Moved, renamed, and deleted files

The original directory structure was scattered and unorganized.
Changes are basically to make it look like kernel structure.

28 files changed, 21342 insertions, 0 deletions

diff --git a/drivers/staging/rtl8187se/Kconfig b/drivers/staging/rtl8187se/Kconfig
new file mode 100644
index 00000000..3162aabb
--- /dev/null
+++ b/drivers/staging/rtl8187se/Kconfig
@@ -0,0 +1,11 @@
+config R8187SE
+	tristate "RealTek RTL8187SE Wireless LAN NIC driver"
+	depends on PCI && WLAN
+	depends on m
+	select WIRELESS_EXT
+	select WEXT_PRIV
+	select EEPROM_93CX6
+	select CRYPTO
+	default N
+	---help---
+	  If built as a module, it will be called r8187se.ko.
diff --git a/drivers/staging/rtl8187se/Makefile b/drivers/staging/rtl8187se/Makefile
new file mode 100644
index 00000000..72db504b
--- /dev/null
+++ b/drivers/staging/rtl8187se/Makefile
@@ -0,0 +1,38 @@
+
+#ccflags-y += -DCONFIG_IEEE80211_NOWEP=y
+#ccflags-y += -std=gnu89
+#ccflags-y += -O2
+#CC            = gcc
+
+ccflags-y := -DSW_ANTE
+ccflags-y += -DTX_TRACK
+ccflags-y += -DHIGH_POWER
+ccflags-y += -DSW_DIG
+ccflags-y += -DRATE_ADAPT
+
+#enable it for legacy power save, disable it for leisure  power save
+ccflags-y += -DENABLE_LPS
+
+
+#ccflags-y := -mhard-float -DCONFIG_FORCE_HARD_FLOAT=y
+
+r8187se-y :=			\
+		r8180_core.o		\
+		r8180_wx.o		\
+		r8180_rtl8225z2.o	\
+		r8185b_init.o		\
+		r8180_dm.o		\
+		ieee80211/dot11d.o			\
+		ieee80211/ieee80211_softmac.o		\
+		ieee80211/ieee80211_rx.o		\
+		ieee80211/ieee80211_tx.o		\
+		ieee80211/ieee80211_wx.o		\
+		ieee80211/ieee80211_module.o		\
+		ieee80211/ieee80211_softmac_wx.o	\
+		ieee80211/ieee80211_crypt.o		\
+		ieee80211/ieee80211_crypt_tkip.o	\
+		ieee80211/ieee80211_crypt_ccmp.o	\
+		ieee80211/ieee80211_crypt_wep.o
+
+obj-$(CONFIG_R8187SE)	+= r8187se.o
+
diff --git a/drivers/staging/rtl8187se/TODO b/drivers/staging/rtl8187se/TODO
new file mode 100644
index 00000000..704949a9
--- /dev/null
+++ b/drivers/staging/rtl8187se/TODO
@@ -0,0 +1,13 @@
+TODO:
+- prepare private ieee80211 stack for merge with rtl8192su's version:
+  - add hwsec_active flag to struct ieee80211_device
+  - add bHwSec flag to cb_desc structure
+- switch to use shared "librtl" instead of private ieee80211 stack
+- switch to use LIB80211
+- switch to use MAC80211
+- use kernel coding style
+- checkpatch.pl fixes
+- sparse fixes
+- integrate with drivers/net/wireless/rtl818x
+
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com>.
diff --git a/drivers/staging/rtl8187se/ieee80211/dot11d.c b/drivers/staging/rtl8187se/ieee80211/dot11d.c
new file mode 100644
index 00000000..309bb8bf
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/dot11d.c
@@ -0,0 +1,224 @@
+//-----------------------------------------------------------------------------
+//	File:
+//		Dot11d.c
+//
+//	Description:
+//		Implement 802.11d.
+//
+//-----------------------------------------------------------------------------
+
+#include "dot11d.h"
+
+void
+Dot11d_Init(struct ieee80211_device *ieee)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
+
+	pDot11dInfo->bEnabled = 0;
+
+	pDot11dInfo->State = DOT11D_STATE_NONE;
+	pDot11dInfo->CountryIeLen = 0;
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	RESET_CIE_WATCHDOG(ieee);
+
+	printk("Dot11d_Init()\n");
+}
+
+//
+//	Description:
+//		Reset to the state as we are just entering a regulatory domain.
+//
+void
+Dot11d_Reset(struct ieee80211_device *ieee)
+{
+	u32 i;
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
+
+	// Clear old channel map
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	// Set new channel map
+	for (i=1; i<=11; i++) {
+		(pDot11dInfo->channel_map)[i] = 1;
+	}
+	for (i=12; i<=14; i++) {
+		(pDot11dInfo->channel_map)[i] = 2;
+	}
+
+	pDot11dInfo->State = DOT11D_STATE_NONE;
+	pDot11dInfo->CountryIeLen = 0;
+	RESET_CIE_WATCHDOG(ieee);
+
+	//printk("Dot11d_Reset()\n");
+}
+
+//
+//	Description:
+//		Update country IE from Beacon or Probe Resopnse
+//		and configure PHY for operation in the regulatory domain.
+//
+//	TODO:
+//		Configure Tx power.
+//
+//	Assumption:
+//		1. IS_DOT11D_ENABLE() is TRUE.
+//		2. Input IE is an valid one.
+//
+void
+Dot11d_UpdateCountryIe(
+	struct ieee80211_device *dev,
+	u8 *		pTaddr,
+	u16	CoutryIeLen,
+	u8 * pCoutryIe
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 i, j, NumTriples, MaxChnlNum;
+	PCHNL_TXPOWER_TRIPLE pTriple;
+
+	if((CoutryIeLen - 3)%3 != 0)
+	{
+		printk("Dot11d_UpdateCountryIe(): Invalid country IE, skip it........1\n");
+		Dot11d_Reset(dev);
+		return;
+	}
+
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	MaxChnlNum = 0;
+	NumTriples = (CoutryIeLen - 3) / 3; // skip 3-byte country string.
+	pTriple = (PCHNL_TXPOWER_TRIPLE)(pCoutryIe + 3);
+	for(i = 0; i < NumTriples; i++)
+	{
+		if(MaxChnlNum >= pTriple->FirstChnl)
+		{ // It is not in a monotonically increasing order, so stop processing.
+			printk("Dot11d_UpdateCountryIe(): Invalid country IE, skip it........1\n");
+			Dot11d_Reset(dev);
+			return;
+		}
+		if(MAX_CHANNEL_NUMBER < (pTriple->FirstChnl + pTriple->NumChnls))
+		{ // It is not a valid set of channel id, so stop processing.
+			printk("Dot11d_UpdateCountryIe(): Invalid country IE, skip it........2\n");
+			Dot11d_Reset(dev);
+			return;
+		}
+
+		for(j = 0 ; j < pTriple->NumChnls; j++)
+		{
+			pDot11dInfo->channel_map[pTriple->FirstChnl + j] = 1;
+			pDot11dInfo->MaxTxPwrDbmList[pTriple->FirstChnl + j] = pTriple->MaxTxPowerInDbm;
+			MaxChnlNum = pTriple->FirstChnl + j;
+		}
+
+		pTriple = (PCHNL_TXPOWER_TRIPLE)((u8*)pTriple + 3);
+	}
+#if 1
+	//printk("Dot11d_UpdateCountryIe(): Channel List:\n");
+	printk("Channel List:");
+	for(i=1; i<= MAX_CHANNEL_NUMBER; i++)
+		if(pDot11dInfo->channel_map[i] > 0)
+			printk(" %d", i);
+	printk("\n");
+#endif
+
+	UPDATE_CIE_SRC(dev, pTaddr);
+
+	pDot11dInfo->CountryIeLen = CoutryIeLen;
+	memcpy(pDot11dInfo->CountryIeBuf, pCoutryIe,CoutryIeLen);
+	pDot11dInfo->State = DOT11D_STATE_LEARNED;
+}
+
+u8
+DOT11D_GetMaxTxPwrInDbm(
+	struct ieee80211_device *dev,
+	u8 Channel
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 MaxTxPwrInDbm = 255;
+
+	if(MAX_CHANNEL_NUMBER < Channel)
+	{
+		printk("DOT11D_GetMaxTxPwrInDbm(): Invalid Channel\n");
+		return MaxTxPwrInDbm;
+	}
+	if(pDot11dInfo->channel_map[Channel])
+	{
+		MaxTxPwrInDbm = pDot11dInfo->MaxTxPwrDbmList[Channel];
+	}
+
+	return MaxTxPwrInDbm;
+}
+
+
+void
+DOT11D_ScanComplete(
+	struct ieee80211_device * dev
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+
+	switch(pDot11dInfo->State)
+	{
+	case DOT11D_STATE_LEARNED:
+		pDot11dInfo->State = DOT11D_STATE_DONE;
+		break;
+
+	case DOT11D_STATE_DONE:
+		if( GET_CIE_WATCHDOG(dev) == 0 )
+		{ // Reset country IE if previous one is gone.
+			Dot11d_Reset(dev);
+		}
+		break;
+	case DOT11D_STATE_NONE:
+		break;
+	}
+}
+
+int IsLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+
+	if(MAX_CHANNEL_NUMBER < channel)
+	{
+		printk("IsLegalChannel(): Invalid Channel\n");
+		return 0;
+	}
+	if(pDot11dInfo->channel_map[channel] > 0)
+		return 1;
+	return 0;
+}
+
+int ToLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 default_chn = 0;
+	u32 i = 0;
+
+	for (i=1; i<= MAX_CHANNEL_NUMBER; i++)
+	{
+		if(pDot11dInfo->channel_map[i] > 0)
+		{
+			default_chn = i;
+			break;
+		}
+	}
+
+	if(MAX_CHANNEL_NUMBER < channel)
+	{
+		printk("IsLegalChannel(): Invalid Channel\n");
+		return default_chn;
+	}
+
+	if(pDot11dInfo->channel_map[channel] > 0)
+		return channel;
+
+	return default_chn;
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/dot11d.h b/drivers/staging/rtl8187se/ieee80211/dot11d.h
new file mode 100644
index 00000000..029c2cab
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/dot11d.h
@@ -0,0 +1,100 @@
+#ifndef __INC_DOT11D_H
+#define __INC_DOT11D_H
+
+#include "ieee80211.h"
+
+//#define ENABLE_DOT11D
+
+//#define DOT11D_MAX_CHNL_NUM 83
+
+typedef struct _CHNL_TXPOWER_TRIPLE {
+	u8 FirstChnl;
+	u8  NumChnls;
+	u8  MaxTxPowerInDbm;
+}CHNL_TXPOWER_TRIPLE, *PCHNL_TXPOWER_TRIPLE;
+
+typedef enum _DOT11D_STATE {
+	DOT11D_STATE_NONE = 0,
+	DOT11D_STATE_LEARNED,
+	DOT11D_STATE_DONE,
+}DOT11D_STATE;
+
+typedef struct _RT_DOT11D_INFO {
+	//DECLARE_RT_OBJECT(RT_DOT11D_INFO);
+
+	bool bEnabled; // dot11MultiDomainCapabilityEnabled
+
+	u16 CountryIeLen; // > 0 if CountryIeBuf[] contains valid country information element.
+	u8  CountryIeBuf[MAX_IE_LEN];
+	u8  CountryIeSrcAddr[6]; // Source AP of the country IE.
+	u8  CountryIeWatchdog;
+
+	u8  channel_map[MAX_CHANNEL_NUMBER+1];  //!!!Value 0: Invalid, 1: Valid (active scan), 2: Valid (passive scan)
+	//u8  ChnlListLen; // #Bytes valid in ChnlList[].
+	//u8  ChnlList[DOT11D_MAX_CHNL_NUM];
+	u8  MaxTxPwrDbmList[MAX_CHANNEL_NUMBER+1];
+
+	DOT11D_STATE State;
+}RT_DOT11D_INFO, *PRT_DOT11D_INFO;
+#define eqMacAddr(a,b)		( ((a)[0]==(b)[0] && (a)[1]==(b)[1] && (a)[2]==(b)[2] && (a)[3]==(b)[3] && (a)[4]==(b)[4] && (a)[5]==(b)[5]) ? 1:0 )
+#define cpMacAddr(des,src)	      ((des)[0]=(src)[0],(des)[1]=(src)[1],(des)[2]=(src)[2],(des)[3]=(src)[3],(des)[4]=(src)[4],(des)[5]=(src)[5])
+#define GET_DOT11D_INFO(__pIeeeDev) ((PRT_DOT11D_INFO)((__pIeeeDev)->pDot11dInfo))
+
+#define IS_DOT11D_ENABLE(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->bEnabled
+#define IS_COUNTRY_IE_VALID(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen > 0)
+
+#define IS_EQUAL_CIE_SRC(__pIeeeDev, __pTa) eqMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+#define UPDATE_CIE_SRC(__pIeeeDev, __pTa) cpMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+
+#define IS_COUNTRY_IE_CHANGED(__pIeeeDev, __Ie) \
+	(((__Ie).Length == 0 || (__Ie).Length != GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen) ? \
+	FALSE : \
+	(!memcmp(GET_DOT11D_INFO(__pIeeeDev)->CountryIeBuf, (__Ie).Octet, (__Ie).Length)))
+
+#define CIE_WATCHDOG_TH 1
+#define GET_CIE_WATCHDOG(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->CountryIeWatchdog
+#define RESET_CIE_WATCHDOG(__pIeeeDev) GET_CIE_WATCHDOG(__pIeeeDev) = 0
+#define UPDATE_CIE_WATCHDOG(__pIeeeDev) ++GET_CIE_WATCHDOG(__pIeeeDev)
+
+#define IS_DOT11D_STATE_DONE(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->State == DOT11D_STATE_DONE)
+
+
+void
+Dot11d_Init(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_Reset(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_UpdateCountryIe(
+	struct ieee80211_device *dev,
+	u8 *		pTaddr,
+	u16	CoutryIeLen,
+	u8 * pCoutryIe
+	);
+
+u8
+DOT11D_GetMaxTxPwrInDbm(
+	struct ieee80211_device *dev,
+	u8 Channel
+	);
+
+void
+DOT11D_ScanComplete(
+	struct ieee80211_device * dev
+	);
+
+int IsLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+
+int ToLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+#endif // #ifndef __INC_DOT11D_H
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
new file mode 100644
index 00000000..40dd715d
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
@@ -0,0 +1,1483 @@
+/*
+ * Merged with mainline ieee80211.h in Aug 2004.  Original ieee802_11
+ * remains copyright by the original authors
+ *
+ * Portions of the merged code are based on Host AP (software wireless
+ * LAN access point) driver for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * Modified for Realtek's wi-fi cards by Andrea Merello
+ * <andreamrl@tiscali.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+#ifndef IEEE80211_H
+#define IEEE80211_H
+#include <linux/if_ether.h> /* ETH_ALEN */
+#include <linux/kernel.h>   /* ARRAY_SIZE */
+#include <linux/jiffies.h>
+#include <linux/timer.h>
+#include <linux/sched.h>
+#include <linux/semaphore.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/interrupt.h>
+
+#define KEY_TYPE_NA		0x0
+#define KEY_TYPE_WEP40 		0x1
+#define KEY_TYPE_TKIP		0x2
+#define KEY_TYPE_CCMP		0x4
+#define KEY_TYPE_WEP104		0x5
+
+#define aSifsTime					10
+
+#define MGMT_QUEUE_NUM 5
+
+
+#define IEEE_CMD_SET_WPA_PARAM			1
+#define	IEEE_CMD_SET_WPA_IE			2
+#define IEEE_CMD_SET_ENCRYPTION			3
+#define IEEE_CMD_MLME				4
+
+#define IEEE_PARAM_WPA_ENABLED			1
+#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
+#define IEEE_PARAM_DROP_UNENCRYPTED		3
+#define IEEE_PARAM_PRIVACY_INVOKED		4
+#define IEEE_PARAM_AUTH_ALGS			5
+#define IEEE_PARAM_IEEE_802_1X			6
+//It should consistent with the driver_XXX.c
+//   David, 2006.9.26
+#define IEEE_PARAM_WPAX_SELECT			7
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_PROTO_WPA				1
+#define IEEE_PROTO_RSN				2
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_WPAX_USEGROUP			0
+#define IEEE_WPAX_WEP40				1
+#define IEEE_WPAX_TKIP				2
+#define IEEE_WPAX_WRAP   			3
+#define IEEE_WPAX_CCMP				4
+#define IEEE_WPAX_WEP104			5
+
+#define IEEE_KEY_MGMT_IEEE8021X			1
+#define IEEE_KEY_MGMT_PSK			2
+
+
+
+#define IEEE_MLME_STA_DEAUTH			1
+#define IEEE_MLME_STA_DISASSOC			2
+
+
+#define IEEE_CRYPT_ERR_UNKNOWN_ALG		2
+#define IEEE_CRYPT_ERR_UNKNOWN_ADDR		3
+#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED		4
+#define IEEE_CRYPT_ERR_KEY_SET_FAILED		5
+#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED		6
+#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
+
+
+#define	IEEE_CRYPT_ALG_NAME_LEN			16
+
+//by amy for ps
+typedef struct ieee_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+        union {
+		struct {
+			u8 name;
+			u32 value;
+		} wpa_param;
+		struct {
+			u32 len;
+			u8 reserved[32];
+			u8 data[0];
+		} wpa_ie;
+	        struct{
+			int command;
+    			int reason_code;
+		} mlme;
+		struct {
+			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
+			u8 set_tx;
+			u32 err;
+			u8 idx;
+			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+			u16 key_len;
+			u8 key[0];
+		} crypt;
+
+	} u;
+}ieee_param;
+
+
+#define MSECS(t) msecs_to_jiffies(t)
+#define msleep_interruptible_rtl  msleep_interruptible
+
+#define IEEE80211_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+
+#define IEEE80211_3ADDR_LEN 24
+#define IEEE80211_4ADDR_LEN 30
+#define IEEE80211_FCS_LEN    4
+#define IEEE80211_HLEN			IEEE80211_4ADDR_LEN
+#define IEEE80211_FRAME_LEN		(IEEE80211_DATA_LEN + IEEE80211_HLEN)
+#define IEEE80211_MGMT_HDR_LEN 24
+#define IEEE80211_DATA_HDR3_LEN 24
+#define IEEE80211_DATA_HDR4_LEN 30
+
+#define MIN_FRAG_THRESHOLD     256U
+#define	MAX_FRAG_THRESHOLD     2346U
+
+/* Frame control field constants */
+#define IEEE80211_FCTL_DSTODS		0x0300 //added by david
+#define IEEE80211_FCTL_WEP		0x4000
+
+/* debug macros */
+
+#ifdef CONFIG_IEEE80211_DEBUG
+extern u32 ieee80211_debug_level;
+#define IEEE80211_DEBUG(level, fmt, args...) \
+do { if (ieee80211_debug_level & (level)) \
+  printk(KERN_DEBUG "ieee80211: %c %s " fmt, \
+         in_interrupt() ? 'I' : 'U', __func__ , ## args); } while (0)
+#else
+#define IEEE80211_DEBUG(level, fmt, args...) do {} while (0)
+#endif	/* CONFIG_IEEE80211_DEBUG */
+
+/*
+ * To use the debug system;
+ *
+ * If you are defining a new debug classification, simply add it to the #define
+ * list here in the form of:
+ *
+ * #define IEEE80211_DL_xxxx VALUE
+ *
+ * shifting value to the left one bit from the previous entry.  xxxx should be
+ * the name of the classification (for example, WEP)
+ *
+ * You then need to either add a IEEE80211_xxxx_DEBUG() macro definition for your
+ * classification, or use IEEE80211_DEBUG(IEEE80211_DL_xxxx, ...) whenever you want
+ * to send output to that classification.
+ *
+ * To add your debug level to the list of levels seen when you perform
+ *
+ * % cat /proc/net/ipw/debug_level
+ *
+ * you simply need to add your entry to the ipw_debug_levels array.
+ *
+ * If you do not see debug_level in /proc/net/ipw then you do not have
+ * CONFIG_IEEE80211_DEBUG defined in your kernel configuration
+ *
+ */
+
+#define IEEE80211_DL_INFO          (1<<0)
+#define IEEE80211_DL_WX            (1<<1)
+#define IEEE80211_DL_SCAN          (1<<2)
+#define IEEE80211_DL_STATE         (1<<3)
+#define IEEE80211_DL_MGMT          (1<<4)
+#define IEEE80211_DL_FRAG          (1<<5)
+#define IEEE80211_DL_EAP           (1<<6)
+#define IEEE80211_DL_DROP          (1<<7)
+
+#define IEEE80211_DL_TX            (1<<8)
+#define IEEE80211_DL_RX            (1<<9)
+
+#define IEEE80211_ERROR(f, a...) printk(KERN_ERR "ieee80211: " f, ## a)
+#define IEEE80211_WARNING(f, a...) printk(KERN_WARNING "ieee80211: " f, ## a)
+#define IEEE80211_DEBUG_INFO(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_INFO, f, ## a)
+
+#define IEEE80211_DEBUG_WX(f, a...)     IEEE80211_DEBUG(IEEE80211_DL_WX, f, ## a)
+#define IEEE80211_DEBUG_SCAN(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_SCAN, f, ## a)
+//#define IEEE_DEBUG_SCAN  IEEE80211_WARNING
+#define IEEE80211_DEBUG_STATE(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_STATE, f, ## a)
+#define IEEE80211_DEBUG_MGMT(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_MGMT, f, ## a)
+#define IEEE80211_DEBUG_FRAG(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_FRAG, f, ## a)
+#define IEEE80211_DEBUG_EAP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_EAP, f, ## a)
+#define IEEE80211_DEBUG_DROP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_DROP, f, ## a)
+#define IEEE80211_DEBUG_TX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_TX, f, ## a)
+#define IEEE80211_DEBUG_RX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_RX, f, ## a)
+#include <linux/netdevice.h>
+#include <linux/if_arp.h> /* ARPHRD_ETHER */
+
+#ifndef WIRELESS_SPY
+#define WIRELESS_SPY		// enable iwspy support
+#endif
+#include <net/iw_handler.h>	// new driver API
+
+#ifndef ETH_P_PAE
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
+#endif /* ETH_P_PAE */
+
+#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
+#endif
+
+/* IEEE 802.11 defines */
+
+#define P80211_OUI_LEN 3
+
+struct ieee80211_snap_hdr {
+
+        u8    dsap;   /* always 0xAA */
+        u8    ssap;   /* always 0xAA */
+        u8    ctrl;   /* always 0x03 */
+        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+} __attribute__ ((packed));
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+#define WLAN_FC_GET_TYPE(fc) ((fc) & IEEE80211_FCTL_FTYPE)
+#define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
+
+#define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
+#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & IEEE80211_SCTL_SEQ)
+
+#define WLAN_CAPABILITY_BSS (1<<0)
+#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
+
+#define IEEE80211_STATMASK_SIGNAL (1<<0)
+#define IEEE80211_STATMASK_RSSI (1<<1)
+#define IEEE80211_STATMASK_NOISE (1<<2)
+#define IEEE80211_STATMASK_RATE (1<<3)
+#define IEEE80211_STATMASK_WEMASK 0x7
+
+
+#define IEEE80211_CCK_MODULATION    (1<<0)
+#define IEEE80211_OFDM_MODULATION   (1<<1)
+
+#define IEEE80211_24GHZ_BAND     (1<<0)
+#define IEEE80211_52GHZ_BAND     (1<<1)
+
+#define IEEE80211_CCK_RATE_LEN  		4
+#define IEEE80211_CCK_RATE_1MB		        0x02
+#define IEEE80211_CCK_RATE_2MB		        0x04
+#define IEEE80211_CCK_RATE_5MB		        0x0B
+#define IEEE80211_CCK_RATE_11MB		        0x16
+#define IEEE80211_OFDM_RATE_LEN 		8
+#define IEEE80211_OFDM_RATE_6MB		        0x0C
+#define IEEE80211_OFDM_RATE_9MB		        0x12
+#define IEEE80211_OFDM_RATE_12MB		0x18
+#define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_OFDM_RATE_36MB		0x48
+#define IEEE80211_OFDM_RATE_48MB		0x60
+#define IEEE80211_OFDM_RATE_54MB		0x6C
+#define IEEE80211_BASIC_RATE_MASK		0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK		(1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK		(1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK		(1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK		(1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK		(1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK		(1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK		(1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK		(1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK		(1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK		(1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK		(1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK		(1<<11)
+
+#define IEEE80211_CCK_RATES_MASK	        0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK	(IEEE80211_CCK_RATE_1MB_MASK | \
+	IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK	(IEEE80211_CCK_BASIC_RATES_MASK | \
+        IEEE80211_CCK_RATE_5MB_MASK | \
+        IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK		0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK	(IEEE80211_OFDM_RATE_6MB_MASK | \
+	IEEE80211_OFDM_RATE_12MB_MASK | \
+	IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK	(IEEE80211_OFDM_BASIC_RATES_MASK | \
+	IEEE80211_OFDM_RATE_9MB_MASK  | \
+	IEEE80211_OFDM_RATE_18MB_MASK | \
+	IEEE80211_OFDM_RATE_36MB_MASK | \
+	IEEE80211_OFDM_RATE_48MB_MASK | \
+	IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+                                IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+#define IEEE80211_NUM_OFDM_RATES	    8
+#define IEEE80211_NUM_CCK_RATES	            4
+#define IEEE80211_OFDM_SHIFT_MASK_A         4
+
+/* this is stolen and modified from the madwifi driver*/
+#define IEEE80211_FC0_TYPE_MASK		0x0c
+#define IEEE80211_FC0_TYPE_DATA		0x08
+#define IEEE80211_FC0_SUBTYPE_MASK	0xB0
+#define IEEE80211_FC0_SUBTYPE_QOS	0x80
+
+#define IEEE80211_QOS_HAS_SEQ(fc) \
+	(((fc) & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) == \
+	 (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
+
+/* this is stolen from ipw2200 driver */
+#define IEEE_IBSS_MAC_HASH_SIZE 31
+struct ieee_ibss_seq {
+	u8 mac[ETH_ALEN];
+	u16 seq_num[17];
+	u16 frag_num[17];
+	unsigned long packet_time[17];
+	struct list_head list;
+};
+
+/* NOTE: This data is for statistical purposes; not all hardware provides this
+ *       information for frames received.  Not setting these will not cause
+ *       any adverse affects. */
+struct ieee80211_rx_stats {
+	u32 mac_time[2];
+	u8 signalstrength;
+	s8 rssi;
+	u8 signal;
+	u8 noise;
+	u16 rate; /* in 100 kbps */
+	u8 received_channel;
+	u8 control;
+	u8 mask;
+	u8 freq;
+	u16 len;
+	u8 nic_type;
+};
+
+/* IEEE 802.11 requires that STA supports concurrent reception of at least
+ * three fragmented frames. This define can be increased to support more
+ * concurrent frames, but it should be noted that each entry can consume about
+ * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
+#define IEEE80211_FRAG_CACHE_LEN 4
+
+struct ieee80211_frag_entry {
+	unsigned long first_frag_time;
+	unsigned int seq;
+	unsigned int last_frag;
+	struct sk_buff *skb;
+	u8 src_addr[ETH_ALEN];
+	u8 dst_addr[ETH_ALEN];
+};
+
+struct ieee80211_stats {
+	unsigned int tx_unicast_frames;
+	unsigned int tx_multicast_frames;
+	unsigned int tx_fragments;
+	unsigned int tx_unicast_octets;
+	unsigned int tx_multicast_octets;
+	unsigned int tx_deferred_transmissions;
+	unsigned int tx_single_retry_frames;
+	unsigned int tx_multiple_retry_frames;
+	unsigned int tx_retry_limit_exceeded;
+	unsigned int tx_discards;
+	unsigned int rx_unicast_frames;
+	unsigned int rx_multicast_frames;
+	unsigned int rx_fragments;
+	unsigned int rx_unicast_octets;
+	unsigned int rx_multicast_octets;
+	unsigned int rx_fcs_errors;
+	unsigned int rx_discards_no_buffer;
+	unsigned int tx_discards_wrong_sa;
+	unsigned int rx_discards_undecryptable;
+	unsigned int rx_message_in_msg_fragments;
+	unsigned int rx_message_in_bad_msg_fragments;
+};
+
+struct ieee80211_device;
+
+#include "ieee80211_crypt.h"
+
+#define SEC_KEY_1         (1<<0)
+#define SEC_KEY_2         (1<<1)
+#define SEC_KEY_3         (1<<2)
+#define SEC_KEY_4         (1<<3)
+#define SEC_ACTIVE_KEY    (1<<4)
+#define SEC_AUTH_MODE     (1<<5)
+#define SEC_UNICAST_GROUP (1<<6)
+#define SEC_LEVEL         (1<<7)
+#define SEC_ENABLED       (1<<8)
+
+#define SEC_LEVEL_0      0 /* None */
+#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
+#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
+#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
+#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
+
+#define WEP_KEYS 4
+#define WEP_KEY_LEN 13
+
+#define WEP_KEY_LEN_MODIF 32
+
+struct ieee80211_security {
+	u16 active_key:2,
+            enabled:1,
+	    auth_mode:2,
+            auth_algo:4,
+            unicast_uses_group:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][WEP_KEY_LEN_MODIF];
+	u8 level;
+	u16 flags;
+} __attribute__ ((packed));
+
+
+/*
+
+ 802.11 data frame from AP
+
+      ,-------------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `-------------------------------------------------------------------'
+
+Total: 28-2340 bytes
+
+*/
+
+/* Management Frame Information Element Types */
+enum {
+	MFIE_TYPE_SSID = 0,
+	MFIE_TYPE_RATES = 1,
+	MFIE_TYPE_FH_SET = 2,
+	MFIE_TYPE_DS_SET = 3,
+	MFIE_TYPE_CF_SET = 4,
+	MFIE_TYPE_TIM = 5,
+	MFIE_TYPE_IBSS_SET = 6,
+	MFIE_TYPE_COUNTRY = 7,
+	MFIE_TYPE_CHALLENGE = 16,
+	MFIE_TYPE_ERP = 42,
+	MFIE_TYPE_RSN = 48,
+	MFIE_TYPE_RATES_EX = 50,
+	MFIE_TYPE_GENERIC = 221,
+};
+
+struct ieee80211_header_data {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[6];
+	u8 addr2[6];
+	u8 addr3[6];
+	u16 seq_ctrl;
+};
+
+struct ieee80211_hdr_4addr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_3addrqos {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_4addrqos {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+
+struct ieee80211_authentication {
+	struct ieee80211_header_data header;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
+	//struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_disassoc_frame {
+	struct ieee80211_hdr_3addr header;
+	u16    reasoncode;
+} __attribute__ ((packed));
+
+struct ieee80211_probe_request {
+	struct ieee80211_header_data header;
+	/* struct ieee80211_info_element info_element; */
+} __attribute__ ((packed));
+
+struct ieee80211_probe_response {
+	struct ieee80211_header_data header;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 capability;
+	struct ieee80211_info_element info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_request_frame {
+	struct ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 listen_interval;
+	//u8 current_ap[ETH_ALEN];
+	struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_response_frame {
+	struct ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 status;
+	u16 aid;
+	struct ieee80211_info_element info_element; /* supported rates */
+} __attribute__ ((packed));
+
+struct ieee80211_txb {
+	u8 nr_frags;
+	u8 encrypted;
+	u16 reserved;
+	u16 frag_size;
+	u16 payload_size;
+	struct sk_buff *fragments[0];
+};
+
+/* SWEEP TABLE ENTRIES NUMBER */
+#define MAX_SWEEP_TAB_ENTRIES			42
+#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET	7
+
+/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
+ * only use 8, and then use extended rates for the remaining supported
+ * rates.  Other APs, however, stick all of their supported rates on the
+ * main rates information element... */
+#define MAX_RATES_LENGTH			((u8)12)
+#define MAX_RATES_EX_LENGTH			((u8)16)
+
+#define MAX_NETWORK_COUNT			128
+
+#define MAX_CHANNEL_NUMBER			165
+
+#define IEEE80211_SOFTMAC_SCAN_TIME		100 /* (HZ / 2) */
+#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME	(HZ * 2)
+
+#define CRC_LENGTH	4U
+
+#define MAX_WPA_IE_LEN	64
+
+#define NETWORK_EMPTY_ESSID	(1 << 0)
+#define NETWORK_HAS_OFDM	(1 << 1)
+#define NETWORK_HAS_CCK		(1 << 2)
+
+struct ieee80211_wmm_ac_param {
+	u8 ac_aci_acm_aifsn;
+	u8 ac_ecwmin_ecwmax;
+	u16 ac_txop_limit;
+};
+
+struct ieee80211_wmm_ts_info {
+	u8 ac_dir_tid;
+	u8 ac_up_psb;
+	u8 reserved;
+} __attribute__ ((packed));
+
+struct ieee80211_wmm_tspec_elem {
+	struct ieee80211_wmm_ts_info ts_info;
+	u16 norm_msdu_size;
+	u16 max_msdu_size;
+	u32 min_serv_inter;
+	u32 max_serv_inter;
+	u32 inact_inter;
+	u32 suspen_inter;
+	u32 serv_start_time;
+	u32 min_data_rate;
+	u32 mean_data_rate;
+	u32 peak_data_rate;
+	u32 max_burst_size;
+	u32 delay_bound;
+	u32 min_phy_rate;
+	u16 surp_band_allow;
+	u16 medium_time;
+}__attribute__((packed));
+
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+static const char *eap_types[] = {
+	[EAP_PACKET]		= "EAP-Packet",
+	[EAPOL_START]		= "EAPOL-Start",
+	[EAPOL_LOGOFF]		= "EAPOL-Logoff",
+	[EAPOL_KEY]		= "EAPOL-Key",
+	[EAPOL_ENCAP_ASF_ALERT]	= "EAPOL-Encap-ASF-Alert"
+};
+
+static inline const char *eap_get_type(int type)
+{
+	return (type >= ARRAY_SIZE(eap_types)) ? "Unknown" : eap_types[type];
+}
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+} __attribute__ ((packed));
+
+struct ieee80211_softmac_stats {
+	unsigned int rx_ass_ok;
+	unsigned int rx_ass_err;
+	unsigned int rx_probe_rq;
+	unsigned int tx_probe_rs;
+	unsigned int tx_beacons;
+	unsigned int rx_auth_rq;
+	unsigned int rx_auth_rs_ok;
+	unsigned int rx_auth_rs_err;
+	unsigned int tx_auth_rq;
+	unsigned int no_auth_rs;
+	unsigned int no_ass_rs;
+	unsigned int tx_ass_rq;
+	unsigned int rx_ass_rq;
+	unsigned int tx_probe_rq;
+	unsigned int reassoc;
+	unsigned int swtxstop;
+	unsigned int swtxawake;
+};
+
+#define BEACON_PROBE_SSID_ID_POSITION 12
+
+/*
+ * These are the data types that can make up management packets
+ *
+	u16 auth_algorithm;
+	u16 auth_sequence;
+	u16 beacon_interval;
+	u16 capability;
+	u8 current_ap[ETH_ALEN];
+	u16 listen_interval;
+	struct {
+		u16 association_id:14, reserved:2;
+	} __attribute__ ((packed));
+	u32 time_stamp[2];
+	u16 reason;
+	u16 status;
+*/
+
+#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+#define IEEE80211_DEFAULT_BASIC_RATE 10
+
+enum {WMM_all_frame, WMM_two_frame, WMM_four_frame, WMM_six_frame};
+#define MAX_SP_Len  (WMM_all_frame << 4)
+#define IEEE80211_QOS_TID 0x0f
+#define QOS_CTL_NOTCONTAIN_ACK (0x01 << 5)
+
+#define MAX_IE_LEN						0xFF //+YJ,080625
+
+typedef struct _CHANNEL_LIST{
+	u8	Channel[MAX_CHANNEL_NUMBER + 1];
+	u8	Len;
+}CHANNEL_LIST, *PCHANNEL_LIST;
+
+//by amy for ps
+#define IEEE80211_WATCH_DOG_TIME    2000
+//by amy for ps
+//by amy for antenna
+#define ANTENNA_DIVERSITY_TIMER_PERIOD		1000 // 1000 m
+//by amy for antenna
+
+#define IEEE80211_DTIM_MBCAST 4
+#define IEEE80211_DTIM_UCAST 2
+#define IEEE80211_DTIM_VALID 1
+#define IEEE80211_DTIM_INVALID 0
+
+#define IEEE80211_PS_DISABLED 0
+#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
+#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
+#define IEEE80211_PS_ENABLE   IEEE80211_DTIM_VALID
+//added by David for QoS 2006/6/30
+//#define WMM_Hang_8187
+#ifdef WMM_Hang_8187
+#undef WMM_Hang_8187
+#endif
+
+#define WME_AC_BE   0x00
+#define WME_AC_BK   0x01
+#define WME_AC_VI   0x02
+#define WME_AC_VO   0x03
+#define WME_ACI_MASK 0x03
+#define WME_AIFSN_MASK 0x03
+#define WME_AC_PRAM_LEN 16
+
+//UP Mapping to AC, using in MgntQuery_SequenceNumber() and maybe for DSCP
+//#define UP2AC(up)	((up<3) ? ((up==0)?1:0) : (up>>1))
+#define UP2AC(up) (		   \
+	((up) < 1) ? WME_AC_BE : \
+	((up) < 3) ? WME_AC_BK : \
+	((up) < 4) ? WME_AC_BE : \
+	((up) < 6) ? WME_AC_VI : \
+	WME_AC_VO)
+//AC Mapping to UP, using in Tx part for selecting the corresponding TX queue
+#define AC2UP(_ac)	(       \
+	((_ac) == WME_AC_VO) ? 6 : \
+	((_ac) == WME_AC_VI) ? 5 : \
+	((_ac) == WME_AC_BK) ? 1 : \
+	0)
+
+#define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
+struct	ether_header {
+	u8 ether_dhost[ETHER_ADDR_LEN];
+	u8 ether_shost[ETHER_ADDR_LEN];
+	u16 ether_type;
+} __attribute__((packed));
+
+#ifndef ETHERTYPE_PAE
+#define	ETHERTYPE_PAE	0x888e		/* EAPOL PAE/802.1x */
+#endif
+#ifndef ETHERTYPE_IP
+#define	ETHERTYPE_IP	0x0800		/* IP protocol */
+#endif
+
+struct ieee80211_network {
+	/* These entries are used to identify a unique network */
+	u8 bssid[ETH_ALEN];
+	u8 channel;
+	/* Ensure null-terminated for any debug msgs */
+	u8 ssid[IW_ESSID_MAX_SIZE + 1];
+	u8 ssid_len;
+
+	/* These are network statistics */
+	struct ieee80211_rx_stats stats;
+	u16 capability;
+	u8 rates[MAX_RATES_LENGTH];
+	u8 rates_len;
+	u8 rates_ex[MAX_RATES_EX_LENGTH];
+	u8 rates_ex_len;
+	unsigned long last_scanned;
+	u8 mode;
+	u8 flags;
+	u32 last_associate;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 listen_interval;
+	u16 atim_window;
+	u8 wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	u8 rsn_ie[MAX_WPA_IE_LEN];
+	size_t rsn_ie_len;
+	u8 dtim_period;
+	u8 dtim_data;
+	u32 last_dtim_sta_time[2];
+	struct list_head list;
+	//appeded for QoS
+	u8 wmm_info;
+	struct ieee80211_wmm_ac_param wmm_param[4];
+	u8 QoS_Enable;
+	u8 SignalStrength;
+//by amy 080312
+	u8 HighestOperaRate;
+//by amy 080312
+	u8 Turbo_Enable;//enable turbo mode, added by thomas
+	u16 CountryIeLen;
+	u8 CountryIeBuf[MAX_IE_LEN];
+};
+
+enum ieee80211_state {
+
+	/* the card is not linked at all */
+	IEEE80211_NOLINK = 0,
+
+	/* IEEE80211_ASSOCIATING* are for BSS client mode
+	 * the driver shall not perform RX filtering unless
+	 * the state is LINKED.
