_wx_get_enc,		/* SIOCGIWENCODE */
-	dummy,				/* SIOCSIWPOWER */
-	r8711_wx_get_power,		/* SIOCGIWPOWER */
-	NULL,				/*---hole---*/
-	NULL,				/*---hole---*/
-	r871x_wx_set_gen_ie,		/* SIOCSIWGENIE */
-	NULL,				/* SIOCGIWGENIE */
-	r871x_wx_set_auth,		/* SIOCSIWAUTH */
-	NULL,				/* SIOCGIWAUTH */
-	r871x_wx_set_enc_ext,		/* SIOCSIWENCODEEXT */
-	NULL,				/* SIOCGIWENCODEEXT */
-	r871x_wx_set_pmkid,		/* SIOCSIWPMKSA */
-	NULL,				/*---hole---*/
-};
-
-static const struct iw_priv_args r8711_private_args[] = {
-	{
-		SIOCIWFIRSTPRIV + 0x0,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "read32"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x1,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "write32"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x2, 0, 0, "driver_ext"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x3, 0, 0, "mp_ioctl"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x4,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x5,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setpid"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x6,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_start"
-	},
-	{
-		SIOCIWFIRSTPRIV + 0x7,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "chplan"
-	}
-};
-
-static iw_handler r8711_private_handler[] = {
-	r8711_wx_read32,
-	r8711_wx_write32,
-	r8711_drvext_hdl,
-	r871x_mp_ioctl_hdl,
-	r871x_get_ap_info, /*for MM DTV platform*/
-	r871x_set_pid,
-	r871x_wps_start,
-	r871x_set_chplan
-};
-
-static struct iw_statistics *r871x_get_wireless_stats(struct net_device *dev)
-{
-	struct _adapter *padapter = netdev_priv(dev);
-	struct iw_statistics *piwstats = &padapter->iwstats;
-	int tmp_level = 0;
-	int tmp_qual = 0;
-	int tmp_noise = 0;
-
-	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) != true) {
-		piwstats->qual.qual = 0;
-		piwstats->qual.level = 0;
-		piwstats->qual.noise = 0;
-	} else {
-		/* show percentage, we need transfer dbm to original value. */
-		tmp_level = padapter->recvpriv.fw_rssi;
-		tmp_qual = padapter->recvpriv.signal;
-		tmp_noise = padapter->recvpriv.noise;
-		piwstats->qual.level = tmp_level;
-		piwstats->qual.qual = tmp_qual;
-		piwstats->qual.noise = tmp_noise;
-	}
-	piwstats->qual.updated = IW_QUAL_ALL_UPDATED;
-	return &padapter->iwstats;
-}
-
-struct iw_handler_def r871x_handlers_def = {
-	.standard = r8711_handlers,
-	.num_standard = ARRAY_SIZE(r8711_handlers),
-	.private = r8711_private_handler,
-	.private_args = (struct iw_priv_args *)r8711_private_args,
-	.num_private = ARRAY_SIZE(r8711_private_handler),
-	.num_private_args = sizeof(r8711_private_args) /
-			    sizeof(struct iw_priv_args),
-	.get_wireless_stats = r871x_get_wireless_stats
-};
--- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.c
+++ /dev/null
@@ -1,519 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_rtl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define  _RTL871X_IOCTL_RTL_C_
-
-#include <linux/rndis.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-#include "wifi.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_set.h"
-#include "rtl871x_ioctl_rtl.h"
-#include "mp_custom_oid.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_mp_ioctl.h"
-
-uint oid_rt_get_signal_quality_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_small_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >=  sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-				padapter->recvpriv.rx_smallpacket_crcerr;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >=  sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-				padapter->recvpriv.rx_middlepacket_crcerr;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_large_packet_crc_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >=  sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-				 padapter->recvpriv.rx_largepacket_crcerr;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_retry_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_retry_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_total_packet_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >=  sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-					 padapter->recvpriv.rx_pkts +
-					 padapter->recvpriv.rx_drop;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_rx_icv_err_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		*(uint *)poid_par_priv->information_buf =
-					 padapter->recvpriv.rx_icv_err;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv
-						*poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_preamble_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	u32 preamblemode = 0;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		if (padapter->registrypriv.preamble == PREAMBLE_LONG)
-			preamblemode = 0;
-		else if (padapter->registrypriv.preamble == PREAMBLE_AUTO)
-			preamblemode = 1;
-		else if (padapter->registrypriv.preamble == PREAMBLE_SHORT)
-			preamblemode = 2;
-		*(u32 *)poid_par_priv->information_buf = preamblemode;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_ap_ip_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channelplan_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	*(u16 *)poid_par_priv->information_buf = peeprompriv->channel_plan;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_channelplan_hdl(struct oid_par_priv
-				       *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	struct eeprom_priv *peeprompriv = &padapter->eeprompriv;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	peeprompriv->channel_plan = *(u16 *)poid_par_priv->information_buf;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_preamble_mode_hdl(struct oid_par_priv
-					 *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	u32 preamblemode = 0;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		preamblemode = *(u32 *)poid_par_priv->information_buf;
-		if (preamblemode == 0)
-			padapter->registrypriv.preamble = PREAMBLE_LONG;
-		else if (preamblemode == 1)
-			padapter->registrypriv.preamble = PREAMBLE_AUTO;
-		else if (preamblemode == 2)
-			padapter->registrypriv.preamble = PREAMBLE_SHORT;
-		*(u32 *)poid_par_priv->information_buf = preamblemode;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_bcn_intvl_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_dedicate_probe_hdl(struct oid_par_priv
-				      *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv
-					  *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-						 padapter->xmitpriv.tx_bytes;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv
-					  *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-					   padapter->recvpriv.rx_bytes;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_current_tx_power_level_hdl(struct oid_par_priv
-					      *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv
-						  *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv
-					       *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channel_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct NDIS_802_11_CONFIGURATION *pnic_Config;
-	u32   channelnum;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (check_fwstate(pmlmepriv, _FW_LINKED) ||
-	    check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))
-		pnic_Config = &pmlmepriv->cur_network.network.Configuration;
-	else
-		pnic_Config = &padapter->registrypriv.dev_network.Configuration;
-	channelnum = pnic_Config->DSConfig;
-	*(u32 *)poid_par_priv->information_buf = channelnum;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv
-			 *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_key_mismatch_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_supported_wireless_mode_hdl(struct oid_par_priv
-					       *poid_par_priv)
-{
-	u32 ulInfo = 0;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len >= sizeof(u32)) {
-		ulInfo |= 0x0100; /* WIRELESS_MODE_B */
-		ulInfo |= 0x0200; /* WIRELESS_MODE_G */
-		ulInfo |= 0x0400; /* WIRELESS_MODE_A */
-		*(u32 *) poid_par_priv->information_buf = ulInfo;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_channel_list_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_scan_in_progress_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_forced_data_rate_hdl(struct oid_par_priv *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv
-						   *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv
-					     *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv
-					      *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv
-						      *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv*
-					      poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_supported_hdl(struct oid_par_priv *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_ap_set_passphrase_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv*
-					     poid_par_priv)
-{
-	uint status = RNDIS_STATUS_SUCCESS;
-	struct _adapter *Adapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len ==
-	   (sizeof(unsigned long) * 3)) {
-		if (r8712_setrfreg_cmd(Adapter,
-			*(unsigned char *)poid_par_priv->information_buf,
-			(unsigned long)(*((unsigned long *)
-					poid_par_priv->information_buf + 2))))
-			status = RNDIS_STATUS_NOT_ACCEPTED;
-	} else {
-		status = RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return status;
-}
-
-uint oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv *poid_par_priv)
-{
-	uint status = RNDIS_STATUS_SUCCESS;
-	struct _adapter *Adapter = poid_par_priv->adapter_context;
-
-	if (poid_par_priv->type_of_oid != SET_OID) /* QUERY_OID */
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len == (sizeof(unsigned long) *
-						   3)) {
-		if (Adapter->mppriv.act_in_progress) {
-			status = RNDIS_STATUS_NOT_ACCEPTED;
-		} else {
-			/* init workparam */
-			Adapter->mppriv.act_in_progress = true;
-			Adapter->mppriv.workparam.bcompleted = false;
-			Adapter->mppriv.workparam.act_type = MPT_READ_RF;
-			Adapter->mppriv.workparam.io_offset = *(unsigned long *)
-						poid_par_priv->information_buf;
-			Adapter->mppriv.workparam.io_value = 0xcccccccc;
-
-		/* RegOffsetValue	- The offset of RF register to read.
-		 * RegDataWidth	- The data width of RF register to read.
-		 * RegDataValue	- The value to read.
-		 * RegOffsetValue = *((unsigned long *)InformationBuffer);
-		 * RegDataWidth = *((unsigned long *)InformationBuffer+1);
-		 * RegDataValue =  *((unsigned long *)InformationBuffer+2);
-		 */
-			if (r8712_getrfreg_cmd(Adapter,
-			    *(unsigned char *)poid_par_priv->information_buf,
-			    (unsigned char *)&Adapter->mppriv.workparam.io_value
-			    ))
-				status = RNDIS_STATUS_NOT_ACCEPTED;
-		}
-	} else {
-		status = RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return status;
-}
-
-enum _CONNECT_STATE_ {
-	CHECKINGSTATUS,
-	ASSOCIATED,
-	ADHOCMODE,
-	NOTASSOCIATED
-};
-
-uint oid_rt_get_connect_state_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *padapter = poid_par_priv->adapter_context;
-	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
-	u32 ulInfo;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	/* nStatus==0	CheckingStatus
-	 * nStatus==1	Associated
-	 * nStatus==2	AdHocMode
-	 * nStatus==3	NotAssociated
-	 */
-	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
-		ulInfo = CHECKINGSTATUS;
-	else if (check_fwstate(pmlmepriv, _FW_LINKED))
-		ulInfo = ASSOCIATED;
-	else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE))
-		ulInfo = ADHOCMODE;
-	else
-		ulInfo = NOTASSOCIATED;
-	*(u32 *)poid_par_priv->information_buf = ulInfo;
-	*poid_par_priv->bytes_rw =  poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_default_key_id_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl871x_ioctl_rtl.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_IOCTL_RTL_H
-#define _RTL871X_IOCTL_RTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/*************** oid_rtl_seg_01_01 **************/
-uint oid_rt_get_signal_quality_hdl(
-			struct oid_par_priv *poid_par_priv);/*84*/
-uint oid_rt_get_small_packet_crc_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_middle_packet_crc_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_large_packet_crc_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_retry_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_retry_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_total_packet_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_beacon_ok_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_tx_beacon_err_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_rx_icv_err_hdl(
-			struct oid_par_priv *poid_par_priv);/*93*/
-uint oid_rt_set_encryption_algorithm_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_preamble_mode_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_ap_ip_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channelplan_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_channelplan_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_preamble_mode_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_bcn_intvl_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_dedicate_probe_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_total_tx_bytes_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_total_rx_bytes_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_current_tx_power_level_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_enc_key_mismatch_count_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_enc_key_match_count_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channel_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_hardware_radio_off_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_key_mismatch_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_supported_wireless_mode_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_channel_list_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_scan_in_progress_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_forced_data_rate_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_wireless_mode_for_scan_list_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_bss_wireless_mode_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_scan_with_magic_packet_hdl(
-			struct oid_par_priv *poid_par_priv);
-
-/**************  oid_rtl_seg_01_03 section start **************/
-uint oid_rt_ap_get_associated_station_list_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_switch_into_ap_mode_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_supported_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_ap_set_passphrase_hdl(
-			struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_01_11 */
-uint oid_rt_pro_rf_write_registry_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_rf_read_registry_hdl(
-			struct oid_par_priv *poid_par_priv);
-/***************  oid_rtl_seg_03_00 section start **************/
-uint oid_rt_get_connect_state_hdl(
-			struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_default_key_id_hdl(
-			struct oid_par_priv *poid_par_priv);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c
+++ /dev/null
@@ -1,354 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_ioctl_set.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_IOCTL_SET_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_ioctl_set.h"
-#include "usb_osintf.h"
-#include "usb_ops.h"
-
-static u8 validate_ssid(struct ndis_802_11_ssid *ssid)
-{
-	u8 i;
-
-	if (ssid->SsidLength > 32)
-		return false;
-	for (i = 0; i < ssid->SsidLength; i++) {
-		/* wifi, printable ascii code must be supported */
-		if (!((ssid->Ssid[i] >= 0x20) && (ssid->Ssid[i] <= 0x7e)))
-			return false;
-	}
-	return true;
-}
-
-static u8 do_join(struct _adapter *padapter)
-{
-	struct list_head *plist, *phead;
-	u8 *pibss = NULL;
-	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
-	struct  __queue	*queue	= &(pmlmepriv->scanned_queue);
-	int ret;
-
-	phead = &queue->queue;
-	plist = phead->next;
-	pmlmepriv->cur_network.join_res = -2;
-	pmlmepriv->fw_state |= _FW_UNDER_LINKING;
-	pmlmepriv->pscanned = plist;
-	pmlmepriv->to_join = true;
-
-	/* adhoc mode will start with an empty queue, but skip checking */
-	if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) &&
-	    list_empty(&queue->queue)) {
-		if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
-			pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
-		/* when set_ssid/set_bssid for do_join(), but scanning queue
-		 * is empty we try to issue sitesurvey firstly
-		 */
-		if (!pmlmepriv->sitesurveyctrl.traffic_busy)
-			r8712_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid);
-		return true;
-	}
-
-	ret = r8712_select_and_join_from_scan(pmlmepriv);
-	if (!ret) {
-		mod_timer(&pmlmepriv->assoc_timer,
-			  jiffies + msecs_to_jiffies(MAX_JOIN_TIMEOUT));
-	} else {
-		if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
-			/* submit r8712_createbss_cmd to change to an
-			 * ADHOC_MASTER pmlmepriv->lock has been
-			 * acquired by caller...
-			 */
-			struct wlan_bssid_ex *pdev_network =
-				&padapter->registrypriv.dev_network;
-			pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
-			pibss = padapter->registrypriv.dev_network.MacAddress;
-			memcpy(&pdev_network->Ssid,
-			       &pmlmepriv->assoc_ssid,
-			       sizeof(struct ndis_802_11_ssid));
-			r8712_update_registrypriv_dev_network(padapter);
-			r8712_generate_random_ibss(pibss);
-			if (r8712_createbss_cmd(padapter))
-				return false;
-			pmlmepriv->to_join = false;
-		} else {
-			/* can't associate ; reset under-linking */
-			if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
-				pmlmepriv->fw_state ^=
-					_FW_UNDER_LINKING;
-			/* when set_ssid/set_bssid for do_join(), but
-			 * there are no desired bss in scanning queue
-			 * we try to issue sitesurvey first
-			 */
-			if (!pmlmepriv->sitesurveyctrl.traffic_busy)
-				r8712_sitesurvey_cmd(padapter,
-						     &pmlmepriv->assoc_ssid);
-		}
-	}
-	return true;
-}
-
-u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid)
-{
-	unsigned long irqL;
-	u8 status = true;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid)) {
-		status = false;
-		return status;
-	}
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY |
-	    _FW_UNDER_LINKING)) {
-		status = check_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-		goto _Abort_Set_BSSID;
-	}
-	if (check_fwstate(pmlmepriv,
-	    _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
-		if (!memcmp(&pmlmepriv->cur_network.network.MacAddress, bssid,
-		    ETH_ALEN)) {
-			if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE))
-				/* driver is in
-				 * WIFI_ADHOC_MASTER_STATE
-				 */
-				goto _Abort_Set_BSSID;
-		} else {
-			r8712_disassoc_cmd(padapter);
-			if (check_fwstate(pmlmepriv, _FW_LINKED))
-				r8712_ind_disconnect(padapter);
-			r8712_free_assoc_resources(padapter);
-			if ((check_fwstate(pmlmepriv,
-			     WIFI_ADHOC_MASTER_STATE))) {
-				_clr_fwstate_(pmlmepriv,
-					      WIFI_ADHOC_MASTER_STATE);
-				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
-			}
-		}
-	}
-	memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
-	pmlmepriv->assoc_by_bssid = true;
-	status = do_join(padapter);
-	goto done;
-_Abort_Set_BSSID:
-done:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	return status;
-}
-
-void r8712_set_802_11_ssid(struct _adapter *padapter,
-			   struct ndis_802_11_ssid *ssid)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_network *pnetwork = &pmlmepriv->cur_network;
-
-	if (!padapter->hw_init_completed)
-		return;
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING)) {
-		check_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-		goto _Abort_Set_SSID;
-	}
-	if (check_fwstate(pmlmepriv, _FW_LINKED | WIFI_ADHOC_MASTER_STATE)) {
-		if ((pmlmepriv->assoc_ssid.SsidLength == ssid->SsidLength) &&
-		    (!memcmp(&pmlmepriv->assoc_ssid.Ssid, ssid->Ssid,
-		    ssid->SsidLength))) {
-			if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
-				if (!r8712_is_same_ibss(padapter,
-				     pnetwork)) {
-					/* if in WIFI_ADHOC_MASTER_STATE or
-					 *  WIFI_ADHOC_STATE, create bss or
-					 * rejoin again
-					 */
-					r8712_disassoc_cmd(padapter);
-					if (check_fwstate(pmlmepriv,
-					    _FW_LINKED))
-						r8712_ind_disconnect(padapter);
-					r8712_free_assoc_resources(padapter);
-					if (check_fwstate(pmlmepriv,
-					     WIFI_ADHOC_MASTER_STATE)) {
-						_clr_fwstate_(pmlmepriv,
-						    WIFI_ADHOC_MASTER_STATE);
-						set_fwstate(pmlmepriv,
-							    WIFI_ADHOC_STATE);
-					}
-				} else {
-					/* driver is in
-					 * WIFI_ADHOC_MASTER_STATE
-					 */
-					goto _Abort_Set_SSID;
-				}
-			}
-		} else {
-			r8712_disassoc_cmd(padapter);
-			if (check_fwstate(pmlmepriv, _FW_LINKED))
-				r8712_ind_disconnect(padapter);
-			r8712_free_assoc_resources(padapter);
-			if (check_fwstate(pmlmepriv,
-			    WIFI_ADHOC_MASTER_STATE)) {
-				_clr_fwstate_(pmlmepriv,
-					      WIFI_ADHOC_MASTER_STATE);
-				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
-			}
-		}
-	}
-	if (padapter->securitypriv.btkip_countermeasure)
-		goto _Abort_Set_SSID;
-	if (!validate_ssid(ssid))
-		goto _Abort_Set_SSID;
-	memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(struct ndis_802_11_ssid));
-	pmlmepriv->assoc_by_bssid = false;
-	do_join(padapter);
-	goto done;
-_Abort_Set_SSID:
-done:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter,
-	enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
-{
-	unsigned long irqL;
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct wlan_network	*cur_network = &pmlmepriv->cur_network;
-	enum NDIS_802_11_NETWORK_INFRASTRUCTURE *pold_state =
-				&(cur_network->network.InfrastructureMode);
-
-	if (*pold_state != networktype) {
-		spin_lock_irqsave(&pmlmepriv->lock, irqL);
-		if (check_fwstate(pmlmepriv, _FW_LINKED) ||
-		    (*pold_state == Ndis802_11IBSS))
-			r8712_disassoc_cmd(padapter);
-		if (check_fwstate(pmlmepriv,
-		    _FW_LINKED | WIFI_ADHOC_MASTER_STATE))
-			r8712_free_assoc_resources(padapter);
-		if (check_fwstate(pmlmepriv, _FW_LINKED) ||
-		    (*pold_state == Ndis802_11Infrastructure) ||
-		    (*pold_state == Ndis802_11IBSS)) {
-			/* will clr Linked_state before this function,
-			 * we must have checked whether issue dis-assoc_cmd or
-			 * not
-			 */
-			r8712_ind_disconnect(padapter);
-		}
-		*pold_state = networktype;
-		/* clear WIFI_STATION_STATE; WIFI_AP_STATE; WIFI_ADHOC_STATE;
-		 * WIFI_ADHOC_MASTER_STATE
-		 */
-		_clr_fwstate_(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE |
-			      WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE);
-		switch (networktype) {
-		case Ndis802_11IBSS:
-			set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
-			break;
-		case Ndis802_11Infrastructure:
-			set_fwstate(pmlmepriv, WIFI_STATION_STATE);
-			break;
-		case Ndis802_11APMode:
-			set_fwstate(pmlmepriv, WIFI_AP_STATE);
-			break;
-		case Ndis802_11AutoUnknown:
-		case Ndis802_11InfrastructureMax:
-			break;
-		}
-		spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	}
-}
-
-u8 r8712_set_802_11_disassociate(struct _adapter *padapter)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-		r8712_disassoc_cmd(padapter);
-		r8712_ind_disconnect(padapter);
-		r8712_free_assoc_resources(padapter);
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	return true;
-}
-
-u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter)
-{
-	struct mlme_priv *pmlmepriv = NULL;
-	unsigned long irqL;
-	u8 ret = true;
-
-	if (!padapter)
-		return false;
-	pmlmepriv = &padapter->mlmepriv;
-	if (!padapter->hw_init_completed)
-		return false;
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY | _FW_UNDER_LINKING) ||
-	    pmlmepriv->sitesurveyctrl.traffic_busy) {
-		/* Scan or linking is in progress, do nothing. */
-		ret = (u8)check_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
-	} else {
-		r8712_free_network_queue(padapter);
-		ret = r8712_sitesurvey_cmd(padapter, NULL);
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	return ret;
-}
-
-u8 r8712_set_802_11_authentication_mode(struct _adapter *padapter,
-				enum NDIS_802_11_AUTHENTICATION_MODE authmode)
-{
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-	u8 ret;
-
-	psecuritypriv->ndisauthtype = authmode;
-	if (psecuritypriv->ndisauthtype > 3)
-		psecuritypriv->AuthAlgrthm = 2; /* 802.1x */
-	if (r8712_set_auth(padapter, psecuritypriv))
-		ret = false;
-	else
-		ret = true;
-	return ret;
-}
-
-int r8712_set_802_11_add_wep(struct _adapter *padapter,
-			     struct NDIS_802_11_WEP *wep)
-{
-	sint	keyid;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-
-	keyid = wep->KeyIndex & 0x3fffffff;
-	if (keyid >= WEP_KEYS)
-		return -EINVAL;
-	switch (wep->KeyLength) {
-	case 5:
-		psecuritypriv->PrivacyAlgrthm = _WEP40_;
-		break;
-	case 13:
-		psecuritypriv->PrivacyAlgrthm = _WEP104_;
-		break;
-	default:
-		psecuritypriv->PrivacyAlgrthm = _NO_PRIVACY_;
-		break;
-	}
-	memcpy(psecuritypriv->DefKey[keyid].skey, &wep->KeyMaterial,
-		wep->KeyLength);
-	psecuritypriv->DefKeylen[keyid] = wep->KeyLength;
-	psecuritypriv->PrivacyKeyIndex = keyid;
-	return r8712_set_key(padapter, psecuritypriv, keyid);
-}
--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __IOCTL_SET_H
-#define __IOCTL_SET_H
-
-#include "drv_types.h"
-
-typedef u8 NDIS_802_11_PMKID_VALUE[16];
-
-struct BSSIDInfo {
-	unsigned char BSSID[6];
-	NDIS_802_11_PMKID_VALUE PMKID;
-};
-
-u8 r8712_set_802_11_authentication_mode(struct _adapter *pdapter,
-			enum NDIS_802_11_AUTHENTICATION_MODE authmode);
-
-u8 r8712_set_802_11_bssid(struct _adapter *padapter, u8 *bssid);
-
-int r8712_set_802_11_add_wep(struct _adapter *padapter,
-			     struct NDIS_802_11_WEP *wep);
-
-u8 r8712_set_802_11_disassociate(struct _adapter *padapter);
-
-u8 r8712_set_802_11_bssid_list_scan(struct _adapter *padapter);
-
-void r8712_set_802_11_infrastructure_mode(struct _adapter *padapter,
-			enum NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
-
-void r8712_set_802_11_ssid(struct _adapter *padapter,
-			   struct ndis_802_11_ssid *ssid);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_led.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL8712_LED_H
-#define __RTL8712_LED_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-/*===========================================================================
- * LED customization.
- *===========================================================================
- */
-enum LED_CTL_MODE {
-	LED_CTL_POWER_ON = 1,
-	LED_CTL_LINK = 2,
-	LED_CTL_NO_LINK = 3,
-	LED_CTL_TX = 4,
-	LED_CTL_RX = 5,
-	LED_CTL_SITE_SURVEY = 6,
-	LED_CTL_POWER_OFF = 7,
-	LED_CTL_START_TO_LINK = 8,
-	LED_CTL_START_WPS = 9,
-	LED_CTL_STOP_WPS = 10,
-	LED_CTL_START_WPS_BOTTON = 11,
-	LED_CTL_STOP_WPS_FAIL = 12,
-	LED_CTL_STOP_WPS_FAIL_OVERLAP = 13,
-};
-
-#define IS_LED_WPS_BLINKING(_LED_871x)	\
-	(((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS \
-	|| ((struct LED_871x *)_LED_871x)->CurrLedState == LED_BLINK_WPS_STOP \
-	|| ((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress)
-
-#define IS_LED_BLINKING(_LED_871x)	\
-		(((struct LED_871x *)_LED_871x)->bLedWPSBlinkInProgress \
-		|| ((struct LED_871x *)_LED_871x)->bLedScanBlinkInProgress)
-
-enum LED_PIN_871x {
-	LED_PIN_GPIO0,
-	LED_PIN_LED0,
-	LED_PIN_LED1
-};
-
-/*===========================================================================
- * LED customization.
- *===========================================================================
- */
-enum LED_STRATEGY_871x {
-	SW_LED_MODE0, /* SW control 1 LED via GPIO0. It is default option. */
-	SW_LED_MODE1, /* 2 LEDs, through LED0 and LED1. For ALPHA. */
-	SW_LED_MODE2, /* SW control 1 LED via GPIO0,
-		       * custom for AzWave 8187 minicard.
-		       */
-	SW_LED_MODE3, /* SW control 1 LED via GPIO0,
-		       * customized for Sercomm Printer Server case.
-		       */
-	SW_LED_MODE4, /*for Edimax / Belkin*/
-	SW_LED_MODE5, /*for Sercomm / Belkin*/
-	SW_LED_MODE6, /*for WNC / Corega*/
-	HW_LED, /* HW control 2 LEDs, LED0 and LED1 (there are 4 different
-		 * control modes, see MAC.CONFIG1 for details.)
-		 */
-};
-
-struct LED_871x {
-	struct _adapter		*padapter;
-	enum LED_PIN_871x	LedPin;	/* Implementation for this SW led. */
-	u32			CurrLedState; /* Current LED state. */
-	u8			bLedOn; /* true if LED is ON */
-	u8			bSWLedCtrl;
-	u8			bLedBlinkInProgress; /*true if blinking */
-	u8			bLedNoLinkBlinkInProgress;
-	u8			bLedLinkBlinkInProgress;
-	u8			bLedStartToLinkBlinkInProgress;
-	u8			bLedScanBlinkInProgress;
-	u8			bLedWPSBlinkInProgress;
-	u32			BlinkTimes; /* No. times to toggle for blink.*/
-	u32			BlinkingLedState; /* Next state for blinking,
-						   * either LED_ON or OFF.
-						   */
-
-	struct timer_list	BlinkTimer; /* Timer object for led blinking.*/
-	struct work_struct	BlinkWorkItem; /* Workitem used by BlinkTimer */
-};
-
-struct led_priv {
-	/* add for led control */
-	struct LED_871x		SwLed0;
-	struct LED_871x		SwLed1;
-	enum LED_STRATEGY_871x	LedStrategy;
-	u8			bRegUseLed;
-	void (*LedControlHandler)(struct _adapter *padapter,
-				  enum LED_CTL_MODE LedAction);
-	/* add for led control */
-};
-
-/*===========================================================================
- * Interface to manipulate LED objects.
- *===========================================================================
- */
-void r8712_InitSwLeds(struct _adapter *padapter);
-void r8712_DeInitSwLeds(struct _adapter *padapter);
-void LedControl871x(struct _adapter *padapter, enum LED_CTL_MODE LedAction);
-void r8712_flush_led_works(struct _adapter *padapter);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_mlme.c
+++ /dev/null
@@ -1,1710 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_mlme.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_MLME_C_
-
-#include <linux/etherdevice.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "mlme_osdep.h"
-#include "sta_info.h"
-#include "wifi.h"
-#include "wlan_bssdef.h"
-
-static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len);
-
-int r8712_init_mlme_priv(struct _adapter *padapter)
-{
-	sint	i;
-	u8	*pbuf;
-	struct wlan_network	*pnetwork;
-	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	memset((u8 *)pmlmepriv, 0, sizeof(struct mlme_priv));
-	pmlmepriv->nic_hdl = (u8 *)padapter;
-	pmlmepriv->pscanned = NULL;
-	pmlmepriv->fw_state = 0;
-	pmlmepriv->cur_network.network.InfrastructureMode =
-				 Ndis802_11AutoUnknown;
-	/* Maybe someday we should rename this variable to "active_mode"(Jeff)*/
-	pmlmepriv->passive_mode = 1; /* 1: active, 0: passive. */
-	spin_lock_init(&(pmlmepriv->lock));
-	spin_lock_init(&(pmlmepriv->lock2));
-	_init_queue(&(pmlmepriv->free_bss_pool));
-	_init_queue(&(pmlmepriv->scanned_queue));
-	set_scanned_network_val(pmlmepriv, 0);
-	memset(&pmlmepriv->assoc_ssid, 0, sizeof(struct ndis_802_11_ssid));
-	pbuf = kmalloc_array(MAX_BSS_CNT, sizeof(struct wlan_network),
-			     GFP_ATOMIC);
-	if (!pbuf)
-		return -ENOMEM;
-	pmlmepriv->free_bss_buf = pbuf;
-	pnetwork = (struct wlan_network *)pbuf;
-	for (i = 0; i < MAX_BSS_CNT; i++) {
-		INIT_LIST_HEAD(&(pnetwork->list));
-		list_add_tail(&(pnetwork->list),
-				 &(pmlmepriv->free_bss_pool.queue));
-		pnetwork++;
-	}
-	pmlmepriv->sitesurveyctrl.last_rx_pkts = 0;
-	pmlmepriv->sitesurveyctrl.last_tx_pkts = 0;
-	pmlmepriv->sitesurveyctrl.traffic_busy = false;
-	/* allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf */
-	r8712_init_mlme_timer(padapter);
-	return 0;
-}
-
-struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv)
-{
-	unsigned long irqL;
-	struct wlan_network *pnetwork;
-	struct  __queue *free_queue = &pmlmepriv->free_bss_pool;
-
-	spin_lock_irqsave(&free_queue->lock, irqL);
-	pnetwork = list_first_entry_or_null(&free_queue->queue,
-					    struct wlan_network, list);
-	if (pnetwork) {
-		list_del_init(&pnetwork->list);
-		pnetwork->last_scanned = jiffies;
-		pmlmepriv->num_of_scanned++;
-	}
-	spin_unlock_irqrestore(&free_queue->lock, irqL);
-	return pnetwork;
-}
-
-static void _free_network(struct mlme_priv *pmlmepriv,
-			  struct wlan_network *pnetwork)
-{
-	u32 curr_time, delta_time;
-	unsigned long irqL;
-	struct  __queue *free_queue = &(pmlmepriv->free_bss_pool);
-
-	if (!pnetwork)
-		return;
-	if (pnetwork->fixed)
-		return;
-	curr_time = jiffies;
-	delta_time = (curr_time - (u32)pnetwork->last_scanned) / HZ;
-	if (delta_time < SCANQUEUE_LIFETIME)
-		return;
-	spin_lock_irqsave(&free_queue->lock, irqL);
-	list_del_init(&pnetwork->list);
-	list_add_tail(&pnetwork->list, &free_queue->queue);
-	pmlmepriv->num_of_scanned--;
-	spin_unlock_irqrestore(&free_queue->lock, irqL);
-}
-
-static void free_network_nolock(struct mlme_priv *pmlmepriv,
-			  struct wlan_network *pnetwork)
-{
-	struct  __queue *free_queue = &pmlmepriv->free_bss_pool;
-
-	if (!pnetwork)
-		return;
-	if (pnetwork->fixed)
-		return;
-	list_del_init(&pnetwork->list);
-	list_add_tail(&pnetwork->list, &free_queue->queue);
-	pmlmepriv->num_of_scanned--;
-}
-
-/* return the wlan_network with the matching addr
- * Shall be called under atomic context...
- * to avoid possible racing condition...
- */
-static struct wlan_network *r8712_find_network(struct  __queue *scanned_queue,
-					       u8 *addr)
-{
-	unsigned long irqL;
-	struct list_head *phead, *plist;
-	struct wlan_network *pnetwork = NULL;
-
-	if (is_zero_ether_addr(addr))
-		return NULL;
-	spin_lock_irqsave(&scanned_queue->lock, irqL);
-	phead = &scanned_queue->queue;
-	list_for_each(plist, phead) {
-		pnetwork = list_entry(plist, struct wlan_network, list);
-		if (!memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN))
-			break;
-	}
-	if (plist == phead)
-		pnetwork = NULL;
-	spin_unlock_irqrestore(&scanned_queue->lock, irqL);
-	return pnetwork;
-}
-
-void r8712_free_network_queue(struct _adapter *padapter)
-{
-	unsigned long irqL;
-	struct list_head *phead, *plist;
-	struct wlan_network *pnetwork;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct  __queue *scanned_queue = &pmlmepriv->scanned_queue;
-
-	spin_lock_irqsave(&scanned_queue->lock, irqL);
-	phead = &scanned_queue->queue;
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist)) {
-		pnetwork = container_of(plist, struct wlan_network, list);
-		plist = plist->next;
-		_free_network(pmlmepriv, pnetwork);
-	}
-	spin_unlock_irqrestore(&scanned_queue->lock, irqL);
-}
-
-sint r8712_if_up(struct _adapter *padapter)
-{
-	sint res;
-
-	if (padapter->driver_stopped || padapter->surprise_removed ||
-	    !check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
-		res = false;
-	} else {
-		res = true;
-	}
-	return res;
-}
-
-void r8712_generate_random_ibss(u8 *pibss)
-{
-	u32 curtime = jiffies;
-
-	pibss[0] = 0x02; /*in ad-hoc mode bit1 must set to 1 */
-	pibss[1] = 0x11;
-	pibss[2] = 0x87;
-	pibss[3] = (u8)(curtime & 0xff);
-	pibss[4] = (u8)((curtime >> 8) & 0xff);
-	pibss[5] = (u8)((curtime >> 16) & 0xff);
-}
-
-uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss)
-{
-	return sizeof(*bss) + bss->IELength - MAX_IE_SZ;
-}
-
-u8 *r8712_get_capability_from_ie(u8 *ie)
-{
-	return ie + 8 + 2;
-}
-
-void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv)
-{
-	kfree(pmlmepriv->free_bss_buf);
-}
-
-static struct	wlan_network *alloc_network(struct mlme_priv *pmlmepriv)
-{
-	return _r8712_alloc_network(pmlmepriv);
-}
-
-int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork)
-{
-	int ret = true;
-	struct security_priv *psecuritypriv = &adapter->securitypriv;
-
-	if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) &&
-		    (pnetwork->network.Privacy == cpu_to_le32(0)))
-		ret = false;
-	else if ((psecuritypriv->PrivacyAlgrthm == _NO_PRIVACY_) &&
-		 (pnetwork->network.Privacy == cpu_to_le32(1)))
-		ret = false;
-	else
-		ret = true;
-	return ret;
-
-}
-
-static int is_same_network(struct wlan_bssid_ex *src,
-			   struct wlan_bssid_ex *dst)
-{
-	u16 s_cap, d_cap;
-
-	memcpy((u8 *)&s_cap, r8712_get_capability_from_ie(src->IEs), 2);
-	memcpy((u8 *)&d_cap, r8712_get_capability_from_ie(dst->IEs), 2);
-	return (src->Ssid.SsidLength == dst->Ssid.SsidLength) &&
-			(src->Configuration.DSConfig ==
-			dst->Configuration.DSConfig) &&
-			((!memcmp(src->MacAddress, dst->MacAddress,
-			ETH_ALEN))) &&
-			((!memcmp(src->Ssid.Ssid,
-			  dst->Ssid.Ssid,
-			  src->Ssid.SsidLength))) &&
-			((s_cap & WLAN_CAPABILITY_IBSS) ==
-			(d_cap & WLAN_CAPABILITY_IBSS)) &&
-			((s_cap & WLAN_CAPABILITY_ESS) ==
-			(d_cap & WLAN_CAPABILITY_ESS));
-
-}
-
-struct	wlan_network *r8712_get_oldest_wlan_network(
-				struct  __queue *scanned_queue)
-{
-	struct list_head *plist, *phead;
-	struct	wlan_network	*pwlan = NULL;
-	struct	wlan_network	*oldest = NULL;
-
-	phead = &scanned_queue->queue;
-	plist = phead->next;
-	while (1) {
-		if (end_of_queue_search(phead, plist))
-			break;
-		pwlan = container_of(plist, struct wlan_network, list);
-		if (!pwlan->fixed) {
-			if (!oldest ||
-			    time_after((unsigned long)oldest->last_scanned,
-				       (unsigned long)pwlan->last_scanned))
-				oldest = pwlan;
-		}
-		plist = plist->next;
-	}
-	return oldest;
-}
-
-static void update_network(struct wlan_bssid_ex *dst,
-			   struct wlan_bssid_ex *src,
-			   struct _adapter *padapter)
-{
-	u32 last_evm = 0, tmpVal;
-	struct smooth_rssi_data *sqd = &padapter->recvpriv.signal_qual_data;
-
-	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) &&
-	    is_same_network(&(padapter->mlmepriv.cur_network.network), src)) {
-		if (padapter->recvpriv.signal_qual_data.total_num++ >=
-		    PHY_LINKQUALITY_SLID_WIN_MAX) {
-			padapter->recvpriv.signal_qual_data.total_num =
-				   PHY_LINKQUALITY_SLID_WIN_MAX;
-			last_evm = sqd->elements[sqd->index];
-			padapter->recvpriv.signal_qual_data.total_val -=
-				 last_evm;
-		}
-		padapter->recvpriv.signal_qual_data.total_val += src->Rssi;
-
-		sqd->elements[sqd->index++] = src->Rssi;
-		if (padapter->recvpriv.signal_qual_data.index >=
-		    PHY_LINKQUALITY_SLID_WIN_MAX)
-			padapter->recvpriv.signal_qual_data.index = 0;
-		/* <1> Showed on UI for user, in percentage. */
-		tmpVal = padapter->recvpriv.signal_qual_data.total_val /
-			 padapter->recvpriv.signal_qual_data.total_num;
-		padapter->recvpriv.signal = (u8)tmpVal;
-
-		src->Rssi = padapter->recvpriv.signal;
-	} else {
-		src->Rssi = (src->Rssi + dst->Rssi) / 2;
-	}
-	memcpy((u8 *)dst, (u8 *)src, r8712_get_wlan_bssid_ex_sz(src));
-}
-
-static void update_current_network(struct _adapter *adapter,
-				   struct wlan_bssid_ex *pnetwork)
-{
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	if (is_same_network(&(pmlmepriv->cur_network.network), pnetwork)) {
-		update_network(&(pmlmepriv->cur_network.network),
-			       pnetwork, adapter);
-		r8712_update_protection(adapter,
-			       (pmlmepriv->cur_network.network.IEs) +
-			       sizeof(struct NDIS_802_11_FIXED_IEs),
-			       pmlmepriv->cur_network.network.IELength);
-	}
-}
-
-/* Caller must hold pmlmepriv->lock first */
-static void update_scanned_network(struct _adapter *adapter,
-			    struct wlan_bssid_ex *target)
-{
-	struct list_head *plist, *phead;
-
-	u32 bssid_ex_sz;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-	struct wlan_network *pnetwork = NULL;
-	struct wlan_network *oldest = NULL;
-
-	phead = &queue->queue;
-	plist = phead->next;
-
-	while (1) {
-		if (end_of_queue_search(phead, plist))
-			break;
-
-		pnetwork = container_of(plist, struct wlan_network, list);
-		if (is_same_network(&pnetwork->network, target))
-			break;
-		if ((oldest == ((struct wlan_network *)0)) ||
-		    time_after((unsigned long)oldest->last_scanned,
-				(unsigned long)pnetwork->last_scanned))
-			oldest = pnetwork;
-
-		plist = plist->next;
-	}
-
-	/* If we didn't find a match, then get a new network slot to initialize
-	 * with this beacon's information
-	 */
-	if (end_of_queue_search(phead, plist)) {
-		if (list_empty(&pmlmepriv->free_bss_pool.queue)) {
-			/* If there are no more slots, expire the oldest */
-			pnetwork = oldest;
-			target->Rssi = (pnetwork->network.Rssi +
-					target->Rssi) / 2;
-			memcpy(&pnetwork->network, target,
-				r8712_get_wlan_bssid_ex_sz(target));
-			pnetwork->last_scanned = jiffies;
-		} else {
-			/* Otherwise just pull from the free list */
-			/* update scan_time */
-			pnetwork = alloc_network(pmlmepriv);
-			if (!pnetwork)
-				return;
-			bssid_ex_sz = r8712_get_wlan_bssid_ex_sz(target);
-			target->Length = bssid_ex_sz;
-			memcpy(&pnetwork->network, target, bssid_ex_sz);
-			list_add_tail(&pnetwork->list, &queue->queue);
-		}
-	} else {
-		/* we have an entry and we are going to update it. But
-		 * this entry may be already expired. In this case we
-		 * do the same as we found a new net and call the new_net
-		 * handler
-		 */
-		update_network(&pnetwork->network, target, adapter);
-		pnetwork->last_scanned = jiffies;
-	}
-}
-
-static void rtl8711_add_network(struct _adapter *adapter,
-			 struct wlan_bssid_ex *pnetwork)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &(((struct _adapter *)adapter)->mlmepriv);
-	struct  __queue *queue = &pmlmepriv->scanned_queue;
-
-	spin_lock_irqsave(&queue->lock, irqL);
-	update_current_network(adapter, pnetwork);
-	update_scanned_network(adapter, pnetwork);
-	spin_unlock_irqrestore(&queue->lock, irqL);
-}
-
-/*select the desired network based on the capability of the (i)bss.
- * check items:		(1) security
- *			(2) network_type
- *			(3) WMM
- *			(4) HT
- *			(5) others
- */
-static int is_desired_network(struct _adapter *adapter,
-				struct wlan_network *pnetwork)
-{
-	u8 wps_ie[512];
-	uint wps_ielen;
-	int bselected = true;
-	struct	security_priv *psecuritypriv = &adapter->securitypriv;
-
-	if (psecuritypriv->wps_phase) {
-		if (r8712_get_wps_ie(pnetwork->network.IEs,
-		    pnetwork->network.IELength, wps_ie,
-		    &wps_ielen))
-			return true;
-		return false;
-	}
-	if ((psecuritypriv->PrivacyAlgrthm != _NO_PRIVACY_) &&
-		    (pnetwork->network.Privacy == 0))
-		bselected = false;
-	if (check_fwstate(&adapter->mlmepriv, WIFI_ADHOC_STATE)) {
-		if (pnetwork->network.InfrastructureMode !=
-			adapter->mlmepriv.cur_network.network.InfrastructureMode)
-			bselected = false;
-	}
-	return bselected;
-}
-
-/* TODO: Perry : For Power Management */
-void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-}
-
-void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	unsigned long flags;
-	u32 len;
-	struct wlan_bssid_ex *pnetwork;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	pnetwork = (struct wlan_bssid_ex *)pbuf;
-#ifdef __BIG_ENDIAN
-	/* endian_convert */
-	pnetwork->Length = le32_to_cpu(pnetwork->Length);
-	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
-	pnetwork->Privacy = le32_to_cpu(pnetwork->Privacy);
-	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
-	pnetwork->NetworkTypeInUse = le32_to_cpu(pnetwork->NetworkTypeInUse);
-	pnetwork->Configuration.ATIMWindow =
-		 le32_to_cpu(pnetwork->Configuration.ATIMWindow);
-	pnetwork->Configuration.BeaconPeriod =
-		 le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
-	pnetwork->Configuration.DSConfig =
-		 le32_to_cpu(pnetwork->Configuration.DSConfig);
-	pnetwork->Configuration.FHConfig.DwellTime =
-		 le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
-	pnetwork->Configuration.FHConfig.HopPattern =
-		 le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
-	pnetwork->Configuration.FHConfig.HopSet =
-		 le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
-	pnetwork->Configuration.FHConfig.Length =
-		 le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
-	pnetwork->Configuration.Length =
-		 le32_to_cpu(pnetwork->Configuration.Length);
-	pnetwork->InfrastructureMode =
-		 le32_to_cpu(pnetwork->InfrastructureMode);
-	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
-#endif
-	len = r8712_get_wlan_bssid_ex_sz(pnetwork);
-	if (len > sizeof(struct wlan_bssid_ex))
-		return;
-	spin_lock_irqsave(&pmlmepriv->lock2, flags);
-	/* update IBSS_network 's timestamp */
-	if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
-		if (!memcmp(&(pmlmepriv->cur_network.network.MacAddress),
-		    pnetwork->MacAddress, ETH_ALEN)) {
-			struct wlan_network *ibss_wlan = NULL;
-
-			memcpy(pmlmepriv->cur_network.network.IEs,
-				pnetwork->IEs, 8);
-			ibss_wlan = r8712_find_network(
-						&pmlmepriv->scanned_queue,
-						pnetwork->MacAddress);
-			if (ibss_wlan) {
-				memcpy(ibss_wlan->network.IEs,
-					pnetwork->IEs, 8);
-				goto exit;
-			}
-		}
-	}
-	/* lock pmlmepriv->lock when you accessing network_q */
-	if (!check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
-		if (pnetwork->Ssid.Ssid[0] != 0) {
-			rtl8711_add_network(adapter, pnetwork);
-		} else {
-			pnetwork->Ssid.SsidLength = 8;
-			memcpy(pnetwork->Ssid.Ssid, "<hidden>", 8);
-			rtl8711_add_network(adapter, pnetwork);
-		}
-	}
-exit:
-	spin_unlock_irqrestore(&pmlmepriv->lock2, flags);
-}
-
-void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-
-	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
-		del_timer(&pmlmepriv->scan_to_timer);
-
-		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
-	}
-
-	if (pmlmepriv->to_join) {
-		if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
-			if (!check_fwstate(pmlmepriv, _FW_LINKED)) {
-				set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-
-				if (!r8712_select_and_join_from_scan(pmlmepriv)) {
-					mod_timer(&pmlmepriv->assoc_timer, jiffies +
-						  msecs_to_jiffies(MAX_JOIN_TIMEOUT));
-				} else {
-					struct wlan_bssid_ex *pdev_network =
-					  &(adapter->registrypriv.dev_network);
-					u8 *pibss =
-						 adapter->registrypriv.dev_network.MacAddress;
-					pmlmepriv->fw_state ^= _FW_UNDER_SURVEY;
-					memcpy(&pdev_network->Ssid,
-						&pmlmepriv->assoc_ssid,
-						sizeof(struct
-							 ndis_802_11_ssid));
-					r8712_update_registrypriv_dev_network
-						(adapter);
-					r8712_generate_random_ibss(pibss);
-					pmlmepriv->fw_state =
-						 WIFI_ADHOC_MASTER_STATE;
-					pmlmepriv->to_join = false;
-				}
-			}
-		} else {
-			pmlmepriv->to_join = false;
-			set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-			if (!r8712_select_and_join_from_scan(pmlmepriv))
-				mod_timer(&pmlmepriv->assoc_timer, jiffies +
-					  msecs_to_jiffies(MAX_JOIN_TIMEOUT));
-			else
-				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
-		}
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-/*
- *r8712_free_assoc_resources: the caller has to lock pmlmepriv->lock
- */
-void r8712_free_assoc_resources(struct _adapter *adapter)
-{
-	unsigned long irqL;
-	struct wlan_network *pwlan = NULL;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	struct sta_priv *pstapriv = &adapter->stapriv;
-	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-
-	pwlan = r8712_find_network(&pmlmepriv->scanned_queue,
-				   tgt_network->network.MacAddress);
-
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_AP_STATE)) {
-		struct sta_info *psta;
-
-		psta = r8712_get_stainfo(&adapter->stapriv,
-					 tgt_network->network.MacAddress);
-
-		spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
-		r8712_free_stainfo(adapter,  psta);
-		spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-	}
-
-	if (check_fwstate(pmlmepriv,
-	    WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE | WIFI_AP_STATE))
-		r8712_free_all_stainfo(adapter);
-	if (pwlan)
-		pwlan->fixed = false;
-
-	if (((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) &&
-	     (adapter->stapriv.asoc_sta_count == 1)))
-		free_network_nolock(pmlmepriv, pwlan);
-}
-
-/*
- * r8712_indicate_connect: the caller has to lock pmlmepriv->lock
- */
-void r8712_indicate_connect(struct _adapter *padapter)
-{
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	pmlmepriv->to_join = false;
-	set_fwstate(pmlmepriv, _FW_LINKED);
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_LINK);
-	r8712_os_indicate_connect(padapter);
-	if (padapter->registrypriv.power_mgnt > PS_MODE_ACTIVE)
-		mod_timer(&pmlmepriv->dhcp_timer,
-			  jiffies + msecs_to_jiffies(60000));
-}
-
-/*
- * r8712_ind_disconnect: the caller has to lock pmlmepriv->lock
- */
-void r8712_ind_disconnect(struct _adapter *padapter)
-{
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-
-	if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-		_clr_fwstate_(pmlmepriv, _FW_LINKED);
-		padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK);
-		r8712_os_indicate_disconnect(padapter);
-	}
-	if (padapter->pwrctrlpriv.pwr_mode !=
-	    padapter->registrypriv.power_mgnt) {
-		del_timer(&pmlmepriv->dhcp_timer);
-		r8712_set_ps_mode(padapter, padapter->registrypriv.power_mgnt,
-				  padapter->registrypriv.smart_ps);
-	}
-}
-
-/*Notes:
- *pnetwork : returns from r8712_joinbss_event_callback
- *ptarget_wlan: found from scanned_queue
- *if join_res > 0, for (fw_state==WIFI_STATION_STATE), we check if
- *  "ptarget_sta" & "ptarget_wlan" exist.
- *if join_res > 0, for (fw_state==WIFI_ADHOC_STATE), we only check
- * if "ptarget_wlan" exist.
- *if join_res > 0, update "cur_network->network" from
- * "pnetwork->network" if (ptarget_wlan !=NULL).
- */
-void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	unsigned long irqL = 0, irqL2;
-	struct sta_info	*ptarget_sta = NULL, *pcur_sta = NULL;
-	struct sta_priv	*pstapriv = &adapter->stapriv;
-	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
-	struct wlan_network	*cur_network = &pmlmepriv->cur_network;
-	struct wlan_network	*pcur_wlan = NULL, *ptarget_wlan = NULL;
-	unsigned int		the_same_macaddr = false;
-	struct wlan_network *pnetwork;
-
-	if (sizeof(struct list_head) == 4 * sizeof(u32)) {
-		pnetwork = kmalloc(sizeof(struct wlan_network), GFP_ATOMIC);
-		if (!pnetwork)
-			return;
-		memcpy((u8 *)pnetwork + 16, (u8 *)pbuf + 8,
-			sizeof(struct wlan_network) - 16);
-	} else {
-		pnetwork = (struct wlan_network *)pbuf;
-	}
-
-#ifdef __BIG_ENDIAN
-	/* endian_convert */
-	pnetwork->join_res = le32_to_cpu(pnetwork->join_res);
-	pnetwork->network_type = le32_to_cpu(pnetwork->network_type);
-	pnetwork->network.Length = le32_to_cpu(pnetwork->network.Length);
-	pnetwork->network.Ssid.SsidLength =
-		le32_to_cpu(pnetwork->network.Ssid.SsidLength);
-	pnetwork->network.Privacy = le32_to_cpu(pnetwork->network.Privacy);
-	pnetwork->network.Rssi = le32_to_cpu(pnetwork->network.Rssi);
-	pnetwork->network.NetworkTypeInUse =
-		le32_to_cpu(pnetwork->network.NetworkTypeInUse);
-	pnetwork->network.Configuration.ATIMWindow =
-		le32_to_cpu(pnetwork->network.Configuration.ATIMWindow);
-	pnetwork->network.Configuration.BeaconPeriod =
-		le32_to_cpu(pnetwork->network.Configuration.BeaconPeriod);
-	pnetwork->network.Configuration.DSConfig =
-		le32_to_cpu(pnetwork->network.Configuration.DSConfig);
-	pnetwork->network.Configuration.FHConfig.DwellTime =
-		le32_to_cpu(pnetwork->network.Configuration.FHConfig.DwellTime);
-	pnetwork->network.Configuration.FHConfig.HopPattern =
-		le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopPattern);
-	pnetwork->network.Configuration.FHConfig.HopSet =
-		le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopSet);
-	pnetwork->network.Configuration.FHConfig.Length =
-		le32_to_cpu(pnetwork->network.Configuration.FHConfig.Length);
-	pnetwork->network.Configuration.Length =
-		le32_to_cpu(pnetwork->network.Configuration.Length);
-	pnetwork->network.InfrastructureMode =
-		le32_to_cpu(pnetwork->network.InfrastructureMode);
-	pnetwork->network.IELength = le32_to_cpu(pnetwork->network.IELength);
-#endif
-
-	the_same_macaddr = !memcmp(pnetwork->network.MacAddress,
-				cur_network->network.MacAddress, ETH_ALEN);
-	pnetwork->network.Length =
-		r8712_get_wlan_bssid_ex_sz(&pnetwork->network);
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (pnetwork->network.Length > sizeof(struct wlan_bssid_ex))
-		goto ignore_joinbss_callback;
-	if (pnetwork->join_res > 0) {
-		if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
-			/*s1. find ptarget_wlan*/
-			if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-				if (the_same_macaddr) {
-					ptarget_wlan =
-						r8712_find_network(&pmlmepriv->scanned_queue,
-						cur_network->network.MacAddress);
-				} else {
-					pcur_wlan =
-						r8712_find_network(&pmlmepriv->scanned_queue,
-						cur_network->network.MacAddress);
-					if (pcur_wlan)
-						pcur_wlan->fixed = false;
-
-					pcur_sta = r8712_get_stainfo(pstapriv,
-						cur_network->network.MacAddress);
-					spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL2);
-					r8712_free_stainfo(adapter, pcur_sta);
-					spin_unlock_irqrestore(&(pstapriv->sta_hash_lock), irqL2);
-
-					ptarget_wlan =
-						r8712_find_network(&pmlmepriv->scanned_queue,
-						pnetwork->network.MacAddress);
-					if (ptarget_wlan)
-						ptarget_wlan->fixed = true;
-				}
-			} else {
-				ptarget_wlan = r8712_find_network(&pmlmepriv->scanned_queue,
-						pnetwork->network.MacAddress);
-				if (ptarget_wlan)
-					ptarget_wlan->fixed = true;
-			}
-
-			if (!ptarget_wlan) {
-				if (check_fwstate(pmlmepriv,
-					_FW_UNDER_LINKING))
-					pmlmepriv->fw_state ^=
-						_FW_UNDER_LINKING;
-				goto ignore_joinbss_callback;
-			}
-
-			/*s2. find ptarget_sta & update ptarget_sta*/
-			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
-				if (the_same_macaddr) {
-					ptarget_sta =
-						r8712_get_stainfo(pstapriv,
-						pnetwork->network.MacAddress);
-					if (!ptarget_sta)
-						ptarget_sta =
-						r8712_alloc_stainfo(pstapriv,
-						pnetwork->network.MacAddress);
-				} else {
-					ptarget_sta =
-						r8712_alloc_stainfo(pstapriv,
-						pnetwork->network.MacAddress);
-				}
-				if (ptarget_sta) /*update ptarget_sta*/ {
-					ptarget_sta->aid = pnetwork->join_res;
-					ptarget_sta->qos_option = 1;
-					ptarget_sta->mac_id = 5;
-					if (adapter->securitypriv.AuthAlgrthm == 2) {
-						adapter->securitypriv.binstallGrpkey = false;
-						adapter->securitypriv.busetkipkey = false;
-						adapter->securitypriv.bgrpkey_handshake = false;
-						ptarget_sta->ieee8021x_blocked = true;
-						ptarget_sta->XPrivacy =
-							adapter->securitypriv.PrivacyAlgrthm;
-						memset((u8 *)&ptarget_sta->x_UncstKey,
-							0,
-							sizeof(union Keytype));
-						memset((u8 *)&ptarget_sta->tkiprxmickey,
-							0,
-							sizeof(union Keytype));
-						memset((u8 *)&ptarget_sta->tkiptxmickey,
-							0,
-							sizeof(union Keytype));
-						memset((u8 *)&ptarget_sta->txpn,
-							0,
-							sizeof(union pn48));
-						memset((u8 *)&ptarget_sta->rxpn,
-							0,
-							sizeof(union pn48));
-					}
-				} else {
-					if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
-						pmlmepriv->fw_state ^=
-							_FW_UNDER_LINKING;
-					goto ignore_joinbss_callback;
-				}
-			}
-
-			/*s3. update cur_network & indicate connect*/
-			memcpy(&cur_network->network, &pnetwork->network,
-				pnetwork->network.Length);
-			cur_network->aid = pnetwork->join_res;