+	 * The driver shall just check for the state LINKED and
+	 * defaults to NOLINK for ALL the other states (including
+	 * LINKED_SCANNING)
+	 */
+
+	/* the association procedure will start (wq scheduling)*/
+	IEEE80211_ASSOCIATING,
+	IEEE80211_ASSOCIATING_RETRY,
+
+	/* the association procedure is sending AUTH request*/
+	IEEE80211_ASSOCIATING_AUTHENTICATING,
+
+	/* the association procedure has successfully authentcated
+	 * and is sending association request
+	 */
+	IEEE80211_ASSOCIATING_AUTHENTICATED,
+
+	/* the link is ok. the card associated to a BSS or linked
+	 * to a ibss cell or acting as an AP and creating the bss
+	 */
+	IEEE80211_LINKED,
+
+	/* same as LINKED, but the driver shall apply RX filter
+	 * rules as we are in NO_LINK mode. As the card is still
+	 * logically linked, but it is doing a syncro site survey
+	 * then it will be back to LINKED state.
+	 */
+	IEEE80211_LINKED_SCANNING,
+
+};
+
+#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
+#define DEFAULT_FTS 2346
+
+#define CFG_IEEE80211_RESERVE_FCS (1<<0)
+#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
+
+typedef struct tx_pending_t{
+	int frag;
+	struct ieee80211_txb *txb;
+}tx_pending_t;
+
+enum {
+	COUNTRY_CODE_FCC = 0,
+	COUNTRY_CODE_IC = 1,
+	COUNTRY_CODE_ETSI = 2,
+	COUNTRY_CODE_SPAIN = 3,
+	COUNTRY_CODE_FRANCE = 4,
+	COUNTRY_CODE_MKK = 5,
+	COUNTRY_CODE_MKK1 = 6,
+	COUNTRY_CODE_ISRAEL = 7,
+	COUNTRY_CODE_TELEC = 8,
+	COUNTRY_CODE_GLOBAL_DOMAIN = 9,
+	COUNTRY_CODE_WORLD_WIDE_13_INDEX = 10
+};
+
+struct ieee80211_device {
+	struct net_device *dev;
+
+	/* Bookkeeping structures */
+	struct net_device_stats stats;
+	struct ieee80211_stats ieee_stats;
+	struct ieee80211_softmac_stats softmac_stats;
+
+	/* Probe / Beacon management */
+	struct list_head network_free_list;
+	struct list_head network_list;
+	struct ieee80211_network *networks;
+	int scans;
+	int scan_age;
+
+	int iw_mode; /* operating mode (IW_MODE_*) */
+
+	spinlock_t lock;
+	spinlock_t wpax_suitlist_lock;
+
+	int tx_headroom; /* Set to size of any additional room needed at front
+			  * of allocated Tx SKBs */
+	u32 config;
+
+	/* WEP and other encryption related settings at the device level */
+	int open_wep; /* Set to 1 to allow unencrypted frames */
+
+	int reset_on_keychange; /* Set to 1 if the HW needs to be reset on
+				 * WEP key changes */
+
+	/* If the host performs {en,de}cryption, then set to 1 */
+	int host_encrypt;
+	int host_decrypt;
+	int ieee802_1x; /* is IEEE 802.1X used */
+
+	/* WPA data */
+	int wpa_enabled;
+	int drop_unencrypted;
+	int tkip_countermeasures;
+	int privacy_invoked;
+	size_t wpa_ie_len;
+	u8 *wpa_ie;
+
+	u8 ap_mac_addr[6];
+	u16 pairwise_key_type;
+	u16 broadcast_key_type;
+
+	struct list_head crypt_deinit_list;
+	struct ieee80211_crypt_data *crypt[WEP_KEYS];
+	int tx_keyidx; /* default TX key index (crypt[tx_keyidx]) */
+	struct timer_list crypt_deinit_timer;
+
+	int bcrx_sta_key; /* use individual keys to override default keys even
+			   * with RX of broad/multicast frames */
+
+	/* Fragmentation structures */
+	// each streaming contain a entry
+	struct ieee80211_frag_entry frag_cache[17][IEEE80211_FRAG_CACHE_LEN];
+	unsigned int frag_next_idx[17];
+	u16 fts; /* Fragmentation Threshold */
+
+	/* This stores infos for the current network.
+	 * Either the network we are associated in INFRASTRUCTURE
+	 * or the network that we are creating in MASTER mode.
+	 * ad-hoc is a mixture ;-).
+	 * Note that in infrastructure mode, even when not associated,
+	 * fields bssid and essid may be valid (if wpa_set and essid_set
+	 * are true) as thy carry the value set by the user via iwconfig
+	 */
+	struct ieee80211_network current_network;
+
+
+	enum ieee80211_state state;
+
+	int short_slot;
+	int mode;       /* A, B, G */
+	int modulation; /* CCK, OFDM */
+	int freq_band;  /* 2.4Ghz, 5.2Ghz, Mixed */
+	int abg_true;   /* ABG flag              */
+
+	/* used for forcing the ibss workqueue to terminate
+	 * without wait for the syncro scan to terminate
+	 */
+	short sync_scan_hurryup;
+
+	void * pDot11dInfo;
+	bool bGlobalDomain;
+
+	// For Liteon Ch12~13 passive scan
+	u8	MinPassiveChnlNum;
+	u8	IbssStartChnl;
+
+	int rate;       /* current rate */
+	int basic_rate;
+	//FIXME: pleace callback, see if redundant with softmac_features
+	short active_scan;
+
+	/* this contains flags for selectively enable softmac support */
+	u16 softmac_features;
+
+	/* if the sequence control field is not filled by HW */
+	u16 seq_ctrl[5];
+
+	/* association procedure transaction sequence number */
+	u16 associate_seq;
+
+	/* AID for RTXed association responses */
+	u16 assoc_id;
+
+	/* power save mode related*/
+	short ps;
+	short sta_sleep;
+	int ps_timeout;
+	struct tasklet_struct ps_task;
+	u32 ps_th;
+	u32 ps_tl;
+
+	short raw_tx;
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	short queue_stop;
+	short scanning;
+	short proto_started;
+
+	struct semaphore wx_sem;
+	struct semaphore scan_sem;
+
+	spinlock_t mgmt_tx_lock;
+	spinlock_t beacon_lock;
+
+	short beacon_txing;
+
+	short wap_set;
+	short ssid_set;
+
+	u8  wpax_type_set;    //{added by David, 2006.9.28}
+	u32 wpax_type_notify; //{added by David, 2006.9.26}
+
+	/* QoS related flag */
+	char init_wmmparam_flag;
+
+	/* for discarding duplicated packets in IBSS */
+	struct list_head ibss_mac_hash[IEEE_IBSS_MAC_HASH_SIZE];
+
+	/* for discarding duplicated packets in BSS */
+	u16 last_rxseq_num[17]; /* rx seq previous per-tid */
+	u16 last_rxfrag_num[17];/* tx frag previous per-tid */
+	unsigned long last_packet_time[17];
+
+	/* for PS mode */
+	unsigned long last_rx_ps_time;
+
+	/* used if IEEE_SOFTMAC_SINGLE_QUEUE is set */
+	struct sk_buff *mgmt_queue_ring[MGMT_QUEUE_NUM];
+	int mgmt_queue_head;
+	int mgmt_queue_tail;
+
+
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	struct  tx_pending_t tx_pending;
+
+	/* used if IEEE_SOFTMAC_ASSOCIATE is set */
+	struct timer_list associate_timer;
+
+	/* used if IEEE_SOFTMAC_BEACONS is set */
+	struct timer_list beacon_timer;
+
+	struct work_struct associate_complete_wq;
+//	struct work_struct associate_retry_wq;
+	struct work_struct associate_procedure_wq;
+//	struct work_struct softmac_scan_wq;
+	struct work_struct wx_sync_scan_wq;
+	struct work_struct wmm_param_update_wq;
+	struct work_struct ps_request_tx_ack_wq;//for ps
+//	struct work_struct hw_wakeup_wq;
+//	struct work_struct hw_sleep_wq;
+//	struct work_struct watch_dog_wq;
+	bool bInactivePs;
+	bool actscanning;
+	bool beinretry;
+	u16 ListenInterval;
+	unsigned long NumRxDataInPeriod; //YJ,add,080828
+	unsigned long NumRxBcnInPeriod;  //YJ,add,080828
+	unsigned long NumRxOkTotal;
+	unsigned long NumRxUnicast;//YJ,add,080828,for keep alive
+	bool bHwRadioOff;
+        struct delayed_work softmac_scan_wq;
+        struct delayed_work associate_retry_wq;
+	struct delayed_work hw_wakeup_wq;
+	struct delayed_work hw_sleep_wq;//+by amy 080324
+	struct delayed_work watch_dog_wq;
+	struct delayed_work sw_antenna_wq;
+	struct delayed_work  start_ibss_wq;
+//by amy for rate adaptive 080312
+    struct delayed_work rate_adapter_wq;
+//by amy for rate adaptive
+	struct delayed_work hw_dig_wq;
+	struct delayed_work tx_pw_wq;
+
+//Added for RF power on power off by lizhaoming 080512
+	struct delayed_work GPIOChangeRFWorkItem;
+
+	struct workqueue_struct *wq;
+
+	/* Callback functions */
+	void (*set_security)(struct net_device *dev,
+			     struct ieee80211_security *sec);
+
+	/* Used to TX data frame by using txb structs.
+	 * this is not used if in the softmac_features
+	 * is set the flag IEEE_SOFTMAC_TX_QUEUE
+	 */
+	int (*hard_start_xmit)(struct ieee80211_txb *txb,
+			       struct net_device *dev);
+
+	int (*reset_port)(struct net_device *dev);
+
+	/* Softmac-generated frames (mamagement) are TXed via this
+	 * callback if the flag IEEE_SOFTMAC_SINGLE_QUEUE is
+	 * not set. As some cards may have different HW queues that
+	 * one might want to use for data and management frames
+	 * the option to have two callbacks might be useful.
+	 * This function can't sleep.
+	 */
+	int (*softmac_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev);
+
+	/* used instead of hard_start_xmit (not softmac_hard_start_xmit)
+	 * if the IEEE_SOFTMAC_TX_QUEUE feature is used to TX data
+	 * frames. I the option IEEE_SOFTMAC_SINGLE_QUEUE is also set
+	 * then also management frames are sent via this callback.
+	 * This function can't sleep.
+	 */
+	void (*softmac_data_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev,int rate);
+
+	/* stops the HW queue for DATA frames. Useful to avoid
+	 * waste time to TX data frame when we are reassociating
+	 * This function can sleep.
+	 */
+	void (*data_hard_stop)(struct net_device *dev);
+
+	/* OK this is complementar to data_poll_hard_stop */
+	void (*data_hard_resume)(struct net_device *dev);
+
+	/* ask to the driver to retune the radio .
+	 * This function can sleep. the driver should ensure
+	 * the radio has been swithced before return.
+	 */
+	void (*set_chan)(struct net_device *dev,short ch);
+
+	/* These are not used if the ieee stack takes care of
+	 * scanning (IEEE_SOFTMAC_SCAN feature set).
+	 * In this case only the set_chan is used.
+	 *
+	 * The syncro version is similar to the start_scan but
+	 * does not return until all channels has been scanned.
+	 * this is called in user context and should sleep,
+	 * it is called in a work_queue when swithcing to ad-hoc mode
+	 * or in behalf of iwlist scan when the card is associated
+	 * and root user ask for a scan.
+	 * the function stop_scan should stop both the syncro and
+	 * background scanning and can sleep.
+	 * The function start_scan should initiate the background
+	 * scanning and can't sleep.
+	 */
+	void (*scan_syncro)(struct net_device *dev);
+	void (*start_scan)(struct net_device *dev);
+	void (*stop_scan)(struct net_device *dev);
+
+	/* indicate the driver that the link state is changed
+	 * for example it may indicate the card is associated now.
+	 * Driver might be interested in this to apply RX filter
+	 * rules or simply light the LINK led
+	 */
+	void (*link_change)(struct net_device *dev);
+
+	/* these two function indicates to the HW when to start
+	 * and stop to send beacons. This is used when the
+	 * IEEE_SOFTMAC_BEACONS is not set. For now the
+	 * stop_send_bacons is NOT guaranteed to be called only
+	 * after start_send_beacons.
+	 */
+	void (*start_send_beacons) (struct net_device *dev);
+	void (*stop_send_beacons) (struct net_device *dev);
+
+	/* power save mode related */
+	void (*sta_wake_up) (struct net_device *dev);
+	void (*ps_request_tx_ack) (struct net_device *dev);
+	void (*enter_sleep_state) (struct net_device *dev, u32 th, u32 tl);
+	short (*ps_is_queue_empty) (struct net_device *dev);
+
+	/* QoS related */
+	//void (*wmm_param_update) (struct net_device *dev, u8 *ac_param);
+	//void (*wmm_param_update) (struct ieee80211_device *ieee);
+
+	/* This must be the last item so that it points to the data
+	 * allocated beyond this structure by alloc_ieee80211 */
+	u8 priv[0];
+};
+
+#define IEEE_A            (1<<0)
+#define IEEE_B            (1<<1)
+#define IEEE_G            (1<<2)
+#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
+
+/* Generate a 802.11 header */
+
+/* Uses the channel change callback directly
+ * instead of [start/stop] scan callbacks
+ */
+#define IEEE_SOFTMAC_SCAN (1<<2)
+
+/* Perform authentication and association handshake */
+#define IEEE_SOFTMAC_ASSOCIATE (1<<3)
+
+/* Generate probe requests */
+#define IEEE_SOFTMAC_PROBERQ (1<<4)
+
+/* Generate respones to probe requests */
+#define IEEE_SOFTMAC_PROBERS (1<<5)
+
+/* The ieee802.11 stack will manages the netif queue
+ * wake/stop for the driver, taking care of 802.11
+ * fragmentation. See softmac.c for details. */
+#define IEEE_SOFTMAC_TX_QUEUE (1<<7)
+
+/* Uses only the softmac_data_hard_start_xmit
+ * even for TX management frames.
+ */
+#define IEEE_SOFTMAC_SINGLE_QUEUE (1<<8)
+
+/* Generate beacons.  The stack will enqueue beacons
+ * to the card
+ */
+#define IEEE_SOFTMAC_BEACONS (1<<6)
+
+
+
+static inline void *ieee80211_priv(struct net_device *dev)
+{
+	return ((struct ieee80211_device *)netdev_priv(dev))->priv;
+}
+
+extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
+{
+	/* Single white space is for Linksys APs */
+	if (essid_len == 1 && essid[0] == ' ')
+		return 1;
+
+	/* Otherwise, if the entire essid is 0, we assume it is hidden */
+	while (essid_len) {
+		essid_len--;
+		if (essid[essid_len] != '\0')
+			return 0;
+	}
+
+	return 1;
+}
+
+extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode)
+{
+	/*
+	 * It is possible for both access points and our device to support
+	 * combinations of modes, so as long as there is one valid combination
+	 * of ap/device supported modes, then return success
+	 *
+	 */
+	if ((mode & IEEE_A) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_52GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_G) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_B) &&
+	    (ieee->modulation & IEEE80211_CCK_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	return 0;
+}
+
+extern inline int ieee80211_get_hdrlen(u16 fc)
+{
+	int hdrlen = 24;
+
+	switch (WLAN_FC_GET_TYPE(fc)) {
+	case IEEE80211_FTYPE_DATA:
+		if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
+			hdrlen = 30; /* Addr4 */
+		if(IEEE80211_QOS_HAS_SEQ(fc))
+			hdrlen += 2; /* QOS ctrl*/
+		break;
+	case IEEE80211_FTYPE_CTL:
+		switch (WLAN_FC_GET_STYPE(fc)) {
+		case IEEE80211_STYPE_CTS:
+		case IEEE80211_STYPE_ACK:
+			hdrlen = 10;
+			break;
+		default:
+			hdrlen = 16;
+			break;
+		}
+		break;
+	}
+
+	return hdrlen;
+}
+
+
+
+/* ieee80211.c */
+extern void free_ieee80211(struct net_device *dev);
+extern struct net_device *alloc_ieee80211(int sizeof_priv);
+
+extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
+
+/* ieee80211_tx.c */
+
+extern int ieee80211_encrypt_fragment(
+	struct ieee80211_device *ieee,
+	struct sk_buff *frag,
+	int hdr_len);
+
+extern int ieee80211_rtl_xmit(struct sk_buff *skb,
+			  struct net_device *dev);
+extern void ieee80211_txb_free(struct ieee80211_txb *);
+
+
+/* ieee80211_rx.c */
+extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats);
+extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
+			     struct ieee80211_hdr_4addr *header,
+			     struct ieee80211_rx_stats *stats);
+
+/* ieee80211_wx.c */
+extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
+                            struct iw_request_info *info,
+                            union iwreq_data* wrqu, char *extra);
+int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
+                               struct iw_request_info *info,
+                               struct iw_param *data, char *extra);
+int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra);
+
+int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len);
+/* ieee80211_softmac.c */
+extern short ieee80211_is_54g(const struct ieee80211_network *net);
+extern short ieee80211_is_shortslot(const struct ieee80211_network *net);
+extern int ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype);
+extern void ieee80211_softmac_new_net(struct ieee80211_device *ieee, struct ieee80211_network *net);
+
+extern void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *ieee);
+extern void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_master_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_ibss(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_init(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_free(struct ieee80211_device *ieee);
+extern void ieee80211_associate_abort(struct ieee80211_device *ieee);
+extern void ieee80211_disassociate(struct ieee80211_device *ieee);
+extern void ieee80211_stop_scan(struct ieee80211_device *ieee);
+extern void ieee80211_start_scan_syncro(struct ieee80211_device *ieee);
+extern void ieee80211_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
+extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
+extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
+extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
+extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct iw_point *p);
+extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
+extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
+extern void SendDisassociation(struct ieee80211_device *ieee,u8* asSta,u8 asRsn);
+extern void ieee80211_rtl_start_scan(struct ieee80211_device *ieee);
+
+//Add for RF power on power off by lizhaoming 080512
+extern void SendDisassociation(struct ieee80211_device *ieee,
+       			 u8*                     asSta,
+        		 u8                      asRsn);
+
+/* ieee80211_crypt_ccmp&tkip&wep.c */
+extern void ieee80211_tkip_null(void);
+extern void ieee80211_wep_null(void);
+extern void ieee80211_ccmp_null(void);
+/* ieee80211_softmac_wx.c */
+
+extern int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *ext);
+
+extern int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra);
+
+extern int ieee80211_wx_get_essid(struct ieee80211_device *ieee, struct iw_request_info *a,union iwreq_data *wrqu,char *b);
+
+extern int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_scan(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_get_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern void ieee80211_wx_sync_scan_wq(struct work_struct *work);
+
+extern int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_name(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern void ieee80211_softmac_ips_scan_syncro(struct ieee80211_device *ieee);
+
+extern void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, short pwr);
+
+extern const long ieee80211_wlan_frequencies[];
+
+extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
+{
+	ieee->scans++;
+}
+
+extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
+{
+	return ieee->scans;
+}
+
+static inline const char *escape_essid(const char *essid, u8 essid_len) {
+	static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
+	const char *s = essid;
+	char *d = escaped;
+
+	if (ieee80211_is_empty_essid(essid, essid_len)) {
+		memcpy(escaped, "<hidden>", sizeof("<hidden>"));
+		return escaped;
+	}
+
+	essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
+	while (essid_len--) {
+		if (*s == '\0') {
+			*d++ = '\\';
+			*d++ = '0';
+			s++;
+		} else {
+			*d++ = *s++;
+		}
+	}
+	*d = '\0';
+	return escaped;
+}
+#endif /* IEEE80211_H */
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
new file mode 100644
index 00000000..b3882ae9
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
@@ -0,0 +1,244 @@
+/*
+ * Host AP crypto routines
+ *
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Portions Copyright (C) 2004, Intel Corporation <jketreno@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ *
+ */
+
+//#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <asm/string.h>
+#include <asm/errno.h>
+
+#include "ieee80211.h"
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("HostAP crypto");
+MODULE_LICENSE("GPL");
+
+struct ieee80211_crypto_alg {
+	struct list_head list;
+	struct ieee80211_crypto_ops *ops;
+};
+
+
+struct ieee80211_crypto {
+	struct list_head algs;
+	spinlock_t lock;
+};
+
+static struct ieee80211_crypto *hcrypt;
+
+void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee,
+					   int force)
+{
+	struct list_head *ptr, *n;
+	struct ieee80211_crypt_data *entry;
+
+	for (ptr = ieee->crypt_deinit_list.next, n = ptr->next;
+	     ptr != &ieee->crypt_deinit_list; ptr = n, n = ptr->next) {
+		entry = list_entry(ptr, struct ieee80211_crypt_data, list);
+
+		if (atomic_read(&entry->refcnt) != 0 && !force)
+			continue;
+
+		list_del(ptr);
+
+		if (entry->ops)
+			entry->ops->deinit(entry->priv);
+		kfree(entry);
+	}
+}
+
+void ieee80211_crypt_deinit_handler(unsigned long data)
+{
+	struct ieee80211_device *ieee = (struct ieee80211_device *)data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	ieee80211_crypt_deinit_entries(ieee, 0);
+	if (!list_empty(&ieee->crypt_deinit_list)) {
+		printk(KERN_DEBUG "%s: entries remaining in delayed crypt "
+		       "deletion list\n", ieee->dev->name);
+		ieee->crypt_deinit_timer.expires = jiffies + HZ;
+		add_timer(&ieee->crypt_deinit_timer);
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
+				    struct ieee80211_crypt_data **crypt)
+{
+	struct ieee80211_crypt_data *tmp;
+	unsigned long flags;
+
+	if (*crypt == NULL)
+		return;
+
+	tmp = *crypt;
+	*crypt = NULL;
+
+	/* must not run ops->deinit() while there may be pending encrypt or
+	 * decrypt operations. Use a list of delayed deinits to avoid needing
+	 * locking. */
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	list_add(&tmp->list, &ieee->crypt_deinit_list);
+	if (!timer_pending(&ieee->crypt_deinit_timer)) {
+		ieee->crypt_deinit_timer.expires = jiffies + HZ;
+		add_timer(&ieee->crypt_deinit_timer);
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
+{
+	unsigned long flags;
+	struct ieee80211_crypto_alg *alg;
+
+	if (hcrypt == NULL)
+		return -1;
+
+	alg = kzalloc(sizeof(*alg), GFP_KERNEL);
+	if (alg == NULL)
+		return -ENOMEM;
+
+	alg->ops = ops;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	list_add(&alg->list, &hcrypt->algs);
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	printk(KERN_DEBUG "ieee80211_crypt: registered algorithm '%s'\n",
+	       ops->name);
+
+	return 0;
+}
+
+int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops)
+{
+	unsigned long flags;
+	struct list_head *ptr;
+	struct ieee80211_crypto_alg *del_alg = NULL;
+
+	if (hcrypt == NULL)
+		return -1;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
+		struct ieee80211_crypto_alg *alg =
+			(struct ieee80211_crypto_alg *) ptr;
+		if (alg->ops == ops) {
+			list_del(&alg->list);
+			del_alg = alg;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	if (del_alg) {
+		printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
+		       "'%s'\n", ops->name);
+		kfree(del_alg);
+	}
+
+	return del_alg ? 0 : -1;
+}
+
+
+struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name)
+{
+	unsigned long flags;
+	struct list_head *ptr;
+	struct ieee80211_crypto_alg *found_alg = NULL;
+
+	if (hcrypt == NULL)
+		return NULL;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
+		struct ieee80211_crypto_alg *alg =
+			(struct ieee80211_crypto_alg *) ptr;
+		if (strcmp(alg->ops->name, name) == 0) {
+			found_alg = alg;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	if (found_alg)
+		return found_alg->ops;
+	else
+		return NULL;
+}
+
+
+static void * ieee80211_crypt_null_init(int keyidx) { return (void *) 1; }
+static void ieee80211_crypt_null_deinit(void *priv) {}
+
+static struct ieee80211_crypto_ops ieee80211_crypt_null = {
+	.name			= "NULL",
+	.init			= ieee80211_crypt_null_init,
+	.deinit			= ieee80211_crypt_null_deinit,
+	.encrypt_mpdu		= NULL,
+	.decrypt_mpdu		= NULL,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= NULL,
+	.get_key		= NULL,
+	.extra_prefix_len	= 0,
+	.extra_postfix_len	= 0,
+	.owner			= THIS_MODULE,
+};
+
+
+int ieee80211_crypto_init(void)
+{
+	int ret = -ENOMEM;
+
+	hcrypt = kzalloc(sizeof(*hcrypt), GFP_KERNEL);
+	if (!hcrypt)
+		goto out;
+
+	INIT_LIST_HEAD(&hcrypt->algs);
+	spin_lock_init(&hcrypt->lock);
+
+	ret = ieee80211_register_crypto_ops(&ieee80211_crypt_null);
+	if (ret < 0) {
+		kfree(hcrypt);
+		hcrypt = NULL;
+	}
+out:
+	return ret;
+}
+
+
+void ieee80211_crypto_deinit(void)
+{
+	struct list_head *ptr, *n;
+	struct ieee80211_crypto_alg *alg = NULL;
+
+	if (hcrypt == NULL)
+		return;
+
+	list_for_each_safe(ptr, n, &hcrypt->algs) {
+		alg = list_entry(ptr, struct ieee80211_crypto_alg, list);
+		if (alg) {
+			list_del(ptr);
+			printk(KERN_DEBUG
+			       "ieee80211_crypt: unregistered algorithm '%s' (deinit)\n",
+			       alg->ops->name);
+			kfree(alg);
+		}
+	}
+	kfree(hcrypt);
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h
new file mode 100644
index 00000000..b58a3bcc
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h
@@ -0,0 +1,86 @@
+/*
+ * Original code based on Host AP (software wireless LAN access point) driver
+ * for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ *
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+/*
+ * This file defines the interface to the ieee80211 crypto module.
+ */
+#ifndef IEEE80211_CRYPT_H
+#define IEEE80211_CRYPT_H
+
+#include <linux/skbuff.h>
+
+struct ieee80211_crypto_ops {
+	const char *name;
+
+	/* init new crypto context (e.g., allocate private data space,
+	 * select IV, etc.); returns NULL on failure or pointer to allocated
+	 * private data on success */
+	void * (*init)(int keyidx);
+
+	/* deinitialize crypto context and free allocated private data */
+	void (*deinit)(void *priv);
+
+	/* encrypt/decrypt return < 0 on error or >= 0 on success. The return
+	 * value from decrypt_mpdu is passed as the keyidx value for
+	 * decrypt_msdu. skb must have enough head and tail room for the
+	 * encryption; if not, error will be returned; these functions are
+	 * called for all MPDUs (i.e., fragments).
+	 */
+	int (*encrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+
+	/* These functions are called for full MSDUs, i.e. full frames.