-			/*update fw_state will clr _FW_UNDER_LINKING*/
-			switch (pnetwork->network.InfrastructureMode) {
-			case Ndis802_11Infrastructure:
-				pmlmepriv->fw_state = WIFI_STATION_STATE;
-				break;
-			case Ndis802_11IBSS:
-				pmlmepriv->fw_state = WIFI_ADHOC_STATE;
-				break;
-			default:
-				pmlmepriv->fw_state = WIFI_NULL_STATE;
-				break;
-			}
-			r8712_update_protection(adapter,
-				(cur_network->network.IEs) +
-				sizeof(struct NDIS_802_11_FIXED_IEs),
-				(cur_network->network.IELength));
-			/*TODO: update HT_Capability*/
-			update_ht_cap(adapter, cur_network->network.IEs,
-				cur_network->network.IELength);
-			/*indicate connect*/
-			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
-				r8712_indicate_connect(adapter);
-			del_timer(&pmlmepriv->assoc_timer);
-		} else {
-			goto ignore_joinbss_callback;
-		}
-	} else {
-		if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) {
-			mod_timer(&pmlmepriv->assoc_timer,
-				jiffies + msecs_to_jiffies(1));
-			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
-		}
-	}
-ignore_joinbss_callback:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	if (sizeof(struct list_head) == 4 * sizeof(u32))
-		kfree(pnetwork);
-}
-
-void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	unsigned long irqL;
-	struct sta_info *psta;
-	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
-	struct stassoc_event *pstassoc	= (struct stassoc_event *)pbuf;
-
-	/* to do: */
-	if (!r8712_access_ctrl(&adapter->acl_list, pstassoc->macaddr))
-		return;
-	psta = r8712_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
-	if (psta) {
-		/*the sta have been in sta_info_queue => do nothing
-		 *(between drv has received this event before and
-		 * fw have not yet to set key to CAM_ENTRY)
-		 */
-		return;
-	}
-
-	psta = r8712_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr);
-	if (!psta)
-		return;
-	/* to do : init sta_info variable */
-	psta->qos_option = 0;
-	psta->mac_id = le32_to_cpu(pstassoc->cam_id);
-	/* psta->aid = (uint)pstassoc->cam_id; */
-
-	if (adapter->securitypriv.AuthAlgrthm == 2)
-		psta->XPrivacy = adapter->securitypriv.PrivacyAlgrthm;
-	psta->ieee8021x_blocked = false;
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) ||
-	    check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
-		if (adapter->stapriv.asoc_sta_count == 2) {
-			/* a sta + bc/mc_stainfo (not Ibss_stainfo) */
-			r8712_indicate_connect(adapter);
-		}
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	unsigned long irqL, irqL2;
-	struct sta_info *psta;
-	struct wlan_network *pwlan = NULL;
-	struct wlan_bssid_ex *pdev_network = NULL;
-	u8 *pibss = NULL;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	struct stadel_event *pstadel = (struct stadel_event *)pbuf;
-	struct sta_priv *pstapriv = &adapter->stapriv;
-	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL2);
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
-		r8712_ind_disconnect(adapter);
-		r8712_free_assoc_resources(adapter);
-	}
-	if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE |
-	    WIFI_ADHOC_STATE)) {
-		psta = r8712_get_stainfo(&adapter->stapriv, pstadel->macaddr);
-		spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
-		r8712_free_stainfo(adapter, psta);
-		spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-		if (adapter->stapriv.asoc_sta_count == 1) {
-			/*a sta + bc/mc_stainfo (not Ibss_stainfo) */
-			pwlan = r8712_find_network(&pmlmepriv->scanned_queue,
-				tgt_network->network.MacAddress);
-			if (pwlan) {
-				pwlan->fixed = false;
-				free_network_nolock(pmlmepriv, pwlan);
-			}
-			/*re-create ibss*/
-			pdev_network = &(adapter->registrypriv.dev_network);
-			pibss = adapter->registrypriv.dev_network.MacAddress;
-			memcpy(pdev_network, &tgt_network->network,
-				r8712_get_wlan_bssid_ex_sz(&tgt_network->network));
-			memcpy(&pdev_network->Ssid,
-				&pmlmepriv->assoc_ssid,
-				sizeof(struct ndis_802_11_ssid));
-			r8712_update_registrypriv_dev_network(adapter);
-			r8712_generate_random_ibss(pibss);
-			if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) {
-				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE);
-				set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
-			}
-		}
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL2);
-}
-
-void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	struct reportpwrstate_parm *preportpwrstate =
-			 (struct reportpwrstate_parm *)pbuf;
-
-	preportpwrstate->state |= (u8)(adapter->pwrctrlpriv.cpwm_tog + 0x80);
-	r8712_cpwm_int_hdl(adapter, preportpwrstate);
-}
-
-/*	When the Netgear 3500 AP is with WPA2PSK-AES mode, it will send
- *	 the ADDBA req frame with start seq control = 0 to wifi client after
- *	 the WPA handshake and the seqence number of following data packet
- *	will be 0. In this case, the Rx reorder sequence is not longer than 0
- *	 and the WiFi client will drop the data with seq number 0.
- *	So, the 8712 firmware has to inform driver with receiving the
- *	 ADDBA-Req frame so that the driver can reset the
- *	sequence value of Rx reorder control.
- */
-void r8712_got_addbareq_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	struct	ADDBA_Req_Report_parm *pAddbareq_pram =
-			 (struct ADDBA_Req_Report_parm *)pbuf;
-	struct	sta_info *psta;
-	struct	sta_priv *pstapriv = &adapter->stapriv;
-	struct	recv_reorder_ctrl *precvreorder_ctrl = NULL;
-
-	psta = r8712_get_stainfo(pstapriv, pAddbareq_pram->MacAddress);
-	if (psta) {
-		precvreorder_ctrl =
-			 &psta->recvreorder_ctrl[pAddbareq_pram->tid];
-		/* set the indicate_seq to 0xffff so that the rx reorder
-		 * can store any following data packet.
-		 */
-		precvreorder_ctrl->indicate_seq = 0xffff;
-	}
-}
-
-void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf)
-{
-	if (!adapter->securitypriv.wps_hw_pbc_pressed)
-		adapter->securitypriv.wps_hw_pbc_pressed = true;
-}
-
-void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter)
-{
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	struct sitesurvey_ctrl	*psitesurveyctrl = &pmlmepriv->sitesurveyctrl;
-	struct registry_priv	*pregistrypriv = &adapter->registrypriv;
-	u64 current_tx_pkts;
-	uint current_rx_pkts;
-
-	current_tx_pkts = (adapter->xmitpriv.tx_pkts) -
-			  (psitesurveyctrl->last_tx_pkts);
-	current_rx_pkts = (adapter->recvpriv.rx_pkts) -
-			  (psitesurveyctrl->last_rx_pkts);
-	psitesurveyctrl->last_tx_pkts = adapter->xmitpriv.tx_pkts;
-	psitesurveyctrl->last_rx_pkts = adapter->recvpriv.rx_pkts;
-	if ((current_tx_pkts > pregistrypriv->busy_thresh) ||
-	    (current_rx_pkts > pregistrypriv->busy_thresh))
-		psitesurveyctrl->traffic_busy = true;
-	else
-		psitesurveyctrl->traffic_busy = false;
-}
-
-void _r8712_join_timeout_handler(struct _adapter *adapter)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	if (adapter->driver_stopped || adapter->surprise_removed)
-		return;
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
-	pmlmepriv->to_join = false;
-	if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-		r8712_os_indicate_disconnect(adapter);
-		_clr_fwstate_(pmlmepriv, _FW_LINKED);
-	}
-	if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt) {
-		r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt,
-				  adapter->registrypriv.smart_ps);
-	}
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_scan_timeout_handler (struct _adapter *adapter)
-{
-	unsigned long irqL;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
-	pmlmepriv->to_join = false;	/* scan fail, so clear to_join flag */
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void _r8712_dhcp_timeout_handler (struct _adapter *adapter)
-{
-	if (adapter->driver_stopped || adapter->surprise_removed)
-		return;
-	if (adapter->pwrctrlpriv.pwr_mode != adapter->registrypriv.power_mgnt)
-		r8712_set_ps_mode(adapter, adapter->registrypriv.power_mgnt,
-			    adapter->registrypriv.smart_ps);
-}
-
-int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv)
-{
-	struct list_head *phead;
-	unsigned char *dst_ssid, *src_ssid;
-	struct _adapter *adapter;
-	struct  __queue *queue = NULL;
-	struct wlan_network *pnetwork = NULL;
-	struct wlan_network *pnetwork_max_rssi = NULL;
-
-	adapter = (struct _adapter *)pmlmepriv->nic_hdl;
-	queue = &pmlmepriv->scanned_queue;
-	phead = &queue->queue;
-	pmlmepriv->pscanned = phead->next;
-	while (1) {
-		if (end_of_queue_search(phead, pmlmepriv->pscanned)) {
-			if (pmlmepriv->assoc_by_rssi && pnetwork_max_rssi) {
-				pnetwork = pnetwork_max_rssi;
-				goto ask_for_joinbss;
-			}
-			return -EINVAL;
-		}
-		pnetwork = container_of(pmlmepriv->pscanned,
-					struct wlan_network, list);
-		pmlmepriv->pscanned = pmlmepriv->pscanned->next;
-		if (pmlmepriv->assoc_by_bssid) {
-			dst_ssid = pnetwork->network.MacAddress;
-			src_ssid = pmlmepriv->assoc_bssid;
-			if (!memcmp(dst_ssid, src_ssid, ETH_ALEN)) {
-				if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-					if (is_same_network(&pmlmepriv->cur_network.network,
-					    &pnetwork->network)) {
-						_clr_fwstate_(pmlmepriv,
-							_FW_UNDER_LINKING);
-						/*r8712_indicate_connect again*/
-						r8712_indicate_connect(adapter);
-						return 2;
-					}
-					r8712_disassoc_cmd(adapter);
-					r8712_ind_disconnect(adapter);
-					r8712_free_assoc_resources(adapter);
-				}
-				goto ask_for_joinbss;
-			}
-		} else if (pmlmepriv->assoc_ssid.SsidLength == 0) {
-			goto ask_for_joinbss;
-		}
-		dst_ssid = pnetwork->network.Ssid.Ssid;
-		src_ssid = pmlmepriv->assoc_ssid.Ssid;
-		if ((pnetwork->network.Ssid.SsidLength ==
-		    pmlmepriv->assoc_ssid.SsidLength) &&
-		    (!memcmp(dst_ssid, src_ssid,
-		     pmlmepriv->assoc_ssid.SsidLength))) {
-			if (pmlmepriv->assoc_by_rssi) {
-				/* if the ssid is the same, select the bss
-				 * which has the max rssi
-				 */
-				if (pnetwork_max_rssi) {
-					if (pnetwork->network.Rssi >
-					    pnetwork_max_rssi->network.Rssi)
-						pnetwork_max_rssi = pnetwork;
-				} else {
-					pnetwork_max_rssi = pnetwork;
-				}
-			} else if (is_desired_network(adapter, pnetwork)) {
-				if (check_fwstate(pmlmepriv, _FW_LINKED)) {
-					r8712_disassoc_cmd(adapter);
-					r8712_free_assoc_resources(adapter);
-				}
-				goto ask_for_joinbss;
-			}
-		}
-	}
-
-ask_for_joinbss:
-	return r8712_joinbss_cmd(adapter, pnetwork);
-}
-
-int r8712_set_auth(struct _adapter *adapter,
-		   struct security_priv *psecuritypriv)
-{
-	struct cmd_priv	*pcmdpriv = &adapter->cmdpriv;
-	struct cmd_obj *pcmd;
-	struct setauth_parm *psetauthparm;
-
-	pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
-	if (!pcmd)
-		return -ENOMEM;
-
-	psetauthparm = kzalloc(sizeof(*psetauthparm), GFP_ATOMIC);
-	if (!psetauthparm) {
-		kfree(pcmd);
-		return -ENOMEM;
-	}
-	psetauthparm->mode = (u8)psecuritypriv->AuthAlgrthm;
-	pcmd->cmdcode = _SetAuth_CMD_;
-	pcmd->parmbuf = (unsigned char *)psetauthparm;
-	pcmd->cmdsz = sizeof(struct setauth_parm);
-	pcmd->rsp = NULL;
-	pcmd->rspsz = 0;
-	INIT_LIST_HEAD(&pcmd->list);
-	r8712_enqueue_cmd(pcmdpriv, pcmd);
-	return 0;
-}
-
-int r8712_set_key(struct _adapter *adapter,
-		  struct security_priv *psecuritypriv,
-		  sint keyid)
-{
-	struct cmd_priv *pcmdpriv = &adapter->cmdpriv;
-	struct cmd_obj *pcmd;
-	struct setkey_parm *psetkeyparm;
-	u8 keylen;
-	int ret;
-
-	pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
-	if (!pcmd)
-		return -ENOMEM;
-	psetkeyparm = kzalloc(sizeof(*psetkeyparm), GFP_ATOMIC);
-	if (!psetkeyparm) {
-		ret = -ENOMEM;
-		goto err_free_cmd;
-	}
-	if (psecuritypriv->AuthAlgrthm == 2) { /* 802.1X */
-		psetkeyparm->algorithm =
-			 (u8)psecuritypriv->XGrpPrivacy;
-	} else { /* WEP */
-		psetkeyparm->algorithm =
-			 (u8)psecuritypriv->PrivacyAlgrthm;
-	}
-	psetkeyparm->keyid = (u8)keyid;
-
-	switch (psetkeyparm->algorithm) {
-	case _WEP40_:
-		keylen = 5;
-		memcpy(psetkeyparm->key,
-			psecuritypriv->DefKey[keyid].skey, keylen);
-		break;
-	case _WEP104_:
-		keylen = 13;
-		memcpy(psetkeyparm->key,
-			psecuritypriv->DefKey[keyid].skey, keylen);
-		break;
-	case _TKIP_:
-		if (keyid < 1 || keyid > 2) {
-			ret = -EINVAL;
-			goto err_free_parm;
-		}
-		keylen = 16;
-		memcpy(psetkeyparm->key,
-			&psecuritypriv->XGrpKey[keyid - 1], keylen);
-		psetkeyparm->grpkey = 1;
-		break;
-	case _AES_:
-		if (keyid < 1 || keyid > 2) {
-			ret = -EINVAL;
-			goto err_free_parm;
-		}
-		keylen = 16;
-		memcpy(psetkeyparm->key,
-			&psecuritypriv->XGrpKey[keyid - 1], keylen);
-		psetkeyparm->grpkey = 1;
-		break;
-	default:
-		ret = -EINVAL;
-		goto err_free_parm;
-	}
-	pcmd->cmdcode = _SetKey_CMD_;
-	pcmd->parmbuf = (u8 *)psetkeyparm;
-	pcmd->cmdsz =  (sizeof(struct setkey_parm));
-	pcmd->rsp = NULL;
-	pcmd->rspsz = 0;
-	INIT_LIST_HEAD(&pcmd->list);
-	r8712_enqueue_cmd(pcmdpriv, pcmd);
-	return 0;
-
-err_free_parm:
-	kfree(psetkeyparm);
-err_free_cmd:
-	kfree(pcmd);
-	return ret;
-}
-
-/* adjust IEs for r8712_joinbss_cmd in WMM */
-int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie, u8 *out_ie,
-		    uint in_len, uint initial_out_len)
-{
-	unsigned int ielength = 0;
-	unsigned int i, j;
-
-	i = 12; /* after the fixed IE */
-	while (i < in_len) {
-		ielength = initial_out_len;
-		if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
-		    in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
-		    in_ie[i + 5] == 0x02 && i + 5 < in_len) {
-			/*WMM element ID and OUI*/
-			for (j = i; j < i + 9; j++) {
-				out_ie[ielength] = in_ie[j];
-				ielength++;
-			}
-			out_ie[initial_out_len + 1] = 0x07;
-			out_ie[initial_out_len + 6] = 0x00;
-			out_ie[initial_out_len + 8] = 0x00;
-			break;
-		}
-		i += (in_ie[i + 1] + 2); /* to the next IE element */
-	}
-	return ielength;
-}
-
-/*
- * Ported from 8185: IsInPreAuthKeyList().
- *
- * Search by BSSID,
- * Return Value:
- *	-1		:if there is no pre-auth key in the  table
- *	>=0		:if there is pre-auth key, and   return the entry id
- */
-static int SecIsInPMKIDList(struct _adapter *Adapter, u8 *bssid)
-{
-	struct security_priv *p = &Adapter->securitypriv;
-	int i;
-
-	for (i = 0; i < NUM_PMKID_CACHE; i++)
-		if (p->PMKIDList[i].bUsed && !memcmp(p->PMKIDList[i].Bssid, bssid, ETH_ALEN))
-			return i;
-	return -1;
-}
-
-sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
-		     u8 *out_ie, uint in_len)
-{
-	u8 authmode = 0, match;
-	u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
-	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
-	uint ielength, cnt, remove_cnt;
-	int iEntry;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	struct security_priv *psecuritypriv = &adapter->securitypriv;
-	uint ndisauthmode = psecuritypriv->ndisauthtype;
-	uint ndissecuritytype = psecuritypriv->ndisencryptstatus;
-
-	if ((ndisauthmode == Ndis802_11AuthModeWPA) ||
-	    (ndisauthmode == Ndis802_11AuthModeWPAPSK)) {
-		authmode = _WPA_IE_ID_;
-		uncst_oui[0] = 0x0;
-		uncst_oui[1] = 0x50;
-		uncst_oui[2] = 0xf2;
-	}
-	if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
-	    (ndisauthmode == Ndis802_11AuthModeWPA2PSK)) {
-		authmode = _WPA2_IE_ID_;
-		uncst_oui[0] = 0x0;
-		uncst_oui[1] = 0x0f;
-		uncst_oui[2] = 0xac;
-	}
-	switch (ndissecuritytype) {
-	case Ndis802_11Encryption1Enabled:
-	case Ndis802_11Encryption1KeyAbsent:
-		uncst_oui[3] = 0x1;
-		break;
-	case Ndis802_11Encryption2Enabled:
-	case Ndis802_11Encryption2KeyAbsent:
-		uncst_oui[3] = 0x2;
-		break;
-	case Ndis802_11Encryption3Enabled:
-	case Ndis802_11Encryption3KeyAbsent:
-		uncst_oui[3] = 0x4;
-		break;
-	default:
-		break;
-	}
-	/*Search required WPA or WPA2 IE and copy to sec_ie[] */
-	cnt = 12;
-	match = false;
-	while (cnt < in_len) {
-		if (in_ie[cnt] == authmode) {
-			if ((authmode == _WPA_IE_ID_) &&
-			    (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
-				memcpy(&sec_ie[0], &in_ie[cnt],
-					in_ie[cnt + 1] + 2);
-				match = true;
-				break;
-			}
-			if (authmode == _WPA2_IE_ID_) {
-				memcpy(&sec_ie[0], &in_ie[cnt],
-					in_ie[cnt + 1] + 2);
-				match = true;
-				break;
-			}
-			if (((authmode == _WPA_IE_ID_) &&
-			     (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) ||
-			     (authmode == _WPA2_IE_ID_))
-				memcpy(&bkup_ie[0], &in_ie[cnt],
-					in_ie[cnt + 1] + 2);
-		}
-		cnt += in_ie[cnt + 1] + 2; /*get next*/
-	}
-	/*restruct WPA IE or WPA2 IE in sec_ie[] */
-	if (match) {
-		if (sec_ie[0] == _WPA_IE_ID_) {
-			/* parsing SSN IE to select required encryption
-			 * algorithm, and set the bc/mc encryption algorithm
-			 */
-			while (true) {
-				/*check wpa_oui tag*/
-				if (memcmp(&sec_ie[2], &wpa_oui[0], 4)) {
-					match = false;
-					break;
-				}
-				if ((sec_ie[6] != 0x01) || (sec_ie[7] != 0x0)) {
-					/*IE Ver error*/
-					match = false;
-					break;
-				}
-				if (!memcmp(&sec_ie[8], &wpa_oui[0], 3)) {
-					/* get bc/mc encryption type (group
-					 * key type)
-					 */
-					switch (sec_ie[11]) {
-					case 0x0: /*none*/
-						psecuritypriv->XGrpPrivacy =
-								_NO_PRIVACY_;
-						break;
-					case 0x1: /*WEP_40*/
-						psecuritypriv->XGrpPrivacy =
-								_WEP40_;
-						break;
-					case 0x2: /*TKIP*/
-						psecuritypriv->XGrpPrivacy =
-								_TKIP_;
-						break;
-					case 0x3: /*AESCCMP*/
-					case 0x4:
-						psecuritypriv->XGrpPrivacy =
-								_AES_;
-						break;
-					case 0x5: /*WEP_104*/
-						psecuritypriv->XGrpPrivacy =
-								_WEP104_;
-						break;
-					}
-				} else {
-					match = false;
-					break;
-				}
-				if (sec_ie[12] == 0x01) {
-					/*check the unicast encryption type*/
-					if (memcmp(&sec_ie[14],
-					    &uncst_oui[0], 4)) {
-						match = false;
-						break;
-
-					} /*else the uncst_oui is match*/
-				} else { /*mixed mode, unicast_enc_type > 1*/
-					/*select the uncst_oui and remove
-					 * the other uncst_oui
-					 */
-					cnt = sec_ie[12];
-					remove_cnt = (cnt - 1) * 4;
-					sec_ie[12] = 0x01;
-					memcpy(&sec_ie[14], &uncst_oui[0], 4);
-					/*remove the other unicast suit*/
-					memcpy(&sec_ie[18],
-						&sec_ie[18 + remove_cnt],
-						sec_ie[1] - 18 + 2 -
-						remove_cnt);
-					sec_ie[1] = sec_ie[1] - remove_cnt;
-				}
-				break;
-			}
-		}
-		if (authmode == _WPA2_IE_ID_) {
-			/* parsing RSN IE to select required encryption
-			 * algorithm, and set the bc/mc encryption algorithm
-			 */
-			while (true) {
-				if ((sec_ie[2] != 0x01) || (sec_ie[3] != 0x0)) {
-					/*IE Ver error*/
-					match = false;
-					break;
-				}
-				if (!memcmp(&sec_ie[4], &uncst_oui[0], 3)) {
-					/*get bc/mc encryption type*/
-					switch (sec_ie[7]) {
-					case 0x1: /*WEP_40*/
-						psecuritypriv->XGrpPrivacy =
-								_WEP40_;
-						break;
-					case 0x2: /*TKIP*/
-						psecuritypriv->XGrpPrivacy =
-								_TKIP_;
-						break;
-					case 0x4: /*AESWRAP*/
-						psecuritypriv->XGrpPrivacy =
-								_AES_;
-						break;
-					case 0x5: /*WEP_104*/
-						psecuritypriv->XGrpPrivacy =
-								_WEP104_;
-						break;
-					default: /*one*/
-						psecuritypriv->XGrpPrivacy =
-								_NO_PRIVACY_;
-						break;
-					}
-				} else {
-					match = false;
-					break;
-				}
-				if (sec_ie[8] == 0x01) {
-					/*check the unicast encryption type*/
-					if (memcmp(&sec_ie[10],
-						     &uncst_oui[0], 4)) {
-						match = false;
-						break;
-					} /*else the uncst_oui is match*/
-				} else { /*mixed mode, unicast_enc_type > 1*/
-					/*select the uncst_oui and remove the
-					 * other uncst_oui
-					 */
-					cnt = sec_ie[8];
-					remove_cnt = (cnt - 1) * 4;
-					sec_ie[8] = 0x01;
-					memcpy(&sec_ie[10], &uncst_oui[0], 4);
-					/*remove the other unicast suit*/
-					memcpy(&sec_ie[14],
-						&sec_ie[14 + remove_cnt],
-						(sec_ie[1] - 14 + 2 -
-						remove_cnt));
-					sec_ie[1] = sec_ie[1] - remove_cnt;
-				}
-				break;
-			}
-		}
-	}
-	if ((authmode == _WPA_IE_ID_) || (authmode == _WPA2_IE_ID_)) {
-		/*copy fixed ie*/
-		memcpy(out_ie, in_ie, 12);
-		ielength = 12;
-		/*copy RSN or SSN*/
-		if (match) {
-			memcpy(&out_ie[ielength], &sec_ie[0], sec_ie[1] + 2);
-			ielength += sec_ie[1] + 2;
-			if (authmode == _WPA2_IE_ID_) {
-				/*the Pre-Authentication bit should be zero*/
-				out_ie[ielength - 1] = 0;
-				out_ie[ielength - 2] = 0;
-			}
-			r8712_report_sec_ie(adapter, authmode, sec_ie);
-		}
-	} else {
-		/*copy fixed ie only*/
-		memcpy(out_ie, in_ie, 12);
-		ielength = 12;
-		if (psecuritypriv->wps_phase) {
-			memcpy(out_ie + ielength, psecuritypriv->wps_ie,
-			       psecuritypriv->wps_ie_len);
-			ielength += psecuritypriv->wps_ie_len;
-		}
-	}
-	iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid);
-	if (iEntry < 0)
-		return ielength;
-	if (authmode == _WPA2_IE_ID_) {
-		out_ie[ielength] = 1;
-		ielength++;
-		out_ie[ielength] = 0;	/*PMKID count = 0x0100*/
-		ielength++;
-		memcpy(&out_ie[ielength],
-			&psecuritypriv->PMKIDList[iEntry].PMKID, 16);
-		ielength += 16;
-		out_ie[13] += 18;/*PMKID length = 2+16*/
-	}
-	return ielength;
-}
-
-void r8712_init_registrypriv_dev_network(struct _adapter *adapter)
-{
-	struct registry_priv *pregistrypriv = &adapter->registrypriv;
-	struct eeprom_priv *peepriv = &adapter->eeprompriv;
-	struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network;
-	u8 *myhwaddr = myid(peepriv);
-
-	memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN);
-	memcpy(&pdev_network->Ssid, &pregistrypriv->ssid,
-		sizeof(struct ndis_802_11_ssid));
-	pdev_network->Configuration.Length =
-			 sizeof(struct NDIS_802_11_CONFIGURATION);
-	pdev_network->Configuration.BeaconPeriod = 100;
-	pdev_network->Configuration.FHConfig.Length = 0;
-	pdev_network->Configuration.FHConfig.HopPattern = 0;
-	pdev_network->Configuration.FHConfig.HopSet = 0;
-	pdev_network->Configuration.FHConfig.DwellTime = 0;
-}
-
-void r8712_update_registrypriv_dev_network(struct _adapter *adapter)
-{
-	int sz = 0;
-	struct registry_priv	*pregistrypriv = &adapter->registrypriv;
-	struct wlan_bssid_ex	*pdev_network = &pregistrypriv->dev_network;
-	struct security_priv	*psecuritypriv = &adapter->securitypriv;
-	struct wlan_network	*cur_network = &adapter->mlmepriv.cur_network;
-
-	pdev_network->Privacy = cpu_to_le32(psecuritypriv->PrivacyAlgrthm
-					    > 0 ? 1 : 0); /* adhoc no 802.1x */
-	pdev_network->Rssi = 0;
-	switch (pregistrypriv->wireless_mode) {
-	case WIRELESS_11B:
-		pdev_network->NetworkTypeInUse = Ndis802_11DS;
-		break;
-	case WIRELESS_11G:
-	case WIRELESS_11BG:
-		pdev_network->NetworkTypeInUse = Ndis802_11OFDM24;
-		break;
-	case WIRELESS_11A:
-		pdev_network->NetworkTypeInUse = Ndis802_11OFDM5;
-		break;
-	default:
-		/* TODO */
-		break;
-	}
-	pdev_network->Configuration.DSConfig = pregistrypriv->channel;
-	if (cur_network->network.InfrastructureMode == Ndis802_11IBSS)
-		pdev_network->Configuration.ATIMWindow = 3;
-	pdev_network->InfrastructureMode = cur_network->network.InfrastructureMode;
-	/* 1. Supported rates
-	 * 2. IE
-	 */
-	sz = r8712_generate_ie(pregistrypriv);
-	pdev_network->IELength = sz;
-	pdev_network->Length = r8712_get_wlan_bssid_ex_sz(pdev_network);
-}
-
-/*the function is at passive_level*/
-void r8712_joinbss_reset(struct _adapter *padapter)
-{
-	int i;
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
-
-	/* todo: if you want to do something io/reg/hw setting before join_bss,
-	 * please add code here
-	 */
-	phtpriv->ampdu_enable = false;/*reset to disabled*/
-	for (i = 0; i < 16; i++)
-		phtpriv->baddbareq_issued[i] = false;/*reset it*/
-	if (phtpriv->ht_option) {
-		/* validate  usb rx aggregation */
-		r8712_write8(padapter, 0x102500D9, 48);/*TH = 48 pages, 6k*/
-	} else {
-		/* invalidate  usb rx aggregation */
-		/* TH=1 => means that invalidate usb rx aggregation */
-		r8712_write8(padapter, 0x102500D9, 1);
-	}
-}
-
-/*the function is >= passive_level*/
-unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie,
-				     u8 *out_ie, uint in_len, uint *pout_len)
-{
-	u32 ielen, out_len;
-	unsigned char *p;
-	struct ieee80211_ht_cap ht_capie;
-	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
-	struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-
-	phtpriv->ht_option = 0;
-	p = r8712_get_ie(in_ie + 12, WLAN_EID_HT_CAPABILITY, &ielen, in_len - 12);
-	if (p && (ielen > 0)) {
-		if (pqospriv->qos_option == 0) {
-			out_len = *pout_len;
-			r8712_set_ie(out_ie + out_len, WLAN_EID_VENDOR_SPECIFIC,
-				     _WMM_IE_Length_, WMM_IE, pout_len);
-			pqospriv->qos_option = 1;
-		}
-		out_len = *pout_len;
-		memset(&ht_capie, 0, sizeof(struct ieee80211_ht_cap));
-		ht_capie.cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-				    IEEE80211_HT_CAP_SGI_20 |
-				    IEEE80211_HT_CAP_SGI_40 |
-				    IEEE80211_HT_CAP_TX_STBC |
-				    IEEE80211_HT_CAP_MAX_AMSDU |
-				    IEEE80211_HT_CAP_DSSSCCK40);
-		ht_capie.ampdu_params_info = (IEEE80211_HT_AMPDU_PARM_FACTOR &
-				0x03) | (IEEE80211_HT_AMPDU_PARM_DENSITY & 0x00);
-		r8712_set_ie(out_ie + out_len, WLAN_EID_HT_CAPABILITY,
-			     sizeof(struct ieee80211_ht_cap),
-			     (unsigned char *)&ht_capie, pout_len);
-		phtpriv->ht_option = 1;
-	}
-	return phtpriv->ht_option;
-}
-
-/* the function is > passive_level (in critical_section) */
-static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len)
-{
-	u8 *p, max_ampdu_sz;
-	int i;
-	uint len;
-	struct sta_info *bmc_sta, *psta;
-	struct ieee80211_ht_cap *pht_capie;
-	struct recv_reorder_ctrl *preorder_ctrl;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct ht_priv *phtpriv = &pmlmepriv->htpriv;
-	struct registry_priv *pregistrypriv = &padapter->registrypriv;
-	struct wlan_network *pcur_network = &(pmlmepriv->cur_network);
-
-	if (!phtpriv->ht_option)
-		return;
-	/* maybe needs check if ap supports rx ampdu. */
-	if (!phtpriv->ampdu_enable &&
-	    (pregistrypriv->ampdu_enable == 1))
-		phtpriv->ampdu_enable = true;
-	/*check Max Rx A-MPDU Size*/
-	len = 0;
-	p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs),
-				WLAN_EID_HT_CAPABILITY,
-				&len, ie_len -
-				sizeof(struct NDIS_802_11_FIXED_IEs));
-	if (p && len > 0) {
-		pht_capie = (struct ieee80211_ht_cap *)(p + 2);
-		max_ampdu_sz = (pht_capie->ampdu_params_info &
-				IEEE80211_HT_AMPDU_PARM_FACTOR);
-		/* max_ampdu_sz (kbytes); */
-		max_ampdu_sz = 1 << (max_ampdu_sz + 3);
-		phtpriv->rx_ampdu_maxlen = max_ampdu_sz;
-	}
-	/* for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
-	 * if A-MPDU Rx is enabled, resetting rx_ordering_ctrl
-	 * wstart_b(indicate_seq) to default value=0xffff
-	 * todo: check if AP can send A-MPDU packets
-	 */
-	bmc_sta = r8712_get_bcmc_stainfo(padapter);
-	if (bmc_sta) {
-		for (i = 0; i < 16; i++) {
-			preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
-			preorder_ctrl->indicate_seq = 0xffff;
-			preorder_ctrl->wend_b = 0xffff;
-		}
-	}
-	psta = r8712_get_stainfo(&padapter->stapriv,
-				 pcur_network->network.MacAddress);
-	if (psta) {
-		for (i = 0; i < 16; i++) {
-			preorder_ctrl = &psta->recvreorder_ctrl[i];
-			preorder_ctrl->indicate_seq = 0xffff;
-			preorder_ctrl->wend_b = 0xffff;
-		}
-	}
-	len = 0;
-	p = r8712_get_ie(pie + sizeof(struct NDIS_802_11_FIXED_IEs),
-		   WLAN_EID_HT_OPERATION, &len,
-		   ie_len - sizeof(struct NDIS_802_11_FIXED_IEs));
-}
-
-void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority)
-{
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct ht_priv	 *phtpriv = &pmlmepriv->htpriv;
-
-	if ((phtpriv->ht_option == 1) && (phtpriv->ampdu_enable)) {
-		if (!phtpriv->baddbareq_issued[priority]) {
-			r8712_addbareq_cmd(padapter, (u8)priority);
-			phtpriv->baddbareq_issued[priority] = true;
-		}
-	}
-}
--- a/drivers/staging/rtl8712/rtl871x_mlme.h
+++ /dev/null
@@ -1,205 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_MLME_H_
-#define __RTL871X_MLME_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wlan_bssdef.h"
-
-#define	MAX_BSS_CNT	64
-#define   MAX_JOIN_TIMEOUT	6000
-
-#define		SCANNING_TIMEOUT	4500
-
-#define	SCANQUEUE_LIFETIME 20 /* unit:sec */
-
-#define		WIFI_NULL_STATE	0x00000000
-#define	WIFI_ASOC_STATE		0x00000001	/* Under Linked state...*/
-#define		WIFI_REASOC_STATE 0x00000002
-#define	WIFI_SLEEP_STATE	0x00000004
-#define	WIFI_STATION_STATE	0x00000008
-#define	WIFI_AP_STATE		0x00000010
-#define	WIFI_ADHOC_STATE	0x00000020
-#define   WIFI_ADHOC_MASTER_STATE 0x00000040
-#define   WIFI_UNDER_LINKING	0x00000080
-#define WIFI_SITE_MONITOR	0x00000800	/* to indicate the station
-						 * is under site surveying
-						 */
-#define	WIFI_MP_STATE		0x00010000
-#define	WIFI_MP_CTX_BACKGROUND	0x00020000	/* in cont. tx background*/
-#define	WIFI_MP_CTX_ST		0x00040000	/* in cont. tx with
-						 * single-tone
-						 */
-#define	WIFI_MP_CTX_BACKGROUND_PENDING	0x00080000 /* pending in cont, tx
-						    * background due
-						    * to out of skb
-						    */
-#define	WIFI_MP_CTX_CCK_HW	0x00100000	/* in continuous tx*/
-#define	WIFI_MP_CTX_CCK_CS	0x00200000	/* in cont, tx with carrier
-						 * suppression
-						 */
-#define   WIFI_MP_LPBK_STATE	0x00400000
-
-#define _FW_UNDER_LINKING	WIFI_UNDER_LINKING
-#define _FW_LINKED		WIFI_ASOC_STATE
-#define _FW_UNDER_SURVEY	WIFI_SITE_MONITOR
-
-/*
- * there are several "locks" in mlme_priv,
- * since mlme_priv is a shared resource between many threads,
- * like ISR/Call-Back functions, the OID handlers, and even timer functions.
- * Each _queue has its own locks, already.
- * Other items are protected by mlme_priv.lock.
- * To avoid possible dead lock, any thread trying to modify mlme_priv
- * SHALL not lock up more than one lock at a time!
- */
-
-#define traffic_threshold	10
-#define	traffic_scan_period	500
-
-struct sitesurvey_ctrl {
-	u64	last_tx_pkts;
-	uint	last_rx_pkts;
-	sint	traffic_busy;
-	struct timer_list sitesurvey_ctrl_timer;
-};
-
-struct mlme_priv {
-	spinlock_t lock;
-	spinlock_t lock2;
-	sint	fw_state;	/*shall we protect this variable? */
-	u8 to_join; /*flag*/
-	u8 *nic_hdl;
-	struct list_head *pscanned;
-	struct  __queue free_bss_pool;
-	struct  __queue scanned_queue;
-	u8 *free_bss_buf;
-	unsigned long num_of_scanned;
-	u8 passive_mode; /*add for Android's SCAN-ACTIVE/SCAN-PASSIVE */
-	struct ndis_802_11_ssid	assoc_ssid;
-	u8 assoc_bssid[6];
-	struct wlan_network cur_network;
-	struct sitesurvey_ctrl sitesurveyctrl;
-	struct timer_list assoc_timer;
-	uint assoc_by_bssid;
-	uint assoc_by_rssi;
-	struct timer_list scan_to_timer; /* driver handles scan_timeout.*/
-	struct timer_list dhcp_timer; /* set dhcp to if driver in ps mode.*/
-	struct qos_priv qospriv;
-	struct ht_priv	htpriv;
-	struct timer_list wdg_timer; /*watchdog periodic timer*/
-};
-
-static inline u8 *get_bssid(struct mlme_priv *pmlmepriv)
-{
-	return pmlmepriv->cur_network.network.MacAddress;
-}
-
-static inline u8 check_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
-	if (pmlmepriv->fw_state & state)
-		return true;
-	return false;
-}
-
-static inline sint get_fwstate(struct mlme_priv *pmlmepriv)
-{
-	return pmlmepriv->fw_state;
-}
-
-/*
- * No Limit on the calling context,
- * therefore set it to be the critical section...
- *
- * ### NOTE:#### (!!!!)
- * TAKE CARE BEFORE CALLING THIS FUNC, LOCK pmlmepriv->lock
- */
-static inline void set_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
-	pmlmepriv->fw_state |= state;
-}
-
-static inline void _clr_fwstate_(struct mlme_priv *pmlmepriv, sint state)
-{
-	pmlmepriv->fw_state &= ~state;
-}
-
-/*
- * No Limit on the calling context,
- * therefore set it to be the critical section...
- */
-static inline void clr_fwstate(struct mlme_priv *pmlmepriv, sint state)
-{
-	unsigned long irqL;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, state))
-		pmlmepriv->fw_state ^= state;
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-static inline void set_scanned_network_val(struct mlme_priv *pmlmepriv,
-					     sint val)
-{
-	unsigned long irqL;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	pmlmepriv->num_of_scanned = val;
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-}
-
-void r8712_survey_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_surveydone_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_joinbss_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_stassoc_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_stadel_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_atimdone_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_cpwm_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_wpspbc_event_callback(struct _adapter *adapter, u8 *pbuf);
-void r8712_free_network_queue(struct _adapter *adapter);
-int r8712_init_mlme_priv(struct _adapter *adapter);
-void r8712_free_mlme_priv(struct mlme_priv *pmlmepriv);
-int r8712_select_and_join_from_scan(struct mlme_priv *pmlmepriv);
-int r8712_set_key(struct _adapter *adapter,
-		  struct security_priv *psecuritypriv, sint keyid);
-int r8712_set_auth(struct _adapter *adapter,
-		   struct security_priv *psecuritypriv);
-uint r8712_get_wlan_bssid_ex_sz(struct wlan_bssid_ex *bss);
-void r8712_generate_random_ibss(u8 *pibss);
-u8 *r8712_get_capability_from_ie(u8 *ie);
-struct wlan_network *r8712_get_oldest_wlan_network(
-				struct  __queue *scanned_queue);
-void r8712_free_assoc_resources(struct _adapter *adapter);
-void r8712_ind_disconnect(struct _adapter *adapter);
-void r8712_indicate_connect(struct _adapter *adapter);
-int r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
-			  u8 *out_ie, uint in_len);
-int r8712_restruct_wmm_ie(struct _adapter *adapter, u8 *in_ie,
-			  u8 *out_ie, uint in_len, uint initial_out_len);
-void r8712_init_registrypriv_dev_network(struct _adapter *adapter);
-void r8712_update_registrypriv_dev_network(struct _adapter *adapter);
-void _r8712_sitesurvey_ctrl_handler(struct _adapter *adapter);
-void _r8712_join_timeout_handler(struct _adapter *adapter);
-void r8712_scan_timeout_handler(struct _adapter *adapter);
-void _r8712_dhcp_timeout_handler(struct _adapter *adapter);
-struct wlan_network *_r8712_alloc_network(struct mlme_priv *pmlmepriv);
-sint r8712_if_up(struct _adapter *padapter);
-void r8712_joinbss_reset(struct _adapter *padapter);
-unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie,
-				     u8 *out_ie, uint in_len, uint *pout_len);
-void r8712_issue_addbareq_cmd(struct _adapter *padapter, int priority);
-int r8712_is_same_ibss(struct _adapter *adapter, struct wlan_network *pnetwork);
-
-#endif /*__RTL871X_MLME_H_*/
--- a/drivers/staging/rtl8712/rtl871x_mp.c
+++ /dev/null
@@ -1,724 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#define _RTL871X_MP_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "rtl871x_mp_phy_regdef.h"
-#include "rtl8712_cmd.h"
-
-static void _init_mp_priv_(struct mp_priv *pmp_priv)
-{
-	pmp_priv->mode = _LOOPBOOK_MODE_;
-	pmp_priv->curr_ch = 1;
-	pmp_priv->curr_modem = MIXED_PHY;
-	pmp_priv->curr_rateidx = 0;
-	pmp_priv->curr_txpoweridx = 0x14;
-	pmp_priv->antenna_tx = ANTENNA_A;
-	pmp_priv->antenna_rx = ANTENNA_AB;
-	pmp_priv->check_mp_pkt = 0;
-	pmp_priv->tx_pktcount = 0;
-	pmp_priv->rx_pktcount = 0;
-	pmp_priv->rx_crcerrpktcount = 0;
-}
-
-static int init_mp_priv(struct mp_priv *pmp_priv)
-{
-	int i;
-	struct mp_xmit_frame *pmp_xmitframe;
-
-	_init_mp_priv_(pmp_priv);
-	_init_queue(&pmp_priv->free_mp_xmitqueue);
-	pmp_priv->pallocated_mp_xmitframe_buf = NULL;
-	pmp_priv->pallocated_mp_xmitframe_buf = kmalloc(NR_MP_XMITFRAME *
-				sizeof(struct mp_xmit_frame) + 4,
-				GFP_ATOMIC);
-	if (!pmp_priv->pallocated_mp_xmitframe_buf)
-		return -ENOMEM;
-
-	pmp_priv->pmp_xmtframe_buf = pmp_priv->pallocated_mp_xmitframe_buf +
-			 4 -
-			 ((addr_t)(pmp_priv->pallocated_mp_xmitframe_buf) & 3);
-	pmp_xmitframe = (struct mp_xmit_frame *)pmp_priv->pmp_xmtframe_buf;
-	for (i = 0; i < NR_MP_XMITFRAME; i++) {
-		INIT_LIST_HEAD(&(pmp_xmitframe->list));
-		list_add_tail(&(pmp_xmitframe->list),
-				 &(pmp_priv->free_mp_xmitqueue.queue));
-		pmp_xmitframe->pkt = NULL;
-		pmp_xmitframe->frame_tag = MP_FRAMETAG;
-		pmp_xmitframe->padapter = pmp_priv->papdater;
-		pmp_xmitframe++;
-	}
-	pmp_priv->free_mp_xmitframe_cnt = NR_MP_XMITFRAME;
-	return 0;
-}
-
-static int free_mp_priv(struct mp_priv *pmp_priv)
-{
-	kfree(pmp_priv->pallocated_mp_xmitframe_buf);
-	return 0;
-}
-
-void mp871xinit(struct _adapter *padapter)
-{
-	struct mp_priv *pmppriv = &padapter->mppriv;
-
-	pmppriv->papdater = padapter;
-	init_mp_priv(pmppriv);
-}
-
-void mp871xdeinit(struct _adapter *padapter)
-{
-	struct mp_priv *pmppriv = &padapter->mppriv;
-
-	free_mp_priv(pmppriv);
-}
-
-/*
- * Special for bb and rf reg read/write
- */
-static u32 fw_iocmd_read(struct _adapter *pAdapter, struct IOCMD_STRUCT iocmd)
-{
-	u32 cmd32 = 0, val32 = 0;
-	u8 iocmd_class	= iocmd.cmdclass;
-	u16 iocmd_value	= iocmd.value;
-	u8 iocmd_idx	= iocmd.index;
-
-	cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx;
-	if (r8712_fw_cmd(pAdapter, cmd32))
-		r8712_fw_cmd_data(pAdapter, &val32, 1);
-	else
-		val32 = 0;
-	return val32;
-}
-
-static u8 fw_iocmd_write(struct _adapter *pAdapter,
-			 struct IOCMD_STRUCT iocmd, u32 value)
-{
-	u32 cmd32 = 0;
-	u8 iocmd_class	= iocmd.cmdclass;
-	u32 iocmd_value	= iocmd.value;
-	u8 iocmd_idx	= iocmd.index;
-
-	r8712_fw_cmd_data(pAdapter, &value, 0);
-	msleep(100);
-	cmd32 = (iocmd_class << 24) | (iocmd_value << 8) | iocmd_idx;
-	return r8712_fw_cmd(pAdapter, cmd32);
-}
-
-/* offset : 0X800~0XFFF */
-u32 r8712_bb_reg_read(struct _adapter *pAdapter, u16 offset)
-{
-	u8 shift = offset & 0x0003;	/* 4 byte access */
-	u16 bb_addr = offset & 0x0FFC;	/* 4 byte access */
-	u32 bb_val = 0;
-	struct IOCMD_STRUCT iocmd;
-
-	iocmd.cmdclass	= IOCMD_CLASS_BB_RF;
-	iocmd.value	= bb_addr;
-	iocmd.index	= IOCMD_BB_READ_IDX;
-	bb_val = fw_iocmd_read(pAdapter, iocmd);
-	if (shift != 0) {
-		u32 bb_val2 = 0;
-
-		bb_val >>= (shift * 8);
-		iocmd.value += 4;
-		bb_val2 = fw_iocmd_read(pAdapter, iocmd);
-		bb_val2 <<= ((4 - shift) * 8);
-		bb_val |= bb_val2;
-	}
-	return bb_val;
-}
-
-/* offset : 0X800~0XFFF */
-u8 r8712_bb_reg_write(struct _adapter *pAdapter, u16 offset, u32 value)
-{
-	u8 shift = offset & 0x0003;	/* 4 byte access */
-	u16 bb_addr = offset & 0x0FFC;	/* 4 byte access */
-	struct IOCMD_STRUCT iocmd;
-
-	iocmd.cmdclass	= IOCMD_CLASS_BB_RF;
-	iocmd.value	= bb_addr;
-	iocmd.index	= IOCMD_BB_WRITE_IDX;
-	if (shift != 0) {
-		u32 oldValue = 0;
-		u32 newValue = value;
-
-		oldValue = r8712_bb_reg_read(pAdapter, iocmd.value);
-		oldValue &= (0xFFFFFFFF >> ((4 - shift) * 8));
-		value = oldValue | (newValue << (shift * 8));
-		if (!fw_iocmd_write(pAdapter, iocmd, value))
-			return false;
-		iocmd.value += 4;
-		oldValue = r8712_bb_reg_read(pAdapter, iocmd.value);
-		oldValue &= (0xFFFFFFFF << (shift * 8));
-		value = oldValue | (newValue >> ((4 - shift) * 8));
-	}
-	return fw_iocmd_write(pAdapter, iocmd, value);
-}
-
-/* offset : 0x00 ~ 0xFF */
-u32 r8712_rf_reg_read(struct _adapter *pAdapter, u8 path, u8 offset)
-{
-	u16 rf_addr = (path << 8) | offset;
-	struct IOCMD_STRUCT iocmd;
-
-	iocmd.cmdclass	= IOCMD_CLASS_BB_RF;
-	iocmd.value	= rf_addr;
-	iocmd.index	= IOCMD_RF_READ_IDX;
-	return fw_iocmd_read(pAdapter, iocmd);
-}
-
-u8 r8712_rf_reg_write(struct _adapter *pAdapter, u8 path, u8 offset, u32 value)
-{
-	u16 rf_addr = (path << 8) | offset;
-	struct IOCMD_STRUCT iocmd;
-
-	iocmd.cmdclass	= IOCMD_CLASS_BB_RF;
-	iocmd.value	= rf_addr;
-	iocmd.index	= IOCMD_RF_WRIT_IDX;
-	return fw_iocmd_write(pAdapter, iocmd, value);
-}
-
-static u32 bitshift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++)
-		if (((bitmask >> i) &  0x1) == 1)
-			break;
-	return i;
-}
-
-static u32 get_bb_reg(struct _adapter *pAdapter, u16 offset, u32 bitmask)
-{
-	u32 org_value, bit_shift;
-
-	org_value = r8712_bb_reg_read(pAdapter, offset);
-	bit_shift = bitshift(bitmask);
-	return (org_value & bitmask) >> bit_shift;
-}
-
-static u8 set_bb_reg(struct _adapter *pAdapter,
-		     u16 offset,
-		     u32 bitmask,
-		     u32 value)
-{
-	u32 org_value, bit_shift, new_value;
-
-	if (bitmask != bMaskDWord) {
-		org_value = r8712_bb_reg_read(pAdapter, offset);
-		bit_shift = bitshift(bitmask);
-		new_value = (org_value & (~bitmask)) | (value << bit_shift);
-	} else {
-		new_value = value;
-	}
-	return r8712_bb_reg_write(pAdapter, offset, new_value);
-}
-
-static u32 get_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset,
-		      u32 bitmask)
-{
-	u32 org_value, bit_shift;
-
-	org_value = r8712_rf_reg_read(pAdapter, path, offset);
-	bit_shift = bitshift(bitmask);
-	return (org_value & bitmask) >> bit_shift;
-}
-
-static u8 set_rf_reg(struct _adapter *pAdapter, u8 path, u8 offset, u32 bitmask,
-	      u32 value)
-{
-	u32 org_value, bit_shift, new_value;
-
-	if (bitmask != bMaskDWord) {
-		org_value = r8712_rf_reg_read(pAdapter, path, offset);
-		bit_shift = bitshift(bitmask);
-		new_value = (org_value & (~bitmask)) | (value << bit_shift);
-	} else {
-		new_value = value;
-	}
-	return r8712_rf_reg_write(pAdapter, path, offset, new_value);
-}
-
-/*
- * SetChannel
- * Description
- *	Use H2C command to change channel,
- *	not only modify rf register, but also other setting need to be done.
- */
-void r8712_SetChannel(struct _adapter *pAdapter)
-{
-	struct cmd_priv *pcmdpriv = &pAdapter->cmdpriv;
-	struct cmd_obj *pcmd = NULL;
-	struct SetChannel_parm *pparm = NULL;
-	u16 code = GEN_CMD_CODE(_SetChannel);
-
-	pcmd = kmalloc(sizeof(*pcmd), GFP_ATOMIC);
-	if (!pcmd)
-		return;
-	pparm = kmalloc(sizeof(*pparm), GFP_ATOMIC);
-	if (!pparm) {
-		kfree(pcmd);
-		return;
-	}
-	pparm->curr_ch = pAdapter->mppriv.curr_ch;
-	init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code);
-	r8712_enqueue_cmd(pcmdpriv, pcmd);
-}
-
-static void SetCCKTxPower(struct _adapter *pAdapter, u8 TxPower)
-{
-	u16 TxAGC = 0;
-
-	TxAGC = TxPower;
-	set_bb_reg(pAdapter, rTxAGC_CCK_Mcs32, bTxAGCRateCCK, TxAGC);
-}
-
-static void SetOFDMTxPower(struct _adapter *pAdapter, u8 TxPower)
-{
-	u32 TxAGC = 0;
-
-	TxAGC |= ((TxPower << 24) | (TxPower << 16) | (TxPower << 8) |
-		  TxPower);
-	set_bb_reg(pAdapter, rTxAGC_Rate18_06, bTxAGCRate18_06, TxAGC);
-	set_bb_reg(pAdapter, rTxAGC_Rate54_24, bTxAGCRate54_24, TxAGC);
-	set_bb_reg(pAdapter, rTxAGC_Mcs03_Mcs00, bTxAGCRateMCS3_MCS0, TxAGC);
-	set_bb_reg(pAdapter, rTxAGC_Mcs07_Mcs04, bTxAGCRateMCS7_MCS4, TxAGC);
-	set_bb_reg(pAdapter, rTxAGC_Mcs11_Mcs08, bTxAGCRateMCS11_MCS8, TxAGC);
-	set_bb_reg(pAdapter, rTxAGC_Mcs15_Mcs12, bTxAGCRateMCS15_MCS12, TxAGC);
-}
-
-void r8712_SetTxPower(struct _adapter *pAdapter)
-{
-	u8 TxPower = pAdapter->mppriv.curr_txpoweridx;
-
-	SetCCKTxPower(pAdapter, TxPower);
-	SetOFDMTxPower(pAdapter, TxPower);
-}
-
-void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset)
-{
-	u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D, tmpAGC;
-
-	TxAGCOffset_B = ulTxAGCOffset & 0x000000ff;
-	TxAGCOffset_C = (ulTxAGCOffset & 0x0000ff00) >> 8;
-	TxAGCOffset_D = (ulTxAGCOffset & 0x00ff0000) >> 16;
-	tmpAGC = TxAGCOffset_D << 8 | TxAGCOffset_C << 4 | TxAGCOffset_B;
-	set_bb_reg(pAdapter, rFPGA0_TxGainStage,
-			(bXBTxAGC | bXCTxAGC | bXDTxAGC), tmpAGC);
-}
-
-void r8712_SetDataRate(struct _adapter *pAdapter)
-{
-	u8 path = RF_PATH_A;
-	u8 offset = RF_SYN_G2;
-	u32 value;
-
-	value = (pAdapter->mppriv.curr_rateidx < 4) ? 0x4440 : 0xF200;
-	r8712_rf_reg_write(pAdapter, path, offset, value);
-}
-
-void r8712_SwitchBandwidth(struct _adapter *pAdapter)
-{
-	/* 3 1.Set MAC register : BWOPMODE  bit2:1 20MhzBW */
-	u8 regBwOpMode = 0;
-	u8 Bandwidth = pAdapter->mppriv.curr_bandwidth;
-
-	regBwOpMode = r8712_read8(pAdapter, 0x10250203);
-	if (Bandwidth == HT_CHANNEL_WIDTH_20)
-		regBwOpMode |= BIT(2);
-	else
-		regBwOpMode &= ~(BIT(2));
-	r8712_write8(pAdapter, 0x10250203, regBwOpMode);
-	/* 3 2.Set PHY related register */
-	switch (Bandwidth) {
-	/* 20 MHz channel*/
-	case HT_CHANNEL_WIDTH_20:
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x0);
-		set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x0);
-		/* Use PHY_REG.txt default value. Do not need to change.
-		 * Correct the tx power for CCK rate in 40M.
-		 * It is set in Tx descriptor for 8192x series
-		 */
-		set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x58);
-		break;
-	/* 40 MHz channel*/
-	case HT_CHANNEL_WIDTH_40:
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bRFMOD, 0x1);
-		set_bb_reg(pAdapter, rFPGA1_RFMOD, bRFMOD, 0x1);
-		/* Use PHY_REG.txt default value. Do not need to change.
-		 * Correct the tx power for CCK rate in 40M.
-		 * Set Control channel to upper or lower. These settings are
-		 * required only for 40MHz
-		 */
-		set_bb_reg(pAdapter, rCCK0_System, bCCKSideBand,
-			   (HAL_PRIME_CHNL_OFFSET_DONT_CARE >> 1));
-		set_bb_reg(pAdapter, rOFDM1_LSTF, 0xC00,
-			   HAL_PRIME_CHNL_OFFSET_DONT_CARE);
-		set_bb_reg(pAdapter, rFPGA0_AnalogParameter2, bMaskDWord, 0x18);
-		break;
-	default:
-		break;
-	}
-
-	/* 3 3.Set RF related register */
-	switch (Bandwidth) {
-	case HT_CHANNEL_WIDTH_20:
-		set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW,
-			   BIT(10) | BIT(11), 0x01);
-		break;
-	case HT_CHANNEL_WIDTH_40:
-		set_rf_reg(pAdapter, RF_PATH_A, RF_CHNLBW,
-			   BIT(10) | BIT(11), 0x00);
-		break;
-	default:
-		break;
-	}
-}
-
-/*------------------------------Define structure----------------------------*/
-struct R_ANTENNA_SELECT_OFDM {
-	u32	r_tx_antenna:4;
-	u32	r_ant_l:4;
-	u32	r_ant_non_ht:4;
-	u32	r_ant_ht1:4;
-	u32	r_ant_ht2:4;
-	u32	r_ant_ht_s1:4;
-	u32	r_ant_non_ht_s1:4;
-	u32	OFDM_TXSC:2;
-	u32	Reserved:2;
-};
-
-struct R_ANTENNA_SELECT_CCK {
-	u8	r_cckrx_enable_2:2;
-	u8	r_cckrx_enable:2;
-	u8	r_ccktx_enable:4;
-};
-
-void r8712_SwitchAntenna(struct _adapter *pAdapter)
-{
-	u32	ofdm_tx_en_val = 0, ofdm_tx_ant_sel_val = 0;
-	u8	ofdm_rx_ant_sel_val = 0;
-	u8	cck_ant_select_val = 0;
-	u32	cck_ant_sel_val = 0;
-	struct R_ANTENNA_SELECT_CCK *p_cck_txrx;
-
-	p_cck_txrx = (struct R_ANTENNA_SELECT_CCK *)&cck_ant_select_val;
-
-	switch (pAdapter->mppriv.antenna_tx) {
-	case ANTENNA_A:
-		/* From SD3 Willis suggestion !!! Set RF A=TX and B as standby*/
-		set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
-		set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 1);
-		ofdm_tx_en_val = 0x3;
-		ofdm_tx_ant_sel_val = 0x11111111;/* Power save */
-		p_cck_txrx->r_ccktx_enable = 0x8;
-		break;
-	case ANTENNA_B:
-		set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 1);
-		set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
-		ofdm_tx_en_val = 0x3;
-		ofdm_tx_ant_sel_val = 0x22222222;/* Power save */
-		p_cck_txrx->r_ccktx_enable = 0x4;
-		break;
-	case ANTENNA_AB:	/* For 8192S */
-		set_bb_reg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
-		set_bb_reg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
-		ofdm_tx_en_val = 0x3;
-		ofdm_tx_ant_sel_val = 0x3321333; /* Disable Power save */
-		p_cck_txrx->r_ccktx_enable = 0xC;
-		break;
-	default:
-		break;
-	}
-	/*OFDM Tx*/
-	set_bb_reg(pAdapter, rFPGA1_TxInfo, 0xffffffff, ofdm_tx_ant_sel_val);
-	/*OFDM Tx*/
-	set_bb_reg(pAdapter, rFPGA0_TxInfo, 0x0000000f, ofdm_tx_en_val);
-	switch (pAdapter->mppriv.antenna_rx) {
-	case ANTENNA_A:
-		ofdm_rx_ant_sel_val = 0x1;	/* A */
-		p_cck_txrx->r_cckrx_enable = 0x0; /* default: A */
-		p_cck_txrx->r_cckrx_enable_2 = 0x0; /* option: A */
-		break;
-	case ANTENNA_B:
-		ofdm_rx_ant_sel_val = 0x2;	/* B */
-		p_cck_txrx->r_cckrx_enable = 0x1; /* default: B */
-		p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option: B */
-		break;
-	case ANTENNA_AB:
-		ofdm_rx_ant_sel_val = 0x3; /* AB */
-		p_cck_txrx->r_cckrx_enable = 0x0; /* default:A */
-		p_cck_txrx->r_cckrx_enable_2 = 0x1; /* option:B */
-		break;
-	default:
-		break;
-	}
-	/*OFDM Rx*/
-	set_bb_reg(pAdapter, rOFDM0_TRxPathEnable, 0x0000000f,
-		   ofdm_rx_ant_sel_val);
-	/*OFDM Rx*/
-	set_bb_reg(pAdapter, rOFDM1_TRxPathEnable, 0x0000000f,
-		   ofdm_rx_ant_sel_val);
-
-	cck_ant_sel_val = cck_ant_select_val;
-	/*CCK TxRx*/
-	set_bb_reg(pAdapter, rCCK0_AFESetting, bMaskByte3, cck_ant_sel_val);
-}
-
-static void TriggerRFThermalMeter(struct _adapter *pAdapter)
-{
-	/* 0x24: RF Reg[6:5] */
-	set_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, bRFRegOffsetMask, 0x60);
-}
-
-static u32 ReadRFThermalMeter(struct _adapter *pAdapter)
-{
-	/* 0x24: RF Reg[4:0] */
-	return get_rf_reg(pAdapter, RF_PATH_A, RF_T_METER, 0x1F);
-}
-
-void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value)
-{
-	TriggerRFThermalMeter(pAdapter);
-	msleep(1000);
-	*value = ReadRFThermalMeter(pAdapter);
-}
-
-void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart)
-{
-	if (bStart) { /* Start Single Carrier. */
-		/* 1. if OFDM block on? */
-		if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
-			/*set OFDM block on*/
-			set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
-		/* 2. set CCK test mode off, set to CCK normal mode */
-		set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
-		/* 3. turn on scramble setting */
-		set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
-		/* 4. Turn On Single Carrier Tx and off the other test modes. */
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bEnable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
-	} else { /* Stop Single Carrier.*/
-		/* Turn off all test modes.*/
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
-			   bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
-		msleep(20);
-		/*BB Reset*/
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
-	}
-}
-
-void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart)
-{
-	u8 rfPath;
-
-	switch (pAdapter->mppriv.antenna_tx) {
-	case ANTENNA_B:
-		rfPath = RF_PATH_B;
-		break;
-	case ANTENNA_A:
-	default:
-		rfPath = RF_PATH_A;
-		break;
-	}
-	if (bStart) { /* Start Single Tone.*/
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bDisable);
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bDisable);
-		set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask,
-			   0xd4000);
-		msleep(100);
-		/* PAD all on.*/
-		set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x2001f);
-		msleep(100);
-	} else { /* Stop Single Tone.*/
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);
-		set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
-		set_rf_reg(pAdapter, rfPath, RF_TX_G2, bRFRegOffsetMask,
-			   0x54000);
-		msleep(100);
-		/* PAD all on.*/
-		set_rf_reg(pAdapter, rfPath, RF_AC, bRFRegOffsetMask, 0x30000);
-		msleep(100);
-	}
-}
-
-void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart)
-{
-	if (bStart) { /* Start Carrier Suppression.*/
-		if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) {
-			/* 1. if CCK block on? */
-			if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) {
-				/*set CCK block on*/
-				set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn,
-					   bEnable);
-			}
-			/* Turn Off All Test Mode */
-			set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx,
-				   bDisable);
-			set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
-				   bDisable);
-			set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone,
-				   bDisable);
-			/*transmit mode*/
-			set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);
-			/*turn off scramble setting*/
-			set_bb_reg(pAdapter, rCCK0_System, bCCKScramble,
-				   bDisable);
-			/*Set CCK Tx Test Rate*/
-			/*Set FTxRate to 1Mbps*/
-			set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, 0x0);
-		}
-	} else { /* Stop Carrier Suppression. */
-		if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M) {
-			/*normal mode*/
-			set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);
-			/*turn on scramble setting*/
-			set_bb_reg(pAdapter, rCCK0_System, bCCKScramble,
-				   bEnable);
-			/*BB Reset*/
-			set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
-			set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
-		}
-	}
-}
-
-static void SetCCKContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
-	u32 cckrate;
-
-	if (bStart) {
-		/* 1. if CCK block on? */
-		if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn)) {
-			/*set CCK block on*/
-			set_bb_reg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);
-		}
-		/* Turn Off All Test Mode */
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
-		/*Set CCK Tx Test Rate*/
-		cckrate  = pAdapter->mppriv.curr_rateidx;
-		set_bb_reg(pAdapter, rCCK0_System, bCCKTxRate, cckrate);
-		/*transmit mode*/
-		set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);
-		/*turn on scramble setting*/
-		set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
-	} else {
-		/*normal mode*/
-		set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);
-		/*turn on scramble setting*/
-		set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
-		/*BB Reset*/
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
-	}
-} /* mpt_StartCckContTx */
-
-static void SetOFDMContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
-	if (bStart) {
-		/* 1. if OFDM block on? */
-		if (!get_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn)) {
-			/*set OFDM block on*/
-			set_bb_reg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);
-		}
-		/* 2. set CCK test mode off, set to CCK normal mode*/
-		set_bb_reg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
-		/* 3. turn on scramble setting */
-		set_bb_reg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
-		/* 4. Turn On Continue Tx and turn off the other test modes.*/
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bEnable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
-	} else {
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier,
-			   bDisable);
-		set_bb_reg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
-		msleep(20);
-		/*BB Reset*/
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
-		set_bb_reg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
-	}
-} /* mpt_StartOfdmContTx */
-
-void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart)
-{
-	/* ADC turn off [bit24-21] adc port0 ~ port1 */
-	if (bStart) {
-		r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA,
-				   r8712_bb_reg_read(pAdapter,
-				   rRx_Wait_CCCA) & 0xFE1FFFFF);
-		msleep(100);
-	}
-	if (pAdapter->mppriv.curr_rateidx <= MPT_RATE_11M)
-		SetCCKContinuousTx(pAdapter, bStart);
-	else if ((pAdapter->mppriv.curr_rateidx >= MPT_RATE_6M) &&
-		 (pAdapter->mppriv.curr_rateidx <= MPT_RATE_MCS15))
-		SetOFDMContinuousTx(pAdapter, bStart);
-	/* ADC turn on [bit24-21] adc port0 ~ port1 */
-	if (!bStart)
-		r8712_bb_reg_write(pAdapter, rRx_Wait_CCCA,
-				   r8712_bb_reg_read(pAdapter,
-				   rRx_Wait_CCCA) | 0x01E00000);
-}
-
-void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter)
-{
-	u32 i, phyrx_set = 0;
-
-	for (i = OFDM_PPDU_BIT; i <= HT_MPDU_FAIL_BIT; i++) {
-		phyrx_set = 0;
-		phyrx_set |= (i << 28);		/*select*/
-		phyrx_set |= 0x08000000;	/* set counter to zero*/
-		r8712_write32(pAdapter, RXERR_RPT, phyrx_set);
-	}
-}
-
-static u32 GetPhyRxPktCounts(struct _adapter *pAdapter, u32 selbit)
-{
-	/*selection*/