+	 * These can be NULL if full MSDU operations are not needed. */
+	int (*encrypt_msdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_msdu)(struct sk_buff *skb, int keyidx, int hdr_len,
+			    void *priv);
+
+	int (*set_key)(void *key, int len, u8 *seq, void *priv);
+	int (*get_key)(void *key, int len, u8 *seq, void *priv);
+
+	/* procfs handler for printing out key information and possible
+	 * statistics */
+	char * (*print_stats)(char *p, void *priv);
+
+	/* maximum number of bytes added by encryption; encrypt buf is
+	 * allocated with extra_prefix_len bytes, copy of in_buf, and
+	 * extra_postfix_len; encrypt need not use all this space, but
+	 * the result must start at the beginning of the buffer and correct
+	 * length must be returned */
+	int extra_prefix_len, extra_postfix_len;
+
+	struct module *owner;
+};
+
+struct ieee80211_crypt_data {
+	struct list_head list; /* delayed deletion list */
+	struct ieee80211_crypto_ops *ops;
+	void *priv;
+	atomic_t refcnt;
+};
+
+int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops);
+int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops);
+struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name);
+void ieee80211_crypt_deinit_entries(struct ieee80211_device *, int);
+void ieee80211_crypt_deinit_handler(unsigned long);
+void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
+				    struct ieee80211_crypt_data **crypt);
+
+#endif
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c
new file mode 100644
index 00000000..6aaaa2fd
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c
@@ -0,0 +1,464 @@
+/*
+ * Host AP crypt: host-based CCMP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <asm/string.h>
+#include <linux/wireless.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: CCMP");
+MODULE_LICENSE("GPL");
+
+
+#define AES_BLOCK_LEN 16
+#define CCMP_HDR_LEN 8
+#define CCMP_MIC_LEN 8
+#define CCMP_TK_LEN 16
+#define CCMP_PN_LEN 6
+
+struct ieee80211_ccmp_data {
+	u8 key[CCMP_TK_LEN];
+	int key_set;
+
+	u8 tx_pn[CCMP_PN_LEN];
+	u8 rx_pn[CCMP_PN_LEN];
+
+	u32 dot11RSNAStatsCCMPFormatErrors;
+	u32 dot11RSNAStatsCCMPReplays;
+	u32 dot11RSNAStatsCCMPDecryptErrors;
+
+	int key_idx;
+
+	struct crypto_tfm *tfm;
+
+	/* scratch buffers for virt_to_page() (crypto API) */
+	u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN],
+		tx_e[AES_BLOCK_LEN], tx_s0[AES_BLOCK_LEN];
+	u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN];
+};
+
+void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm,
+			     const u8 pt[16], u8 ct[16])
+{
+	crypto_cipher_encrypt_one((void *)tfm, ct, pt);
+}
+
+static void * ieee80211_ccmp_init(int key_idx)
+{
+	struct ieee80211_ccmp_data *priv;
+
+	priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	priv->key_idx = key_idx;
+
+	priv->tfm = (void *)crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_ccmp: could not allocate "
+		       "crypto API aes\n");
+		priv->tfm = NULL;
+		goto fail;
+	}
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tfm)
+			crypto_free_cipher((void *)priv->tfm);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void ieee80211_ccmp_deinit(void *priv)
+{
+	struct ieee80211_ccmp_data *_priv = priv;
+
+	if (_priv && _priv->tfm)
+		crypto_free_cipher((void *)_priv->tfm);
+	kfree(priv);
+}
+
+
+static inline void xor_block(u8 *b, u8 *a, size_t len)
+{
+	int i;
+	for (i = 0; i < len; i++)
+		b[i] ^= a[i];
+}
+
+static void ccmp_init_blocks(struct crypto_tfm *tfm,
+			     struct ieee80211_hdr_4addr *hdr,
+			     u8 *pn, size_t dlen, u8 *b0, u8 *auth,
+			     u8 *s0)
+{
+	u8 *pos, qc = 0;
+	size_t aad_len;
+	u16 fc;
+	int a4_included, qc_included;
+	u8 aad[2 * AES_BLOCK_LEN];
+
+	fc = le16_to_cpu(hdr->frame_ctl);
+	a4_included = ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+		       (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS));
+	/*
+	qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
+		       (WLAN_FC_GET_STYPE(fc) & 0x08));
+        */
+	// fixed by David :2006.9.6
+	qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
+		       (WLAN_FC_GET_STYPE(fc) & 0x80));
+	aad_len = 22;
+	if (a4_included)
+		aad_len += 6;
+	if (qc_included) {
+		pos = (u8 *) &hdr->addr4;
+		if (a4_included)
+			pos += 6;
+		qc = *pos & 0x0f;
+		aad_len += 2;
+	}
+	/* CCM Initial Block:
+	 * Flag (Include authentication header, M=3 (8-octet MIC),
+	 *       L=1 (2-octet Dlen))
+	 * Nonce: 0x00 | A2 | PN
+	 * Dlen */
+	b0[0] = 0x59;
+	b0[1] = qc;
+	memcpy(b0 + 2, hdr->addr2, ETH_ALEN);
+	memcpy(b0 + 8, pn, CCMP_PN_LEN);
+	b0[14] = (dlen >> 8) & 0xff;
+	b0[15] = dlen & 0xff;
+
+	/* AAD:
+	 * FC with bits 4..6 and 11..13 masked to zero; 14 is always one
+	 * A1 | A2 | A3
+	 * SC with bits 4..15 (seq#) masked to zero
+	 * A4 (if present)
+	 * QC (if present)
+	 */
+	pos = (u8 *) hdr;
+	aad[0] = 0; /* aad_len >> 8 */
+	aad[1] = aad_len & 0xff;
+	aad[2] = pos[0] & 0x8f;
+	aad[3] = pos[1] & 0xc7;
+	memcpy(aad + 4, hdr->addr1, 3 * ETH_ALEN);
+	pos = (u8 *) &hdr->seq_ctl;
+	aad[22] = pos[0] & 0x0f;
+	aad[23] = 0; /* all bits masked */
+	memset(aad + 24, 0, 8);
+	if (a4_included)
+		memcpy(aad + 24, hdr->addr4, ETH_ALEN);
+	if (qc_included) {
+		aad[a4_included ? 30 : 24] = qc;
+		/* rest of QC masked */
+	}
+
+	/* Start with the first block and AAD */
+	ieee80211_ccmp_aes_encrypt(tfm, b0, auth);
+	xor_block(auth, aad, AES_BLOCK_LEN);
+	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
+	xor_block(auth, &aad[AES_BLOCK_LEN], AES_BLOCK_LEN);
+	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
+	b0[0] &= 0x07;
+	b0[14] = b0[15] = 0;
+	ieee80211_ccmp_aes_encrypt(tfm, b0, s0);
+}
+
+static int ieee80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_ccmp_data *key = priv;
+	int data_len, i;
+	u8 *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	int blocks, last, len;
+	u8 *mic;
+	u8 *b0 = key->tx_b0;
+	u8 *b = key->tx_b;
+	u8 *e = key->tx_e;
+	u8 *s0 = key->tx_s0;
+
+	if (skb_headroom(skb) < CCMP_HDR_LEN ||
+	    skb_tailroom(skb) < CCMP_MIC_LEN ||
+	    skb->len < hdr_len)
+		return -1;
+
+	data_len = skb->len - hdr_len;
+	pos = skb_push(skb, CCMP_HDR_LEN);
+	memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
+	pos += hdr_len;
+//	mic = skb_put(skb, CCMP_MIC_LEN);
+
+	i = CCMP_PN_LEN - 1;
+	while (i >= 0) {
+		key->tx_pn[i]++;
+		if (key->tx_pn[i] != 0)
+			break;
+		i--;
+	}
+
+	*pos++ = key->tx_pn[5];
+	*pos++ = key->tx_pn[4];
+	*pos++ = 0;
+	*pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */;
+	*pos++ = key->tx_pn[3];
+	*pos++ = key->tx_pn[2];
+	*pos++ = key->tx_pn[1];
+	*pos++ = key->tx_pn[0];
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	//mic is moved to here by john
+	mic = skb_put(skb, CCMP_MIC_LEN);
+
+	ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
+
+	blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
+	last = data_len % AES_BLOCK_LEN;
+
+	for (i = 1; i <= blocks; i++) {
+		len = (i == blocks && last) ? last : AES_BLOCK_LEN;
+		/* Authentication */
+		xor_block(b, pos, len);
+		ieee80211_ccmp_aes_encrypt(key->tfm, b, b);
+		/* Encryption, with counter */
+		b0[14] = (i >> 8) & 0xff;
+		b0[15] = i & 0xff;
+		ieee80211_ccmp_aes_encrypt(key->tfm, b0, e);
+		xor_block(pos, e, len);
+		pos += len;
+	}
+
+	for (i = 0; i < CCMP_MIC_LEN; i++)
+		mic[i] = b[i] ^ s0[i];
+
+	return 0;
+}
+
+
+static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_ccmp_data *key = priv;
+	u8 keyidx, *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	u8 pn[6];
+	size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - CCMP_MIC_LEN;
+	u8 *mic = skb->data + skb->len - CCMP_MIC_LEN;
+	u8 *b0 = key->rx_b0;
+	u8 *b = key->rx_b;
+	u8 *a = key->rx_a;
+	int i, blocks, last, len;
+
+	if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
+		key->dot11RSNAStatsCCMPFormatErrors++;
+		return -1;
+	}
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	pos = skb->data + hdr_len;
+	keyidx = pos[3];
+	if (!(keyidx & (1 << 5))) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: received packet without ExtIV"
+			       " flag from %pM\n", hdr->addr2);
+		}
+		key->dot11RSNAStatsCCMPFormatErrors++;
+		return -2;
+	}
+	keyidx >>= 6;
+	if (key->key_idx != keyidx) {
+		printk(KERN_DEBUG "CCMP: RX tkey->key_idx=%d frame "
+		       "keyidx=%d priv=%p\n", key->key_idx, keyidx, priv);
+		return -6;
+	}
+	if (!key->key_set) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: received packet from %pM"
+			       " with keyid=%d that does not have a configured"
+			       " key\n", hdr->addr2, keyidx);
+		}
+		return -3;
+	}
+
+	pn[0] = pos[7];
+	pn[1] = pos[6];
+	pn[2] = pos[5];
+	pn[3] = pos[4];
+	pn[4] = pos[1];
+	pn[5] = pos[0];
+	pos += 8;
+
+	if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: replay detected: STA=%pM"
+			       " previous PN %pm received PN %pm\n",
+			       hdr->addr2, key->rx_pn, pn);
+		}
+		key->dot11RSNAStatsCCMPReplays++;
+		return -4;
+	}
+
+	ccmp_init_blocks(key->tfm, hdr, pn, data_len, b0, a, b);
+	xor_block(mic, b, CCMP_MIC_LEN);
+
+	blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
+	last = data_len % AES_BLOCK_LEN;
+
+	for (i = 1; i <= blocks; i++) {
+		len = (i == blocks && last) ? last : AES_BLOCK_LEN;
+		/* Decrypt, with counter */
+		b0[14] = (i >> 8) & 0xff;
+		b0[15] = i & 0xff;
+		ieee80211_ccmp_aes_encrypt(key->tfm, b0, b);
+		xor_block(pos, b, len);
+		/* Authentication */
+		xor_block(a, pos, len);
+		ieee80211_ccmp_aes_encrypt(key->tfm, a, a);
+		pos += len;
+	}
+
+	if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: decrypt failed: STA="
+			       "%pM\n", hdr->addr2);
+		}
+		key->dot11RSNAStatsCCMPDecryptErrors++;
+		return -5;
+	}
+
+	memcpy(key->rx_pn, pn, CCMP_PN_LEN);
+
+	/* Remove hdr and MIC */
+	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
+	skb_pull(skb, CCMP_HDR_LEN);
+	skb_trim(skb, skb->len - CCMP_MIC_LEN);
+
+	return keyidx;
+}
+
+
+static int ieee80211_ccmp_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_ccmp_data *data = priv;
+	int keyidx;
+	struct crypto_tfm *tfm = data->tfm;
+
+	keyidx = data->key_idx;
+	memset(data, 0, sizeof(*data));
+	data->key_idx = keyidx;
+	data->tfm = tfm;
+	if (len == CCMP_TK_LEN) {
+		memcpy(data->key, key, CCMP_TK_LEN);
+		data->key_set = 1;
+		if (seq) {
+			data->rx_pn[0] = seq[5];
+			data->rx_pn[1] = seq[4];
+			data->rx_pn[2] = seq[3];
+			data->rx_pn[3] = seq[2];
+			data->rx_pn[4] = seq[1];
+			data->rx_pn[5] = seq[0];
+		}
+		crypto_cipher_setkey((void *)data->tfm, data->key, CCMP_TK_LEN);
+	} else if (len == 0)
+		data->key_set = 0;
+	else
+		return -1;
+
+	return 0;
+}
+
+
+static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_ccmp_data *data = priv;
+
+	if (len < CCMP_TK_LEN)
+		return -1;
+
+	if (!data->key_set)
+		return 0;
+	memcpy(key, data->key, CCMP_TK_LEN);
+
+	if (seq) {
+		seq[0] = data->tx_pn[5];
+		seq[1] = data->tx_pn[4];
+		seq[2] = data->tx_pn[3];
+		seq[3] = data->tx_pn[2];
+		seq[4] = data->tx_pn[1];
+		seq[5] = data->tx_pn[0];
+	}
+
+	return CCMP_TK_LEN;
+}
+
+
+static char * ieee80211_ccmp_print_stats(char *p, void *priv)
+{
+	struct ieee80211_ccmp_data *ccmp = priv;
+	p += sprintf(p, "key[%d] alg=CCMP key_set=%d "
+		     "tx_pn=%pm rx_pn=%pm "
+		     "format_errors=%d replays=%d decrypt_errors=%d\n",
+		     ccmp->key_idx, ccmp->key_set,
+		     ccmp->tx_pn, ccmp->rx_pn,
+		     ccmp->dot11RSNAStatsCCMPFormatErrors,
+		     ccmp->dot11RSNAStatsCCMPReplays,
+		     ccmp->dot11RSNAStatsCCMPDecryptErrors);
+
+	return p;
+}
+
+void ieee80211_ccmp_null(void)
+{
+//    printk("============>%s()\n", __func__);
+	return;
+}
+static struct ieee80211_crypto_ops ieee80211_crypt_ccmp = {
+	.name			= "CCMP",
+	.init			= ieee80211_ccmp_init,
+	.deinit			= ieee80211_ccmp_deinit,
+	.encrypt_mpdu		= ieee80211_ccmp_encrypt,
+	.decrypt_mpdu		= ieee80211_ccmp_decrypt,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= ieee80211_ccmp_set_key,
+	.get_key		= ieee80211_ccmp_get_key,
+	.print_stats		= ieee80211_ccmp_print_stats,
+	.extra_prefix_len	= CCMP_HDR_LEN,
+	.extra_postfix_len	= CCMP_MIC_LEN,
+	.owner			= THIS_MODULE,
+};
+
+
+int ieee80211_crypto_ccmp_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_ccmp);
+}
+
+
+void ieee80211_crypto_ccmp_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_ccmp);
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c
new file mode 100644
index 00000000..da24e430
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c
@@ -0,0 +1,751 @@
+/*
+ * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <asm/string.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <linux/crc32.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: TKIP");
+MODULE_LICENSE("GPL");
+
+
+struct ieee80211_tkip_data {
+#define TKIP_KEY_LEN 32
+	u8 key[TKIP_KEY_LEN];
+	int key_set;
+
+	u32 tx_iv32;
+	u16 tx_iv16;
+	u16 tx_ttak[5];
+	int tx_phase1_done;
+
+	u32 rx_iv32;
+	u16 rx_iv16;
+	u16 rx_ttak[5];
+	int rx_phase1_done;
+	u32 rx_iv32_new;
+	u16 rx_iv16_new;
+
+	u32 dot11RSNAStatsTKIPReplays;
+	u32 dot11RSNAStatsTKIPICVErrors;
+	u32 dot11RSNAStatsTKIPLocalMICFailures;
+
+	int key_idx;
+
+	struct crypto_blkcipher *rx_tfm_arc4;
+	struct crypto_hash *rx_tfm_michael;
+	struct crypto_blkcipher *tx_tfm_arc4;
+	struct crypto_hash *tx_tfm_michael;
+	struct crypto_tfm *tfm_arc4;
+	struct crypto_tfm *tfm_michael;
+
+	/* scratch buffers for virt_to_page() (crypto API) */
+	u8 rx_hdr[16], tx_hdr[16];
+};
+
+static void * ieee80211_tkip_init(int key_idx)
+{
+	struct ieee80211_tkip_data *priv;
+
+	priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	priv->key_idx = key_idx;
+
+	priv->tx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+						CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm_arc4)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+		       "crypto API arc4\n");
+		priv->tx_tfm_arc4 = NULL;
+		goto fail;
+	}
+
+	priv->tx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+						 CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm_michael)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+		       "crypto API michael_mic\n");
+		priv->tx_tfm_michael = NULL;
+		goto fail;
+	}
+
+	priv->rx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+						CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm_arc4)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+		       "crypto API arc4\n");
+		priv->rx_tfm_arc4 = NULL;
+		goto fail;
+	}
+
+	priv->rx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+						 CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm_michael)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+		       "crypto API michael_mic\n");
+		priv->rx_tfm_michael = NULL;
+		goto fail;
+	}
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tx_tfm_michael)
+			crypto_free_hash(priv->tx_tfm_michael);
+		if (priv->tx_tfm_arc4)
+			crypto_free_blkcipher(priv->tx_tfm_arc4);
+		if (priv->rx_tfm_michael)
+			crypto_free_hash(priv->rx_tfm_michael);
+		if (priv->rx_tfm_arc4)
+			crypto_free_blkcipher(priv->rx_tfm_arc4);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void ieee80211_tkip_deinit(void *priv)
+{
+	struct ieee80211_tkip_data *_priv = priv;
+
+	if (_priv) {
+		if (_priv->tx_tfm_michael)
+			crypto_free_hash(_priv->tx_tfm_michael);
+		if (_priv->tx_tfm_arc4)
+			crypto_free_blkcipher(_priv->tx_tfm_arc4);
+		if (_priv->rx_tfm_michael)
+			crypto_free_hash(_priv->rx_tfm_michael);
+		if (_priv->rx_tfm_arc4)
+			crypto_free_blkcipher(_priv->rx_tfm_arc4);
+	}
+	kfree(priv);
+}
+
+
+static inline u16 RotR1(u16 val)
+{
+	return (val >> 1) | (val << 15);
+}
+
+
+static inline u8 Lo8(u16 val)
+{
+	return val & 0xff;
+}
+
+
+static inline u8 Hi8(u16 val)
+{
+	return val >> 8;
+}
+
+
+static inline u16 Lo16(u32 val)
+{
+	return val & 0xffff;
+}
+
+
+static inline u16 Hi16(u32 val)
+{
+	return val >> 16;
+}
+
+
+static inline u16 Mk16(u8 hi, u8 lo)
+{
+	return lo | (((u16) hi) << 8);
+}
+
+
+static inline u16 Mk16_le(u16 *v)
+{
+	return le16_to_cpu(*v);
+}
+
+
+static const u16 Sbox[256] =
+{
+	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
+	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
+	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
+	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
+	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
+	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
+	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
+	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
+	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
+	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
+	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
+	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
+	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
+	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
+	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
+	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
+	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
+	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
+	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
+	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
+	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
+	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
+	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
+	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
+	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
+	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
+	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
+	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
+	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
+	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
+	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
+	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
+};
+
+
+static inline u16 _S_(u16 v)
+{
+	u16 t = Sbox[Hi8(v)];
+	return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
+}
+
+#define PHASE1_LOOP_COUNT 8
+
+static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
+{
+	int i, j;
+
+	/* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
+	TTAK[0] = Lo16(IV32);
+	TTAK[1] = Hi16(IV32);
+	TTAK[2] = Mk16(TA[1], TA[0]);
+	TTAK[3] = Mk16(TA[3], TA[2]);
+	TTAK[4] = Mk16(TA[5], TA[4]);
+
+	for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
+		j = 2 * (i & 1);
+		TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
+		TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
+		TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
+		TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
+		TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
+	}
+}
+
+
+static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
+			       u16 IV16)
+{
+	/* Make temporary area overlap WEP seed so that the final copy can be
+	 * avoided on little endian hosts. */
+	u16 *PPK = (u16 *) &WEPSeed[4];
+
+	/* Step 1 - make copy of TTAK and bring in TSC */
+	PPK[0] = TTAK[0];
+	PPK[1] = TTAK[1];
+	PPK[2] = TTAK[2];
+	PPK[3] = TTAK[3];
+	PPK[4] = TTAK[4];
+	PPK[5] = TTAK[4] + IV16;
+
+	/* Step 2 - 96-bit bijective mixing using S-box */
+	PPK[0] += _S_(PPK[5] ^ Mk16_le((u16 *) &TK[0]));
+	PPK[1] += _S_(PPK[0] ^ Mk16_le((u16 *) &TK[2]));
+	PPK[2] += _S_(PPK[1] ^ Mk16_le((u16 *) &TK[4]));
+	PPK[3] += _S_(PPK[2] ^ Mk16_le((u16 *) &TK[6]));
+	PPK[4] += _S_(PPK[3] ^ Mk16_le((u16 *) &TK[8]));
+	PPK[5] += _S_(PPK[4] ^ Mk16_le((u16 *) &TK[10]));
+
+	PPK[0] += RotR1(PPK[5] ^ Mk16_le((u16 *) &TK[12]));
+	PPK[1] += RotR1(PPK[0] ^ Mk16_le((u16 *) &TK[14]));
+	PPK[2] += RotR1(PPK[1]);
+	PPK[3] += RotR1(PPK[2]);
+	PPK[4] += RotR1(PPK[3]);
+	PPK[5] += RotR1(PPK[4]);
+
+	/* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
+	 * WEPSeed[0..2] is transmitted as WEP IV */
+	WEPSeed[0] = Hi8(IV16);
+	WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
+	WEPSeed[2] = Lo8(IV16);
+	WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((u16 *) &TK[0])) >> 1);
+
+#ifdef __BIG_ENDIAN
+	{
+		int i;
+		for (i = 0; i < 6; i++)
+			PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
+	}
+#endif
+}
+
+static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+        struct ieee80211_tkip_data *tkey = priv;
+        struct blkcipher_desc desc = {.tfm = tkey->tx_tfm_arc4};
+	int len;
+	u8  *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	u8 rc4key[16],*icv;
+	u32 crc;
+	struct scatterlist sg;
+	int ret;
+
+	ret = 0;
+	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||
+	    skb->len < hdr_len)
+		return -1;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+
+	if (!tkey->tx_phase1_done) {
+		tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
+				   tkey->tx_iv32);
+		tkey->tx_phase1_done = 1;
+	}
+	tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
+
+	len = skb->len - hdr_len;
+	pos = skb_push(skb, 8);
+	memmove(pos, pos + 8, hdr_len);
+	pos += hdr_len;
+
+	*pos++ = rc4key[0];
+	*pos++ = rc4key[1];
+	*pos++ = rc4key[2];
+	*pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */;
+	*pos++ = tkey->tx_iv32 & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 8) & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 16) & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 24) & 0xff;
+
+	icv = skb_put(skb, 4);
+	crc = ~crc32_le(~0, pos, len);
+	icv[0] = crc;
+	icv[1] = crc >> 8;
+	icv[2] = crc >> 16;
+	icv[3] = crc >> 24;
+	crypto_blkcipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
+	sg_init_one(&sg, pos, len + 4);
+	ret= crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
+
+	tkey->tx_iv16++;
+	if (tkey->tx_iv16 == 0) {
+		tkey->tx_phase1_done = 0;
+		tkey->tx_iv32++;
+	}
+	   return ret;
+}
+
+static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	struct blkcipher_desc desc = { .tfm = tkey->rx_tfm_arc4 };
+	u8 keyidx, *pos;
+	u32 iv32;
+	u16 iv16;
+	struct ieee80211_hdr_4addr *hdr;
+	u8 icv[4];
+	u32 crc;
+	struct scatterlist sg;
+	u8 rc4key[16];
+	int plen;
+
+	if (skb->len < hdr_len + 8 + 4)
+		return -1;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	pos = skb->data + hdr_len;
+	keyidx = pos[3];
+	if (!(keyidx & (1 << 5))) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: received packet without ExtIV"
+			       " flag from %pM\n", hdr->addr2);
+		}
+		return -2;
+	}
+	keyidx >>= 6;
+	if (tkey->key_idx != keyidx) {
+		printk(KERN_DEBUG "TKIP: RX tkey->key_idx=%d frame "
+		       "keyidx=%d priv=%p\n", tkey->key_idx, keyidx, priv);
+		return -6;
+	}
+	if (!tkey->key_set) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: received packet from %pM"
+			       " with keyid=%d that does not have a configured"
+			       " key\n", hdr->addr2, keyidx);
+		}
+		return -3;
+	}
+	iv16 = (pos[0] << 8) | pos[2];
+	iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
+	pos += 8;
+
+	if (iv32 < tkey->rx_iv32 ||
+	    (iv32 == tkey->rx_iv32 && iv16 <= tkey->rx_iv16)) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: replay detected: STA=%pM"
+			       " previous TSC %08x%04x received TSC "
+			       "%08x%04x\n", hdr->addr2,
+			       tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
+		}
+		tkey->dot11RSNAStatsTKIPReplays++;
+		return -4;
+	}
+
+	if (iv32 != tkey->rx_iv32 || !tkey->rx_phase1_done) {
+		tkip_mixing_phase1(tkey->rx_ttak, tkey->key, hdr->addr2, iv32);
+		tkey->rx_phase1_done = 1;
+	}
+	tkip_mixing_phase2(rc4key, tkey->key, tkey->rx_ttak, iv16);
+
+	plen = skb->len - hdr_len - 12;
+	crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
+	sg_init_one(&sg, pos, plen + 4);
+	if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG ": TKIP: failed to decrypt "
+			       "received packet from %pM\n",
+			       hdr->addr2);
+		}
+		return -7;
+	}
+
+	crc = ~crc32_le(~0, pos, plen);
+	icv[0] = crc;
+	icv[1] = crc >> 8;
+	icv[2] = crc >> 16;
+	icv[3] = crc >> 24;
+	if (memcmp(icv, pos + plen, 4) != 0) {
+		if (iv32 != tkey->rx_iv32) {
+			/* Previously cached Phase1 result was already lost, so
+			 * it needs to be recalculated for the next packet. */
+			tkey->rx_phase1_done = 0;
+		}
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: ICV error detected: STA="
+			       "%pM\n", hdr->addr2);
+		}
+		tkey->dot11RSNAStatsTKIPICVErrors++;
+		return -5;
+	}
+
+	/* Update real counters only after Michael MIC verification has
+	 * completed */
+	tkey->rx_iv32_new = iv32;
+	tkey->rx_iv16_new = iv16;
+
+	/* Remove IV and ICV */
+	memmove(skb->data + 8, skb->data, hdr_len);
+	skb_pull(skb, 8);
+	skb_trim(skb, skb->len - 4);
+
+	return keyidx;
+}
+
+static int michael_mic(struct crypto_hash *tfm_michael, u8 * key, u8 * hdr,
+                       u8 * data, size_t data_len, u8 * mic)
+{
+        struct hash_desc desc;
+        struct scatterlist sg[2];
+
+        if (tfm_michael == NULL) {
+                printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
+                return -1;
+        }
+
+	sg_init_table(sg, 2);
+	sg_set_buf(&sg[0], hdr, 16);
+	sg_set_buf(&sg[1], data, data_len);
+
+        if (crypto_hash_setkey(tfm_michael, key, 8))
+                return -1;
+
+        desc.tfm = tfm_michael;
+        desc.flags = 0;
+        return crypto_hash_digest(&desc, sg, data_len + 16, mic);
+}
+
+static void michael_mic_hdr(struct sk_buff *skb, u8 *hdr)
+{
+	struct ieee80211_hdr_4addr *hdr11;
+
+	hdr11 = (struct ieee80211_hdr_4addr *)skb->data;
+	switch (le16_to_cpu(hdr11->frame_ctl) &
+		(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
+	case IEEE80211_FCTL_TODS:
+		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
+		break;
+	case IEEE80211_FCTL_FROMDS:
+		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr3, ETH_ALEN); /* SA */
+		break;
+	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
+		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr4, ETH_ALEN); /* SA */
+		break;
+	case 0:
+		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
+		break;
+	}
+
+	hdr[12] = 0; /* priority */
+
+	hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
+}
+
+
+static int ieee80211_michael_mic_add(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	u8 *pos;
+	struct ieee80211_hdr_4addr *hdr;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+
+	if (skb_tailroom(skb) < 8 || skb->len < hdr_len) {
+		printk(KERN_DEBUG "Invalid packet for Michael MIC add "
+		       "(tailroom=%d hdr_len=%d skb->len=%d)\n",
+		       skb_tailroom(skb), hdr_len, skb->len);
+		return -1;
+	}
+
+	michael_mic_hdr(skb, tkey->tx_hdr);
+
+	// { david, 2006.9.1
+	// fix the wpa process with wmm enabled.
+	if(IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl))) {
+		tkey->tx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
+	}
+	// }
+	pos = skb_put(skb, 8);
+
+	if (michael_mic(tkey->tx_tfm_michael, &tkey->key[16], tkey->tx_hdr,
+			skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
+		return -1;
+
+	return 0;
+}
+
+static void ieee80211_michael_mic_failure(struct net_device *dev,
+				       struct ieee80211_hdr_4addr *hdr,
+				       int keyidx)
+{
+	union iwreq_data wrqu;
+	struct iw_michaelmicfailure ev;
+
+	/* TODO: needed parameters: count, keyid, key type, TSC */
+	memset(&ev, 0, sizeof(ev));
+	ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
+	if (hdr->addr1[0] & 0x01)
+		ev.flags |= IW_MICFAILURE_GROUP;
+	else
+		ev.flags |= IW_MICFAILURE_PAIRWISE;
+	ev.src_addr.sa_family = ARPHRD_ETHER;
+	memcpy(ev.src_addr.sa_data, hdr->addr2, ETH_ALEN);
+	memset(&wrqu, 0, sizeof(wrqu));
+	wrqu.data.length = sizeof(ev);
+	wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, (char *) &ev);
+}
+
+static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
+				     int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	u8 mic[8];
+	struct ieee80211_hdr_4addr *hdr;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+
+	if (!tkey->key_set)
+		return -1;
+
+	michael_mic_hdr(skb, tkey->rx_hdr);
+	// { david, 2006.9.1
+	// fix the wpa process with wmm enabled.
+	if(IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl))) {
+		tkey->rx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
+	}
+	// }
+
+	if (michael_mic(tkey->rx_tfm_michael, &tkey->key[24], tkey->rx_hdr,
+			skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
+		return -1;
+
+	if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
+		struct ieee80211_hdr_4addr *hdr;
+		hdr = (struct ieee80211_hdr_4addr *)skb->data;
+		printk(KERN_DEBUG "%s: Michael MIC verification failed for "
+		       "MSDU from %pM keyidx=%d\n",
+		       skb->dev ? skb->dev->name : "N/A", hdr->addr2,
+		       keyidx);
+		if (skb->dev)
+			ieee80211_michael_mic_failure(skb->dev, hdr, keyidx);
+		tkey->dot11RSNAStatsTKIPLocalMICFailures++;
+		return -1;
+	}
+
+	/* Update TSC counters for RX now that the packet verification has
+	 * completed. */
+	tkey->rx_iv32 = tkey->rx_iv32_new;
+	tkey->rx_iv16 = tkey->rx_iv16_new;
+
+	skb_trim(skb, skb->len - 8);
+
+	return 0;
+}
+
+
+static int ieee80211_tkip_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	int keyidx;
+	struct crypto_hash *tfm = tkey->tx_tfm_michael;
+	struct crypto_blkcipher *tfm2 = tkey->tx_tfm_arc4;
+	struct crypto_hash *tfm3 = tkey->rx_tfm_michael;
+	struct crypto_blkcipher *tfm4 = tkey->rx_tfm_arc4;
+
+	keyidx = tkey->key_idx;
+	memset(tkey, 0, sizeof(*tkey));
+	tkey->key_idx = keyidx;
+
+	tkey->tx_tfm_michael = tfm;
+	tkey->tx_tfm_arc4 = tfm2;
+	tkey->rx_tfm_michael = tfm3;
+	tkey->rx_tfm_arc4 = tfm4;
+
+	if (len == TKIP_KEY_LEN) {
+		memcpy(tkey->key, key, TKIP_KEY_LEN);
+		tkey->key_set = 1;
+		tkey->tx_iv16 = 1; /* TSC is initialized to 1 */
+		if (seq) {
+			tkey->rx_iv32 = (seq[5] << 24) | (seq[4] << 16) |
+				(seq[3] << 8) | seq[2];
+			tkey->rx_iv16 = (seq[1] << 8) | seq[0];
+		}
+	} else if (len == 0)
+		tkey->key_set = 0;
+	else
+		return -1;
+
+	return 0;
+}
+
+
+static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+
+	if (len < TKIP_KEY_LEN)
+		return -1;
+
+	if (!tkey->key_set)
+		return 0;
+	memcpy(key, tkey->key, TKIP_KEY_LEN);
+
+	if (seq) {
+		/* Return the sequence number of the last transmitted frame. */
+		u16 iv16 = tkey->tx_iv16;
+		u32 iv32 = tkey->tx_iv32;
+		if (iv16 == 0)
+			iv32--;
+		iv16--;
+		seq[0] = tkey->tx_iv16;
+		seq[1] = tkey->tx_iv16 >> 8;
+		seq[2] = tkey->tx_iv32;
+		seq[3] = tkey->tx_iv32 >> 8;
+		seq[4] = tkey->tx_iv32 >> 16;
+		seq[5] = tkey->tx_iv32 >> 24;
+	}
+
+	return TKIP_KEY_LEN;
+}
+
+
+static char * ieee80211_tkip_print_stats(char *p, void *priv)
+{
+	struct ieee80211_tkip_data *tkip = priv;
+	p += sprintf(p, "key[%d] alg=TKIP key_set=%d "
+		     "tx_pn=%02x%02x%02x%02x%02x%02x "
+		     "rx_pn=%02x%02x%02x%02x%02x%02x "
+		     "replays=%d icv_errors=%d local_mic_failures=%d\n",
+		     tkip->key_idx, tkip->key_set,
+		     (tkip->tx_iv32 >> 24) & 0xff,
+		     (tkip->tx_iv32 >> 16) & 0xff,
+		     (tkip->tx_iv32 >> 8) & 0xff,
+		     tkip->tx_iv32 & 0xff,
+		     (tkip->tx_iv16 >> 8) & 0xff,
+		     tkip->tx_iv16 & 0xff,
+		     (tkip->rx_iv32 >> 24) & 0xff,
+		     (tkip->rx_iv32 >> 16) & 0xff,
+		     (tkip->rx_iv32 >> 8) & 0xff,
+		     tkip->rx_iv32 & 0xff,
+		     (tkip->rx_iv16 >> 8) & 0xff,
+		     tkip->rx_iv16 & 0xff,
+		     tkip->dot11RSNAStatsTKIPReplays,
+		     tkip->dot11RSNAStatsTKIPICVErrors,
+		     tkip->dot11RSNAStatsTKIPLocalMICFailures);
+	return p;
+}
+
+
+static struct ieee80211_crypto_ops ieee80211_crypt_tkip = {
+	.name			= "TKIP",
+	.init			= ieee80211_tkip_init,
+	.deinit			= ieee80211_tkip_deinit,
+	.encrypt_mpdu		= ieee80211_tkip_encrypt,
+	.decrypt_mpdu		= ieee80211_tkip_decrypt,
+	.encrypt_msdu		= ieee80211_michael_mic_add,
+	.decrypt_msdu		= ieee80211_michael_mic_verify,
+	.set_key		= ieee80211_tkip_set_key,
+	.get_key		= ieee80211_tkip_get_key,
+	.print_stats		= ieee80211_tkip_print_stats,
+	.extra_prefix_len	= 4 + 4, /* IV + ExtIV */
+	.extra_postfix_len	= 8 + 4, /* MIC + ICV */
+	.owner		        = THIS_MODULE,
+};
+
+
+int ieee80211_crypto_tkip_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_tkip);
+}
+
+
+void ieee80211_crypto_tkip_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_tkip);
+}
+
+
+void ieee80211_tkip_null(void)
+{
+//    printk("============>%s()\n", __func__);
+        return;
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c
new file mode 100644
index 00000000..58f3eeb2
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c
@@ -0,0 +1,293 @@
+/*
+ * Host AP crypt: host-based WEP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2002-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <asm/string.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <linux/crc32.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: WEP");
+MODULE_LICENSE("GPL");
+
+
+
+struct prism2_wep_data {
+	u32 iv;
+#define WEP_KEY_LEN 13
+	u8 key[WEP_KEY_LEN + 1];
+	u8 key_len;
+	u8 key_idx;
+	struct crypto_blkcipher *tx_tfm;
+	struct crypto_blkcipher *rx_tfm;
+};
+
+
+static void * prism2_wep_init(int keyidx)
+{
+	struct prism2_wep_data *priv;
+
+	priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	priv->key_idx = keyidx;
+	priv->tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
+		       "crypto API arc4\n");
+		priv->tx_tfm = NULL;
+		goto fail;
+	}
+	priv->rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
+		       "crypto API arc4\n");
+		priv->rx_tfm = NULL;
+		goto fail;
+	}
+
+	/* start WEP IV from a random value */
+	get_random_bytes(&priv->iv, 4);
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tx_tfm)
+			crypto_free_blkcipher(priv->tx_tfm);
+		if (priv->rx_tfm)
+			crypto_free_blkcipher(priv->rx_tfm);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void prism2_wep_deinit(void *priv)
+{
+	struct prism2_wep_data *_priv = priv;
+
+	if (_priv) {
+		if (_priv->tx_tfm)
+			crypto_free_blkcipher(_priv->tx_tfm);
+		if (_priv->rx_tfm)
+			crypto_free_blkcipher(_priv->rx_tfm);
+	}
+
+	kfree(priv);
+}
+
+
+/* Perform WEP encryption on given skb that has at least 4 bytes of headroom
+ * for IV and 4 bytes of tailroom for ICV. Both IV and ICV will be transmitted,
+ * so the payload length increases with 8 bytes.
+ *
+ * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
+ */
+static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	struct blkcipher_desc desc = { .tfm = wep->tx_tfm };
+	u32 klen, len;
+	u8 key[WEP_KEY_LEN + 3];
+	u8 *pos;
+	u32 crc;
+	u8 *icv;
+	struct scatterlist sg;
+
+	if (skb_headroom(skb) < 4 || skb_tailroom(skb) < 4 ||
+	    skb->len < hdr_len)
+		return -1;
+
+	len = skb->len - hdr_len;
+	pos = skb_push(skb, 4);
+	memmove(pos, pos + 4, hdr_len);
+	pos += hdr_len;
+
+	klen = 3 + wep->key_len;
+
+	wep->iv++;
+
+	/* Fluhrer, Mantin, and Shamir have reported weaknesses in the key
+	 * scheduling algorithm of RC4. At least IVs (KeyByte + 3, 0xff, N)
+	 * can be used to speedup attacks, so avoid using them. */
+	if ((wep->iv & 0xff00) == 0xff00) {
+		u8 B = (wep->iv >> 16) & 0xff;
+		if (B >= 3 && B < klen)
+			wep->iv += 0x0100;
+	}
+
+	/* Prepend 24-bit IV to RC4 key and TX frame */
+	*pos++ = key[0] = (wep->iv >> 16) & 0xff;
+	*pos++ = key[1] = (wep->iv >> 8) & 0xff;
+	*pos++ = key[2] = wep->iv & 0xff;
+	*pos++ = wep->key_idx << 6;
+
+	/* Copy rest of the WEP key (the secret part) */
+	memcpy(key + 3, wep->key, wep->key_len);
+
+	/* Append little-endian CRC32 and encrypt it to produce ICV */
+	crc = ~crc32_le(~0, pos, len);
+	icv = skb_put(skb, 4);
+	icv[0] = crc;
+	icv[1] = crc >> 8;
+	icv[2] = crc >> 16;
+	icv[3] = crc >> 24;
+
+	crypto_blkcipher_setkey(wep->tx_tfm, key, klen);
+	sg_init_one(&sg, pos, len + 4);
+
+	return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
+}
+
+
+/* Perform WEP decryption on given buffer. Buffer includes whole WEP part of
+ * the frame: IV (4 bytes), encrypted payload (including SNAP header),
+ * ICV (4 bytes). len includes both IV and ICV.
+ *
+ * Returns 0 if frame was decrypted successfully and ICV was correct and -1 on
+ * failure. If frame is OK, IV and ICV will be removed.
+ */
+static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	struct blkcipher_desc desc = { .tfm = wep->rx_tfm };
+	u32 klen, plen;
+	u8 key[WEP_KEY_LEN + 3];
+	u8 keyidx, *pos;
+	u32 crc;
+	u8 icv[4];
+	struct scatterlist sg;
+
+	if (skb->len < hdr_len + 8)
+		return -1;
+
+	pos = skb->data + hdr_len;
+	key[0] = *pos++;
+	key[1] = *pos++;
+	key[2] = *pos++;
+	keyidx = *pos++ >> 6;
+	if (keyidx != wep->key_idx)
+		return -1;
+
+	klen = 3 + wep->key_len;
+
+	/* Copy rest of the WEP key (the secret part) */
+	memcpy(key + 3, wep->key, wep->key_len);
+
+	/* Apply RC4 to data and compute CRC32 over decrypted data */
+	plen = skb->len - hdr_len - 8;
+
+	crypto_blkcipher_setkey(wep->rx_tfm, key, klen);
+	sg_init_one(&sg, pos, plen + 4);
+
+	if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4))
+		return -7;
+
+	crc = ~crc32_le(~0, pos, plen);
+	icv[0] = crc;
+	icv[1] = crc >> 8;
+	icv[2] = crc >> 16;
+	icv[3] = crc >> 24;
+
+	if (memcmp(icv, pos + plen, 4) != 0) {
+		/* ICV mismatch - drop frame */
+		return -2;
+	}
+
+	/* Remove IV and ICV */
+	memmove(skb->data + 4, skb->data, hdr_len);
+	skb_pull(skb, 4);
+	skb_trim(skb, skb->len - 4);
+        return 0;
+}
+
+
+static int prism2_wep_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+
+	if (len < 0 || len > WEP_KEY_LEN)
+		return -1;
+
+	memcpy(wep->key, key, len);
+	wep->key_len = len;
+
+	return 0;
+}
+
+
+static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+
+	if (len < wep->key_len)
+		return -1;
+
+	memcpy(key, wep->key, wep->key_len);
+
+	return wep->key_len;
+}
+
+
+static char * prism2_wep_print_stats(char *p, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	p += sprintf(p, "key[%d] alg=WEP len=%d\n",
+		     wep->key_idx, wep->key_len);
+	return p;
+}
+
+
+static struct ieee80211_crypto_ops ieee80211_crypt_wep = {
+	.name			= "WEP",
+	.init			= prism2_wep_init,
+	.deinit			= prism2_wep_deinit,
+	.encrypt_mpdu		= prism2_wep_encrypt,
+	.decrypt_mpdu		= prism2_wep_decrypt,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= prism2_wep_set_key,
+	.get_key		= prism2_wep_get_key,
+	.print_stats		= prism2_wep_print_stats,
+	.extra_prefix_len	= 4, /* IV */
+	.extra_postfix_len	= 4, /* ICV */
+	.owner			= THIS_MODULE,
+};
+
+
+int ieee80211_crypto_wep_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_wep);
+}
+
+
+void ieee80211_crypto_wep_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_wep);
+}
+
+
+void ieee80211_wep_null(void)
+{
+//	printk("============>%s()\n", __func__);
+        return;
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c
new file mode 100644
index 00000000..9422573b
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c
@@ -0,0 +1,206 @@
+/*******************************************************************************
+
+  Copyright(c) 2004 Intel Corporation. All rights reserved.
+
+  Portions of this file are based on the WEP enablement code provided by the
+  Host AP project hostap-drivers v0.1.3
+  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+  <jkmaline@cc.hut.fi>
+  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+*******************************************************************************/
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <net/arp.h>
+#include <net/net_namespace.h>
+
+#include "ieee80211.h"
+
+MODULE_DESCRIPTION("802.11 data/management/control stack");
+MODULE_AUTHOR("Copyright (C) 2004 Intel Corporation <jketreno@linux.intel.com>");
+MODULE_LICENSE("GPL");
+
+#define DRV_NAME "ieee80211"
+
+static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
+{
+	if (ieee->networks)
+		return 0;
+
+	ieee->networks = kcalloc(
+		MAX_NETWORK_COUNT, sizeof(struct ieee80211_network),
+		GFP_KERNEL);
+	if (!ieee->networks) {
+		printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
+		       ieee->dev->name);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
+{
+	if (!ieee->networks)
+		return;
+	kfree(ieee->networks);
+	ieee->networks = NULL;
+}
+
+static inline void ieee80211_networks_initialize(struct ieee80211_device *ieee)
+{
+	int i;
+
+	INIT_LIST_HEAD(&ieee->network_free_list);
+	INIT_LIST_HEAD(&ieee->network_list);
+	for (i = 0; i < MAX_NETWORK_COUNT; i++)
+		list_add_tail(&ieee->networks[i].list, &ieee->network_free_list);
+}
+
+
+struct net_device *alloc_ieee80211(int sizeof_priv)
+{
+	struct ieee80211_device *ieee;
+	struct net_device *dev;
+	int i,err;
+
+	IEEE80211_DEBUG_INFO("Initializing...\n");
+
+	dev = alloc_etherdev(sizeof(struct ieee80211_device) + sizeof_priv);
+	if (!dev) {
+		IEEE80211_ERROR("Unable to network device.\n");
+		goto failed;
+	}
+	ieee = netdev_priv(dev);
+
+	ieee->dev = dev;
+
+	err = ieee80211_networks_allocate(ieee);
+	if (err) {
+		IEEE80211_ERROR("Unable to allocate beacon storage: %d\n",
+				err);
+		goto failed;
+	}
+	ieee80211_networks_initialize(ieee);
+
+	/* Default fragmentation threshold is maximum payload size */
+	ieee->fts = DEFAULT_FTS;
+	ieee->scan_age = DEFAULT_MAX_SCAN_AGE;
+	ieee->open_wep = 1;
+
+	/* Default to enabling full open WEP with host based encrypt/decrypt */
+	ieee->host_encrypt = 1;
+	ieee->host_decrypt = 1;
+	ieee->ieee802_1x = 1; /* Default to supporting 802.1x */
+
+	INIT_LIST_HEAD(&ieee->crypt_deinit_list);
+	init_timer(&ieee->crypt_deinit_timer);
+	ieee->crypt_deinit_timer.data = (unsigned long)ieee;
+	ieee->crypt_deinit_timer.function = ieee80211_crypt_deinit_handler;
+
+	spin_lock_init(&ieee->lock);
+	spin_lock_init(&ieee->wpax_suitlist_lock);
+
+	ieee->wpax_type_set = 0;
+ 	ieee->wpa_enabled = 0;
+ 	ieee->tkip_countermeasures = 0;
+ 	ieee->drop_unencrypted = 0;
+ 	ieee->privacy_invoked = 0;
+ 	ieee->ieee802_1x = 1;
+	ieee->raw_tx = 0;
+
+	ieee80211_softmac_init(ieee);
+
+	for (i = 0; i < IEEE_IBSS_MAC_HASH_SIZE; i++)
+		INIT_LIST_HEAD(&ieee->ibss_mac_hash[i]);
+
+	for (i = 0; i < 17; i++) {
+	  ieee->last_rxseq_num[i] = -1;
+	  ieee->last_rxfrag_num[i] = -1;
+	  ieee->last_packet_time[i] = 0;
+	}
+//These function were added to load crypte module autoly
+	ieee80211_tkip_null();
+	ieee80211_wep_null();
+	ieee80211_ccmp_null();
+	return dev;
+
+ failed:
+	if (dev)
+		free_netdev(dev);
+	return NULL;
+}
+
+
+void free_ieee80211(struct net_device *dev)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+
+	int i;
+	struct list_head *p, *q;
+
+
+	ieee80211_softmac_free(ieee);
+	del_timer_sync(&ieee->crypt_deinit_timer);
+	ieee80211_crypt_deinit_entries(ieee, 1);
+
+	for (i = 0; i < WEP_KEYS; i++) {
+		struct ieee80211_crypt_data *crypt = ieee->crypt[i];
+		if (crypt) {
+			if (crypt->ops)
+				crypt->ops->deinit(crypt->priv);
+			kfree(crypt);
+			ieee->crypt[i] = NULL;
+		}
+	}
+
+	ieee80211_networks_free(ieee);
+
+	for (i = 0; i < IEEE_IBSS_MAC_HASH_SIZE; i++) {
+		list_for_each_safe(p, q, &ieee->ibss_mac_hash[i]) {
+			kfree(list_entry(p, struct ieee_ibss_seq, list));
+			list_del(p);
+		}
+	}
+
+
+	free_netdev(dev);
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
new file mode 100644
index 00000000..3a724496
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
@@ -0,0 +1,1544 @@
+/*
+ * Original code based Host AP (software wireless LAN access point) driver
+ * for Intersil Prism2/2.5/3 - hostap.o module, common routines
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ ******************************************************************************
+
+  Few modifications for Realtek's Wi-Fi drivers by
+  Andrea Merello <andreamrl@tiscali.it>
+
+  A special thanks goes to Realtek for their support !
+
+******************************************************************************/
+
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <linux/ctype.h>
+
+#include "ieee80211.h"
+#include "dot11d.h"
+static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
+					struct sk_buff *skb,
+					struct ieee80211_rx_stats *rx_stats)
+{
+	struct ieee80211_hdr_4addr *hdr =
+		(struct ieee80211_hdr_4addr *)skb->data;
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+
+	skb->dev = ieee->dev;
+	skb_reset_mac_header(skb);
+	skb_pull(skb, ieee80211_get_hdrlen(fc));
+	skb->pkt_type = PACKET_OTHERHOST;
+	skb->protocol = __constant_htons(ETH_P_80211_RAW);
+	memset(skb->cb, 0, sizeof(skb->cb));
+	netif_rx(skb);
+}
+
+
+/* Called only as a tasklet (software IRQ) */
+static struct ieee80211_frag_entry *
+ieee80211_frag_cache_find(struct ieee80211_device *ieee, unsigned int seq,
+			  unsigned int frag, u8 tid,u8 *src, u8 *dst)
+{
+	struct ieee80211_frag_entry *entry;
+	int i;
+
+	for (i = 0; i < IEEE80211_FRAG_CACHE_LEN; i++) {
+		entry = &ieee->frag_cache[tid][i];
+		if (entry->skb != NULL &&
+		    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
+			IEEE80211_DEBUG_FRAG(
+				"expiring fragment cache entry "
+				"seq=%u last_frag=%u\n",
+				entry->seq, entry->last_frag);
+			dev_kfree_skb_any(entry->skb);
+			entry->skb = NULL;
+		}
+
+		if (entry->skb != NULL && entry->seq == seq &&
+		    (entry->last_frag + 1 == frag || frag == -1) &&
+		    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
+		    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
+			return entry;
+	}
+
+	return NULL;
+}
+
+/* Called only as a tasklet (software IRQ) */
+static struct sk_buff *
+ieee80211_frag_cache_get(struct ieee80211_device *ieee,
+			 struct ieee80211_hdr_4addr *hdr)
+{
+	struct sk_buff *skb = NULL;
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+	u16 sc = le16_to_cpu(hdr->seq_ctl);
+	unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
+	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
+	struct ieee80211_frag_entry *entry;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+	if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if (IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else {
+	  tid = 0;
+	}
+
+	if (frag == 0) {
+		/* Reserve enough space to fit maximum frame length */
+		skb = dev_alloc_skb(ieee->dev->mtu +
+				    sizeof(struct ieee80211_hdr_4addr) +
+				    8 /* LLC */ +
+				    2 /* alignment */ +
+				    8 /* WEP */ +
+				    ETH_ALEN /* WDS */ +
+				    (IEEE80211_QOS_HAS_SEQ(fc)?2:0) /* QOS Control */);
+		if (skb == NULL)
+			return NULL;
+
+		entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
+		ieee->frag_next_idx[tid]++;
+		if (ieee->frag_next_idx[tid] >= IEEE80211_FRAG_CACHE_LEN)
+			ieee->frag_next_idx[tid] = 0;
+
+		if (entry->skb != NULL)
+			dev_kfree_skb_any(entry->skb);
+
+		entry->first_frag_time = jiffies;
+		entry->seq = seq;
+		entry->last_frag = frag;
+		entry->skb = skb;
+		memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
+		memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
+	} else {
+		/* received a fragment of a frame for which the head fragment
+		 * should have already been received */
+		entry = ieee80211_frag_cache_find(ieee, seq, frag, tid,hdr->addr2,
+						  hdr->addr1);
+		if (entry != NULL) {
+			entry->last_frag = frag;
+			skb = entry->skb;
+		}
+	}
+
+	return skb;
+}
+
+
+/* Called only as a tasklet (software IRQ) */
+static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
+					   struct ieee80211_hdr_4addr *hdr)
+{
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+	u16 sc = le16_to_cpu(hdr->seq_ctl);
+	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
+	struct ieee80211_frag_entry *entry;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+	if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if (IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else {
+	  tid = 0;
+	}
+
+	entry = ieee80211_frag_cache_find(ieee, seq, -1, tid,hdr->addr2,
+					  hdr->addr1);
+
+	if (entry == NULL) {
+		IEEE80211_DEBUG_FRAG(
+			"could not invalidate fragment cache "
+			"entry (seq=%u)\n", seq);
+		return -1;
+	}
+
+	entry->skb = NULL;
+	return 0;
+}
+
+
+
+/* ieee80211_rx_frame_mgtmt
+ *
+ * Responsible for handling management control frames
+ *
+ * Called by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype)
+{
+	struct ieee80211_hdr_4addr *hdr;
+
+	// cheat the the hdr type
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+
+	/* On the struct stats definition there is written that
+	 * this is not mandatory.... but seems that the probe
+	 * response parser uses it
+	 */
+	rx_stats->len = skb->len;
+	ieee80211_rx_mgt(ieee, (struct ieee80211_hdr_4addr *)skb->data,
+			 rx_stats);
+
+	if((ieee->state == IEEE80211_LINKED)&&(memcmp(hdr->addr3,ieee->current_network.bssid,ETH_ALEN))) {
+		dev_kfree_skb_any(skb);
+		return 0;
+	}
+
+	ieee80211_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
+
+	dev_kfree_skb_any(skb);
+
+	return 0;
+
+}
+
+
+
+/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
+/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
+static unsigned char rfc1042_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
+static unsigned char bridge_tunnel_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+/* No encapsulation header if EtherType < 0x600 (=length) */
+
+/* Called by ieee80211_rx_frame_decrypt */
+static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
+				    struct sk_buff *skb, size_t hdrlen)
+{
+	struct net_device *dev = ieee->dev;
+	u16 fc, ethertype;
+	struct ieee80211_hdr_4addr *hdr;
+	u8 *pos;
+
+	if (skb->len < 24)
+		return 0;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	fc = le16_to_cpu(hdr->frame_ctl);
+
+	/* check that the frame is unicast frame to us */
+	if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+	    IEEE80211_FCTL_TODS &&
+	    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
+	    memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
+		/* ToDS frame with own addr BSSID and DA */
+	} else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+		   IEEE80211_FCTL_FROMDS &&
+		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
+		/* FromDS frame with own addr as DA */
+	} else
+		return 0;
+
+	if (skb->len < 24 + 8)
+		return 0;
+
+	/* check for port access entity Ethernet type */
+//	pos = skb->data + 24;
+	pos = skb->data + hdrlen;
+	ethertype = (pos[6] << 8) | pos[7];
+	if (ethertype == ETH_P_PAE)
+		return 1;
+
+	return 0;
+}
+
+/* Called only as a tasklet (software IRQ), by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_decrypt(struct ieee80211_device* ieee, struct sk_buff *skb,
+			   struct ieee80211_crypt_data *crypt)
+{
+	struct ieee80211_hdr_4addr *hdr;
+	int res, hdrlen;
+
+	if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
+		return 0;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+
+#ifdef CONFIG_IEEE80211_CRYPT_TKIP
+	if (ieee->tkip_countermeasures &&
+	    strcmp(crypt->ops->name, "TKIP") == 0) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
+			       "received packet from %pM\n",
+			       ieee->dev->name, hdr->addr2);
+		}
+		return -1;
+	}
+#endif
+
+	atomic_inc(&crypt->refcnt);
+	res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		IEEE80211_DEBUG_DROP(
+			"decryption failed (SA=%pM"
+			") res=%d\n", hdr->addr2, res);
+		if (res == -2)
+			IEEE80211_DEBUG_DROP("Decryption failed ICV "
+					     "mismatch (key %d)\n",
+					     skb->data[hdrlen + 3] >> 6);
+		ieee->ieee_stats.rx_discards_undecryptable++;
+		return -1;
+	}
+
+	return res;
+}
+
+
+/* Called only as a tasklet (software IRQ), by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device* ieee, struct sk_buff *skb,
+			     int keyidx, struct ieee80211_crypt_data *crypt)
+{
+	struct ieee80211_hdr_4addr *hdr;
+	int res, hdrlen;
+
+	if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
+		return 0;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+
+	atomic_inc(&crypt->refcnt);
+	res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
+		       " (SA=%pM keyidx=%d)\n",
+		       ieee->dev->name, hdr->addr2, keyidx);
+		return -1;
+	}
+
+	return 0;
+}
+
+
+/* this function is stolen from ipw2200 driver*/
+#define IEEE_PACKET_RETRY_TIME (5*HZ)
+static int is_duplicate_packet(struct ieee80211_device *ieee,
+				      struct ieee80211_hdr_4addr *header)
+{
+	u16 fc = le16_to_cpu(header->frame_ctl);
+	u16 sc = le16_to_cpu(header->seq_ctl);
+	u16 seq = WLAN_GET_SEQ_SEQ(sc);
+	u16 frag = WLAN_GET_SEQ_FRAG(sc);
+	u16 *last_seq, *last_frag;
+	unsigned long *last_time;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+	//TO2DS and QoS
+	if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)header;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if(IEEE80211_QOS_HAS_SEQ(fc)) { //QoS
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)header;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else { // no QoS
+	  tid = 0;
+	}
+	switch (ieee->iw_mode) {
+	case IW_MODE_ADHOC:
+	{
+		struct list_head *p;
+		struct ieee_ibss_seq *entry = NULL;
+		u8 *mac = header->addr2;
+		int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
+		//for (pos = (head)->next; pos != (head); pos = pos->next)
+		__list_for_each(p, &ieee->ibss_mac_hash[index]) {
+			entry = list_entry(p, struct ieee_ibss_seq, list);
+			if (!memcmp(entry->mac, mac, ETH_ALEN))
+				break;
+		}
+	//	if (memcmp(entry->mac, mac, ETH_ALEN)){
+		if (p == &ieee->ibss_mac_hash[index]) {
+			entry = kmalloc(sizeof(struct ieee_ibss_seq), GFP_ATOMIC);
+			if (!entry) {
+				printk(KERN_WARNING "Cannot malloc new mac entry\n");
+				return 0;
+			}
+			memcpy(entry->mac, mac, ETH_ALEN);
+			entry->seq_num[tid] = seq;
+			entry->frag_num[tid] = frag;
+			entry->packet_time[tid] = jiffies;
+			list_add(&entry->list, &ieee->ibss_mac_hash[index]);
+			return 0;
+		}
+		last_seq = &entry->seq_num[tid];
+		last_frag = &entry->frag_num[tid];
+		last_time = &entry->packet_time[tid];
+		break;
+	}
+
+	case IW_MODE_INFRA:
+		last_seq = &ieee->last_rxseq_num[tid];
+		last_frag = &ieee->last_rxfrag_num[tid];
+		last_time = &ieee->last_packet_time[tid];
+
+		break;
+	default:
+		return 0;
+	}
+
+//	if(tid != 0) {
+//		printk(KERN_WARNING ":)))))))))))%x %x %x, fc(%x)\n", tid, *last_seq, seq, header->frame_ctl);
+//	}
+	if ((*last_seq == seq) &&
+	    time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
+		if (*last_frag == frag){
+			//printk(KERN_WARNING "[1] go drop!\n");
+			goto drop;
+
+		}
+		if (*last_frag + 1 != frag)
+			/* out-of-order fragment */
+			//printk(KERN_WARNING "[2] go drop!\n");
+			goto drop;
+	} else
+		*last_seq = seq;
+
+	*last_frag = frag;
+	*last_time = jiffies;
+	return 0;
+
+drop:
+//	BUG_ON(!(fc & IEEE80211_FCTL_RETRY));
+//	printk("DUP\n");
+
+	return 1;
+}
+
+
+/* All received frames are sent to this function. @skb contains the frame in
+ * IEEE 802.11 format, i.e., in the format it was sent over air.
+ * This function is called only as a tasklet (software IRQ). */
+int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+		 struct ieee80211_rx_stats *rx_stats)
+{
+	struct net_device *dev = ieee->dev;
+	//struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct ieee80211_hdr_4addr *hdr;
+
+	size_t hdrlen;
+	u16 fc, type, stype, sc;
+	struct net_device_stats *stats;
+	unsigned int frag;
+	u8 *payload;
+	u16 ethertype;
+	u8 dst[ETH_ALEN];
+	u8 src[ETH_ALEN];
+	u8 bssid[ETH_ALEN];
+	struct ieee80211_crypt_data *crypt = NULL;
+	int keyidx = 0;
+
+	// cheat the the hdr type
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	stats = &ieee->stats;
+
+	if (skb->len < 10) {
+		printk(KERN_INFO "%s: SKB length < 10\n",
+		       dev->name);
+		goto rx_dropped;
+	}
+
+	fc = le16_to_cpu(hdr->frame_ctl);
+	type = WLAN_FC_GET_TYPE(fc);
+	stype = WLAN_FC_GET_STYPE(fc);
+	sc = le16_to_cpu(hdr->seq_ctl);
+
+	frag = WLAN_GET_SEQ_FRAG(sc);
+
+//YJ,add,080828,for keep alive
+	if((fc & IEEE80211_FCTL_TODS) != IEEE80211_FCTL_TODS)
+	{
+		if(!memcmp(hdr->addr1,dev->dev_addr, ETH_ALEN))
+		{
+			ieee->NumRxUnicast++;
+		}
+	}
+	else
+	{
+		if(!memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN))
+		{
+			ieee->NumRxUnicast++;
+		}
+	}
+//YJ,add,080828,for keep alive,end
+
+	hdrlen = ieee80211_get_hdrlen(fc);
+
+
+	if (ieee->iw_mode == IW_MODE_MONITOR) {
+		ieee80211_monitor_rx(ieee, skb, rx_stats);
+		stats->rx_packets++;
+		stats->rx_bytes += skb->len;
+		return 1;
+	}
+
+	if (ieee->host_decrypt) {
+		int idx = 0;
+		if (skb->len >= hdrlen + 3)
+			idx = skb->data[hdrlen + 3] >> 6;
+		crypt = ieee->crypt[idx];
+
+		/* allow NULL decrypt to indicate an station specific override
+		 * for default encryption */
+		if (crypt && (crypt->ops == NULL ||
+			      crypt->ops->decrypt_mpdu == NULL))
+			crypt = NULL;
+
+		if (!crypt && (fc & IEEE80211_FCTL_WEP)) {
+			/* This seems to be triggered by some (multicast?)
+			 * frames from other than current BSS, so just drop the
+			 * frames silently instead of filling system log with
+			 * these reports. */
+			IEEE80211_DEBUG_DROP("Decryption failed (not set)"
+					     " (SA=%pM)\n",
+					     hdr->addr2);
+			ieee->ieee_stats.rx_discards_undecryptable++;
+			goto rx_dropped;
+		}
+	}
+
+	if (skb->len < IEEE80211_DATA_HDR3_LEN)
+		goto rx_dropped;
+
+	// if QoS enabled, should check the sequence for each of the AC
+	if (is_duplicate_packet(ieee, hdr))
+		goto rx_dropped;
+
+
+	if (type == IEEE80211_FTYPE_MGMT) {
+		if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
+			goto rx_dropped;
+		else
+			goto rx_exit;
+	}
+
+	/* Data frame - extract src/dst addresses */
+	switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
+	case IEEE80211_FCTL_FROMDS:
+		memcpy(dst, hdr->addr1, ETH_ALEN);
+		memcpy(src, hdr->addr3, ETH_ALEN);
+		memcpy(bssid,hdr->addr2,ETH_ALEN);
+		break;
+	case IEEE80211_FCTL_TODS:
+		memcpy(dst, hdr->addr3, ETH_ALEN);
+		memcpy(src, hdr->addr2, ETH_ALEN);
+		memcpy(bssid,hdr->addr1,ETH_ALEN);
+		break;
+	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
+		if (skb->len < IEEE80211_DATA_HDR4_LEN)
+			goto rx_dropped;
+		memcpy(dst, hdr->addr3, ETH_ALEN);
+		memcpy(src, hdr->addr4, ETH_ALEN);
+		memcpy(bssid, ieee->current_network.bssid, ETH_ALEN);
+		break;
+	case 0:
+		memcpy(dst, hdr->addr1, ETH_ALEN);
+		memcpy(src, hdr->addr2, ETH_ALEN);
+		memcpy(bssid,hdr->addr3,ETH_ALEN);
+		break;
+	}
+
+
+	dev->last_rx = jiffies;
+
+
+	/* Nullfunc frames may have PS-bit set, so they must be passed to
+	 * hostap_handle_sta_rx() before being dropped here. */
+	if (stype != IEEE80211_STYPE_DATA &&
+	    stype != IEEE80211_STYPE_DATA_CFACK &&
+	    stype != IEEE80211_STYPE_DATA_CFPOLL &&
+	    stype != IEEE80211_STYPE_DATA_CFACKPOLL&&
+	    stype != IEEE80211_STYPE_QOS_DATA//add by David,2006.8.4
+	    ) {
+		if (stype != IEEE80211_STYPE_NULLFUNC)
+			IEEE80211_DEBUG_DROP(
+				"RX: dropped data frame "
+				"with no data (type=0x%02x, "
+				"subtype=0x%02x, len=%d)\n",
+				type, stype, skb->len);
+		goto rx_dropped;
+	}
+	if(memcmp(bssid,ieee->current_network.bssid,ETH_ALEN)) {
+		goto rx_dropped;
+	}
+
+	ieee->NumRxDataInPeriod++;
+	ieee->NumRxOkTotal++;
+	/* skb: hdr + (possibly fragmented, possibly encrypted) payload */
+
+	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	    (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
+		goto rx_dropped;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+
+	/* skb: hdr + (possibly fragmented) plaintext payload */
+	// PR: FIXME: hostap has additional conditions in the "if" below:
+	// ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	if ((frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
+		int flen;
+		struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
+		IEEE80211_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
+
+		if (!frag_skb) {
+			IEEE80211_DEBUG(IEEE80211_DL_RX | IEEE80211_DL_FRAG,
+					"Rx cannot get skb from fragment "
+					"cache (morefrag=%d seq=%u frag=%u)\n",
+					(fc & IEEE80211_FCTL_MOREFRAGS) != 0,
+					WLAN_GET_SEQ_SEQ(sc), frag);
+			goto rx_dropped;
+		}
+		flen = skb->len;
+		if (frag != 0)
+			flen -= hdrlen;
+
+		if (frag_skb->tail + flen > frag_skb->end) {
+			printk(KERN_WARNING "%s: host decrypted and "
+			       "reassembled frame did not fit skb\n",
+			       dev->name);
+			ieee80211_frag_cache_invalidate(ieee, hdr);
+			goto rx_dropped;
+		}
+
+		if (frag == 0) {
+			/* copy first fragment (including full headers) into
+			 * beginning of the fragment cache skb */
+			memcpy(skb_put(frag_skb, flen), skb->data, flen);
+		} else {
+			/* append frame payload to the end of the fragment
+			 * cache skb */
+			memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
+			       flen);
+		}
+		dev_kfree_skb_any(skb);
+		skb = NULL;
+
+		if (fc & IEEE80211_FCTL_MOREFRAGS) {
+			/* more fragments expected - leave the skb in fragment
+			 * cache for now; it will be delivered to upper layers
+			 * after all fragments have been received */
+			goto rx_exit;
+		}
+
+		/* this was the last fragment and the frame will be
+		 * delivered, so remove skb from fragment cache */
+		skb = frag_skb;
+		hdr = (struct ieee80211_hdr_4addr *)skb->data;
+		ieee80211_frag_cache_invalidate(ieee, hdr);
+	}
+
+	/* skb: hdr + (possible reassembled) full MSDU payload; possibly still
+	 * encrypted/authenticated */
+	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	    ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
+		goto rx_dropped;
+
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep) {
+		if (/*ieee->ieee802_1x &&*/
+		    ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+
+#ifdef CONFIG_IEEE80211_DEBUG
+			/* pass unencrypted EAPOL frames even if encryption is
+			 * configured */
+			struct eapol *eap = (struct eapol *)(skb->data +
+				24);
+			IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
+						eap_get_type(eap->type));
+#endif
+		} else {
+			IEEE80211_DEBUG_DROP(
+				"encryption configured, but RX "
+				"frame not encrypted (SA=%pM)\n",
+				hdr->addr2);
+			goto rx_dropped;
+		}
+	}
+
+#ifdef CONFIG_IEEE80211_DEBUG
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) &&
+	    ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+			struct eapol *eap = (struct eapol *)(skb->data +
+				24);
+			IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
+						eap_get_type(eap->type));
+	}
+#endif
+
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep &&
+	    !ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+		IEEE80211_DEBUG_DROP(
+			"dropped unencrypted RX data "
+			"frame from %pM"
+			" (drop_unencrypted=1)\n",
+			hdr->addr2);
+		goto rx_dropped;
+	}
+/*
+	if(ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+		printk(KERN_WARNING "RX: IEEE802.1X EPAOL frame!\n");
+	}
+*/
+	/* skb: hdr + (possible reassembled) full plaintext payload */
+	payload = skb->data + hdrlen;
+	ethertype = (payload[6] << 8) | payload[7];
+
+
+	/* convert hdr + possible LLC headers into Ethernet header */
+	if (skb->len - hdrlen >= 8 &&
+	    ((memcmp(payload, rfc1042_header, SNAP_SIZE) == 0 &&
+	      ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+	     memcmp(payload, bridge_tunnel_header, SNAP_SIZE) == 0)) {
+		/* remove RFC1042 or Bridge-Tunnel encapsulation and
+		 * replace EtherType */
+		skb_pull(skb, hdrlen + SNAP_SIZE);
+		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
+		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
+	} else {
+		u16 len;
+		/* Leave Ethernet header part of hdr and full payload */
+		skb_pull(skb, hdrlen);
+		len = htons(skb->len);
+		memcpy(skb_push(skb, 2), &len, 2);
+		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
+		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
+	}
+
+
+	stats->rx_packets++;
+	stats->rx_bytes += skb->len;
+
+	if (skb) {
+		skb->protocol = eth_type_trans(skb, dev);
+		memset(skb->cb, 0, sizeof(skb->cb));
+		skb->dev = dev;
+		skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
+		ieee->last_rx_ps_time = jiffies;
+		netif_rx(skb);
+	}
+
+ rx_exit:
+	return 1;
+
+ rx_dropped:
+	stats->rx_dropped++;
+
+	/* Returning 0 indicates to caller that we have not handled the SKB--
+	 * so it is still allocated and can be used again by underlying
+	 * hardware as a DMA target */
+	return 0;
+}
+
+#define MGMT_FRAME_FIXED_PART_LENGTH		0x24
+
+static inline int ieee80211_is_ofdm_rate(u8 rate)
+{
+	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
+	case IEEE80211_OFDM_RATE_6MB:
+	case IEEE80211_OFDM_RATE_9MB:
+	case IEEE80211_OFDM_RATE_12MB:
+	case IEEE80211_OFDM_RATE_18MB:
+	case IEEE80211_OFDM_RATE_24MB:
+	case IEEE80211_OFDM_RATE_36MB:
+	case IEEE80211_OFDM_RATE_48MB:
+	case IEEE80211_OFDM_RATE_54MB:
+		return 1;
+	}
+        return 0;
+}
+
+static inline int ieee80211_SignalStrengthTranslate(
+	int  CurrSS
+	)
+{
+	int RetSS;
+
+	// Step 1. Scale mapping.