-	u32 phyrx_set = 0;
-	u32 SelectBit;
-
-	SelectBit = selbit << 28;
-	phyrx_set |= (SelectBit & 0xF0000000);
-	r8712_write32(pAdapter, RXERR_RPT, phyrx_set);
-	/*Read packet count*/
-	return r8712_read32(pAdapter, RXERR_RPT) & RPTMaxCount;
-}
-
-u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter)
-{
-	u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_OK_BIT);
-	u32 CCK_cnt  = GetPhyRxPktCounts(pAdapter, CCK_MPDU_OK_BIT);
-	u32 HT_cnt   = GetPhyRxPktCounts(pAdapter, HT_MPDU_OK_BIT);
-
-	return OFDM_cnt + CCK_cnt + HT_cnt;
-}
-
-u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter)
-{
-	u32 OFDM_cnt = GetPhyRxPktCounts(pAdapter, OFDM_MPDU_FAIL_BIT);
-	u32 CCK_cnt  = GetPhyRxPktCounts(pAdapter, CCK_MPDU_FAIL_BIT);
-	u32 HT_cnt   = GetPhyRxPktCounts(pAdapter, HT_MPDU_FAIL_BIT);
-
-	return OFDM_cnt + CCK_cnt + HT_cnt;
-}
--- a/drivers/staging/rtl8712/rtl871x_mp.h
+++ /dev/null
@@ -1,275 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_MP_H_
-#define __RTL871X_MP_H_
-
-#define MPT_NOOP			0
-#define MPT_READ_MAC_1BYTE		1
-#define MPT_READ_MAC_2BYTE		2
-#define MPT_READ_MAC_4BYTE		3
-#define MPT_WRITE_MAC_1BYTE		4
-#define MPT_WRITE_MAC_2BYTE		5
-#define MPT_WRITE_MAC_4BYTE		6
-#define MPT_READ_BB_CCK			7
-#define MPT_WRITE_BB_CCK		8
-#define MPT_READ_BB_OFDM		9
-#define MPT_WRITE_BB_OFDM		10
-#define MPT_READ_RF			11
-#define MPT_WRITE_RF			12
-#define MPT_READ_EEPROM_1BYTE		13
-#define MPT_WRITE_EEPROM_1BYTE		14
-#define MPT_READ_EEPROM_2BYTE		15
-#define MPT_WRITE_EEPROM_2BYTE		16
-#define MPT_SET_CSTHRESHOLD		21
-#define MPT_SET_INITGAIN		22
-#define MPT_SWITCH_BAND			23
-#define MPT_SWITCH_CHANNEL		24
-#define MPT_SET_DATARATE		25
-#define MPT_SWITCH_ANTENNA		26
-#define MPT_SET_TX_POWER		27
-#define MPT_SET_CONT_TX			28
-#define MPT_SET_SINGLE_CARRIER		29
-#define MPT_SET_CARRIER_SUPPRESSION	30
-#define MPT_GET_RATE_TABLE		31
-#define MPT_READ_TSSI			32
-#define MPT_GET_THERMAL_METER		33
-#define MAX_MP_XMITBUF_SZ	2048
-#define NR_MP_XMITFRAME		8
-
-struct mp_xmit_frame {
-	struct list_head list;
-	struct pkt_attrib attrib;
-	_pkt *pkt;
-	int frame_tag;
-	struct _adapter *padapter;
-	u8 *mem_addr;
-	u16 sz[8];
-	struct urb *pxmit_urb[8];
-	u8 bpending[8];
-	u8 last[8];
-};
-
-struct mp_wiparam {
-	u32 bcompleted;
-	u32 act_type;
-	u32 io_offset;
-	u32 io_value;
-};
-
-struct mp_priv {
-	struct _adapter *papdater;
-	/*OID cmd handler*/
-	struct mp_wiparam workparam;
-	u8 act_in_progress;
-	/*Tx Section*/
-	u8 TID;
-	u32 tx_pktcount;
-	/*Rx Section*/
-	u32 rx_pktcount;
-	u32 rx_crcerrpktcount;
-	u32 rx_pktloss;
-	struct recv_stat rxstat;
-	/*RF/BB relative*/
-	u32 curr_ch;
-	u32 curr_rateidx;
-	u8 curr_bandwidth;
-	u8 curr_modem;
-	u8 curr_txpoweridx;
-	u32 curr_crystalcap;
-	u16 antenna_tx;
-	u16 antenna_rx;
-	u8 curr_rfpath;
-	u8 check_mp_pkt;
-	uint ForcedDataRate;
-	struct wlan_network mp_network;
-	unsigned char network_macaddr[6];
-	/*Testing Flag*/
-	u32 mode;/*0 for normal type packet,
-		  * 1 for loopback packet (16bytes TXCMD)
-		  */
-	sint prev_fw_state;
-	u8 *pallocated_mp_xmitframe_buf;
-	u8 *pmp_xmtframe_buf;
-	struct  __queue free_mp_xmitqueue;
-	u32 free_mp_xmitframe_cnt;
-};
-
-struct IOCMD_STRUCT {
-	u8	cmdclass;
-	u16	value;
-	u8	index;
-};
-
-struct rf_reg_param {
-	u32 path;
-	u32 offset;
-	u32 value;
-};
-
-struct bb_reg_param {
-	u32 offset;
-	u32 value;
-};
-
-/* ======================================================================= */
-
-#define LOWER	true
-#define RAISE	false
-#define IOCMD_CTRL_REG			0x10250370
-#define IOCMD_DATA_REG			0x10250374
-#define IOCMD_GET_THERMAL_METER		0xFD000028
-#define IOCMD_CLASS_BB_RF		0xF0
-#define IOCMD_BB_READ_IDX		0x00
-#define IOCMD_BB_WRITE_IDX		0x01
-#define IOCMD_RF_READ_IDX		0x02
-#define IOCMD_RF_WRIT_IDX		0x03
-#define BB_REG_BASE_ADDR		0x800
-#define RF_PATH_A	0
-#define RF_PATH_B	1
-#define RF_PATH_C	2
-#define RF_PATH_D	3
-#define MAX_RF_PATH_NUMS	2
-#define _2MAC_MODE_	0
-#define _LOOPBOOK_MODE_	1
-
-/* MP set force data rate base on the definition. */
-enum {
-	/* CCK rate. */
-	MPT_RATE_1M,	/* 0 */
-	MPT_RATE_2M,
-	MPT_RATE_55M,
-	MPT_RATE_11M,	/* 3 */
-
-	/* OFDM rate. */
-	MPT_RATE_6M,	/* 4 */
-	MPT_RATE_9M,
-	MPT_RATE_12M,
-	MPT_RATE_18M,
-	MPT_RATE_24M,
-	MPT_RATE_36M,
-	MPT_RATE_48M,
-	MPT_RATE_54M,	/* 11 */
-
-	/* HT rate. */
-	MPT_RATE_MCS0,	/* 12 */
-	MPT_RATE_MCS1,
-	MPT_RATE_MCS2,
-	MPT_RATE_MCS3,
-	MPT_RATE_MCS4,
-	MPT_RATE_MCS5,
-	MPT_RATE_MCS6,
-	MPT_RATE_MCS7,	/* 19 */
-	MPT_RATE_MCS8,
-	MPT_RATE_MCS9,
-	MPT_RATE_MCS10,
-	MPT_RATE_MCS11,
-	MPT_RATE_MCS12,
-	MPT_RATE_MCS13,
-	MPT_RATE_MCS14,
-	MPT_RATE_MCS15,	/* 27 */
-	MPT_RATE_LAST
-};
-
-/* Represent Channel Width in HT Capabilities */
-enum HT_CHANNEL_WIDTH {
-	HT_CHANNEL_WIDTH_20 = 0,
-	HT_CHANNEL_WIDTH_40 = 1,
-};
-
-#define MAX_TX_PWR_INDEX_N_MODE 64	/* 0x3F */
-
-enum POWER_MODE {
-	POWER_LOW = 0,
-	POWER_NORMAL
-};
-
-#define RX_PKT_BROADCAST	1
-#define RX_PKT_DEST_ADDR	2
-#define RX_PKT_PHY_MATCH	3
-
-#define RPTMaxCount 0x000FFFFF
-
-/* parameter 1 : BitMask
- *	bit 0  : OFDM PPDU
- *	bit 1  : OFDM False Alarm
- *	bit 2  : OFDM MPDU OK
- *	bit 3  : OFDM MPDU Fail
- *	bit 4  : CCK PPDU
- *	bit 5  : CCK False Alarm
- *	bit 6  : CCK MPDU ok
- *	bit 7  : CCK MPDU fail
- *	bit 8  : HT PPDU counter
- *	bit 9  : HT false alarm
- *	bit 10 : HT MPDU total
- *	bit 11 : HT MPDU OK
- *	bit 12 : HT MPDU fail
- *	bit 15 : RX full drop
- */
-enum RXPHY_BITMASK {
-	OFDM_PPDU_BIT = 0,
-	OFDM_MPDU_OK_BIT,
-	OFDM_MPDU_FAIL_BIT,
-	CCK_PPDU_BIT,
-	CCK_MPDU_OK_BIT,
-	CCK_MPDU_FAIL_BIT,
-	HT_PPDU_BIT,
-	HT_MPDU_BIT,
-	HT_MPDU_OK_BIT,
-	HT_MPDU_FAIL_BIT,
-};
-
-enum ENCRY_CTRL_STATE {
-	HW_CONTROL,		/*hw encryption& decryption*/
-	SW_CONTROL,		/*sw encryption& decryption*/
-	HW_ENCRY_SW_DECRY,	/*hw encryption & sw decryption*/
-	SW_ENCRY_HW_DECRY	/*sw encryption & hw decryption*/
-};
-
-/* Bandwidth Offset */
-#define HAL_PRIME_CHNL_OFFSET_DONT_CARE	0
-#define HAL_PRIME_CHNL_OFFSET_LOWER	1
-#define HAL_PRIME_CHNL_OFFSET_UPPER	2
-/*=======================================================================*/
-void mp871xinit(struct _adapter *padapter);
-void mp871xdeinit(struct _adapter *padapter);
-u32 r8712_bb_reg_read(struct _adapter *Adapter, u16 offset);
-u8 r8712_bb_reg_write(struct _adapter *Adapter, u16 offset, u32 value);
-u32 r8712_rf_reg_read(struct _adapter *Adapter, u8 path, u8 offset);
-u8 r8712_rf_reg_write(struct _adapter *Adapter, u8 path,
-		      u8 offset, u32 value);
-u32 r8712_get_bb_reg(struct _adapter *Adapter, u16 offset, u32 bitmask);
-u8 r8712_set_bb_reg(struct _adapter *Adapter, u16 offset,
-		    u32 bitmask, u32 value);
-u32 r8712_get_rf_reg(struct _adapter *Adapter, u8 path, u8 offset,
-		     u32 bitmask);
-u8 r8712_set_rf_reg(struct _adapter *Adapter, u8 path, u8 offset,
-		    u32 bitmask, u32 value);
-
-void r8712_SetChannel(struct _adapter *pAdapter);
-void r8712_SetTxPower(struct _adapter *pAdapte);
-void r8712_SetTxAGCOffset(struct _adapter *pAdapter, u32 ulTxAGCOffset);
-void r8712_SetDataRate(struct _adapter *pAdapter);
-void r8712_SwitchBandwidth(struct _adapter *pAdapter);
-void r8712_SwitchAntenna(struct _adapter *pAdapter);
-void r8712_GetThermalMeter(struct _adapter *pAdapter, u32 *value);
-void r8712_SetContinuousTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetSingleCarrierTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetSingleToneTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_SetCarrierSuppressionTx(struct _adapter *pAdapter, u8 bStart);
-void r8712_ResetPhyRxPktCount(struct _adapter *pAdapter);
-u32 r8712_GetPhyRxPktReceived(struct _adapter *pAdapter);
-u32 r8712_GetPhyRxPktCRC32Error(struct _adapter *pAdapter);
-
-#endif /*__RTL871X_MP_H_*/
-
--- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.c
+++ /dev/null
@@ -1,883 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_mp_ioctl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#include <linux/rndis.h>
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mlme_osdep.h"
-#include "rtl871x_mp.h"
-#include "rtl871x_mp_ioctl.h"
-
-uint oid_null_function(struct oid_par_priv *poid_par_priv)
-{
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
-	uint status = RNDIS_STATUS_SUCCESS;
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid == SET_OID) {
-		if (poid_par_priv->information_buf_len >= sizeof(u8))
-			Adapter->registrypriv.wireless_mode =
-					*(u8 *)poid_par_priv->information_buf;
-		else
-			status = RNDIS_STATUS_INVALID_LENGTH;
-	} else if (poid_par_priv->type_of_oid == QUERY_OID) {
-		if (poid_par_priv->information_buf_len >= sizeof(u8)) {
-			*(u8 *)poid_par_priv->information_buf =
-					 Adapter->registrypriv.wireless_mode;
-			*poid_par_priv->bytes_rw =
-					poid_par_priv->information_buf_len;
-		} else {
-			status = RNDIS_STATUS_INVALID_LENGTH;
-		}
-	} else {
-		status = RNDIS_STATUS_NOT_ACCEPTED;
-	}
-	return status;
-}
-
-uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	struct bb_reg_param *pbbreg;
-	u16 offset;
-	u32 value;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
-	offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/
-	if (offset < BB_REG_BASE_ADDR)
-		offset |= BB_REG_BASE_ADDR;
-	value = pbbreg->value;
-	r8712_bb_reg_write(Adapter, offset, value);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	struct bb_reg_param *pbbreg;
-	u16 offset;
-	u32 value;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
-	offset = (u16)(pbbreg->offset) & 0xFFF; /*0ffset :0x800~0xfff*/
-	if (offset < BB_REG_BASE_ADDR)
-		offset |= BB_REG_BASE_ADDR;
-	value = r8712_bb_reg_read(Adapter, offset);
-	pbbreg->value = value;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	struct rf_reg_param *pbbreg;
-	u8 path;
-	u8 offset;
-	u32 value;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
-	path = (u8)pbbreg->path;
-	if (path > RF_PATH_B)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	offset = (u8)pbbreg->offset;
-	value = pbbreg->value;
-	r8712_rf_reg_write(Adapter, path, offset, value);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	struct rf_reg_param *pbbreg;
-	u8 path;
-	u8 offset;
-	u32 value;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
-	path = (u8)pbbreg->path;
-	if (path > RF_PATH_B) /* 1T2R  path_a /path_b */
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	offset = (u8)pbbreg->offset;
-	value = r8712_rf_reg_read(Adapter, path, offset);
-	pbbreg->value = value;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-/*This function initializes the DUT to the MP test mode*/
-static int mp_start_test(struct _adapter *padapter)
-{
-	struct mp_priv *pmppriv = &padapter->mppriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-	struct wlan_bssid_ex *bssid;
-	struct sta_info *psta;
-	unsigned long length;
-	unsigned long irqL;
-	int res = 0;
-
-	bssid = kzalloc(sizeof(*bssid), GFP_KERNEL);
-	if (!bssid)
-		return -ENOMEM;
-
-	/* 3 1. initialize a new struct wlan_bssid_ex */
-	memcpy(bssid->MacAddress, pmppriv->network_macaddr, ETH_ALEN);
-	bssid->Ssid.SsidLength = 16;
-	memcpy(bssid->Ssid.Ssid, (unsigned char *)"mp_pseudo_adhoc",
-		bssid->Ssid.SsidLength);
-	bssid->InfrastructureMode = Ndis802_11IBSS;
-	bssid->NetworkTypeInUse = Ndis802_11DS;
-	bssid->IELength = 0;
-	length = r8712_get_wlan_bssid_ex_sz(bssid);
-	if (length % 4) {
-		/*round up to multiple of 4 bytes.*/
-		bssid->Length = ((length >> 2) + 1) << 2;
-	} else {
-		bssid->Length = length;
-	}
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
-		goto end_of_mp_start_test;
-	/*init mp_start_test status*/
-	pmppriv->prev_fw_state = get_fwstate(pmlmepriv);
-	pmlmepriv->fw_state = WIFI_MP_STATE;
-	if (pmppriv->mode == _LOOPBOOK_MODE_)
-		set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); /*append txdesc*/
-	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
-	/* 3 2. create a new psta for mp driver */
-	/* clear psta in the cur_network, if any */
-	psta = r8712_get_stainfo(&padapter->stapriv,
-				 tgt_network->network.MacAddress);
-	if (psta)
-		r8712_free_stainfo(padapter, psta);
-	psta = r8712_alloc_stainfo(&padapter->stapriv, bssid->MacAddress);
-	if (!psta) {
-		res = -ENOMEM;
-		goto end_of_mp_start_test;
-	}
-	/* 3 3. join pseudo AdHoc */
-	tgt_network->join_res = 1;
-	tgt_network->aid = psta->aid = 1;
-	memcpy(&tgt_network->network, bssid, length);
-	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
-	r8712_os_indicate_connect(padapter);
-	/* Set to LINKED STATE for MP TRX Testing */
-	set_fwstate(pmlmepriv, _FW_LINKED);
-end_of_mp_start_test:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	kfree(bssid);
-	return res;
-}
-
-/*This function change the DUT from the MP test mode into normal mode */
-static int mp_stop_test(struct _adapter *padapter)
-{
-	struct mp_priv *pmppriv = &padapter->mppriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
-	struct sta_info *psta;
-	unsigned long irqL;
-
-	spin_lock_irqsave(&pmlmepriv->lock, irqL);
-	if (!check_fwstate(pmlmepriv, WIFI_MP_STATE))
-		goto end_of_mp_stop_test;
-	/* 3 1. disconnect pseudo AdHoc */
-	r8712_os_indicate_disconnect(padapter);
-	/* 3 2. clear psta used in mp test mode. */
-	psta = r8712_get_stainfo(&padapter->stapriv,
-				 tgt_network->network.MacAddress);
-	if (psta)
-		r8712_free_stainfo(padapter, psta);
-	/* 3 3. return to normal state (default:station mode) */
-	pmlmepriv->fw_state = pmppriv->prev_fw_state; /* WIFI_STATION_STATE;*/
-	/*flush the cur_network*/
-	memset(tgt_network, 0, sizeof(struct wlan_network));
-end_of_mp_stop_test:
-	spin_unlock_irqrestore(&pmlmepriv->lock, irqL);
-	return _SUCCESS;
-}
-
-uint oid_rt_pro_set_data_rate_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32 ratevalue;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	ratevalue = *((u32 *)poid_par_priv->information_buf);
-	if (ratevalue >= MPT_RATE_LAST)
-		return RNDIS_STATUS_INVALID_DATA;
-	Adapter->mppriv.curr_rateidx = ratevalue;
-	r8712_SetDataRate(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	uint status = RNDIS_STATUS_SUCCESS;
-	u32 mode;
-	u8 val8;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return  RNDIS_STATUS_NOT_ACCEPTED;
-	mode = *((u32 *)poid_par_priv->information_buf);
-	Adapter->mppriv.mode = mode;/* 1 for loopback*/
-	if (mp_start_test(Adapter))
-		status = RNDIS_STATUS_NOT_ACCEPTED;
-	r8712_write8(Adapter, MSR, 1); /* Link in ad hoc network, 0x1025004C */
-	r8712_write8(Adapter, RCR, 0); /* RCR : disable all pkt, 0x10250048 */
-	/* RCR disable Check BSSID, 0x1025004a */
-	r8712_write8(Adapter, RCR + 2, 0x57);
-	/* disable RX filter map , mgt frames will put in RX FIFO 0 */
-	r8712_write16(Adapter, RXFLTMAP0, 0x0);
-	val8 = r8712_read8(Adapter, EE_9346CR);
-	if (!(val8 & _9356SEL)) { /*boot from EFUSE*/
-		r8712_efuse_reg_init(Adapter);
-		r8712_efuse_change_max_size(Adapter);
-		r8712_efuse_reg_uninit(Adapter);
-	}
-	return status;
-}
-
-uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (mp_stop_test(Adapter) == _FAIL)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		Channel;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	Channel = *((u32 *)poid_par_priv->information_buf);
-	if (Channel > 14)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	Adapter->mppriv.curr_ch = Channel;
-	r8712_SetChannel(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32 antenna;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	antenna = *((u32 *)poid_par_priv->information_buf);
-	Adapter->mppriv.antenna_tx = (u16)((antenna & 0xFFFF0000) >> 16);
-	Adapter->mppriv.antenna_rx = (u16)(antenna & 0x0000FFFF);
-	r8712_SwitchAntenna(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32 tx_pwr_idx;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	tx_pwr_idx = *((u32 *)poid_par_priv->information_buf);
-	if (tx_pwr_idx > MAX_TX_PWR_INDEX_N_MODE)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	Adapter->mppriv.curr_txpoweridx = (u8)tx_pwr_idx;
-	r8712_SetTxPower(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	if (poid_par_priv->information_buf_len == sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-					Adapter->mppriv.tx_pktcount;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	if (poid_par_priv->information_buf_len == sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-					Adapter->mppriv.rx_pktcount;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	if (poid_par_priv->information_buf_len == sizeof(u32)) {
-		*(u32 *)poid_par_priv->information_buf =
-					Adapter->mppriv.rx_crcerrpktcount;
-		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	Adapter->mppriv.tx_pktcount = 0;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len == sizeof(u32)) {
-		Adapter->mppriv.rx_pktcount = 0;
-		Adapter->mppriv.rx_crcerrpktcount = 0;
-	} else {
-		return RNDIS_STATUS_INVALID_LENGTH;
-	}
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	r8712_ResetPhyRxPktCount(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	*(u32 *)poid_par_priv->information_buf =
-					 r8712_GetPhyRxPktReceived(Adapter);
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len != sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	*(u32 *)poid_par_priv->information_buf =
-					 r8712_GetPhyRxPktCRC32Error(Adapter);
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	Adapter->mppriv.curr_modem = *((u8 *)poid_par_priv->information_buf);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		bStartTest;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	bStartTest = *((u32 *)poid_par_priv->information_buf);
-	r8712_SetContinuousTx(Adapter, (u8)bStartTest);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		bStartTest;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	bStartTest = *((u32 *)poid_par_priv->information_buf);
-	r8712_SetSingleCarrierTx(Adapter, (u8)bStartTest);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		bStartTest;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	bStartTest = *((u32 *)poid_par_priv->information_buf);
-	r8712_SetCarrierSuppressionTx(Adapter, (u8)bStartTest);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		bStartTest;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	bStartTest = *((u32 *)poid_par_priv->information_buf);
-	r8712_SetSingleToneTx(Adapter, (u8)bStartTest);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	uint status = RNDIS_STATUS_SUCCESS;
-	struct mp_rw_reg *RegRWStruct;
-	u16		offset;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf;
-	if ((RegRWStruct->offset >= 0x10250800) &&
-	    (RegRWStruct->offset <= 0x10250FFF)) {
-		/*baseband register*/
-		/*0ffset :0x800~0xfff*/
-		offset = (u16)(RegRWStruct->offset) & 0xFFF;
-		RegRWStruct->value = r8712_bb_reg_read(Adapter, offset);
-	} else {
-		switch (RegRWStruct->width) {
-		case 1:
-			RegRWStruct->value = r8712_read8(Adapter,
-						   RegRWStruct->offset);
-			break;
-		case 2:
-			RegRWStruct->value = r8712_read16(Adapter,
-						    RegRWStruct->offset);
-			break;
-		case 4:
-			RegRWStruct->value = r8712_read32(Adapter,
-						    RegRWStruct->offset);
-			break;
-		default:
-			status = RNDIS_STATUS_NOT_ACCEPTED;
-			break;
-		}
-	}
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return status;
-}
-
-uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	uint status = RNDIS_STATUS_SUCCESS;
-	struct mp_rw_reg *RegRWStruct;
-	u16		offset;
-	u32		value;
-	u32 oldValue = 0;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	RegRWStruct = (struct mp_rw_reg *)poid_par_priv->information_buf;
-	if ((RegRWStruct->offset >= 0x10250800) &&
-	    (RegRWStruct->offset <= 0x10250FFF)) {
-		/*baseband register*/
-		offset = (u16)(RegRWStruct->offset) & 0xFFF;
-		value = RegRWStruct->value;
-		switch (RegRWStruct->width) {
-		case 1:
-			oldValue = r8712_bb_reg_read(Adapter, offset);
-			oldValue &= 0xFFFFFF00;
-			value &= 0x000000FF;
-			value |= oldValue;
-			break;
-		case 2:
-			oldValue = r8712_bb_reg_read(Adapter, offset);
-			oldValue &= 0xFFFF0000;
-			value &= 0x0000FFFF;
-			value |= oldValue;
-			break;
-		}
-		r8712_bb_reg_write(Adapter, offset, value);
-	} else {
-		switch (RegRWStruct->width) {
-		case 1:
-			r8712_write8(Adapter, RegRWStruct->offset,
-			       (unsigned char)RegRWStruct->value);
-			break;
-		case 2:
-			r8712_write16(Adapter, RegRWStruct->offset,
-				(unsigned short)RegRWStruct->value);
-			break;
-		case 4:
-			r8712_write32(Adapter, RegRWStruct->offset,
-				(unsigned int)RegRWStruct->value);
-			break;
-		default:
-			status = RNDIS_STATUS_NOT_ACCEPTED;
-			break;
-		}
-	}
-	return status;
-}
-
-uint oid_rt_get_thermal_meter_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	if (Adapter->mppriv.act_in_progress)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	if (poid_par_priv->information_buf_len < sizeof(u8))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	/*init workparam*/
-	Adapter->mppriv.act_in_progress = true;
-	Adapter->mppriv.workparam.bcompleted = false;
-	Adapter->mppriv.workparam.act_type = MPT_GET_THERMAL_METER;
-	Adapter->mppriv.workparam.io_offset = 0;
-	Adapter->mppriv.workparam.io_value = 0xFFFFFFFF;
-	r8712_GetThermalMeter(Adapter, &Adapter->mppriv.workparam.io_value);
-	Adapter->mppriv.workparam.bcompleted = true;
-	Adapter->mppriv.act_in_progress = false;
-	*(u32 *)poid_par_priv->information_buf =
-				 Adapter->mppriv.workparam.io_value;
-	*poid_par_priv->bytes_rw = sizeof(u32);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	uint status = RNDIS_STATUS_SUCCESS;
-
-	struct EFUSE_ACCESS_STRUCT *pefuse;
-	u8 *data;
-	u16 addr = 0, cnts = 0;
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len <
-	    sizeof(struct EFUSE_ACCESS_STRUCT))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf;
-	addr = pefuse->start_addr;
-	cnts = pefuse->cnts;
-	data = pefuse->data;
-	memset(data, 0xFF, cnts);
-	if ((addr > 511) || (cnts < 1) || (cnts > 512) || (addr + cnts) >
-	     EFUSE_MAX_SIZE)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (!r8712_efuse_access(Adapter, true, addr, cnts, data))
-		status = RNDIS_STATUS_FAILURE;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return status;
-}
-
-/*------------------------------------------------------------------------*/
-uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	uint status = RNDIS_STATUS_SUCCESS;
-
-	struct EFUSE_ACCESS_STRUCT *pefuse;
-	u8 *data;
-	u16 addr = 0, cnts = 0;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-
-	pefuse = (struct EFUSE_ACCESS_STRUCT *)poid_par_priv->information_buf;
-	addr = pefuse->start_addr;
-	cnts = pefuse->cnts;
-	data = pefuse->data;
-
-	if ((addr > 511) || (cnts < 1) || (cnts > 512) ||
-	    (addr + cnts) > r8712_efuse_get_max_size(Adapter))
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (!r8712_efuse_access(Adapter, false, addr, cnts, data))
-		status = RNDIS_STATUS_FAILURE;
-	return status;
-}
-
-/*----------------------------------------------------------------------*/
-
-uint oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(int))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	r8712_efuse_reg_init(Adapter);
-	*(int *)poid_par_priv->information_buf =
-				 r8712_efuse_get_current_size(Adapter);
-	r8712_efuse_reg_uninit(Adapter);
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	*(int *)poid_par_priv->information_buf =
-					 r8712_efuse_get_max_size(Adapter);
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv)
-{
-	uint status = RNDIS_STATUS_SUCCESS;
-
-	if (poid_par_priv->type_of_oid == QUERY_OID)
-		status = oid_rt_pro_read_efuse_hdl(poid_par_priv);
-	else
-		status = oid_rt_pro_write_efuse_hdl(poid_par_priv);
-	return status;
-}
-
-uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	uint status = RNDIS_STATUS_SUCCESS;
-	u8		*data;
-
-	*poid_par_priv->bytes_rw = 0;
-	if (poid_par_priv->information_buf_len < EFUSE_MAP_MAX_SIZE)
-		return RNDIS_STATUS_INVALID_LENGTH;
-	data = (u8 *)poid_par_priv->information_buf;
-	if (poid_par_priv->type_of_oid == QUERY_OID) {
-		if (r8712_efuse_map_read(Adapter, 0, EFUSE_MAP_MAX_SIZE, data))
-			*poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE;
-		else
-			status = RNDIS_STATUS_FAILURE;
-	} else {
-		/* SET_OID */
-		if (r8712_efuse_reg_init(Adapter)) {
-			if (r8712_efuse_map_write(Adapter, 0,
-			    EFUSE_MAP_MAX_SIZE, data))
-				*poid_par_priv->bytes_rw = EFUSE_MAP_MAX_SIZE;
-			else
-				status = RNDIS_STATUS_FAILURE;
-			r8712_efuse_reg_uninit(Adapter);
-		} else {
-			status = RNDIS_STATUS_FAILURE;
-		}
-	}
-	return status;
-}
-
-uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u32		bandwidth;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	bandwidth = *((u32 *)poid_par_priv->information_buf);/*4*/
-	if (bandwidth != HT_CHANNEL_WIDTH_20)
-		bandwidth = HT_CHANNEL_WIDTH_40;
-	Adapter->mppriv.curr_bandwidth = (u8)bandwidth;
-	r8712_SwitchBandwidth(Adapter);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-	u8		rx_pkt_type;
-	u32		rcr_val32;
-
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(u8))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	rx_pkt_type = *((u8 *)poid_par_priv->information_buf);/*4*/
-	rcr_val32 = r8712_read32(Adapter, RCR);/*RCR = 0x10250048*/
-	rcr_val32 &= ~(RCR_CBSSID | RCR_AB | RCR_AM | RCR_APM | RCR_AAP);
-	switch (rx_pkt_type) {
-	case RX_PKT_BROADCAST:
-		rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32);
-		break;
-	case RX_PKT_DEST_ADDR:
-		rcr_val32 |= (RCR_AB | RCR_AM | RCR_APM | RCR_AAP | RCR_ACRC32);
-		break;
-	case RX_PKT_PHY_MATCH:
-		rcr_val32 |= (RCR_APM | RCR_ACRC32);
-		break;
-	default:
-		rcr_val32 &= ~(RCR_AAP |
-			       RCR_APM |
-			       RCR_AM |
-			       RCR_AB |
-			       RCR_ACRC32);
-		break;
-	}
-	if (rx_pkt_type == RX_PKT_DEST_ADDR)
-		Adapter->mppriv.check_mp_pkt = 1;
-	else
-		Adapter->mppriv.check_mp_pkt = 0;
-	r8712_write32(Adapter, RCR, rcr_val32);
-	return RNDIS_STATUS_SUCCESS;
-}
-
-/*--------------------------------------------------------------------------*/
-/*Linux*/
-unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
-{
-	return _SUCCESS;
-}
-
-/*-------------------------------------------------------------------------*/
-uint oid_rt_set_power_down_hdl(struct oid_par_priv *poid_par_priv)
-{
-	if (poid_par_priv->type_of_oid != SET_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	/*CALL  the power_down function*/
-	return RNDIS_STATUS_SUCCESS;
-}
-
-/*-------------------------------------------------------------------------- */
-uint oid_rt_get_power_mode_hdl(struct oid_par_priv *poid_par_priv)
-{
-	struct _adapter *Adapter = (struct _adapter *)
-				   (poid_par_priv->adapter_context);
-
-	if (poid_par_priv->type_of_oid != QUERY_OID)
-		return RNDIS_STATUS_NOT_ACCEPTED;
-	if (poid_par_priv->information_buf_len < sizeof(u32))
-		return RNDIS_STATUS_INVALID_LENGTH;
-	*(int *)poid_par_priv->information_buf =
-		 Adapter->registrypriv.low_power ? POWER_LOW : POWER_NORMAL;
-	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
-	return RNDIS_STATUS_SUCCESS;
-}
--- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h
+++ /dev/null
@@ -1,328 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_MP_IOCTL_H
-#define _RTL871X_MP_IOCTL_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "mp_custom_oid.h"
-#include "rtl871x_ioctl.h"
-#include "rtl871x_ioctl_rtl.h"
-#include "rtl8712_efuse.h"
-
-#define TESTFWCMDNUMBER			1000000
-#define TEST_H2CINT_WAIT_TIME		500
-#define TEST_C2HINT_WAIT_TIME		500
-#define HCI_TEST_SYSCFG_HWMASK		1
-#define _BUSCLK_40M			(4 << 2)
-
-struct CFG_DBG_MSG_STRUCT {
-	u32 DebugLevel;
-	u32 DebugComponent_H32;
-	u32 DebugComponent_L32;
-};
-
-struct mp_rw_reg {
-	uint offset;
-	uint width;
-	u32 value;
-};
-
-/* for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM */
-struct eeprom_rw_param {
-	uint offset;
-	u16 value;
-};
-
-struct EFUSE_ACCESS_STRUCT {
-	u16	start_addr;
-	u16	cnts;
-	u8	data[];
-};
-
-struct burst_rw_reg {
-	uint offset;
-	uint len;
-	u8 Data[256];
-};
-
-struct usb_vendor_req {
-	u8	bRequest;
-	u16	wValue;
-	u16	wIndex;
-	u16	wLength;
-	u8	u8Dir;/*0:OUT, 1:IN */
-	u8	u8InData;
-};
-
-struct DR_VARIABLE_STRUCT {
-	u8 offset;
-	u32 variable;
-};
-
-/* oid_rtl_seg_87_11_00 */
-uint oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_80_00 */
-uint oid_rt_pro_set_data_rate_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_channel_direct_call_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_antenna_bb_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_tx_power_control_hdl(
-				struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_80_20 */
-uint oid_rt_pro_query_tx_packet_sent_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_query_rx_packet_received_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_query_rx_packet_crc32_error_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_reset_tx_packet_sent_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_reset_rx_packet_received_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_modulation_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_continuous_tx_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_single_carrier_tx_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_carrier_suppression_tx_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_set_single_tone_tx_hdl(
-				struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_87 */
-uint oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv);
-/* oid_rtl_seg_81_85 */
-uint oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_efuse_current_size_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_thermal_meter_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_reset_phy_rx_packet_count_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_phy_rx_packet_received_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_phy_rx_packet_crc32_error_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_set_power_down_hdl(
-				struct oid_par_priv *poid_par_priv);
-uint oid_rt_get_power_mode_hdl(
-				struct oid_par_priv *poid_par_priv);
-#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */
-/* This ifdef _MUST_ be left in!! */
-
-#else /* _RTL871X_MP_IOCTL_C_ */
-extern struct oid_obj_priv oid_rtl_seg_81_87[5];
-extern struct oid_obj_priv oid_rtl_seg_87_11_00[32];
-extern struct oid_obj_priv oid_rtl_seg_87_11_20[5];
-extern struct oid_obj_priv oid_rtl_seg_87_11_50[2];
-extern struct oid_obj_priv oid_rtl_seg_87_11_80[1];
-extern struct oid_obj_priv oid_rtl_seg_87_11_B0[1];
-extern struct oid_obj_priv oid_rtl_seg_87_11_F0[16];
-extern struct oid_obj_priv oid_rtl_seg_87_12_00[32];
-
-#endif /* _RTL871X_MP_IOCTL_C_ */
-
-enum MP_MODE {
-	MP_START_MODE,
-	MP_STOP_MODE,
-	MP_ERR_MODE
-};
-
-struct rwreg_param {
-	unsigned int offset;
-	unsigned int width;
-	unsigned int value;
-};
-
-struct bbreg_param {
-	unsigned int offset;
-	unsigned int phymask;
-	unsigned int value;
-};
-
-struct txpower_param {
-	unsigned int pwr_index;
-};
-
-struct datarate_param {
-	unsigned int rate_index;
-};
-
-struct rfintfs_parm {
-	unsigned int rfintfs;
-};
-
-struct mp_xmit_packet {
-	unsigned int len;
-};
-
-struct psmode_param {
-	unsigned int ps_mode;
-	unsigned int smart_ps;
-};
-
-struct mp_ioctl_handler {
-	unsigned int paramsize;
-	unsigned int (*handler)(struct oid_par_priv *poid_par_priv);
-	unsigned int oid;
-};
-
-struct mp_ioctl_param {
-	unsigned int subcode;
-	unsigned int len;
-	unsigned char data[];
-};
-
-#define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_
-
-enum RTL871X_MP_IOCTL_SUBCODE {
-	GEN_MP_IOCTL_SUBCODE(MP_START),			/*0*/
-	GEN_MP_IOCTL_SUBCODE(MP_STOP),			/*1*/
-	GEN_MP_IOCTL_SUBCODE(READ_REG),			/*2*/
-	GEN_MP_IOCTL_SUBCODE(WRITE_REG),
-	GEN_MP_IOCTL_SUBCODE(SET_CHANNEL),		/*4*/
-	GEN_MP_IOCTL_SUBCODE(SET_TXPOWER),		/*5*/
-	GEN_MP_IOCTL_SUBCODE(SET_DATARATE),		/*6*/
-	GEN_MP_IOCTL_SUBCODE(READ_BB_REG),		/*7*/
-	GEN_MP_IOCTL_SUBCODE(WRITE_BB_REG),
-	GEN_MP_IOCTL_SUBCODE(READ_RF_REG),		/*9*/
-	GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG),
-	GEN_MP_IOCTL_SUBCODE(SET_RF_INTFS),
-	GEN_MP_IOCTL_SUBCODE(IOCTL_XMIT_PACKET),	/*12*/
-	GEN_MP_IOCTL_SUBCODE(PS_STATE),			/*13*/
-	GEN_MP_IOCTL_SUBCODE(READ16_EEPROM),		/*14*/
-	GEN_MP_IOCTL_SUBCODE(WRITE16_EEPROM),		/*15*/
-	GEN_MP_IOCTL_SUBCODE(SET_PTM),			/*16*/
-	GEN_MP_IOCTL_SUBCODE(READ_TSSI),		/*17*/
-	GEN_MP_IOCTL_SUBCODE(CNTU_TX),			/*18*/
-	GEN_MP_IOCTL_SUBCODE(SET_BANDWIDTH),		/*19*/
-	GEN_MP_IOCTL_SUBCODE(SET_RX_PKT_TYPE),		/*20*/
-	GEN_MP_IOCTL_SUBCODE(RESET_PHY_RX_PKT_CNT),	/*21*/
-	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_RECV),	/*22*/
-	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_ERROR),	/*23*/
-	GEN_MP_IOCTL_SUBCODE(SET_POWER_DOWN),		/*24*/
-	GEN_MP_IOCTL_SUBCODE(GET_THERMAL_METER),	/*25*/
-	GEN_MP_IOCTL_SUBCODE(GET_POWER_MODE),		/*26*/
-	GEN_MP_IOCTL_SUBCODE(EFUSE),			/*27*/
-	GEN_MP_IOCTL_SUBCODE(EFUSE_MAP),		/*28*/
-	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_MAX_SIZE),	/*29*/
-	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_CURRENT_SIZE),	/*30*/
-	GEN_MP_IOCTL_SUBCODE(SC_TX),			/*31*/
-	GEN_MP_IOCTL_SUBCODE(CS_TX),			/*32*/
-	GEN_MP_IOCTL_SUBCODE(ST_TX),			/*33*/
-	GEN_MP_IOCTL_SUBCODE(SET_ANTENNA),		/*34*/
-	MAX_MP_IOCTL_SUBCODE,
-};
-
-unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv);
-
-#ifdef _RTL871X_MP_IOCTL_C_ /* CAUTION!!! */
-/* This ifdef _MUST_ be left in!! */
-
-static struct mp_ioctl_handler mp_ioctl_hdl[] = {
-	{sizeof(u32), oid_rt_pro_start_test_hdl,
-			     OID_RT_PRO_START_TEST},/*0*/
-	{sizeof(u32), oid_rt_pro_stop_test_hdl,
-			     OID_RT_PRO_STOP_TEST},/*1*/
-	{sizeof(struct rwreg_param),
-			     oid_rt_pro_read_register_hdl,
-			     OID_RT_PRO_READ_REGISTER},/*2*/
-	{sizeof(struct rwreg_param),
-			     oid_rt_pro_write_register_hdl,
-			     OID_RT_PRO_WRITE_REGISTER},
-	{sizeof(u32),
-			     oid_rt_pro_set_channel_direct_call_hdl,
-			     OID_RT_PRO_SET_CHANNEL_DIRECT_CALL},
-	{sizeof(struct txpower_param),
-			     oid_rt_pro_set_tx_power_control_hdl,
-			     OID_RT_PRO_SET_TX_POWER_CONTROL},
-	{sizeof(u32),
-			     oid_rt_pro_set_data_rate_hdl,
-			     OID_RT_PRO_SET_DATA_RATE},
-	{sizeof(struct bb_reg_param),
-			     oid_rt_pro_read_bb_reg_hdl,
-			     OID_RT_PRO_READ_BB_REG},/*7*/
-	{sizeof(struct bb_reg_param),
-			     oid_rt_pro_write_bb_reg_hdl,
-			     OID_RT_PRO_WRITE_BB_REG},
-	{sizeof(struct rwreg_param),
-			     oid_rt_pro_read_rf_reg_hdl,
-			     OID_RT_PRO_RF_READ_REGISTRY},/*9*/
-	{sizeof(struct rwreg_param),
-			     oid_rt_pro_write_rf_reg_hdl,
-			     OID_RT_PRO_RF_WRITE_REGISTRY},
-	{sizeof(struct rfintfs_parm), NULL, 0},
-	{0, mp_ioctl_xmit_packet_hdl, 0},/*12*/
-	{sizeof(struct psmode_param), NULL, 0},/*13*/
-	{sizeof(struct eeprom_rw_param), NULL, 0},/*14*/
-	{sizeof(struct eeprom_rw_param), NULL, 0},/*15*/
-	{sizeof(unsigned char), NULL, 0},/*16*/
-	{sizeof(u32), NULL, 0},/*17*/
-	{sizeof(u32), oid_rt_pro_set_continuous_tx_hdl,
-			     OID_RT_PRO_SET_CONTINUOUS_TX},/*18*/
-	{sizeof(u32), oid_rt_set_bandwidth_hdl,
-			     OID_RT_SET_BANDWIDTH},/*19*/
-	{sizeof(u32), oid_rt_set_rx_packet_type_hdl,
-			     OID_RT_SET_RX_PACKET_TYPE},/*20*/
-	{0, oid_rt_reset_phy_rx_packet_count_hdl,
-			     OID_RT_RESET_PHY_RX_PACKET_COUNT},/*21*/
-	{sizeof(u32), oid_rt_get_phy_rx_packet_received_hdl,
-			     OID_RT_GET_PHY_RX_PACKET_RECEIVED},/*22*/
-	{sizeof(u32), oid_rt_get_phy_rx_packet_crc32_error_hdl,
-			     OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR},/*23*/
-	{sizeof(unsigned char), oid_rt_set_power_down_hdl,
-			     OID_RT_SET_POWER_DOWN},/*24*/
-	{sizeof(u32), oid_rt_get_thermal_meter_hdl,
-			     OID_RT_PRO_GET_THERMAL_METER},/*25*/
-	{sizeof(u32), oid_rt_get_power_mode_hdl,
-			     OID_RT_GET_POWER_MODE},/*26*/
-	{sizeof(struct EFUSE_ACCESS_STRUCT),
-			     oid_rt_pro_efuse_hdl, OID_RT_PRO_EFUSE},/*27*/
-	{EFUSE_MAP_MAX_SIZE, oid_rt_pro_efuse_map_hdl,
-			     OID_RT_PRO_EFUSE_MAP},/*28*/
-	{sizeof(u32), oid_rt_get_efuse_max_size_hdl,
-			     OID_RT_GET_EFUSE_MAX_SIZE},/*29*/
-	{sizeof(u32), oid_rt_get_efuse_current_size_hdl,
-			     OID_RT_GET_EFUSE_CURRENT_SIZE},/*30*/
-	{sizeof(u32), oid_rt_pro_set_single_carrier_tx_hdl,
-			     OID_RT_PRO_SET_SINGLE_CARRIER_TX},/*31*/
-	{sizeof(u32), oid_rt_pro_set_carrier_suppression_tx_hdl,
-			     OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX},/*32*/
-	{sizeof(u32), oid_rt_pro_set_single_tone_tx_hdl,
-			     OID_RT_PRO_SET_SINGLE_TONE_TX},/*33*/
-	{sizeof(u32), oid_rt_pro_set_antenna_bb_hdl,
-			     OID_RT_PRO_SET_ANTENNA_BB},/*34*/
-};
-
-#else /* _RTL871X_MP_IOCTL_C_ */
-extern struct mp_ioctl_handler mp_ioctl_hdl[];
-#endif /* _RTL871X_MP_IOCTL_C_ */
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_mp_phy_regdef.h
+++ /dev/null
@@ -1,1034 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*****************************************************************************
- *	Copyright(c) 2008,  RealTEK Technology Inc. All Right Reserved.
- *
- * Module:	__INC_HAL8192SPHYREG_H
- *
- *
- * Note:	1. Define PMAC/BB register map
- *			2. Define RF register map
- *			3. PMAC/BB register bit mask.
- *			4. RF reg bit mask.
- *			5. Other BB/RF relative definition.
- *
- *
- * Export:	Constants, macro, functions(API), global variables(None).
- *
- * Abbrev:
- *
- * History:
- *	Data			Who		Remark
- *	08/07/2007	MHC		1. Porting from 9x series PHYCFG.h.
- *						2. Reorganize code architecture.
- *	09/25/2008	MH		1. Add RL6052 register definition
- *
- *****************************************************************************/
-#ifndef __RTL871X_MP_PHY_REGDEF_H
-#define __RTL871X_MP_PHY_REGDEF_H
-
-/*--------------------------Define Parameters-------------------------------*/
-
-/*============================================================
- *       8192S Register offset definition
- *============================================================
- *
- *
- * BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
- * 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
- * 3. RF register 0x00-2E
- * 4. Bit Mask for BB/RF register
- * 5. Other definition for BB/RF R/W
- *
- * 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
- * 1. Page1(0x100)
- */
-#define	rPMAC_Reset			0x100
-#define	rPMAC_TxStart			0x104
-#define	rPMAC_TxLegacySIG		0x108
-#define	rPMAC_TxHTSIG1			0x10c
-#define	rPMAC_TxHTSIG2			0x110
-#define	rPMAC_PHYDebug			0x114
-#define	rPMAC_TxPacketNum		0x118
-#define	rPMAC_TxIdle			0x11c
-#define	rPMAC_TxMACHeader0		0x120
-#define	rPMAC_TxMACHeader1		0x124
-#define	rPMAC_TxMACHeader2		0x128
-#define	rPMAC_TxMACHeader3		0x12c
-#define	rPMAC_TxMACHeader4		0x130
-#define	rPMAC_TxMACHeader5		0x134
-#define	rPMAC_TxDataType		0x138
-#define	rPMAC_TxRandomSeed		0x13c
-#define	rPMAC_CCKPLCPPreamble		0x140
-#define	rPMAC_CCKPLCPHeader		0x144
-#define	rPMAC_CCKCRC16			0x148
-#define	rPMAC_OFDMRxCRC32OK		0x170
-#define	rPMAC_OFDMRxCRC32Er		0x174
-#define	rPMAC_OFDMRxParityEr		0x178
-#define	rPMAC_OFDMRxCRC8Er		0x17c
-#define	rPMAC_CCKCRxRC16Er		0x180
-#define	rPMAC_CCKCRxRC32Er		0x184
-#define	rPMAC_CCKCRxRC32OK		0x188
-#define	rPMAC_TxStatus			0x18c
-
-/*
- * 2. Page2(0x200)
- *
- * The following two definition are only used for USB interface.
- *#define RF_BB_CMD_ADDR	0x02c0	// RF/BB read/write command address.
- *#define RF_BB_CMD_DATA	0x02c4	// RF/BB read/write command data.
- *
- *
- * 3. Page8(0x800)
- */
-#define	rFPGA0_RFMOD			0x800	/*RF mode & CCK TxSC RF
-						 * BW Setting??
-						 */
-#define	rFPGA0_TxInfo			0x804	/* Status report?? */
-#define	rFPGA0_PSDFunction		0x808
-#define	rFPGA0_TxGainStage		0x80c	/* Set TX PWR init gain? */
-#define	rFPGA0_RFTiming1		0x810	/* Useless now */
-#define	rFPGA0_RFTiming2		0x814
-#define	rFPGA0_XA_HSSIParameter1	0x820	/* RF 3 wire register */
-#define	rFPGA0_XA_HSSIParameter2	0x824
-#define	rFPGA0_XB_HSSIParameter1	0x828
-#define	rFPGA0_XB_HSSIParameter2	0x82c
-#define	rFPGA0_XC_HSSIParameter1	0x830
-#define	rFPGA0_XC_HSSIParameter2	0x834
-#define	rFPGA0_XD_HSSIParameter1	0x838
-#define	rFPGA0_XD_HSSIParameter2	0x83c
-#define	rFPGA0_XA_LSSIParameter		0x840
-#define	rFPGA0_XB_LSSIParameter		0x844
-#define	rFPGA0_XC_LSSIParameter		0x848
-#define	rFPGA0_XD_LSSIParameter		0x84c
-
-#define	rFPGA0_RFWakeUpParameter	0x850	/* Useless now */
-#define	rFPGA0_RFSleepUpParameter	0x854
-
-#define	rFPGA0_XAB_SwitchControl	0x858	/* RF Channel switch */
-#define	rFPGA0_XCD_SwitchControl	0x85c
-
-#define	rFPGA0_XA_RFInterfaceOE		0x860	/* RF Channel switch */
-#define	rFPGA0_XB_RFInterfaceOE		0x864
-#define	rFPGA0_XC_RFInterfaceOE		0x868
-#define	rFPGA0_XD_RFInterfaceOE		0x86c
-#define	rFPGA0_XAB_RFInterfaceSW	0x870	/* RF Interface Software Ctrl */
-#define	rFPGA0_XCD_RFInterfaceSW	0x874
-
-#define	rFPGA0_XAB_RFParameter		0x878	/* RF Parameter */
-#define	rFPGA0_XCD_RFParameter		0x87c
-
-#define	rFPGA0_AnalogParameter1		0x880	/* Crystal cap setting
-						 * RF-R/W protection
-						 * for parameter4??
-						 */
-#define	rFPGA0_AnalogParameter2		0x884
-#define	rFPGA0_AnalogParameter3		0x888	/* Useless now */
-#define	rFPGA0_AnalogParameter4		0x88c
-
-#define	rFPGA0_XA_LSSIReadBack		0x8a0	/* Tranceiver LSSI Readback */
-#define	rFPGA0_XB_LSSIReadBack		0x8a4
-#define	rFPGA0_XC_LSSIReadBack		0x8a8
-#define	rFPGA0_XD_LSSIReadBack		0x8ac
-
-#define	rFPGA0_PSDReport		0x8b4	/* Useless now */
-#define	rFPGA0_XAB_RFInterfaceRB	0x8e0	/* Useless now */
-#define	rFPGA0_XCD_RFInterfaceRB	0x8e4	/* Useless now */
-
-/*
- * 4. Page9(0x900)
- */
-#define	rFPGA1_RFMOD			0x900	/* RF mode & OFDM TxSC */
-
-#define	rFPGA1_TxBlock			0x904	/* Useless now */
-#define	rFPGA1_DebugSelect		0x908	/* Useless now */
-#define	rFPGA1_TxInfo			0x90c	/* Useless now */
-
-/*
- * 5. PageA(0xA00)
- *
- * Set Control channel to upper or lower.
- * These settings are required only for 40MHz
- */
-#define	rCCK0_System			0xa00
-
-#define	rCCK0_AFESetting		0xa04	/* Disable init gain now */
-#define	rCCK0_CCA			0xa08	/* Disable init gain now */
-
-#define	rCCK0_RxAGC1			0xa0c
-/* AGC default value, saturation level
- * Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now.
- * Not the same as 90 series
- */
-#define	rCCK0_RxAGC2			0xa10	/* AGC & DAGC */
-
-#define	rCCK0_RxHP			0xa14
-
-#define	rCCK0_DSPParameter1		0xa18	/* Timing recovery & Channel
-						 * estimation threshold
-						 */
-#define	rCCK0_DSPParameter2		0xa1c	/* SQ threshold */
-
-#define	rCCK0_TxFilter1			0xa20
-#define	rCCK0_TxFilter2			0xa24
-#define	rCCK0_DebugPort			0xa28	/* debug port and Tx filter3 */
-#define	rCCK0_FalseAlarmReport		0xa2c	/* 0xa2d useless now 0xa30-a4f
-						 * channel report
-						 */
-#define	rCCK0_TRSSIReport		0xa50
-#define	rCCK0_RxReport			0xa54   /* 0xa57 */
-#define	rCCK0_FACounterLower		0xa5c   /* 0xa5b */
-#define	rCCK0_FACounterUpper		0xa58   /* 0xa5c */
-
-/*
- * 6. PageC(0xC00)
- */
-#define	rOFDM0_LSTF			0xc00
-#define	rOFDM0_TRxPathEnable		0xc04
-#define	rOFDM0_TRMuxPar			0xc08
-#define	rOFDM0_TRSWIsolation		0xc0c
-
-/*RxIQ DC offset, Rx digital filter, DC notch filter */
-#define	rOFDM0_XARxAFE			0xc10
-#define	rOFDM0_XARxIQImbalance		0xc14  /* RxIQ imbalance matrix */
-#define	rOFDM0_XBRxAFE			0xc18
-#define	rOFDM0_XBRxIQImbalance		0xc1c
-#define	rOFDM0_XCRxAFE			0xc20
-#define	rOFDM0_XCRxIQImbalance		0xc24
-#define	rOFDM0_XDRxAFE			0xc28
-#define	rOFDM0_XDRxIQImbalance		0xc2c
-
-#define	rOFDM0_RxDetector1		0xc30  /* PD,BW & SBD DM tune
-						* init gain
-						*/
-#define	rOFDM0_RxDetector2		0xc34  /* SBD & Fame Sync. */
-#define	rOFDM0_RxDetector3		0xc38  /* Frame Sync. */
-#define	rOFDM0_RxDetector4		0xc3c  /* PD, SBD, Frame Sync &
-						* Short-GI
-						*/
-
-#define	rOFDM0_RxDSP			0xc40  /* Rx Sync Path */
-#define	rOFDM0_CFOandDAGC		0xc44  /* CFO & DAGC */
-#define	rOFDM0_CCADropThreshold		0xc48 /* CCA Drop threshold */
-#define	rOFDM0_ECCAThreshold		0xc4c /* energy CCA */
-
-#define	rOFDM0_XAAGCCore1		0xc50	/* DIG */
-#define	rOFDM0_XAAGCCore2		0xc54
-#define	rOFDM0_XBAGCCore1		0xc58
-#define	rOFDM0_XBAGCCore2		0xc5c
-#define	rOFDM0_XCAGCCore1		0xc60
-#define	rOFDM0_XCAGCCore2		0xc64
-#define	rOFDM0_XDAGCCore1		0xc68
-#define	rOFDM0_XDAGCCore2		0xc6c
-#define	rOFDM0_AGCParameter1		0xc70
-#define	rOFDM0_AGCParameter2		0xc74
-#define	rOFDM0_AGCRSSITable		0xc78
-#define	rOFDM0_HTSTFAGC			0xc7c
-
-#define	rOFDM0_XATxIQImbalance		0xc80	/* TX PWR TRACK and DIG */
-#define	rOFDM0_XATxAFE			0xc84
-#define	rOFDM0_XBTxIQImbalance		0xc88
-#define	rOFDM0_XBTxAFE			0xc8c
-#define	rOFDM0_XCTxIQImbalance		0xc90
-#define	rOFDM0_XCTxAFE			0xc94
-#define	rOFDM0_XDTxIQImbalance		0xc98
-#define	rOFDM0_XDTxAFE			0xc9c
-
-#define	rOFDM0_RxHPParameter		0xce0
-#define	rOFDM0_TxPseudoNoiseWgt		0xce4
-#define	rOFDM0_FrameSync		0xcf0
-#define	rOFDM0_DFSReport		0xcf4
-#define	rOFDM0_TxCoeff1			0xca4
-#define	rOFDM0_TxCoeff2			0xca8
-#define	rOFDM0_TxCoeff3			0xcac
-#define	rOFDM0_TxCoeff4			0xcb0
-#define	rOFDM0_TxCoeff5			0xcb4
-#define	rOFDM0_TxCoeff6			0xcb8
-
-/*
- * 7. PageD(0xD00)
- */
-#define	rOFDM1_LSTF			0xd00
-#define	rOFDM1_TRxPathEnable		0xd04
-
-#define	rOFDM1_CFO			0xd08	/* No setting now */
-#define	rOFDM1_CSI1			0xd10
-#define	rOFDM1_SBD			0xd14
-#define	rOFDM1_CSI2			0xd18
-#define	rOFDM1_CFOTracking		0xd2c
-#define	rOFDM1_TRxMesaure1		0xd34
-#define	rOFDM1_IntfDet			0xd3c
-#define	rOFDM1_PseudoNoiseStateAB	0xd50
-#define	rOFDM1_PseudoNoiseStateCD	0xd54
-#define	rOFDM1_RxPseudoNoiseWgt		0xd58
-
-#define	rOFDM_PHYCounter1		0xda0  /* cca, parity fail */
-#define	rOFDM_PHYCounter2		0xda4  /* rate illegal, crc8 fail */
-#define	rOFDM_PHYCounter3		0xda8  /* MCS not support */
-#define	rOFDM_ShortCFOAB		0xdac  /* No setting now */
-#define	rOFDM_ShortCFOCD		0xdb0
-#define	rOFDM_LongCFOAB			0xdb4
-#define	rOFDM_LongCFOCD			0xdb8
-#define	rOFDM_TailCFOAB			0xdbc
-#define	rOFDM_TailCFOCD			0xdc0
-#define	rOFDM_PWMeasure1		0xdc4
-#define	rOFDM_PWMeasure2		0xdc8
-#define	rOFDM_BWReport			0xdcc
-#define	rOFDM_AGCReport			0xdd0
-#define	rOFDM_RxSNR			0xdd4
-#define	rOFDM_RxEVMCSI			0xdd8
-#define	rOFDM_SIGReport			0xddc
-
-/*
- * 8. PageE(0xE00)
- */
-#define	rTxAGC_Rate18_06		0xe00
-#define	rTxAGC_Rate54_24		0xe04
-#define	rTxAGC_CCK_Mcs32		0xe08
-#define	rTxAGC_Mcs03_Mcs00		0xe10
-#define	rTxAGC_Mcs07_Mcs04		0xe14
-#define	rTxAGC_Mcs11_Mcs08		0xe18
-#define	rTxAGC_Mcs15_Mcs12		0xe1c
-
-/* Analog- control in RX_WAIT_CCA : REG: EE0
- * [Analog- Power & Control Register]
- */
-#define		rRx_Wait_CCCA		0xe70
-#define	rAnapar_Ctrl_BB			0xee0
-
-/*
- * 7. RF Register 0x00-0x2E (RF 8256)
- *    RF-0222D 0x00-3F
- *
- * Zebra1
- */
-#define	rZebra1_HSSIEnable		0x0	/* Useless now */
-#define	rZebra1_TRxEnable1		0x1
-#define	rZebra1_TRxEnable2		0x2
-#define	rZebra1_AGC			0x4
-#define	rZebra1_ChargePump		0x5
-#define	rZebra1_Channel			0x7	/* RF channel switch */
-#define	rZebra1_TxGain			0x8	/* Useless now */
-#define	rZebra1_TxLPF			0x9
-#define	rZebra1_RxLPF			0xb
-#define	rZebra1_RxHPFCorner		0xc
-
-/* Zebra4 */
-#define	rGlobalCtrl			0	/* Useless now */
-#define	rRTL8256_TxLPF			19
-#define	rRTL8256_RxLPF			11
-
-/* RTL8258 */
-#define	rRTL8258_TxLPF			0x11	/* Useless now */
-#define	rRTL8258_RxLPF			0x13
-#define	rRTL8258_RSSILPF		0xa
-
-/* RL6052 Register definition */
-#define	RF_AC				0x00
-#define	RF_IQADJ_G1			0x01
-#define	RF_IQADJ_G2			0x02
-#define	RF_POW_TRSW			0x05
-
-#define	RF_GAIN_RX			0x06
-#define	RF_GAIN_TX			0x07
-
-#define	RF_TXM_IDAC			0x08
-#define	RF_BS_IQGEN			0x0F
-
-#define	RF_MODE1			0x10
-#define	RF_MODE2			0x11
-
-#define	RF_RX_AGC_HP			0x12
-#define	RF_TX_AGC			0x13
-#define	RF_BIAS				0x14
-#define	RF_IPA				0x15
-#define	RF_POW_ABILITY			0x17
-#define	RF_MODE_AG			0x18
-#define	rRfChannel			0x18	/* RF channel and BW switch */
-#define	RF_CHNLBW			0x18	/* RF channel and BW switch */
-#define	RF_TOP				0x19
-#define	RF_RX_G1			0x1A
-#define	RF_RX_G2			0x1B
-#define	RF_RX_BB2			0x1C
-#define	RF_RX_BB1			0x1D
-
-#define	RF_RCK1				0x1E
-#define	RF_RCK2				0x1F
-
-#define	RF_TX_G1			0x20
-#define	RF_TX_G2			0x21
-#define	RF_TX_G3			0x22
-
-#define	RF_TX_BB1			0x23
-#define	RF_T_METER			0x24
-
-#define	RF_SYN_G1			0x25	/* RF TX Power control */
-#define	RF_SYN_G2			0x26	/* RF TX Power control */
-#define	RF_SYN_G3			0x27	/* RF TX Power control */
-#define	RF_SYN_G4			0x28	/* RF TX Power control */
-#define	RF_SYN_G5			0x29	/* RF TX Power control */
-#define	RF_SYN_G6			0x2A	/* RF TX Power control */
-#define	RF_SYN_G7			0x2B	/* RF TX Power control */
-#define	RF_SYN_G8			0x2C	/* RF TX Power control */
-
-#define	RF_RCK_OS			0x30	/* RF TX PA control */
-
-#define	RF_TXPA_G1			0x31	/* RF TX PA control */
-#define	RF_TXPA_G2			0x32	/* RF TX PA control */
-#define	RF_TXPA_G3			0x33	/* RF TX PA control */
-
-/*
- * Bit Mask
- *
- * 1. Page1(0x100)
- */
-#define	bBBResetB			0x100	/* Useless now? */
-#define	bGlobalResetB			0x200
-#define	bOFDMTxStart			0x4
-#define	bCCKTxStart			0x8
-#define	bCRC32Debug			0x100
-#define	bPMACLoopback			0x10
-#define	bTxLSIG				0xffffff
-#define	bOFDMTxRate			0xf
-#define	bOFDMTxReserved			0x10
-#define	bOFDMTxLength			0x1ffe0
-#define	bOFDMTxParity			0x20000
-#define	bTxHTSIG1			0xffffff
-#define	bTxHTMCSRate			0x7f
-#define	bTxHTBW				0x80
-#define	bTxHTLength			0xffff00
-#define	bTxHTSIG2			0xffffff
-#define	bTxHTSmoothing			0x1
-#define	bTxHTSounding			0x2
-#define	bTxHTReserved			0x4
-#define	bTxHTAggreation			0x8
-#define	bTxHTSTBC			0x30
-#define	bTxHTAdvanceCoding		0x40
-#define	bTxHTShortGI			0x80
-#define	bTxHTNumberHT_LTF		0x300
-#define	bTxHTCRC8			0x3fc00
-#define	bCounterReset			0x10000
-#define	bNumOfOFDMTx			0xffff
-#define	bNumOfCCKTx			0xffff0000
-#define	bTxIdleInterval			0xffff
-#define	bOFDMService			0xffff0000
-#define	bTxMACHeader			0xffffffff
-#define	bTxDataInit			0xff
-#define	bTxHTMode			0x100
-#define	bTxDataType			0x30000
-#define	bTxRandomSeed			0xffffffff
-#define	bCCKTxPreamble			0x1
-#define	bCCKTxSFD			0xffff0000
-#define	bCCKTxSIG			0xff
-#define	bCCKTxService			0xff00
-#define	bCCKLengthExt			0x8000
-#define	bCCKTxLength			0xffff0000
-#define	bCCKTxCRC16			0xffff
-#define	bCCKTxStatus			0x1
-#define	bOFDMTxStatus			0x2
-#define IS_BB_REG_OFFSET_92S(_Offset)	((_Offset >= 0x800) && \
-					(_Offset <= 0xfff))
-
-/* 2. Page8(0x800) */
-#define	bRFMOD			0x1	/* Reg 0x800 rFPGA0_RFMOD */
-#define	bJapanMode		0x2
-#define	bCCKTxSC		0x30
-#define	bCCKEn			0x1000000
-#define	bOFDMEn			0x2000000
-
-#define	bOFDMRxADCPhase         0x10000	/* Useless now */
-#define	bOFDMTxDACPhase         0x40000
-#define	bXATxAGC                0x3f
-#define	bXBTxAGC                0xf00	/* Reg 80c rFPGA0_TxGainStage */
-#define	bXCTxAGC                0xf000
-#define	bXDTxAGC                0xf0000
-
-#define	bPAStart		0xf0000000	/* Useless now */
-#define	bTRStart		0x00f00000
-#define	bRFStart		0x0000f000
-#define	bBBStart		0x000000f0
-#define	bBBCCKStart		0x0000000f
-#define	bPAEnd			0xf          /* Reg0x814 */
-#define	bTREnd			0x0f000000
-#define	bRFEnd			0x000f0000
-#define	bCCAMask		0x000000f0   /* T2R */
-#define	bR2RCCAMask		0x00000f00
-#define	bHSSI_R2TDelay		0xf8000000
-#define	bHSSI_T2RDelay		0xf80000
-#define	bContTxHSSI		0x400     /* change gain at continue Tx */
-#define	bIGFromCCK		0x200
-#define	bAGCAddress		0x3f
-#define	bRxHPTx			0x7000
-#define	bRxHPT2R		0x38000
-#define	bRxHPCCKIni		0xc0000
-#define	bAGCTxCode		0xc00000
-#define	bAGCRxCode		0x300000
-#define	b3WireDataLength	0x800	/* Reg 0x820~84f rFPGA0_XA_HSSIParm1 */
-#define	b3WireAddressLength	0x400
-#define	b3WireRFPowerDown	0x1	/* Useless now */
-#define	b5GPAPEPolarity		0x40000000
-#define	b2GPAPEPolarity		0x80000000
-#define	bRFSW_TxDefaultAnt	0x3
-#define	bRFSW_TxOptionAnt	0x30
-#define	bRFSW_RxDefaultAnt	0x300
-#define	bRFSW_RxOptionAnt	0x3000
-#define	bRFSI_3WireData		0x1
-#define	bRFSI_3WireClock	0x2
-#define	bRFSI_3WireLoad		0x4
-#define	bRFSI_3WireRW		0x8
-#define	bRFSI_3Wire		0xf
-#define	bRFSI_RFENV		0x10	/* Reg 0x870 rFPGA0_XAB_RFInterfaceSW */
-#define	bRFSI_TRSW		0x20	/* Useless now */
-#define	bRFSI_TRSWB		0x40
-#define	bRFSI_ANTSW		0x100
-#define	bRFSI_ANTSWB		0x200
-#define	bRFSI_PAPE		0x400
-#define	bRFSI_PAPE5G		0x800
-#define	bBandSelect		0x1
-#define	bHTSIG2_GI		0x80
-#define	bHTSIG2_Smoothing	0x01
-#define	bHTSIG2_Sounding	0x02
-#define	bHTSIG2_Aggreaton	0x08
-#define	bHTSIG2_STBC		0x30
-#define	bHTSIG2_AdvCoding	0x40
-#define	bHTSIG2_NumOfHTLTF	0x300
-#define	bHTSIG2_CRC8		0x3fc
-#define	bHTSIG1_MCS		0x7f
-#define	bHTSIG1_BandWidth	0x80
-#define	bHTSIG1_HTLength	0xffff
-#define	bLSIG_Rate		0xf
-#define	bLSIG_Reserved		0x10
-#define	bLSIG_Length		0x1fffe
-#define	bLSIG_Parity		0x20
-#define	bCCKRxPhase		0x4
-#define	bLSSIReadAddress	0x7f800000   /* T65 RF */
-#define	bLSSIReadEdge		0x80000000   /* LSSI "Read" edge signal */
-#define	bLSSIReadBackData	0xfffff		/* T65 RF */
-#define	bLSSIReadOKFlag		0x1000	/* Useless now */
-#define	bCCKSampleRate		0x8       /*0: 44MHz, 1:88MHz*/
-#define	bRegulator0Standby	0x1
-#define	bRegulatorPLLStandby	0x2
-#define	bRegulator1Standby	0x4
-#define	bPLLPowerUp		0x8
-#define	bDPLLPowerUp		0x10
-#define	bDA10PowerUp		0x20
-#define	bAD7PowerUp		0x200
-#define	bDA6PowerUp		0x2000
-#define	bXtalPowerUp		0x4000
-#define	b40MDClkPowerUP		0x8000
-#define	bDA6DebugMode		0x20000
-#define	bDA6Swing		0x380000
-
-/* Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ */
-#define	bADClkPhase		0x4000000
-
-#define	b80MClkDelay		0x18000000	/* Useless */
-#define	bAFEWatchDogEnable	0x20000000
-
-/* Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap */
-#define	bXtalCap01		0xc0000000
-#define	bXtalCap23		0x3
-#define	bXtalCap92x		0x0f000000
-#define bXtalCap		0x0f000000
-#define	bIntDifClkEnable	0x400	/* Useless */
-#define	bExtSigClkEnable	0x800
-#define	bBandgapMbiasPowerUp	0x10000
-#define	bAD11SHGain		0xc0000
-#define	bAD11InputRange		0x700000
-#define	bAD11OPCurrent		0x3800000
-#define	bIPathLoopback		0x4000000
-#define	bQPathLoopback		0x8000000
-#define	bAFELoopback		0x10000000
-#define	bDA10Swing		0x7e0
-#define	bDA10Reverse		0x800
-#define	bDAClkSource		0x1000
-#define	bAD7InputRange		0x6000
-#define	bAD7Gain		0x38000
-#define	bAD7OutputCMMode	0x40000
-#define	bAD7InputCMMode		0x380000
-#define	bAD7Current		0xc00000
-#define	bRegulatorAdjust	0x7000000
-#define	bAD11PowerUpAtTx	0x1
-#define	bDA10PSAtTx		0x10
-#define	bAD11PowerUpAtRx	0x100
-#define	bDA10PSAtRx		0x1000
-#define	bCCKRxAGCFormat		0x200
-#define	bPSDFFTSamplepPoint	0xc000
-#define	bPSDAverageNum		0x3000
-#define	bIQPathControl		0xc00
-#define	bPSDFreq		0x3ff
-#define	bPSDAntennaPath		0x30
-#define	bPSDIQSwitch		0x40
-#define	bPSDRxTrigger		0x400000
-#define	bPSDTxTrigger		0x80000000
-#define	bPSDSineToneScale	0x7f000000
-#define	bPSDReport		0xffff
-
-/* 3. Page9(0x900) */
-#define	bOFDMTxSC		0x30000000	/* Useless */
-#define	bCCKTxOn		0x1
-#define	bOFDMTxOn		0x2
-#define	bDebugPage		0xfff  /* reset debug page and HWord, LWord */
-#define	bDebugItem		0xff   /* reset debug page and LWord */
-#define	bAntL			0x10
-#define	bAntNonHT		0x100
-#define	bAntHT1			0x1000
-#define	bAntHT2			0x10000
-#define	bAntHT1S1		0x100000
-#define	bAntNonHTS1		0x1000000
-
-/* 4. PageA(0xA00) */
-#define	bCCKBBMode		0x3	/* Useless */
-#define	bCCKTxPowerSaving	0x80
-#define	bCCKRxPowerSaving	0x40
-
-#define	bCCKSideBand		0x10	/* Reg 0xa00 rCCK0_System 20/40 switch*/
-#define	bCCKScramble		0x8	/* Useless */
-#define	bCCKAntDiversity	0x8000
-#define	bCCKCarrierRecovery	0x4000
-#define	bCCKTxRate		0x3000
-#define	bCCKDCCancel		0x0800
-#define	bCCKISICancel		0x0400
-#define	bCCKMatchFilter		0x0200
-#define	bCCKEqualizer		0x0100
-#define	bCCKPreambleDetect	0x800000
-#define	bCCKFastFalseCCA	0x400000
-#define	bCCKChEstStart		0x300000
-#define	bCCKCCACount		0x080000
-#define	bCCKcs_lim		0x070000
-#define	bCCKBistMode		0x80000000
-#define	bCCKCCAMask		0x40000000
-#define	bCCKTxDACPhase		0x4
-#define	bCCKRxADCPhase		0x20000000   /* r_rx_clk */
-#define	bCCKr_cp_mode0		0x0100
-#define	bCCKTxDCOffset		0xf0
-#define	bCCKRxDCOffset		0xf
-#define	bCCKCCAMode		0xc000
-#define	bCCKFalseCS_lim		0x3f00
-#define	bCCKCS_ratio		0xc00000
-#define	bCCKCorgBit_sel		0x300000
-#define	bCCKPD_lim		0x0f0000
-#define	bCCKNewCCA		0x80000000
-#define	bCCKRxHPofIG		0x8000
-#define	bCCKRxIG		0x7f00
-#define	bCCKLNAPolarity		0x800000
-#define	bCCKRx1stGain		0x7f0000
-#define	bCCKRFExtend		0x20000000 /* CCK Rx initial gain polarity */
-#define	bCCKRxAGCSatLevel	0x1f000000
-#define	bCCKRxAGCSatCount       0xe0
-#define	bCCKRxRFSettle          0x1f       /* AGCsamp_dly */
-#define	bCCKFixedRxAGC          0x8000
-#define	bCCKAntennaPolarity     0x2000
-#define	bCCKTxFilterType        0x0c00
-#define	bCCKRxAGCReportType	0x0300
-#define	bCCKRxDAGCEn            0x80000000
-#define	bCCKRxDAGCPeriod        0x20000000
-#define	bCCKRxDAGCSatLevel	0x1f000000
-#define	bCCKTimingRecovery      0x800000
-#define	bCCKTxC0                0x3f0000
-#define	bCCKTxC1                0x3f000000
-#define	bCCKTxC2                0x3f
-#define	bCCKTxC3                0x3f00
-#define	bCCKTxC4                0x3f0000
-#define	bCCKTxC5		0x3f000000
-#define	bCCKTxC6		0x3f
-#define	bCCKTxC7		0x3f00
-#define	bCCKDebugPort		0xff0000
-#define	bCCKDACDebug		0x0f000000
-#define	bCCKFalseAlarmEnable	0x8000
-#define	bCCKFalseAlarmRead	0x4000
-#define	bCCKTRSSI		0x7f
-#define	bCCKRxAGCReport		0xfe
-#define	bCCKRxReport_AntSel	0x80000000
-#define	bCCKRxReport_MFOff	0x40000000
-#define	bCCKRxRxReport_SQLoss	0x20000000
-#define	bCCKRxReport_Pktloss	0x10000000
-#define	bCCKRxReport_Lockedbit	0x08000000
-#define	bCCKRxReport_RateError	0x04000000
-#define	bCCKRxReport_RxRate	0x03000000
-#define	bCCKRxFACounterLower	0xff
-#define	bCCKRxFACounterUpper	0xff000000
-#define	bCCKRxHPAGCStart	0xe000
-#define	bCCKRxHPAGCFinal	0x1c00
-#define	bCCKRxFalseAlarmEnable	0x8000
-#define	bCCKFACounterFreeze	0x4000
-#define	bCCKTxPathSel		0x10000000
-#define	bCCKDefaultRxPath	0xc000000
-#define	bCCKOptionRxPath	0x3000000
-
-/* 5. PageC(0xC00) */
-#define	bNumOfSTF		0x3	/* Useless */
-#define	bShift_L                0xc0
-#define	bGI_TH			0xc
-#define	bRxPathA		0x1
-#define	bRxPathB		0x2
-#define	bRxPathC		0x4
-#define	bRxPathD		0x8
-#define	bTxPathA		0x1
-#define	bTxPathB		0x2
-#define	bTxPathC		0x4
-#define	bTxPathD		0x8
-#define	bTRSSIFreq		0x200
-#define	bADCBackoff		0x3000
-#define	bDFIRBackoff		0xc000
-#define	bTRSSILatchPhase	0x10000
-#define	bRxIDCOffset		0xff
-#define	bRxQDCOffset		0xff00
-#define	bRxDFIRMode		0x1800000
-#define	bRxDCNFType		0xe000000
-#define	bRXIQImb_A		0x3ff
-#define	bRXIQImb_B		0xfc00
-#define	bRXIQImb_C		0x3f0000
-#define	bRXIQImb_D		0xffc00000
-#define	bDC_dc_Notch		0x60000
-#define	bRxNBINotch		0x1f000000
-#define	bPD_TH			0xf
-#define	bPD_TH_Opt2		0xc000
-#define	bPWED_TH		0x700
-#define	bIfMF_Win_L		0x800
-#define	bPD_Option		0x1000
-#define	bMF_Win_L		0xe000
-#define	bBW_Search_L		0x30000
-#define	bwin_enh_L		0xc0000
-#define	bBW_TH			0x700000
-#define	bED_TH2			0x3800000
-#define	bBW_option		0x4000000
-#define	bRatio_TH		0x18000000
-#define	bWindow_L		0xe0000000
-#define	bSBD_Option		0x1
-#define	bFrame_TH		0x1c
-#define	bFS_Option		0x60
-#define	bDC_Slope_check		0x80
-#define	bFGuard_Counter_DC_L	0xe00
-#define	bFrame_Weight_Short	0x7000
-#define	bSub_Tune		0xe00000
-#define	bFrame_DC_Length	0xe000000
-#define	bSBD_start_offset	0x30000000
-#define	bFrame_TH_2		0x7
-#define	bFrame_GI2_TH		0x38
-#define	bGI2_Sync_en		0x40
-#define	bSarch_Short_Early	0x300
-#define	bSarch_Short_Late	0xc00
-#define	bSarch_GI2_Late		0x70000
-#define	bCFOAntSum		0x1
-#define	bCFOAcc			0x2
-#define	bCFOStartOffset		0xc
-#define	bCFOLookBack		0x70
-#define	bCFOSumWeight		0x80
-#define	bDAGCEnable		0x10000
-#define	bTXIQImb_A		0x3ff
-#define	bTXIQImb_B		0xfc00
-#define	bTXIQImb_C		0x3f0000
-#define	bTXIQImb_D		0xffc00000
-#define	bTxIDCOffset		0xff
-#define	bTxQDCOffset		0xff00
-#define	bTxDFIRMode		0x10000
-#define	bTxPesudoNoiseOn	0x4000000
-#define	bTxPesudoNoise_A	0xff
-#define	bTxPesudoNoise_B	0xff00
-#define	bTxPesudoNoise_C	0xff0000
-#define	bTxPesudoNoise_D	0xff000000
-#define	bCCADropOption		0x20000
-#define	bCCADropThres		0xfff00000
-#define	bEDCCA_H		0xf
-#define	bEDCCA_L		0xf0
-#define	bLambda_ED              0x300
-#define	bRxInitialGain          0x7f
-#define	bRxAntDivEn             0x80
-#define	bRxAGCAddressForLNA     0x7f00
-#define	bRxHighPowerFlow        0x8000
-#define	bRxAGCFreezeThres       0xc0000
-#define	bRxFreezeStep_AGC1      0x300000
-#define	bRxFreezeStep_AGC2      0xc00000
-#define	bRxFreezeStep_AGC3      0x3000000
-#define	bRxFreezeStep_AGC0      0xc000000
-#define	bRxRssi_Cmp_En          0x10000000
-#define	bRxQuickAGCEn           0x20000000
-#define	bRxAGCFreezeThresMode   0x40000000
-#define	bRxOverFlowCheckType    0x80000000
-#define	bRxAGCShift             0x7f
-#define	bTRSW_Tri_Only          0x80
-#define	bPowerThres             0x300
-#define	bRxAGCEn                0x1
-#define	bRxAGCTogetherEn        0x2
-#define	bRxAGCMin               0x4
-#define	bRxHP_Ini               0x7
-#define	bRxHP_TRLNA             0x70
-#define	bRxHP_RSSI              0x700
-#define	bRxHP_BBP1              0x7000
-#define	bRxHP_BBP2              0x70000
-#define	bRxHP_BBP3              0x700000
-#define	bRSSI_H                 0x7f0000     /* the threshold for high power */
-#define	bRSSI_Gen               0x7f000000   /* the threshold for ant divers */
-#define	bRxSettle_TRSW          0x7
-#define	bRxSettle_LNA           0x38
-#define	bRxSettle_RSSI          0x1c0
-#define	bRxSettle_BBP           0xe00
-#define	bRxSettle_RxHP          0x7000
-#define	bRxSettle_AntSW_RSSI    0x38000
-#define	bRxSettle_AntSW         0xc0000
-#define	bRxProcessTime_DAGC     0x300000
-#define	bRxSettle_HSSI          0x400000
-#define	bRxProcessTime_BBPPW    0x800000
-#define	bRxAntennaPowerShift    0x3000000
-#define	bRSSITableSelect        0xc000000
-#define	bRxHP_Final             0x7000000
-#define	bRxHTSettle_BBP         0x7
-#define	bRxHTSettle_HSSI        0x8
-#define	bRxHTSettle_RxHP        0x70
-#define	bRxHTSettle_BBPPW       0x80
-#define	bRxHTSettle_Idle        0x300
-#define	bRxHTSettle_Reserved    0x1c00
-#define	bRxHTRxHPEn             0x8000
-#define	bRxHTAGCFreezeThres     0x30000
-#define	bRxHTAGCTogetherEn      0x40000
-#define	bRxHTAGCMin             0x80000
-#define	bRxHTAGCEn              0x100000
-#define	bRxHTDAGCEn             0x200000
-#define	bRxHTRxHP_BBP           0x1c00000
-#define	bRxHTRxHP_Final         0xe0000000
-#define	bRxPWRatioTH            0x3
-#define	bRxPWRatioEn            0x4
-#define	bRxMFHold               0x3800
-#define	bRxPD_Delay_TH1         0x38
-#define	bRxPD_Delay_TH2         0x1c0
-#define	bRxPD_DC_COUNT_MAX      0x600
-#define	bRxPD_Delay_TH          0x8000
-#define	bRxProcess_Delay        0xf0000
-#define	bRxSearchrange_GI2_Early 0x700000
-#define	bRxFrame_Guard_Counter_L 0x3800000
-#define	bRxSGI_Guard_L          0xc000000
-#define	bRxSGI_Search_L         0x30000000
-#define	bRxSGI_TH               0xc0000000
-#define	bDFSCnt0                0xff
-#define	bDFSCnt1                0xff00
-#define	bDFSFlag                0xf0000
-#define	bMFWeightSum            0x300000
-#define	bMinIdxTH               0x7f000000
-#define	bDAFormat               0x40000
-#define	bTxChEmuEnable          0x01000000
-#define	bTRSWIsolation_A        0x7f
-#define	bTRSWIsolation_B        0x7f00
-#define	bTRSWIsolation_C        0x7f0000
-#define	bTRSWIsolation_D        0x7f000000
-#define	bExtLNAGain             0x7c00
-
-/* 6. PageE(0xE00) */
-#define	bSTBCEn                 0x4	/* Useless */
-#define	bAntennaMapping         0x10
-#define	bNss                    0x20
-#define	bCFOAntSumD             0x200
-#define	bPHYCounterReset        0x8000000
-#define	bCFOReportGet           0x4000000
-#define	bOFDMContinueTx         0x10000000
-#define	bOFDMSingleCarrier      0x20000000
-#define	bOFDMSingleTone         0x40000000
-#define	bHTDetect               0x100
-#define	bCFOEn                  0x10000
-#define	bCFOValue               0xfff00000
-#define	bSigTone_Re             0x3f
-#define	bSigTone_Im             0x7f00
-#define	bCounter_CCA            0xffff
-#define	bCounter_ParityFail     0xffff0000
-#define	bCounter_RateIllegal    0xffff
-#define	bCounter_CRC8Fail       0xffff0000
-#define	bCounter_MCSNoSupport   0xffff
-#define	bCounter_FastSync       0xffff
-#define	bShortCFO               0xfff
-#define	bShortCFOTLength        12   /* total */
-#define	bShortCFOFLength        11   /* fraction */
-#define	bLongCFO                0x7ff
-#define	bLongCFOTLength         11
-#define	bLongCFOFLength         11
-#define	bTailCFO                0x1fff
-#define	bTailCFOTLength         13
-#define	bTailCFOFLength         12
-#define	bmax_en_pwdB            0xffff
-#define	bCC_power_dB            0xffff0000
-#define	bnoise_pwdB             0xffff
-#define	bPowerMeasTLength       10
-#define	bPowerMeasFLength       3
-#define	bRx_HT_BW               0x1
-#define	bRxSC                   0x6
-#define	bRx_HT                  0x8
-#define	bNB_intf_det_on         0x1
-#define	bIntf_win_len_cfg       0x30
-#define	bNB_Intf_TH_cfg         0x1c0
-#define	bRFGain                 0x3f
-#define	bTableSel               0x40
-#define	bTRSW                   0x80
-#define	bRxSNR_A                0xff
-#define	bRxSNR_B                0xff00
-#define	bRxSNR_C                0xff0000
-#define	bRxSNR_D                0xff000000
-#define	bSNREVMTLength          8
-#define	bSNREVMFLength          1
-#define	bCSI1st                 0xff
-#define	bCSI2nd                 0xff00
-#define	bRxEVM1st               0xff0000
-#define	bRxEVM2nd               0xff000000
-#define	bSIGEVM                 0xff
-#define	bPWDB                   0xff00
-#define	bSGIEN                  0x10000
-
-#define	bSFactorQAM1            0xf	/* Useless */
-#define	bSFactorQAM2            0xf0
-#define	bSFactorQAM3            0xf00
-#define	bSFactorQAM4            0xf000
-#define	bSFactorQAM5            0xf0000
-#define	bSFactorQAM6            0xf0000
-#define	bSFactorQAM7            0xf00000
-#define	bSFactorQAM8            0xf000000
-#define	bSFactorQAM9            0xf0000000
-#define	bCSIScheme              0x100000
-
-#define	bNoiseLvlTopSet         0x3	/* Useless */
-#define	bChSmooth               0x4
-#define	bChSmoothCfg1           0x38
-#define	bChSmoothCfg2           0x1c0
-#define	bChSmoothCfg3           0xe00
-#define	bChSmoothCfg4           0x7000
-#define	bMRCMode                0x800000
-#define	bTHEVMCfg               0x7000000
-
-#define	bLoopFitType            0x1	/* Useless */
-#define	bUpdCFO                 0x40
-#define	bUpdCFOOffData          0x80
-#define	bAdvUpdCFO              0x100
-#define	bAdvTimeCtrl            0x800
-#define	bUpdClko                0x1000
-#define	bFC                     0x6000
-#define	bTrackingMode           0x8000
-#define	bPhCmpEnable            0x10000
-#define	bUpdClkoLTF             0x20000
-#define	bComChCFO               0x40000
-#define	bCSIEstiMode            0x80000
-#define	bAdvUpdEqz              0x100000
-#define	bUChCfg                 0x7000000
-#define	bUpdEqz			0x8000000
-
-#define	bTxAGCRate18_06		0x7f7f7f7f	/* Useless */
-#define	bTxAGCRate54_24		0x7f7f7f7f
-#define	bTxAGCRateMCS32		0x7f
-#define	bTxAGCRateCCK		0x7f00
-#define	bTxAGCRateMCS3_MCS0	0x7f7f7f7f
-#define	bTxAGCRateMCS7_MCS4	0x7f7f7f7f
-#define	bTxAGCRateMCS11_MCS8	0x7f7f7f7f
-#define	bTxAGCRateMCS15_MCS12	0x7f7f7f7f
-
-/* Rx Pseduo noise */
-#define	bRxPesudoNoiseOn         0x20000000	/* Useless */
-#define	bRxPesudoNoise_A         0xff
-#define	bRxPesudoNoise_B         0xff00
-#define	bRxPesudoNoise_C         0xff0000
-#define	bRxPesudoNoise_D         0xff000000
-#define	bPesudoNoiseState_A      0xffff
-#define	bPesudoNoiseState_B      0xffff0000
-#define	bPesudoNoiseState_C      0xffff
-#define	bPesudoNoiseState_D      0xffff0000
-
-/* 7. RF Register
- * Zebra1
- */
-#define	bZebra1_HSSIEnable        0x8		/* Useless */
-#define	bZebra1_TRxControl        0xc00
-#define	bZebra1_TRxGainSetting    0x07f
-#define	bZebra1_RxCorner          0xc00
-#define	bZebra1_TxChargePump      0x38
-#define	bZebra1_RxChargePump      0x7
-#define	bZebra1_ChannelNum        0xf80
-#define	bZebra1_TxLPFBW           0x400
-#define	bZebra1_RxLPFBW           0x600
-
-/*Zebra4 */
-#define	bRTL8256RegModeCtrl1      0x100	/* Useless */
-#define	bRTL8256RegModeCtrl0      0x40
-#define	bRTL8256_TxLPFBW          0x18
-#define	bRTL8256_RxLPFBW          0x600
-
-/* RTL8258 */
-#define	bRTL8258_TxLPFBW          0xc	/* Useless */
-#define	bRTL8258_RxLPFBW          0xc00
-#define	bRTL8258_RSSILPFBW        0xc0
-
-/*
- * Other Definition
- */
-
-/* byte endable for sb_write */
-#define	bByte0                    0x1	/* Useless */
-#define	bByte1                    0x2
-#define	bByte2                    0x4
-#define	bByte3                    0x8
-#define	bWord0                    0x3
-#define	bWord1                    0xc
-#define	bDWord                    0xf
-
-/* for PutRegsetting & GetRegSetting BitMask */
-#define	bMaskByte0                0xff	/* Reg 0xc50 rOFDM0_XAAGCCore~0xC6f */
-#define	bMaskByte1                0xff00
-#define	bMaskByte2                0xff0000
-#define	bMaskByte3                0xff000000
-#define	bMaskHWord                0xffff0000
-#define	bMaskLWord                0x0000ffff
-#define	bMaskDWord                0xffffffff
-
-/* for PutRFRegsetting & GetRFRegSetting BitMask */
-#define	bRFRegOffsetMask	0xfffff
-#define	bEnable                   0x1	/* Useless */
-#define	bDisable                  0x0
-
-#define	LeftAntenna               0x0	/* Useless */
-#define	RightAntenna              0x1
-
-#define	tCheckTxStatus            500   /* 500ms Useless */
-#define	tUpdateRxCounter          100   /* 100ms */
-
-#define	rateCCK     0	/* Useless */
-#define	rateOFDM    1
-#define	rateHT      2
-
-/* define Register-End */
-#define	bPMAC_End       0x1ff	/* Useless */
-#define	bFPGAPHY0_End   0x8ff
-#define	bFPGAPHY1_End   0x9ff
-#define	bCCKPHY0_End    0xaff
-#define	bOFDMPHY0_End   0xcff
-#define	bOFDMPHY1_End   0xdff
-
-#define	bPMACControl	0x0	/* Useless */
-#define	bWMACControl	0x1
-#define	bWNICControl	0x2
-
-#define	ANTENNA_A	0x1	/* Useless */
-#define	ANTENNA_B	0x2
-#define	ANTENNA_AB	0x3	/* ANTENNA_A |ANTENNA_B */
-
-#define	ANTENNA_C	0x4
-#define	ANTENNA_D	0x8
-
-/* accept all physical address */
-#define RCR_AAP		BIT(0)
-#define RCR_APM		BIT(1)		/* accept physical match */
-#define RCR_AM		BIT(2)		/* accept multicast */
-#define RCR_AB		BIT(3)		/* accept broadcast */
-#define RCR_ACRC32	BIT(5)		/* accept error packet */
-#define RCR_9356SEL	BIT(6)
-#define RCR_AICV	BIT(12)		/* Accept ICV error packet */
-#define RCR_RXFTH0	(BIT(13)|BIT(14)|BIT(15))	/* Rx FIFO threshold */
-#define RCR_ADF		BIT(18)		/* Accept Data(frame type) frame */
-#define RCR_ACF		BIT(19)		/* Accept control frame */
-#define RCR_AMF		BIT(20)		/* Accept management frame */
-#define RCR_ADD3	BIT(21)
-#define RCR_APWRMGT	BIT(22)		/* Accept power management packet */
-#define RCR_CBSSID	BIT(23)		/* Accept BSSID match packet */
-#define RCR_ENMARP	BIT(28)		/* enable mac auto reset phy */
-#define RCR_EnCS1	BIT(29)		/* enable carrier sense method 1 */
-#define RCR_EnCS2	BIT(30)		/* enable carrier sense method 2 */
-/* Rx Early mode is performed for packet size greater than 1536 */
-#define RCR_OnlyErlPkt	BIT(31)
-
-/*--------------------------Define Parameters-------------------------------*/
-
-#endif	/*__INC_HAL8192SPHYREG_H */
-
--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.c
+++ /dev/null
@@ -1,234 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_pwrctrl.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_PWRCTRL_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-#define RTL8712_SDIO_LOCAL_BASE 0X10100000
-#define SDIO_HCPWM (RTL8712_SDIO_LOCAL_BASE + 0x0081)
-
-void r8712_set_rpwm(struct _adapter *padapter, u8 val8)
-{
-	u8	rpwm;
-	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
-	if (pwrpriv->rpwm == val8) {
-		if (pwrpriv->rpwm_retry == 0)
-			return;
-	}
-	if (padapter->driver_stopped || padapter->surprise_removed)
-		return;
-	rpwm = val8 | pwrpriv->tog;
-	switch (val8) {
-	case PS_STATE_S1:
-		pwrpriv->cpwm = val8;
-		break;
-	case PS_STATE_S2:/* only for USB normal powersave mode use,
-			  * temp mark some code.
-			  */
-	case PS_STATE_S3:
-	case PS_STATE_S4:
-		pwrpriv->cpwm = val8;
-		break;
-	default:
-		break;
-	}
-	pwrpriv->rpwm_retry = 0;
-	pwrpriv->rpwm = val8;
-	r8712_write8(padapter, 0x1025FE58, rpwm);
-	pwrpriv->tog += 0x80;
-}
-
-void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode, uint smart_ps)
-{
-	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
-	if (ps_mode > PM_Card_Disable)
-		return;
-	/* if driver is in active state, we dont need set smart_ps.*/
-	if (ps_mode == PS_MODE_ACTIVE)
-		smart_ps = 0;
-	if ((pwrpriv->pwr_mode != ps_mode) || (pwrpriv->smart_ps != smart_ps)) {
-		if (pwrpriv->pwr_mode == PS_MODE_ACTIVE)
-			pwrpriv->bSleep = true;
-		else
-			pwrpriv->bSleep = false;
-		pwrpriv->pwr_mode = ps_mode;
-		pwrpriv->smart_ps = smart_ps;
-		schedule_work(&pwrpriv->SetPSModeWorkItem);
-	}
-}
-
-/*
- * Caller:ISR handler...
- *
- * This will be called when CPWM interrupt is up.
- *
- * using to update cpwn of drv; and drv will make a decision to up or
- * down pwr level
- */
-void r8712_cpwm_int_hdl(struct _adapter *padapter,
-			struct reportpwrstate_parm *preportpwrstate)
-{
-	struct pwrctrl_priv *pwrpriv = &(padapter->pwrctrlpriv);
-	struct cmd_priv	*pcmdpriv = &(padapter->cmdpriv);
-
-	if (pwrpriv->cpwm_tog == ((preportpwrstate->state) & 0x80))
-		return;
-	del_timer(&padapter->pwrctrlpriv.rpwm_check_timer);
-	mutex_lock(&pwrpriv->mutex_lock);
-	pwrpriv->cpwm = (preportpwrstate->state) & 0xf;
-	if (pwrpriv->cpwm >= PS_STATE_S2) {
-		if (pwrpriv->alives & CMD_ALIVE)
-			complete(&(pcmdpriv->cmd_queue_comp));
-	}
-	pwrpriv->cpwm_tog = (preportpwrstate->state) & 0x80;
-	mutex_unlock(&pwrpriv->mutex_lock);
-}
-
-static inline void register_task_alive(struct pwrctrl_priv *pwrctrl, uint tag)
-{
-		pwrctrl->alives |= tag;
-}
-
-static inline void unregister_task_alive(struct pwrctrl_priv *pwrctrl, uint tag)
-{
-	if (pwrctrl->alives & tag)
-		pwrctrl->alives ^= tag;
-}
-
-static void _rpwm_check_handler (struct _adapter *padapter)
-{
-	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
-
-	if (padapter->driver_stopped || padapter->surprise_removed)
-		return;
-	if (pwrpriv->cpwm != pwrpriv->rpwm)
-		schedule_work(&pwrpriv->rpwm_workitem);
-}
-
-static void SetPSModeWorkItemCallback(struct work_struct *work)
-{
-	struct pwrctrl_priv *pwrpriv = container_of(work,
-				       struct pwrctrl_priv, SetPSModeWorkItem);
-	struct _adapter *padapter = container_of(pwrpriv,
-				    struct _adapter, pwrctrlpriv);
-	if (!pwrpriv->bSleep) {
-		mutex_lock(&pwrpriv->mutex_lock);
-		if (pwrpriv->pwr_mode == PS_MODE_ACTIVE)
-			r8712_set_rpwm(padapter, PS_STATE_S4);
-		mutex_unlock(&pwrpriv->mutex_lock);
-	}
-}
-
-static void rpwm_workitem_callback(struct work_struct *work)
-{
-	struct pwrctrl_priv *pwrpriv = container_of(work,
-				       struct pwrctrl_priv, rpwm_workitem);
-	struct _adapter *padapter = container_of(pwrpriv,
-				    struct _adapter, pwrctrlpriv);
-	if (pwrpriv->cpwm != pwrpriv->rpwm) {
-		mutex_lock(&pwrpriv->mutex_lock);
-		r8712_read8(padapter, SDIO_HCPWM);
-		pwrpriv->rpwm_retry = 1;
-		r8712_set_rpwm(padapter, pwrpriv->rpwm);
-		mutex_unlock(&pwrpriv->mutex_lock);
-	}
-}
-
-static void rpwm_check_handler (struct timer_list *t)
-{
-	struct _adapter *adapter =
-		from_timer(adapter, t, pwrctrlpriv.rpwm_check_timer);
-
-	_rpwm_check_handler(adapter);
-}
-
-void r8712_init_pwrctrl_priv(struct _adapter *padapter)
-{
-	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
-
-	memset((unsigned char *)pwrctrlpriv, 0, sizeof(struct pwrctrl_priv));
-	mutex_init(&pwrctrlpriv->mutex_lock);
-	pwrctrlpriv->cpwm = PS_STATE_S4;
-	pwrctrlpriv->pwr_mode = PS_MODE_ACTIVE;
-	pwrctrlpriv->smart_ps = 0;
-	pwrctrlpriv->tog = 0x80;
-/* clear RPWM to ensure driver and fw back to initial state. */
-	r8712_write8(padapter, 0x1025FE58, 0);
-	INIT_WORK(&pwrctrlpriv->SetPSModeWorkItem, SetPSModeWorkItemCallback);
-	INIT_WORK(&pwrctrlpriv->rpwm_workitem, rpwm_workitem_callback);
-	timer_setup(&pwrctrlpriv->rpwm_check_timer, rpwm_check_handler, 0);
-}
-
-/*
- * Caller: r8712_cmd_thread
- * Check if the fw_pwrstate is okay for issuing cmd.
- * If not (cpwm should be is less than P2 state), then the sub-routine
- * will raise the cpwm to be greater than or equal to P2.
- * Calling Context: Passive
- * Return Value:
- * 0:	    r8712_cmd_thread can issue cmds to firmware afterwards.
- * -EINVAL: r8712_cmd_thread can not do anything.
- */
-int r8712_register_cmd_alive(struct _adapter *padapter)
-{
-	int res = 0;
-	struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
-	mutex_lock(&pwrctrl->mutex_lock);
-	register_task_alive(pwrctrl, CMD_ALIVE);
-	if (pwrctrl->cpwm < PS_STATE_S2) {
-		r8712_set_rpwm(padapter, PS_STATE_S3);
-		res = -EINVAL;
-	}
-	mutex_unlock(&pwrctrl->mutex_lock);
-	return res;
-}
-
-/*
- * Caller: ISR
- * If ISR's txdone,
- * No more pkts for TX,
- * Then driver shall call this fun. to power down firmware again.
- */
-void r8712_unregister_cmd_alive(struct _adapter *padapter)
-{
-	struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
-	mutex_lock(&pwrctrl->mutex_lock);
-	unregister_task_alive(pwrctrl, CMD_ALIVE);
-	if ((pwrctrl->cpwm > PS_STATE_S2) &&
-	   (pwrctrl->pwr_mode > PS_MODE_ACTIVE)) {
-		if ((pwrctrl->alives == 0) &&
-		    (check_fwstate(&padapter->mlmepriv,
-		     _FW_UNDER_LINKING) != true)) {
-			r8712_set_rpwm(padapter, PS_STATE_S0);
-		}
-	}
-	mutex_unlock(&pwrctrl->mutex_lock);
-}
-
-void r8712_flush_rwctrl_works(struct _adapter *padapter)
-{
-	struct pwrctrl_priv *pwrctrl = &padapter->pwrctrlpriv;
-
-	flush_work(&pwrctrl->SetPSModeWorkItem);
-	flush_work(&pwrctrl->rpwm_workitem);
-}
--- a/drivers/staging/rtl8712/rtl871x_pwrctrl.h
+++ /dev/null
@@ -1,113 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_PWRCTRL_H_
-#define __RTL871X_PWRCTRL_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define CMD_ALIVE	BIT(2)
-
-enum Power_Mgnt {
-	PS_MODE_ACTIVE	= 0,
-	PS_MODE_MIN,
-	PS_MODE_MAX,
-	PS_MODE_DTIM,
-	PS_MODE_VOIP,
-	PS_MODE_UAPSD_WMM,
-	PS_MODE_UAPSD,
-	PS_MODE_IBSS,
-	PS_MODE_WWLAN,
-	PM_Radio_Off,
-	PM_Card_Disable,
-	PS_MODE_NUM
-};
-
-/*
- * BIT[2:0] = HW state
- * BIT[3] = Protocol PS state, 0: register active state,
- *				1: register sleep state
- * BIT[4] = sub-state
- */
-
-#define		PS_DPS				BIT(0)
-#define		PS_LCLK				(PS_DPS)
-#define	PS_RF_OFF			BIT(1)
-#define	PS_ALL_ON			BIT(2)
-#define	PS_ST_ACTIVE		BIT(3)
-#define	PS_LP				BIT(4)	/* low performance */
-
-#define	PS_STATE_MASK		(0x0F)
-#define	PS_STATE_HW_MASK	(0x07)
-#define		PS_SEQ_MASK		(0xc0)
-
-#define	PS_STATE(x)			(PS_STATE_MASK & (x))
-#define	PS_STATE_HW(x)	(PS_STATE_HW_MASK & (x))
-#define	PS_SEQ(x)			(PS_SEQ_MASK & (x))
-
-#define	PS_STATE_S0		(PS_DPS)
-#define		PS_STATE_S1		(PS_LCLK)
-#define	PS_STATE_S2		(PS_RF_OFF)
-#define		PS_STATE_S3		(PS_ALL_ON)
-#define	PS_STATE_S4		((PS_ST_ACTIVE) | (PS_ALL_ON))
-
-#define		PS_IS_RF_ON(x)		((x) & (PS_ALL_ON))
-#define		PS_IS_ACTIVE(x)		((x) & (PS_ST_ACTIVE))
-#define		CLR_PS_STATE(x)	((x) = ((x) & (0xF0)))
-
-struct reportpwrstate_parm {
-	unsigned char mode;
-	unsigned char state; /* the CPWM value */
-	unsigned short rsvd;
-};
-
-struct	pwrctrl_priv {
-	struct mutex mutex_lock;
-	/*volatile*/ u8 rpwm; /* requested power state for fw */
-	/* fw current power state. updated when 1. read from HCPWM or
-	 * 2. driver lowers power level
-	 */
-	/*volatile*/ u8 cpwm;
-	/*volatile*/ u8 tog; /* toggling */
-	/*volatile*/ u8 cpwm_tog; /* toggling */
-	/*volatile*/ u8 tgt_rpwm; /* wanted power state */
-	uint pwr_mode;
-	uint smart_ps;
-	uint alives;
-	uint ImrContent;	/* used to store original imr. */
-	uint bSleep; /* sleep -> active is different from active -> sleep. */
-
-	struct work_struct SetPSModeWorkItem;
-	struct work_struct rpwm_workitem;
-	struct timer_list rpwm_check_timer;
-	u8	rpwm_retry;
-	uint	bSetPSModeWorkItemInProgress;
-
-	spinlock_t pnp_pwr_mgnt_lock;
-	s32	pnp_current_pwr_state;
-	u8	pnp_bstop_trx;
-	u8	pnp_wwirp_pending;
-};
-
-void r8712_init_pwrctrl_priv(struct _adapter *adapter);
-int r8712_register_cmd_alive(struct _adapter *padapter);
-void r8712_unregister_cmd_alive(struct _adapter *padapter);
-void r8712_cpwm_int_hdl(struct _adapter *padapter,
-			struct reportpwrstate_parm *preportpwrstate);
-void r8712_set_ps_mode(struct _adapter *padapter, uint ps_mode,
-			uint smart_ps);
-void r8712_set_rpwm(struct _adapter *padapter, u8 val8);
-void r8712_flush_rwctrl_works(struct _adapter *padapter);
-
-#endif  /* __RTL871X_PWRCTRL_H_ */
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ /dev/null
@@ -1,671 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_recv.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_RECV_C_
-
-#include <linux/ip.h>
-#include <linux/if_ether.h>
-#include <linux/etherdevice.h>
-#include <linux/ieee80211.h>
-#include <net/cfg80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "mlme_osdep.h"
-#include "ethernet.h"
-#include "usb_ops.h"
-#include "wifi.h"
-
-static const u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
-
-/* Datagram Delivery Protocol */
-static const u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
-
-void _r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
-{
-	memset((u8 *)psta_recvpriv, 0, sizeof(struct sta_recv_priv));
-	spin_lock_init(&psta_recvpriv->lock);
-	_init_queue(&psta_recvpriv->defrag_q);
-}
-
-int _r8712_init_recv_priv(struct recv_priv *precvpriv,
-			  struct _adapter *padapter)
-{
-	int ret;
-	sint i;
-	union recv_frame *precvframe;
-
-	memset((unsigned char *)precvpriv, 0, sizeof(struct  recv_priv));
-	spin_lock_init(&precvpriv->lock);
-	_init_queue(&precvpriv->free_recv_queue);
-	_init_queue(&precvpriv->recv_pending_queue);
-	precvpriv->adapter = padapter;
-	precvpriv->free_recvframe_cnt = NR_RECVFRAME;
-	precvpriv->pallocated_frame_buf = kzalloc(NR_RECVFRAME *
-				sizeof(union recv_frame) + RXFRAME_ALIGN_SZ,
-				GFP_ATOMIC);
-	if (!precvpriv->pallocated_frame_buf)
-		return -ENOMEM;
-	precvpriv->precv_frame_buf = precvpriv->pallocated_frame_buf +
-				    RXFRAME_ALIGN_SZ -
-				    ((addr_t)(precvpriv->pallocated_frame_buf) &
-				    (RXFRAME_ALIGN_SZ - 1));
-	precvframe = (union recv_frame *)precvpriv->precv_frame_buf;
-	for (i = 0; i < NR_RECVFRAME; i++) {
-		INIT_LIST_HEAD(&(precvframe->u.list));
-		list_add_tail(&(precvframe->u.list),
-			      &(precvpriv->free_recv_queue.queue));
-		r8712_os_recv_resource_alloc(padapter, precvframe);
-		precvframe->u.hdr.adapter = padapter;
-		precvframe++;
-	}
-	precvpriv->rx_pending_cnt = 1;
-	ret = r8712_init_recv_priv(precvpriv, padapter);
-	if (ret)
-		kfree(precvpriv->pallocated_frame_buf);
-
-	return ret;
-}
-
-void _r8712_free_recv_priv(struct recv_priv *precvpriv)
-{
-	kfree(precvpriv->pallocated_frame_buf);
-	r8712_free_recv_priv(precvpriv);
-}
-
-union recv_frame *r8712_alloc_recvframe(struct __queue *pfree_recv_queue)
-{
-	unsigned long irqL;
-	union recv_frame  *precvframe;
-	struct _adapter *padapter;
-	struct recv_priv *precvpriv;
-
-	spin_lock_irqsave(&pfree_recv_queue->lock, irqL);
-	precvframe = list_first_entry_or_null(&pfree_recv_queue->queue,
-					      union recv_frame, u.hdr.list);
-	if (precvframe) {
-		list_del_init(&precvframe->u.hdr.list);
-		padapter = precvframe->u.hdr.adapter;
-		if (padapter) {
-			precvpriv = &padapter->recvpriv;
-			if (pfree_recv_queue == &precvpriv->free_recv_queue)
-				precvpriv->free_recvframe_cnt--;
-		}
-	}
-	spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL);
-	return precvframe;
-}
-
-/*
- * caller : defrag; recvframe_chk_defrag in recv_thread  (passive)
- * pframequeue: defrag_queue : will be accessed in recv_thread  (passive)
- * using spin_lock to protect
- */
-void r8712_free_recvframe_queue(struct  __queue *pframequeue,
-				struct  __queue *pfree_recv_queue)
-{
-	union	recv_frame *precvframe;
-	struct list_head *plist, *phead;
-
-	spin_lock(&pframequeue->lock);
-	phead = &pframequeue->queue;
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist)) {
-		precvframe = container_of(plist, union recv_frame, u.list);
-		plist = plist->next;
-		r8712_free_recvframe(precvframe, pfree_recv_queue);
-	}
-	spin_unlock(&pframequeue->lock);
-}
-
-sint r8712_recvframe_chkmic(struct _adapter *adapter,
-			    union recv_frame *precvframe)
-{
-	sint i, res = _SUCCESS;
-	u32	datalen;
-	u8 miccode[8];
-	u8 bmic_err = false;
-	u8 *pframe, *payload, *pframemic;
-	u8   *mickey, idx, *iv;
-	struct	sta_info *stainfo;
-	struct	rx_pkt_attrib *prxattrib = &precvframe->u.hdr.attrib;
-	struct	security_priv *psecuritypriv = &adapter->securitypriv;
-
-	stainfo = r8712_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
-	if (prxattrib->encrypt == _TKIP_) {
-		/* calculate mic code */
-		if (stainfo) {
-			if (is_multicast_ether_addr(prxattrib->ra)) {
-				iv = precvframe->u.hdr.rx_data +
-				     prxattrib->hdrlen;
-				idx = iv[3];
-				mickey = &psecuritypriv->XGrprxmickey[(((idx >>
-					 6) & 0x3)) - 1].skey[0];
-				if (!psecuritypriv->binstallGrpkey)
-					return _FAIL;
-			} else {
-				mickey = &stainfo->tkiprxmickey.skey[0];
-			}
-			/*icv_len included the mic code*/
-			datalen = precvframe->u.hdr.len - prxattrib->hdrlen -
-				  prxattrib->iv_len - prxattrib->icv_len - 8;
-			pframe = precvframe->u.hdr.rx_data;
-			payload = pframe + prxattrib->hdrlen +
-				  prxattrib->iv_len;
-			seccalctkipmic(mickey, pframe, payload, datalen,
-				       &miccode[0],
-				       (unsigned char)prxattrib->priority);
-			pframemic = payload + datalen;
-			bmic_err = false;
-			for (i = 0; i < 8; i++) {
-				if (miccode[i] != *(pframemic + i))
-					bmic_err = true;
-			}
-			if (bmic_err) {
-				if (prxattrib->bdecrypted)
-					r8712_handle_tkip_mic_err(adapter,
-								  (u8)is_multicast_ether_addr(prxattrib->ra));
-				res = _FAIL;
-			} else {
-				/* mic checked ok */
-				if (!psecuritypriv->bcheck_grpkey &&
-				    is_multicast_ether_addr(prxattrib->ra))
-					psecuritypriv->bcheck_grpkey = true;
-			}
-			recvframe_pull_tail(precvframe, 8);
-		}
-	}
-	return res;
-}
-
-/* decrypt and set the ivlen,icvlen of the recv_frame */
-union recv_frame *r8712_decryptor(struct _adapter *padapter,
-				  union recv_frame *precv_frame)
-{
-	struct rx_pkt_attrib *prxattrib = &precv_frame->u.hdr.attrib;
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-	union recv_frame *return_packet = precv_frame;
-
-	if ((prxattrib->encrypt > 0) && ((prxattrib->bdecrypted == 0) ||
-					 psecuritypriv->sw_decrypt)) {
-		psecuritypriv->hw_decrypted = false;
-		switch (prxattrib->encrypt) {
-		case _WEP40_:
-		case _WEP104_:
-			r8712_wep_decrypt(padapter, (u8 *)precv_frame);
-			break;
-		case _TKIP_:
-			r8712_tkip_decrypt(padapter, (u8 *)precv_frame);
-			break;
-		case _AES_:
-			r8712_aes_decrypt(padapter, (u8 *)precv_frame);
-			break;
-		default:
-				break;
-		}
-	} else if (prxattrib->bdecrypted == 1) {
-		psecuritypriv->hw_decrypted = true;
-	}
-	return return_packet;
-}
-
-/*###set the security information in the recv_frame */
-union recv_frame *r8712_portctrl(struct _adapter *adapter,
-				 union recv_frame *precv_frame)
-{
-	u8 *psta_addr, *ptr;
-	uint auth_alg;
-	struct recv_frame_hdr *pfhdr;
-	struct sta_info *psta;
-	struct	sta_priv *pstapriv;
-	union recv_frame *prtnframe;
-	u16 ether_type;
-
-	pstapriv = &adapter->stapriv;
-	ptr = precv_frame->u.hdr.rx_data;
-	pfhdr = &precv_frame->u.hdr;
-	psta_addr = pfhdr->attrib.ta;
-	psta = r8712_get_stainfo(pstapriv, psta_addr);
-	auth_alg = adapter->securitypriv.AuthAlgrthm;
-	if (auth_alg == 2) {
-		/* get ether_type */
-		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
-		ether_type = get_unaligned_be16(ptr);
-
-		if (psta && psta->ieee8021x_blocked) {
-			/* blocked
-			 * only accept EAPOL frame
-			 */
-			if (ether_type == 0x888e) {
-				prtnframe = precv_frame;
-			} else {
-				/*free this frame*/
-				r8712_free_recvframe(precv_frame,
-						     &adapter->recvpriv.free_recv_queue);
-				prtnframe = NULL;
-			}
-		} else {
-			/* allowed
-			 * check decryption status, and decrypt the
-			 * frame if needed
-			 */
-			prtnframe = precv_frame;
-			/* check is the EAPOL frame or not (Rekey) */
-			if (ether_type == 0x888e) {
-				/* check Rekey */
-				prtnframe = precv_frame;
-			}
-		}
-	} else {
-		prtnframe = precv_frame;
-	}
-	return prtnframe;
-}
-
-static sint recv_decache(union recv_frame *precv_frame, u8 bretry,
-			 struct stainfo_rxcache *prxcache)
-{
-	sint tid = precv_frame->u.hdr.attrib.priority;
-	u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num & 0xffff) << 4) |
-			(precv_frame->u.hdr.attrib.frag_num & 0xf);
-
-	if (tid > 15)
-		return _FAIL;
-	if (seq_ctrl == prxcache->tid_rxseq[tid])
-		return _FAIL;
-	prxcache->tid_rxseq[tid] = seq_ctrl;
-	return _SUCCESS;
-}
-
-static sint sta2sta_data_frame(struct _adapter *adapter,
-			       union recv_frame *precv_frame,
-			       struct sta_info **psta)
-{
-	u8 *ptr = precv_frame->u.hdr.rx_data;
-	sint ret = _SUCCESS;
-	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-	struct	sta_priv *pstapriv = &adapter->stapriv;
-	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	u8 *mybssid  = get_bssid(pmlmepriv);
-	u8 *myhwaddr = myid(&adapter->eeprompriv);
-	u8 *sta_addr = NULL;
-	bool bmcast = is_multicast_ether_addr(pattrib->dst);
-
-	if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
-	    check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
-		/* filter packets that SA is myself or multicast or broadcast */
-		if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN))
-			return _FAIL;
-		if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast))
-			return _FAIL;
-		if (is_zero_ether_addr(pattrib->bssid) ||
-		    is_zero_ether_addr(mybssid) ||
-		    (memcmp(pattrib->bssid, mybssid, ETH_ALEN)))
-			return _FAIL;
-		sta_addr = pattrib->src;
-	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
-		/* For Station mode, sa and bssid should always be BSSID,
-		 * and DA is my mac-address
-		 */
-		if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN))
-			return _FAIL;
-		sta_addr = pattrib->bssid;
-	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
-		if (bmcast) {
-			/* For AP mode, if DA == MCAST, then BSSID should
-			 * be also MCAST
-			 */
-			if (!is_multicast_ether_addr(pattrib->bssid))
-				return _FAIL;
-		} else { /* not mc-frame */
-			/* For AP mode, if DA is non-MCAST, then it must be
-			 * BSSID, and bssid == BSSID
-			 */
-			if (memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN))
-				return _FAIL;
-			sta_addr = pattrib->src;
-		}
-	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
-		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
-		sta_addr = mybssid;
-	} else {
-		ret  = _FAIL;
-	}
-	if (bmcast)
-		*psta = r8712_get_bcmc_stainfo(adapter);
-	else
-		*psta = r8712_get_stainfo(pstapriv, sta_addr); /* get ap_info */
-	if (!*psta) {
-		if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
-			adapter->mppriv.rx_pktloss++;
-		return _FAIL;
-	}
-	return ret;
-}
-
-static sint ap2sta_data_frame(struct _adapter *adapter,
-			      union recv_frame *precv_frame,
-			      struct sta_info **psta)
-{
-	u8 *ptr = precv_frame->u.hdr.rx_data;
-	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-	struct	sta_priv *pstapriv = &adapter->stapriv;
-	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	u8 *mybssid  = get_bssid(pmlmepriv);
-	u8 *myhwaddr = myid(&adapter->eeprompriv);
-	bool bmcast = is_multicast_ether_addr(pattrib->dst);
-
-	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) &&
-	    check_fwstate(pmlmepriv, _FW_LINKED)) {
-		/* if NULL-frame, drop packet */
-		if ((GetFrameSubType(ptr)) == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC))
-			return _FAIL;
-		/* drop QoS-SubType Data, including QoS NULL,
-		 * excluding QoS-Data
-		 */
-		if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) ==
-		     WIFI_QOS_DATA_TYPE) {
-			if (GetFrameSubType(ptr) & (BIT(4) | BIT(5) | BIT(6)))
-				return _FAIL;
-		}
-
-		/* filter packets that SA is myself or multicast or broadcast */
-		if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN))
-			return _FAIL;
-
-		/* da should be for me */
-		if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast))
-			return _FAIL;
-		/* check BSSID */
-		if (is_zero_ether_addr(pattrib->bssid) ||
-		    is_zero_ether_addr(mybssid) ||
-		     (memcmp(pattrib->bssid, mybssid, ETH_ALEN)))
-			return _FAIL;
-		if (bmcast)
-			*psta = r8712_get_bcmc_stainfo(adapter);
-		else
-			*psta = r8712_get_stainfo(pstapriv, pattrib->bssid);
-		if (!*psta)
-			return _FAIL;
-	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE) &&
-		   check_fwstate(pmlmepriv, _FW_LINKED)) {
-		memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
-		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
-		memcpy(pattrib->bssid,  mybssid, ETH_ALEN);
-		*psta = r8712_get_stainfo(pstapriv, pattrib->bssid);
-		if (!*psta)
-			return _FAIL;
-	} else {
-		return _FAIL;
-	}
-	return _SUCCESS;
-}
-
-static sint sta2ap_data_frame(struct _adapter *adapter,
-			      union recv_frame *precv_frame,
-			      struct sta_info **psta)
-{
-	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-	struct	sta_priv *pstapriv = &adapter->stapriv;
-	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
-	unsigned char *mybssid  = get_bssid(pmlmepriv);
-
-	if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
-		/* For AP mode, if DA is non-MCAST, then it must be BSSID,
-		 * and bssid == BSSID
-		 * For AP mode, RA=BSSID, TX=STA(SRC_ADDR), A3=DST_ADDR
-		 */
-		if (memcmp(pattrib->bssid, mybssid, ETH_ALEN))
-			return _FAIL;
-		*psta = r8712_get_stainfo(pstapriv, pattrib->src);
-		if (!*psta)
-			return _FAIL;
-	}
-	return _SUCCESS;
-}
-
-static sint validate_recv_ctrl_frame(struct _adapter *adapter,
-				     union recv_frame *precv_frame)
-{
-	return _FAIL;
-}
-
-static sint validate_recv_mgnt_frame(struct _adapter *adapter,
-				     union recv_frame *precv_frame)
-{
-	return _FAIL;
-}
-
-static sint validate_recv_data_frame(struct _adapter *adapter,
-				     union recv_frame *precv_frame)
-{
-	int res;
-	u8 bretry;
-	u8 *psa, *pda, *pbssid;
-	struct sta_info *psta = NULL;
-	u8 *ptr = precv_frame->u.hdr.rx_data;
-	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-	struct security_priv *psecuritypriv = &adapter->securitypriv;
-
-	bretry = GetRetry(ptr);
-	pda = ieee80211_get_DA((struct ieee80211_hdr *)ptr);
-	psa = ieee80211_get_SA((struct ieee80211_hdr *)ptr);
-	pbssid = get_hdr_bssid(ptr);
-	if (!pbssid)
-		return _FAIL;
-	memcpy(pattrib->dst, pda, ETH_ALEN);
-	memcpy(pattrib->src, psa, ETH_ALEN);
-	memcpy(pattrib->bssid, pbssid, ETH_ALEN);
-	switch (pattrib->to_fr_ds) {
-	case 0:
-		memcpy(pattrib->ra, pda, ETH_ALEN);
-		memcpy(pattrib->ta, psa, ETH_ALEN);
-		res = sta2sta_data_frame(adapter, precv_frame, &psta);
-		break;
-	case 1:
-		memcpy(pattrib->ra, pda, ETH_ALEN);
-		memcpy(pattrib->ta, pbssid, ETH_ALEN);
-		res = ap2sta_data_frame(adapter, precv_frame, &psta);
-		break;
-	case 2:
-		memcpy(pattrib->ra, pbssid, ETH_ALEN);
-		memcpy(pattrib->ta, psa, ETH_ALEN);
-		res = sta2ap_data_frame(adapter, precv_frame, &psta);
-		break;
-	case 3:
-		memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
-		memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
-		return _FAIL;
-	default:
-		return _FAIL;
-	}
-	if (res == _FAIL)
-		return _FAIL;
-	if (!psta)
-		return _FAIL;
-	precv_frame->u.hdr.psta = psta;
-	pattrib->amsdu = 0;
-	/* parsing QC field */
-	if (pattrib->qos == 1) {
-		pattrib->priority = GetPriority((ptr + 24));
-		pattrib->ack_policy = GetAckpolicy((ptr + 24));
-		pattrib->amsdu = GetAMsdu((ptr + 24));
-		pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 32 : 26;
-	} else {
-		pattrib->priority = 0;
-		pattrib->hdrlen = (pattrib->to_fr_ds == 3) ? 30 : 24;
-	}
-
-	if (pattrib->order)/*HT-CTRL 11n*/
-		pattrib->hdrlen += 4;
-	precv_frame->u.hdr.preorder_ctrl =
-			 &psta->recvreorder_ctrl[pattrib->priority];
-
-	/* decache, drop duplicate recv packets */
-	if (recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) ==
-	    _FAIL)
-		return _FAIL;
-
-	if (pattrib->privacy) {
-		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt,
-			       is_multicast_ether_addr(pattrib->ra));
-		SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len,
-			       pattrib->encrypt);
-	} else {
-		pattrib->encrypt = 0;
-		pattrib->iv_len = pattrib->icv_len = 0;
-	}
-	return _SUCCESS;
-}
-
-sint r8712_validate_recv_frame(struct _adapter *adapter,
-			       union recv_frame *precv_frame)
-{
-	/*shall check frame subtype, to / from ds, da, bssid */
-	/*then call check if rx seq/frag. duplicated.*/
-
-	u8 type;
-	u8 subtype;
-	sint retval = _SUCCESS;
-	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
-
-	u8 *ptr = precv_frame->u.hdr.rx_data;
-	u8  ver = (unsigned char)(*ptr) & 0x3;
-
-	/*add version chk*/
-	if (ver != 0)
-		return _FAIL;
-	type =  GetFrameType(ptr);
-	subtype = GetFrameSubType(ptr); /*bit(7)~bit(2)*/
-	pattrib->to_fr_ds = get_tofr_ds(ptr);
-	pattrib->frag_num = GetFragNum(ptr);
-	pattrib->seq_num = GetSequence(ptr);
-	pattrib->pw_save = GetPwrMgt(ptr);
-	pattrib->mfrag = GetMFrag(ptr);
-	pattrib->mdata = GetMData(ptr);
-	pattrib->privacy =  GetPrivacy(ptr);
-	pattrib->order = GetOrder(ptr);
-	switch (type) {
-	case IEEE80211_FTYPE_MGMT:
-		retval = validate_recv_mgnt_frame(adapter, precv_frame);
-		break;
-	case IEEE80211_FTYPE_CTL:
-		retval = validate_recv_ctrl_frame(adapter, precv_frame);
-		break;
-	case IEEE80211_FTYPE_DATA:
-		pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
-		retval = validate_recv_data_frame(adapter, precv_frame);
-		break;
-	default:
-		return _FAIL;
-	}
-	return retval;
-}
-
-int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe)
-{
-	/*remove the wlanhdr and add the eth_hdr*/
-	sint	rmv_len;
-	u16	len;
-	u8	bsnaphdr;
-	u8	*psnap_type;
-	struct ieee80211_snap_hdr *psnap;
-	struct _adapter	*adapter = precvframe->u.hdr.adapter;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-	u8 *ptr = precvframe->u.hdr.rx_data; /*point to frame_ctrl field*/
-	struct rx_pkt_attrib *pattrib = &precvframe->u.hdr.attrib;
-
-	if (pattrib->encrypt)
-		recvframe_pull_tail(precvframe, pattrib->icv_len);
-	psnap = (struct ieee80211_snap_hdr *)(ptr + pattrib->hdrlen +
-		 pattrib->iv_len);
-	psnap_type = ptr + pattrib->hdrlen + pattrib->iv_len + SNAP_SIZE;
-	/* convert hdr + possible LLC headers into Ethernet header */
-	if ((!memcmp(psnap, (void *)rfc1042_header, SNAP_SIZE) &&
-	     (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_IPX, 2)) &&
-	    (memcmp(psnap_type, (void *)SNAP_ETH_TYPE_APPLETALK_AARP, 2))) ||
-	     !memcmp(psnap, (void *)bridge_tunnel_header, SNAP_SIZE)) {
-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
-		 * replace EtherType
-		 */
-		bsnaphdr = true;
-	} else {
-		/* Leave Ethernet header part of hdr and full payload */
-		bsnaphdr = false;
-	}
-	rmv_len = pattrib->hdrlen + pattrib->iv_len +
-		  (bsnaphdr ? SNAP_SIZE : 0);
-	len = precvframe->u.hdr.len - rmv_len;
-	if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		ptr += rmv_len;
-		*ptr = 0x87;
-		*(ptr + 1) = 0x12;
-		/* append rx status for mp test packets */
-		ptr = recvframe_pull(precvframe, (rmv_len -
-		      sizeof(struct ethhdr) + 2) - 24);
-		if (!ptr)
-			return -ENOMEM;
-		memcpy(ptr, get_rxmem(precvframe), 24);
-		ptr += 24;
-	} else {
-		ptr = recvframe_pull(precvframe, (rmv_len -
-		      sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
-		if (!ptr)
-			return -ENOMEM;
-	}
-
-	memcpy(ptr, pattrib->dst, ETH_ALEN);
-	memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
-	if (!bsnaphdr) {
-		__be16 be_tmp = htons(len);
-
-		memcpy(ptr + 12, &be_tmp, 2);
-	}
-	return 0;
-}
-
-void r8712_recv_entry(union recv_frame *precvframe)
-{
-	struct _adapter *padapter;
-	struct recv_priv *precvpriv;
-
-	s32 ret = _SUCCESS;
-
-	padapter = precvframe->u.hdr.adapter;
-	precvpriv = &(padapter->recvpriv);
-
-	padapter->ledpriv.LedControlHandler(padapter, LED_CTL_RX);
-
-	ret = recv_func(padapter, precvframe);
-	if (ret == _FAIL)
-		goto _recv_entry_drop;
-	precvpriv->rx_pkts++;
-	precvpriv->rx_bytes += (uint)(precvframe->u.hdr.rx_tail -
-				precvframe->u.hdr.rx_data);
-	return;
-_recv_entry_drop:
-	precvpriv->rx_drop++;
-	padapter->mppriv.rx_pktloss = precvpriv->rx_drop;
-}
--- a/drivers/staging/rtl8712/rtl871x_recv.h
+++ /dev/null
@@ -1,208 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _RTL871X_RECV_H_
-#define _RTL871X_RECV_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define NR_RECVFRAME 256
-
-#define RXFRAME_ALIGN	8
-#define RXFRAME_ALIGN_SZ	(1 << RXFRAME_ALIGN)
-
-#define MAX_SUBFRAME_COUNT	64
-
-/* for Rx reordering buffer control */
-struct recv_reorder_ctrl {
-	struct _adapter	*padapter;
-	u16 indicate_seq; /* =wstart_b, init_value=0xffff */
-	u16 wend_b;
-	u8 wsize_b;
-	struct  __queue pending_recvframe_queue;
-	struct timer_list reordering_ctrl_timer;
-};
-
-struct	stainfo_rxcache	{
-	u16	tid_rxseq[16];
-};
-
-#define		PHY_RSSI_SLID_WIN_MAX			100
-#define		PHY_LINKQUALITY_SLID_WIN_MAX		20
-
-struct smooth_rssi_data {
-	u32	elements[100];	/* array to store values */
-	u32	index;		/* index to current array to store */
-	u32	total_num;	/* num of valid elements */
-	u32	total_val;	/* sum of valid elements */
-};
-
-struct rx_pkt_attrib {
-	u8	amsdu;
-	u8	order;
-	u8	qos;
-	u8	to_fr_ds;
-	u8	frag_num;
-	u16	seq_num;
-	u8   pw_save;
-	u8    mfrag;
-	u8    mdata;
-	u8	privacy; /* in frame_ctrl field */
-	u8	bdecrypted;
-	int	hdrlen;	 /* the WLAN Header Len */
-	int	encrypt; /* 0 no encrypt. != 0 encrypt algorithm */
-	int	iv_len;
-	int	icv_len;
-	int	priority;
-	int	ack_policy;
-	u8	crc_err;
-	u8	dst[ETH_ALEN];
-	u8	src[ETH_ALEN];
-	u8	ta[ETH_ALEN];
-	u8	ra[ETH_ALEN];
-	u8	bssid[ETH_ALEN];
-	u8	tcpchk_valid; /* 0: invalid, 1: valid */
-	u8	ip_chkrpt; /* 0: incorrect, 1: correct */
-	u8	tcp_chkrpt; /* 0: incorrect, 1: correct */
-	u8	signal_qual;
-	s8	rx_mimo_signal_qual[2];
-	u8	mcs_rate;
-	u8	htc;
-	u8	signal_strength;
-};
-
-/*
- * accesser of recv_priv: recv_entry(dispatch / passive level);
- * recv_thread(passive) ; returnpkt(dispatch)
- * ; halt(passive) ;
- *
- * using enter_critical section to protect
- */
-struct recv_priv {
-	spinlock_t lock;
-	struct  __queue	free_recv_queue;
-	struct  __queue	recv_pending_queue;
-	u8 *pallocated_frame_buf;
-	u8 *precv_frame_buf;
-	uint free_recvframe_cnt;
-	struct _adapter	*adapter;
-	uint	rx_bytes;
-	uint	rx_pkts;
-	uint	rx_drop;
-	uint  rx_icv_err;
-	uint  rx_largepacket_crcerr;
-	uint  rx_smallpacket_crcerr;
-	uint  rx_middlepacket_crcerr;
-	u8  rx_pending_cnt;
-	uint	ff_hwaddr;
-	struct tasklet_struct recv_tasklet;
-	struct sk_buff_head free_recv_skb_queue;
-	struct sk_buff_head rx_skb_queue;
-	u8 *pallocated_recv_buf;
-	u8 *precv_buf;    /* 4 alignment */
-	struct  __queue	free_recv_buf_queue;
-	u32	free_recv_buf_queue_cnt;
-	/* For the phy information */
-	s8 rssi;
-	u8 signal;
-	u8 noise;
-	u8 fw_rssi;
-	struct smooth_rssi_data signal_qual_data;
-	struct smooth_rssi_data signal_strength_data;
-};
-
-struct sta_recv_priv {
-	spinlock_t lock;
-	sint	option;
-	struct  __queue defrag_q; /* keeping the fragment frame until defrag */
-	struct	stainfo_rxcache rxcache;
-	uint	sta_rx_bytes;
-	uint	sta_rx_pkts;
-	uint	sta_rx_fail;
-};
-
-#include "rtl8712_recv.h"
-
-/* get a free recv_frame from pfree_recv_queue */
-union recv_frame *r8712_alloc_recvframe(struct  __queue *pfree_recv_queue);
-void r8712_free_recvframe(union recv_frame *precvframe,
-			  struct  __queue *pfree_recv_queue);
-void r8712_free_recvframe_queue(struct  __queue *pframequeue,
-				 struct  __queue *pfree_recv_queue);
-int r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe);
-int recv_func(struct _adapter *padapter, void *pcontext);
-
-static inline u8 *get_rxmem(union recv_frame *precvframe)
-{
-	/* always return rx_head... */
-	if (!precvframe)
-		return NULL;
-	return precvframe->u.hdr.rx_head;
-}
-
-static inline u8 *recvframe_pull(union recv_frame *precvframe, sint sz)
-{
-	/* used for extract sz bytes from rx_data, update rx_data and return
-	 * the updated rx_data to the caller
-	 */
-	if (!precvframe)
-		return NULL;
-	precvframe->u.hdr.rx_data += sz;
-	if (precvframe->u.hdr.rx_data > precvframe->u.hdr.rx_tail) {
-		precvframe->u.hdr.rx_data -= sz;
-		return NULL;
-	}
-	precvframe->u.hdr.len -= sz;
-	return precvframe->u.hdr.rx_data;
-}
-
-static inline u8 *recvframe_put(union recv_frame *precvframe, sint sz)
-{
-	/* used for append sz bytes from ptr to rx_tail, update rx_tail and
-	 * return the updated rx_tail to the caller
-	 * after putting, rx_tail must be still larger than rx_end.
-	 */
-	if (!precvframe)
-		return NULL;
-	precvframe->u.hdr.rx_tail += sz;
-	if (precvframe->u.hdr.rx_tail > precvframe->u.hdr.rx_end) {
-		precvframe->u.hdr.rx_tail -= sz;
-		return NULL;
-	}
-	precvframe->u.hdr.len += sz;
-	return precvframe->u.hdr.rx_tail;
-}
-
-static inline u8 *recvframe_pull_tail(union recv_frame *precvframe, sint sz)
-{
-	/* rmv data from rx_tail (by yitsen)
-	 * used for extract sz bytes from rx_end, update rx_end and return the
-	 * updated rx_end to the caller
-	 * after pulling, rx_end must be still larger than rx_data.
-	 */
-	if (!precvframe)
-		return NULL;
-	precvframe->u.hdr.rx_tail -= sz;
-	if (precvframe->u.hdr.rx_tail < precvframe->u.hdr.rx_data) {
-		precvframe->u.hdr.rx_tail += sz;
-		return NULL;
-	}
-	precvframe->u.hdr.len -= sz;
-	return precvframe->u.hdr.rx_tail;
-}
-
-struct sta_info;
-
-void	_r8712_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv);
-sint r8712_recvframe_chkmic(struct _adapter *adapter,
-			    union recv_frame *precvframe);
-union recv_frame *r8712_decryptor(struct _adapter *adapter,
-				  union recv_frame *precv_frame);
-union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *adapter,
-					     union recv_frame *precv_frame);
-int r8712_validate_recv_frame(struct _adapter *adapter,
-			      union recv_frame *precv_frame);
-union recv_frame *r8712_portctrl(struct _adapter *adapter,
-				 union recv_frame *precv_frame);
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_rf.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef	__RTL871X_RF_H_
-#define __RTL871X_RF_H_
-
-#include "rtl871x_cmd.h"
-#include "rtl871x_mp_phy_regdef.h"
-
-#define OFDM_PHY		1
-#define MIXED_PHY		2
-#define CCK_PHY		3
-#define NumRates	(13)
-#define RTL8711_RF_MAX_SENS 6
-#define RTL8711_RF_DEF_SENS 4
-#define NUM_CHANNELS	15
-
-struct	regulatory_class {
-	u32	starting_freq;		/*MHz, */
-	u8	channel_set[NUM_CHANNELS];
-	u8	channel_cck_power[NUM_CHANNELS]; /*dbm*/
-	u8	channel_ofdm_power[NUM_CHANNELS];/*dbm*/
-	u8	txpower_limit;		/*dbm*/
-	u8	channel_spacing;	/*MHz*/
-	u8	modem;
-};
-
-enum	_REG_PREAMBLE_MODE {
-	PREAMBLE_LONG	= 1,
-	PREAMBLE_AUTO	= 2,
-	PREAMBLE_SHORT	= 3,
-};
-
-enum {
-	RTL8712_RFC_1T = 0x10,
-	RTL8712_RFC_2T = 0x20,
-	RTL8712_RFC_1R = 0x01,
-	RTL8712_RFC_2R = 0x02,
-	RTL8712_RFC_1T1R = 0x11,
-	RTL8712_RFC_1T2R = 0x12,
-	RTL8712_RFC_TURBO = 0x92,
-	RTL8712_RFC_2T2R = 0x22
-};
-
-#endif /*__RTL871X_RF_H_*/
--- a/drivers/staging/rtl8712/rtl871x_security.c
+++ /dev/null
@@ -1,1386 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_security.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define  _RTL871X_SECURITY_C_
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kref.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/circ_buf.h>
-#include <linux/uaccess.h>
-#include <asm/byteorder.h>
-#include <linux/atomic.h>
-#include <linux/crc32poly.h>
-#include <linux/semaphore.h>
-#include <linux/ieee80211.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-/* =====WEP related===== */
-
-struct arc4context {
-	u32 x;
-	u32 y;
-	u8 state[256];
-};
-
-static void arcfour_init(struct arc4context *parc4ctx, u8 *key, u32 key_len)
-{
-	u32	t, u;
-	u32	keyindex;
-	u32	stateindex;
-	u8 *state;
-	u32	counter;
-
-	state = parc4ctx->state;
-	parc4ctx->x = 0;
-	parc4ctx->y = 0;
-	for (counter = 0; counter < 256; counter++)
-		state[counter] = (u8)counter;
-	keyindex = 0;
-	stateindex = 0;
-	for (counter = 0; counter < 256; counter++) {
-		t = state[counter];
-		stateindex = (stateindex + key[keyindex] + t) & 0xff;
-		u = state[stateindex];
-		state[stateindex] = (u8)t;
-		state[counter] = (u8)u;
-		if (++keyindex >= key_len)
-			keyindex = 0;
-	}
-}
-
-static u32 arcfour_byte(struct arc4context *parc4ctx)
-{
-	u32 x;
-	u32 y;
-	u32 sx, sy;
-	u8 *state;
-
-	state = parc4ctx->state;
-	x = (parc4ctx->x + 1) & 0xff;
-	sx = state[x];
-	y = (sx + parc4ctx->y) & 0xff;
-	sy = state[y];
-	parc4ctx->x = x;
-	parc4ctx->y = y;
-	state[y] = (u8)sx;
-	state[x] = (u8)sy;
-	return state[(sx + sy) & 0xff];
-}
-
-static void arcfour_encrypt(struct arc4context	*parc4ctx,
-		     u8 *dest, u8 *src, u32 len)
-{
-	u32 i;
-
-	for (i = 0; i < len; i++)
-		dest[i] = src[i] ^ (unsigned char)arcfour_byte(parc4ctx);
-}
-
-static sint bcrc32initialized;
-static u32 crc32_table[256];
-
-static u8 crc32_reverseBit(u8 data)
-{
-	return ((u8)(data << 7) & 0x80) | ((data << 5) & 0x40) | ((data << 3)
-		 & 0x20) | ((data << 1) & 0x10) | ((data >> 1) & 0x08) |
-		 ((data >> 3) & 0x04) | ((data >> 5) & 0x02) | ((data >> 7) &
-		 0x01);
-}
-
-static void crc32_init(void)
-{
-	sint i, j;
-	u32 c;
-	u8 *p = (u8 *)&c, *p1;
-	u8 k;
-
-	if (bcrc32initialized == 1)
-		return;
-