+	if(CurrSS >= 71 && CurrSS <= 100)
+	{
+		RetSS = 90 + ((CurrSS - 70) / 3);
+	}
+	else if(CurrSS >= 41 && CurrSS <= 70)
+	{
+		RetSS = 78 + ((CurrSS - 40) / 3);
+	}
+	else if(CurrSS >= 31 && CurrSS <= 40)
+	{
+		RetSS = 66 + (CurrSS - 30);
+	}
+	else if(CurrSS >= 21 && CurrSS <= 30)
+	{
+		RetSS = 54 + (CurrSS - 20);
+	}
+	else if(CurrSS >= 5 && CurrSS <= 20)
+	{
+		RetSS = 42 + (((CurrSS - 5) * 2) / 3);
+	}
+	else if(CurrSS == 4)
+	{
+		RetSS = 36;
+	}
+	else if(CurrSS == 3)
+	{
+		RetSS = 27;
+	}
+	else if(CurrSS == 2)
+	{
+		RetSS = 18;
+	}
+	else if(CurrSS == 1)
+	{
+		RetSS = 9;
+	}
+	else
+	{
+		RetSS = CurrSS;
+	}
+	//RT_TRACE(COMP_DBG, DBG_LOUD, ("##### After Mapping:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
+
+	// Step 2. Smoothing.
+
+	//RT_TRACE(COMP_DBG, DBG_LOUD, ("$$$$$ After Smoothing:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
+
+	return RetSS;
+}
+
+static inline void ieee80211_extract_country_ie(
+	struct ieee80211_device *ieee,
+	struct ieee80211_info_element *info_element,
+	struct ieee80211_network *network,
+	u8 * addr2
+)
+{
+	if(IS_DOT11D_ENABLE(ieee))
+	{
+		if(info_element->len!= 0)
+		{
+			memcpy(network->CountryIeBuf, info_element->data, info_element->len);
+			network->CountryIeLen = info_element->len;
+
+			if(!IS_COUNTRY_IE_VALID(ieee))
+			{
+				Dot11d_UpdateCountryIe(ieee, addr2, info_element->len, info_element->data);
+			}
+		}
+
+		//
+		// 070305, rcnjko: I update country IE watch dog here because
+		// some AP (e.g. Cisco 1242) don't include country IE in their
+		// probe response frame.
+		//
+		if(IS_EQUAL_CIE_SRC(ieee, addr2) )
+		{
+			UPDATE_CIE_WATCHDOG(ieee);
+		}
+	}
+
+}
+
+int
+ieee80211_TranslateToDbm(
+	unsigned char SignalStrengthIndex	// 0-100 index.
+	)
+{
+	unsigned char SignalPower; // in dBm.
+
+	// Translate to dBm (x=0.5y-95).
+	SignalPower = (int)SignalStrengthIndex * 7 / 10;
+	SignalPower -= 95;
+
+	return SignalPower;
+}
+inline int ieee80211_network_init(
+	struct ieee80211_device *ieee,
+	struct ieee80211_probe_response *beacon,
+	struct ieee80211_network *network,
+	struct ieee80211_rx_stats *stats)
+{
+#ifdef CONFIG_IEEE80211_DEBUG
+	char rates_str[64];
+	char *p;
+#endif
+	struct ieee80211_info_element *info_element;
+ 	u16 left;
+	u8 i;
+	short offset;
+	u8 curRate = 0,hOpRate = 0,curRate_ex = 0;
+
+	/* Pull out fixed field data */
+	memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
+	network->capability = beacon->capability;
+	network->last_scanned = jiffies;
+	network->time_stamp[0] = beacon->time_stamp[0];
+	network->time_stamp[1] = beacon->time_stamp[1];
+	network->beacon_interval = beacon->beacon_interval;
+	/* Where to pull this? beacon->listen_interval;*/
+	network->listen_interval = 0x0A;
+	network->rates_len = network->rates_ex_len = 0;
+	network->last_associate = 0;
+	network->ssid_len = 0;
+	network->flags = 0;
+	network->atim_window = 0;
+	network->QoS_Enable = 0;
+//by amy 080312
+	network->HighestOperaRate = 0;
+//by amy 080312
+	network->Turbo_Enable = 0;
+	network->CountryIeLen = 0;
+	memset(network->CountryIeBuf, 0, MAX_IE_LEN);
+
+	if (stats->freq == IEEE80211_52GHZ_BAND) {
+		/* for A band (No DS info) */
+		network->channel = stats->received_channel;
+	} else
+		network->flags |= NETWORK_HAS_CCK;
+
+ 	network->wpa_ie_len = 0;
+ 	network->rsn_ie_len = 0;
+
+ 	info_element = &beacon->info_element;
+	left = stats->len - ((void *)info_element - (void *)beacon);
+	while (left >= sizeof(struct ieee80211_info_element_hdr)) {
+		if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
+			IEEE80211_DEBUG_SCAN("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%d left=%d.\n",
+					     info_element->len + sizeof(struct ieee80211_info_element),
+					     left);
+			return 1;
+               	}
+
+		switch (info_element->id) {
+		case MFIE_TYPE_SSID:
+			if (ieee80211_is_empty_essid(info_element->data,
+						     info_element->len)) {
+				network->flags |= NETWORK_EMPTY_ESSID;
+				break;
+			}
+
+			network->ssid_len = min(info_element->len,
+						(u8)IW_ESSID_MAX_SIZE);
+			memcpy(network->ssid, info_element->data, network->ssid_len);
+        		if (network->ssid_len < IW_ESSID_MAX_SIZE)
+                		memset(network->ssid + network->ssid_len, 0,
+				       IW_ESSID_MAX_SIZE - network->ssid_len);
+
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_SSID: '%s' len=%d.\n",
+					     network->ssid, network->ssid_len);
+			break;
+
+		case MFIE_TYPE_RATES:
+#ifdef CONFIG_IEEE80211_DEBUG
+			p = rates_str;
+#endif
+			network->rates_len = min(info_element->len, MAX_RATES_LENGTH);
+			for (i = 0; i < network->rates_len; i++) {
+				network->rates[i] = info_element->data[i];
+				curRate = network->rates[i] & 0x7f;
+				if( hOpRate < curRate )
+					hOpRate = curRate;
+#ifdef CONFIG_IEEE80211_DEBUG
+				p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
+#endif
+				if (ieee80211_is_ofdm_rate(info_element->data[i])) {
+					network->flags |= NETWORK_HAS_OFDM;
+					if (info_element->data[i] &
+					    IEEE80211_BASIC_RATE_MASK)
+						network->flags &=
+							~NETWORK_HAS_CCK;
+				}
+			}
+
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES: '%s' (%d)\n",
+					     rates_str, network->rates_len);
+			break;
+
+		case MFIE_TYPE_RATES_EX:
+#ifdef CONFIG_IEEE80211_DEBUG
+			p = rates_str;
+#endif
+			network->rates_ex_len = min(info_element->len, MAX_RATES_EX_LENGTH);
+			for (i = 0; i < network->rates_ex_len; i++) {
+				network->rates_ex[i] = info_element->data[i];
+				curRate_ex = network->rates_ex[i] & 0x7f;
+				if( hOpRate < curRate_ex )
+					hOpRate = curRate_ex;
+#ifdef CONFIG_IEEE80211_DEBUG
+				p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
+#endif
+				if (ieee80211_is_ofdm_rate(info_element->data[i])) {
+					network->flags |= NETWORK_HAS_OFDM;
+					if (info_element->data[i] &
+					    IEEE80211_BASIC_RATE_MASK)
+						network->flags &=
+							~NETWORK_HAS_CCK;
+				}
+			}
+
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
+					     rates_str, network->rates_ex_len);
+			break;
+
+		case MFIE_TYPE_DS_SET:
+  			IEEE80211_DEBUG_SCAN("MFIE_TYPE_DS_SET: %d\n",
+					     info_element->data[0]);
+			if (stats->freq == IEEE80211_24GHZ_BAND)
+				network->channel = info_element->data[0];
+			break;
+
+	 	case MFIE_TYPE_FH_SET:
+  			IEEE80211_DEBUG_SCAN("MFIE_TYPE_FH_SET: ignored\n");
+			break;
+
+		case MFIE_TYPE_CF_SET:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_CF_SET: ignored\n");
+			break;
+
+		case MFIE_TYPE_TIM:
+
+			if(info_element->len < 4)
+				break;
+
+			network->dtim_period = info_element->data[1];
+
+			if(ieee->state != IEEE80211_LINKED)
+				break;
+
+			network->last_dtim_sta_time[0] = jiffies;
+			network->last_dtim_sta_time[1] = stats->mac_time[1];
+
+			network->dtim_data = IEEE80211_DTIM_VALID;
+
+			if(info_element->data[0] != 0)
+				break;
+
+			if(info_element->data[2] & 1)
+				network->dtim_data |= IEEE80211_DTIM_MBCAST;
+
+			offset = (info_element->data[2] >> 1)*2;
+
+			//printk("offset1:%x aid:%x\n",offset, ieee->assoc_id);
+
+			/* add and modified for ps 2008.1.22 */
+			if(ieee->assoc_id < 8*offset ||
+				ieee->assoc_id > 8*(offset + info_element->len -3)) {
+				break;
+			}
+
+			offset = (ieee->assoc_id/8) - offset;// + ((aid % 8)? 0 : 1) ;
+
+		//	printk("offset:%x data:%x, ucast:%d\n", offset,
+			//	info_element->data[3+offset] ,
+			//	info_element->data[3+offset] & (1<<(ieee->assoc_id%8)));
+
+			if(info_element->data[3+offset] & (1<<(ieee->assoc_id%8))) {
+				network->dtim_data |= IEEE80211_DTIM_UCAST;
+			}
+			break;
+
+		case MFIE_TYPE_IBSS_SET:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_IBSS_SET: ignored\n");
+			break;
+
+		case MFIE_TYPE_CHALLENGE:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_CHALLENGE: ignored\n");
+			break;
+
+		case MFIE_TYPE_GENERIC:
+			//nic is 87B
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n",
+					     info_element->len);
+			if (info_element->len >= 4  &&
+			    info_element->data[0] == 0x00 &&
+			    info_element->data[1] == 0x50 &&
+			    info_element->data[2] == 0xf2 &&
+			    info_element->data[3] == 0x01) {
+				network->wpa_ie_len = min(info_element->len + 2,
+							 MAX_WPA_IE_LEN);
+				memcpy(network->wpa_ie, info_element,
+				       network->wpa_ie_len);
+			}
+
+			if (info_element->len == 7 &&
+			    info_element->data[0] == 0x00 &&
+			    info_element->data[1] == 0xe0 &&
+			    info_element->data[2] == 0x4c &&
+			    info_element->data[3] == 0x01 &&
+			    info_element->data[4] == 0x02) {
+				network->Turbo_Enable = 1;
+			}
+			if (1 == stats->nic_type) {//nic 87
+				break;
+			}
+
+			if (info_element->len >= 5  &&
+			    info_element->data[0] == 0x00 &&
+			    info_element->data[1] == 0x50 &&
+			    info_element->data[2] == 0xf2 &&
+			    info_element->data[3] == 0x02 &&
+			    info_element->data[4] == 0x00) {
+				//printk(KERN_WARNING "wmm info updated: %x\n", info_element->data[6]);
+				//WMM Information Element
+				network->wmm_info = info_element->data[6];
+				network->QoS_Enable = 1;
+			}
+
+			if (info_element->len >= 8  &&
+			    info_element->data[0] == 0x00 &&
+			    info_element->data[1] == 0x50 &&
+			    info_element->data[2] == 0xf2 &&
+			    info_element->data[3] == 0x02 &&
+			    info_element->data[4] == 0x01) {
+				// Not care about version at present.
+				//WMM Information Element
+				//printk(KERN_WARNING "wmm info&param updated: %x\n", info_element->data[6]);
+				network->wmm_info = info_element->data[6];
+				//WMM Parameter Element
+				memcpy(network->wmm_param, (u8 *)(info_element->data + 8),(info_element->len - 8));
+				network->QoS_Enable = 1;
+			}
+			break;
+
+		case MFIE_TYPE_RSN:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RSN: %d bytes\n",
+					     info_element->len);
+			network->rsn_ie_len = min(info_element->len + 2,
+						 MAX_WPA_IE_LEN);
+			memcpy(network->rsn_ie, info_element,
+			       network->rsn_ie_len);
+			break;
+		case MFIE_TYPE_COUNTRY:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_COUNTRY: %d bytes\n",
+					     info_element->len);
+//			printk("=====>Receive <%s> Country IE\n",network->ssid);
+			ieee80211_extract_country_ie(ieee, info_element, network, beacon->header.addr2);
+			break;
+		default:
+			IEEE80211_DEBUG_SCAN("unsupported IE %d\n",
+					     info_element->id);
+                        break;
+  		}
+
+		left -= sizeof(struct ieee80211_info_element_hdr) +
+			info_element->len;
+		info_element = (struct ieee80211_info_element *)
+                	&info_element->data[info_element->len];
+  	}
+//by amy 080312
+	network->HighestOperaRate = hOpRate;
+//by amy 080312
+	network->mode = 0;
+	if (stats->freq == IEEE80211_52GHZ_BAND)
+		network->mode = IEEE_A;
+	else {
+		if (network->flags & NETWORK_HAS_OFDM)
+			network->mode |= IEEE_G;
+		if (network->flags & NETWORK_HAS_CCK)
+			network->mode |= IEEE_B;
+	}
+
+	if (network->mode == 0) {
+		IEEE80211_DEBUG_SCAN("Filtered out '%s (%pM)' "
+				     "network.\n",
+				     escape_essid(network->ssid,
+						  network->ssid_len),
+				     network->bssid);
+		return 1;
+	}
+
+	if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
+		network->flags |= NETWORK_EMPTY_ESSID;
+
+	stats->signal = ieee80211_TranslateToDbm(stats->signalstrength);
+	//stats->noise = stats->signal - stats->noise;
+	stats->noise = ieee80211_TranslateToDbm(100 - stats->signalstrength) - 25;
+	memcpy(&network->stats, stats, sizeof(network->stats));
+
+	return 0;
+}
+
+static inline int is_same_network(struct ieee80211_network *src,
+				  struct ieee80211_network *dst,
+				  struct ieee80211_device * ieee)
+{
+	/* A network is only a duplicate if the channel, BSSID, ESSID
+	 * and the capability field (in particular IBSS and BSS) all match.
+	 * We treat all <hidden> with the same BSSID and channel
+	 * as one network */
+	return (((src->ssid_len == dst->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&  //YJ,mod,080819,for hidden ap
+		//((src->ssid_len == dst->ssid_len) &&
+		(src->channel == dst->channel) &&
+		!memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
+		(!memcmp(src->ssid, dst->ssid, src->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) && //YJ,mod,080819,for hidden ap
+		//!memcmp(src->ssid, dst->ssid, src->ssid_len) &&
+		((src->capability & WLAN_CAPABILITY_IBSS) ==
+		(dst->capability & WLAN_CAPABILITY_IBSS)) &&
+		((src->capability & WLAN_CAPABILITY_BSS) ==
+		(dst->capability & WLAN_CAPABILITY_BSS)));
+}
+
+inline void update_network(struct ieee80211_network *dst,
+				  struct ieee80211_network *src)
+{
+	unsigned char quality = src->stats.signalstrength;
+	unsigned char signal = 0;
+	unsigned char noise = 0;
+        if(dst->stats.signalstrength > 0) {
+                quality = (dst->stats.signalstrength * 5 + src->stats.signalstrength + 5)/6;
+        }
+	signal = ieee80211_TranslateToDbm(quality);
+	//noise = signal - src->stats.noise;
+	if(dst->stats.noise > 0)
+		noise = (dst->stats.noise * 5 + src->stats.noise)/6;
+        //if(strcmp(dst->ssid, "linksys_lzm000") == 0)
+//	printk("ssid:%s, quality:%d, signal:%d\n", dst->ssid, quality, signal);
+	memcpy(&dst->stats, &src->stats, sizeof(struct ieee80211_rx_stats));
+	dst->stats.signalstrength = quality;
+	dst->stats.signal = signal;
+//	printk("==================>stats.signal is %d\n",dst->stats.signal);
+	dst->stats.noise = noise;
+
+
+	dst->capability = src->capability;
+	memcpy(dst->rates, src->rates, src->rates_len);
+	dst->rates_len = src->rates_len;
+	memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
+	dst->rates_ex_len = src->rates_ex_len;
+	dst->HighestOperaRate= src->HighestOperaRate;
+	//printk("==========>in %s: src->ssid is %s,chan is %d\n",__func__,src->ssid,src->channel);
+
+	//YJ,add,080819,for hidden ap
+	if(src->ssid_len > 0)
+	{
+		//if(src->ssid_len == 13)
+		//	printk("=====================>>>>>>>> Dst ssid: %s Src ssid: %s\n", dst->ssid, src->ssid);
+		memset(dst->ssid, 0, dst->ssid_len);
+		dst->ssid_len = src->ssid_len;
+		memcpy(dst->ssid, src->ssid, src->ssid_len);
+	}
+	//YJ,add,080819,for hidden ap,end
+
+	dst->channel = src->channel;
+	dst->mode = src->mode;
+	dst->flags = src->flags;
+	dst->time_stamp[0] = src->time_stamp[0];
+	dst->time_stamp[1] = src->time_stamp[1];
+
+	dst->beacon_interval = src->beacon_interval;
+	dst->listen_interval = src->listen_interval;
+	dst->atim_window = src->atim_window;
+	dst->dtim_period = src->dtim_period;
+	dst->dtim_data = src->dtim_data;
+	dst->last_dtim_sta_time[0] = src->last_dtim_sta_time[0];
+	dst->last_dtim_sta_time[1] = src->last_dtim_sta_time[1];
+//	printk("update:%s, dtim_period:%x, dtim_data:%x\n", src->ssid, src->dtim_period, src->dtim_data);
+	memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
+	dst->wpa_ie_len = src->wpa_ie_len;
+	memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
+	dst->rsn_ie_len = src->rsn_ie_len;
+
+	dst->last_scanned = jiffies;
+	/* dst->last_associate is not overwritten */
+// disable QoS process now, added by David 2006/7/25
+#if 1
+	dst->wmm_info = src->wmm_info; //sure to exist in beacon or probe response frame.
+/*
+	if((dst->wmm_info^src->wmm_info)&0x0f) {//Param Set Count change, update Parameter
+	  memcpy(dst->wmm_param, src->wmm_param, IEEE80211_AC_PRAM_LEN);
+	}
+*/
+	if(src->wmm_param[0].ac_aci_acm_aifsn|| \
+	   src->wmm_param[1].ac_aci_acm_aifsn|| \
+	   src->wmm_param[2].ac_aci_acm_aifsn|| \
+	   src->wmm_param[3].ac_aci_acm_aifsn) {
+	  memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
+	}
+	dst->QoS_Enable = src->QoS_Enable;
+#else
+	dst->QoS_Enable = 1;//for Rtl8187 simulation
+#endif
+	dst->SignalStrength = src->SignalStrength;
+	dst->Turbo_Enable = src->Turbo_Enable;
+	dst->CountryIeLen = src->CountryIeLen;
+	memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
+}
+
+
+inline void ieee80211_process_probe_response(
+	struct ieee80211_device *ieee,
+	struct ieee80211_probe_response *beacon,
+	struct ieee80211_rx_stats *stats)
+{
+	struct ieee80211_network network;
+	struct ieee80211_network *target;
+	struct ieee80211_network *oldest = NULL;
+#ifdef CONFIG_IEEE80211_DEBUG
+	struct ieee80211_info_element *info_element = &beacon->info_element;
+#endif
+	unsigned long flags;
+	short renew;
+	u8 wmm_info;
+	u8 is_beacon = (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_BEACON)? 1:0;  //YJ,add,080819,for hidden ap
+
+	memset(&network, 0, sizeof(struct ieee80211_network));
+
+	IEEE80211_DEBUG_SCAN(
+		"'%s' (%pM): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
+		escape_essid(info_element->data, info_element->len),
+		beacon->header.addr3,
+		(beacon->capability & (1<<0xf)) ? '1' : '0',
+		(beacon->capability & (1<<0xe)) ? '1' : '0',
+		(beacon->capability & (1<<0xd)) ? '1' : '0',
+		(beacon->capability & (1<<0xc)) ? '1' : '0',
+		(beacon->capability & (1<<0xb)) ? '1' : '0',
+		(beacon->capability & (1<<0xa)) ? '1' : '0',
+		(beacon->capability & (1<<0x9)) ? '1' : '0',
+		(beacon->capability & (1<<0x8)) ? '1' : '0',
+		(beacon->capability & (1<<0x7)) ? '1' : '0',
+		(beacon->capability & (1<<0x6)) ? '1' : '0',
+		(beacon->capability & (1<<0x5)) ? '1' : '0',
+		(beacon->capability & (1<<0x4)) ? '1' : '0',
+		(beacon->capability & (1<<0x3)) ? '1' : '0',
+		(beacon->capability & (1<<0x2)) ? '1' : '0',
+		(beacon->capability & (1<<0x1)) ? '1' : '0',
+		(beacon->capability & (1<<0x0)) ? '1' : '0');
+
+	if (ieee80211_network_init(ieee, beacon, &network, stats)) {
+		IEEE80211_DEBUG_SCAN("Dropped '%s' (%pM) via %s.\n",
+				     escape_essid(info_element->data,
+						  info_element->len),
+				     beacon->header.addr3,
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+		return;
+	}
+
+	// For Asus EeePc request,
+	// (1) if wireless adapter receive get any 802.11d country code in AP beacon,
+	//	   wireless adapter should follow the country code.
+	// (2)  If there is no any country code in beacon,
+	//       then wireless adapter should do active scan from ch1~11 and
+	//       passive scan from ch12~14
+	if(ieee->bGlobalDomain)
+	{
+		if (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_PROBE_RESP)
+		{
+			// Case 1: Country code
+			if(IS_COUNTRY_IE_VALID(ieee) )
+			{
+				if( !IsLegalChannel(ieee, network.channel) )
+				{
+					printk("GetScanInfo(): For Country code, filter probe response at channel(%d).\n", network.channel);
+					return;
+				}
+			}
+			// Case 2: No any country code.
+			else
+			{
+				// Filter over channel ch12~14
+				if(network.channel > 11)
+				{
+					printk("GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", network.channel);
+					return;
+				}
+			}
+		}
+		else
+		{
+			// Case 1: Country code
+			if(IS_COUNTRY_IE_VALID(ieee) )
+			{
+				if( !IsLegalChannel(ieee, network.channel) )
+				{
+					printk("GetScanInfo(): For Country code, filter beacon at channel(%d).\n",network.channel);
+					return;
+				}
+			}
+			// Case 2: No any country code.
+			else
+			{
+				// Filter over channel ch12~14
+				if(network.channel > 14)
+				{
+					printk("GetScanInfo(): For Global Domain, filter beacon at channel(%d).\n",network.channel);
+					return;
+				}
+			}
+		}
+	}
+	/* The network parsed correctly -- so now we scan our known networks
+	 * to see if we can find it in our list.
+	 *
+	 * NOTE:  This search is definitely not optimized.  Once its doing
+	 *        the "right thing" we'll optimize it for efficiency if
+	 *        necessary */
+
+	/* Search for this entry in the list and update it if it is
+	 * already there. */
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(is_same_network(&ieee->current_network, &network, ieee)) {
+		wmm_info = ieee->current_network.wmm_info;
+		//YJ,add,080819,for hidden ap
+		if(is_beacon == 0)
+			network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & ieee->current_network.flags);
+		else if(ieee->state == IEEE80211_LINKED)
+			ieee->NumRxBcnInPeriod++;
+		//YJ,add,080819,for hidden ap,end
+		//printk("====>network.ssid=%s cur_ssid=%s\n", network.ssid, ieee->current_network.ssid);
+		update_network(&ieee->current_network, &network);
+	}
+
+	list_for_each_entry(target, &ieee->network_list, list) {
+		if (is_same_network(target, &network, ieee))
+			break;
+		if ((oldest == NULL) ||
+		    (target->last_scanned < oldest->last_scanned))
+			oldest = target;
+	}
+
+	/* If we didn't find a match, then get a new network slot to initialize
+	 * with this beacon's information */
+	if (&target->list == &ieee->network_list) {
+		if (list_empty(&ieee->network_free_list)) {
+			/* If there are no more slots, expire the oldest */
+			list_del(&oldest->list);
+			target = oldest;
+			IEEE80211_DEBUG_SCAN("Expired '%s' (%pM) from "
+					     "network list.\n",
+					     escape_essid(target->ssid,
+							  target->ssid_len),
+					     target->bssid);
+		} else {
+			/* Otherwise just pull from the free list */
+			target = list_entry(ieee->network_free_list.next,
+					    struct ieee80211_network, list);
+			list_del(ieee->network_free_list.next);
+		}
+
+
+#ifdef CONFIG_IEEE80211_DEBUG
+		IEEE80211_DEBUG_SCAN("Adding '%s' (%pM) via %s.\n",
+				     escape_essid(network.ssid,
+						  network.ssid_len),
+				     network.bssid,
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+#endif
+
+		memcpy(target, &network, sizeof(*target));
+		list_add_tail(&target->list, &ieee->network_list);
+	} else {
+		IEEE80211_DEBUG_SCAN("Updating '%s' (%pM) via %s.\n",
+				     escape_essid(target->ssid,
+						  target->ssid_len),
+				     target->bssid,
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+
+		/* we have an entry and we are going to update it. But this entry may
+		 * be already expired. In this case we do the same as we found a new
+		 * net and call the new_net handler
+		 */
+		renew = !time_after(target->last_scanned + ieee->scan_age, jiffies);
+		//YJ,add,080819,for hidden ap
+		if(is_beacon == 0)
+			network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & target->flags);
+		//if(strncmp(network.ssid, "linksys-c",9) == 0)
+		//	printk("====>2 network.ssid=%s FLAG=%d target.ssid=%s FLAG=%d\n", network.ssid, network.flags, target->ssid, target->flags);
+		if(((network.flags & NETWORK_EMPTY_ESSID) == NETWORK_EMPTY_ESSID) \
+		    && (((network.ssid_len > 0) && (strncmp(target->ssid, network.ssid, network.ssid_len)))\
+		    ||((ieee->current_network.ssid_len == network.ssid_len)&&(strncmp(ieee->current_network.ssid, network.ssid, network.ssid_len) == 0)&&(ieee->state == IEEE80211_NOLINK))))
+			renew = 1;
+		//YJ,add,080819,for hidden ap,end
+		update_network(target, &network);
+	}
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+void ieee80211_rx_mgt(struct ieee80211_device *ieee,
+		      struct ieee80211_hdr_4addr *header,
+		      struct ieee80211_rx_stats *stats)
+{
+	switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
+
+	case IEEE80211_STYPE_BEACON:
+		IEEE80211_DEBUG_MGMT("received BEACON (%d)\n",
+				     WLAN_FC_GET_STYPE(header->frame_ctl));
+		IEEE80211_DEBUG_SCAN("Beacon\n");
+		ieee80211_process_probe_response(
+			ieee, (struct ieee80211_probe_response *)header, stats);
+		break;
+
+	case IEEE80211_STYPE_PROBE_RESP:
+		IEEE80211_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
+				     WLAN_FC_GET_STYPE(header->frame_ctl));
+		IEEE80211_DEBUG_SCAN("Probe response\n");
+		ieee80211_process_probe_response(
+			ieee, (struct ieee80211_probe_response *)header, stats);
+		break;
+	}
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
new file mode 100644
index 00000000..26bacb96
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
@@ -0,0 +1,3008 @@
+/* IEEE 802.11 SoftMAC layer
+ * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Mostly extracted from the rtl8180-sa2400 driver for the
+ * in-kernel generic ieee802.11 stack.
+ *
+ * Few lines might be stolen from other part of the ieee80211
+ * stack. Copyright who own it's copyright
+ *
+ * WPA code stolen from the ipw2200 driver.
+ * Copyright who own it's copyright.
+ *
+ * released under the GPL
+ */
+
+
+#include "ieee80211.h"
+
+#include <linux/random.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <asm/uaccess.h>
+
+#include "dot11d.h"
+u8 rsn_authen_cipher_suite[16][4] = {
+	{0x00,0x0F,0xAC,0x00}, //Use group key, //Reserved
+	{0x00,0x0F,0xAC,0x01}, //WEP-40         //RSNA default
+	{0x00,0x0F,0xAC,0x02}, //TKIP           //NONE		//{used just as default}
+	{0x00,0x0F,0xAC,0x03}, //WRAP-historical
+	{0x00,0x0F,0xAC,0x04}, //CCMP
+	{0x00,0x0F,0xAC,0x05}, //WEP-104
+};
+
+short ieee80211_is_54g(const struct ieee80211_network *net)
+{
+	return (net->rates_ex_len > 0) || (net->rates_len > 4);
+}
+
+short ieee80211_is_shortslot(const struct ieee80211_network *net)
+{
+	return net->capability & WLAN_CAPABILITY_SHORT_SLOT;
+}
+
+/* returns the total length needed for pleacing the RATE MFIE
+ * tag and the EXTENDED RATE MFIE tag if needed.
+ * It encludes two bytes per tag for the tag itself and its len
+ */
+unsigned int ieee80211_MFIE_rate_len(struct ieee80211_device *ieee)
+{
+	unsigned int rate_len = 0;
+
+	if (ieee->modulation & IEEE80211_CCK_MODULATION)
+		rate_len = IEEE80211_CCK_RATE_LEN + 2;
+
+	if (ieee->modulation & IEEE80211_OFDM_MODULATION)
+
+		rate_len += IEEE80211_OFDM_RATE_LEN + 2;
+
+	return rate_len;
+}
+
+/* pleace the MFIE rate, tag to the memory (double) poined.
+ * Then it updates the pointer so that
+ * it points after the new MFIE tag added.
+ */
+void ieee80211_MFIE_Brate(struct ieee80211_device *ieee, u8 **tag_p)
+{
+	u8 *tag = *tag_p;
+
+	if (ieee->modulation & IEEE80211_CCK_MODULATION){
+		*tag++ = MFIE_TYPE_RATES;
+		*tag++ = 4;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+	}
+
+	/* We may add an option for custom rates that specific HW might support */
+	*tag_p = tag;
+}
+
+void ieee80211_MFIE_Grate(struct ieee80211_device *ieee, u8 **tag_p)
+{
+	u8 *tag = *tag_p;
+
+		if (ieee->modulation & IEEE80211_OFDM_MODULATION){
+
+		*tag++ = MFIE_TYPE_RATES_EX;
+		*tag++ = 8;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+
+	}
+
+	/* We may add an option for custom rates that specific HW might support */
+	*tag_p = tag;
+}
+
+
+void ieee80211_WMM_Info(struct ieee80211_device *ieee, u8 **tag_p) {
+	u8 *tag = *tag_p;
+
+	*tag++ = MFIE_TYPE_GENERIC; //0
+	*tag++ = 7;
+	*tag++ = 0x00;
+	*tag++ = 0x50;
+	*tag++ = 0xf2;
+	*tag++ = 0x02;//5
+	*tag++ = 0x00;
+	*tag++ = 0x01;
+#ifdef SUPPORT_USPD
+	if(ieee->current_network.wmm_info & 0x80) {
+		*tag++ = 0x0f|MAX_SP_Len;
+	} else {
+		*tag++ = MAX_SP_Len;
+	}
+#else
+	*tag++ = MAX_SP_Len;
+#endif
+	*tag_p = tag;
+}
+
+void ieee80211_TURBO_Info(struct ieee80211_device *ieee, u8 **tag_p) {
+	u8 *tag = *tag_p;
+
+        *tag++ = MFIE_TYPE_GENERIC; //0
+        *tag++ = 7;
+        *tag++ = 0x00;
+        *tag++ = 0xe0;
+        *tag++ = 0x4c;
+        *tag++ = 0x01;//5
+        *tag++ = 0x02;
+        *tag++ = 0x11;
+	*tag++ = 0x00;
+
+	*tag_p = tag;
+	printk(KERN_ALERT "This is enable turbo mode IE process\n");
+}
+
+void enqueue_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	int nh;
+	nh = (ieee->mgmt_queue_head +1) % MGMT_QUEUE_NUM;
+
+/*
+ * if the queue is full but we have newer frames then
+ * just overwrites the oldest.