-	for (i = 0; i < 256; ++i) {
-		k = crc32_reverseBit((u8)i);
-		for (c = ((u32)k) << 24, j = 8; j > 0; --j)
-			c = c & 0x80000000 ? (c << 1) ^ CRC32_POLY_BE : (c << 1);
-		p1 = (u8 *)&crc32_table[i];
-		p1[0] = crc32_reverseBit(p[3]);
-		p1[1] = crc32_reverseBit(p[2]);
-		p1[2] = crc32_reverseBit(p[1]);
-		p1[3] = crc32_reverseBit(p[0]);
-	}
-	bcrc32initialized = 1;
-}
-
-static u32 getcrc32(u8 *buf, u32 len)
-{
-	u8 *p;
-	u32  crc;
-
-	if (!bcrc32initialized)
-		crc32_init();
-	crc = 0xffffffff; /* preload shift register, per CRC-32 spec */
-	for (p = buf; len > 0; ++p, --len)
-		crc = crc32_table[(crc ^ *p) & 0xff] ^ (crc >> 8);
-	return ~crc;    /* transmit complement, per CRC-32 spec */
-}
-
-/*
- * Need to consider the fragment situation
- */
-void r8712_wep_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{	/* exclude ICV */
-	unsigned char	crc[4];
-	struct arc4context  mycontext;
-	u32 curfragnum, length, keylength, pki;
-	u8 *pframe, *payload, *iv;    /*,*wepkey*/
-	u8 wepkey[16];
-	struct	pkt_attrib  *pattrib = &((struct xmit_frame *)
-				       pxmitframe)->attrib;
-	struct	security_priv *psecuritypriv = &padapter->securitypriv;
-	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
-	if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
-		return;
-	pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
-	/*start to encrypt each fragment*/
-	if ((pattrib->encrypt == _WEP40_) || (pattrib->encrypt == _WEP104_)) {
-		pki = psecuritypriv->PrivacyKeyIndex;
-		keylength = psecuritypriv->DefKeylen[pki];
-		for (curfragnum = 0; curfragnum < pattrib->nr_frags;
-		     curfragnum++) {
-			iv = pframe + pattrib->hdrlen;
-			memcpy(&wepkey[0], iv, 3);
-			memcpy(&wepkey[3], &psecuritypriv->DefKey[
-				psecuritypriv->PrivacyKeyIndex].skey[0],
-				keylength);
-			payload = pframe + pattrib->iv_len + pattrib->hdrlen;
-			if ((curfragnum + 1) == pattrib->nr_frags) {
-				length = pattrib->last_txcmdsz -
-					pattrib->hdrlen -
-					pattrib->iv_len -
-					pattrib->icv_len;
-				*((__le32 *)crc) = cpu_to_le32(getcrc32(
-						payload, length));
-				arcfour_init(&mycontext, wepkey, 3 + keylength);
-				arcfour_encrypt(&mycontext, payload, payload,
-						length);
-				arcfour_encrypt(&mycontext, payload + length,
-						crc, 4);
-			} else {
-				length = pxmitpriv->frag_len -
-					 pattrib->hdrlen - pattrib->iv_len -
-					 pattrib->icv_len;
-				*((__le32 *)crc) = cpu_to_le32(getcrc32(
-						payload, length));
-				arcfour_init(&mycontext, wepkey, 3 + keylength);
-				arcfour_encrypt(&mycontext, payload, payload,
-						length);
-				arcfour_encrypt(&mycontext, payload + length,
-						crc, 4);
-				pframe += pxmitpriv->frag_len;
-				pframe = (u8 *)RND4((addr_t)(pframe));
-			}
-		}
-	}
-}
-
-void r8712_wep_decrypt(struct _adapter  *padapter, u8 *precvframe)
-{
-	/* exclude ICV */
-	u8 crc[4];
-	struct arc4context  mycontext;
-	u32 length, keylength;
-	u8 *pframe, *payload, *iv, wepkey[16];
-	u8  keyindex;
-	struct rx_pkt_attrib  *prxattrib = &(((union recv_frame *)
-					  precvframe)->u.hdr.attrib);
-	struct security_priv *psecuritypriv = &padapter->securitypriv;
-
-	pframe = (unsigned char *)((union recv_frame *)precvframe)->
-		  u.hdr.rx_data;
-	/* start to decrypt recvframe */
-	if ((prxattrib->encrypt == _WEP40_) || (prxattrib->encrypt ==
-	     _WEP104_)) {
-		iv = pframe + prxattrib->hdrlen;
-		keyindex = (iv[3] & 0x3);
-		keylength = psecuritypriv->DefKeylen[keyindex];
-		memcpy(&wepkey[0], iv, 3);
-		memcpy(&wepkey[3], &psecuritypriv->DefKey[
-			psecuritypriv->PrivacyKeyIndex].skey[0],
-			keylength);
-		length = ((union recv_frame *)precvframe)->
-			   u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len;
-		payload = pframe + prxattrib->iv_len + prxattrib->hdrlen;
-		/* decrypt payload include icv */
-		arcfour_init(&mycontext, wepkey, 3 + keylength);
-		arcfour_encrypt(&mycontext, payload, payload,  length);
-		/* calculate icv and compare the icv */
-		*((__le32 *)crc) = cpu_to_le32(getcrc32(payload, length - 4));
-	}
-}
-
-/* 3 =====TKIP related===== */
-
-static u32 secmicgetuint32(u8 *p)
-/* Convert from Byte[] to Us4Byte32 in a portable way */
-{
-	s32 i;
-	u32 res = 0;
-
-	for (i = 0; i < 4; i++)
-		res |= ((u32)(*p++)) << (8 * i);
-	return res;
-}
-
-static void secmicputuint32(u8 *p, u32 val)
-/* Convert from Us4Byte32 to Byte[] in a portable way */
-{
-	long i;
-
-	for (i = 0; i < 4; i++) {
-		*p++ = (u8)(val & 0xff);
-		val >>= 8;
-	}
-}
-
-static void secmicclear(struct mic_data *pmicdata)
-{
-/* Reset the state to the empty message. */
-	pmicdata->L = pmicdata->K0;
-	pmicdata->R = pmicdata->K1;
-	pmicdata->nBytesInM = 0;
-	pmicdata->M = 0;
-}
-
-void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key)
-{
-	/* Set the key */
-	pmicdata->K0 = secmicgetuint32(key);
-	pmicdata->K1 = secmicgetuint32(key + 4);
-	/* and reset the message */
-	secmicclear(pmicdata);
-}
-
-static void secmicappendbyte(struct mic_data *pmicdata, u8 b)
-{
-	/* Append the byte to our word-sized buffer */
-	pmicdata->M |= ((u32)b) << (8 * pmicdata->nBytesInM);
-	pmicdata->nBytesInM++;
-	/* Process the word if it is full. */
-	if (pmicdata->nBytesInM >= 4) {
-		pmicdata->L ^= pmicdata->M;
-		pmicdata->R ^= ROL32(pmicdata->L, 17);
-		pmicdata->L += pmicdata->R;
-		pmicdata->R ^= ((pmicdata->L & 0xff00ff00) >> 8) |
-			       ((pmicdata->L & 0x00ff00ff) << 8);
-		pmicdata->L += pmicdata->R;
-		pmicdata->R ^= ROL32(pmicdata->L, 3);
-		pmicdata->L += pmicdata->R;
-		pmicdata->R ^= ROR32(pmicdata->L, 2);
-		pmicdata->L += pmicdata->R;
-		/* Clear the buffer */
-		pmicdata->M = 0;
-		pmicdata->nBytesInM = 0;
-	}
-}
-
-void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nbytes)
-{
-	/* This is simple */
-	while (nbytes > 0) {
-		secmicappendbyte(pmicdata, *src++);
-		nbytes--;
-	}
-}
-
-void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst)
-{
-	/* Append the minimum padding */
-	secmicappendbyte(pmicdata, 0x5a);
-	secmicappendbyte(pmicdata, 0);
-	secmicappendbyte(pmicdata, 0);
-	secmicappendbyte(pmicdata, 0);
-	secmicappendbyte(pmicdata, 0);
-	/* and then zeroes until the length is a multiple of 4 */
-	while (pmicdata->nBytesInM != 0)
-		secmicappendbyte(pmicdata, 0);
-	/* The appendByte function has already computed the result. */
-	secmicputuint32(dst, pmicdata->L);
-	secmicputuint32(dst + 4, pmicdata->R);
-	/* Reset to the empty message. */
-	secmicclear(pmicdata);
-}
-
-void seccalctkipmic(u8 *key, u8 *header, u8 *data, u32 data_len, u8 *mic_code,
-		    u8 pri)
-{
-
-	struct mic_data	micdata;
-	u8 priority[4] = {0x0, 0x0, 0x0, 0x0};
-
-	r8712_secmicsetkey(&micdata, key);
-	priority[0] = pri;
-	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
-	if (header[1] & 1) {   /* ToDS==1 */
-		r8712_secmicappend(&micdata, &header[16], 6);  /* DA */
-		if (header[1] & 2)  /* From Ds==1 */
-			r8712_secmicappend(&micdata, &header[24], 6);
-		else
-			r8712_secmicappend(&micdata, &header[10], 6);
-	} else {	/* ToDS==0 */
-		r8712_secmicappend(&micdata, &header[4], 6);   /* DA */
-		if (header[1] & 2)  /* From Ds==1 */
-			r8712_secmicappend(&micdata, &header[16], 6);
-		else
-			r8712_secmicappend(&micdata, &header[10], 6);
-	}
-	r8712_secmicappend(&micdata, &priority[0], 4);
-	r8712_secmicappend(&micdata, data, data_len);
-	r8712_secgetmic(&micdata, mic_code);
-}
-
-/* macros for extraction/creation of unsigned char/unsigned short values  */
-#define RotR1(v16)   ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15))
-#define   Lo8(v16)   ((u8)((v16) & 0x00FF))
-#define   Hi8(v16)   ((u8)(((v16) >> 8) & 0x00FF))
-#define  Lo16(v32)   ((u16)((v32) & 0xFFFF))
-#define  Hi16(v32)   ((u16)(((v32) >> 16) & 0xFFFF))
-#define  Mk16(hi, lo) ((lo) ^ (((u16)(hi)) << 8))
-
-/* select the Nth 16-bit word of the temporal key unsigned char array TK[]   */
-#define  TK16(N)  Mk16(tk[2 * (N) + 1], tk[2 * (N)])
-
-/* S-box lookup: 16 bits --> 16 bits */
-#define _S_(v16)  (Sbox1[0][Lo8(v16)] ^ Sbox1[1][Hi8(v16)])
-
-/* fixed algorithm "parameters" */
-#define PHASE1_LOOP_CNT   8    /* this needs to be "big enough"     */
-#define TA_SIZE           6    /*  48-bit transmitter address       */
-#define TK_SIZE          16    /* 128-bit temporal key              */
-#define P1K_SIZE         10    /*  80-bit Phase1 key                */
-#define RC4_KEY_SIZE     16    /* 128-bit RC4KEY (104 bits unknown) */
-
-/* 2-unsigned char by 2-unsigned char subset of the full AES S-box table */
-static const unsigned short Sbox1[2][256] = {/* Sbox for hash (can be in ROM) */
-	{
-	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
-	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
-	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
-	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
-	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
-	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
-	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
-	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
-	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
-	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
-	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
-	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
-	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
-	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
-	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
-	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
-	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
-	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
-	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
-	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
-	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
-	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
-	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
-	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
-	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
-	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
-	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
-	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
-	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
-	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
-	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
-	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
-	},
-	{  /* second half is unsigned char-reversed version of first! */
-	0xA5C6, 0x84F8, 0x99EE, 0x8DF6, 0x0DFF, 0xBDD6, 0xB1DE, 0x5491,
-	0x5060, 0x0302, 0xA9CE, 0x7D56, 0x19E7, 0x62B5, 0xE64D, 0x9AEC,
-	0x458F, 0x9D1F, 0x4089, 0x87FA, 0x15EF, 0xEBB2, 0xC98E, 0x0BFB,
-	0xEC41, 0x67B3, 0xFD5F, 0xEA45, 0xBF23, 0xF753, 0x96E4, 0x5B9B,
-	0xC275, 0x1CE1, 0xAE3D, 0x6A4C, 0x5A6C, 0x417E, 0x02F5, 0x4F83,
-	0x5C68, 0xF451, 0x34D1, 0x08F9, 0x93E2, 0x73AB, 0x5362, 0x3F2A,
-	0x0C08, 0x5295, 0x6546, 0x5E9D, 0x2830, 0xA137, 0x0F0A, 0xB52F,
-	0x090E, 0x3624, 0x9B1B, 0x3DDF, 0x26CD, 0x694E, 0xCD7F, 0x9FEA,
-	0x1B12, 0x9E1D, 0x7458, 0x2E34, 0x2D36, 0xB2DC, 0xEEB4, 0xFB5B,
-	0xF6A4, 0x4D76, 0x61B7, 0xCE7D, 0x7B52, 0x3EDD, 0x715E, 0x9713,
-	0xF5A6, 0x68B9, 0x0000, 0x2CC1, 0x6040, 0x1FE3, 0xC879, 0xEDB6,
-	0xBED4, 0x468D, 0xD967, 0x4B72, 0xDE94, 0xD498, 0xE8B0, 0x4A85,
-	0x6BBB, 0x2AC5, 0xE54F, 0x16ED, 0xC586, 0xD79A, 0x5566, 0x9411,
-	0xCF8A, 0x10E9, 0x0604, 0x81FE, 0xF0A0, 0x4478, 0xBA25, 0xE34B,
-	0xF3A2, 0xFE5D, 0xC080, 0x8A05, 0xAD3F, 0xBC21, 0x4870, 0x04F1,
-	0xDF63, 0xC177, 0x75AF, 0x6342, 0x3020, 0x1AE5, 0x0EFD, 0x6DBF,
-	0x4C81, 0x1418, 0x3526, 0x2FC3, 0xE1BE, 0xA235, 0xCC88, 0x392E,
-	0x5793, 0xF255, 0x82FC, 0x477A, 0xACC8, 0xE7BA, 0x2B32, 0x95E6,
-	0xA0C0, 0x9819, 0xD19E, 0x7FA3, 0x6644, 0x7E54, 0xAB3B, 0x830B,
-	0xCA8C, 0x29C7, 0xD36B, 0x3C28, 0x79A7, 0xE2BC, 0x1D16, 0x76AD,
-	0x3BDB, 0x5664, 0x4E74, 0x1E14, 0xDB92, 0x0A0C, 0x6C48, 0xE4B8,
-	0x5D9F, 0x6EBD, 0xEF43, 0xA6C4, 0xA839, 0xA431, 0x37D3, 0x8BF2,
-	0x32D5, 0x438B, 0x596E, 0xB7DA, 0x8C01, 0x64B1, 0xD29C, 0xE049,
-	0xB4D8, 0xFAAC, 0x07F3, 0x25CF, 0xAFCA, 0x8EF4, 0xE947, 0x1810,
-	0xD56F, 0x88F0, 0x6F4A, 0x725C, 0x2438, 0xF157, 0xC773, 0x5197,
-	0x23CB, 0x7CA1, 0x9CE8, 0x213E, 0xDD96, 0xDC61, 0x860D, 0x850F,
-	0x90E0, 0x427C, 0xC471, 0xAACC, 0xD890, 0x0506, 0x01F7, 0x121C,
-	0xA3C2, 0x5F6A, 0xF9AE, 0xD069, 0x9117, 0x5899, 0x273A, 0xB927,
-	0x38D9, 0x13EB, 0xB32B, 0x3322, 0xBBD2, 0x70A9, 0x8907, 0xA733,
-	0xB62D, 0x223C, 0x9215, 0x20C9, 0x4987, 0xFFAA, 0x7850, 0x7AA5,
-	0x8F03, 0xF859, 0x8009, 0x171A, 0xDA65, 0x31D7, 0xC684, 0xB8D0,
-	0xC382, 0xB029, 0x775A, 0x111E, 0xCB7B, 0xFCA8, 0xD66D, 0x3A2C,
-	}
-};
-
-/*
- **********************************************************************
- * Routine: Phase 1 -- generate P1K, given TA, TK, IV32
- *
- * Inputs:
- *     tk[]      = temporal key                         [128 bits]
- *     ta[]      = transmitter's MAC address            [ 48 bits]
- *     iv32      = upper 32 bits of IV                  [ 32 bits]
- * Output:
- *     p1k[]     = Phase 1 key                          [ 80 bits]
- *
- * Note:
- *     This function only needs to be called every 2**16 packets,
- *     although in theory it could be called every packet.
- *
- **********************************************************************
- */
-static void phase1(u16 *p1k, const u8 *tk, const u8 *ta, u32 iv32)
-{
-	sint  i;
-
-	/* Initialize the 80 bits of P1K[] from IV32 and TA[0..5]     */
-	p1k[0] = Lo16(iv32);
-	p1k[1] = Hi16(iv32);
-	p1k[2] = Mk16(ta[1], ta[0]); /* use TA[] as little-endian */
-	p1k[3] = Mk16(ta[3], ta[2]);
-	p1k[4] = Mk16(ta[5], ta[4]);
-	/* Now compute an unbalanced Feistel cipher with 80-bit block */
-	/* size on the 80-bit block P1K[], using the 128-bit key TK[] */
-	for (i = 0; i < PHASE1_LOOP_CNT; i++) {  /* Each add is mod 2**16 */
-		p1k[0] += _S_(p1k[4] ^ TK16((i & 1) + 0));
-		p1k[1] += _S_(p1k[0] ^ TK16((i & 1) + 2));
-		p1k[2] += _S_(p1k[1] ^ TK16((i & 1) + 4));
-		p1k[3] += _S_(p1k[2] ^ TK16((i & 1) + 6));
-		p1k[4] += _S_(p1k[3] ^ TK16((i & 1) + 0));
-		p1k[4] +=  (unsigned short)i;	/* avoid "slide attacks" */
-	}
-}
-
-/*
- **********************************************************************
- * Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16
- *
- * Inputs:
- *     tk[]      = Temporal key                         [128 bits]
- *     p1k[]     = Phase 1 output key                   [ 80 bits]
- *     iv16      = low 16 bits of IV counter            [ 16 bits]
- * Output:
- *     rc4key[]  = the key used to encrypt the packet   [128 bits]
- *
- * Note:
- *     The value {TA,IV32,IV16} for Phase1/Phase2 must be unique
- *     across all packets using the same key TK value. Then, for a
- *     given value of TK[], this TKIP48 construction guarantees that
- *     the final RC4KEY value is unique across all packets.
- *
- * Suggested implementation optimization: if PPK[] is "overlaid"
- *     appropriately on RC4KEY[], there is no need for the final
- *     for loop below that copies the PPK[] result into RC4KEY[].
- *
- **********************************************************************
- */
-static void phase2(u8 *rc4key, const u8 *tk, const u16 *p1k, u16 iv16)
-{
-	sint  i;
-	u16 PPK[6];			/* temporary key for mixing    */
-
-	/* Note: all adds in the PPK[] equations below are mod 2**16 */
-	for (i = 0; i < 5; i++)
-		PPK[i] = p1k[i]; /* first, copy P1K to PPK */
-	PPK[5]  =  p1k[4] + iv16; /* next,  add in IV16 */
-	/* Bijective non-linear mixing of the 96 bits of PPK[0..5] */
-	PPK[0] += _S_(PPK[5] ^ TK16(0));   /* Mix key in each "round" */
-	PPK[1] += _S_(PPK[0] ^ TK16(1));
-	PPK[2] += _S_(PPK[1] ^ TK16(2));
-	PPK[3] += _S_(PPK[2] ^ TK16(3));
-	PPK[4] += _S_(PPK[3] ^ TK16(4));
-	PPK[5] += _S_(PPK[4] ^ TK16(5));   /* Total # S-box lookups == 6  */
-	/* Final sweep: bijective, "linear". Rotates kill LSB correlations   */
-	PPK[0] +=  RotR1(PPK[5] ^ TK16(6));
-	PPK[1] +=  RotR1(PPK[0] ^ TK16(7));   /* Use all of TK[] in Phase2   */
-	PPK[2] +=  RotR1(PPK[1]);
-	PPK[3] +=  RotR1(PPK[2]);
-	PPK[4] +=  RotR1(PPK[3]);
-	PPK[5] +=  RotR1(PPK[4]);
-	/* Note: At this point, for a given key TK[0..15], the 96-bit output */
-	/* value PPK[0..5] is guaranteed to be unique, as a function   */
-	/* of the 96-bit "input" value   {TA,IV32,IV16}. That is, P1K  */
-	/* is now a keyed permutation of {TA,IV32,IV16}. */
-	/* Set RC4KEY[0..3], which includes "cleartext" portion of RC4 key   */
-	rc4key[0] = Hi8(iv16); /* RC4KEY[0..2] is the WEP IV  */
-	rc4key[1] = (Hi8(iv16) | 0x20) & 0x7F; /* Help avoid weak (FMS) keys  */
-	rc4key[2] = Lo8(iv16);
-	rc4key[3] = Lo8((PPK[5] ^ TK16(0)) >> 1);
-	/* Copy 96 bits of PPK[0..5] to RC4KEY[4..15]  (little-endian) */
-	for (i = 0; i < 6; i++) {
-		rc4key[4 + 2 * i] = Lo8(PPK[i]);
-		rc4key[5 + 2 * i] = Hi8(PPK[i]);
-	}
-}
-
-/*The hlen isn't include the IV*/
-u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{	/*  exclude ICV */
-	u16 pnl;
-	u32 pnh;
-	u8 rc4key[16];
-	u8 ttkey[16];
-	u8 crc[4];
-	struct arc4context mycontext;
-	u32 curfragnum, length;
-
-	u8 *pframe, *payload, *iv, *prwskey;
-	union pn48 txpn;
-	struct sta_info *stainfo;
-	struct pkt_attrib *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	u32 res = _SUCCESS;
-
-	if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
-		return _FAIL;
-
-	pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
-	/* 4 start to encrypt each fragment */
-	if (pattrib->encrypt == _TKIP_) {
-		if (pattrib->psta)
-			stainfo = pattrib->psta;
-		else
-			stainfo = r8712_get_stainfo(&padapter->stapriv,
-				  &pattrib->ra[0]);
-		if (stainfo) {
-			prwskey = &stainfo->x_UncstKey.skey[0];
-			for (curfragnum = 0; curfragnum < pattrib->nr_frags;
-			     curfragnum++) {
-				iv = pframe + pattrib->hdrlen;
-				payload = pframe + pattrib->iv_len +
-					  pattrib->hdrlen;
-				GET_TKIP_PN(iv, txpn);
-				pnl = (u16)(txpn.val);
-				pnh = (u32)(txpn.val >> 16);
-				phase1((u16 *)&ttkey[0], prwskey,
-				       &pattrib->ta[0], pnh);
-				phase2(&rc4key[0], prwskey, (u16 *)&ttkey[0],
-				       pnl);
-				if ((curfragnum + 1) == pattrib->nr_frags) {
-					/* 4 the last fragment */
-					length = pattrib->last_txcmdsz -
-					     pattrib->hdrlen -
-					     pattrib->iv_len -
-					     pattrib->icv_len;
-					*((__le32 *)crc) = cpu_to_le32(
-						getcrc32(payload, length));
-					arcfour_init(&mycontext, rc4key, 16);
-					arcfour_encrypt(&mycontext, payload,
-							payload, length);
-					arcfour_encrypt(&mycontext, payload +
-							length, crc, 4);
-				} else {
-					length = pxmitpriv->frag_len -
-						 pattrib->hdrlen -
-						 pattrib->iv_len -
-						 pattrib->icv_len;
-					*((__le32 *)crc) = cpu_to_le32(getcrc32(
-							payload, length));
-					arcfour_init(&mycontext, rc4key, 16);
-					arcfour_encrypt(&mycontext, payload,
-							 payload, length);
-					arcfour_encrypt(&mycontext,
-							payload + length, crc,
-							4);
-					pframe += pxmitpriv->frag_len;
-					pframe = (u8 *)RND4((addr_t)(pframe));
-				}
-			}
-		} else {
-			res = _FAIL;
-		}
-	}
-	return res;
-}
-
-/* The hlen doesn't include the IV */
-void r8712_tkip_decrypt(struct _adapter *padapter, u8 *precvframe)
-{	/* exclude ICV */
-	u16 pnl;
-	u32 pnh;
-	u8 rc4key[16];
-	u8 ttkey[16];
-	u8 crc[4];
-	struct arc4context mycontext;
-	u32 length;
-	u8 *pframe, *payload, *iv, *prwskey, idx = 0;
-	union pn48 txpn;
-	struct	sta_info *stainfo;
-	struct	rx_pkt_attrib *prxattrib = &((union recv_frame *)
-					   precvframe)->u.hdr.attrib;
-	struct	security_priv	*psecuritypriv = &padapter->securitypriv;
-
-	pframe = (unsigned char *)((union recv_frame *)
-				   precvframe)->u.hdr.rx_data;
-	/* 4 start to decrypt recvframe */
-	if (prxattrib->encrypt == _TKIP_) {
-		stainfo = r8712_get_stainfo(&padapter->stapriv,
-					    &prxattrib->ta[0]);
-		if (stainfo) {
-			iv = pframe + prxattrib->hdrlen;
-			payload = pframe + prxattrib->iv_len +
-				  prxattrib->hdrlen;
-			length = ((union recv_frame *)precvframe)->
-				 u.hdr.len - prxattrib->hdrlen -
-				 prxattrib->iv_len;
-			if (is_multicast_ether_addr(prxattrib->ra)) {
-				idx = iv[3];
-				prwskey = &psecuritypriv->XGrpKey[
-					 ((idx >> 6) & 0x3) - 1].skey[0];
-				if (!psecuritypriv->binstallGrpkey)
-					return;
-			} else {
-				prwskey = &stainfo->x_UncstKey.skey[0];
-			}
-			GET_TKIP_PN(iv, txpn);
-			pnl = (u16)(txpn.val);
-			pnh = (u32)(txpn.val >> 16);
-			phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0],
-				pnh);
-			phase2(&rc4key[0], prwskey, (unsigned short *)
-			       &ttkey[0], pnl);
-			/* 4 decrypt payload include icv */
-			arcfour_init(&mycontext, rc4key, 16);
-			arcfour_encrypt(&mycontext, payload, payload, length);
-			*((__le32 *)crc) = cpu_to_le32(getcrc32(payload,
-					length - 4));
-		}
-	}
-}
-
-/* 3 =====AES related===== */
-
-#define MAX_MSG_SIZE	2048
-/*****************************/
-/******** SBOX Table *********/
-/*****************************/
-
-static const u8 sbox_table[256] = {
-	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
-	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
-	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
-	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
-	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
-	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
-	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
-	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
-	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
-	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
-	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
-	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
-	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
-	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
-	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
-	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
-	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
-	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
-	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
-	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
-	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
-	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
-	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
-	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
-	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
-	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
-	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
-	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
-	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
-	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
-	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
-	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
-};
-
-/****************************************/
-/* aes128k128d()                        */
-/* Performs a 128 bit AES encrypt with  */
-/* 128 bit data.                        */
-/****************************************/
-static void xor_128(u8 *a, u8 *b, u8 *out)
-{
-	sint i;
-
-	for (i = 0; i < 16; i++)
-		out[i] = a[i] ^ b[i];
-}
-
-static void xor_32(u8 *a, u8 *b, u8 *out)
-{
-	sint i;
-
-	for (i = 0; i < 4; i++)
-		out[i] = a[i] ^ b[i];
-}
-
-static u8 sbox(u8 a)
-{
-	return sbox_table[(sint)a];
-}
-
-static void next_key(u8 *key, sint round)
-{
-	u8 rcon;
-	u8 sbox_key[4];
-	static const u8 rcon_table[12] = {
-		0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
-		0x1b, 0x36, 0x36, 0x36
-	};
-
-	sbox_key[0] = sbox(key[13]);
-	sbox_key[1] = sbox(key[14]);
-	sbox_key[2] = sbox(key[15]);
-	sbox_key[3] = sbox(key[12]);
-	rcon = rcon_table[round];
-	xor_32(&key[0], sbox_key, &key[0]);
-	key[0] = key[0] ^ rcon;
-	xor_32(&key[4], &key[0], &key[4]);
-	xor_32(&key[8], &key[4], &key[8]);
-	xor_32(&key[12], &key[8], &key[12]);
-}
-
-static void byte_sub(u8 *in, u8 *out)
-{
-	sint i;
-
-	for (i = 0; i < 16; i++)
-		out[i] = sbox(in[i]);
-}
-
-static void shift_row(u8 *in, u8 *out)
-{
-	out[0] =  in[0];
-	out[1] =  in[5];
-	out[2] =  in[10];
-	out[3] =  in[15];
-	out[4] =  in[4];
-	out[5] =  in[9];
-	out[6] =  in[14];
-	out[7] =  in[3];
-	out[8] =  in[8];
-	out[9] =  in[13];
-	out[10] = in[2];
-	out[11] = in[7];
-	out[12] = in[12];
-	out[13] = in[1];
-	out[14] = in[6];
-	out[15] = in[11];
-}
-
-static void mix_column(u8 *in, u8 *out)
-{
-	sint i;
-	u8 add1b[4];
-	u8 add1bf7[4];
-	u8 rotl[4];
-	u8 swap_halves[4];
-	u8 andf7[4];
-	u8 rotr[4];
-	u8 temp[4];
-	u8 tempb[4];
-
-	for (i = 0; i < 4; i++) {
-		if ((in[i] & 0x80) == 0x80)
-			add1b[i] = 0x1b;
-		else
-			add1b[i] = 0x00;
-	}
-	swap_halves[0] = in[2];    /* Swap halves */
-	swap_halves[1] = in[3];
-	swap_halves[2] = in[0];
-	swap_halves[3] = in[1];
-	rotl[0] = in[3];        /* Rotate left 8 bits */
-	rotl[1] = in[0];
-	rotl[2] = in[1];
-	rotl[3] = in[2];
-	andf7[0] = in[0] & 0x7f;
-	andf7[1] = in[1] & 0x7f;
-	andf7[2] = in[2] & 0x7f;
-	andf7[3] = in[3] & 0x7f;
-	for (i = 3; i > 0; i--) {   /* logical shift left 1 bit */
-		andf7[i] = andf7[i] << 1;
-		if ((andf7[i - 1] & 0x80) == 0x80)
-			andf7[i] = (andf7[i] | 0x01);
-	}
-	andf7[0] = andf7[0] << 1;
-	andf7[0] = andf7[0] & 0xfe;
-	xor_32(add1b, andf7, add1bf7);
-	xor_32(in, add1bf7, rotr);
-	temp[0] = rotr[0];         /* Rotate right 8 bits */
-	rotr[0] = rotr[1];
-	rotr[1] = rotr[2];
-	rotr[2] = rotr[3];
-	rotr[3] = temp[0];
-	xor_32(add1bf7, rotr, temp);
-	xor_32(swap_halves, rotl, tempb);
-	xor_32(temp, tempb, out);
-}
-
-static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext)
-{
-	sint round;
-	sint i;
-	u8 intermediatea[16];
-	u8 intermediateb[16];
-	u8 round_key[16];
-
-	for (i = 0; i < 16; i++)
-		round_key[i] = key[i];
-	for (round = 0; round < 11; round++) {
-		if (round == 0) {
-			xor_128(round_key, data, ciphertext);
-			next_key(round_key, round);
-		} else if (round == 10) {
-			byte_sub(ciphertext, intermediatea);
-			shift_row(intermediatea, intermediateb);
-			xor_128(intermediateb, round_key, ciphertext);
-		} else {   /* 1 - 9 */
-			byte_sub(ciphertext, intermediatea);
-			shift_row(intermediatea, intermediateb);
-			mix_column(&intermediateb[0], &intermediatea[0]);
-			mix_column(&intermediateb[4], &intermediatea[4]);
-			mix_column(&intermediateb[8], &intermediatea[8]);
-			mix_column(&intermediateb[12], &intermediatea[12]);
-			xor_128(intermediatea, round_key, ciphertext);
-			next_key(round_key, round);
-		}
-	}
-}
-
-/************************************************/
-/* construct_mic_iv()                           */
-/* Builds the MIC IV from header fields and PN  */
-/************************************************/
-static void construct_mic_iv(u8 *mic_iv, sint qc_exists, sint a4_exists,
-			     u8 *mpdu, uint payload_length, u8 *pn_vector)
-{
-	sint i;
-
-	mic_iv[0] = 0x59;
-	if (qc_exists && a4_exists)
-		mic_iv[1] = mpdu[30] & 0x0f;    /* QoS_TC           */
-	if (qc_exists && !a4_exists)
-		mic_iv[1] = mpdu[24] & 0x0f;   /* mute bits 7-4    */
-	if (!qc_exists)
-		mic_iv[1] = 0x00;
-	for (i = 2; i < 8; i++)
-		mic_iv[i] = mpdu[i + 8];
-	for (i = 8; i < 14; i++)
-		mic_iv[i] = pn_vector[13 - i]; /* mic_iv[8:13] = PN[5:0] */
-	mic_iv[14] = (unsigned char)(payload_length / 256);
-	mic_iv[15] = (unsigned char)(payload_length % 256);
-}
-
-/************************************************/
-/* construct_mic_header1()                      */
-/* Builds the first MIC header block from       */
-/* header fields.                               */
-/************************************************/
-static void construct_mic_header1(u8 *mic_header1, sint header_length, u8 *mpdu)
-{
-	mic_header1[0] = (u8)((header_length - 2) / 256);
-	mic_header1[1] = (u8)((header_length - 2) % 256);
-	mic_header1[2] = mpdu[0] & 0xcf;    /* Mute CF poll & CF ack bits */
-	/* Mute retry, more data and pwr mgt bits */
-	mic_header1[3] = mpdu[1] & 0xc7;
-	mic_header1[4] = mpdu[4];       /* A1 */
-	mic_header1[5] = mpdu[5];
-	mic_header1[6] = mpdu[6];
-	mic_header1[7] = mpdu[7];
-	mic_header1[8] = mpdu[8];
-	mic_header1[9] = mpdu[9];
-	mic_header1[10] = mpdu[10];     /* A2 */
-	mic_header1[11] = mpdu[11];
-	mic_header1[12] = mpdu[12];
-	mic_header1[13] = mpdu[13];
-	mic_header1[14] = mpdu[14];
-	mic_header1[15] = mpdu[15];
-}
-
-/************************************************/
-/* construct_mic_header2()                      */
-/* Builds the last MIC header block from        */
-/* header fields.                               */
-/************************************************/
-static void construct_mic_header2(u8 *mic_header2, u8 *mpdu, sint a4_exists,
-			   sint qc_exists)
-{
-	sint i;
-
-	for (i = 0; i < 16; i++)
-		mic_header2[i] = 0x00;
-	mic_header2[0] = mpdu[16];    /* A3 */
-	mic_header2[1] = mpdu[17];
-	mic_header2[2] = mpdu[18];
-	mic_header2[3] = mpdu[19];
-	mic_header2[4] = mpdu[20];
-	mic_header2[5] = mpdu[21];
-	mic_header2[6] = 0x00;
-	mic_header2[7] = 0x00; /* mpdu[23]; */
-	if (!qc_exists && a4_exists)
-		for (i = 0; i < 6; i++)
-			mic_header2[8 + i] = mpdu[24 + i];   /* A4 */
-	if (qc_exists && !a4_exists) {
-		mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
-		mic_header2[9] = mpdu[25] & 0x00;
-	}
-	if (qc_exists && a4_exists) {
-		for (i = 0; i < 6; i++)
-			mic_header2[8 + i] = mpdu[24 + i];   /* A4 */
-		mic_header2[14] = mpdu[30] & 0x0f;
-		mic_header2[15] = mpdu[31] & 0x00;
-	}
-}
-
-/************************************************/
-/* construct_mic_header2()                      */
-/* Builds the last MIC header block from        */
-/* header fields.                               */
-/************************************************/
-static void construct_ctr_preload(u8 *ctr_preload,
-				  sint a4_exists, sint qc_exists,
-				  u8 *mpdu, u8 *pn_vector, sint c)
-{
-	sint i;
-
-	for (i = 0; i < 16; i++)
-		ctr_preload[i] = 0x00;
-	i = 0;
-	ctr_preload[0] = 0x01;    /* flag */
-	if (qc_exists && a4_exists)
-		ctr_preload[1] = mpdu[30] & 0x0f;
-	if (qc_exists && !a4_exists)
-		ctr_preload[1] = mpdu[24] & 0x0f;
-	for (i = 2; i < 8; i++)
-		ctr_preload[i] = mpdu[i + 8];
-	for (i = 8; i < 14; i++)
-		ctr_preload[i] = pn_vector[13 - i];
-	ctr_preload[14] = (unsigned char)(c / 256); /* Ctr */
-	ctr_preload[15] = (unsigned char)(c % 256);
-}
-
-/************************************/
-/* bitwise_xor()                    */
-/* A 128 bit, bitwise exclusive or  */
-/************************************/
-static void bitwise_xor(u8 *ina, u8 *inb, u8 *out)
-{
-	sint i;
-
-	for (i = 0; i < 16; i++)
-		out[i] = ina[i] ^ inb[i];
-}
-
-static void aes_cipher(u8 *key, uint hdrlen,
-		       u8 *pframe, uint plen)
-{
-	uint qc_exists, a4_exists, i, j, payload_remainder;
-	uint num_blocks, payload_index;
-
-	u8 pn_vector[6];
-	u8 mic_iv[16];
-	u8 mic_header1[16];
-	u8 mic_header2[16];
-	u8 ctr_preload[16];
-
-	/* Intermediate Buffers */
-	u8 chain_buffer[16];
-	u8 aes_out[16];
-	u8 padded_buffer[16];
-	u8 mic[8];
-	u16 frtype  = GetFrameType(pframe);
-	u16 frsubtype  = GetFrameSubType(pframe);
-
-	frsubtype >>= 4;
-	memset((void *)mic_iv, 0, 16);
-	memset((void *)mic_header1, 0, 16);
-	memset((void *)mic_header2, 0, 16);
-	memset((void *)ctr_preload, 0, 16);
-	memset((void *)chain_buffer, 0, 16);
-	memset((void *)aes_out, 0, 16);
-	memset((void *)padded_buffer, 0, 16);
-
-	if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen ==  WLAN_HDR_A3_QOS_LEN))
-		a4_exists = 0;
-	else
-		a4_exists = 1;
-
-	if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) ||
-	    (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) ||
-	    (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) {
-		qc_exists = 1;
-		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
-			hdrlen += 2;
-	} else if ((frsubtype == 0x08) ||
-		   (frsubtype == 0x09) ||
-		   (frsubtype == 0x0a) ||
-		   (frsubtype == 0x0b)) {
-		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
-			hdrlen += 2;
-		qc_exists = 1;
-	} else {
-		qc_exists = 0;
-	}
-	pn_vector[0] = pframe[hdrlen];
-	pn_vector[1] = pframe[hdrlen + 1];
-	pn_vector[2] = pframe[hdrlen + 4];
-	pn_vector[3] = pframe[hdrlen + 5];
-	pn_vector[4] = pframe[hdrlen + 6];
-	pn_vector[5] = pframe[hdrlen + 7];
-	construct_mic_iv(mic_iv, qc_exists, a4_exists, pframe, plen, pn_vector);
-	construct_mic_header1(mic_header1, hdrlen, pframe);
-	construct_mic_header2(mic_header2, pframe, a4_exists, qc_exists);
-	payload_remainder = plen % 16;
-	num_blocks = plen / 16;
-	/* Find start of payload */
-	payload_index = hdrlen + 8;
-	/* Calculate MIC */
-	aes128k128d(key, mic_iv, aes_out);
-	bitwise_xor(aes_out, mic_header1, chain_buffer);
-	aes128k128d(key, chain_buffer, aes_out);
-	bitwise_xor(aes_out, mic_header2, chain_buffer);
-	aes128k128d(key, chain_buffer, aes_out);
-	for (i = 0; i < num_blocks; i++) {
-		bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
-		payload_index += 16;
-		aes128k128d(key, chain_buffer, aes_out);
-	}
-	/* Add on the final payload block if it needs padding */
-	if (payload_remainder > 0) {
-		for (j = 0; j < 16; j++)
-			padded_buffer[j] = 0x00;
-		for (j = 0; j < payload_remainder; j++)
-			padded_buffer[j] = pframe[payload_index++];
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
-	}
-	for (j = 0; j < 8; j++)
-		mic[j] = aes_out[j];
-	/* Insert MIC into payload */
-	for (j = 0; j < 8; j++)
-		pframe[payload_index + j] = mic[j];
-	payload_index = hdrlen + 8;
-	for (i = 0; i < num_blocks; i++) {
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      pframe, pn_vector, i + 1);
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
-		for (j = 0; j < 16; j++)
-			pframe[payload_index++] = chain_buffer[j];
-	}
-	if (payload_remainder > 0) {  /* If short final block, then pad it,*/
-				      /* encrypt and copy unpadded part back */
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      pframe, pn_vector, num_blocks + 1);
-		for (j = 0; j < 16; j++)
-			padded_buffer[j] = 0x00;
-		for (j = 0; j < payload_remainder; j++)
-			padded_buffer[j] = pframe[payload_index + j];
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		for (j = 0; j < payload_remainder; j++)
-			pframe[payload_index++] = chain_buffer[j];
-	}
-	/* Encrypt the MIC */
-	construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-			      pframe, pn_vector, 0);
-	for (j = 0; j < 16; j++)
-		padded_buffer[j] = 0x00;
-	for (j = 0; j < 8; j++)
-		padded_buffer[j] = pframe[j + hdrlen + 8 + plen];
-	aes128k128d(key, ctr_preload, aes_out);
-	bitwise_xor(aes_out, padded_buffer, chain_buffer);
-	for (j = 0; j < 8; j++)
-		pframe[payload_index++] = chain_buffer[j];
-}
-
-u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe)
-{	/* exclude ICV */
-	/* Intermediate Buffers */
-	sint	curfragnum, length;
-	u8	*pframe, *prwskey;
-	struct	sta_info *stainfo;
-	struct	pkt_attrib  *pattrib = &((struct xmit_frame *)
-				       pxmitframe)->attrib;
-	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	u32 res = _SUCCESS;
-
-	if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
-		return _FAIL;
-	pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + TXDESC_OFFSET;
-	/* 4 start to encrypt each fragment */
-	if (pattrib->encrypt == _AES_) {
-		if (pattrib->psta)
-			stainfo = pattrib->psta;
-		else
-			stainfo = r8712_get_stainfo(&padapter->stapriv,
-				  &pattrib->ra[0]);
-		if (stainfo) {
-			prwskey = &stainfo->x_UncstKey.skey[0];
-			for (curfragnum = 0; curfragnum < pattrib->nr_frags;
-			     curfragnum++) {
-				if ((curfragnum + 1) == pattrib->nr_frags) {
-					length = pattrib->last_txcmdsz -
-						 pattrib->hdrlen -
-						 pattrib->iv_len -
-						 pattrib->icv_len;
-					aes_cipher(prwskey, pattrib->hdrlen,
-						   pframe, length);
-				} else {
-					length = pxmitpriv->frag_len -
-						 pattrib->hdrlen -
-						 pattrib->iv_len -
-						 pattrib->icv_len;
-					aes_cipher(prwskey, pattrib->hdrlen,
-						   pframe, length);
-					pframe += pxmitpriv->frag_len;
-					pframe = (u8 *)RND4((addr_t)(pframe));
-				}
-			}
-		} else {
-			res = _FAIL;
-		}
-	}
-	return res;
-}
-
-static void aes_decipher(u8 *key, uint hdrlen,
-			 u8 *pframe, uint plen)
-{
-	static u8 message[MAX_MSG_SIZE];
-	uint qc_exists, a4_exists, i, j, payload_remainder;
-	uint num_blocks, payload_index;
-	u8 pn_vector[6];
-	u8 mic_iv[16];
-	u8 mic_header1[16];
-	u8 mic_header2[16];
-	u8 ctr_preload[16];
-	/* Intermediate Buffers */
-	u8 chain_buffer[16];
-	u8 aes_out[16];
-	u8 padded_buffer[16];
-	u8 mic[8];
-	uint frtype  = GetFrameType(pframe);
-	uint frsubtype  = GetFrameSubType(pframe);
-
-	frsubtype >>= 4;
-	memset((void *)mic_iv, 0, 16);
-	memset((void *)mic_header1, 0, 16);
-	memset((void *)mic_header2, 0, 16);
-	memset((void *)ctr_preload, 0, 16);
-	memset((void *)chain_buffer, 0, 16);
-	memset((void *)aes_out, 0, 16);
-	memset((void *)padded_buffer, 0, 16);
-	/* start to decrypt the payload */
-	/*(plen including llc, payload and mic) */
-	num_blocks = (plen - 8) / 16;
-	payload_remainder = (plen - 8) % 16;
-	pn_vector[0] = pframe[hdrlen];
-	pn_vector[1] = pframe[hdrlen + 1];
-	pn_vector[2] = pframe[hdrlen + 4];
-	pn_vector[3] = pframe[hdrlen + 5];
-	pn_vector[4] = pframe[hdrlen + 6];
-	pn_vector[5] = pframe[hdrlen + 7];
-	if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen ==  WLAN_HDR_A3_QOS_LEN))
-		a4_exists = 0;
-	else
-		a4_exists = 1;
-	if ((frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACK)) ||
-	    (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFPOLL)) ||
-	    (frtype == (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA_CFACKPOLL))) {
-		qc_exists = 1;
-		if (hdrlen != WLAN_HDR_A3_QOS_LEN)
-			hdrlen += 2;
-	} else if ((frsubtype == 0x08) ||
-		   (frsubtype == 0x09) ||
-		   (frsubtype == 0x0a) ||
-		   (frsubtype == 0x0b)) {
-		if (hdrlen != WLAN_HDR_A3_QOS_LEN)
-			hdrlen += 2;
-		qc_exists = 1;
-	} else {
-		qc_exists = 0;
-	}
-	/* now, decrypt pframe with hdrlen offset and plen long */
-	payload_index = hdrlen + 8; /* 8 is for extiv */
-	for (i = 0; i < num_blocks; i++) {
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      pframe, pn_vector, i + 1);
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
-		for (j = 0; j < 16; j++)
-			pframe[payload_index++] = chain_buffer[j];
-	}
-	if (payload_remainder > 0) {  /* If short final block, pad it,*/
-		/* encrypt it and copy the unpadded part back   */
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      pframe, pn_vector, num_blocks + 1);
-		for (j = 0; j < 16; j++)
-			padded_buffer[j] = 0x00;
-		for (j = 0; j < payload_remainder; j++)
-			padded_buffer[j] = pframe[payload_index + j];
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		for (j = 0; j < payload_remainder; j++)
-			pframe[payload_index++] = chain_buffer[j];
-	}
-	/* start to calculate the mic */
-	memcpy((void *)message, pframe, (hdrlen + plen + 8));
-	pn_vector[0] = pframe[hdrlen];
-	pn_vector[1] = pframe[hdrlen + 1];
-	pn_vector[2] = pframe[hdrlen + 4];
-	pn_vector[3] = pframe[hdrlen + 5];
-	pn_vector[4] = pframe[hdrlen + 6];
-	pn_vector[5] = pframe[hdrlen + 7];
-	construct_mic_iv(mic_iv, qc_exists, a4_exists, message, plen - 8,
-			 pn_vector);
-	construct_mic_header1(mic_header1, hdrlen, message);
-	construct_mic_header2(mic_header2, message, a4_exists, qc_exists);
-	payload_remainder = (plen - 8) % 16;
-	num_blocks = (plen - 8) / 16;
-	/* Find start of payload */
-	payload_index = hdrlen + 8;
-	/* Calculate MIC */
-	aes128k128d(key, mic_iv, aes_out);
-	bitwise_xor(aes_out, mic_header1, chain_buffer);
-	aes128k128d(key, chain_buffer, aes_out);
-	bitwise_xor(aes_out, mic_header2, chain_buffer);
-	aes128k128d(key, chain_buffer, aes_out);
-	for (i = 0; i < num_blocks; i++) {
-		bitwise_xor(aes_out, &message[payload_index], chain_buffer);
-		payload_index += 16;
-		aes128k128d(key, chain_buffer, aes_out);
-	}
-	/* Add on the final payload block if it needs padding */
-	if (payload_remainder > 0) {
-		for (j = 0; j < 16; j++)
-			padded_buffer[j] = 0x00;
-		for (j = 0; j < payload_remainder; j++)
-			padded_buffer[j] = message[payload_index++];
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
-	}
-	for (j = 0; j < 8; j++)
-		mic[j] = aes_out[j];
-	/* Insert MIC into payload */
-	for (j = 0; j < 8; j++)
-		message[payload_index + j] = mic[j];
-	payload_index = hdrlen + 8;
-	for (i = 0; i < num_blocks; i++) {
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      message, pn_vector, i + 1);
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, &message[payload_index], chain_buffer);
-		for (j = 0; j < 16; j++)
-			message[payload_index++] = chain_buffer[j];
-	}
-	if (payload_remainder > 0) { /* If short final block, pad it,*/
-				     /* encrypt and copy unpadded part back */
-		construct_ctr_preload(ctr_preload, a4_exists, qc_exists,
-				      message, pn_vector, num_blocks + 1);
-		for (j = 0; j < 16; j++)
-			padded_buffer[j] = 0x00;
-		for (j = 0; j < payload_remainder; j++)
-			padded_buffer[j] = message[payload_index + j];
-		aes128k128d(key, ctr_preload, aes_out);
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		for (j = 0; j < payload_remainder; j++)
-			message[payload_index++] = chain_buffer[j];
-	}
-	/* Encrypt the MIC */
-	construct_ctr_preload(ctr_preload, a4_exists, qc_exists, message,
-			      pn_vector, 0);
-	for (j = 0; j < 16; j++)
-		padded_buffer[j] = 0x00;
-	for (j = 0; j < 8; j++)
-		padded_buffer[j] = message[j + hdrlen + plen];
-	aes128k128d(key, ctr_preload, aes_out);
-	bitwise_xor(aes_out, padded_buffer, chain_buffer);
-	for (j = 0; j < 8; j++)
-		message[payload_index++] = chain_buffer[j];
-	/* compare the mic */
-}
-
-void r8712_aes_decrypt(struct _adapter *padapter, u8 *precvframe)
-{	/* exclude ICV */
-	/* Intermediate Buffers */
-	sint		length;
-	u8	*pframe, *prwskey, *iv, idx;
-	struct	sta_info *stainfo;
-	struct	rx_pkt_attrib *prxattrib = &((union recv_frame *)
-					   precvframe)->u.hdr.attrib;
-	struct	security_priv *psecuritypriv = &padapter->securitypriv;
-
-	pframe = (unsigned char *)((union recv_frame *)precvframe)->
-		 u.hdr.rx_data;
-	/* 4 start to encrypt each fragment */
-	if (prxattrib->encrypt == _AES_) {
-		stainfo = r8712_get_stainfo(&padapter->stapriv,
-					    &prxattrib->ta[0]);
-		if (stainfo) {
-			if (is_multicast_ether_addr(prxattrib->ra)) {
-				iv = pframe + prxattrib->hdrlen;
-				idx = iv[3];
-				prwskey = &psecuritypriv->XGrpKey[
-					  ((idx >> 6) & 0x3) - 1].skey[0];
-				if (!psecuritypriv->binstallGrpkey)
-					return;
-
-			} else {
-				prwskey = &stainfo->x_UncstKey.skey[0];
-			}
-			length = ((union recv_frame *)precvframe)->
-				 u.hdr.len - prxattrib->hdrlen -
-				 prxattrib->iv_len;
-			aes_decipher(prwskey, prxattrib->hdrlen, pframe,
-				     length);
-		}
-	}
-}
-
-void r8712_use_tkipkey_handler(struct timer_list *t)
-{
-	struct _adapter *padapter =
-		from_timer(padapter, t, securitypriv.tkip_timer);
-
-	padapter->securitypriv.busetkipkey = true;
-}
--- a/drivers/staging/rtl8712/rtl871x_security.h
+++ /dev/null
@@ -1,218 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __RTL871X_SECURITY_H_
-#define __RTL871X_SECURITY_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#define _NO_PRIVACY_	0x0
-#define _WEP40_		0x1
-#define _TKIP_		0x2
-#define _TKIP_WTMIC_	0x3
-#define _AES_		0x4
-#define _WEP104_	0x5
-
-#define _WPA_IE_ID_	0xdd
-#define _WPA2_IE_ID_	0x30
-
-#ifndef Ndis802_11AuthModeWPA2
-#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1)
-#endif
-
-#ifndef Ndis802_11AuthModeWPA2PSK
-#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
-#endif
-
-union pn48 {
-	u64 val;
-#if defined(__BIG_ENDIAN)
-	struct {
-		u8 TSC7;
-		u8 TSC6;
-		u8 TSC5;
-		u8 TSC4;
-		u8 TSC3;
-		u8 TSC2;
-		u8 TSC1;
-		u8 TSC0;
-	} _byte_;
-#else
-	struct {
-		u8 TSC0;
-		u8 TSC1;
-		u8 TSC2;
-		u8 TSC3;
-		u8 TSC4;
-		u8 TSC5;
-		u8 TSC6;
-		u8 TSC7;
-	} _byte_;
-#endif
-};
-
-union Keytype {
-	u8 skey[16];
-	u32 lkey[4];
-};
-
-struct RT_PMKID_LIST {
-	u8 bUsed;
-	u8 Bssid[6];
-	u8 PMKID[16];
-	u8 SsidBuf[33];
-	u8 *ssid_octet;
-	u16 ssid_length;
-};
-
-struct security_priv {
-	u32 AuthAlgrthm;		/* 802.11 auth, could be open, shared,
-					 * 8021x and authswitch
-					 */
-	u32 PrivacyAlgrthm;		/* This specify the privacy for shared
-					 * auth. algorithm.
-					 */
-	u32 PrivacyKeyIndex;		/* this is only valid for legendary
-					 * wep, 0~3 for key id.
-					 */
-	union Keytype DefKey[4];	/* this is only valid for def. key */
-	u32 DefKeylen[4];
-	u32 XGrpPrivacy;		/* This specify the privacy algthm.
-					 * used for Grp key
-					 */
-	u32 XGrpKeyid;			/* key id used for Grp Key */
-	union Keytype	XGrpKey[2];	/* 802.1x Group Key, for
-					 * inx0 and inx1
-					 */
-	union Keytype	XGrptxmickey[2];
-	union Keytype	XGrprxmickey[2];
-	union pn48 Grptxpn;		/* PN48 used for Grp Key xmit. */
-	union pn48 Grprxpn;		/* PN48 used for Grp Key recv. */
-	u8 wps_hw_pbc_pressed;/*for hw pbc pressed*/
-	u8 wps_phase;/*for wps*/
-	u8 wps_ie[MAX_WPA_IE_LEN << 2];
-	int wps_ie_len;
-	u8	binstallGrpkey;
-	u8	busetkipkey;
-	struct timer_list tkip_timer;
-	u8	bcheck_grpkey;
-	u8	bgrpkey_handshake;
-	s32	sw_encrypt;	/* from registry_priv */
-	s32	sw_decrypt;	/* from registry_priv */
-	s32	hw_decrypted;	/* if the rx packets is hw_decrypted==false,
-				 * it means the hw has not been ready.
-				 */
-	u32 ndisauthtype;	/* keeps the auth_type & enc_status from upper
-				 * layer ioctl(wpa_supplicant or wzc)
-				 */
-	u32 ndisencryptstatus;
-	struct wlan_bssid_ex sec_bss;  /* for joinbss (h2c buffer) usage */
-	struct NDIS_802_11_WEP ndiswep;
-	u8 assoc_info[600];
-	u8 szofcapability[256]; /* for wpa2 usage */
-	u8 oidassociation[512]; /* for wpa/wpa2 usage */
-	u8 authenticator_ie[256];  /* store ap security information element */
-	u8 supplicant_ie[256];  /* store sta security information element */
-	/* for tkip countermeasure */
-	u32 last_mic_err_time;
-	u8	btkip_countermeasure;
-	u8	btkip_wait_report;
-	u32 btkip_countermeasure_time;
-	/*-------------------------------------------------------------------
-	 * For WPA2 Pre-Authentication.
-	 *------------------------------------------------------------------
-	 **/
-	struct RT_PMKID_LIST		PMKIDList[NUM_PMKID_CACHE];
-	u8				PMKIDIndex;
-};
-
-#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst) \
-do { \
-	switch (psecuritypriv->AuthAlgrthm) { \
-	case 0: \
-	case 1: \
-	case 3: \
-		encry_algo = (u8)psecuritypriv->PrivacyAlgrthm; \
-		break; \
-	case 2: \
-		if (bmcst) \
-			encry_algo = (u8)psecuritypriv->XGrpPrivacy; \
-		else \
-			encry_algo = (u8)psta->XPrivacy; \
-		break; \
-	} \
-} while (0)
-#define SET_ICE_IV_LEN(iv_len, icv_len, encrypt)\
-do {\
-	switch (encrypt) { \
-	case _WEP40_: \
-	case _WEP104_: \
-		iv_len = 4; \
-		icv_len = 4; \
-		break; \
-	case _TKIP_: \
-		iv_len = 8; \
-		icv_len = 4; \
-		break; \
-	case _AES_: \
-		iv_len = 8; \
-		icv_len = 8; \
-		break; \
-	default: \
-		iv_len = 0; \
-		icv_len = 0; \
-		break; \
-	} \
-} while (0)
-#define GET_TKIP_PN(iv, txpn) \
-do {\
-	txpn._byte_.TSC0 = iv[2];\
-	txpn._byte_.TSC1 = iv[0];\
-	txpn._byte_.TSC2 = iv[4];\
-	txpn._byte_.TSC3 = iv[5];\
-	txpn._byte_.TSC4 = iv[6];\
-	txpn._byte_.TSC5 = iv[7];\
-} while (0)
-
-#define ROL32(A, n) (((A) << (n)) | (((A) >> (32 - (n)))  & ((1UL << (n)) - 1)))
-#define ROR32(A, n) ROL32((A), 32 - (n))
-
-struct mic_data {
-	u32  K0, K1;         /* Key */
-	u32  L, R;           /* Current state */
-	u32  M;              /* Message accumulator (single word) */
-	u32  nBytesInM;      /* # bytes in M */
-};
-
-void seccalctkipmic(
-	u8  *key,
-	u8  *header,
-	u8  *data,
-	u32  data_len,
-	u8  *Miccode,
-	u8   priority);
-
-void r8712_secmicsetkey(struct mic_data *pmicdata, u8 *key);
-void r8712_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nBytes);
-void r8712_secgetmic(struct mic_data *pmicdata, u8 *dst);
-u32 r8712_aes_encrypt(struct _adapter *padapter, u8 *pxmitframe);
-u32 r8712_tkip_encrypt(struct _adapter *padapter, u8 *pxmitframe);
-void r8712_wep_encrypt(struct _adapter *padapter, u8  *pxmitframe);
-void r8712_aes_decrypt(struct _adapter *padapter, u8  *precvframe);
-void r8712_tkip_decrypt(struct _adapter *padapter, u8  *precvframe);
-void r8712_wep_decrypt(struct _adapter *padapter, u8  *precvframe);
-void r8712_use_tkipkey_handler(struct timer_list *t);
-
-#endif	/*__RTL871X_SECURITY_H_ */
-
--- a/drivers/staging/rtl8712/rtl871x_sta_mgt.c
+++ /dev/null
@@ -1,263 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_sta_mgt.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_STA_MGT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "sta_info.h"
-
-static void _init_stainfo(struct sta_info *psta)
-{
-	memset((u8 *)psta, 0, sizeof(struct sta_info));
-	spin_lock_init(&psta->lock);
-	INIT_LIST_HEAD(&psta->list);
-	INIT_LIST_HEAD(&psta->hash_list);
-	_r8712_init_sta_xmit_priv(&psta->sta_xmitpriv);
-	_r8712_init_sta_recv_priv(&psta->sta_recvpriv);
-	INIT_LIST_HEAD(&psta->asoc_list);
-	INIT_LIST_HEAD(&psta->auth_list);
-}
-
-int _r8712_init_sta_priv(struct	sta_priv *pstapriv)
-{
-	struct sta_info *psta;
-	s32 i;
-
-	pstapriv->pallocated_stainfo_buf = kmalloc(sizeof(struct sta_info) *
-						   NUM_STA + 4, GFP_ATOMIC);
-	if (!pstapriv->pallocated_stainfo_buf)
-		return -ENOMEM;
-	pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 -
-		((addr_t)(pstapriv->pallocated_stainfo_buf) & 3);
-	_init_queue(&pstapriv->free_sta_queue);
-	spin_lock_init(&pstapriv->sta_hash_lock);
-	pstapriv->asoc_sta_count = 0;
-	_init_queue(&pstapriv->sleep_q);
-	_init_queue(&pstapriv->wakeup_q);
-	psta = (struct sta_info *)(pstapriv->pstainfo_buf);
-	for (i = 0; i < NUM_STA; i++) {
-		_init_stainfo(psta);
-		INIT_LIST_HEAD(&(pstapriv->sta_hash[i]));
-		list_add_tail(&psta->list, &pstapriv->free_sta_queue.queue);
-		psta++;
-	}
-	INIT_LIST_HEAD(&pstapriv->asoc_list);
-	INIT_LIST_HEAD(&pstapriv->auth_list);
-	return 0;
-}
-
-/* this function is used to free the memory of lock || sema for all stainfos */
-static void mfree_all_stainfo(struct sta_priv *pstapriv)
-{
-	unsigned long irqL;
-	struct list_head *plist, *phead;
-
-	spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
-	phead = &pstapriv->free_sta_queue.queue;
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist))
-		plist = plist->next;
-
-	spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-}
-
-void _r8712_free_sta_priv(struct sta_priv *pstapriv)
-{
-	if (pstapriv) {
-		/* be done before free sta_hash_lock */
-		mfree_all_stainfo(pstapriv);
-		kfree(pstapriv->pallocated_stainfo_buf);
-	}
-}
-
-struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv, u8 *hwaddr)
-{
-	s32	index;
-	struct list_head *phash_list;
-	struct sta_info	*psta;
-	struct  __queue *pfree_sta_queue;
-	struct recv_reorder_ctrl *preorder_ctrl;
-	int i = 0;
-	u16  wRxSeqInitialValue = 0xffff;
-	unsigned long flags;
-
-	pfree_sta_queue = &pstapriv->free_sta_queue;
-	spin_lock_irqsave(&pfree_sta_queue->lock, flags);
-	psta = list_first_entry_or_null(&pfree_sta_queue->queue,
-					struct sta_info, list);
-	if (psta) {
-		list_del_init(&psta->list);
-		_init_stainfo(psta);
-		memcpy(psta->hwaddr, hwaddr, ETH_ALEN);
-		index = wifi_mac_hash(hwaddr);
-		if (index >= NUM_STA) {
-			psta = NULL;
-			goto exit;
-		}
-		phash_list = &pstapriv->sta_hash[index];
-		list_add_tail(&psta->hash_list, phash_list);
-		pstapriv->asoc_sta_count++;
-
-/* For the SMC router, the sequence number of first packet of WPS handshake
- * will be 0. In this case, this packet will be dropped by recv_decache function
- * if we use the 0x00 as the default value for tid_rxseq variable. So, we
- * initialize the tid_rxseq variable as the 0xffff.
- */
-		for (i = 0; i < 16; i++)
-			memcpy(&psta->sta_recvpriv.rxcache.tid_rxseq[i],
-				&wRxSeqInitialValue, 2);
-		/* for A-MPDU Rx reordering buffer control */
-		for (i = 0; i < 16; i++) {
-			preorder_ctrl = &psta->recvreorder_ctrl[i];
-			preorder_ctrl->padapter = pstapriv->padapter;
-			preorder_ctrl->indicate_seq = 0xffff;
-			preorder_ctrl->wend_b = 0xffff;
-			preorder_ctrl->wsize_b = 64;
-			_init_queue(&preorder_ctrl->pending_recvframe_queue);
-			r8712_init_recv_timer(preorder_ctrl);
-		}
-	}
-exit:
-	spin_unlock_irqrestore(&pfree_sta_queue->lock, flags);
-	return psta;
-}
-
-/* using pstapriv->sta_hash_lock to protect */
-void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta)
-{
-	int i;
-	unsigned long irqL0;
-	struct  __queue *pfree_sta_queue;
-	struct recv_reorder_ctrl *preorder_ctrl;
-	struct	sta_xmit_priv *pstaxmitpriv;
-	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct	sta_priv *pstapriv = &padapter->stapriv;
-
-	if (!psta)
-		return;
-	pfree_sta_queue = &pstapriv->free_sta_queue;
-	pstaxmitpriv = &psta->sta_xmitpriv;
-	spin_lock_irqsave(&(pxmitpriv->vo_pending.lock), irqL0);
-	r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vo_q.sta_pending);
-	list_del_init(&(pstaxmitpriv->vo_q.tx_pending));
-	spin_unlock_irqrestore(&(pxmitpriv->vo_pending.lock), irqL0);
-	spin_lock_irqsave(&(pxmitpriv->vi_pending.lock), irqL0);
-	r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->vi_q.sta_pending);
-	list_del_init(&(pstaxmitpriv->vi_q.tx_pending));
-	spin_unlock_irqrestore(&(pxmitpriv->vi_pending.lock), irqL0);
-	spin_lock_irqsave(&(pxmitpriv->bk_pending.lock), irqL0);
-	r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->bk_q.sta_pending);
-	list_del_init(&(pstaxmitpriv->bk_q.tx_pending));
-	spin_unlock_irqrestore(&(pxmitpriv->bk_pending.lock), irqL0);
-	spin_lock_irqsave(&(pxmitpriv->be_pending.lock), irqL0);
-	r8712_free_xmitframe_queue(pxmitpriv, &pstaxmitpriv->be_q.sta_pending);
-	list_del_init(&(pstaxmitpriv->be_q.tx_pending));
-	spin_unlock_irqrestore(&(pxmitpriv->be_pending.lock), irqL0);
-	list_del_init(&psta->hash_list);
-	pstapriv->asoc_sta_count--;
-	/* re-init sta_info; 20061114 */
-	_r8712_init_sta_xmit_priv(&psta->sta_xmitpriv);
-	_r8712_init_sta_recv_priv(&psta->sta_recvpriv);
-	/* for A-MPDU Rx reordering buffer control,
-	 * cancel reordering_ctrl_timer
-	 */
-	for (i = 0; i < 16; i++) {
-		preorder_ctrl = &psta->recvreorder_ctrl[i];
-		del_timer(&preorder_ctrl->reordering_ctrl_timer);
-	}
-	spin_lock(&(pfree_sta_queue->lock));
-	/* insert into free_sta_queue; 20061114 */
-	list_add_tail(&psta->list, &pfree_sta_queue->queue);
-	spin_unlock(&(pfree_sta_queue->lock));
-}
-
-/* free all stainfo which in sta_hash[all] */
-void r8712_free_all_stainfo(struct _adapter *padapter)
-{
-	unsigned long irqL;
-	struct list_head *plist, *phead;
-	s32 index;
-	struct sta_info *psta = NULL;
-	struct	sta_priv *pstapriv = &padapter->stapriv;
-	struct sta_info *pbcmc_stainfo = r8712_get_bcmc_stainfo(padapter);
-
-	if (pstapriv->asoc_sta_count == 1)
-		return;
-	spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
-	for (index = 0; index < NUM_STA; index++) {
-		phead = &(pstapriv->sta_hash[index]);
-		plist = phead->next;
-		while (!end_of_queue_search(phead, plist)) {
-			psta = container_of(plist,
-					    struct sta_info, hash_list);
-			plist = plist->next;
-			if (pbcmc_stainfo != psta)
-				r8712_free_stainfo(padapter, psta);
-		}
-	}
-	spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-}
-
-/* any station allocated can be searched by hash list */
-struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr)
-{
-	unsigned long	 irqL;
-	struct list_head *plist, *phead;
-	struct sta_info *psta = NULL;
-	u32	index;
-
-	if (!hwaddr)
-		return NULL;
-	index = wifi_mac_hash(hwaddr);
-	spin_lock_irqsave(&pstapriv->sta_hash_lock, irqL);
-	phead = &(pstapriv->sta_hash[index]);
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist)) {
-		psta = container_of(plist, struct sta_info, hash_list);
-		if ((!memcmp(psta->hwaddr, hwaddr, ETH_ALEN))) {
-			/* if found the matched address */
-			break;
-		}
-		psta = NULL;
-		plist = plist->next;
-	}
-	spin_unlock_irqrestore(&pstapriv->sta_hash_lock, irqL);
-	return psta;
-}
-
-void r8712_init_bcmc_stainfo(struct _adapter *padapter)
-{
-	unsigned char bcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-	struct	sta_priv *pstapriv = &padapter->stapriv;
-
-	r8712_alloc_stainfo(pstapriv, bcast_addr);
-}
-
-struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter)
-{
-	struct sta_priv *pstapriv = &padapter->stapriv;
-	u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-
-	return r8712_get_stainfo(pstapriv, bc_addr);
-}
-
-u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr)
-{
-	return true;
-}
--- a/drivers/staging/rtl8712/rtl871x_wlan_sme.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_WLAN_SME_H_
-#define _RTL871X_WLAN_SME_H_
-
-#define MSR_APMODE		0x0C
-#define MSR_STAMODE	0x08
-#define MSR_ADHOCMODE	0x04
-#define MSR_NOLINKMODE	0x00
-#define		_1M_RATE_	0
-#define		_2M_RATE_	1
-#define		_5M_RATE_	2
-#define		_11M_RATE_	3
-#define		_6M_RATE_	4
-#define		_9M_RATE_	5
-#define		_12M_RATE_	6
-#define		_18M_RATE_	7
-#define		_24M_RATE_	8
-#define		_36M_RATE_	9
-#define		_48M_RATE_	10
-#define		_54M_RATE_	11
-
-#endif
-
--- a/drivers/staging/rtl8712/rtl871x_xmit.c
+++ /dev/null
@@ -1,1059 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * rtl871x_xmit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _RTL871X_XMIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-#include <linux/usb.h>
-#include <linux/ieee80211.h>
-
-static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8};
-static const u8 RFC1042_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0x00};
-static void init_hwxmits(struct hw_xmit *phwxmit, sint entry);
-static void alloc_hwxmits(struct _adapter *padapter);
-static void free_hwxmits(struct _adapter *padapter);
-
-static void _init_txservq(struct tx_servq *ptxservq)
-{
-	INIT_LIST_HEAD(&ptxservq->tx_pending);
-	_init_queue(&ptxservq->sta_pending);
-	ptxservq->qcnt = 0;
-}
-
-void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
-{
-	memset((unsigned char *)psta_xmitpriv, 0,
-		 sizeof(struct sta_xmit_priv));
-	spin_lock_init(&psta_xmitpriv->lock);
-	_init_txservq(&psta_xmitpriv->be_q);
-	_init_txservq(&psta_xmitpriv->bk_q);
-	_init_txservq(&psta_xmitpriv->vi_q);
-	_init_txservq(&psta_xmitpriv->vo_q);
-	INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz);
-	INIT_LIST_HEAD(&psta_xmitpriv->apsd);
-}
-
-int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
-			  struct _adapter *padapter)
-{
-	sint i;
-	struct xmit_buf *pxmitbuf;
-	struct xmit_frame *pxframe;
-	int j;
-
-	memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
-	spin_lock_init(&pxmitpriv->lock);
-	/*
-	 *Please insert all the queue initialization using _init_queue below
-	 */
-	pxmitpriv->adapter = padapter;
-	_init_queue(&pxmitpriv->be_pending);
-	_init_queue(&pxmitpriv->bk_pending);
-	_init_queue(&pxmitpriv->vi_pending);
-	_init_queue(&pxmitpriv->vo_pending);
-	_init_queue(&pxmitpriv->bm_pending);
-	_init_queue(&pxmitpriv->legacy_dz_queue);
-	_init_queue(&pxmitpriv->apsd_queue);
-	_init_queue(&pxmitpriv->free_xmit_queue);
-	/*
-	 * Please allocate memory with sz = (struct xmit_frame) * NR_XMITFRAME,
-	 * and initialize free_xmit_frame below.
-	 * Please also apply  free_txobj to link_up all the xmit_frames...
-	 */
-	pxmitpriv->pallocated_frame_buf =
-		kmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4,
-			GFP_ATOMIC);
-	if (!pxmitpriv->pallocated_frame_buf) {
-		pxmitpriv->pxmit_frame_buf = NULL;
-		return -ENOMEM;
-	}
-	pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 -
-			((addr_t) (pxmitpriv->pallocated_frame_buf) & 3);
-	pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
-	for (i = 0; i < NR_XMITFRAME; i++) {
-		INIT_LIST_HEAD(&(pxframe->list));
-		pxframe->padapter = padapter;
-		pxframe->frame_tag = DATA_FRAMETAG;
-		pxframe->pkt = NULL;
-		pxframe->buf_addr = NULL;
-		pxframe->pxmitbuf = NULL;
-		list_add_tail(&(pxframe->list),
-				 &(pxmitpriv->free_xmit_queue.queue));
-		pxframe++;
-	}
-	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
-	/*
-	 * init xmit hw_txqueue
-	 */
-	_r8712_init_hw_txqueue(&pxmitpriv->be_txqueue, BE_QUEUE_INX);
-	_r8712_init_hw_txqueue(&pxmitpriv->bk_txqueue, BK_QUEUE_INX);
-	_r8712_init_hw_txqueue(&pxmitpriv->vi_txqueue, VI_QUEUE_INX);
-	_r8712_init_hw_txqueue(&pxmitpriv->vo_txqueue, VO_QUEUE_INX);
-	_r8712_init_hw_txqueue(&pxmitpriv->bmc_txqueue, BMC_QUEUE_INX);
-	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
-	pxmitpriv->txirp_cnt = 1;
-	/*per AC pending irp*/
-	pxmitpriv->beq_cnt = 0;
-	pxmitpriv->bkq_cnt = 0;
-	pxmitpriv->viq_cnt = 0;
-	pxmitpriv->voq_cnt = 0;
-	/*init xmit_buf*/
-	_init_queue(&pxmitpriv->free_xmitbuf_queue);
-	_init_queue(&pxmitpriv->pending_xmitbuf_queue);
-	pxmitpriv->pallocated_xmitbuf =
-		kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC);
-	if (!pxmitpriv->pallocated_xmitbuf)
-		goto clean_up_frame_buf;
-	pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
-			      ((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3);
-	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
-	for (i = 0; i < NR_XMITBUFF; i++) {
-		INIT_LIST_HEAD(&pxmitbuf->list);
-		pxmitbuf->pallocated_buf =
-			kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC);
-		if (!pxmitbuf->pallocated_buf) {
-			j = 0;
-			goto clean_up_alloc_buf;
-		}
-		pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -
-				 ((addr_t) (pxmitbuf->pallocated_buf) &
-				 (XMITBUF_ALIGN_SZ - 1));
-		if (r8712_xmit_resource_alloc(padapter, pxmitbuf)) {
-			j = 1;
-			goto clean_up_alloc_buf;
-		}
-		list_add_tail(&pxmitbuf->list,
-				 &(pxmitpriv->free_xmitbuf_queue.queue));
-		pxmitbuf++;
-	}
-	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
-	INIT_WORK(&padapter->wk_filter_rx_ff0, r8712_SetFilter);
-	alloc_hwxmits(padapter);
-	init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
-	tasklet_setup(&pxmitpriv->xmit_tasklet, r8712_xmit_bh);
-	return 0;
-
-clean_up_alloc_buf:
-	if (j) {
-		/* failure happened in r8712_xmit_resource_alloc()
-		 * delete extra pxmitbuf->pallocated_buf
-		 */
-		kfree(pxmitbuf->pallocated_buf);
-	}
-	for (j = 0; j < i; j++) {
-		int k;
-
-		pxmitbuf--;			/* reset pointer */
-		kfree(pxmitbuf->pallocated_buf);
-		for (k = 0; k < 8; k++)		/* delete xmit urb's */
-			usb_free_urb(pxmitbuf->pxmit_urb[k]);
-	}
-	kfree(pxmitpriv->pallocated_xmitbuf);
-	pxmitpriv->pallocated_xmitbuf = NULL;
-clean_up_frame_buf:
-	kfree(pxmitpriv->pallocated_frame_buf);
-	pxmitpriv->pallocated_frame_buf = NULL;
-	return -ENOMEM;
-}
-
-void _free_xmit_priv(struct xmit_priv *pxmitpriv)
-{
-	int i;
-	struct _adapter *padapter = pxmitpriv->adapter;
-	struct xmit_frame *pxmitframe = (struct xmit_frame *)
-					pxmitpriv->pxmit_frame_buf;
-	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
-
-	if (!pxmitpriv->pxmit_frame_buf)
-		return;
-	for (i = 0; i < NR_XMITFRAME; i++) {
-		r8712_xmit_complete(padapter, pxmitframe);
-		pxmitframe++;
-	}
-	for (i = 0; i < NR_XMITBUFF; i++) {
-		r8712_xmit_resource_free(padapter, pxmitbuf);
-		kfree(pxmitbuf->pallocated_buf);
-		pxmitbuf++;
-	}
-	kfree(pxmitpriv->pallocated_frame_buf);
-	kfree(pxmitpriv->pallocated_xmitbuf);
-	free_hwxmits(padapter);
-}
-
-int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt,
-			struct pkt_attrib *pattrib)
-{
-	struct pkt_file pktfile;
-	struct sta_info *psta = NULL;
-	struct ethhdr etherhdr;
-
-	struct tx_cmd txdesc;
-
-	bool bmcast;
-	struct sta_priv		*pstapriv = &padapter->stapriv;
-	struct security_priv	*psecuritypriv = &padapter->securitypriv;
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct qos_priv		*pqospriv = &pmlmepriv->qospriv;
-
-	_r8712_open_pktfile(pkt, &pktfile);
-
-	_r8712_pktfile_read(&pktfile, (unsigned char *)&etherhdr, ETH_HLEN);
-
-	pattrib->ether_type = ntohs(etherhdr.h_proto);
-
-	/*
-	 * If driver xmit ARP packet, driver can set ps mode to initial
-	 * setting. It stands for getting DHCP or fix IP.
-	 */
-	if (pattrib->ether_type == 0x0806) {
-		if (padapter->pwrctrlpriv.pwr_mode !=
-		    padapter->registrypriv.power_mgnt) {
-			del_timer_sync(&pmlmepriv->dhcp_timer);
-			r8712_set_ps_mode(padapter,
-					  padapter->registrypriv.power_mgnt,
-					  padapter->registrypriv.smart_ps);
-		}
-	}
-
-	memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
-	memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
-	pattrib->pctrl = 0;
-	if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
-	    check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
-		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
-		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
-	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
-		memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
-		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
-	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
-		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
-		memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
-	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		/*firstly, filter packet not belongs to mp*/
-		if (pattrib->ether_type != 0x8712)
-			return -EINVAL;
-		/* for mp storing the txcmd per packet,
-		 * according to the info of txcmd to update pattrib
-		 */
-		/*get MP_TXDESC_SIZE bytes txcmd per packet*/
-		_r8712_pktfile_read(&pktfile, (u8 *)&txdesc, TXDESC_SIZE);
-		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
-		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
-		pattrib->pctrl = 1;
-	}
-	/* r8712_xmitframe_coalesce() overwrite this!*/
-	pattrib->pktlen = pktfile.pkt_len;
-	if (pattrib->ether_type == ETH_P_IP) {
-		/* The following is for DHCP and ARP packet, we use cck1M to
-		 * tx these packets and let LPS awake some time
-		 * to prevent DHCP protocol fail
-		 */
-		u8 tmp[24];
-
-		_r8712_pktfile_read(&pktfile, &tmp[0], 24);
-		pattrib->dhcp_pkt = 0;
-		if (pktfile.pkt_len > 282) {/*MINIMUM_DHCP_PACKET_SIZE)*/
-			if (pattrib->ether_type == ETH_P_IP) {/* IP header*/
-				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
-					((tmp[21] == 67) && (tmp[23] == 68))) {
-					/* 68 : UDP BOOTP client
-					 * 67 : UDP BOOTP server
-					 * Use low rate to send DHCP packet.
-					 */
-					pattrib->dhcp_pkt = 1;
-				}
-			}
-		}
-	}
-	bmcast = is_multicast_ether_addr(pattrib->ra);
-	/* get sta_info*/
-	if (bmcast) {
-		psta = r8712_get_bcmc_stainfo(padapter);
-		pattrib->mac_id = 4;
-	} else {
-		if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-			psta = r8712_get_stainfo(pstapriv,
-						 get_bssid(pmlmepriv));
-			pattrib->mac_id = 5;
-		} else {
-			psta = r8712_get_stainfo(pstapriv, pattrib->ra);
-			if (!psta)  /* drop the pkt */
-				return -ENOMEM;
-			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
-				pattrib->mac_id = 5;
-			else
-				pattrib->mac_id = psta->mac_id;
-		}
-	}
-
-	if (psta) {
-		pattrib->psta = psta;
-	} else {
-		/* if we cannot get psta => drrp the pkt */
-		return -ENOMEM;
-	}
-
-	pattrib->ack_policy = 0;
-	/* get ether_hdr_len */
-	pattrib->pkt_hdrlen = ETH_HLEN;
-
-	if (pqospriv->qos_option) {
-		r8712_set_qos(&pktfile, pattrib);
-	} else {
-		pattrib->hdrlen = WLAN_HDR_A3_LEN;
-		pattrib->subtype = IEEE80211_FTYPE_DATA;
-		pattrib->priority = 0;
-	}
-	if (psta->ieee8021x_blocked) {
-		pattrib->encrypt = 0;
-		if ((pattrib->ether_type != 0x888e) &&
-		    !check_fwstate(pmlmepriv, WIFI_MP_STATE))
-			return -EINVAL;
-	} else {
-		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
-	}
-	switch (pattrib->encrypt) {
-	case _WEP40_:
-	case _WEP104_:
-		pattrib->iv_len = 4;
-		pattrib->icv_len = 4;
-		break;
-	case _TKIP_:
-		pattrib->iv_len = 8;
-		pattrib->icv_len = 4;
-		if (padapter->securitypriv.busetkipkey == _FAIL)
-			return -EINVAL;
-		break;
-	case _AES_:
-		pattrib->iv_len = 8;
-		pattrib->icv_len = 8;
-		break;
-	default:
-		pattrib->iv_len = 0;
-		pattrib->icv_len = 0;
-		break;
-	}
-
-	if (pattrib->encrypt &&
-	    (padapter->securitypriv.sw_encrypt ||
-	    !psecuritypriv->hw_decrypted))
-		pattrib->bswenc = true;
-	else
-		pattrib->bswenc = false;
-	/* if in MP_STATE, update pkt_attrib from mp_txcmd, and overwrite
-	 * some settings above.
-	 */
-	if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
-		pattrib->priority =
-		    (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f;
-	return 0;
-}
-
-static int xmitframe_addmic(struct _adapter *padapter,
-			    struct xmit_frame *pxmitframe)
-{
-	u32	curfragnum, length;
-	u8	*pframe, *payload, mic[8];
-	struct	mic_data micdata;
-	struct	sta_info *stainfo;
-	struct	qos_priv *pqospriv = &(padapter->mlmepriv.qospriv);
-	struct	pkt_attrib  *pattrib = &pxmitframe->attrib;
-	struct	security_priv *psecpriv = &padapter->securitypriv;
-	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	u8 priority[4] = {};
-	bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
-	if (pattrib->psta)
-		stainfo = pattrib->psta;
-	else
-		stainfo = r8712_get_stainfo(&padapter->stapriv,
-					    &pattrib->ra[0]);
-	if (pattrib->encrypt == _TKIP_) {
-		/*encode mic code*/
-		if (stainfo) {
-			u8 null_key[16] = {};
-
-			pframe = pxmitframe->buf_addr + TXDESC_OFFSET;
-			if (bmcst) {
-				if (!memcmp(psecpriv->XGrptxmickey
-				   [psecpriv->XGrpKeyid].skey,
-				   null_key, 16))
-					return -ENOMEM;
-				/*start to calculate the mic code*/
-				r8712_secmicsetkey(&micdata,
-					psecpriv->XGrptxmickey
-					[psecpriv->XGrpKeyid].skey);
-			} else {
-				if (!memcmp(&stainfo->tkiptxmickey.skey[0],
-					    null_key, 16))
-					return -ENOMEM;
-				/* start to calculate the mic code */
-				r8712_secmicsetkey(&micdata,
-					     &stainfo->tkiptxmickey.skey[0]);
-			}
-			if (pframe[1] & 1) {   /* ToDS==1 */
-				r8712_secmicappend(&micdata,
-						   &pframe[16], 6); /*DA*/
-				if (pframe[1] & 2)  /* From Ds==1 */
-					r8712_secmicappend(&micdata,
-							   &pframe[24], 6);
-				else
-					r8712_secmicappend(&micdata,
-							   &pframe[10], 6);
-			} else {	/* ToDS==0 */
-				r8712_secmicappend(&micdata,
-						   &pframe[4], 6); /* DA */
-				if (pframe[1] & 2)  /* From Ds==1 */
-					r8712_secmicappend(&micdata,
-							   &pframe[16], 6);
-				else
-					r8712_secmicappend(&micdata,
-							   &pframe[10], 6);
-			}
-			if (pqospriv->qos_option == 1)
-				priority[0] = (u8)pxmitframe->attrib.priority;
-			r8712_secmicappend(&micdata, &priority[0], 4);
-			payload = pframe;
-			for (curfragnum = 0; curfragnum < pattrib->nr_frags;
-			     curfragnum++) {
-				payload = (u8 *)RND4((addr_t)(payload));
-				payload += pattrib->hdrlen + pattrib->iv_len;
-				if ((curfragnum + 1) == pattrib->nr_frags) {
-					length = pattrib->last_txcmdsz -
-						  pattrib->hdrlen -
-						  pattrib->iv_len -
-						  ((psecpriv->sw_encrypt)
-						  ? pattrib->icv_len : 0);
-					r8712_secmicappend(&micdata, payload,
-							   length);
-					payload = payload + length;
-				} else {
-					length = pxmitpriv->frag_len -
-					    pattrib->hdrlen - pattrib->iv_len -
-					    ((psecpriv->sw_encrypt) ?
-					    pattrib->icv_len : 0);
-					r8712_secmicappend(&micdata, payload,
-							   length);
-					payload = payload + length +
-						  pattrib->icv_len;
-				}
-			}
-			r8712_secgetmic(&micdata, &(mic[0]));
-			/* add mic code  and add the mic code length in
-			 * last_txcmdsz
-			 */
-			memcpy(payload, &(mic[0]), 8);
-			pattrib->last_txcmdsz += 8;
-			payload = payload - pattrib->last_txcmdsz + 8;
-		}
-	}
-	return 0;
-}
-
-static sint xmitframe_swencrypt(struct _adapter *padapter,
-				struct xmit_frame *pxmitframe)
-{
-	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
-
-	if (pattrib->bswenc) {
-		switch (pattrib->encrypt) {
-		case _WEP40_:
-		case _WEP104_:
-			r8712_wep_encrypt(padapter, (u8 *)pxmitframe);
-			break;
-		case _TKIP_:
-			r8712_tkip_encrypt(padapter, (u8 *)pxmitframe);
-			break;
-		case _AES_:
-			r8712_aes_encrypt(padapter, (u8 *)pxmitframe);
-			break;
-		default:
-				break;
-		}
-	}
-	return _SUCCESS;
-}
-
-static int make_wlanhdr(struct _adapter *padapter, u8 *hdr,
-			struct pkt_attrib *pattrib)
-{
-	u16 *qc;
-
-	struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
-	__le16 *fctrl = &pwlanhdr->frame_control;
-	u8 *bssid;
-
-	memset(hdr, 0, WLANHDR_OFFSET);
-	SetFrameSubType(fctrl, pattrib->subtype);
-	if (!(pattrib->subtype & IEEE80211_FTYPE_DATA))
-		return 0;
-
-	bssid = get_bssid(pmlmepriv);
-
-	if (check_fwstate(pmlmepriv,  WIFI_STATION_STATE)) {
-		/* to_ds = 1, fr_ds = 0; */
-		SetToDs(fctrl);
-		ether_addr_copy(pwlanhdr->addr1, bssid);
-		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
-		ether_addr_copy(pwlanhdr->addr3, pattrib->dst);
-	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
-		/* to_ds = 0, fr_ds = 1; */
-		SetFrDs(fctrl);
-		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
-		ether_addr_copy(pwlanhdr->addr2, bssid);
-		ether_addr_copy(pwlanhdr->addr3, pattrib->src);
-	} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
-		   check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
-		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
-		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
-		ether_addr_copy(pwlanhdr->addr3, bssid);
-	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
-		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
-		ether_addr_copy(pwlanhdr->addr3, bssid);
-	} else {
-		return -EINVAL;
-	}
-
-	if (pattrib->encrypt)
-		SetPrivacy(fctrl);
-	if (pqospriv->qos_option) {
-		qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
-		if (pattrib->priority)
-			SetPriority(qc, pattrib->priority);
-		SetAckpolicy(qc, pattrib->ack_policy);
-	}
-	/* TODO: fill HT Control Field */
-	/* Update Seq Num will be handled by f/w */
-	{
-		struct sta_info *psta;
-		bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
-		if (pattrib->psta)
-			psta = pattrib->psta;
-		else if (bmcst)
-			psta = r8712_get_bcmc_stainfo(padapter);
-		else
-			psta = r8712_get_stainfo(&padapter->stapriv,
-						 pattrib->ra);
-
-		if (psta) {
-			u16 *txtid = psta->sta_xmitpriv.txseq_tid;
-
-			txtid[pattrib->priority]++;
-			txtid[pattrib->priority] &= 0xFFF;
-			pattrib->seqnum = txtid[pattrib->priority];
-			SetSeqNum(hdr, pattrib->seqnum);
-		}
-	}
-
-	return 0;
-}
-
-static sint r8712_put_snap(u8 *data, u16 h_proto)
-{
-	struct ieee80211_snap_hdr *snap;
-	const u8 *oui;
-
-	snap = (struct ieee80211_snap_hdr *)data;
-	snap->dsap = 0xaa;
-	snap->ssap = 0xaa;
-	snap->ctrl = 0x03;
-	if (h_proto == 0x8137 || h_proto == 0x80f3)
-		oui = P802_1H_OUI;
-	else
-		oui = RFC1042_OUI;
-	snap->oui[0] = oui[0];
-	snap->oui[1] = oui[1];
-	snap->oui[2] = oui[2];
-	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
-	return SNAP_SIZE + sizeof(u16);
-}
-
-/*
- * This sub-routine will perform all the following:
- * 1. remove 802.3 header.
- * 2. create wlan_header, based on the info in pxmitframe
- * 3. append sta's iv/ext-iv
- * 4. append LLC
- * 5. move frag chunk from pframe to pxmitframe->mem
- * 6. apply sw-encrypt, if necessary.
- */
-sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt,
-			struct xmit_frame *pxmitframe)
-{
-	struct pkt_file pktfile;
-
-	sint	frg_len, mpdu_len, llc_sz;
-	u32	mem_sz;
-	u8	frg_inx;
-	addr_t addr;
-	u8 *pframe, *mem_start, *ptxdesc;
-	struct sta_info		*psta;
-	struct security_priv	*psecpriv = &padapter->securitypriv;
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
-	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
-	u8 *pbuf_start;
-	bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
-	if (!pattrib->psta)
-		return _FAIL;
-	psta = pattrib->psta;
-	if (!pxmitframe->buf_addr)
-		return _FAIL;
-	pbuf_start = pxmitframe->buf_addr;
-	ptxdesc = pbuf_start;
-	mem_start = pbuf_start + TXDESC_OFFSET;
-	if (make_wlanhdr(padapter, mem_start, pattrib))
-		return _FAIL;
-	_r8712_open_pktfile(pkt, &pktfile);
-	_r8712_pktfile_read(&pktfile, NULL, (uint) pattrib->pkt_hdrlen);
-	if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
-		/* truncate TXDESC_SIZE bytes txcmd if at mp mode for 871x */
-		if (pattrib->ether_type == 0x8712) {
-			/* take care -  update_txdesc overwrite this */
-			_r8712_pktfile_read(&pktfile, ptxdesc, TXDESC_SIZE);
-		}
-	}
-	pattrib->pktlen = pktfile.pkt_len;
-	frg_inx = 0;
-	frg_len = pxmitpriv->frag_len - 4;
-	while (1) {
-		llc_sz = 0;
-		mpdu_len = frg_len;
-		pframe = mem_start;
-		SetMFrag(mem_start);
-		pframe += pattrib->hdrlen;
-		mpdu_len -= pattrib->hdrlen;
-		/* adding icv, if necessary...*/
-		if (pattrib->iv_len) {
-			if (psta) {
-				switch (pattrib->encrypt) {
-				case _WEP40_:
-				case _WEP104_:
-					WEP_IV(pattrib->iv, psta->txpn,
-					       (u8)psecpriv->PrivacyKeyIndex);
-					break;
-				case _TKIP_:
-					if (bmcst)
-						TKIP_IV(pattrib->iv,
-						    psta->txpn,
-						    (u8)psecpriv->XGrpKeyid);
-					else
-						TKIP_IV(pattrib->iv, psta->txpn,
-							0);
-					break;
-				case _AES_:
-					if (bmcst)
-						AES_IV(pattrib->iv, psta->txpn,
-						    (u8)psecpriv->XGrpKeyid);
-					else
-						AES_IV(pattrib->iv, psta->txpn,
-						       0);
-					break;
-				}
-			}
-			memcpy(pframe, pattrib->iv, pattrib->iv_len);
-			pframe += pattrib->iv_len;
-			mpdu_len -= pattrib->iv_len;
-		}
-		if (frg_inx == 0) {
-			llc_sz = r8712_put_snap(pframe, pattrib->ether_type);
-			pframe += llc_sz;
-			mpdu_len -= llc_sz;
-		}
-		if ((pattrib->icv_len > 0) && (pattrib->bswenc))
-			mpdu_len -= pattrib->icv_len;
-		if (bmcst)
-			mem_sz = _r8712_pktfile_read(&pktfile, pframe,
-				 pattrib->pktlen);
-		else
-			mem_sz = _r8712_pktfile_read(&pktfile, pframe,
-				 mpdu_len);
-		pframe += mem_sz;
-		if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
-			memcpy(pframe, pattrib->icv, pattrib->icv_len);
-			pframe += pattrib->icv_len;
-		}
-		frg_inx++;
-		if (bmcst || r8712_endofpktfile(&pktfile)) {
-			pattrib->nr_frags = frg_inx;
-			pattrib->last_txcmdsz = pattrib->hdrlen +
-						pattrib->iv_len +
-						((pattrib->nr_frags == 1) ?
-						llc_sz : 0) +
-						((pattrib->bswenc) ?
-						pattrib->icv_len : 0) + mem_sz;
-			ClearMFrag(mem_start);
-			break;
-		}
-		addr = (addr_t)(pframe);
-		mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET;
-		memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen);
-	}
-
-	if (xmitframe_addmic(padapter, pxmitframe))
-		return _FAIL;
-	xmitframe_swencrypt(padapter, pxmitframe);
-	return _SUCCESS;
-}
-
-void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len)
-{
-	uint	protection;
-	u8	*perp;
-	uint	erp_len;
-	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
-
-	switch (pxmitpriv->vcs_setting) {
-	case DISABLE_VCS:
-		pxmitpriv->vcs = NONE_VCS;
-		break;
-	case ENABLE_VCS:
-		break;
-	case AUTO_VCS:
-	default:
-		perp = r8712_get_ie(ie, WLAN_EID_ERP_INFO, &erp_len, ie_len);
-		if (!perp) {
-			pxmitpriv->vcs = NONE_VCS;
-		} else {
-			protection = (*(perp + 2)) & BIT(1);
-			if (protection) {
-				if (pregistrypriv->vcs_type == RTS_CTS)
-					pxmitpriv->vcs = RTS_CTS;
-				else
-					pxmitpriv->vcs = CTS_TO_SELF;
-			} else {
-				pxmitpriv->vcs = NONE_VCS;
-			}
-		}
-		break;
-	}
-}
-
-struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
-{
-	unsigned long irqL;
-	struct xmit_buf *pxmitbuf;
-	struct  __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
-
-	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
-	pxmitbuf = list_first_entry_or_null(&pfree_xmitbuf_queue->queue,
-					    struct xmit_buf, list);
-	if (pxmitbuf) {
-		list_del_init(&pxmitbuf->list);
-		pxmitpriv->free_xmitbuf_cnt--;
-	}
-	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
-	return pxmitbuf;
-}
-
-void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
-{
-	unsigned long irqL;
-	struct  __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
-
-	if (!pxmitbuf)
-		return;
-	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
-	list_del_init(&pxmitbuf->list);
-	list_add_tail(&(pxmitbuf->list), &pfree_xmitbuf_queue->queue);
-	pxmitpriv->free_xmitbuf_cnt++;
-	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
-}
-
-/*
- * Calling context:
- * 1. OS_TXENTRY
- * 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
- *
- * If we turn on USE_RXTHREAD, then, no need for critical section.
- * Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
- *
- * Must be very very cautious...
- *
- */
-struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv)
-{
-	/*
-	 * Please remember to use all the osdep_service api,
-	 * and lock/unlock or _enter/_exit critical to protect
-	 * pfree_xmit_queue
-	 */
-	unsigned long irqL;
-	struct xmit_frame *pxframe;
-	struct  __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
-
-	spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
-	pxframe = list_first_entry_or_null(&pfree_xmit_queue->queue,
-					   struct xmit_frame, list);
-	if (pxframe) {
-		list_del_init(&pxframe->list);
-		pxmitpriv->free_xmitframe_cnt--;
-		pxframe->buf_addr = NULL;
-		pxframe->pxmitbuf = NULL;
-		pxframe->attrib.psta = NULL;
-		pxframe->pkt = NULL;
-	}
-	spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
-	return pxframe;
-}
-
-void r8712_free_xmitframe(struct xmit_priv *pxmitpriv,
-			  struct xmit_frame *pxmitframe)
-{
-	unsigned long irqL;
-	struct  __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
-	struct _adapter *padapter = pxmitpriv->adapter;
-
-	if (!pxmitframe)
-		return;
-	spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
-	list_del_init(&pxmitframe->list);
-	if (pxmitframe->pkt)
-		pxmitframe->pkt = NULL;
-	list_add_tail(&pxmitframe->list, &pfree_xmit_queue->queue);
-	pxmitpriv->free_xmitframe_cnt++;
-	spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
-	if (netif_queue_stopped(padapter->pnetdev))
-		netif_wake_queue(padapter->pnetdev);
-}
-
-void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
-		      struct xmit_frame *pxmitframe)
-{
-	if (!pxmitframe)
-		return;
-	if (pxmitframe->frame_tag == DATA_FRAMETAG)
-		r8712_free_xmitframe(pxmitpriv, pxmitframe);
-}
-
-void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv,
-				struct  __queue *pframequeue)
-{
-	unsigned long irqL;
-	struct list_head *plist, *phead;
-	struct	xmit_frame	*pxmitframe;
-
-	spin_lock_irqsave(&(pframequeue->lock), irqL);
-	phead = &pframequeue->queue;
-	plist = phead->next;
-	while (!end_of_queue_search(phead, plist)) {
-		pxmitframe = container_of(plist, struct xmit_frame, list);
-		plist = plist->next;
-		r8712_free_xmitframe(pxmitpriv, pxmitframe);
-	}
-	spin_unlock_irqrestore(&(pframequeue->lock), irqL);
-}
-
-static inline struct tx_servq *get_sta_pending(struct _adapter *padapter,
-					       struct  __queue **ppstapending,
-					       struct sta_info *psta, sint up)
-{
-	struct tx_servq *ptxservq;
-	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
-
-	switch (up) {
-	case 1:
-	case 2:
-		ptxservq = &(psta->sta_xmitpriv.bk_q);
-		*ppstapending = &padapter->xmitpriv.bk_pending;
-		(phwxmits + 3)->accnt++;
-		break;
-	case 4:
-	case 5:
-		ptxservq = &(psta->sta_xmitpriv.vi_q);
-		*ppstapending = &padapter->xmitpriv.vi_pending;
-		(phwxmits + 1)->accnt++;
-		break;
-	case 6:
-	case 7:
-		ptxservq = &(psta->sta_xmitpriv.vo_q);
-		*ppstapending = &padapter->xmitpriv.vo_pending;
-		(phwxmits + 0)->accnt++;
-		break;
-	case 0:
-	case 3:
-	default:
-		ptxservq = &(psta->sta_xmitpriv.be_q);
-		*ppstapending = &padapter->xmitpriv.be_pending;
-		(phwxmits + 2)->accnt++;
-		break;
-	}
-	return ptxservq;
-}
-
-/*
- * Will enqueue pxmitframe to the proper queue, and indicate it
- * to xx_pending list.....
- */
-int r8712_xmit_classifier(struct _adapter *padapter,
-			  struct xmit_frame *pxmitframe)
-{
-	unsigned long irqL0;
-	struct  __queue *pstapending;
-	struct sta_info	*psta;
-	struct tx_servq	*ptxservq;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-	struct sta_priv *pstapriv = &padapter->stapriv;
-	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
-	bool bmcst = is_multicast_ether_addr(pattrib->ra);
-
-	if (pattrib->psta) {
-		psta = pattrib->psta;
-	} else {
-		if (bmcst) {
-			psta = r8712_get_bcmc_stainfo(padapter);
-		} else {
-			if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
-				psta = r8712_get_stainfo(pstapriv,
-				       get_bssid(pmlmepriv));
-			else
-				psta = r8712_get_stainfo(pstapriv, pattrib->ra);
-		}
-	}
-	if (!psta)
-		return -EINVAL;
-	ptxservq = get_sta_pending(padapter, &pstapending,
-		   psta, pattrib->priority);
-	spin_lock_irqsave(&pstapending->lock, irqL0);
-	if (list_empty(&ptxservq->tx_pending))
-		list_add_tail(&ptxservq->tx_pending, &pstapending->queue);
-	list_add_tail(&pxmitframe->list, &ptxservq->sta_pending.queue);
-	ptxservq->qcnt++;
-	spin_unlock_irqrestore(&pstapending->lock, irqL0);
-	return 0;
-}
-
-static void alloc_hwxmits(struct _adapter *padapter)
-{
-	struct hw_xmit *hwxmits;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
-	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
-	pxmitpriv->hwxmits = kmalloc_array(pxmitpriv->hwxmit_entry,
-				sizeof(struct hw_xmit), GFP_ATOMIC);
-	if (!pxmitpriv->hwxmits)
-		return;
-	hwxmits = pxmitpriv->hwxmits;
-	if (pxmitpriv->hwxmit_entry == 5) {
-		pxmitpriv->bmc_txqueue.head = 0;
-		hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue;
-		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
-		pxmitpriv->vo_txqueue.head = 0;
-		hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue;
-		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
-		pxmitpriv->vi_txqueue.head = 0;
-		hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue;
-		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
-		pxmitpriv->bk_txqueue.head = 0;
-		hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
-		pxmitpriv->be_txqueue.head = 0;
-		hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue;
-		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
-	} else if (pxmitpriv->hwxmit_entry == 4) {
-		pxmitpriv->vo_txqueue.head = 0;
-		hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue;
-		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
-		pxmitpriv->vi_txqueue.head = 0;
-		hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue;
-		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
-		pxmitpriv->be_txqueue.head = 0;
-		hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue;
-		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
-		pxmitpriv->bk_txqueue.head = 0;
-		hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
-	}
-}
-
-static void free_hwxmits(struct _adapter *padapter)
-{
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
-	kfree(pxmitpriv->hwxmits);
-}
-
-static void init_hwxmits(struct hw_xmit *phwxmit, sint entry)
-{
-	sint i;
-
-	for (i = 0; i < entry; i++, phwxmit++) {
-		spin_lock_init(&phwxmit->xmit_lock);
-		INIT_LIST_HEAD(&phwxmit->pending);
-		phwxmit->txcmdcnt = 0;
-		phwxmit->accnt = 0;
-	}
-}
-
-void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe,
-			struct xmit_buf *pxmitbuf)
-{
-	/* pxmitbuf attach to pxmitframe */
-	pxmitframe->pxmitbuf = pxmitbuf;
-	/* urb and irp connection */
-	pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
-	/* buffer addr assoc */
-	pxmitframe->buf_addr = pxmitbuf->pbuf;
-	/* pxmitframe attach to pxmitbuf */
-	pxmitbuf->priv_data = pxmitframe;
-}
-
-/*
- * tx_action == 0 == no frames to transmit
- * tx_action > 0 ==> we have frames to transmit
- * tx_action < 0 ==> we have frames to transmit, but TXFF is not even enough
- *						 to transmit 1 frame.
- */
-
-int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe)
-{
-	unsigned long irqL;
-	int ret;
-	struct xmit_buf *pxmitbuf = NULL;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
-	r8712_do_queue_select(padapter, pattrib);
-	spin_lock_irqsave(&pxmitpriv->lock, irqL);
-	if (r8712_txframes_sta_ac_pending(padapter, pattrib) > 0) {
-		ret = false;
-		r8712_xmit_enqueue(padapter, pxmitframe);
-		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
-		return ret;
-	}
-	pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv);
-	if (!pxmitbuf) { /*enqueue packet*/
-		ret = false;
-		r8712_xmit_enqueue(padapter, pxmitframe);
-		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
-	} else { /*dump packet directly*/
-		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
-		ret = true;
-		xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
-		r8712_xmit_direct(padapter, pxmitframe);
-	}
-	return ret;
-}
--- a/drivers/staging/rtl8712/rtl871x_xmit.h
+++ /dev/null
@@ -1,288 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _RTL871X_XMIT_H_
-#define _RTL871X_XMIT_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "xmit_osdep.h"
-
-#ifdef CONFIG_R8712_TX_AGGR
-#define MAX_XMITBUF_SZ  (16384)
-#else
-#define MAX_XMITBUF_SZ  (2048)
-#endif
-
-#define NR_XMITBUFF     (4)
-
-#ifdef CONFIG_R8712_TX_AGGR
-#define AGGR_NR_HIGH_BOUND      (4) /*(8) */
-#define AGGR_NR_LOW_BOUND       (2)
-#endif
-
-#define XMITBUF_ALIGN_SZ 512
-#define TX_GUARD_BAND		5
-#define MAX_NUMBLKS		(1)
-
-/* Fixed the Big Endian bug when using the software driver encryption.*/
-#define WEP_IV(pattrib_iv, txpn, keyidx)\
-do { \
-	pattrib_iv[0] = txpn._byte_.TSC0;\
-	pattrib_iv[1] = txpn._byte_.TSC1;\
-	pattrib_iv[2] = txpn._byte_.TSC2;\
-	pattrib_iv[3] = ((keyidx & 0x3) << 6);\
-	txpn.val = (txpn.val == 0xffffff) ? 0 : (txpn.val + 1);\
-} while (0)
-
-/* Fixed the Big Endian bug when doing the Tx.
- * The Linksys WRH54G will check this.
- */
-#define TKIP_IV(pattrib_iv, txpn, keyidx)\
-do { \
-	pattrib_iv[0] = txpn._byte_.TSC1;\
-	pattrib_iv[1] = (txpn._byte_.TSC1 | 0x20) & 0x7f;\
-	pattrib_iv[2] = txpn._byte_.TSC0;\
-	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\
-	pattrib_iv[4] = txpn._byte_.TSC2;\
-	pattrib_iv[5] = txpn._byte_.TSC3;\
-	pattrib_iv[6] = txpn._byte_.TSC4;\
-	pattrib_iv[7] = txpn._byte_.TSC5;\
-	txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \
-	(txpn.val + 1);\
-} while (0)
-
-#define AES_IV(pattrib_iv, txpn, keyidx)\
-do { \
-	pattrib_iv[0] = txpn._byte_.TSC0;\
-	pattrib_iv[1] = txpn._byte_.TSC1;\
-	pattrib_iv[2] = 0;\
-	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3) << 6);\
-	pattrib_iv[4] = txpn._byte_.TSC2;\
-	pattrib_iv[5] = txpn._byte_.TSC3;\
-	pattrib_iv[6] = txpn._byte_.TSC4;\
-	pattrib_iv[7] = txpn._byte_.TSC5;\
-	txpn.val = txpn.val == 0xffffffffffffULL ? 0 : \
-	(txpn.val + 1);\
-} while (0)
-
-struct hw_xmit {
-	spinlock_t xmit_lock;
-	struct list_head pending;
-	struct  __queue *sta_queue;
-	struct hw_txqueue *phwtxqueue;
-	sint	txcmdcnt;
-	int	accnt;
-};
-
-struct pkt_attrib {
-	u8	type;
-	u8	subtype;
-	u8	bswenc;
-	u8	dhcp_pkt;
-
-	u16	seqnum;
-	u16	ether_type;
-	u16	pktlen;		/* the original 802.3 pkt raw_data len
-				 * (not include ether_hdr data)
-				 */
-	u16	last_txcmdsz;
-
-	u8	pkt_hdrlen;	/*the original 802.3 pkt header len*/
-	u8	hdrlen;		/*the WLAN Header Len*/
-	u8	nr_frags;
-	u8	ack_policy;
-	u8	mac_id;
-	u8	vcs_mode;	/*virtual carrier sense method*/
-	u8	pctrl;/*per packet txdesc control enable*/
-	u8	qsel;
-
-	u8	priority;
-	u8	encrypt;	/* when 0 indicate no encrypt. when non-zero,
-				 * indicate the encrypt algorithm
-				 */
-	u8	iv_len;
-	u8	icv_len;
-	unsigned char iv[8];
-	unsigned char icv[8];
-	u8	dst[ETH_ALEN] __aligned(2);	/* for ether_addr_copy */
-	u8	src[ETH_ALEN];
-	u8	ta[ETH_ALEN];
-	u8	ra[ETH_ALEN];
-	struct sta_info *psta;
-};
-
-#define WLANHDR_OFFSET	64
-#define DATA_FRAMETAG		0x01
-#define L2_FRAMETAG		0x02
-#define MGNT_FRAMETAG		0x03
-#define AMSDU_FRAMETAG	0x04
-#define EII_FRAMETAG		0x05
-#define IEEE8023_FRAMETAG  0x06
-#define MP_FRAMETAG		0x07
-#define TXAGG_FRAMETAG	0x08
-
-struct xmit_buf {
-	struct list_head list;
-
-	u8 *pallocated_buf;
-	u8 *pbuf;
-	void *priv_data;
-	struct urb *pxmit_urb[8];
-	u32 aggr_nr;
-};
-
-struct xmit_frame {
-	struct list_head list;
-	struct pkt_attrib attrib;
-	_pkt *pkt;
-	int frame_tag;
-	struct _adapter *padapter;
-	u8 *buf_addr;
-	struct xmit_buf *pxmitbuf;
-	u8 *mem_addr;
-	u16 sz[8];
-	struct urb *pxmit_urb[8];
-	u8 bpending[8];
-	u8 last[8];
-};
-
-struct tx_servq {
-	struct list_head tx_pending;
-	struct  __queue	sta_pending;
-	int qcnt;
-};
-
-struct sta_xmit_priv {
-	spinlock_t lock;
-	sint	option;
-	sint	apsd_setting;	/* When bit mask is on, the associated edca
-				 * queue supports APSD.
-				 */
-	struct tx_servq	be_q;	/* priority == 0,3 */
-	struct tx_servq	bk_q;	/* priority == 1,2*/
-	struct tx_servq	vi_q;	/*priority == 4,5*/
-	struct tx_servq	vo_q;	/*priority == 6,7*/
-	struct list_head  legacy_dz;
-	struct list_head apsd;
-	u16 txseq_tid[16];
-	uint	sta_tx_bytes;
-	u64	sta_tx_pkts;
-	uint	sta_tx_fail;
-};
-
-struct	hw_txqueue {
-	sint	head;
-	sint	tail;
-	sint	free_sz;	/* in units of 64 bytes */
-	sint	free_cmdsz;
-	sint	txsz[8];
-	uint	ff_hwaddr;
-	uint	cmd_hwaddr;
-	sint	ac_tag;
-};
-
-struct	xmit_priv {
-	spinlock_t lock;
-	struct  __queue	be_pending;
-	struct  __queue	bk_pending;
-	struct  __queue	vi_pending;
-	struct  __queue	vo_pending;
-	struct  __queue	bm_pending;
-	struct  __queue	legacy_dz_queue;
-	struct  __queue	apsd_queue;
-	u8 *pallocated_frame_buf;
-	u8 *pxmit_frame_buf;
-	uint free_xmitframe_cnt;
-	uint mapping_addr;
-	uint pkt_sz;
-	struct  __queue	free_xmit_queue;
-	struct	hw_txqueue	be_txqueue;
-	struct	hw_txqueue	bk_txqueue;
-	struct	hw_txqueue	vi_txqueue;
-	struct	hw_txqueue	vo_txqueue;
-	struct	hw_txqueue	bmc_txqueue;
-	uint	frag_len;
-	struct _adapter	*adapter;
-	u8   vcs_setting;
-	u8	vcs;
-	u8	vcs_type;
-	u16  rts_thresh;
-	uint	tx_bytes;
-	u64	tx_pkts;
-	uint	tx_drop;
-	struct hw_xmit *hwxmits;
-	u8	hwxmit_entry;
-	u8	txirp_cnt;
-	struct tasklet_struct xmit_tasklet;
-	struct work_struct xmit_pipe4_reset_wi;
-	struct work_struct xmit_pipe6_reset_wi;
-	struct work_struct xmit_piped_reset_wi;
-	/*per AC pending irp*/
-	int beq_cnt;
-	int bkq_cnt;
-	int viq_cnt;
-	int voq_cnt;
-	struct  __queue	free_amsdu_xmit_queue;
-	u8 *pallocated_amsdu_frame_buf;
-	u8 *pxmit_amsdu_frame_buf;
-	uint free_amsdu_xmitframe_cnt;
-	struct  __queue free_txagg_xmit_queue;
-	u8 *pallocated_txagg_frame_buf;
-	u8 *pxmit_txagg_frame_buf;
-	uint free_txagg_xmitframe_cnt;
-	int cmdseq;
-	struct  __queue free_xmitbuf_queue;
-	struct  __queue pending_xmitbuf_queue;
-	u8 *pallocated_xmitbuf;
-	u8 *pxmitbuf;
-	uint free_xmitbuf_cnt;
-};
-
-void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv,
-			struct xmit_buf *pxmitbuf);
-struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv);
-void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len);
-struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv);
-void r8712_free_xmitframe(struct xmit_priv *pxmitpriv,
-			  struct xmit_frame *pxmitframe);
-void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv,
-				struct  __queue *pframequeue);
-int r8712_xmit_classifier(struct _adapter *padapter,
-			  struct xmit_frame *pxmitframe);
-sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt,
-			      struct xmit_frame *pxmitframe);
-sint _r8712_init_hw_txqueue(struct hw_txqueue *phw_txqueue, u8 ac_tag);
-void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv);
-int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt,
-			struct pkt_attrib *pattrib);
-int r8712_txframes_sta_ac_pending(struct _adapter *padapter,
-				  struct pkt_attrib *pattrib);
-int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
-			  struct _adapter *padapter);
-void _free_xmit_priv(struct xmit_priv *pxmitpriv);
-void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
-			     struct xmit_frame *pxmitframe);
-int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe);
-int r8712_xmit_enqueue(struct _adapter *padapter,
-		       struct xmit_frame *pxmitframe);
-void r8712_xmit_direct(struct _adapter *padapter, struct xmit_frame *pxmitframe);
-void r8712_xmit_bh(struct tasklet_struct *t);
-
-void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe,
-			      struct xmit_buf *pxmitbuf);
-
-#include "rtl8712_xmit.h"
-
-#endif	/*_RTL871X_XMIT_H_*/
-
--- a/drivers/staging/rtl8712/sta_info.h
+++ /dev/null
@@ -1,132 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __STA_INFO_H_
-#define __STA_INFO_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "wifi.h"
-
-#define NUM_STA 32
-#define NUM_ACL 64
-
-/* if mode ==0, then the sta is allowed once the addr is hit.
- * if mode ==1, then the sta is rejected once the addr is non-hit.
- */
-struct wlan_acl_node {
-	struct list_head list;
-	u8       addr[ETH_ALEN];
-	u8       mode;
-};
-
-struct wlan_acl_pool {
-	struct wlan_acl_node aclnode[NUM_ACL];
-};
-
-struct	stainfo_stats {
-	uint	rx_pkts;
-	uint	rx_bytes;
-	u64	tx_pkts;
-	uint	tx_bytes;
-};
-
-struct sta_info {
-	spinlock_t lock;
-	struct list_head list; /*free_sta_queue*/
-	struct list_head hash_list; /*sta_hash*/
-	struct sta_xmit_priv sta_xmitpriv;
-	struct sta_recv_priv sta_recvpriv;
-	uint state;
-	uint aid;
-	uint	mac_id;
-	uint	qos_option;
-	u8	hwaddr[ETH_ALEN];
-	uint	ieee8021x_blocked;	/*0: allowed, 1:blocked */
-	uint	XPrivacy; /*aes, tkip...*/
-	union Keytype	tkiptxmickey;
-	union Keytype	tkiprxmickey;
-	union Keytype	x_UncstKey;
-	union pn48		txpn;	/* PN48 used for Unicast xmit.*/
-	union pn48		rxpn;	/* PN48 used for Unicast recv.*/
-	u8	bssrateset[16];
-	uint	bssratelen;
-	s32  rssi;
-	s32	signal_quality;
-	struct stainfo_stats sta_stats;
-	/*for A-MPDU Rx reordering buffer control */
-	struct recv_reorder_ctrl recvreorder_ctrl[16];
-	struct ht_priv	htpriv;
-	/* Notes:
-	 * STA_Mode:
-	 * curr_network(mlme_priv/security_priv/qos/ht)
-	 *   + sta_info: (STA & AP) CAP/INFO
-	 * scan_q: AP CAP/INFO
-	 * AP_Mode:
-	 * curr_network(mlme_priv/security_priv/qos/ht) : AP CAP/INFO
-	 * sta_info: (AP & STA) CAP/INFO
-	 */
-	struct list_head asoc_list;
-	struct list_head auth_list;
-	unsigned int expire_to;
-	unsigned int auth_seq;
-	unsigned int authalg;
-	unsigned char chg_txt[128];
-	unsigned int tx_ra_bitmap;
-};
-
-struct	sta_priv {
-	u8 *pallocated_stainfo_buf;
-	u8 *pstainfo_buf;
-	struct  __queue	free_sta_queue;
-	spinlock_t sta_hash_lock;
-	struct list_head sta_hash[NUM_STA];
-	int asoc_sta_count;
-	struct  __queue sleep_q;
-	struct  __queue wakeup_q;
-	struct _adapter *padapter;
-	struct list_head asoc_list;
-	struct list_head auth_list;
-	unsigned int auth_to;  /* sec, time to expire in authenticating. */
-	unsigned int assoc_to; /* sec, time to expire before associating. */
-	unsigned int expire_to; /* sec , time to expire after associated. */
-};
-
-static inline u32 wifi_mac_hash(u8 *mac)
-{
-	u32 x;
-
-	x = mac[0];
-	x = (x << 2) ^ mac[1];
-	x = (x << 2) ^ mac[2];
-	x = (x << 2) ^ mac[3];
-	x = (x << 2) ^ mac[4];
-	x = (x << 2) ^ mac[5];
-	x ^= x >> 8;
-	x  = x & (NUM_STA - 1);
-	return x;
-}
-
-int _r8712_init_sta_priv(struct sta_priv *pstapriv);
-void _r8712_free_sta_priv(struct sta_priv *pstapriv);
-struct sta_info *r8712_alloc_stainfo(struct sta_priv *pstapriv,
-				     u8 *hwaddr);
-void r8712_free_stainfo(struct _adapter *padapter, struct sta_info *psta);
-void r8712_free_all_stainfo(struct _adapter *padapter);
-struct sta_info *r8712_get_stainfo(struct sta_priv *pstapriv, u8 *hwaddr);
-void r8712_init_bcmc_stainfo(struct _adapter *padapter);
-struct sta_info *r8712_get_bcmc_stainfo(struct _adapter *padapter);
-u8 r8712_access_ctrl(struct wlan_acl_pool *pacl_list, u8 *mac_addr);
-
-#endif /* _STA_INFO_H_ */
-
--- a/drivers/staging/rtl8712/usb_halinit.c
+++ /dev/null
@@ -1,307 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_halinit.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_HAL_INIT_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "usb_ops.h"
-#include "usb_osintf.h"
-
-u8 r8712_usb_hal_bus_init(struct _adapter *adapter)
-{
-	u8 val8 = 0;
-	u8 ret = _SUCCESS;
-	int PollingCnt = 20;
-	struct registry_priv *registrypriv = &adapter->registrypriv;
-
-	if (registrypriv->chip_version == RTL8712_FPGA) {
-		val8 = 0x01;
-		/* switch to 80M clock */
-		r8712_write8(adapter, SYS_CLKR, val8);
-		val8 = r8712_read8(adapter, SPS1_CTRL);
-		val8 = val8 | 0x01;
-		/* enable VSPS12 LDO Macro block */
-		r8712_write8(adapter, SPS1_CTRL, val8);
-		val8 = r8712_read8(adapter, AFE_MISC);
-		val8 = val8 | 0x01;
-		/* Enable AFE Macro Block's Bandgap */
-		r8712_write8(adapter, AFE_MISC, val8);
-		val8 = r8712_read8(adapter, LDOA15_CTRL);
-		val8 = val8 | 0x01;
-		/* enable LDOA15 block */
-		r8712_write8(adapter, LDOA15_CTRL, val8);
-		val8 = r8712_read8(adapter, SPS1_CTRL);
-		val8 = val8 | 0x02;
-		/* Enable VSPS12_SW Macro Block */
-		r8712_write8(adapter, SPS1_CTRL, val8);
-		val8 = r8712_read8(adapter, AFE_MISC);
-		val8 = val8 | 0x02;
-		/* Enable AFE Macro Block's Mbias */
-		r8712_write8(adapter, AFE_MISC, val8);
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		val8 = val8 | 0x08;
-		/* isolate PCIe Analog 1.2V to PCIe 3.3V and PCIE Digital */
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, val8);
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		val8 = val8 & 0xEF;
-		/* attach AFE PLL to MACTOP/BB/PCIe Digital */
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, val8);
-		val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
-		val8 = val8 & 0xFB;
-		/* enable AFE clock */
-		r8712_write8(adapter, AFE_XTAL_CTRL + 1, val8);
-		val8 = r8712_read8(adapter, AFE_PLL_CTRL);
-		val8 = val8 | 0x01;
-		/* Enable AFE PLL Macro Block */
-		r8712_write8(adapter, AFE_PLL_CTRL, val8);
-		val8 = 0xEE;
-		/* release isolation AFE PLL & MD */
-		r8712_write8(adapter, SYS_ISO_CTRL, val8);
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		val8 = val8 | 0x08;
-		/* enable MAC clock */
-		r8712_write8(adapter, SYS_CLKR + 1, val8);
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		val8 = val8 | 0x08;
-		/* enable Core digital and enable IOREG R/W */
-		r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
-		val8 = val8 | 0x80;
-		/* enable REG_EN */
-		r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		val8 = (val8 | 0x80) & 0xBF;
-		/* switch the control path */
-		r8712_write8(adapter, SYS_CLKR + 1, val8);
-		val8 = 0xFC;
-		r8712_write8(adapter, CR, val8);
-		val8 = 0x37;
-		r8712_write8(adapter, CR + 1, val8);
-		/* reduce EndPoint & init it */
-		r8712_write8(adapter, 0x102500ab, r8712_read8(adapter,
-			     0x102500ab) | BIT(6) | BIT(7));
-		/* consideration of power consumption - init */
-		r8712_write8(adapter, 0x10250008, r8712_read8(adapter,
-			     0x10250008) & 0xfffffffb);
-	} else if (registrypriv->chip_version == RTL8712_1stCUT) {
-		/* Initialization for power on sequence, */
-		r8712_write8(adapter, SPS0_CTRL + 1, 0x53);
-		r8712_write8(adapter, SPS0_CTRL, 0x57);
-		/* Enable AFE Macro Block's Bandgap and Enable AFE Macro
-		 * Block's Mbias
-		 */
-		val8 = r8712_read8(adapter, AFE_MISC);
-		r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN |
-			     AFE_MISC_MBEN));
-		/* Enable LDOA15 block */
-		val8 = r8712_read8(adapter, LDOA15_CTRL);
-		r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN));
-		val8 = r8712_read8(adapter, SPS1_CTRL);
-		r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_LDEN));
-		msleep(20);
-		/* Enable Switch Regulator Block */
-		val8 = r8712_read8(adapter, SPS1_CTRL);
-		r8712_write8(adapter, SPS1_CTRL, (val8 | SPS1_SWEN));
-		r8712_write32(adapter, SPS1_CTRL, 0x00a7b267);
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08));
-		/* Engineer Packet CP test Enable */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20));
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x6F));
-		/* Enable AFE clock */
-		val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
-		r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb));
-		/* Enable AFE PLL Macro Block */
-		val8 = r8712_read8(adapter, AFE_PLL_CTRL);
-		r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
-		/* Attach AFE PLL to MACTOP/BB/PCIe Digital */
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL);
-		r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE));
-		/* Switch to 40M clock */
-		val8 = r8712_read8(adapter, SYS_CLKR);
-		r8712_write8(adapter, SYS_CLKR, val8 & (~SYS_CLKSEL));
-		/* SSC Disable */
-		val8 = r8712_read8(adapter, SYS_CLKR);
-		/* Enable MAC clock */
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18));
-		/* Revised POS, */
-		r8712_write8(adapter, PMC_FSM, 0x02);
-		/* Enable Core digital and enable IOREG R/W */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08));
-		/* Enable REG_EN */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80));
-		/* Switch the control path to FW */
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF);
-		r8712_write8(adapter, CR, 0xFC);
-		r8712_write8(adapter, CR + 1, 0x37);
-		/* Fix the RX FIFO issue(usb error), */
-		val8 = r8712_read8(adapter, 0x1025FE5c);
-		r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7)));
-		val8 = r8712_read8(adapter, 0x102500ab);
-		r8712_write8(adapter, 0x102500ab, (val8 | BIT(6) | BIT(7)));
-		/* For power save, used this in the bit file after 970621 */
-		val8 = r8712_read8(adapter, SYS_CLKR);
-		r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL));
-	} else if (registrypriv->chip_version == RTL8712_2ndCUT ||
-		   registrypriv->chip_version == RTL8712_3rdCUT) {
-		/* Initialization for power on sequence,
-		 * E-Fuse leakage prevention sequence
-		 */
-		r8712_write8(adapter, 0x37, 0xb0);
-		msleep(20);
-		r8712_write8(adapter, 0x37, 0x30);
-		/* Set control path switch to HW control and reset Digital Core,
-		 * CPU Core and MAC I/O to solve FW download fail when system
-		 * from resume sate.
-		 */
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		if (val8 & 0x80) {
-			val8 &= 0x3f;
-			r8712_write8(adapter, SYS_CLKR + 1, val8);
-		}
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		val8 &= 0x73;
-		r8712_write8(adapter, SYS_FUNC_EN + 1, val8);
-		msleep(20);
-		/* Revised POS, */
-		/* Enable AFE Macro Block's Bandgap and Enable AFE Macro
-		 * Block's Mbias
-		 */
-		r8712_write8(adapter, SPS0_CTRL + 1, 0x53);
-		r8712_write8(adapter, SPS0_CTRL, 0x57);
-		val8 = r8712_read8(adapter, AFE_MISC);
-		/*Bandgap*/
-		r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN));
-		r8712_write8(adapter, AFE_MISC, (val8 | AFE_MISC_BGEN |
-			     AFE_MISC_MBEN | AFE_MISC_I32_EN));
-		/* Enable PLL Power (LDOA15V) */
-		val8 = r8712_read8(adapter, LDOA15_CTRL);
-		r8712_write8(adapter, LDOA15_CTRL, (val8 | LDA15_EN));
-		/* Enable LDOV12D block */
-		val8 = r8712_read8(adapter, LDOV12D_CTRL);
-		r8712_write8(adapter, LDOV12D_CTRL, (val8 | LDV12_EN));
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 | 0x08));
-		/* Engineer Packet CP test Enable */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x20));
-		/* Support 64k IMEM */
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL + 1);
-		r8712_write8(adapter, SYS_ISO_CTRL + 1, (val8 & 0x68));
-		/* Enable AFE clock */
-		val8 = r8712_read8(adapter, AFE_XTAL_CTRL + 1);
-		r8712_write8(adapter, AFE_XTAL_CTRL + 1, (val8 & 0xfb));
-		/* Enable AFE PLL Macro Block */
-		val8 = r8712_read8(adapter, AFE_PLL_CTRL);
-		r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
-		/* Some sample will download fw failure. The clock will be
-		 * stable with 500 us delay after reset the PLL
-		 * TODO: When usleep is added to kernel, change next 3
-		 * udelay(500) to usleep(500)
-		 */
-		udelay(500);
-		r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x51));
-		udelay(500);
-		r8712_write8(adapter, AFE_PLL_CTRL, (val8 | 0x11));
-		udelay(500);
-		/* Attach AFE PLL to MACTOP/BB/PCIe Digital */
-		val8 = r8712_read8(adapter, SYS_ISO_CTRL);
-		r8712_write8(adapter, SYS_ISO_CTRL, (val8 & 0xEE));
-		/* Switch to 40M clock */
-		r8712_write8(adapter, SYS_CLKR, 0x00);
-		/* CPU Clock and 80M Clock SSC Disable to overcome FW download
-		 * fail timing issue.
-		 */
-		val8 = r8712_read8(adapter, SYS_CLKR);
-		r8712_write8(adapter, SYS_CLKR, (val8 | 0xa0));
-		/* Enable MAC clock */
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x18));
-		/* Revised POS, */
-		r8712_write8(adapter, PMC_FSM, 0x02);
-		/* Enable Core digital and enable IOREG R/W */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x08));
-		/* Enable REG_EN */
-		val8 = r8712_read8(adapter, SYS_FUNC_EN + 1);
-		r8712_write8(adapter, SYS_FUNC_EN + 1, (val8 | 0x80));
-		/* Switch the control path to FW */
-		val8 = r8712_read8(adapter, SYS_CLKR + 1);
-		r8712_write8(adapter, SYS_CLKR + 1, (val8 | 0x80) & 0xBF);
-		r8712_write8(adapter, CR, 0xFC);
-		r8712_write8(adapter, CR + 1, 0x37);
-		/* Fix the RX FIFO issue(usb error), 970410 */
-		val8 = r8712_read8(adapter, 0x1025FE5c);
-		r8712_write8(adapter, 0x1025FE5c, (val8 | BIT(7)));
-		/* For power save, used this in the bit file after 970621 */
-		val8 = r8712_read8(adapter, SYS_CLKR);
-		r8712_write8(adapter, SYS_CLKR, val8 & (~CPU_CLKSEL));
-		/* Revised for 8051 ROM code wrong operation. */
-		r8712_write8(adapter, 0x1025fe1c, 0x80);
-		/* To make sure that TxDMA can ready to download FW.
-		 * We should reset TxDMA if IMEM RPT was not ready.
-		 */
-		do {
-			val8 = r8712_read8(adapter, TCR);
-			if ((val8 & _TXDMA_INIT_VALUE) == _TXDMA_INIT_VALUE)
-				break;
-			udelay(5); /* PlatformStallExecution(5); */
-		} while (PollingCnt--);	/* Delay 1ms */
-
-		if (PollingCnt <= 0) {
-			val8 = r8712_read8(adapter, CR);
-			r8712_write8(adapter, CR, val8 & (~_TXDMA_EN));
-			udelay(2); /* PlatformStallExecution(2); */
-			/* Reset TxDMA */
-			r8712_write8(adapter, CR, val8 | _TXDMA_EN);
-		}
-	} else {
-		ret = _FAIL;
-	}
-	return ret;
-}
-
-unsigned int r8712_usb_inirp_init(struct _adapter *adapter)
-{
-	u8 i;
-	struct recv_buf *recvbuf;
-	struct intf_hdl *intfhdl = &adapter->pio_queue->intf;
-	struct recv_priv *recvpriv = &(adapter->recvpriv);
-
-	recvpriv->ff_hwaddr = RTL8712_DMA_RX0FF; /* mapping rx fifo address */
-	/* issue Rx irp to receive data */
-	recvbuf = (struct recv_buf *)recvpriv->precv_buf;
-	for (i = 0; i < NR_RECVBUFF; i++) {
-		if (r8712_usb_read_port(intfhdl, recvpriv->ff_hwaddr, 0,