+ *
+ * if (nh == ieee->mgmt_queue_tail)
+ *		return -1;
+ */
+	ieee->mgmt_queue_head = nh;
+	ieee->mgmt_queue_ring[nh] = skb;
+
+	//return 0;
+}
+
+struct sk_buff *dequeue_mgmt(struct ieee80211_device *ieee)
+{
+	struct sk_buff *ret;
+
+	if(ieee->mgmt_queue_tail == ieee->mgmt_queue_head)
+		return NULL;
+
+	ret = ieee->mgmt_queue_ring[ieee->mgmt_queue_tail];
+
+	ieee->mgmt_queue_tail =
+		(ieee->mgmt_queue_tail+1) % MGMT_QUEUE_NUM;
+
+	return ret;
+}
+
+void init_mgmt_queue(struct ieee80211_device *ieee)
+{
+	ieee->mgmt_queue_tail = ieee->mgmt_queue_head = 0;
+}
+
+
+void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl);
+
+inline void softmac_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
+	struct ieee80211_hdr_3addr  *header=
+		(struct ieee80211_hdr_3addr  *) skb->data;
+
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	/* called with 2nd param 0, no mgmt lock required */
+	ieee80211_sta_wakeup(ieee,0);
+
+	if(single){
+		if(ieee->queue_stop){
+
+			enqueue_mgmt(ieee,skb);
+		}else{
+			header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0]<<4);
+
+			if (ieee->seq_ctrl[0] == 0xFFF)
+				ieee->seq_ctrl[0] = 0;
+			else
+				ieee->seq_ctrl[0]++;
+
+			/* avoid watchdog triggers */
+			ieee->dev->trans_start = jiffies;
+			ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+		}
+
+		spin_unlock_irqrestore(&ieee->lock, flags);
+	}else{
+		spin_unlock_irqrestore(&ieee->lock, flags);
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags);
+
+		header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		/* avoid watchdog triggers */
+		ieee->dev->trans_start = jiffies;
+		ieee->softmac_hard_start_xmit(skb,ieee->dev);
+
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags);
+	}
+}
+
+
+inline void softmac_ps_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee)
+{
+
+	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
+	struct ieee80211_hdr_3addr  *header =
+		(struct ieee80211_hdr_3addr  *) skb->data;
+
+
+	if(single){
+
+		header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		/* avoid watchdog triggers */
+		ieee->dev->trans_start = jiffies;
+		ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+
+	}else{
+
+		header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		/* avoid watchdog triggers */
+		ieee->dev->trans_start = jiffies;
+		ieee->softmac_hard_start_xmit(skb,ieee->dev);
+
+	}
+//	dev_kfree_skb_any(skb);//edit by thomas
+}
+//by amy for power save
+inline struct sk_buff *ieee80211_disassociate_skb(
+							struct ieee80211_network *beacon,
+							struct ieee80211_device *ieee,
+							u8	asRsn)
+{
+	struct sk_buff *skb;
+	struct ieee80211_disassoc_frame *disass;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_disassoc_frame));
+	if (!skb)
+		return NULL;
+
+	disass = (struct ieee80211_disassoc_frame *) skb_put(skb,sizeof(struct ieee80211_disassoc_frame));
+	disass->header.frame_control = cpu_to_le16(IEEE80211_STYPE_DISASSOC);
+	disass->header.duration_id = 0;
+
+	memcpy(disass->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(disass->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(disass->header.addr3, beacon->bssid, ETH_ALEN);
+
+	disass->reasoncode = asRsn;
+	return skb;
+}
+void
+SendDisassociation(
+        struct ieee80211_device *ieee,
+        u8*                     asSta,
+        u8                      asRsn
+)
+{
+        struct ieee80211_network *beacon = &ieee->current_network;
+        struct sk_buff *skb;
+        skb = ieee80211_disassociate_skb(beacon,ieee,asRsn);
+        if (skb){
+                softmac_mgmt_xmit(skb, ieee);
+                //dev_kfree_skb_any(skb);//edit by thomas
+        }
+}
+
+//by amy for power save
+inline struct sk_buff *ieee80211_probe_req(struct ieee80211_device *ieee)
+{
+	unsigned int len,rate_len;
+	u8 *tag;
+	struct sk_buff *skb;
+	struct ieee80211_probe_request *req;
+
+	len = ieee->current_network.ssid_len;
+
+	rate_len = ieee80211_MFIE_rate_len(ieee);
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_probe_request) +
+			    2 + len + rate_len);
+	if (!skb)
+		return NULL;
+
+	req = (struct ieee80211_probe_request *) skb_put(skb,sizeof(struct ieee80211_probe_request));
+	req->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
+	req->header.duration_id = 0; //FIXME: is this OK ?
+
+	memset(req->header.addr1, 0xff, ETH_ALEN);
+	memcpy(req->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memset(req->header.addr3, 0xff, ETH_ALEN);
+
+	tag = (u8 *) skb_put(skb,len+2+rate_len);
+
+	*tag++ = MFIE_TYPE_SSID;
+	*tag++ = len;
+	memcpy(tag, ieee->current_network.ssid, len);
+	tag += len;
+	ieee80211_MFIE_Brate(ieee,&tag);
+	ieee80211_MFIE_Grate(ieee,&tag);
+
+	return skb;
+}
+
+struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee);
+
+void ext_ieee80211_send_beacon_wq(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+
+	//unsigned long flags;
+
+	skb = ieee80211_get_beacon_(ieee);
+
+	if (skb){
+		softmac_mgmt_xmit(skb, ieee);
+		ieee->softmac_stats.tx_beacons++;
+		dev_kfree_skb_any(skb);//edit by thomas
+	}
+
+
+	//printk(KERN_WARNING "[1] beacon sending!\n");
+	ieee->beacon_timer.expires = jiffies +
+		(MSECS( ieee->current_network.beacon_interval -5));
+
+	//spin_lock_irqsave(&ieee->beacon_lock,flags);
+	if(ieee->beacon_txing)
+		add_timer(&ieee->beacon_timer);
+	//spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+}
+
+void ieee80211_send_beacon(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+
+	//unsigned long flags;
+
+	skb = ieee80211_get_beacon_(ieee);
+
+	if (skb){
+		softmac_mgmt_xmit(skb, ieee);
+		ieee->softmac_stats.tx_beacons++;
+		dev_kfree_skb_any(skb);//edit by thomas
+	}
+
+	//printk(KERN_WARNING "[1] beacon sending!\n");
+	ieee->beacon_timer.expires = jiffies +
+		(MSECS( ieee->current_network.beacon_interval -5));
+
+	//spin_lock_irqsave(&ieee->beacon_lock,flags);
+	if(ieee->beacon_txing)
+		add_timer(&ieee->beacon_timer);
+	//spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+}
+
+
+void ieee80211_send_beacon_cb(unsigned long _ieee)
+{
+	struct ieee80211_device *ieee =
+		(struct ieee80211_device *) _ieee;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->beacon_lock, flags);
+	ieee80211_send_beacon(ieee);
+	spin_unlock_irqrestore(&ieee->beacon_lock, flags);
+}
+
+void ieee80211_send_probe(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+
+	skb = ieee80211_probe_req(ieee);
+	if (skb){
+		softmac_mgmt_xmit(skb, ieee);
+		ieee->softmac_stats.tx_probe_rq++;
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+
+void ieee80211_send_probe_requests(struct ieee80211_device *ieee)
+{
+	if (ieee->active_scan && (ieee->softmac_features & IEEE_SOFTMAC_PROBERQ)){
+		ieee80211_send_probe(ieee);
+		ieee80211_send_probe(ieee);
+	}
+}
+
+/* this performs syncro scan blocking the caller until all channels
+ * in the allowed channel map has been checked.
+ */
+void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee)
+{
+	short ch = 0;
+	u8 channel_map[MAX_CHANNEL_NUMBER+1];
+	memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
+	down(&ieee->scan_sem);
+//	printk("==================> Sync scan\n");
+
+	while(1)
+	{
+
+		do{
+			ch++;
+			if (ch > MAX_CHANNEL_NUMBER)
+				goto out; /* scan completed */
+
+		}while(!channel_map[ch]);
+		/* this function can be called in two situations
+		 * 1- We have switched to ad-hoc mode and we are
+		 *    performing a complete syncro scan before conclude
+		 *    there are no interesting cell and to create a
+		 *    new one. In this case the link state is
+		 *    IEEE80211_NOLINK until we found an interesting cell.
+		 *    If so the ieee8021_new_net, called by the RX path
+		 *    will set the state to IEEE80211_LINKED, so we stop
+		 *    scanning
+		 * 2- We are linked and the root uses run iwlist scan.
+		 *    So we switch to IEEE80211_LINKED_SCANNING to remember
+		 *    that we are still logically linked (not interested in
+		 *    new network events, despite for updating the net list,
+		 *    but we are temporarly 'unlinked' as the driver shall
+		 *    not filter RX frames and the channel is changing.
+		 * So the only situation in witch are interested is to check
+		 * if the state become LINKED because of the #1 situation
+		 */
+
+		if (ieee->state == IEEE80211_LINKED)
+			goto out;
+
+		ieee->set_chan(ieee->dev, ch);
+//		printk("=====>channel=%d   ",ch);
+		if(channel_map[ch] == 1)
+		{
+//			printk("====send probe request\n");
+			ieee80211_send_probe_requests(ieee);
+		}
+		/* this prevent excessive time wait when we
+		 * need to wait for a syncro scan to end..
+		 */
+		if (ieee->sync_scan_hurryup)
+			goto out;
+
+
+		msleep_interruptible_rtl(IEEE80211_SOFTMAC_SCAN_TIME);
+
+	}
+out:
+	ieee->sync_scan_hurryup = 0;
+	up(&ieee->scan_sem);
+	if(IS_DOT11D_ENABLE(ieee))
+		DOT11D_ScanComplete(ieee);
+}
+
+void ieee80211_softmac_ips_scan_syncro(struct ieee80211_device *ieee)
+{
+	int ch;
+        unsigned int watch_dog = 0;
+	u8 channel_map[MAX_CHANNEL_NUMBER+1];
+	memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
+        down(&ieee->scan_sem);
+	ch = ieee->current_network.channel;
+//      	if(ieee->sync_scan_hurryup)
+//	{
+
+//		printk("stop scan sync\n");
+//   		goto out;
+//  	}
+//	printk("=======hh===============>ips scan\n");
+     	while(1)
+        {
+                /* this function can be called in two situations
+                 * 1- We have switched to ad-hoc mode and we are
+                 *    performing a complete syncro scan before conclude
+                 *    there are no interesting cell and to create a
+                 *    new one. In this case the link state is
+                 *    IEEE80211_NOLINK until we found an interesting cell.
+                 *    If so the ieee8021_new_net, called by the RX path
+                 *    will set the state to IEEE80211_LINKED, so we stop
+                 *    scanning
+                 * 2- We are linked and the root uses run iwlist scan.
+                 *    So we switch to IEEE80211_LINKED_SCANNING to remember
+                 *    that we are still logically linked (not interested in
+                 *    new network events, despite for updating the net list,
+                 *    but we are temporarly 'unlinked' as the driver shall
+                 *    not filter RX frames and the channel is changing.
+                 * So the only situation in witch are interested is to check
+                 * if the state become LINKED because of the #1 situation
+                 */
+		if (ieee->state == IEEE80211_LINKED)
+		{
+			goto out;
+		}
+		if(channel_map[ieee->current_network.channel] > 0)
+		{
+			ieee->set_chan(ieee->dev, ieee->current_network.channel);
+//			printk("======>channel=%d  ",ieee->current_network.channel);
+		}
+		if(channel_map[ieee->current_network.channel] == 1)
+		{
+//			printk("====send probe request\n");
+			ieee80211_send_probe_requests(ieee);
+                }
+		/* this prevent excessive time wait when we
+                 * need to wait for a syncro scan to end..
+                 */
+//                if (ieee->sync_scan_hurryup)
+//                        goto out;
+
+		msleep_interruptible_rtl(IEEE80211_SOFTMAC_SCAN_TIME);
+
+		do{
+			if (watch_dog++ >= MAX_CHANNEL_NUMBER)
+		//	if (++watch_dog >= 15);//MAX_CHANNEL_NUMBER)  //YJ,modified,080630
+				goto out; /* scan completed */
+
+			ieee->current_network.channel = (ieee->current_network.channel + 1)%MAX_CHANNEL_NUMBER;
+		}while(!channel_map[ieee->current_network.channel]);
+        }
+out:
+	//ieee->sync_scan_hurryup = 0;
+   	//ieee->set_chan(ieee->dev, ch);
+   	//ieee->current_network.channel = ch;
+	ieee->actscanning = false;
+	up(&ieee->scan_sem);
+	if(IS_DOT11D_ENABLE(ieee))
+		DOT11D_ScanComplete(ieee);
+}
+
+void ieee80211_softmac_scan_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, softmac_scan_wq);
+	static short watchdog = 0;
+	u8 channel_map[MAX_CHANNEL_NUMBER+1];
+	memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
+//	printk("ieee80211_softmac_scan_wq ENABLE_IPS\n");
+//	printk("in %s\n",__func__);
+	down(&ieee->scan_sem);
+
+	do{
+		ieee->current_network.channel =
+			(ieee->current_network.channel + 1) % MAX_CHANNEL_NUMBER;
+		if (watchdog++ > MAX_CHANNEL_NUMBER)
+				goto out; /* no good chans */
+
+ 	}while(!channel_map[ieee->current_network.channel]);
+
+	//printk("current_network.channel:%d\n", ieee->current_network.channel);
+	if (ieee->scanning == 0 )
+	{
+		printk("error out, scanning = 0\n");
+		goto out;
+	}
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	if(channel_map[ieee->current_network.channel] == 1)
+		ieee80211_send_probe_requests(ieee);
+
+	queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq, IEEE80211_SOFTMAC_SCAN_TIME);
+	up(&ieee->scan_sem);
+	return;
+out:
+	ieee->actscanning = false;
+	watchdog = 0;
+	ieee->scanning = 0;
+	up(&ieee->scan_sem);
+
+	if(IS_DOT11D_ENABLE(ieee))
+		DOT11D_ScanComplete(ieee);
+	return;
+}
+
+void ieee80211_beacons_start(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->beacon_lock,flags);
+
+	ieee->beacon_txing = 1;
+	ieee80211_send_beacon(ieee);
+
+	spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+}
+
+void ieee80211_beacons_stop(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->beacon_lock,flags);
+
+	ieee->beacon_txing = 0;
+ 	del_timer_sync(&ieee->beacon_timer);
+
+	spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+
+}
+
+
+void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
+{
+	if(ieee->stop_send_beacons)
+		ieee->stop_send_beacons(ieee->dev);
+	if (ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
+		ieee80211_beacons_stop(ieee);
+}
+
+
+void ieee80211_start_send_beacons(struct ieee80211_device *ieee)
+{
+	if(ieee->start_send_beacons)
+		ieee->start_send_beacons(ieee->dev);
+	if(ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
+		ieee80211_beacons_start(ieee);
+}
+
+
+void ieee80211_softmac_stop_scan(struct ieee80211_device *ieee)
+{
+//	unsigned long flags;
+
+	//ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->scan_sem);
+//	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->scanning == 1){
+		ieee->scanning = 0;
+		//del_timer_sync(&ieee->scan_timer);
+		cancel_delayed_work(&ieee->softmac_scan_wq);
+	}
+
+//	spin_unlock_irqrestore(&ieee->lock, flags);
+	up(&ieee->scan_sem);
+}
+
+void ieee80211_stop_scan(struct ieee80211_device *ieee)
+{
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
+		ieee80211_softmac_stop_scan(ieee);
+	else
+		ieee->stop_scan(ieee->dev);
+}
+
+/* called with ieee->lock held */
+void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
+{
+	if(IS_DOT11D_ENABLE(ieee) )
+	{
+		if(IS_COUNTRY_IE_VALID(ieee))
+		{
+			RESET_CIE_WATCHDOG(ieee);
+		}
+	}
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN){
+		if (ieee->scanning == 0)
+		{
+			ieee->scanning = 1;
+			//ieee80211_softmac_scan(ieee);
+		//	queue_work(ieee->wq, &ieee->softmac_scan_wq);
+		//care this,1203,2007,by lawrence
+#if 1
+			queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq,0);
+#endif
+		}
+	}else
+		ieee->start_scan(ieee->dev);
+
+}
+
+/* called with wx_sem held */
+void ieee80211_start_scan_syncro(struct ieee80211_device *ieee)
+{
+	if(IS_DOT11D_ENABLE(ieee) )
+	{
+		if(IS_COUNTRY_IE_VALID(ieee))
+		{
+			RESET_CIE_WATCHDOG(ieee);
+		}
+	}
+	ieee->sync_scan_hurryup = 0;
+
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
+		ieee80211_softmac_scan_syncro(ieee);
+	else
+		ieee->scan_syncro(ieee->dev);
+
+}
+
+inline struct sk_buff *ieee80211_authentication_req(struct ieee80211_network *beacon,
+	struct ieee80211_device *ieee, int challengelen)
+{
+	struct sk_buff *skb;
+	struct ieee80211_authentication *auth;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_authentication) + challengelen);
+
+	if (!skb) return NULL;
+
+	auth = (struct ieee80211_authentication *)
+		skb_put(skb, sizeof(struct ieee80211_authentication));
+
+	auth->header.frame_ctl = IEEE80211_STYPE_AUTH;
+	if (challengelen) auth->header.frame_ctl |= IEEE80211_FCTL_WEP;
+
+	auth->header.duration_id = 0x013a; //FIXME
+
+	memcpy(auth->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr3, beacon->bssid, ETH_ALEN);
+
+	auth->algorithm = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
+
+	auth->transaction = cpu_to_le16(ieee->associate_seq);
+	ieee->associate_seq++;
+
+	auth->status = cpu_to_le16(WLAN_STATUS_SUCCESS);
+
+	return skb;
+
+}
+
+static struct sk_buff* ieee80211_probe_resp(struct ieee80211_device *ieee, u8 *dest)
+{
+	u8 *tag;
+	int beacon_size;
+	struct ieee80211_probe_response *beacon_buf;
+	struct sk_buff *skb;
+	int encrypt;
+	int atim_len,erp_len;
+	struct ieee80211_crypt_data* crypt;
+
+	char *ssid = ieee->current_network.ssid;
+	int ssid_len = ieee->current_network.ssid_len;
+	int rate_len = ieee->current_network.rates_len+2;
+	int rate_ex_len = ieee->current_network.rates_ex_len;
+	int wpa_ie_len = ieee->wpa_ie_len;
+	if(rate_ex_len > 0) rate_ex_len+=2;
+
+	if(ieee->current_network.capability & WLAN_CAPABILITY_IBSS)
+		atim_len = 4;
+	else
+		atim_len = 0;
+
+	if(ieee80211_is_54g(&ieee->current_network))
+		erp_len = 3;
+	else
+		erp_len = 0;
+
+	beacon_size = sizeof(struct ieee80211_probe_response)+
+		ssid_len
+		+3 //channel
+		+rate_len
+		+rate_ex_len
+		+atim_len
+		+wpa_ie_len
+		+erp_len;
+
+	skb = dev_alloc_skb(beacon_size);
+
+	if (!skb)
+		return NULL;
+
+	beacon_buf = (struct ieee80211_probe_response*) skb_put(skb, beacon_size);
+
+	memcpy (beacon_buf->header.addr1, dest,ETH_ALEN);
+	memcpy (beacon_buf->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy (beacon_buf->header.addr3, ieee->current_network.bssid, ETH_ALEN);
+
+	beacon_buf->header.duration_id = 0; //FIXME
+	beacon_buf->beacon_interval =
+		cpu_to_le16(ieee->current_network.beacon_interval);
+	beacon_buf->capability =
+		cpu_to_le16(ieee->current_network.capability & WLAN_CAPABILITY_IBSS);
+
+	if(ieee->short_slot && (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_SLOT))
+		beacon_buf->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
+
+	crypt = ieee->crypt[ieee->tx_keyidx];
+
+	encrypt = ieee->host_encrypt && crypt && crypt->ops &&
+		((0 == strcmp(crypt->ops->name, "WEP")) || wpa_ie_len);
+
+	if (encrypt)
+		beacon_buf->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+
+
+	beacon_buf->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_RESP);
+
+	beacon_buf->info_element.id = MFIE_TYPE_SSID;
+	beacon_buf->info_element.len = ssid_len;
+
+	tag = (u8*) beacon_buf->info_element.data;
+
+	memcpy(tag, ssid, ssid_len);
+
+	tag += ssid_len;
+
+	*(tag++) = MFIE_TYPE_RATES;
+	*(tag++) = rate_len-2;
+	memcpy(tag,ieee->current_network.rates,rate_len-2);
+	tag+=rate_len-2;
+
+	*(tag++) = MFIE_TYPE_DS_SET;
+	*(tag++) = 1;
+	*(tag++) = ieee->current_network.channel;
+
+	if(atim_len){
+		*(tag++) = MFIE_TYPE_IBSS_SET;
+		*(tag++) = 2;
+		*((u16*)(tag)) = cpu_to_le16(ieee->current_network.atim_window);
+		tag+=2;
+	}
+
+	if(erp_len){
+		*(tag++) = MFIE_TYPE_ERP;
+		*(tag++) = 1;
+		*(tag++) = 0;
+	}
+
+	if(rate_ex_len){
+		*(tag++) = MFIE_TYPE_RATES_EX;
+		*(tag++) = rate_ex_len-2;
+		memcpy(tag,ieee->current_network.rates_ex,rate_ex_len-2);
+		tag+=rate_ex_len-2;
+	}
+
+	if (wpa_ie_len)
+	{
+		if (ieee->iw_mode == IW_MODE_ADHOC)
+		{//as Windows will set pairwise key same as the group key which is not allowed in Linux, so set this for IOT issue. WB 2008.07.07
+			memcpy(&ieee->wpa_ie[14], &ieee->wpa_ie[8], 4);
+		}
+
+		memcpy(tag, ieee->wpa_ie, ieee->wpa_ie_len);
+	}
+
+	skb->dev = ieee->dev;
+	return skb;
+}
+
+struct sk_buff* ieee80211_assoc_resp(struct ieee80211_device *ieee, u8 *dest)
+{
+	struct sk_buff *skb;
+	u8* tag;
+
+	struct ieee80211_crypt_data* crypt;
+	struct ieee80211_assoc_response_frame *assoc;
+	short encrypt;
+
+	unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
+	int len = sizeof(struct ieee80211_assoc_response_frame) + rate_len;
+
+	skb = dev_alloc_skb(len);
+
+	if (!skb)
+		return NULL;
+
+	assoc = (struct ieee80211_assoc_response_frame *)
+		skb_put(skb,sizeof(struct ieee80211_assoc_response_frame));
+
+	assoc->header.frame_control = cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP);
+	memcpy(assoc->header.addr1, dest,ETH_ALEN);
+	memcpy(assoc->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(assoc->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	assoc->capability = cpu_to_le16(ieee->iw_mode == IW_MODE_MASTER ?
+		WLAN_CAPABILITY_BSS : WLAN_CAPABILITY_IBSS);
+
+
+	if(ieee->short_slot)
+		assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
+
+	if (ieee->host_encrypt)
+		crypt = ieee->crypt[ieee->tx_keyidx];
+	else crypt = NULL;
+
+	encrypt = ( crypt && crypt->ops);
+
+	if (encrypt)
+		assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+
+	assoc->status = 0;
+	assoc->aid = cpu_to_le16(ieee->assoc_id);
+	if (ieee->assoc_id == 0x2007) ieee->assoc_id=0;
+	else ieee->assoc_id++;
+
+	tag = (u8*) skb_put(skb, rate_len);
+
+	ieee80211_MFIE_Brate(ieee, &tag);
+	ieee80211_MFIE_Grate(ieee, &tag);
+
+	return skb;
+}
+
+struct sk_buff* ieee80211_auth_resp(struct ieee80211_device *ieee,int status, u8 *dest)
+{
+	struct sk_buff *skb;
+	struct ieee80211_authentication *auth;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_authentication)+1);
+
+	if (!skb)
+		return NULL;
+
+	skb->len = sizeof(struct ieee80211_authentication);
+
+	auth = (struct ieee80211_authentication *)skb->data;
+
+	auth->status = cpu_to_le16(status);
+	auth->transaction = cpu_to_le16(2);
+	auth->algorithm = cpu_to_le16(WLAN_AUTH_OPEN);
+
+	memcpy(auth->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr1, dest, ETH_ALEN);
+	auth->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_AUTH);
+	return skb;
+
+
+}
+
+struct sk_buff* ieee80211_null_func(struct ieee80211_device *ieee,short pwr)
+{
+	struct sk_buff *skb;
+	struct ieee80211_hdr_3addr* hdr;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_hdr_3addr));
+
+	if (!skb)
+		return NULL;
+
+	hdr = (struct ieee80211_hdr_3addr*)skb_put(skb,sizeof(struct ieee80211_hdr_3addr));
+
+	memcpy(hdr->addr1, ieee->current_network.bssid, ETH_ALEN);
+	memcpy(hdr->addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(hdr->addr3, ieee->current_network.bssid, ETH_ALEN);
+
+	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+		IEEE80211_STYPE_NULLFUNC | IEEE80211_FCTL_TODS |
+		(pwr ? IEEE80211_FCTL_PM:0));
+
+	return skb;
+
+
+}
+
+
+void ieee80211_resp_to_assoc_rq(struct ieee80211_device *ieee, u8* dest)
+{
+	struct sk_buff *buf = ieee80211_assoc_resp(ieee, dest);
+
+	if (buf){
+		softmac_mgmt_xmit(buf, ieee);
+		dev_kfree_skb_any(buf);//edit by thomas
+	}
+}
+
+
+void ieee80211_resp_to_auth(struct ieee80211_device *ieee, int s, u8* dest)
+{
+	struct sk_buff *buf = ieee80211_auth_resp(ieee, s, dest);
+
+	if (buf){
+		softmac_mgmt_xmit(buf, ieee);
+		dev_kfree_skb_any(buf);//edit by thomas
+	}
+}
+
+
+void ieee80211_resp_to_probe(struct ieee80211_device *ieee, u8 *dest)
+{
+
+	struct sk_buff *buf = ieee80211_probe_resp(ieee, dest);
+
+	if (buf) {
+		softmac_mgmt_xmit(buf, ieee);
+		dev_kfree_skb_any(buf);//edit by thomas
+	}
+}
+
+
+inline struct sk_buff *ieee80211_association_req(struct ieee80211_network *beacon,struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+	//unsigned long flags;
+
+	struct ieee80211_assoc_request_frame *hdr;
+	u8 *tag;
+	//short info_addr = 0;
+	//int i;
+	//u16 suite_count = 0;
+	//u8 suit_select = 0;
+	unsigned int wpa_len = beacon->wpa_ie_len;
+	//struct net_device *dev = ieee->dev;
+	//union iwreq_data wrqu;
+	//u8 *buff;
+	//u8 *p;
+#if 1
+	// for testing purpose
+	unsigned int rsn_len = beacon->rsn_ie_len;
+#else
+	unsigned int rsn_len = beacon->rsn_ie_len - 4;
+#endif
+	unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
+	unsigned int wmm_info_len = beacon->QoS_Enable?9:0;
+	unsigned int turbo_info_len = beacon->Turbo_Enable?9:0;
+
+	u8  encry_proto = ieee->wpax_type_notify & 0xff;
+	//u8  pairwise_type = (ieee->wpax_type_notify >> 8) & 0xff;
+	//u8  authen_type = (ieee->wpax_type_notify >> 16) & 0xff;
+
+	int len = 0;
+
+	//[0] Notify type of encryption: WPA/WPA2
+	//[1] pair wise type
+	//[2] authen type
+	if(ieee->wpax_type_set) {
+		if (IEEE_PROTO_WPA == encry_proto) {
+			rsn_len = 0;
+		} else if (IEEE_PROTO_RSN == encry_proto) {
+			wpa_len = 0;
+		}
+	}
+	len = sizeof(struct ieee80211_assoc_request_frame)+
+		+ beacon->ssid_len//essid tagged val
+		+ rate_len//rates tagged val
+		+ wpa_len
+		+ rsn_len
+		+ wmm_info_len
+		+ turbo_info_len;
+
+	skb = dev_alloc_skb(len);
+
+	if (!skb)
+		return NULL;
+
+	hdr = (struct ieee80211_assoc_request_frame *)
+		skb_put(skb, sizeof(struct ieee80211_assoc_request_frame));
+
+
+	hdr->header.frame_control = IEEE80211_STYPE_ASSOC_REQ;
+	hdr->header.duration_id= 37; //FIXME
+	memcpy(hdr->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(hdr->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(hdr->header.addr3, beacon->bssid, ETH_ALEN);
+	memcpy(ieee->ap_mac_addr, beacon->bssid, ETH_ALEN);//for HW security, John
+
+	hdr->capability = cpu_to_le16(WLAN_CAPABILITY_BSS);
+	if (beacon->capability & WLAN_CAPABILITY_PRIVACY )
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+	if (beacon->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
+
+	if(ieee->short_slot)
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
+
+	hdr->listen_interval = 0xa; //FIXME
+
+	hdr->info_element.id = MFIE_TYPE_SSID;
+
+	hdr->info_element.len = beacon->ssid_len;
+	tag = skb_put(skb, beacon->ssid_len);
+	memcpy(tag, beacon->ssid, beacon->ssid_len);
+
+	tag = skb_put(skb, rate_len);
+
+	ieee80211_MFIE_Brate(ieee, &tag);
+	ieee80211_MFIE_Grate(ieee, &tag);
+
+	//add rsn==0 condition for ap's mix security mode(wpa+wpa2), john2007.8.9
+	//choose AES encryption as default algorithm while using mixed mode
+
+	tag = skb_put(skb,ieee->wpa_ie_len);
+	memcpy(tag,ieee->wpa_ie,ieee->wpa_ie_len);
+
+	tag = skb_put(skb,wmm_info_len);
+	if(wmm_info_len) {
+	  ieee80211_WMM_Info(ieee, &tag);
+	}
+	tag = skb_put(skb,turbo_info_len);
+        if(turbo_info_len) {
+                ieee80211_TURBO_Info(ieee, &tag);
+        }
+
+	return skb;
+}
+
+void ieee80211_associate_abort(struct ieee80211_device *ieee)
+{
+
+	unsigned long flags;
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	ieee->associate_seq++;
+
+	/* don't scan, and avoid to have the RX path possibily
+	 * try again to associate. Even do not react to AUTH or
+	 * ASSOC response. Just wait for the retry wq to be scheduled.
+	 * Here we will check if there are good nets to associate
+	 * with, so we retry or just get back to NO_LINK and scanning
+	 */
+	if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING){
+		IEEE80211_DEBUG_MGMT("Authentication failed\n");
+		ieee->softmac_stats.no_auth_rs++;
+	}else{
+		IEEE80211_DEBUG_MGMT("Association failed\n");
+		ieee->softmac_stats.no_ass_rs++;
+	}
+
+	ieee->state = IEEE80211_ASSOCIATING_RETRY;
+
+	queue_delayed_work(ieee->wq, &ieee->associate_retry_wq,IEEE80211_SOFTMAC_ASSOC_RETRY_TIME);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+void ieee80211_associate_abort_cb(unsigned long dev)
+{
+	ieee80211_associate_abort((struct ieee80211_device *) dev);
+}
+
+
+void ieee80211_associate_step1(struct ieee80211_device *ieee)
+{
+	struct ieee80211_network *beacon = &ieee->current_network;
+	struct sk_buff *skb;
+
+	IEEE80211_DEBUG_MGMT("Stopping scan\n");
+	ieee->softmac_stats.tx_auth_rq++;
+	skb=ieee80211_authentication_req(beacon, ieee, 0);
+	if (!skb){
+
+		ieee80211_associate_abort(ieee);
+	}
+	else{
+		ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATING ;
+		IEEE80211_DEBUG_MGMT("Sending authentication request\n");
+		//printk("---Sending authentication request\n");
+		softmac_mgmt_xmit(skb, ieee);
+		//BUGON when you try to add_timer twice, using mod_timer may be better, john0709
+		if(!timer_pending(&ieee->associate_timer)){
+			ieee->associate_timer.expires = jiffies + (HZ / 2);
+			add_timer(&ieee->associate_timer);
+		}
+		//If call dev_kfree_skb_any,a warning will ocur....
+		//KERNEL: assertion (!atomic_read(&skb->users)) failed at net/core/dev.c (1708)
+		//So ... 1204 by lawrence.
+		//printk("\nIn %s,line %d call kfree skb.",__func__,__LINE__);
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+
+void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
+{
+	u8 *c;
+	struct sk_buff *skb;
+	struct ieee80211_network *beacon = &ieee->current_network;
+//	int hlen = sizeof(struct ieee80211_authentication);
+	del_timer_sync(&ieee->associate_timer);
+	ieee->associate_seq++;
+	ieee->softmac_stats.tx_auth_rq++;
+
+	skb = ieee80211_authentication_req(beacon, ieee, chlen+2);
+	if (!skb)
+		ieee80211_associate_abort(ieee);
+	else{
+		c = skb_put(skb, chlen+2);
+		*(c++) = MFIE_TYPE_CHALLENGE;
+		*(c++) = chlen;
+		memcpy(c, challenge, chlen);
+
+		IEEE80211_DEBUG_MGMT("Sending authentication challenge response\n");
+
+		ieee80211_encrypt_fragment(ieee, skb, sizeof(struct ieee80211_hdr_3addr  ));
+
+		softmac_mgmt_xmit(skb, ieee);
+		if (!timer_pending(&ieee->associate_timer)){
+		//printk("=========>add timer again, to crash\n");
+		ieee->associate_timer.expires = jiffies + (HZ / 2);
+		add_timer(&ieee->associate_timer);
+		}
+		dev_kfree_skb_any(skb);//edit by thomas
+	}
+	kfree(challenge);
+}
+
+void ieee80211_associate_step2(struct ieee80211_device *ieee)
+{
+	struct sk_buff* skb;
+	struct ieee80211_network *beacon = &ieee->current_network;
+
+	del_timer_sync(&ieee->associate_timer);
+
+	IEEE80211_DEBUG_MGMT("Sending association request\n");
+	ieee->softmac_stats.tx_ass_rq++;
+	skb=ieee80211_association_req(beacon, ieee);
+	if (!skb)
+		ieee80211_associate_abort(ieee);
+	else{
+		softmac_mgmt_xmit(skb, ieee);
+		if (!timer_pending(&ieee->associate_timer)){
+		ieee->associate_timer.expires = jiffies + (HZ / 2);
+		add_timer(&ieee->associate_timer);
+		}
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+
+void ieee80211_associate_complete_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_complete_wq);
+
+	printk(KERN_INFO "Associated successfully\n");
+	if(ieee80211_is_54g(&ieee->current_network) &&
+		(ieee->modulation & IEEE80211_OFDM_MODULATION)){
+
+		ieee->rate = 540;
+		printk(KERN_INFO"Using G rates\n");
+	}else{
+		ieee->rate = 110;
+		printk(KERN_INFO"Using B rates\n");
+	}
+	ieee->link_change(ieee->dev);
+	notify_wx_assoc_event(ieee);
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+	netif_carrier_on(ieee->dev);
+}
+
+void ieee80211_associate_complete(struct ieee80211_device *ieee)
+{
+	int i;
+	del_timer_sync(&ieee->associate_timer);
+
+	for(i = 0; i < 6; i++) {
+	  //ieee->seq_ctrl[i] = 0;
+	}
+	ieee->state = IEEE80211_LINKED;
+	IEEE80211_DEBUG_MGMT("Successfully associated\n");
+
+	queue_work(ieee->wq, &ieee->associate_complete_wq);
+}
+
+void ieee80211_associate_procedure_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_procedure_wq);
+
+	ieee->sync_scan_hurryup = 1;
+	down(&ieee->wx_sem);
+
+	if (ieee->data_hard_stop)
+		ieee->data_hard_stop(ieee->dev);
+
+	ieee80211_stop_scan(ieee);
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+
+	ieee->associate_seq = 1;
+	ieee80211_associate_step1(ieee);
+
+	up(&ieee->wx_sem);
+}
+
+inline void ieee80211_softmac_new_net(struct ieee80211_device *ieee, struct ieee80211_network *net)
+{
+	u8 tmp_ssid[IW_ESSID_MAX_SIZE+1];
+	int tmp_ssid_len = 0;
+
+	short apset,ssidset,ssidbroad,apmatch,ssidmatch;
+
+	/* we are interested in new new only if we are not associated
+	 * and we are not associating / authenticating
+	 */
+	if (ieee->state != IEEE80211_NOLINK)
+		return;
+
+	if ((ieee->iw_mode == IW_MODE_INFRA) && !(net->capability & WLAN_CAPABILITY_BSS))
+		return;
+
+	if ((ieee->iw_mode == IW_MODE_ADHOC) && !(net->capability & WLAN_CAPABILITY_IBSS))
+		return;
+
+
+	if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC){
+		/* if the user specified the AP MAC, we need also the essid
+		 * This could be obtained by beacons or, if the network does not
+		 * broadcast it, it can be put manually.