-					(unsigned char *)recvbuf) == false)
-			return _FAIL;
-		recvbuf++;
-		recvpriv->free_recv_buf_queue_cnt--;
-	}
-	return _SUCCESS;
-}
-
-unsigned int r8712_usb_inirp_deinit(struct _adapter *adapter)
-{
-	r8712_usb_read_port_cancel(adapter);
-	return _SUCCESS;
-}
--- a/drivers/staging/rtl8712/usb_intf.c
+++ /dev/null
@@ -1,638 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_intf.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_INTF_C_
-
-#include <linux/usb.h>
-#include <linux/module.h>
-#include <linux/firmware.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "recv_osdep.h"
-#include "xmit_osdep.h"
-#include "rtl8712_efuse.h"
-#include "usb_ops.h"
-#include "usb_osintf.h"
-
-static struct usb_interface *pintf;
-
-static int r871xu_drv_init(struct usb_interface *pusb_intf,
-			   const struct usb_device_id *pdid);
-
-static void r871xu_dev_remove(struct usb_interface *pusb_intf);
-
-static const struct usb_device_id rtl871x_usb_id_tbl[] = {
-/* RTL8188SU */
-	/* Realtek */
-	{USB_DEVICE(0x0BDA, 0x8171)},
-	{USB_DEVICE(0x0bda, 0x8173)},
-	{USB_DEVICE(0x0bda, 0x8712)},
-	{USB_DEVICE(0x0bda, 0x8713)},
-	{USB_DEVICE(0x0bda, 0xC512)},
-	/* Abocom */
-	{USB_DEVICE(0x07B8, 0x8188)},
-	/* ASUS */
-	{USB_DEVICE(0x0B05, 0x1786)},
-	{USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
-	/* Belkin */
-	{USB_DEVICE(0x050D, 0x945A)},
-	/* ISY IWL - Belkin clone */
-	{USB_DEVICE(0x050D, 0x11F1)},
-	/* Corega */
-	{USB_DEVICE(0x07AA, 0x0047)},
-	/* D-Link */
-	{USB_DEVICE(0x2001, 0x3306)},
-	{USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
-	/* Edimax */
-	{USB_DEVICE(0x7392, 0x7611)},
-	/* EnGenius */
-	{USB_DEVICE(0x1740, 0x9603)},
-	/* Hawking */
-	{USB_DEVICE(0x0E66, 0x0016)},
-	/* Hercules */
-	{USB_DEVICE(0x06F8, 0xE034)},
-	{USB_DEVICE(0x06F8, 0xE032)},
-	/* Logitec */
-	{USB_DEVICE(0x0789, 0x0167)},
-	/* PCI */
-	{USB_DEVICE(0x2019, 0xAB28)},
-	{USB_DEVICE(0x2019, 0xED16)},
-	/* Sitecom */
-	{USB_DEVICE(0x0DF6, 0x0057)},
-	{USB_DEVICE(0x0DF6, 0x0045)},
-	{USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
-	{USB_DEVICE(0x0DF6, 0x004B)},
-	{USB_DEVICE(0x0DF6, 0x005B)},
-	{USB_DEVICE(0x0DF6, 0x005D)},
-	{USB_DEVICE(0x0DF6, 0x0063)},
-	/* Sweex */
-	{USB_DEVICE(0x177F, 0x0154)},
-	/* Thinkware */
-	{USB_DEVICE(0x0BDA, 0x5077)},
-	/* Toshiba */
-	{USB_DEVICE(0x1690, 0x0752)},
-	/* - */
-	{USB_DEVICE(0x20F4, 0x646B)},
-	{USB_DEVICE(0x083A, 0xC512)},
-	{USB_DEVICE(0x25D4, 0x4CA1)},
-	{USB_DEVICE(0x25D4, 0x4CAB)},
-
-/* RTL8191SU */
-	/* Realtek */
-	{USB_DEVICE(0x0BDA, 0x8172)},
-	{USB_DEVICE(0x0BDA, 0x8192)},
-	/* Amigo */
-	{USB_DEVICE(0x0EB0, 0x9061)},
-	/* ASUS/EKB */
-	{USB_DEVICE(0x13D3, 0x3323)},
-	{USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
-	{USB_DEVICE(0x13D3, 0x3342)},
-	/* ASUS/EKBLenovo */
-	{USB_DEVICE(0x13D3, 0x3333)},
-	{USB_DEVICE(0x13D3, 0x3334)},
-	{USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
-	{USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
-	/* ASUS/Media BOX */
-	{USB_DEVICE(0x13D3, 0x3309)},
-	/* Belkin */
-	{USB_DEVICE(0x050D, 0x815F)},
-	/* D-Link */
-	{USB_DEVICE(0x07D1, 0x3302)},
-	{USB_DEVICE(0x07D1, 0x3300)},
-	{USB_DEVICE(0x07D1, 0x3303)},
-	/* Edimax */
-	{USB_DEVICE(0x7392, 0x7612)},
-	/* EnGenius */
-	{USB_DEVICE(0x1740, 0x9605)},
-	/* Guillemot */
-	{USB_DEVICE(0x06F8, 0xE031)},
-	/* Hawking */
-	{USB_DEVICE(0x0E66, 0x0015)},
-	/* Mediao */
-	{USB_DEVICE(0x13D3, 0x3306)},
-	/* PCI */
-	{USB_DEVICE(0x2019, 0xED18)},
-	{USB_DEVICE(0x2019, 0x4901)},
-	/* Sitecom */
-	{USB_DEVICE(0x0DF6, 0x0058)},
-	{USB_DEVICE(0x0DF6, 0x0049)},
-	{USB_DEVICE(0x0DF6, 0x004C)},
-	{USB_DEVICE(0x0DF6, 0x006C)},
-	{USB_DEVICE(0x0DF6, 0x0064)},
-	/* Skyworth */
-	{USB_DEVICE(0x14b2, 0x3300)},
-	{USB_DEVICE(0x14b2, 0x3301)},
-	{USB_DEVICE(0x14B2, 0x3302)},
-	/* - */
-	{USB_DEVICE(0x04F2, 0xAFF2)},
-	{USB_DEVICE(0x04F2, 0xAFF5)},
-	{USB_DEVICE(0x04F2, 0xAFF6)},
-	{USB_DEVICE(0x13D3, 0x3339)},
-	{USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
-	{USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
-	{USB_DEVICE(0x13D3, 0x3310)},
-	{USB_DEVICE(0x13D3, 0x3325)},
-
-/* RTL8192SU */
-	/* Realtek */
-	{USB_DEVICE(0x0BDA, 0x8174)},
-	/* Belkin */
-	{USB_DEVICE(0x050D, 0x845A)},
-	/* Corega */
-	{USB_DEVICE(0x07AA, 0x0051)},
-	/* Edimax */
-	{USB_DEVICE(0x7392, 0x7622)},
-	/* NEC */
-	{USB_DEVICE(0x0409, 0x02B6)},
-	{}
-};
-
-MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl);
-
-static struct specific_device_id specific_device_id_tbl[] = {
-	{.idVendor = 0x0b05, .idProduct = 0x1791,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x0df6, .idProduct = 0x0059,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13d3, .idProduct = 0x3306,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13D3, .idProduct = 0x3311,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13d3, .idProduct = 0x3335,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13d3, .idProduct = 0x3336,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13d3, .idProduct = 0x3340,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{.idVendor = 0x13d3, .idProduct = 0x3341,
-		 .flags = SPEC_DEV_ID_DISABLE_HT},
-	{}
-};
-
-struct drv_priv {
-	struct usb_driver r871xu_drv;
-	int drv_registered;
-};
-
-#ifdef CONFIG_PM
-static int r871x_suspend(struct usb_interface *pusb_intf, pm_message_t state)
-{
-	struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
-	struct _adapter *padapter = netdev_priv(pnetdev);
-
-	netdev_info(pnetdev, "Suspending...\n");
-	padapter->suspended = true;
-	rtl871x_intf_stop(padapter);
-	if (pnetdev->netdev_ops->ndo_stop)
-		pnetdev->netdev_ops->ndo_stop(pnetdev);
-	mdelay(10);
-	netif_device_detach(pnetdev);
-	return 0;
-}
-
-static void rtl871x_intf_resume(struct _adapter *padapter)
-{
-	if (padapter->dvobjpriv.inirp_init)
-		padapter->dvobjpriv.inirp_init(padapter);
-}
-
-static int r871x_resume(struct usb_interface *pusb_intf)
-{
-	struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
-	struct _adapter *padapter = netdev_priv(pnetdev);
-
-	netdev_info(pnetdev,  "Resuming...\n");
-	netif_device_attach(pnetdev);
-	if (pnetdev->netdev_ops->ndo_open)
-		pnetdev->netdev_ops->ndo_open(pnetdev);
-	padapter->suspended = false;
-	rtl871x_intf_resume(padapter);
-	return 0;
-}
-#endif
-
-static struct drv_priv drvpriv = {
-	.r871xu_drv.name = "r8712u",
-	.r871xu_drv.id_table = rtl871x_usb_id_tbl,
-	.r871xu_drv.probe = r871xu_drv_init,
-	.r871xu_drv.disconnect = r871xu_dev_remove,
-#ifdef CONFIG_PM
-	.r871xu_drv.suspend = r871x_suspend,
-	.r871xu_drv.resume = r871x_resume,
-#endif
-};
-
-static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-{
-	uint	status = _SUCCESS;
-	struct	usb_host_interface		*phost_iface;
-	struct	usb_interface_descriptor	*piface_desc;
-	struct dvobj_priv *pdvobjpriv = &padapter->dvobjpriv;
-	struct usb_device *pusbd = pdvobjpriv->pusbdev;
-
-	pdvobjpriv->padapter = padapter;
-	padapter->eeprom_address_size = 6;
-	phost_iface = pintf->cur_altsetting;
-	piface_desc = &phost_iface->desc;
-	pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
-	if (pusbd->speed == USB_SPEED_HIGH) {
-		pdvobjpriv->ishighspeed = true;
-		dev_info(&pusbd->dev, "r8712u: USB_SPEED_HIGH with %d endpoints\n",
-			 pdvobjpriv->nr_endpoint);
-	} else {
-		pdvobjpriv->ishighspeed = false;
-		dev_info(&pusbd->dev, "r8712u: USB_SPEED_LOW with %d endpoints\n",
-			 pdvobjpriv->nr_endpoint);
-	}
-	if ((r8712_alloc_io_queue(padapter)) == _FAIL)
-		status = _FAIL;
-	return status;
-}
-
-static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
-{
-	r8712_free_io_queue(padapter);
-}
-
-void rtl871x_intf_stop(struct _adapter *padapter)
-{
-	/*disable_hw_interrupt*/
-	if (!padapter->surprise_removed) {
-		/*device still exists, so driver can do i/o operation
-		 * TODO:
-		 */
-	}
-
-	/* cancel in irp */
-	if (padapter->dvobjpriv.inirp_deinit)
-		padapter->dvobjpriv.inirp_deinit(padapter);
-	/* cancel out irp */
-	r8712_usb_write_port_cancel(padapter);
-	/* TODO:cancel other irps */
-}
-
-void r871x_dev_unload(struct _adapter *padapter)
-{
-	if (padapter->bup) {
-		/*s1.*/
-		padapter->driver_stopped = true;
-
-		/*s3.*/
-		rtl871x_intf_stop(padapter);
-
-		/*s4.*/
-		r8712_stop_drv_threads(padapter);
-
-		/*s5.*/
-		if (!padapter->surprise_removed) {
-			padapter->hw_init_completed = false;
-			rtl8712_hal_deinit(padapter);
-		}
-
-		padapter->bup = false;
-	}
-}
-
-static void disable_ht_for_spec_devid(const struct usb_device_id *pdid,
-				      struct _adapter *padapter)
-{
-	u16 vid, pid;
-	u32 flags;
-	int i;
-	int num = ARRAY_SIZE(specific_device_id_tbl);
-
-	for (i = 0; i < num; i++) {
-		vid = specific_device_id_tbl[i].idVendor;
-		pid = specific_device_id_tbl[i].idProduct;
-		flags = specific_device_id_tbl[i].flags;
-
-		if ((pdid->idVendor == vid) && (pdid->idProduct == pid) &&
-		    (flags & SPEC_DEV_ID_DISABLE_HT)) {
-			padapter->registrypriv.ht_enable = 0;
-			padapter->registrypriv.cbw40_enable = 0;
-			padapter->registrypriv.ampdu_enable = 0;
-		}
-	}
-}
-
-static const struct device_type wlan_type = {
-	.name = "wlan",
-};
-
-/*
- * drv_init() - a device potentially for us
- *
- * notes: drv_init() is called when the bus driver has located a card for us
- * to support. We accept the new device by returning 0.
- */
-static int r871xu_drv_init(struct usb_interface *pusb_intf,
-			   const struct usb_device_id *pdid)
-{
-	uint status;
-	struct _adapter *padapter = NULL;
-	struct dvobj_priv *pdvobjpriv;
-	struct net_device *pnetdev;
-	struct usb_device *udev;
-
-	/* In this probe function, O.S. will provide the usb interface pointer
-	 * to driver. We have to increase the reference count of the usb device
-	 * structure by using the usb_get_dev function.
-	 */
-	udev = interface_to_usbdev(pusb_intf);
-	usb_get_dev(udev);
-	pintf = pusb_intf;
-	/* step 1. */
-	pnetdev = r8712_init_netdev();
-	if (!pnetdev)
-		goto put_dev;
-	padapter = netdev_priv(pnetdev);
-	disable_ht_for_spec_devid(pdid, padapter);
-	pdvobjpriv = &padapter->dvobjpriv;
-	pdvobjpriv->padapter = padapter;
-	padapter->dvobjpriv.pusbdev = udev;
-	padapter->pusb_intf = pusb_intf;
-	usb_set_intfdata(pusb_intf, pnetdev);
-	SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
-	pnetdev->dev.type = &wlan_type;
-	/* step 2. */
-	padapter->dvobj_init = r8712_usb_dvobj_init;
-	padapter->dvobj_deinit = r8712_usb_dvobj_deinit;
-	padapter->halpriv.hal_bus_init = r8712_usb_hal_bus_init;
-	padapter->dvobjpriv.inirp_init = r8712_usb_inirp_init;
-	padapter->dvobjpriv.inirp_deinit = r8712_usb_inirp_deinit;
-	/* step 3.
-	 * initialize the dvobj_priv
-	 */
-
-	status = padapter->dvobj_init(padapter);
-	if (status != _SUCCESS)
-		goto free_netdev;
-
-	/* step 4. */
-	status = r8712_init_drv_sw(padapter);
-	if (status)
-		goto dvobj_deinit;
-	/* step 5. read efuse/eeprom data and get mac_addr */
-	{
-		int i, offset;
-		u8 mac[6];
-		u8 tmpU1b, AutoloadFail, eeprom_CustomerID;
-		u8 *pdata = padapter->eeprompriv.efuse_eeprom_data;
-
-		tmpU1b = r8712_read8(padapter, EE_9346CR);/*CR9346*/
-
-		/* To check system boot selection.*/
-		dev_info(&udev->dev, "r8712u: Boot from %s: Autoload %s\n",
-			 (tmpU1b & _9356SEL) ? "EEPROM" : "EFUSE",
-			 (tmpU1b & _EEPROM_EN) ? "OK" : "Failed");
-
-		/* To check autoload success or not.*/
-		if (tmpU1b & _EEPROM_EN) {
-			AutoloadFail = true;
-			/* The following operations prevent Efuse leakage by
-			 * turning on 2.5V.
-			 */
-			tmpU1b = r8712_read8(padapter, EFUSE_TEST + 3);
-			r8712_write8(padapter, EFUSE_TEST + 3, tmpU1b | 0x80);
-			msleep(20);
-			r8712_write8(padapter, EFUSE_TEST + 3,
-				     (tmpU1b & (~BIT(7))));
-
-			/* Retrieve Chip version.
-			 * Recognize IC version by Reg0x4 BIT15.
-			 */
-			tmpU1b = (u8)((r8712_read32(padapter, PMC_FSM) >> 15) &
-						    0x1F);
-			if (tmpU1b == 0x3)
-				padapter->registrypriv.chip_version =
-				     RTL8712_3rdCUT;
-			else
-				padapter->registrypriv.chip_version =
-				     (tmpU1b >> 1) + 1;
-			switch (padapter->registrypriv.chip_version) {
-			case RTL8712_1stCUT:
-			case RTL8712_2ndCUT:
-			case RTL8712_3rdCUT:
-				break;
-			default:
-				padapter->registrypriv.chip_version =
-				     RTL8712_2ndCUT;
-				break;
-			}
-
-			for (i = 0, offset = 0; i < 128; i += 8, offset++)
-				r8712_efuse_pg_packet_read(padapter, offset,
-						     &pdata[i]);
-
-			if (!r8712_initmac || !mac_pton(r8712_initmac, mac)) {
-				/* Use the mac address stored in the Efuse
-				 * offset = 0x12 for usb in efuse
-				 */
-				ether_addr_copy(mac, &pdata[0x12]);
-			}
-			eeprom_CustomerID = pdata[0x52];
-			switch (eeprom_CustomerID) {
-			case EEPROM_CID_ALPHA:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_ALPHA;
-				break;
-			case EEPROM_CID_CAMEO:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_CAMEO;
-				break;
-			case EEPROM_CID_SITECOM:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_Sitecom;
-				break;
-			case EEPROM_CID_COREGA:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_COREGA;
-				break;
-			case EEPROM_CID_Senao:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_Senao;
-				break;
-			case EEPROM_CID_EDIMAX_BELKIN:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_Edimax_Belkin;
-				break;
-			case EEPROM_CID_SERCOMM_BELKIN:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_Sercomm_Belkin;
-				break;
-			case EEPROM_CID_WNC_COREGA:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_WNC_COREGA;
-				break;
-			case EEPROM_CID_WHQL:
-				break;
-			case EEPROM_CID_NetCore:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_Netcore;
-				break;
-			case EEPROM_CID_CAMEO1:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_CAMEO1;
-				break;
-			case EEPROM_CID_CLEVO:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_819x_CLEVO;
-				break;
-			default:
-				padapter->eeprompriv.CustomerID =
-						 RT_CID_DEFAULT;
-				break;
-			}
-			dev_info(&udev->dev, "r8712u: CustomerID = 0x%.4x\n",
-				 padapter->eeprompriv.CustomerID);
-			/* Led mode */
-			switch (padapter->eeprompriv.CustomerID) {
-			case RT_CID_DEFAULT:
-			case RT_CID_819x_ALPHA:
-			case RT_CID_819x_CAMEO:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE1;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			case RT_CID_819x_Sitecom:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE2;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			case RT_CID_COREGA:
-			case RT_CID_819x_Senao:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE3;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			case RT_CID_819x_Edimax_Belkin:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE4;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			case RT_CID_819x_Sercomm_Belkin:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE5;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			case RT_CID_819x_WNC_COREGA:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE6;
-				padapter->ledpriv.bRegUseLed = true;
-				break;
-			default:
-				padapter->ledpriv.LedStrategy = SW_LED_MODE0;
-				padapter->ledpriv.bRegUseLed = false;
-				break;
-			}
-		} else {
-			AutoloadFail = false;
-		}
-		if ((!AutoloadFail) ||
-		    ((mac[0] == 0xff) && (mac[1] == 0xff) &&
-		     (mac[2] == 0xff) && (mac[3] == 0xff) &&
-		     (mac[4] == 0xff) && (mac[5] == 0xff)) ||
-		    ((mac[0] == 0x00) && (mac[1] == 0x00) &&
-		     (mac[2] == 0x00) && (mac[3] == 0x00) &&
-		     (mac[4] == 0x00) && (mac[5] == 0x00))) {
-			mac[0] = 0x00;
-			mac[1] = 0xe0;
-			mac[2] = 0x4c;
-			mac[3] = 0x87;
-			mac[4] = 0x00;
-			mac[5] = 0x00;
-		}
-		if (r8712_initmac) {
-			/* Make sure the user did not select a multicast
-			 * address by setting bit 1 of first octet.
-			 */
-			mac[0] &= 0xFE;
-			dev_info(&udev->dev,
-				"r8712u: MAC Address from user = %pM\n", mac);
-		} else {
-			dev_info(&udev->dev,
-				"r8712u: MAC Address from efuse = %pM\n", mac);
-		}
-		eth_hw_addr_set(pnetdev, mac);
-	}
-	/* step 6. Load the firmware asynchronously */
-	if (rtl871x_load_fw(padapter))
-		goto deinit_drv_sw;
-	init_completion(&padapter->rx_filter_ready);
-	return 0;
-
-deinit_drv_sw:
-	r8712_free_drv_sw(padapter);
-dvobj_deinit:
-	padapter->dvobj_deinit(padapter);
-free_netdev:
-	free_netdev(pnetdev);
-put_dev:
-	usb_put_dev(udev);
-	usb_set_intfdata(pusb_intf, NULL);
-	return -ENODEV;
-}
-
-/* rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove()
- * => how to recognize both
- */
-static void r871xu_dev_remove(struct usb_interface *pusb_intf)
-{
-	struct net_device *pnetdev = usb_get_intfdata(pusb_intf);
-	struct usb_device *udev = interface_to_usbdev(pusb_intf);
-	struct _adapter *padapter = netdev_priv(pnetdev);
-
-	/* never exit with a firmware callback pending */
-	wait_for_completion(&padapter->rtl8712_fw_ready);
-	if (pnetdev->reg_state != NETREG_UNINITIALIZED)
-		unregister_netdev(pnetdev); /* will call netdev_close() */
-	usb_set_intfdata(pusb_intf, NULL);
-	release_firmware(padapter->fw);
-	if (drvpriv.drv_registered)
-		padapter->surprise_removed = true;
-	r8712_flush_rwctrl_works(padapter);
-	r8712_flush_led_works(padapter);
-	udelay(1);
-	/* Stop driver mlme relation timer */
-	r8712_stop_drv_timers(padapter);
-	r871x_dev_unload(padapter);
-	if (padapter->dvobj_deinit)
-		padapter->dvobj_deinit(padapter);
-	r8712_free_drv_sw(padapter);
-	free_netdev(pnetdev);
-
-	/* decrease the reference count of the usb device structure
-	 * when disconnect
-	 */
-	usb_put_dev(udev);
-
-	/* If we didn't unplug usb dongle and remove/insert module, driver
-	 * fails on sitesurvey for the first time when device is up.
-	 * Reset usb port for sitesurvey fail issue.
-	 */
-	if (udev->state != USB_STATE_NOTATTACHED)
-		usb_reset_device(udev);
-}
-
-static int __init r8712u_drv_entry(void)
-{
-	drvpriv.drv_registered = true;
-	return usb_register(&drvpriv.r871xu_drv);
-}
-
-static void __exit r8712u_drv_halt(void)
-{
-	drvpriv.drv_registered = false;
-	usb_deregister(&drvpriv.r871xu_drv);
-}
-
-module_init(r8712u_drv_entry);
-module_exit(r8712u_drv_halt);
--- a/drivers/staging/rtl8712/usb_ops.c
+++ /dev/null
@@ -1,195 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_ops.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_OPS_C_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-#include "recv_osdep.h"
-
-static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	int status;
-	__le32 data = 0;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x01; /* read_in */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 1;
-	status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-					 &data, len, requesttype);
-	if (status < 0)
-		return 0;
-	return (u8)(le32_to_cpu(data) & 0x0ff);
-}
-
-static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	int status;
-	__le32 data = 0;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x01; /* read_in */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 2;
-	status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-					 &data, len, requesttype);
-	if (status < 0)
-		return 0;
-	return (u16)(le32_to_cpu(data) & 0xffff);
-}
-
-static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	int status;
-	__le32 data = 0;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x01; /* read_in */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 4;
-	status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-					 &data, len, requesttype);
-	if (status < 0)
-		return 0;
-	return le32_to_cpu(data);
-}
-
-static void usb_write8(struct intf_hdl *intfhdl, u32 addr, u8 val)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	__le32 data;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x00; /* write_out */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 1;
-	data = cpu_to_le32((u32)val & 0x000000ff);
-	r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-				requesttype);
-}
-
-static void usb_write16(struct intf_hdl *intfhdl, u32 addr, u16 val)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	__le32 data;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x00; /* write_out */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 2;
-	data = cpu_to_le32((u32)val & 0x0000ffff);
-	r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-				requesttype);
-}
-
-static void usb_write32(struct intf_hdl *intfhdl, u32 addr, u32 val)
-{
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	__le32 data;
-	struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
-	request = 0x05;
-	requesttype = 0x00; /* write_out */
-	index = 0;
-	wvalue = (u16)(addr & 0x0000ffff);
-	len = 4;
-	data = cpu_to_le32(val);
-	r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-				requesttype);
-}
-
-void r8712_usb_set_intf_option(u32 *option)
-{
-	*option = ((*option) | _INTF_ASYNC_);
-}
-
-static void usb_intf_hdl_init(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_unload(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_open(u8 *priv)
-{
-}
-
-static void usb_intf_hdl_close(u8 *priv)
-{
-}
-
-void r8712_usb_set_intf_funs(struct intf_hdl *intfhdl)
-{
-	intfhdl->intf_hdl_init = usb_intf_hdl_init;
-	intfhdl->intf_hdl_unload = usb_intf_hdl_unload;
-	intfhdl->intf_hdl_open = usb_intf_hdl_open;
-	intfhdl->intf_hdl_close = usb_intf_hdl_close;
-}
-
-void r8712_usb_set_intf_ops(struct _io_ops *ops)
-{
-	memset((u8 *)ops, 0, sizeof(struct _io_ops));
-	ops->_read8 = usb_read8;
-	ops->_read16 = usb_read16;
-	ops->_read32 = usb_read32;
-	ops->_read_port = r8712_usb_read_port;
-	ops->_write8 = usb_write8;
-	ops->_write16 = usb_write16;
-	ops->_write32 = usb_write32;
-	ops->_write_mem = r8712_usb_write_mem;
-	ops->_write_port = r8712_usb_write_port;
-}
--- a/drivers/staging/rtl8712/usb_ops.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __USB_OPS_H_
-#define __USB_OPS_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-
-void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr,
-			 u32 cnt, u8 *wmem);
-u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr,
-			 u32 cnt, u8 *wmem);
-u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr,
-			u32 cnt, u8 *rmem);
-void r8712_usb_set_intf_option(u32 *poption);
-void r8712_usb_set_intf_funs(struct intf_hdl *pintf_hdl);
-uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv);
-void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv);
-void r8712_usb_set_intf_ops(struct _io_ops *pops);
-void r8712_usb_read_port_cancel(struct _adapter *padapter);
-void r8712_usb_write_port_cancel(struct _adapter *padapter);
-int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
-			    u16 index, void *pdata, u16 len, u8 requesttype);
-
-#endif
-
--- a/drivers/staging/rtl8712/usb_ops_linux.c
+++ /dev/null
@@ -1,515 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * usb_ops_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _HCI_OPS_OS_C_
-
-#include <linux/usb.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-#include "osdep_intf.h"
-#include "usb_ops.h"
-
-#define	RTL871X_VENQT_READ	0xc0
-#define	RTL871X_VENQT_WRITE	0x40
-
-struct zero_bulkout_context {
-	void *pbuf;
-	void *purb;
-	void *pirp;
-	void *padapter;
-};
-
-uint r8712_usb_init_intf_priv(struct intf_priv *pintfpriv)
-{
-	pintfpriv->piorw_urb = usb_alloc_urb(0, GFP_ATOMIC);
-	if (!pintfpriv->piorw_urb)
-		return _FAIL;
-	init_completion(&pintfpriv->io_retevt_comp);
-	return _SUCCESS;
-}
-
-void r8712_usb_unload_intf_priv(struct intf_priv *pintfpriv)
-{
-	if (pintfpriv->piorw_urb) {
-		usb_kill_urb(pintfpriv->piorw_urb);
-		usb_free_urb(pintfpriv->piorw_urb);
-	}
-}
-
-static unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr)
-{
-	unsigned int pipe = 0;
-	struct usb_device *pusbd = pdvobj->pusbdev;
-
-	if (pdvobj->nr_endpoint == 11) {
-		switch (addr) {
-		case RTL8712_DMA_BKQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x07);
-			break;
-		case RTL8712_DMA_BEQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x06);
-			break;
-		case RTL8712_DMA_VIQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x05);
-			break;
-		case RTL8712_DMA_VOQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x04);
-			break;
-		case RTL8712_DMA_BCNQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x0a);
-			break;
-		case RTL8712_DMA_BMCQ:	/* HI Queue */
-			pipe = usb_sndbulkpipe(pusbd, 0x0b);
-			break;
-		case RTL8712_DMA_MGTQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x0c);
-			break;
-		case RTL8712_DMA_RX0FF:
-			pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
-			break;
-		case RTL8712_DMA_C2HCMD:
-			pipe = usb_rcvbulkpipe(pusbd, 0x09); /* in */
-			break;
-		case RTL8712_DMA_H2CCMD:
-			pipe = usb_sndbulkpipe(pusbd, 0x0d);
-			break;
-		}
-	} else if (pdvobj->nr_endpoint == 6) {
-		switch (addr) {
-		case RTL8712_DMA_BKQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x07);
-			break;
-		case RTL8712_DMA_BEQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x06);
-			break;
-		case RTL8712_DMA_VIQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x05);
-			break;
-		case RTL8712_DMA_VOQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x04);
-			break;
-		case RTL8712_DMA_RX0FF:
-		case RTL8712_DMA_C2HCMD:
-			pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
-			break;
-		case RTL8712_DMA_H2CCMD:
-		case RTL8712_DMA_BCNQ:
-		case RTL8712_DMA_BMCQ:
-		case RTL8712_DMA_MGTQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x0d);
-			break;
-		}
-	} else if (pdvobj->nr_endpoint == 4) {
-		switch (addr) {
-		case RTL8712_DMA_BEQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x06);
-			break;
-		case RTL8712_DMA_VOQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x04);
-			break;
-		case RTL8712_DMA_RX0FF:
-		case RTL8712_DMA_C2HCMD:
-			pipe = usb_rcvbulkpipe(pusbd, 0x03); /* in */
-			break;
-		case RTL8712_DMA_H2CCMD:
-		case RTL8712_DMA_BCNQ:
-		case RTL8712_DMA_BMCQ:
-		case RTL8712_DMA_MGTQ:
-			pipe = usb_sndbulkpipe(pusbd, 0x0d);
-			break;
-		}
-	} else {
-		pipe = 0;
-	}
-	return pipe;
-}
-
-static void usb_write_mem_complete(struct urb *purb)
-{
-	struct io_queue *pio_q = (struct io_queue *)purb->context;
-	struct intf_hdl *pintf = &(pio_q->intf);
-	struct intf_priv *pintfpriv = pintf->pintfpriv;
-	struct _adapter *padapter = (struct _adapter *)pintf->adapter;
-
-	if (purb->status != 0) {
-		if (purb->status == (-ESHUTDOWN))
-			padapter->driver_stopped = true;
-		else
-			padapter->surprise_removed = true;
-	}
-	complete(&pintfpriv->io_retevt_comp);
-}
-
-void r8712_usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
-{
-	unsigned int pipe;
-	struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter;
-	struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
-	struct io_queue *pio_queue = padapter->pio_queue;
-	struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
-	struct usb_device *pusbd = pdvobj->pusbdev;
-	struct urb *piorw_urb = pintfpriv->piorw_urb;
-
-	if ((padapter->driver_stopped) || (padapter->surprise_removed) ||
-	    (padapter->pwrctrlpriv.pnp_bstop_trx))
-		return;
-	/* translate DMA FIFO addr to pipehandle */
-	pipe = ffaddr2pipehdl(pdvobj, addr);
-	if (pipe == 0)
-		return;
-	usb_fill_bulk_urb(piorw_urb, pusbd, pipe,
-			  wmem, cnt, usb_write_mem_complete,
-			  pio_queue);
-	usb_submit_urb(piorw_urb, GFP_ATOMIC);
-	wait_for_completion_interruptible(&pintfpriv->io_retevt_comp);
-}
-
-static void r8712_usb_read_port_complete(struct urb *purb)
-{
-	uint isevt;
-	__le32 *pbuf;
-	struct recv_buf	*precvbuf = (struct recv_buf *)purb->context;
-	struct _adapter *padapter = (struct _adapter *)precvbuf->adapter;
-	struct recv_priv *precvpriv = &padapter->recvpriv;
-
-	if (padapter->surprise_removed || padapter->driver_stopped)
-		return;
-	if (purb->status == 0) { /* SUCCESS */
-		if ((purb->actual_length > (MAX_RECVBUF_SZ)) ||
-		    (purb->actual_length < RXDESC_SIZE)) {
-			r8712_read_port(padapter, precvpriv->ff_hwaddr, 0,
-				  (unsigned char *)precvbuf);
-		} else {
-			_pkt *pskb = precvbuf->pskb;
-
-			precvbuf->transfer_len = purb->actual_length;
-			pbuf = (__le32 *)precvbuf->pbuf;
-			isevt = le32_to_cpu(*(pbuf + 1)) & 0x1ff;
-			if ((isevt & 0x1ff) == 0x1ff) {
-				r8712_rxcmd_event_hdl(padapter, pbuf);
-				skb_queue_tail(&precvpriv->rx_skb_queue, pskb);
-				r8712_read_port(padapter, precvpriv->ff_hwaddr,
-						0, (unsigned char *)precvbuf);
-			} else {
-				skb_put(pskb, purb->actual_length);
-				skb_queue_tail(&precvpriv->rx_skb_queue, pskb);
-				tasklet_hi_schedule(&precvpriv->recv_tasklet);
-				r8712_read_port(padapter, precvpriv->ff_hwaddr,
-						0, (unsigned char *)precvbuf);
-			}
-		}
-	} else {
-		switch (purb->status) {
-		case -EINVAL:
-		case -EPIPE:
-		case -ENODEV:
-		case -ESHUTDOWN:
-			padapter->driver_stopped = true;
-			break;
-		case -ENOENT:
-			if (!padapter->suspended) {
-				padapter->driver_stopped = true;
-				break;
-			}
-			fallthrough;
-		case -EPROTO:
-			r8712_read_port(padapter, precvpriv->ff_hwaddr, 0,
-				  (unsigned char *)precvbuf);
-			break;
-		case -EINPROGRESS:
-			netdev_err(padapter->pnetdev, "ERROR: URB IS IN PROGRESS!\n");
-			break;
-		default:
-			break;
-		}
-	}
-}
-
-u32 r8712_usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
-{
-	unsigned int pipe;
-	int err;
-	u32 tmpaddr = 0;
-	int alignment = 0;
-	u32 ret = _SUCCESS;
-	struct urb *purb = NULL;
-	struct recv_buf	*precvbuf = (struct recv_buf *)rmem;
-	struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
-	struct dvobj_priv *pdvobj = (struct dvobj_priv *)pintfpriv->intf_dev;
-	struct _adapter *adapter = pdvobj->padapter;
-	struct recv_priv *precvpriv = &adapter->recvpriv;
-	struct usb_device *pusbd = pdvobj->pusbdev;
-
-	if (adapter->driver_stopped || adapter->surprise_removed ||
-	    adapter->pwrctrlpriv.pnp_bstop_trx || !precvbuf)
-		return _FAIL;
-	r8712_init_recvbuf(adapter, precvbuf);
-	/* Try to use skb from the free queue */
-	precvbuf->pskb = skb_dequeue(&precvpriv->free_recv_skb_queue);
-
-	if (!precvbuf->pskb) {
-		precvbuf->pskb = netdev_alloc_skb(adapter->pnetdev,
-				 MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
-		if (!precvbuf->pskb)
-			return _FAIL;
-		tmpaddr = (addr_t)precvbuf->pskb->data;
-		alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1);
-		skb_reserve(precvbuf->pskb,
-			    (RECVBUFF_ALIGN_SZ - alignment));
-		precvbuf->phead = precvbuf->pskb->head;
-		precvbuf->pdata = precvbuf->pskb->data;
-		precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
-		precvbuf->pend = skb_end_pointer(precvbuf->pskb);
-		precvbuf->pbuf = precvbuf->pskb->data;
-	} else { /* skb is reused */
-		precvbuf->phead = precvbuf->pskb->head;
-		precvbuf->pdata = precvbuf->pskb->data;
-		precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
-		precvbuf->pend = skb_end_pointer(precvbuf->pskb);
-		precvbuf->pbuf = precvbuf->pskb->data;
-	}
-	purb = precvbuf->purb;
-	/* translate DMA FIFO addr to pipehandle */
-	pipe = ffaddr2pipehdl(pdvobj, addr);
-	usb_fill_bulk_urb(purb, pusbd, pipe,
-			  precvbuf->pbuf, MAX_RECVBUF_SZ,
-			  r8712_usb_read_port_complete,
-			  precvbuf);
-	err = usb_submit_urb(purb, GFP_ATOMIC);
-	if ((err) && (err != (-EPERM)))
-		ret = _FAIL;
-	return ret;
-}
-
-void r8712_usb_read_port_cancel(struct _adapter *padapter)
-{
-	int i;
-	struct recv_buf *precvbuf;
-
-	precvbuf = (struct recv_buf *)padapter->recvpriv.precv_buf;
-	for (i = 0; i < NR_RECVBUFF; i++) {
-		if (precvbuf->purb)
-			usb_kill_urb(precvbuf->purb);
-		precvbuf++;
-	}
-}
-
-void r8712_xmit_bh(struct tasklet_struct *t)
-{
-	int ret = false;
-	struct _adapter *padapter = from_tasklet(padapter, t,
-						 xmitpriv.xmit_tasklet);
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-
-	if (padapter->driver_stopped ||
-	    padapter->surprise_removed) {
-		netdev_err(padapter->pnetdev, "xmit_bh => driver_stopped or surprise_removed\n");
-		return;
-	}
-	ret = r8712_xmitframe_complete(padapter, pxmitpriv, NULL);
-	if (!ret)
-		return;
-	tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
-}
-
-static void usb_write_port_complete(struct urb *purb)
-{
-	int i;
-	struct xmit_frame *pxmitframe = (struct xmit_frame *)purb->context;
-	struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
-	struct _adapter *padapter = pxmitframe->padapter;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
-	switch (pattrib->priority) {
-	case 1:
-	case 2:
-		pxmitpriv->bkq_cnt--;
-		break;
-	case 4:
-	case 5:
-		pxmitpriv->viq_cnt--;
-		break;
-	case 6:
-	case 7:
-		pxmitpriv->voq_cnt--;
-		break;
-	case 0:
-	case 3:
-	default:
-		pxmitpriv->beq_cnt--;
-		break;
-	}
-	pxmitpriv->txirp_cnt--;
-	for (i = 0; i < 8; i++) {
-		if (purb == pxmitframe->pxmit_urb[i]) {
-			pxmitframe->bpending[i] = false;
-			break;
-		}
-	}
-	if (padapter->surprise_removed)
-		return;
-	switch (purb->status) {
-	case 0:
-		break;
-	default:
-		netdev_warn(padapter->pnetdev,
-				"r8712u: pipe error: (%d)\n", purb->status);
-		break;
-	}
-	/* not to consider tx fragment */
-	r8712_free_xmitframe_ex(pxmitpriv, pxmitframe);
-	r8712_free_xmitbuf(pxmitpriv, pxmitbuf);
-	tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
-}
-
-u32 r8712_usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
-{
-	unsigned long irqL;
-	int i, status;
-	unsigned int pipe;
-	u32 ret, bwritezero;
-	struct urb *purb = NULL;
-	struct _adapter *padapter = (struct _adapter *)pintfhdl->adapter;
-	struct dvobj_priv *pdvobj = &padapter->dvobjpriv;
-	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
-	struct xmit_frame *pxmitframe = (struct xmit_frame *)wmem;
-	struct usb_device *pusbd = pdvobj->pusbdev;
-	struct pkt_attrib *pattrib = &pxmitframe->attrib;
-
-	if ((padapter->driver_stopped) || (padapter->surprise_removed) ||
-	    (padapter->pwrctrlpriv.pnp_bstop_trx))
-		return _FAIL;
-	for (i = 0; i < 8; i++) {
-		if (!pxmitframe->bpending[i]) {
-			spin_lock_irqsave(&pxmitpriv->lock, irqL);
-			pxmitpriv->txirp_cnt++;
-			pxmitframe->bpending[i]  = true;
-			switch (pattrib->priority) {
-			case 1:
-			case 2:
-				pxmitpriv->bkq_cnt++;
-				break;
-			case 4:
-			case 5:
-				pxmitpriv->viq_cnt++;
-				break;
-			case 6:
-			case 7:
-				pxmitpriv->voq_cnt++;
-				break;
-			case 0:
-			case 3:
-			default:
-				pxmitpriv->beq_cnt++;
-				break;
-			}
-			spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
-			pxmitframe->sz[i] = (u16)cnt;
-			purb = pxmitframe->pxmit_urb[i];
-			break;
-		}
-	}
-	bwritezero = false;
-	if (pdvobj->ishighspeed) {
-		if (cnt > 0 && cnt % 512 == 0)
-			bwritezero = true;
-	} else {
-		if (cnt > 0 && cnt % 64 == 0)
-			bwritezero = true;
-	}
-	/* translate DMA FIFO addr to pipehandle */
-	pipe = ffaddr2pipehdl(pdvobj, addr);
-	if (pxmitpriv->free_xmitbuf_cnt % NR_XMITBUFF == 0)
-		purb->transfer_flags  &=  (~URB_NO_INTERRUPT);
-	else
-		purb->transfer_flags  |=  URB_NO_INTERRUPT;
-	if (bwritezero)
-		cnt += 8;
-	usb_fill_bulk_urb(purb, pusbd, pipe,
-			  pxmitframe->mem_addr,
-			  cnt, usb_write_port_complete,
-			  pxmitframe); /* context is xmit_frame */
-	status = usb_submit_urb(purb, GFP_ATOMIC);
-	if (!status)
-		ret = _SUCCESS;
-	else
-		ret = _FAIL;
-	return ret;
-}
-
-void r8712_usb_write_port_cancel(struct _adapter *padapter)
-{
-	int i, j;
-	struct xmit_buf	*pxmitbuf = (struct xmit_buf *)
-				     padapter->xmitpriv.pxmitbuf;
-
-	for (i = 0; i < NR_XMITBUFF; i++) {
-		for (j = 0; j < 8; j++) {
-			if (pxmitbuf->pxmit_urb[j])
-				usb_kill_urb(pxmitbuf->pxmit_urb[j]);
-		}
-		pxmitbuf++;
-	}
-}
-
-int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
-		      u16 index, void *pdata, u16 len, u8 requesttype)
-{
-	unsigned int pipe;
-	int status;
-	u8 reqtype;
-	struct dvobj_priv *pdvobjpriv = (struct dvobj_priv *)
-					 pintfpriv->intf_dev;
-	struct usb_device *udev = pdvobjpriv->pusbdev;
-	/* For mstar platform, mstar suggests the address for USB IO
-	 * should be 16 bytes alignment. Trying to fix it here.
-	 */
-	u8 *palloc_buf, *pIo_buf;
-
-	palloc_buf = kmalloc((u32)len + 16, GFP_ATOMIC);
-	if (!palloc_buf)
-		return -ENOMEM;
-	pIo_buf = palloc_buf + 16 - ((addr_t)(palloc_buf) & 0x0f);
-	if (requesttype == 0x01) {
-		pipe = usb_rcvctrlpipe(udev, 0); /* read_in */
-		reqtype =  RTL871X_VENQT_READ;
-	} else {
-		pipe = usb_sndctrlpipe(udev, 0); /* write_out */
-		reqtype =  RTL871X_VENQT_WRITE;
-		memcpy(pIo_buf, pdata, len);
-	}
-	status = usb_control_msg(udev, pipe, request, reqtype, value, index,
-				 pIo_buf, len, 500);
-	if (status < 0)
-		goto free;
-	if (status != len) {
-		status = -EREMOTEIO;
-		goto free;
-	}
-	/* Success this control transfer. */
-	if (requesttype == 0x01) {
-		/* For Control read transfer, we have to copy the read
-		 * data from pIo_buf to pdata.
-		 */
-		memcpy(pdata, pIo_buf, status);
-	}
-
-free:
-	kfree(palloc_buf);
-	return status;
-}
--- a/drivers/staging/rtl8712/usb_osintf.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __USB_OSINTF_H
-#define __USB_OSINTF_H
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-extern char *r8712_initmac;
-
-unsigned int r8712_usb_inirp_init(struct _adapter *padapter);
-unsigned int r8712_usb_inirp_deinit(struct _adapter *padapter);
-uint rtl871x_hal_init(struct _adapter *padapter);
-uint rtl8712_hal_deinit(struct _adapter *padapter);
-
-void rtl871x_intf_stop(struct _adapter *padapter);
-void r871x_dev_unload(struct _adapter *padapter);
-void r8712_stop_drv_threads(struct _adapter *padapter);
-void r8712_stop_drv_timers(struct _adapter *padapter);
-int r8712_init_drv_sw(struct _adapter *padapter);
-void r8712_free_drv_sw(struct _adapter *padapter);
-struct net_device *r8712_init_netdev(void);
-
-#endif
--- a/drivers/staging/rtl8712/wifi.h
+++ /dev/null
@@ -1,196 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef _WIFI_H_
-#define _WIFI_H_
-
-#include <linux/compiler.h>
-#include <linux/ieee80211.h>
-
-#define WLAN_HDR_A3_LEN		24
-#define WLAN_HDR_A3_QOS_LEN	26
-
-enum WIFI_FRAME_TYPE {
-	WIFI_QOS_DATA_TYPE	= (BIT(7) | BIT(3)),	/*!< QoS Data */
-};
-
-#define SetToDs(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_TODS); \
-})
-
-#define GetToDs(pbuf)	(((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_TODS)) != 0)
-
-#define ClearToDs(pbuf)	({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_TODS)); \
-})
-
-#define SetFrDs(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_FROMDS); \
-})
-
-#define GetFrDs(pbuf)	(((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_FROMDS)) != 0)
-
-#define ClearFrDs(pbuf)	({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_FROMDS)); \
-})
-
-static inline unsigned char get_tofr_ds(unsigned char *pframe)
-{
-	return ((GetToDs(pframe) << 1) | GetFrDs(pframe));
-}
-
-#define SetMFrag(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS); \
-})
-
-#define GetMFrag(pbuf)	(((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)) != 0)
-
-#define ClearMFrag(pbuf) ({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)); \
-})
-
-#define SetRetry(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_RETRY); \
-})
-
-#define GetRetry(pbuf)	(((*(__le16 *)(pbuf)) & cpu_to_le16(IEEE80211_FCTL_RETRY)) != 0)
-
-#define ClearRetry(pbuf) ({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_RETRY)); \
-})
-
-#define SetPwrMgt(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PM); \
-})
-
-#define GetPwrMgt(pbuf)	(((*(__le16 *)(pbuf)) & \
-			cpu_to_le16(IEEE80211_FCTL_PM)) != 0)
-
-#define ClearPwrMgt(pbuf) ({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_PM)); \
-})
-
-#define SetMData(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_MOREDATA); \
-})
-
-#define GetMData(pbuf)	(((*(__le16 *)(pbuf)) & \
-			cpu_to_le16(IEEE80211_FCTL_MOREDATA)) != 0)
-
-#define ClearMData(pbuf) ({ \
-	*(__le16 *)(pbuf) &= (~cpu_to_le16(IEEE80211_FCTL_MOREDATA)); \
-})
-
-#define SetPrivacy(pbuf) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); \
-})
-
-#define GetPrivacy(pbuf)	(((*(__le16 *)(pbuf)) & \
-				cpu_to_le16(IEEE80211_FCTL_PROTECTED)) != 0)
-
-#define GetOrder(pbuf)	(((*(__le16 *)(pbuf)) & \
-			cpu_to_le16(IEEE80211_FCTL_ORDER)) != 0)
-
-#define GetFrameType(pbuf)	(le16_to_cpu(*(__le16 *)(pbuf)) & \
-				(BIT(3) | BIT(2)))
-
-#define SetFrameType(pbuf, type)	\
-	do {	\
-		*(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(3) | \
-		BIT(2))); \
-		*(__le16 *)(pbuf) |= cpu_to_le16(type); \
-	} while (0)
-
-#define GetFrameSubType(pbuf)	(le16_to_cpu(*(__le16 *)(pbuf)) & \
-				(BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | \
-				BIT(2)))
-
-#define SetFrameSubType(pbuf, type) \
-	do {    \
-		*(__le16 *)(pbuf) &= cpu_to_le16(~(BIT(7) | BIT(6) | \
-		BIT(5) | BIT(4) | BIT(3) | BIT(2))); \
-		*(__le16 *)(pbuf) |= cpu_to_le16(type); \
-	} while (0)
-
-#define GetSequence(pbuf)	(le16_to_cpu(*(__le16 *)\
-				((addr_t)(pbuf) + 22)) >> 4)
-
-#define GetFragNum(pbuf)	(le16_to_cpu(*(__le16 *)((addr_t)\
-				(pbuf) + 22)) & 0x0f)
-
-#define SetSeqNum(pbuf, num) ({ \
-	*(__le16 *)((addr_t)(pbuf) + 22) = \
-	cpu_to_le16((le16_to_cpu(*(__le16 *)((addr_t)(pbuf) + 22)) & \
-	0x000f) | (0xfff0 & (num << 4))); \
-})
-
-#define SetPriority(pbuf, tid) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16(tid & 0xf); \
-})
-
-#define GetPriority(pbuf)	((le16_to_cpu(*(__le16 *)(pbuf))) & 0xf)
-
-#define SetAckpolicy(pbuf, ack) ({ \
-	*(__le16 *)(pbuf) |= cpu_to_le16((ack & 3) << 5); \
-})
-
-#define GetAckpolicy(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 5) & 0x3)
-
-#define GetAMsdu(pbuf) (((le16_to_cpu(*(__le16 *)pbuf)) >> 7) & 0x1)
-
-#define GetAddr1Ptr(pbuf)	((unsigned char *)((addr_t)(pbuf) + 4))
-
-#define GetAddr2Ptr(pbuf)	((unsigned char *)((addr_t)(pbuf) + 10))
-
-#define GetAddr3Ptr(pbuf)	((unsigned char *)((addr_t)(pbuf) + 16))
-
-#define GetAddr4Ptr(pbuf)	((unsigned char *)((addr_t)(pbuf) + 24))
-
-static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
-{
-	unsigned char	*sa;
-	unsigned int	to_fr_ds = (GetToDs(pframe) << 1) | GetFrDs(pframe);
-
-	switch (to_fr_ds) {
-	case 0x00:	/* ToDs=0, FromDs=0 */
-		sa = GetAddr3Ptr(pframe);
-		break;
-	case 0x01:	/* ToDs=0, FromDs=1 */
-		sa = GetAddr2Ptr(pframe);
-		break;
-	case 0x02:	/* ToDs=1, FromDs=0 */
-		sa = GetAddr1Ptr(pframe);
-		break;
-	default:	/* ToDs=1, FromDs=1 */
-		sa = NULL;
-		break;
-	}
-	return sa;
-}
-
-/* ---------------------------------------------------------------------------
- *			Below is the fixed elements...
- * ---------------------------------------------------------------------------
- */
-#define _BEACON_ITERVAL_		2
-#define _CAPABILITY_			2
-#define _TIMESTAMP_				8
-
-/*-----------------------------------------------------------------------------
- *			Below is the definition for WMM
- *------------------------------------------------------------------------------
- */
-#define _WMM_IE_Length_				7  /* for WMM STA */
-
-#endif /* _WIFI_H_ */
-
--- a/drivers/staging/rtl8712/wlan_bssdef.h
+++ /dev/null
@@ -1,223 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __WLAN_BSSDEF_H__
-#define __WLAN_BSSDEF_H__
-
-#define MAX_IE_SZ	768
-
-#define NDIS_802_11_LENGTH_SSID         32
-#define NDIS_802_11_LENGTH_RATES        8
-#define NDIS_802_11_LENGTH_RATES_EX     16
-
-struct ndis_802_11_ssid {
-	u32 SsidLength;
-	u8  Ssid[32];
-};
-
-enum NDIS_802_11_NETWORK_TYPE {
-	Ndis802_11FH,
-	Ndis802_11DS,
-	Ndis802_11OFDM5,
-	Ndis802_11OFDM24,
-	Ndis802_11NetworkTypeMax /* not a real type, defined as an upper bound*/
-};
-
-struct NDIS_802_11_CONFIGURATION_FH {
-	u32 Length;             /* Length of structure */
-	u32 HopPattern;         /* As defined by 802.11, MSB set */
-	u32 HopSet;             /* to one if non-802.11 */
-	u32 DwellTime;          /* units are Kusec */
-};
-
-/*
- * FW will only save the channel number in DSConfig.
- * ODI Handler will convert the channel number to freq. number.
- */
-struct NDIS_802_11_CONFIGURATION {
-	u32 Length;             /* Length of structure */
-	u32 BeaconPeriod;       /* units are Kusec */
-	u32 ATIMWindow;         /* units are Kusec */
-	u32 DSConfig;           /* Frequency, units are kHz */
-	struct NDIS_802_11_CONFIGURATION_FH FHConfig;
-};
-
-enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
-	Ndis802_11IBSS,
-	Ndis802_11Infrastructure,
-	Ndis802_11AutoUnknown,
-	Ndis802_11InfrastructureMax, /*Not a real value,defined as upper bound*/
-	Ndis802_11APMode
-};
-
-struct NDIS_802_11_FIXED_IEs {
-	u8  Timestamp[8];
-	u16 BeaconInterval;
-	u16 Capabilities;
-};
-
-struct wlan_bssid_ex {
-	u32 Length;
-	unsigned char  MacAddress[6];
-	u8  Reserved[2];
-	struct ndis_802_11_ssid  Ssid;
-	__le32 Privacy;
-	s32 Rssi;
-	enum NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
-	struct NDIS_802_11_CONFIGURATION  Configuration;
-	enum NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-	u8 rates[NDIS_802_11_LENGTH_RATES_EX];
-	/* number of content bytes in EIs, which varies */
-	u32 IELength;
-	/*(timestamp, beacon interval, and capability information) */
-	u8 IEs[MAX_IE_SZ];
-};
-
-enum NDIS_802_11_AUTHENTICATION_MODE {
-	Ndis802_11AuthModeOpen,
-	Ndis802_11AuthModeShared,
-	Ndis802_11AuthModeAutoSwitch,
-	Ndis802_11AuthModeWPA,
-	Ndis802_11AuthModeWPAPSK,
-	Ndis802_11AuthModeWPANone,
-	Ndis802_11AuthModeMax      /* Not a real mode, defined as upper bound */
-};
-
-enum {
-	Ndis802_11WEPEnabled,
-	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
-	Ndis802_11WEPDisabled,
-	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
-	Ndis802_11WEPKeyAbsent,
-	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
-	Ndis802_11WEPNotSupported,
-	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
-	Ndis802_11Encryption2Enabled,
-	Ndis802_11Encryption2KeyAbsent,
-	Ndis802_11Encryption3Enabled,
-	Ndis802_11Encryption3KeyAbsent
-};
-
-#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
-#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
-#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
-
-#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
-#define NDIS_802_11_AI_RESFI_STATUSCODE        2
-#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
-
-struct NDIS_802_11_AI_REQFI {
-	u16 Capabilities;
-	u16 ListenInterval;
-	unsigned char CurrentAPAddress[6];
-};
-
-struct NDIS_802_11_AI_RESFI {
-	u16 Capabilities;
-	u16 StatusCode;
-	u16 AssociationId;
-};
-
-struct NDIS_802_11_ASSOCIATION_INFORMATION {
-	u32 Length;
-	u16 AvailableRequestFixedIEs;
-	struct NDIS_802_11_AI_REQFI RequestFixedIEs;
-	u32 RequestIELength;
-	u32 OffsetRequestIEs;
-	u16 AvailableResponseFixedIEs;
-	struct NDIS_802_11_AI_RESFI ResponseFixedIEs;
-	u32 ResponseIELength;
-	u32 OffsetResponseIEs;
-};
-
-/* Key mapping keys require a BSSID*/
-struct NDIS_802_11_KEY {
-	u32 Length;			/* Length of this structure */
-	u32 KeyIndex;
-	u32 KeyLength;			/* length of key in bytes */
-	unsigned char BSSID[6];
-	unsigned long long KeyRSC;
-	u8  KeyMaterial[32];		/* variable length */
-};
-
-struct NDIS_802_11_REMOVE_KEY {
-	u32 Length;			/* Length of this structure */
-	u32 KeyIndex;
-	unsigned char BSSID[6];
-};
-
-struct NDIS_802_11_WEP {
-	u32 Length;		  /* Length of this structure */
-	u32 KeyIndex;		  /* 0 is the per-client key,
-				   * 1-N are the global keys
-				   */
-	u32 KeyLength;		  /* length of key in bytes */
-	u8  KeyMaterial[16];      /* variable length depending on above field */
-};
-
-/* mask for authentication/integrity fields */
-#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
-#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
-#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
-#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
-#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
-
-/* MIC check time, 60 seconds. */
-#define MIC_CHECK_TIME	60000000
-
-#ifndef Ndis802_11APMode
-#define Ndis802_11APMode (Ndis802_11InfrastructureMax + 1)
-#endif
-
-struct	wlan_network {
-	struct list_head list;
-	int	network_type;	/*refer to ieee80211.h for WIRELESS_11A/B/G */
-	int	fixed;		/* set to fixed when not to be removed asi
-				 * site-surveying
-				 */
-	unsigned int	last_scanned; /*timestamp for the network */
-	int	aid;		/*will only be valid when a BSS is joined. */
-	int	join_res;
-	struct wlan_bssid_ex network; /*must be the last item */
-};
-
-enum VRTL_CARRIER_SENSE {
-	DISABLE_VCS,
-	ENABLE_VCS,
-	AUTO_VCS
-};
-
-enum VCS_TYPE {
-	NONE_VCS,
-	RTS_CTS,
-	CTS_TO_SELF
-};
-
-#define PWR_CAM 0
-#define PWR_MINPS 1
-#define PWR_MAXPS 2
-#define PWR_UAPSD 3
-#define PWR_VOIP 4
-
-enum UAPSD_MAX_SP {
-	NO_LIMIT,
-	TWO_MSDU,
-	FOUR_MSDU,
-	SIX_MSDU
-};
-
-#define NUM_PRE_AUTH_KEY 16
-#define NUM_PMKID_CACHE NUM_PRE_AUTH_KEY
-
-#endif /* #ifndef WLAN_BSSDEF_H_ */
-
--- a/drivers/staging/rtl8712/xmit_linux.c
+++ /dev/null
@@ -1,181 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/******************************************************************************
- * xmit_linux.c
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- * Linux device driver for RTL8192SU
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-
-#define _XMIT_OSDEP_C_
-
-#include <linux/usb.h>
-#include <linux/ip.h>
-#include <linux/if_ether.h>
-#include <linux/kmemleak.h>
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-#include "wifi.h"
-#include "mlme_osdep.h"
-#include "xmit_osdep.h"
-#include "osdep_intf.h"
-
-static uint remainder_len(struct pkt_file *pfile)
-{
-	return (uint)(pfile->buf_len - ((addr_t)(pfile->cur_addr) -
-	       (addr_t)(pfile->buf_start)));
-}
-
-void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile)
-{
-	pfile->pkt = pktptr;
-	pfile->cur_addr = pfile->buf_start = pktptr->data;
-	pfile->pkt_len = pfile->buf_len = pktptr->len;
-	pfile->cur_buffer = pfile->buf_start;
-}
-
-uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen)
-{
-	uint len;
-
-	len = remainder_len(pfile);
-	len = (rlen > len) ? len : rlen;
-	if (rmem)
-		skb_copy_bits(pfile->pkt, pfile->buf_len - pfile->pkt_len,
-			      rmem, len);
-	pfile->cur_addr += len;
-	pfile->pkt_len -= len;
-	return len;
-}
-
-sint r8712_endofpktfile(struct pkt_file *pfile)
-{
-	return (pfile->pkt_len == 0);
-}
-
-void r8712_set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
-{
-	struct ethhdr etherhdr;
-	struct iphdr ip_hdr;
-	u16 user_priority = 0;
-
-	_r8712_open_pktfile(ppktfile->pkt, ppktfile);
-	_r8712_pktfile_read(ppktfile, (unsigned char *)&etherhdr, ETH_HLEN);
-
-	/* get user_priority from IP hdr*/
-	if (pattrib->ether_type == 0x0800) {
-		_r8712_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr));
-		/*user_priority = (ntohs(ip_hdr.tos) >> 5) & 0x3 ;*/
-		user_priority = ip_hdr.tos >> 5;
-	} else {
-		/* "When priority processing of data frames is supported,
-		 * a STA's SME should send EAPOL-Key frames at the highest
-		 * priority."
-		 */
-
-		if (pattrib->ether_type == 0x888e)
-			user_priority = 7;
-	}
-	pattrib->priority = user_priority;
-	pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
-	pattrib->subtype = WIFI_QOS_DATA_TYPE;
-}
-
-void r8712_SetFilter(struct work_struct *work)
-{
-	struct _adapter *adapter = container_of(work, struct _adapter,
-						wk_filter_rx_ff0);
-	u8  oldvalue = 0x00, newvalue = 0x00;
-
-	oldvalue = r8712_read8(adapter, 0x117);
-	newvalue = oldvalue & 0xfe;
-	r8712_write8(adapter, 0x117, newvalue);
-
-	wait_for_completion(&adapter->rx_filter_ready);
-	r8712_write8(adapter, 0x117, oldvalue);
-}
-
-int r8712_xmit_resource_alloc(struct _adapter *padapter,
-			      struct xmit_buf *pxmitbuf)
-{
-	int i;
-
-	for (i = 0; i < 8; i++) {
-		pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
-		if (!pxmitbuf->pxmit_urb[i]) {
-			int k;
-
-			for (k = i - 1; k >= 0; k--) {
-				/* handle allocation errors part way through loop */
-				usb_free_urb(pxmitbuf->pxmit_urb[k]);
-			}
-			netdev_err(padapter->pnetdev, "pxmitbuf->pxmit_urb[i] == NULL\n");
-			return -ENOMEM;
-		}
-		kmemleak_not_leak(pxmitbuf->pxmit_urb[i]);
-	}
-	return 0;
-}
-
-void r8712_xmit_resource_free(struct _adapter *padapter,
-			      struct xmit_buf *pxmitbuf)
-{
-	int i;
-
-	for (i = 0; i < 8; i++) {
-		if (pxmitbuf->pxmit_urb[i]) {
-			usb_kill_urb(pxmitbuf->pxmit_urb[i]);
-			usb_free_urb(pxmitbuf->pxmit_urb[i]);
-		}
-	}
-}
-
-void r8712_xmit_complete(struct _adapter *padapter, struct xmit_frame *pxframe)
-{
-	if (pxframe->pkt)
-		dev_kfree_skb_any(pxframe->pkt);
-	pxframe->pkt = NULL;
-}
-
-netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct  net_device *netdev)
-{
-	struct xmit_frame *xmitframe = NULL;
-	struct _adapter *adapter = netdev_priv(netdev);
-	struct xmit_priv *xmitpriv = &(adapter->xmitpriv);
-
-	if (!r8712_if_up(adapter))
-		goto _xmit_entry_drop;
-
-	xmitframe = r8712_alloc_xmitframe(xmitpriv);
-	if (!xmitframe)
-		goto _xmit_entry_drop;
-
-	if (r8712_update_attrib(adapter, pkt, &xmitframe->attrib))
-		goto _xmit_entry_drop;
-
-	adapter->ledpriv.LedControlHandler(adapter, LED_CTL_TX);
-	xmitframe->pkt = pkt;
-	if (r8712_pre_xmit(adapter, xmitframe)) {
-		/*dump xmitframe directly or drop xframe*/
-		dev_kfree_skb_any(pkt);
-		xmitframe->pkt = NULL;
-	}
-	xmitpriv->tx_pkts++;
-	xmitpriv->tx_bytes += xmitframe->attrib.last_txcmdsz;
-	return NETDEV_TX_OK;
-_xmit_entry_drop:
-	if (xmitframe)
-		r8712_free_xmitframe(xmitpriv, xmitframe);
-	xmitpriv->tx_drop++;
-	dev_kfree_skb_any(pkt);
-	return NETDEV_TX_OK;
-}
--- a/drivers/staging/rtl8712/xmit_osdep.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/******************************************************************************
- *
- * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
- *
- * Modifications for inclusion into the Linux staging tree are
- * Copyright(c) 2010 Larry Finger. All rights reserved.
- *
- * Contact information:
- * WLAN FAE <wlanfae@realtek.com>
- * Larry Finger <Larry.Finger@lwfinger.net>
- *
- ******************************************************************************/
-#ifndef __XMIT_OSDEP_H_
-#define __XMIT_OSDEP_H_
-
-#include "osdep_service.h"
-#include "drv_types.h"
-
-struct pkt_file {
-	_pkt	*pkt;
-	u32	pkt_len;	 /*the remainder length of the open_file*/
-	_buffer	*cur_buffer;
-	u8	*buf_start;
-	u8	*cur_addr;
-	u32	buf_len;
-};
-
-#define NR_XMITFRAME	256
-
-struct xmit_priv;
-struct pkt_attrib;
-struct sta_xmit_priv;
-struct xmit_frame;
-struct xmit_buf;
-
-netdev_tx_t r8712_xmit_entry(_pkt *pkt, struct  net_device *pnetdev);
-void r8712_SetFilter(struct work_struct *work);
-int r8712_xmit_resource_alloc(struct _adapter *padapter,
-			      struct xmit_buf *pxmitbuf);
-void r8712_xmit_resource_free(struct _adapter *padapter,
-			      struct xmit_buf *pxmitbuf);
-
-void r8712_set_qos(struct pkt_file *ppktfile,
-		   struct pkt_attrib *pattrib);
-void _r8712_open_pktfile(_pkt *pktptr, struct pkt_file *pfile);
-uint _r8712_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen);
-sint r8712_endofpktfile(struct pkt_file *pfile);
-void r8712_xmit_complete(struct _adapter *padapter,
-			 struct xmit_frame *pxframe);
-
-#endif