+		 */
+		apset = ieee->wap_set;//(memcmp(ieee->current_network.bssid, zero,ETH_ALEN)!=0 );
+		ssidset = ieee->ssid_set;//ieee->current_network.ssid[0] != '\0';
+		ssidbroad =  !(net->ssid_len == 0 || net->ssid[0]== '\0');
+		apmatch = (memcmp(ieee->current_network.bssid, net->bssid, ETH_ALEN)==0);
+
+		if(ieee->current_network.ssid_len != net->ssid_len)
+			ssidmatch = 0;
+		else
+			ssidmatch = (0==strncmp(ieee->current_network.ssid, net->ssid, net->ssid_len));
+
+		//printk("cur: %s, %d, net:%s, %d\n", ieee->current_network.ssid, ieee->current_network.ssid_len, net->ssid, net->ssid_len);
+		//printk("apset=%d apmatch=%d ssidset=%d ssidbroad=%d ssidmatch=%d\n",apset,apmatch,ssidset,ssidbroad,ssidmatch);
+
+		if (	/* if the user set the AP check if match.
+			 * if the network does not broadcast essid we check the user supplyed ANY essid
+			 * if the network does broadcast and the user does not set essid it is OK
+			 * if the network does broadcast and the user did set essid chech if essid match
+			 */
+				( apset && apmatch &&
+				  ((ssidset && ssidbroad && ssidmatch) || (ssidbroad && !ssidset) || (!ssidbroad && ssidset)) ) ||
+				/* if the ap is not set, check that the user set the bssid
+				 * and the network does bradcast and that those two bssid matches
+				 */
+				(!apset && ssidset && ssidbroad && ssidmatch)
+		   ){
+
+
+			/* if the essid is hidden replace it with the
+			 * essid provided by the user.
+			 */
+			if (!ssidbroad){
+				strncpy(tmp_ssid, ieee->current_network.ssid, IW_ESSID_MAX_SIZE);
+				tmp_ssid_len = ieee->current_network.ssid_len;
+			}
+			memcpy(&ieee->current_network, net, sizeof(struct ieee80211_network));
+
+			if (!ssidbroad){
+				strncpy(ieee->current_network.ssid, tmp_ssid, IW_ESSID_MAX_SIZE);
+				ieee->current_network.ssid_len = tmp_ssid_len;
+			}
+			printk(KERN_INFO"Linking with %s: channel is %d\n",ieee->current_network.ssid,ieee->current_network.channel);
+
+			if (ieee->iw_mode == IW_MODE_INFRA){
+				ieee->state = IEEE80211_ASSOCIATING;
+				ieee->beinretry = false;
+				queue_work(ieee->wq, &ieee->associate_procedure_wq);
+			}else{
+				if(ieee80211_is_54g(&ieee->current_network) &&
+						(ieee->modulation & IEEE80211_OFDM_MODULATION)){
+					ieee->rate = 540;
+					printk(KERN_INFO"Using G rates\n");
+				}else{
+					ieee->rate = 110;
+					printk(KERN_INFO"Using B rates\n");
+				}
+				ieee->state = IEEE80211_LINKED;
+				ieee->beinretry = false;
+			}
+
+		}
+	}
+
+}
+
+void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	struct ieee80211_network *target;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	list_for_each_entry(target, &ieee->network_list, list) {
+
+		/* if the state become different that NOLINK means
+		 * we had found what we are searching for
+		 */
+
+		if (ieee->state != IEEE80211_NOLINK)
+			break;
+
+		if (ieee->scan_age == 0 || time_after(target->last_scanned + ieee->scan_age, jiffies))
+			ieee80211_softmac_new_net(ieee, target);
+	}
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+
+static inline u16 auth_parse(struct sk_buff *skb, u8** challenge, int *chlen)
+{
+	struct ieee80211_authentication *a;
+	u8 *t;
+	if (skb->len <  (sizeof(struct ieee80211_authentication)-sizeof(struct ieee80211_info_element))){
+		IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n",skb->len);
+		return 0xcafe;
+	}
+	*challenge = NULL;
+	a = (struct ieee80211_authentication*) skb->data;
+	if(skb->len > (sizeof(struct ieee80211_authentication) +3)){
+		t = skb->data + sizeof(struct ieee80211_authentication);
+
+		if(*(t++) == MFIE_TYPE_CHALLENGE){
+			*chlen = *(t++);
+			*challenge = kmemdup(t, *chlen, GFP_ATOMIC);
+			if (!*challenge)
+				return -ENOMEM;
+		}
+	}
+
+	return cpu_to_le16(a->status);
+
+}
+
+
+int auth_rq_parse(struct sk_buff *skb,u8* dest)
+{
+	struct ieee80211_authentication *a;
+
+	if (skb->len <  (sizeof(struct ieee80211_authentication)-sizeof(struct ieee80211_info_element))){
+		IEEE80211_DEBUG_MGMT("invalid len in auth request: %d\n",skb->len);
+		return -1;
+	}
+	a = (struct ieee80211_authentication*) skb->data;
+
+	memcpy(dest,a->header.addr2, ETH_ALEN);
+
+	if (le16_to_cpu(a->algorithm) != WLAN_AUTH_OPEN)
+		return  WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
+
+	return WLAN_STATUS_SUCCESS;
+}
+
+static short probe_rq_parse(struct ieee80211_device *ieee, struct sk_buff *skb, u8 *src)
+{
+	u8 *tag;
+	u8 *skbend;
+	u8 *ssid=NULL;
+	u8 ssidlen = 0;
+
+	struct ieee80211_hdr_3addr   *header =
+		(struct ieee80211_hdr_3addr   *) skb->data;
+
+	if (skb->len < sizeof (struct ieee80211_hdr_3addr  ))
+		return -1; /* corrupted */
+
+	memcpy(src,header->addr2, ETH_ALEN);
+
+	skbend = (u8*)skb->data + skb->len;
+
+	tag = skb->data + sizeof (struct ieee80211_hdr_3addr  );
+
+	while (tag+1 < skbend){
+		if (*tag == 0){
+			ssid = tag+2;
+			ssidlen = *(tag+1);
+			break;
+		}
+		tag++; /* point to the len field */
+		tag = tag + *(tag); /* point to the last data byte of the tag */
+		tag++; /* point to the next tag */
+	}
+
+	//IEEE80211DMESG("Card MAC address is "MACSTR, MAC2STR(src));
+	if (ssidlen == 0) return 1;
+
+	if (!ssid) return 1; /* ssid not found in tagged param */
+	return (!strncmp(ssid, ieee->current_network.ssid, ssidlen));
+
+}
+
+int assoc_rq_parse(struct sk_buff *skb,u8* dest)
+{
+	struct ieee80211_assoc_request_frame *a;
+
+	if (skb->len < (sizeof(struct ieee80211_assoc_request_frame) -
+		sizeof(struct ieee80211_info_element))) {
+
+		IEEE80211_DEBUG_MGMT("invalid len in auth request:%d \n", skb->len);
+		return -1;
+	}
+
+	a = (struct ieee80211_assoc_request_frame*) skb->data;
+
+	memcpy(dest,a->header.addr2,ETH_ALEN);
+
+	return 0;
+}
+
+static inline u16 assoc_parse(struct sk_buff *skb, int *aid)
+{
+	struct ieee80211_assoc_response_frame *a;
+	if (skb->len <  sizeof(struct ieee80211_assoc_response_frame)){
+		IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n", skb->len);
+		return 0xcafe;
+	}
+
+	a = (struct ieee80211_assoc_response_frame*) skb->data;
+	*aid = le16_to_cpu(a->aid) & 0x3fff;
+	return le16_to_cpu(a->status);
+}
+
+static inline void
+ieee80211_rx_probe_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	u8 dest[ETH_ALEN];
+
+	//IEEE80211DMESG("Rx probe");
+	ieee->softmac_stats.rx_probe_rq++;
+	//DMESG("Dest is "MACSTR, MAC2STR(dest));
+	if (probe_rq_parse(ieee, skb, dest)){
+		//IEEE80211DMESG("Was for me!");
+		ieee->softmac_stats.tx_probe_rs++;
+		ieee80211_resp_to_probe(ieee, dest);
+	}
+}
+
+inline void
+ieee80211_rx_auth_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	u8 dest[ETH_ALEN];
+	int status;
+	//IEEE80211DMESG("Rx probe");
+	ieee->softmac_stats.rx_auth_rq++;
+
+	status = auth_rq_parse(skb, dest);
+	if (status != -1) {
+		ieee80211_resp_to_auth(ieee, status, dest);
+	}
+	//DMESG("Dest is "MACSTR, MAC2STR(dest));
+
+}
+
+ inline void
+ieee80211_rx_assoc_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+
+	u8 dest[ETH_ALEN];
+	//unsigned long flags;
+
+	ieee->softmac_stats.rx_ass_rq++;
+	if (assoc_rq_parse(skb,dest) != -1){
+		ieee80211_resp_to_assoc_rq(ieee, dest);
+	}
+
+	printk(KERN_INFO"New client associated: %pM\n", dest);
+}
+
+
+
+void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, short pwr)
+{
+
+	struct sk_buff *buf = ieee80211_null_func(ieee, pwr);
+
+	if (buf)
+		softmac_ps_mgmt_xmit(buf, ieee);
+
+}
+
+
+short ieee80211_sta_ps_sleep(struct ieee80211_device *ieee, u32 *time_h, u32 *time_l)
+{
+        int timeout = 0;
+
+	u8 dtim;
+	/*if(ieee->ps == IEEE80211_PS_DISABLED ||
+		ieee->iw_mode != IW_MODE_INFRA ||
+		ieee->state != IEEE80211_LINKED)
+
+		return 0;
+	*/
+	dtim = ieee->current_network.dtim_data;
+	//printk("DTIM\n");
+
+	if(!(dtim & IEEE80211_DTIM_VALID))
+		return 0;
+        else
+                timeout = ieee->current_network.beacon_interval;
+
+	//printk("VALID\n");
+	ieee->current_network.dtim_data = IEEE80211_DTIM_INVALID;
+
+	if(dtim & ((IEEE80211_DTIM_UCAST | IEEE80211_DTIM_MBCAST)& ieee->ps))
+		return 2;
+
+	if(!time_after(jiffies, ieee->dev->trans_start + MSECS(timeout)))
+		return 0;
+
+	if(!time_after(jiffies, ieee->last_rx_ps_time + MSECS(timeout)))
+		return 0;
+
+	if((ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE ) &&
+		(ieee->mgmt_queue_tail != ieee->mgmt_queue_head))
+		return 0;
+
+	if(time_l){
+		*time_l = ieee->current_network.last_dtim_sta_time[0]
+			+ MSECS((ieee->current_network.beacon_interval));
+			//* ieee->current_network.dtim_period));
+			//printk("beacon_interval:%x, dtim_period:%x, totol to Msecs:%x, HZ:%x\n", ieee->current_network.beacon_interval, ieee->current_network.dtim_period, MSECS(((ieee->current_network.beacon_interval * ieee->current_network.dtim_period))), HZ);
+	}
+
+	if(time_h){
+		*time_h = ieee->current_network.last_dtim_sta_time[1];
+		if(time_l && *time_l < ieee->current_network.last_dtim_sta_time[0])
+			*time_h += 1;
+	}
+
+	return 1;
+
+
+}
+
+inline void ieee80211_sta_ps(struct ieee80211_device *ieee)
+{
+
+	u32 th,tl;
+	short sleep;
+
+	unsigned long flags,flags2;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if((ieee->ps == IEEE80211_PS_DISABLED ||
+
+		ieee->iw_mode != IW_MODE_INFRA ||
+		ieee->state != IEEE80211_LINKED)){
+
+		//#warning CHECK_LOCK_HERE
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+		ieee80211_sta_wakeup(ieee, 1);
+
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+	}
+
+	sleep = ieee80211_sta_ps_sleep(ieee,&th, &tl);
+//	printk("===>%s,%d[2 wake, 1 sleep, 0 do nothing], ieee->sta_sleep = %d\n",__func__, sleep,ieee->sta_sleep);
+	/* 2 wake, 1 sleep, 0 do nothing */
+	if(sleep == 0)
+		goto out;
+
+	if(sleep == 1){
+
+		if(ieee->sta_sleep == 1)
+			ieee->enter_sleep_state(ieee->dev,th,tl);
+
+		else if(ieee->sta_sleep == 0){
+	//		printk("send null 1\n");
+			spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+			if(ieee->ps_is_queue_empty(ieee->dev)){
+
+
+				ieee->sta_sleep = 2;
+
+				ieee->ps_request_tx_ack(ieee->dev);
+
+				ieee80211_sta_ps_send_null_frame(ieee,1);
+
+				ieee->ps_th = th;
+				ieee->ps_tl = tl;
+			}
+			spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+
+		}
+
+
+	}else if(sleep == 2){
+//#warning CHECK_LOCK_HERE
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+	//	printk("send wakeup packet\n");
+		ieee80211_sta_wakeup(ieee,1);
+
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+	}
+
+out:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl)
+{
+	if(ieee->sta_sleep == 0){
+		if(nl){
+		//	printk("Warning: driver is probably failing to report TX ps error\n");
+			ieee->ps_request_tx_ack(ieee->dev);
+			ieee80211_sta_ps_send_null_frame(ieee, 0);
+		}
+		return;
+
+	}
+
+	if(ieee->sta_sleep == 1)
+		ieee->sta_wake_up(ieee->dev);
+
+	ieee->sta_sleep = 0;
+
+	if(nl){
+		ieee->ps_request_tx_ack(ieee->dev);
+		ieee80211_sta_ps_send_null_frame(ieee, 0);
+	}
+}
+
+void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success)
+{
+	unsigned long flags,flags2;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	if(ieee->sta_sleep == 2){
+		/* Null frame with PS bit set */
+		if(success){
+
+		//	printk("==================> %s::enter sleep state\n",__func__);
+			ieee->sta_sleep = 1;
+			ieee->enter_sleep_state(ieee->dev,ieee->ps_th,ieee->ps_tl);
+		}
+		/* if the card report not success we can't be sure the AP
+		 * has not RXed so we can't assume the AP believe us awake
+		 */
+	}
+	/* 21112005 - tx again null without PS bit if lost */
+	else {
+
+		if((ieee->sta_sleep == 0) && !success){
+			spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+			ieee80211_sta_ps_send_null_frame(ieee, 0);
+			spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+		}
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+inline int
+ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype)
+{
+	struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *) skb->data;
+	u16 errcode;
+	u8* challenge=NULL;
+	int chlen=0;
+	int aid=0;
+	struct ieee80211_assoc_response_frame *assoc_resp;
+	struct ieee80211_info_element *info_element;
+
+	if(!ieee->proto_started)
+		return 0;
+
+	if(ieee->sta_sleep || (ieee->ps != IEEE80211_PS_DISABLED &&
+		ieee->iw_mode == IW_MODE_INFRA &&
+		ieee->state == IEEE80211_LINKED))
+
+		tasklet_schedule(&ieee->ps_task);
+
+	if (WLAN_FC_GET_STYPE(header->frame_control) != IEEE80211_STYPE_PROBE_RESP &&
+		WLAN_FC_GET_STYPE(header->frame_control) != IEEE80211_STYPE_BEACON)
+		ieee->last_rx_ps_time = jiffies;
+
+	switch (WLAN_FC_GET_STYPE(header->frame_control)) {
+
+		case IEEE80211_STYPE_ASSOC_RESP:
+		case IEEE80211_STYPE_REASSOC_RESP:
+
+			IEEE80211_DEBUG_MGMT("received [RE]ASSOCIATION RESPONSE (%d)\n",
+					WLAN_FC_GET_STYPE(header->frame_ctl));
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATED &&
+				ieee->iw_mode == IW_MODE_INFRA){
+				if (0 == (errcode=assoc_parse(skb, &aid))){
+					u16 left;
+
+					ieee->state=IEEE80211_LINKED;
+					ieee->assoc_id = aid;
+					ieee->softmac_stats.rx_ass_ok++;
+
+					//printk(KERN_WARNING "nic_type = %s", (rx_stats->nic_type == 1)?"rtl8187":"rtl8187B");
+					if(1 == rx_stats->nic_type) //card type is 8187
+					{
+						goto associate_complete;
+					}
+					assoc_resp = (struct ieee80211_assoc_response_frame*)skb->data;
+					info_element = 	&assoc_resp->info_element;
+					left = skb->len - ((void*)info_element - (void*)assoc_resp);
+
+					while (left >= sizeof(struct ieee80211_info_element_hdr)) {
+						if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
+							printk(KERN_WARNING "[re]associate reeponse error!");
+							return 1;
+						}
+						switch (info_element->id) {
+						  case MFIE_TYPE_GENERIC:
+						         IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n", info_element->len);
+							if (info_element->len >= 8  &&
+							    info_element->data[0] == 0x00 &&
+							    info_element->data[1] == 0x50 &&
+							    info_element->data[2] == 0xf2 &&
+							    info_element->data[3] == 0x02 &&
+							    info_element->data[4] == 0x01) {
+							    // Not care about version at present.
+							    //WMM Parameter Element
+							    memcpy(ieee->current_network.wmm_param,(u8*)(info_element->data\
+										    + 8),(info_element->len - 8));
+
+					 	            if (((ieee->current_network.wmm_info^info_element->data[6])& \
+										    0x0f)||(!ieee->init_wmmparam_flag)) {
+						   	      // refresh parameter element for current network
+							      // update the register parameter for hardware
+							      ieee->init_wmmparam_flag = 1;
+							      queue_work(ieee->wq, &ieee->wmm_param_update_wq);
+
+						            }
+						            //update info_element for current network
+						            ieee->current_network.wmm_info  = info_element->data[6];
+							}
+							break;
+						  default:
+							//nothing to do at present!!!
+							break;
+						}
+
+						left -= sizeof(struct ieee80211_info_element_hdr) +
+							info_element->len;
+						info_element = (struct ieee80211_info_element *)
+							&info_element->data[info_element->len];
+					}
+					if(!ieee->init_wmmparam_flag) //legacy AP, reset the AC_xx_param register
+					{
+						queue_work(ieee->wq,&ieee->wmm_param_update_wq);
+						ieee->init_wmmparam_flag = 1;//indicate AC_xx_param upated since last associate
+					}
+associate_complete:
+					ieee80211_associate_complete(ieee);
+				}else{
+					ieee->softmac_stats.rx_ass_err++;
+					IEEE80211_DEBUG_MGMT(
+						"Association response status code 0x%x\n",
+						errcode);
+					ieee80211_associate_abort(ieee);
+				}
+			}
+			break;
+
+		case IEEE80211_STYPE_ASSOC_REQ:
+		case IEEE80211_STYPE_REASSOC_REQ:
+
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				ieee->iw_mode == IW_MODE_MASTER)
+
+				ieee80211_rx_assoc_rq(ieee, skb);
+			break;
+
+		case IEEE80211_STYPE_AUTH:
+
+			if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE){
+				if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING &&
+				ieee->iw_mode == IW_MODE_INFRA){
+
+						IEEE80211_DEBUG_MGMT("Received authentication response");
+
+						if (0 == (errcode=auth_parse(skb, &challenge, &chlen))){
+							if(ieee->open_wep || !challenge){
+								ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATED;
+								ieee->softmac_stats.rx_auth_rs_ok++;
+
+								ieee80211_associate_step2(ieee);
+							}else{
+								ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
+							}
+						}else{
+							ieee->softmac_stats.rx_auth_rs_err++;
+							IEEE80211_DEBUG_MGMT("Authentication respose status code 0x%x",errcode);
+							ieee80211_associate_abort(ieee);
+						}
+
+					}else if (ieee->iw_mode == IW_MODE_MASTER){
+						ieee80211_rx_auth_rq(ieee, skb);
+					}
+				}
+			break;
+
+		case IEEE80211_STYPE_PROBE_REQ:
+
+			if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) &&
+				((ieee->iw_mode == IW_MODE_ADHOC ||
+				ieee->iw_mode == IW_MODE_MASTER) &&
+				ieee->state == IEEE80211_LINKED))
+
+				ieee80211_rx_probe_rq(ieee, skb);
+			break;
+
+		case IEEE80211_STYPE_DISASSOC:
+		case IEEE80211_STYPE_DEAUTH:
+			/* FIXME for now repeat all the association procedure
+			* both for disassociation and deauthentication
+			*/
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				(ieee->state == IEEE80211_LINKED) &&
+				(ieee->iw_mode == IW_MODE_INFRA) &&
+				(!memcmp(header->addr2,ieee->current_network.bssid,ETH_ALEN))){
+				ieee->state = IEEE80211_ASSOCIATING;
+				ieee->softmac_stats.reassoc++;
+
+				//notify_wx_assoc_event(ieee);  //YJ,del,080828, do not notify os here
+				queue_work(ieee->wq, &ieee->associate_procedure_wq);
+			}
+
+			break;
+
+		default:
+			return -1;
+			break;
+	}
+
+	//dev_kfree_skb_any(skb);
+	return 0;
+}
+
+
+
+/* following are for a simpler TX queue management.
+ * Instead of using netif_[stop/wake]_queue the driver
+ * will uses these two function (plus a reset one), that
+ * will internally uses the kernel netif_* and takes
+ * care of the ieee802.11 fragmentation.
+ * So the driver receives a fragment per time and might
+ * call the stop function when it want without take care
+ * to have enough room to TX an entire packet.
+ * This might be useful if each fragment need it's own
+ * descriptor, thus just keep a total free memory > than
+ * the max fragmentation threshold is not enough.. If the
+ * ieee802.11 stack passed a TXB struct then you needed
+ * to keep N free descriptors where
+ * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
+ * In this way you need just one and the 802.11 stack
+ * will take care of buffering fragments and pass them to
+ * to the driver later, when it wakes the queue.
+ */
+
+void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *ieee)
+{
+
+
+	unsigned long flags;
+	int  i;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+
+	/* called with 2nd parm 0, no tx mgmt lock required */
+	ieee80211_sta_wakeup(ieee,0);
+
+	for(i = 0; i < txb->nr_frags; i++) {
+
+		if (ieee->queue_stop){
+			ieee->tx_pending.txb = txb;
+			ieee->tx_pending.frag = i;
+			goto exit;
+		}else{
+			ieee->softmac_data_hard_start_xmit(
+				txb->fragments[i],
+				ieee->dev,ieee->rate);
+				//(i+1)<txb->nr_frags);
+			ieee->stats.tx_packets++;
+			ieee->stats.tx_bytes += txb->fragments[i]->len;
+			ieee->dev->trans_start = jiffies;
+		}
+	}
+
+	ieee80211_txb_free(txb);
+
+	exit:
+	spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+/* called with ieee->lock acquired */
+void ieee80211_resume_tx(struct ieee80211_device *ieee)
+{
+	int i;
+	for(i = ieee->tx_pending.frag; i < ieee->tx_pending.txb->nr_frags; i++) {
+
+		if (ieee->queue_stop){
+			ieee->tx_pending.frag = i;
+			return;
+		}else{
+
+			ieee->softmac_data_hard_start_xmit(
+				ieee->tx_pending.txb->fragments[i],
+				ieee->dev,ieee->rate);
+				//(i+1)<ieee->tx_pending.txb->nr_frags);
+			ieee->stats.tx_packets++;
+			ieee->dev->trans_start = jiffies;
+		}
+	}
+
+
+	ieee80211_txb_free(ieee->tx_pending.txb);
+	ieee->tx_pending.txb = NULL;
+}
+
+
+void ieee80211_reset_queue(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+	init_mgmt_queue(ieee);
+	if (ieee->tx_pending.txb){
+		ieee80211_txb_free(ieee->tx_pending.txb);
+		ieee->tx_pending.txb = NULL;
+	}
+	ieee->queue_stop = 0;
+	spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
+{
+
+	unsigned long flags;
+	struct sk_buff *skb;
+	struct ieee80211_hdr_3addr  *header;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+	if (! ieee->queue_stop) goto exit;
+
+	ieee->queue_stop = 0;
+
+	if(ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE){
+		while (!ieee->queue_stop && (skb = dequeue_mgmt(ieee))){
+
+			header = (struct ieee80211_hdr_3addr  *) skb->data;
+
+			header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+			if (ieee->seq_ctrl[0] == 0xFFF)
+				ieee->seq_ctrl[0] = 0;
+			else
+				ieee->seq_ctrl[0]++;
+
+			//printk(KERN_ALERT "ieee80211_wake_queue \n");
+			ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+			dev_kfree_skb_any(skb);//edit by thomas
+		}
+	}
+	if (!ieee->queue_stop && ieee->tx_pending.txb)
+		ieee80211_resume_tx(ieee);
+
+	if (!ieee->queue_stop && netif_queue_stopped(ieee->dev)){
+		ieee->softmac_stats.swtxawake++;
+		netif_wake_queue(ieee->dev);
+	}
+
+exit :
+	spin_unlock_irqrestore(&ieee->lock,flags);
+}
+
+
+void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
+{
+	//unsigned long flags;
+	//spin_lock_irqsave(&ieee->lock,flags);
+
+	if (! netif_queue_stopped(ieee->dev)){
+		netif_stop_queue(ieee->dev);
+		ieee->softmac_stats.swtxstop++;
+	}
+	ieee->queue_stop = 1;
+	//spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+
+inline void ieee80211_randomize_cell(struct ieee80211_device *ieee)
+{
+
+	get_random_bytes(ieee->current_network.bssid, ETH_ALEN);
+
+	/* an IBSS cell address must have the two less significant
+	 * bits of the first byte = 2
+	 */
+	ieee->current_network.bssid[0] &= ~0x01;
+	ieee->current_network.bssid[0] |= 0x02;
+}
+
+/* called in user context only */
+void ieee80211_start_master_bss(struct ieee80211_device *ieee)
+{
+	ieee->assoc_id = 1;
+
+	if (ieee->current_network.ssid_len == 0){
+		strncpy(ieee->current_network.ssid,
+			IEEE80211_DEFAULT_TX_ESSID,
+			IW_ESSID_MAX_SIZE);
+
+		ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
+		ieee->ssid_set = 1;
+	}
+
+	memcpy(ieee->current_network.bssid, ieee->dev->dev_addr, ETH_ALEN);
+
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	ieee->state = IEEE80211_LINKED;
+	ieee->link_change(ieee->dev);
+	notify_wx_assoc_event(ieee);
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+
+	netif_carrier_on(ieee->dev);
+}
+
+void ieee80211_start_monitor_mode(struct ieee80211_device *ieee)
+{
+	if(ieee->raw_tx){
+
+		if (ieee->data_hard_resume)
+			ieee->data_hard_resume(ieee->dev);
+
+		netif_carrier_on(ieee->dev);
+	}
+}
+
+void ieee80211_start_ibss_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, start_ibss_wq);
+
+	/* iwconfig mode ad-hoc will schedule this and return
+	 * on the other hand this will block further iwconfig SET
+	 * operations because of the wx_sem hold.
+	 * Anyway some most set operations set a flag to speed-up
+	 * (abort) this wq (when syncro scanning) before sleeping
+	 * on the semaphore
+	 */
+
+	down(&ieee->wx_sem);
+
+
+	if (ieee->current_network.ssid_len == 0){
+		strcpy(ieee->current_network.ssid,IEEE80211_DEFAULT_TX_ESSID);
+		ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
+		ieee->ssid_set = 1;
+	}
+
+	/* check if we have this cell in our network list */
+	ieee80211_softmac_check_all_nets(ieee);
+
+	if(ieee->state == IEEE80211_NOLINK)
+		ieee->current_network.channel = 10;
+	/* if not then the state is not linked. Maybe the user swithced to
+	 * ad-hoc mode just after being in monitor mode, or just after
+	 * being very few time in managed mode (so the card have had no
+	 * time to scan all the chans..) or we have just run up the iface
+	 * after setting ad-hoc mode. So we have to give another try..
+	 * Here, in ibss mode, should be safe to do this without extra care
+	 * (in bss mode we had to make sure no-one tryed to associate when
+	 * we had just checked the ieee->state and we was going to start the
+	 * scan) beacause in ibss mode the ieee80211_new_net function, when
+	 * finds a good net, just set the ieee->state to IEEE80211_LINKED,
+	 * so, at worst, we waste a bit of time to initiate an unneeded syncro
+	 * scan, that will stop at the first round because it sees the state
+	 * associated.
+	 */
+	if (ieee->state == IEEE80211_NOLINK)
+		ieee80211_start_scan_syncro(ieee);
+
+	/* the network definitively is not here.. create a new cell */
+	if (ieee->state == IEEE80211_NOLINK){
+		printk("creating new IBSS cell\n");
+		if(!ieee->wap_set)
+			ieee80211_randomize_cell(ieee);
+
+		if(ieee->modulation & IEEE80211_CCK_MODULATION){
+
+			ieee->current_network.rates_len = 4;
+
+			ieee->current_network.rates[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+			ieee->current_network.rates[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+			ieee->current_network.rates[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+			ieee->current_network.rates[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+
+		}else
+			ieee->current_network.rates_len = 0;
+
+		if(ieee->modulation & IEEE80211_OFDM_MODULATION){
+			ieee->current_network.rates_ex_len = 8;
+
+			ieee->current_network.rates_ex[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+			ieee->current_network.rates_ex[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+			ieee->current_network.rates_ex[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+			ieee->current_network.rates_ex[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+			ieee->current_network.rates_ex[4] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+			ieee->current_network.rates_ex[5] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+			ieee->current_network.rates_ex[6] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+			ieee->current_network.rates_ex[7] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+
+			ieee->rate = 540;
+		}else{
+			ieee->current_network.rates_ex_len = 0;
+			ieee->rate = 110;
+		}
+
+		// By default, WMM function will be disabled in IBSS mode
+		ieee->current_network.QoS_Enable = 0;
+
+		ieee->current_network.atim_window = 0;
+		ieee->current_network.capability = WLAN_CAPABILITY_IBSS;
+		if(ieee->short_slot)
+			ieee->current_network.capability |= WLAN_CAPABILITY_SHORT_SLOT;
+
+	}
+
+	ieee->state = IEEE80211_LINKED;
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	ieee->link_change(ieee->dev);
+
+	notify_wx_assoc_event(ieee);
+
+	ieee80211_start_send_beacons(ieee);
+	printk(KERN_WARNING "after sending beacon packet!\n");
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+
+	netif_carrier_on(ieee->dev);
+
+	up(&ieee->wx_sem);
+}
+inline void ieee80211_start_ibss(struct ieee80211_device *ieee)
+{
+	queue_delayed_work(ieee->wq, &ieee->start_ibss_wq, 100);
+}
+
+/* this is called only in user context, with wx_sem held */
+void ieee80211_start_bss(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	//
+	// Ref: 802.11d 11.1.3.3
+	// STA shall not start a BSS unless properly formed Beacon frame including a Country IE.
+	//
+	if(IS_DOT11D_ENABLE(ieee) && !IS_COUNTRY_IE_VALID(ieee))
+	{
+		if(! ieee->bGlobalDomain)
+		{
+			return;
+		}
+	}
+	/* check if we have already found the net we
+	 * are interested in (if any).
+	 * if not (we are disassociated and we are not
+	 * in associating / authenticating phase) start the background scanning.
+	 */
+	ieee80211_softmac_check_all_nets(ieee);
+
+	/* ensure no-one start an associating process (thus setting
+	 * the ieee->state to ieee80211_ASSOCIATING) while we
+	 * have just cheked it and we are going to enable scan.
+	 * The ieee80211_new_net function is always called with
+	 * lock held (from both ieee80211_softmac_check_all_nets and
+	 * the rx path), so we cannot be in the middle of such function
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+//#ifdef ENABLE_IPS
+//	printk("start bss ENABLE_IPS\n");
+//#else
+	if (ieee->state == IEEE80211_NOLINK){
+		ieee->actscanning = true;
+		ieee80211_rtl_start_scan(ieee);
+	}
+//#endif
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+/* called only in userspace context */
+void ieee80211_disassociate(struct ieee80211_device *ieee)
+{
+	netif_carrier_off(ieee->dev);
+
+	if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)
+			ieee80211_reset_queue(ieee);
+
+	if (ieee->data_hard_stop)
+			ieee->data_hard_stop(ieee->dev);
+
+	if(IS_DOT11D_ENABLE(ieee))
+		Dot11d_Reset(ieee);
+
+	ieee->link_change(ieee->dev);
+	if (ieee->state == IEEE80211_LINKED)
+		notify_wx_assoc_event(ieee);
+	ieee->state = IEEE80211_NOLINK;
+
+}
+void ieee80211_associate_retry_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, associate_retry_wq);
+	unsigned long flags;
+	down(&ieee->wx_sem);
+	if(!ieee->proto_started)
+		goto exit;
+	if(ieee->state != IEEE80211_ASSOCIATING_RETRY)
+		goto exit;
+	/* until we do not set the state to IEEE80211_NOLINK
+	* there are no possibility to have someone else trying
+	* to start an association procdure (we get here with
+	* ieee->state = IEEE80211_ASSOCIATING).
+	* When we set the state to IEEE80211_NOLINK it is possible
+	* that the RX path run an attempt to associate, but
+	* both ieee80211_softmac_check_all_nets and the
+	* RX path works with ieee->lock held so there are no
+	* problems. If we are still disassociated then start a scan.
+	* the lock here is necessary to ensure no one try to start
+	* an association procedure when we have just checked the
+	* state and we are going to start the scan.