[PATCH 6.6 88/93] selftests: mptcp: join: properly kill background tasks

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>

commit 852b644acbce1529307a4bb283752c4e77b5cda7 upstream.

The 'run_tests' function is executed in the background, but killing its
associated PID would not kill the children tasks running in the
background.

To properly kill all background tasks, 'kill -- -PID' could be used, but
this requires kill from procps-ng. Instead, all children tasks are
listed using 'ps', and 'kill' is called with all PIDs of this group.

Fixes: 31ee4ad86afd ("selftests: mptcp: join: stop transfer when check is done (part 1)")
Cc: stable@vger.kernel.org
Fixes: 04b57c9e096a ("selftests: mptcp: join: stop transfer when check is done (part 2)")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Conflicts in mptcp_join.sh, because commit e3b47e460b4b ("selftests:
  mptcp: userspace pm remove initial subflow") and commit b9fb176081fb
  ("selftests: mptcp: userspace pm send RM_ADDR for ID 0") are not in
  this version. They introduced new subtests that got modified by this
  patch. That's OK, no need to modify them if they are not there: the
  conflicts can be dropped. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/mptcp/mptcp_join.sh |   14 +++++++-------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh  |   21 +++++++++++++++++++++
 2 files changed, 28 insertions(+), 7 deletions(-)

--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -3679,7 +3679,7 @@ userspace_tests()
 		chk_mptcp_info subflows 0 subflows 0
 		chk_subflows_total 1 1
 		kill_events_pids
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 	fi
 
 	# userspace pm create destroy subflow
@@ -3707,7 +3707,7 @@ userspace_tests()
 		chk_mptcp_info subflows 0 subflows 0
 		chk_subflows_total 1 1
 		kill_events_pids
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 	fi
 
 	# userspace pm create id 0 subflow
@@ -3728,7 +3728,7 @@ userspace_tests()
 		chk_mptcp_info subflows 1 subflows 1
 		chk_subflows_total 2 2
 		kill_events_pids
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 	fi
 }
 
@@ -3758,7 +3758,7 @@ endpoint_tests()
 		pm_nl_add_endpoint $ns2 10.0.2.2 flags signal
 		pm_nl_check_endpoint "modif is allowed" \
 			$ns2 10.0.2.2 id 1 flags signal
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 	fi
 
 	if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT &&
@@ -3813,7 +3813,7 @@ endpoint_tests()
 			chk_mptcp_info subflows 3 subflows 3
 		done
 
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 
 		kill_events_pids
 		chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
@@ -3886,7 +3886,7 @@ endpoint_tests()
 		wait_mpj $ns2
 		chk_subflow_nr "after re-re-add ID 0" 3
 		chk_mptcp_info subflows 3 subflows 3
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 
 		kill_events_pids
 		chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
@@ -3933,7 +3933,7 @@ endpoint_tests()
 		wait_mpj $ns2
 		pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal
 		wait_mpj $ns2
-		mptcp_lib_kill_wait $tests_pid
+		mptcp_lib_kill_group_wait $tests_pid
 
 		chk_join_nr 2 2 2
 		chk_add_nr 2 2
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -242,6 +242,27 @@ mptcp_lib_kill_wait() {
 	wait "${1}" 2>/dev/null
 }
 
+# $1: PID
+mptcp_lib_pid_list_children() {
+	local curr="${1}"
+	# evoke 'ps' only once
+	local pids="${2:-"$(ps o pid,ppid)"}"
+
+	echo "${curr}"
+
+	local pid
+	for pid in $(echo "${pids}" | awk "\$2 == ${curr} { print \$1 }"); do
+		mptcp_lib_pid_list_children "${pid}" "${pids}"
+	done
+}
+
+# $1: PID
+mptcp_lib_kill_group_wait() {
+	# Some users might not have procps-ng: cannot use "kill -- -PID"
+	mptcp_lib_pid_list_children "${1}" | xargs -r kill &>/dev/null
+	wait "${1}" 2>/dev/null
+}
+
 # $1: IP address
 mptcp_lib_is_v6() {
 	[ -z "${1##*:*}" ]

[PATCH 6.6 89/93] mptcp: fix duplicate reset on fastclose

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <pabeni@redhat.com>

commit ae155060247be8dcae3802a95bd1bdf93ab3215d upstream.

The CI reports sporadic failures of the fastclose self-tests. The root
cause is a duplicate reset, not carrying the relevant MPTCP option.
In the failing scenario the bad reset is received by the peer before
the fastclose one, preventing the reception of the latter.

Indeed there is window of opportunity at fastclose time for the
following race:

  mptcp_do_fastclose
    __mptcp_close_ssk
      __tcp_close()
        tcp_set_state() [1]
        tcp_send_active_reset() [2]

After [1] the stack will send reset to in-flight data reaching the now
closed port. Such reset may race with [2].

Address the issue explicitly sending a single reset on fastclose before
explicitly moving the subflow to close status.

Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/596
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-6-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ No conflicts, but tcp_send_active_reset() doesn't take a 3rd argument
  (sk_rst_reason) in this version, see commit 5691276b39da ("rstreason:
  prepare for active reset"). This argument is only helpful for tracing,
  it is fine to drop it. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/protocol.c |   35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2431,7 +2431,6 @@ bool __mptcp_retransmit_pending_data(str
 
 /* flags for __mptcp_close_ssk() */
 #define MPTCP_CF_PUSH		BIT(1)
-#define MPTCP_CF_FASTCLOSE	BIT(2)
 
 /* be sure to send a reset only if the caller asked for it, also
  * clean completely the subflow status when the subflow reaches
@@ -2442,7 +2441,7 @@ static void __mptcp_subflow_disconnect(s
 				       unsigned int flags)
 {
 	if (((1 << ssk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
-	    (flags & MPTCP_CF_FASTCLOSE)) {
+	    subflow->send_fastclose) {
 		/* The MPTCP code never wait on the subflow sockets, TCP-level
 		 * disconnect should never fail
 		 */
@@ -2489,14 +2488,8 @@ static void __mptcp_close_ssk(struct soc
 
 	lock_sock_nested(ssk, SINGLE_DEPTH_NESTING);
 
-	if ((flags & MPTCP_CF_FASTCLOSE) && !__mptcp_check_fallback(msk)) {
-		/* be sure to force the tcp_close path
-		 * to generate the egress reset
-		 */
-		ssk->sk_lingertime = 0;
-		sock_set_flag(ssk, SOCK_LINGER);
-		subflow->send_fastclose = 1;
-	}
+	if (subflow->send_fastclose && ssk->sk_state != TCP_CLOSE)
+		tcp_set_state(ssk, TCP_CLOSE);
 
 	need_push = (flags & MPTCP_CF_PUSH) && __mptcp_retransmit_pending_data(sk);
 	if (!dispose_it) {
@@ -2809,9 +2802,25 @@ static void mptcp_do_fastclose(struct so
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
 	mptcp_set_state(sk, TCP_CLOSE);
-	mptcp_for_each_subflow_safe(msk, subflow, tmp)
-		__mptcp_close_ssk(sk, mptcp_subflow_tcp_sock(subflow),
-				  subflow, MPTCP_CF_FASTCLOSE);
+
+	/* Explicitly send the fastclose reset as need */
+	if (__mptcp_check_fallback(msk))
+		return;
+
+	mptcp_for_each_subflow_safe(msk, subflow, tmp) {
+		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+
+		lock_sock(ssk);
+
+		/* Some subflow socket states don't allow/need a reset.*/
+		if ((1 << ssk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+			goto unlock;
+
+		subflow->send_fastclose = 1;
+		tcp_send_active_reset(ssk, ssk->sk_allocation);
+unlock:
+		release_sock(ssk);
+	}
 }
 
 static void mptcp_worker(struct work_struct *work)

[PATCH 6.6 90/93] ksmbd: fix use-after-free in session logoff

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sean Heelan <seanheelan@gmail.com>

commit 2fc9feff45d92a92cd5f96487655d5be23fb7e2b upstream.

The sess->user object can currently be in use by another thread, for
example if another connection has sent a session setup request to
bind to the session being free'd. The handler for that connection could
be in the smb2_sess_setup function which makes use of sess->user.

Signed-off-by: Sean Heelan <seanheelan@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
v2: Fix duplicate From: header
Backport fix for CVE-2025-37899
 fs/smb/server/smb2pdu.c |    4 ----
 1 file changed, 4 deletions(-)

--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2255,10 +2255,6 @@ int smb2_session_logoff(struct ksmbd_wor
 	sess->state = SMB2_SESSION_EXPIRED;
 	up_write(&conn->session_lock);
 
-	if (sess->user) {
-		ksmbd_free_user(sess->user);
-		sess->user = NULL;
-	}
 	ksmbd_all_conn_set_status(sess_id, KSMBD_SESS_NEED_SETUP);
 
 	rsp->StructureSize = cpu_to_le16(4);

[PATCH 6.6 91/93] net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@bootlin.com>

[ Upstream commit d0b8fec8ae50525b57139393d0bb1f446e82ff7e ]

The IRQ numbers created through irq_create_mapping() are only assigned
to ptpmsg_irq[n].num at the end of the IRQ setup. So if an error occurs
between their creation and their assignment (for instance during the
request_threaded_irq() step), we enter the error path and fail to
release the newly created virtual IRQs because they aren't yet assigned
to ptpmsg_irq[n].num.

Move the mapping creation to ksz_ptp_msg_irq_setup() to ensure symetry
with what's released by ksz_ptp_msg_irq_free().
In the error path, move the irq_dispose_mapping to the out_ptp_msg label
so it will be called only on created IRQs.

Cc: stable@vger.kernel.org
Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-5-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_ptp.c |   18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

--- a/drivers/net/dsa/microchip/ksz_ptp.c
+++ b/drivers/net/dsa/microchip/ksz_ptp.c
@@ -1099,19 +1099,19 @@ static int ksz_ptp_msg_irq_setup(struct
 	static const char * const name[] = {"pdresp-msg", "xdreq-msg",
 					    "sync-msg"};
 	const struct ksz_dev_ops *ops = port->ksz_dev->dev_ops;
+	struct ksz_irq *ptpirq = &port->ptpirq;
 	struct ksz_ptp_irq *ptpmsg_irq;
 
 	ptpmsg_irq = &port->ptpmsg_irq[n];
+	ptpmsg_irq->num = irq_create_mapping(ptpirq->domain, n);
+	if (!ptpmsg_irq->num)
+		return -EINVAL;
 
 	ptpmsg_irq->port = port;
 	ptpmsg_irq->ts_reg = ops->get_port_addr(port->num, ts_reg[n]);
 
 	snprintf(ptpmsg_irq->name, sizeof(ptpmsg_irq->name), name[n]);
 
-	ptpmsg_irq->num = irq_find_mapping(port->ptpirq.domain, n);
-	if (ptpmsg_irq->num < 0)
-		return ptpmsg_irq->num;
-
 	return request_threaded_irq(ptpmsg_irq->num, NULL,
 				    ksz_ptp_msg_thread_fn, IRQF_ONESHOT,
 				    ptpmsg_irq->name, ptpmsg_irq);
@@ -1141,9 +1141,6 @@ int ksz_ptp_irq_setup(struct dsa_switch
 	if (!ptpirq->domain)
 		return -ENOMEM;
 
-	for (irq = 0; irq < ptpirq->nirqs; irq++)
-		irq_create_mapping(ptpirq->domain, irq);
-
 	ptpirq->irq_num = irq_find_mapping(port->pirq.domain, PORT_SRC_PTP_INT);
 	if (!ptpirq->irq_num) {
 		ret = -EINVAL;
@@ -1165,12 +1162,11 @@ int ksz_ptp_irq_setup(struct dsa_switch
 
 out_ptp_msg:
 	free_irq(ptpirq->irq_num, ptpirq);
-	while (irq--)
+	while (irq--) {
 		free_irq(port->ptpmsg_irq[irq].num, &port->ptpmsg_irq[irq]);
-out:
-	for (irq = 0; irq < ptpirq->nirqs; irq++)
 		irq_dispose_mapping(port->ptpmsg_irq[irq].num);
-
+	}
+out:
 	irq_domain_remove(ptpirq->domain);
 
 	return ret;

[PATCH 6.6 92/93] net: dsa: microchip: Free previously initialized ports on init failures

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@bootlin.com>

[ Upstream commit 0f80e21bf6229637e193248fbd284c0ec44bc0fd ]

If a port interrupt setup fails after at least one port has already been
successfully initialized, the gotos miss some resource releasing:
- the already initialized PTP IRQs aren't released
- the already initialized port IRQs aren't released if the failure
occurs in ksz_pirq_setup().

Merge 'out_girq' and 'out_ptpirq' into a single 'port_release' label.
Behind this label, use the reverse loop to release all IRQ resources
for all initialized ports.
Jump in the middle of the reverse loop if an error occurs in
ksz_ptp_irq_setup() to only release the port IRQ of the current
iteration.

Cc: stable@vger.kernel.org
Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link")
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-4-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ replaced dsa_switch_for_each_user_port_continue_reverse() macro with dsa_switch_for_each_port_continue_reverse() plus manual dsa_port_is_user() check ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_common.c |   22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -2163,18 +2163,18 @@ static int ksz_setup(struct dsa_switch *
 		dsa_switch_for_each_user_port(dp, dev->ds) {
 			ret = ksz_pirq_setup(dev, dp->index);
 			if (ret)
-				goto out_girq;
+				goto port_release;
 
 			ret = ksz_ptp_irq_setup(ds, dp->index);
 			if (ret)
-				goto out_pirq;
+				goto pirq_release;
 		}
 	}
 
 	ret = ksz_ptp_clock_register(ds);
 	if (ret) {
 		dev_err(dev->dev, "Failed to register PTP clock: %d\n", ret);
-		goto out_ptpirq;
+		goto port_release;
 	}
 
 	ret = ksz_mdio_register(dev);
@@ -2191,17 +2191,17 @@ static int ksz_setup(struct dsa_switch *
 
 out_ptp_clock_unregister:
 	ksz_ptp_clock_unregister(ds);
-out_ptpirq:
-	if (dev->irq > 0)
-		dsa_switch_for_each_user_port(dp, dev->ds)
+port_release:
+	if (dev->irq > 0) {
+		dsa_switch_for_each_port_continue_reverse(dp, dev->ds) {
+			if (!dsa_port_is_user(dp))
+				continue;
 			ksz_ptp_irq_free(ds, dp->index);
-out_pirq:
-	if (dev->irq > 0)
-		dsa_switch_for_each_user_port(dp, dev->ds)
+pirq_release:
 			ksz_irq_free(&dev->ports[dp->index].pirq);
-out_girq:
-	if (dev->irq > 0)
+		}
 		ksz_irq_free(&dev->girq);
+	}
 
 	return ret;
 }

[PATCH 6.6 93/93] HID: core: Harden s32ton() against conversion to 0 bits

[Greg Kroah-Hartman]

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

[ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ]

Testing by the syzbot fuzzer showed that the HID core gets a
shift-out-of-bounds exception when it tries to convert a 32-bit
quantity to a 0-bit quantity.  Ideally this should never occur, but
there are buggy devices and some might have a report field with size
set to zero; we shouldn't reject the report or the device just because
of that.

Instead, harden the s32ton() routine so that it returns a reasonable
result instead of crashing when it is called with the number of bits
set to 0 -- the same as what snto32() does.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.com/
Tested-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com
Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
[ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()").
  Minor context change fixed. ]
Signed-off-by: Wenshan Lan <jetlan9@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-core.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1351,7 +1351,12 @@ EXPORT_SYMBOL_GPL(hid_snto32);
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
+
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Florian Fainelli]

On 12/3/25 07:28, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on 
BMIPS_GENERIC:

Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Hardik Garg]

The kernel, bpf tool, perf tool, and kselftest builds fine for v6.6.119-rc1 on x86 and arm64 Azure VM.


Tested-by: Hardik Garg <hargar@linux.microsoft.com>


Thanks,
Hardik

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Shuah Khan]

On 12/3/25 08:28, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Peter Schneider]

Am 03.12.2025 um 16:28 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Tested-by: Peter Schneider <pschneider1968@googlemail.com>


Beste Grüße,
Peter Schneider

-- 
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Jon Hunter]

On Wed, 03 Dec 2025 16:28:53 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests passing for Tegra ...

Test results for stable-v6.6:
    10 builds:	10 pass, 0 fail
    28 boots:	28 pass, 0 fail
    120 tests:	120 pass, 0 fail

Linux version:	6.6.119-rc1-gcca93798e4cd
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
                tegra194-p3509-0000+p3668-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Tested-by: Jon Hunter <jonathanh@nvidia.com>

Jon

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Ron Economos]

On 12/3/25 07:28, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Tested-by: Ron Economos <re@w6rz.net>

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 345 bytes --]

On Wed, Dec 03, 2025 at 04:28:53PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Tested-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Naresh Kamboju]

On Wed, 3 Dec 2025 at 22:27, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.119-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>

NOTE:
allyesconfig build errors:
 drivers/leds/leds-spi-byte.c:99:26: error: variable 'child' is
uninitialized when used here [-Werror,-Wuninitialized]

allyesconfig build failures can be resolved by a recent proposed patch,
 - https://lore.kernel.org/all/20251204000025.GA468348@ax162/

## Build
* kernel: 6.6.119-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: cca93798e4cd9365a29b85a0d56a0332912fdcb8
* git describe: v6.6.118-94-gcca93798e4cd
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.118-94-gcca93798e4cd

## Test Regressions (compared to v6.6.117-87-gdd9a47301c80)

## Metric Regressions (compared to v6.6.117-87-gdd9a47301c80)

## Test Fixes (compared to v6.6.117-87-gdd9a47301c80)

## Metric Fixes (compared to v6.6.117-87-gdd9a47301c80)

## Test result summary
total: 111140, pass: 93968, fail: 3457, skip: 13425, xfail: 290

## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 129 total, 128 passed, 1 failed
* arm64: 44 total, 40 passed, 4 failed
* i386: 23 total, 23 passed, 0 failed
* mips: 26 total, 25 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 15 total, 14 passed, 1 failed
* s390: 14 total, 13 passed, 1 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 7 total, 7 passed, 0 failed
* x86_64: 37 total, 34 passed, 3 failed

## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture

--
Linaro LKFT
https://lkft.linaro.org

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Miguel Ojeda]

On Wed, 03 Dec 2025 16:28:53 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.6.119 release.
> There are 93 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.

Boot-tested under QEMU for Rust x86_64:

Tested-by: Miguel Ojeda <ojeda@kernel.org>

Thanks!

Cheers,
Miguel

Re: [PATCH 6.6 00/93] 6.6.119-rc1 review

[Brett A C Sheffield]

# Librecast Test Results

020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 6.6.119-rc1-gcca93798e4cd #5 SMP PREEMPT_DYNAMIC Fri Dec  5 10:58:19 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

Tested-by: Brett A C Sheffield <bacs@librecast.net>