+	*/
+	ieee->state = IEEE80211_NOLINK;
+	ieee->beinretry = true;
+	ieee80211_softmac_check_all_nets(ieee);
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(ieee->state == IEEE80211_NOLINK){
+		ieee->beinretry = false;
+		ieee->actscanning = true;
+		ieee80211_rtl_start_scan(ieee);
+	}
+	//YJ,add,080828, notify os here
+	if(ieee->state == IEEE80211_NOLINK)
+	{
+		notify_wx_assoc_event(ieee);
+	}
+	//YJ,add,080828,end
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+exit:
+	up(&ieee->wx_sem);
+}
+
+struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee)
+{
+	u8 broadcast_addr[] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+	struct sk_buff *skb = NULL;
+	struct ieee80211_probe_response *b;
+
+	skb = ieee80211_probe_resp(ieee, broadcast_addr);
+	if (!skb)
+		return NULL;
+
+	b = (struct ieee80211_probe_response *) skb->data;
+	b->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_BEACON);
+
+	return skb;
+
+}
+
+struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+	struct ieee80211_probe_response *b;
+
+	skb = ieee80211_get_beacon_(ieee);
+	if(!skb)
+		return NULL;
+
+	b = (struct ieee80211_probe_response *) skb->data;
+	b->header.seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+	if (ieee->seq_ctrl[0] == 0xFFF)
+		ieee->seq_ctrl[0] = 0;
+	else
+		ieee->seq_ctrl[0]++;
+
+	return skb;
+}
+
+void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee)
+{
+	ieee->sync_scan_hurryup = 1;
+	down(&ieee->wx_sem);
+	ieee80211_stop_protocol(ieee);
+	up(&ieee->wx_sem);
+}
+
+
+void ieee80211_stop_protocol(struct ieee80211_device *ieee)
+{
+	if (!ieee->proto_started)
+		return;
+
+	ieee->proto_started = 0;
+
+	ieee80211_stop_send_beacons(ieee);
+	if((ieee->iw_mode == IW_MODE_INFRA)&&(ieee->state == IEEE80211_LINKED)) {
+		SendDisassociation(ieee,NULL,WLAN_REASON_DISASSOC_STA_HAS_LEFT);
+	}
+	del_timer_sync(&ieee->associate_timer);
+	cancel_delayed_work(&ieee->associate_retry_wq);
+	cancel_delayed_work(&ieee->start_ibss_wq);
+	ieee80211_stop_scan(ieee);
+
+	ieee80211_disassociate(ieee);
+}
+
+void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee)
+{
+	ieee->sync_scan_hurryup = 0;
+	down(&ieee->wx_sem);
+	ieee80211_start_protocol(ieee);
+	up(&ieee->wx_sem);
+}
+
+void ieee80211_start_protocol(struct ieee80211_device *ieee)
+{
+	short ch = 0;
+ 	int i = 0;
+
+	if (ieee->proto_started)
+		return;
+
+	ieee->proto_started = 1;
+
+	if (ieee->current_network.channel == 0){
+		do{
+			ch++;
+			if (ch > MAX_CHANNEL_NUMBER)
+				return; /* no channel found */
+
+		}while(!GET_DOT11D_INFO(ieee)->channel_map[ch]);
+
+		ieee->current_network.channel = ch;
+	}
+
+	if (ieee->current_network.beacon_interval == 0)
+		ieee->current_network.beacon_interval = 100;
+	ieee->set_chan(ieee->dev,ieee->current_network.channel);
+
+       	for(i = 0; i < 17; i++) {
+	  ieee->last_rxseq_num[i] = -1;
+	  ieee->last_rxfrag_num[i] = -1;
+	  ieee->last_packet_time[i] = 0;
+	}
+
+	ieee->init_wmmparam_flag = 0;//reinitialize AC_xx_PARAM registers.
+
+
+	/* if the user set the MAC of the ad-hoc cell and then
+	 * switch to managed mode, shall we  make sure that association
+	 * attempts does not fail just because the user provide the essid
+	 * and the nic is still checking for the AP MAC ??
+	 */
+	switch (ieee->iw_mode) {
+		case IW_MODE_AUTO:
+			ieee->iw_mode = IW_MODE_INFRA;
+			//not set break here intentionly
+		case IW_MODE_INFRA:
+			ieee80211_start_bss(ieee);
+			break;
+
+		case IW_MODE_ADHOC:
+			ieee80211_start_ibss(ieee);
+			break;
+
+		case IW_MODE_MASTER:
+			ieee80211_start_master_bss(ieee);
+		break;
+
+		case IW_MODE_MONITOR:
+			ieee80211_start_monitor_mode(ieee);
+			break;
+
+		default:
+			ieee->iw_mode = IW_MODE_INFRA;
+			ieee80211_start_bss(ieee);
+			break;
+	}
+}
+
+
+#define DRV_NAME  "Ieee80211"
+void ieee80211_softmac_init(struct ieee80211_device *ieee)
+{
+	int i;
+	memset(&ieee->current_network, 0, sizeof(struct ieee80211_network));
+
+	ieee->state = IEEE80211_NOLINK;
+	ieee->sync_scan_hurryup = 0;
+	for(i = 0; i < 5; i++) {
+	  ieee->seq_ctrl[i] = 0;
+	}
+
+	ieee->assoc_id = 0;
+	ieee->queue_stop = 0;
+	ieee->scanning = 0;
+	ieee->softmac_features = 0; //so IEEE2100-like driver are happy
+	ieee->wap_set = 0;
+	ieee->ssid_set = 0;
+	ieee->proto_started = 0;
+	ieee->basic_rate = IEEE80211_DEFAULT_BASIC_RATE;
+	ieee->rate = 3;
+//#ifdef ENABLE_LPS
+	ieee->ps = IEEE80211_PS_MBCAST|IEEE80211_PS_UNICAST;
+//#else
+//	ieee->ps = IEEE80211_PS_DISABLED;
+//#endif
+	ieee->sta_sleep = 0;
+//by amy
+	ieee->bInactivePs = false;
+	ieee->actscanning = false;
+	ieee->ListenInterval = 2;
+	ieee->NumRxDataInPeriod = 0; //YJ,add,080828
+	ieee->NumRxBcnInPeriod = 0; //YJ,add,080828
+	ieee->NumRxOkTotal = 0;//+by amy 080312
+	ieee->NumRxUnicast = 0;//YJ,add,080828,for keep alive
+	ieee->beinretry = false;
+	ieee->bHwRadioOff = false;
+//by amy
+
+	init_mgmt_queue(ieee);
+
+	ieee->tx_pending.txb = NULL;
+
+	init_timer(&ieee->associate_timer);
+	ieee->associate_timer.data = (unsigned long)ieee;
+	ieee->associate_timer.function = ieee80211_associate_abort_cb;
+
+	init_timer(&ieee->beacon_timer);
+	ieee->beacon_timer.data = (unsigned long) ieee;
+	ieee->beacon_timer.function = ieee80211_send_beacon_cb;
+
+	ieee->wq = create_workqueue(DRV_NAME);
+
+	INIT_DELAYED_WORK(&ieee->start_ibss_wq,(void*) ieee80211_start_ibss_wq);
+	INIT_WORK(&ieee->associate_complete_wq,(void*) ieee80211_associate_complete_wq);
+	INIT_WORK(&ieee->associate_procedure_wq,(void*) ieee80211_associate_procedure_wq);
+	INIT_DELAYED_WORK(&ieee->softmac_scan_wq,(void*) ieee80211_softmac_scan_wq);
+	INIT_DELAYED_WORK(&ieee->associate_retry_wq,(void*) ieee80211_associate_retry_wq);
+	INIT_WORK(&ieee->wx_sync_scan_wq,(void*) ieee80211_wx_sync_scan_wq);
+//	INIT_WORK(&ieee->watch_dog_wq,(void*) ieee80211_watch_dog_wq);
+
+	sema_init(&ieee->wx_sem, 1);
+	sema_init(&ieee->scan_sem, 1);
+
+	spin_lock_init(&ieee->mgmt_tx_lock);
+	spin_lock_init(&ieee->beacon_lock);
+
+	tasklet_init(&ieee->ps_task,
+	     (void(*)(unsigned long)) ieee80211_sta_ps,
+	     (unsigned long)ieee);
+	ieee->pDot11dInfo = kmalloc(sizeof(RT_DOT11D_INFO), GFP_ATOMIC);
+}
+
+void ieee80211_softmac_free(struct ieee80211_device *ieee)
+{
+	down(&ieee->wx_sem);
+
+	del_timer_sync(&ieee->associate_timer);
+	cancel_delayed_work(&ieee->associate_retry_wq);
+
+
+	//add for RF power on power of by lizhaoming 080512
+	cancel_delayed_work(&ieee->GPIOChangeRFWorkItem);
+
+	destroy_workqueue(ieee->wq);
+	kfree(ieee->pDot11dInfo);
+	up(&ieee->wx_sem);
+}
+
+/********************************************************
+ * Start of WPA code.                                   *
+ * this is stolen from the ipw2200 driver               *
+ ********************************************************/
+
+
+static int ieee80211_wpa_enable(struct ieee80211_device *ieee, int value)
+{
+	/* This is called when wpa_supplicant loads and closes the driver
+	 * interface. */
+	printk("%s WPA\n",value ? "enabling" : "disabling");
+	ieee->wpa_enabled = value;
+	return 0;
+}
+
+
+void ieee80211_wpa_assoc_frame(struct ieee80211_device *ieee, char *wpa_ie, int wpa_ie_len)
+{
+	/* make sure WPA is enabled */
+	ieee80211_wpa_enable(ieee, 1);
+
+	ieee80211_disassociate(ieee);
+}
+
+
+static int ieee80211_wpa_mlme(struct ieee80211_device *ieee, int command, int reason)
+{
+
+	int ret = 0;
+
+	switch (command) {
+	case IEEE_MLME_STA_DEAUTH:
+		// silently ignore
+		break;
+
+	case IEEE_MLME_STA_DISASSOC:
+		ieee80211_disassociate(ieee);
+		break;
+
+	default:
+		printk("Unknown MLME request: %d\n", command);
+		ret = -EOPNOTSUPP;
+	}
+
+	return ret;
+}
+
+
+static int ieee80211_wpa_set_wpa_ie(struct ieee80211_device *ieee,
+			      struct ieee_param *param, int plen)
+{
+	u8 *buf;
+
+	if (param->u.wpa_ie.len > MAX_WPA_IE_LEN ||
+	    (param->u.wpa_ie.len && param->u.wpa_ie.data == NULL))
+		return -EINVAL;
+
+	if (param->u.wpa_ie.len) {
+		buf = kmemdup(param->u.wpa_ie.data, param->u.wpa_ie.len,
+			      GFP_KERNEL);
+		if (buf == NULL)
+			return -ENOMEM;
+
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = buf;
+		ieee->wpa_ie_len = param->u.wpa_ie.len;
+	} else {
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = NULL;
+		ieee->wpa_ie_len = 0;
+	}
+
+	ieee80211_wpa_assoc_frame(ieee, ieee->wpa_ie, ieee->wpa_ie_len);
+	return 0;
+}
+
+#define AUTH_ALG_OPEN_SYSTEM			0x1
+#define AUTH_ALG_SHARED_KEY			0x2
+
+static int ieee80211_wpa_set_auth_algs(struct ieee80211_device *ieee, int value)
+{
+
+	struct ieee80211_security sec = {
+		.flags = SEC_AUTH_MODE,
+	};
+	int ret = 0;
+
+	if (value & AUTH_ALG_SHARED_KEY) {
+		sec.auth_mode = WLAN_AUTH_SHARED_KEY;
+		ieee->open_wep = 0;
+	} else {
+		sec.auth_mode = WLAN_AUTH_OPEN;
+		ieee->open_wep = 1;
+	}
+
+	if (ieee->set_security)
+		ieee->set_security(ieee->dev, &sec);
+	else
+		ret = -EOPNOTSUPP;
+
+	return ret;
+}
+
+static int ieee80211_wpa_set_param(struct ieee80211_device *ieee, u8 name, u32 value)
+{
+	int ret=0;
+	unsigned long flags;
+
+	switch (name) {
+	case IEEE_PARAM_WPA_ENABLED:
+		ret = ieee80211_wpa_enable(ieee, value);
+		break;
+
+	case IEEE_PARAM_TKIP_COUNTERMEASURES:
+		ieee->tkip_countermeasures=value;
+		break;
+
+	case IEEE_PARAM_DROP_UNENCRYPTED: {
+		/* HACK:
+		 *
+		 * wpa_supplicant calls set_wpa_enabled when the driver
+		 * is loaded and unloaded, regardless of if WPA is being
+		 * used.  No other calls are made which can be used to
+		 * determine if encryption will be used or not prior to
+		 * association being expected.  If encryption is not being
+		 * used, drop_unencrypted is set to false, else true -- we
+		 * can use this to determine if the CAP_PRIVACY_ON bit should
+		 * be set.
+		 */
+		struct ieee80211_security sec = {
+			.flags = SEC_ENABLED,
+			.enabled = value,
+		};
+ 		ieee->drop_unencrypted = value;
+		/* We only change SEC_LEVEL for open mode. Others
+		 * are set by ipw_wpa_set_encryption.
+		 */
+		if (!value) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_0;
+		}
+		else {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		}
+		if (ieee->set_security)
+			ieee->set_security(ieee->dev, &sec);
+		break;
+	}
+
+	case IEEE_PARAM_PRIVACY_INVOKED:
+		ieee->privacy_invoked=value;
+		break;
+
+	case IEEE_PARAM_AUTH_ALGS:
+		ret = ieee80211_wpa_set_auth_algs(ieee, value);
+		break;
+
+	case IEEE_PARAM_IEEE_802_1X:
+		ieee->ieee802_1x=value;
+		break;
+	case IEEE_PARAM_WPAX_SELECT:
+		// added for WPA2 mixed mode
+		//printk(KERN_WARNING "------------------------>wpax value = %x\n", value);
+		spin_lock_irqsave(&ieee->wpax_suitlist_lock,flags);
+		ieee->wpax_type_set = 1;
+		ieee->wpax_type_notify = value;
+		spin_unlock_irqrestore(&ieee->wpax_suitlist_lock,flags);
+		break;
+
+	default:
+		printk("Unknown WPA param: %d\n",name);
+		ret = -EOPNOTSUPP;
+	}
+
+	return ret;
+}
+
+/* implementation borrowed from hostap driver */
+
+static int ieee80211_wpa_set_encryption(struct ieee80211_device *ieee,
+				  struct ieee_param *param, int param_len)
+{
+	int ret = 0;
+
+	struct ieee80211_crypto_ops *ops;
+	struct ieee80211_crypt_data **crypt;
+
+	struct ieee80211_security sec = {
+		.flags = 0,
+	};
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len !=
+	    (int) ((char *) param->u.crypt.key - (char *) param) +
+	    param->u.crypt.key_len) {
+		printk("Len mismatch %d, %d\n", param_len,
+			       param->u.crypt.key_len);
+		return -EINVAL;
+	}
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
+		if (param->u.crypt.idx >= WEP_KEYS)
+			return -EINVAL;
+		crypt = &ieee->crypt[param->u.crypt.idx];
+	} else {
+		return -EINVAL;
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0) {
+		if (crypt) {
+			sec.enabled = 0;
+			// FIXME FIXME
+			//sec.encrypt = 0;
+			sec.level = SEC_LEVEL_0;
+			sec.flags |= SEC_ENABLED | SEC_LEVEL;
+			ieee80211_crypt_delayed_deinit(ieee, crypt);
+		}
+		goto done;
+	}
+	sec.enabled = 1;
+// FIXME FIXME
+//	sec.encrypt = 1;
+	sec.flags |= SEC_ENABLED;
+
+	/* IPW HW cannot build TKIP MIC, host decryption still needed. */
+	if (!(ieee->host_encrypt || ieee->host_decrypt) &&
+	    strcmp(param->u.crypt.alg, "TKIP"))
+		goto skip_host_crypt;
+
+	ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	if (ops == NULL && strcmp(param->u.crypt.alg, "WEP") == 0)
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	else if (ops == NULL && strcmp(param->u.crypt.alg, "TKIP") == 0)
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	else if (ops == NULL && strcmp(param->u.crypt.alg, "CCMP") == 0)
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	if (ops == NULL) {
+		printk("unknown crypto alg '%s'\n", param->u.crypt.alg);
+		param->u.crypt.err = IEEE_CRYPT_ERR_UNKNOWN_ALG;
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (*crypt == NULL || (*crypt)->ops != ops) {
+		struct ieee80211_crypt_data *new_crypt;
+
+		ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+		new_crypt = kmalloc(sizeof(*new_crypt), GFP_KERNEL);
+		if (new_crypt == NULL) {
+			ret = -ENOMEM;
+			goto done;
+		}
+		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
+		new_crypt->ops = ops;
+		if (new_crypt->ops)
+			new_crypt->priv =
+				new_crypt->ops->init(param->u.crypt.idx);
+
+		if (new_crypt->priv == NULL) {
+			kfree(new_crypt);
+			param->u.crypt.err = IEEE_CRYPT_ERR_CRYPT_INIT_FAILED;
+			ret = -EINVAL;
+			goto done;
+		}
+
+		*crypt = new_crypt;
+	}
+
+	if (param->u.crypt.key_len > 0 && (*crypt)->ops->set_key &&
+	    (*crypt)->ops->set_key(param->u.crypt.key,
+				   param->u.crypt.key_len, param->u.crypt.seq,
+				   (*crypt)->priv) < 0) {
+		printk("key setting failed\n");
+		param->u.crypt.err = IEEE_CRYPT_ERR_KEY_SET_FAILED;
+		ret = -EINVAL;
+		goto done;
+	}
+
+ skip_host_crypt:
+	if (param->u.crypt.set_tx) {
+		ieee->tx_keyidx = param->u.crypt.idx;
+		sec.active_key = param->u.crypt.idx;
+		sec.flags |= SEC_ACTIVE_KEY;
+	} else
+		sec.flags &= ~SEC_ACTIVE_KEY;
+
+	if (param->u.crypt.alg != NULL) {
+		memcpy(sec.keys[param->u.crypt.idx],
+		       param->u.crypt.key,
+		       param->u.crypt.key_len);
+		sec.key_sizes[param->u.crypt.idx] = param->u.crypt.key_len;
+		sec.flags |= (1 << param->u.crypt.idx);
+
+		if (strcmp(param->u.crypt.alg, "WEP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		} else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_2;
+		} else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_3;
+		}
+	}
+ done:
+	if (ieee->set_security)
+		ieee->set_security(ieee->dev, &sec);
+
+	/* Do not reset port if card is in Managed mode since resetting will
+	 * generate new IEEE 802.11 authentication which may end up in looping
+	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
+	 * configuration (for example... Prism2), implement the reset_port in
+	 * the callbacks structures used to initialize the 802.11 stack. */
+	if (ieee->reset_on_keychange &&
+	    ieee->iw_mode != IW_MODE_INFRA &&
+	    ieee->reset_port &&
+	    ieee->reset_port(ieee->dev)) {
+		printk("reset_port failed\n");
+		param->u.crypt.err = IEEE_CRYPT_ERR_CARD_CONF_FAILED;
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct iw_point *p)
+{
+	struct ieee_param *param;
+	int ret=0;
+
+	down(&ieee->wx_sem);
+	//IEEE_DEBUG_INFO("wpa_supplicant: len=%d\n", p->length);
+
+	if (p->length < sizeof(struct ieee_param) || !p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	param = kmalloc(p->length, GFP_KERNEL);
+	if (param == NULL){
+		ret = -ENOMEM;
+		goto out;
+	}
+	if (copy_from_user(param, p->pointer, p->length)) {
+		kfree(param);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	switch (param->cmd) {
+
+	case IEEE_CMD_SET_WPA_PARAM:
+		ret = ieee80211_wpa_set_param(ieee, param->u.wpa_param.name,
+					param->u.wpa_param.value);
+		break;
+
+	case IEEE_CMD_SET_WPA_IE:
+		ret = ieee80211_wpa_set_wpa_ie(ieee, param, p->length);
+		break;
+
+	case IEEE_CMD_SET_ENCRYPTION:
+		ret = ieee80211_wpa_set_encryption(ieee, param, p->length);
+		break;
+
+	case IEEE_CMD_MLME:
+		ret = ieee80211_wpa_mlme(ieee, param->u.mlme.command,
+				   param->u.mlme.reason_code);
+		break;
+
+	default:
+		printk("Unknown WPA supplicant request: %d\n",param->cmd);
+		ret = -EOPNOTSUPP;
+		break;
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+	kfree(param);
+out:
+	up(&ieee->wx_sem);
+
+	return ret;
+}
+
+void notify_wx_assoc_event(struct ieee80211_device *ieee)
+{
+	union iwreq_data wrqu;
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	if (ieee->state == IEEE80211_LINKED)
+		memcpy(wrqu.ap_addr.sa_data, ieee->current_network.bssid, ETH_ALEN);
+	else
+		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+	wireless_send_event(ieee->dev, SIOCGIWAP, &wrqu, NULL);
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
new file mode 100644
index 00000000..e46ff2ff
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
@@ -0,0 +1,567 @@
+/* IEEE 802.11 SoftMAC layer
+ * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Mostly extracted from the rtl8180-sa2400 driver for the
+ * in-kernel generic ieee802.11 stack.
+ *
+ * Some pieces of code might be stolen from ipw2100 driver
+ * copyright of who own it's copyright ;-)
+ *
+ * PS wx handler mostly stolen from hostap, copyright who
+ * own it's copyright ;-)
+ *
+ * released under the GPL
+ */
+
+
+#include "ieee80211.h"
+
+/* FIXME: add A freqs */
+
+const long ieee80211_wlan_frequencies[] = {
+	2412, 2417, 2422, 2427,
+	2432, 2437, 2442, 2447,
+	2452, 2457, 2462, 2467,
+	2472, 2484
+};
+
+
+int ieee80211_wx_set_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct iw_freq *fwrq = & wrqu->freq;
+//	printk("in %s\n",__func__);
+	down(&ieee->wx_sem);
+
+	if(ieee->iw_mode == IW_MODE_INFRA){
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+
+	/* if setting by freq convert to channel */
+	if (fwrq->e == 1) {
+		if ((fwrq->m >= (int) 2.412e8 &&
+		     fwrq->m <= (int) 2.487e8)) {
+			int f = fwrq->m / 100000;
+			int c = 0;
+
+			while ((c < 14) && (f != ieee80211_wlan_frequencies[c]))
+				c++;
+
+			/* hack to fall through */
+			fwrq->e = 0;
+			fwrq->m = c + 1;
+		}
+	}
+
+	if (fwrq->e > 0 || fwrq->m > 14 || fwrq->m < 1 ){
+		ret = -EOPNOTSUPP;
+		goto out;
+
+	}else { /* Set the channel */
+
+
+		ieee->current_network.channel = fwrq->m;
+		ieee->set_chan(ieee->dev, ieee->current_network.channel);
+
+		if(ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
+			if(ieee->state == IEEE80211_LINKED){
+
+			ieee80211_stop_send_beacons(ieee);
+			ieee80211_start_send_beacons(ieee);
+			}
+	}
+
+	ret = 0;
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+
+int ieee80211_wx_get_freq(struct ieee80211_device *ieee,
+			     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct iw_freq *fwrq = & wrqu->freq;
+
+	if (ieee->current_network.channel == 0)
+		return -1;
+
+	fwrq->m = ieee->current_network.channel;
+	fwrq->e = 0;
+
+	return 0;
+}
+
+int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	unsigned long flags;
+
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+
+	if (ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	/* We want avoid to give to the user inconsistent infos*/
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->state != IEEE80211_LINKED &&
+		ieee->state != IEEE80211_LINKED_SCANNING &&
+		ieee->wap_set == 0)
+
+		memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+	else
+		memcpy(wrqu->ap_addr.sa_data,
+		       ieee->current_network.bssid, ETH_ALEN);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	return 0;
+}
+
+
+int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+
+	int ret = 0;
+	u8 zero[] = {0,0,0,0,0,0};
+	unsigned long flags;
+
+	short ifup = ieee->proto_started;//dev->flags & IFF_UP;
+	struct sockaddr *temp = (struct sockaddr *)awrq;
+
+	//printk("=======Set WAP:");
+	ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->wx_sem);
+	/* use ifconfig hw ether */
+	if (ieee->iw_mode == IW_MODE_MASTER){
+		ret = -1;
+		goto out;
+	}
+
+	if (temp->sa_family != ARPHRD_ETHER){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (ifup)
+		ieee80211_stop_protocol(ieee);
+
+	/* just to avoid to give inconsistent infos in the
+	 * get wx method. not really needed otherwise
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	memcpy(ieee->current_network.bssid, temp->sa_data, ETH_ALEN);
+	ieee->wap_set = memcmp(temp->sa_data, zero,ETH_ALEN)!=0;
+	//printk(" %x:%x:%x:%x:%x:%x\n", ieee->current_network.bssid[0],ieee->current_network.bssid[1],ieee->current_network.bssid[2],ieee->current_network.bssid[3],ieee->current_network.bssid[4],ieee->current_network.bssid[5]);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	if (ifup)
+		ieee80211_start_protocol(ieee);
+
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+ int ieee80211_wx_get_essid(struct ieee80211_device *ieee, struct iw_request_info *a,union iwreq_data *wrqu,char *b)
+{
+	int len,ret = 0;
+	unsigned long flags;
+
+	if (ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	/* We want avoid to give to the user inconsistent infos*/
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->current_network.ssid[0] == '\0' ||
+		ieee->current_network.ssid_len == 0){
+		ret = -1;
+		goto out;
+	}
+
+	if (ieee->state != IEEE80211_LINKED &&
+		ieee->state != IEEE80211_LINKED_SCANNING &&
+		ieee->ssid_set == 0){
+		ret = -1;
+		goto out;
+	}
+	len = ieee->current_network.ssid_len;
+	wrqu->essid.length = len;
+	strncpy(b,ieee->current_network.ssid,len);
+	wrqu->essid.flags = 1;
+
+out:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	return ret;
+
+}
+
+int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+
+	u32 target_rate = wrqu->bitrate.value;
+
+	//added by lizhaoming for auto mode
+	if(target_rate == -1){
+	ieee->rate = 110;
+	} else {
+	ieee->rate = target_rate/100000;
+	}
+	//FIXME: we might want to limit rate also in management protocols.
+	return 0;
+}
+
+
+
+int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+
+	wrqu->bitrate.value = ieee->rate * 100000;
+
+	return 0;
+}
+
+int ieee80211_wx_set_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->wx_sem);
+
+	if (wrqu->mode == ieee->iw_mode)
+		goto out;
+
+	if (wrqu->mode == IW_MODE_MONITOR){
+
+		ieee->dev->type = ARPHRD_IEEE80211;
+	}else{
+		ieee->dev->type = ARPHRD_ETHER;
+	}
+
+	if (!ieee->proto_started){
+		ieee->iw_mode = wrqu->mode;
+	}else{
+		ieee80211_stop_protocol(ieee);
+		ieee->iw_mode = wrqu->mode;
+		ieee80211_start_protocol(ieee);
+	}
+
+out:
+	up(&ieee->wx_sem);
+	return 0;
+}
+
+
+void ieee80211_wx_sync_scan_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, wx_sync_scan_wq);
+	short chan;
+
+	chan = ieee->current_network.channel;
+
+	if (ieee->data_hard_stop)
+		ieee->data_hard_stop(ieee->dev);
+
+	ieee80211_stop_send_beacons(ieee);
+
+	ieee->state = IEEE80211_LINKED_SCANNING;
+	ieee->link_change(ieee->dev);
+
+	ieee80211_start_scan_syncro(ieee);
+
+	ieee->set_chan(ieee->dev, chan);
+
+	ieee->state = IEEE80211_LINKED;
+	ieee->link_change(ieee->dev);
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+
+	if(ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
+		ieee80211_start_send_beacons(ieee);
+
+	//YJ,add,080828, In prevent of lossing ping packet during scanning
+	//ieee80211_sta_ps_send_null_frame(ieee, false);
+	//YJ,add,080828,end
+
+	up(&ieee->wx_sem);
+
+}
+
+int ieee80211_wx_set_scan(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret = 0;
+
+	down(&ieee->wx_sem);
+
+	if (ieee->iw_mode == IW_MODE_MONITOR || !(ieee->proto_started)){
+		ret = -1;
+		goto out;
+	}
+	//YJ,add,080828
+	//In prevent of lossing ping packet during scanning
+	//ieee80211_sta_ps_send_null_frame(ieee, true);
+	//YJ,add,080828,end
+
+	if ( ieee->state == IEEE80211_LINKED){
+		queue_work(ieee->wq, &ieee->wx_sync_scan_wq);
+		/* intentionally forget to up sem */
+		return 0;
+	}
+
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+
+	int ret=0,len;
+	short proto_started;
+	unsigned long flags;
+
+	ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->wx_sem);
+
+	proto_started = ieee->proto_started;
+
+	if (wrqu->essid.length > IW_ESSID_MAX_SIZE){
+		ret= -E2BIG;
+		goto out;
+	}
+
+	if (ieee->iw_mode == IW_MODE_MONITOR){
+		ret= -1;
+		goto out;
+	}
+
+	if(proto_started)
+		ieee80211_stop_protocol(ieee);
+
+	/* this is just to be sure that the GET wx callback
+	 * has consisten infos. not needed otherwise
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (wrqu->essid.flags && wrqu->essid.length) {
+//YJ,modified,080819
+		len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ? (wrqu->essid.length) : IW_ESSID_MAX_SIZE;
+		memset(ieee->current_network.ssid, 0, ieee->current_network.ssid_len); //YJ,add,080819
+		strncpy(ieee->current_network.ssid, extra, len);
+		ieee->current_network.ssid_len = len;
+		ieee->ssid_set = 1;
+//YJ,modified,080819,end
+
+		//YJ,add,080819,for hidden ap
+		if(len == 0){
+			memset(ieee->current_network.bssid, 0, ETH_ALEN);
+			ieee->current_network.capability = 0;
+		}
+		//YJ,add,080819,for hidden ap,end
+	}
+	else{
+		ieee->ssid_set = 0;
+		ieee->current_network.ssid[0] = '\0';
+		ieee->current_network.ssid_len = 0;
+	}
+	//printk("==========set essid %s!\n",ieee->current_network.ssid);
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	if (proto_started)
+		ieee80211_start_protocol(ieee);
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+ int ieee80211_wx_get_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	wrqu->mode = ieee->iw_mode;
+	return 0;
+}
+
+ int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+
+	int *parms = (int *)extra;
+	int enable = (parms[0] > 0);
+	short prev = ieee->raw_tx;
+
+	down(&ieee->wx_sem);
+
+	if(enable)
+		ieee->raw_tx = 1;
+	else
+		ieee->raw_tx = 0;
+
+	printk(KERN_INFO"raw TX is %s\n",
+	      ieee->raw_tx ? "enabled" : "disabled");
+
+	if(ieee->iw_mode == IW_MODE_MONITOR)
+	{
+		if(prev == 0 && ieee->raw_tx){
+			if (ieee->data_hard_resume)
+				ieee->data_hard_resume(ieee->dev);
+
+			netif_carrier_on(ieee->dev);
+		}
+
+		if(prev && ieee->raw_tx == 1)
+			netif_carrier_off(ieee->dev);
+	}
+
+	up(&ieee->wx_sem);
+
+	return 0;
+}
+
+int ieee80211_wx_get_name(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	strlcpy(wrqu->name, "802.11", IFNAMSIZ);
+	if(ieee->modulation & IEEE80211_CCK_MODULATION){
+		strlcat(wrqu->name, "b", IFNAMSIZ);
+		if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+			strlcat(wrqu->name, "/g", IFNAMSIZ);
+	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+		strlcat(wrqu->name, "g", IFNAMSIZ);
+
+	if((ieee->state == IEEE80211_LINKED) ||
+		(ieee->state == IEEE80211_LINKED_SCANNING))
+		strlcat(wrqu->name,"  link", IFNAMSIZ);
+	else if(ieee->state != IEEE80211_NOLINK)
+		strlcat(wrqu->name," .....", IFNAMSIZ);
+
+
+	return 0;
+}
+
+
+/* this is mostly stolen from hostap */
+int ieee80211_wx_set_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+	if(
+		(!ieee->sta_wake_up) ||
+		(!ieee->ps_request_tx_ack) ||
+		(!ieee->enter_sleep_state) ||
+		(!ieee->ps_is_queue_empty)){
+
+		printk("ERROR. PS mode tried to be use but driver missed a callback\n\n");
+
+		return -1;
+	}
+
+	down(&ieee->wx_sem);
+
+	if (wrqu->power.disabled){
+		ieee->ps = IEEE80211_PS_DISABLED;
+
+		goto exit;
+	}
+	switch (wrqu->power.flags & IW_POWER_MODE) {
+	case IW_POWER_UNICAST_R:
+		ieee->ps = IEEE80211_PS_UNICAST;
+
+		break;
+	case IW_POWER_ALL_R:
+		ieee->ps = IEEE80211_PS_UNICAST | IEEE80211_PS_MBCAST;
+		break;
+
+	case IW_POWER_ON:
+		ieee->ps = IEEE80211_PS_DISABLED;
+		break;
+
+	default:
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (wrqu->power.flags & IW_POWER_TIMEOUT) {
+
+		ieee->ps_timeout = wrqu->power.value / 1000;
+		printk("Timeout %d\n",ieee->ps_timeout);
+	}
+
+	if (wrqu->power.flags & IW_POWER_PERIOD) {
+
+		ret = -EOPNOTSUPP;
+		goto exit;
+		//wrq->value / 1024;
+
+	}
+exit:
+	up(&ieee->wx_sem);
+	return ret;
+
+}
+
+/* this is stolen from hostap */
+int ieee80211_wx_get_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	int ret =0;
+
+	down(&ieee->wx_sem);
+
+	if(ieee->ps == IEEE80211_PS_DISABLED){
+		wrqu->power.disabled = 1;
+		goto exit;
+	}
+
+	wrqu->power.disabled = 0;
+
+//	if ((wrqu->power.flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+		wrqu->power.flags = IW_POWER_TIMEOUT;
+		wrqu->power.value = ieee->ps_timeout * 1000;
+//	} else {
+//		ret = -EOPNOTSUPP;
+//		goto exit;
+		//wrqu->power.flags = IW_POWER_PERIOD;
+		//wrqu->power.value = ieee->current_network.dtim_period *
+		//	ieee->current_network.beacon_interval * 1024;
+//	}
+
+
+	if (ieee->ps & IEEE80211_PS_MBCAST)
+		wrqu->power.flags |= IW_POWER_ALL_R;
+	else
+		wrqu->power.flags |= IW_POWER_UNICAST_R;
+
+exit:
+	up(&ieee->wx_sem);
+	return ret;
+
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
new file mode 100644
index 00000000..552115cd
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
@@ -0,0 +1,583 @@
+/******************************************************************************
+
+  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+******************************************************************************
+
+  Few modifications for Realtek's Wi-Fi drivers by
+  Andrea Merello <andreamrl@tiscali.it>
+
+  A special thanks goes to Realtek for their support !
+
+******************************************************************************/
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <linux/if_vlan.h>
+
+#include "ieee80211.h"
+
+
+/*
+
+
+802.11 Data Frame
+
+
+802.11 frame_contorl for data frames - 2 bytes
+     ,-----------------------------------------------------------------------------------------.
+bits | 0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9  |  a  |  b  |  c  |  d  |  e   |
+     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
+val  | 0  |  0  |  0  |  1  |  x  |  0  |  0  |  0  |  1  |  0  |  x  |  x  |  x  |  x  |  x   |
+     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
+desc | ^-ver-^  |  ^type-^  |  ^-----subtype-----^  | to  |from |more |retry| pwr |more |wep   |
+     |          |           | x=0 data,x=1 data+ack | DS  | DS  |frag |     | mgm |data |      |
+     '-----------------------------------------------------------------------------------------'
+		                                    /\
+                                                    |
+802.11 Data Frame                                   |
+           ,--------- 'ctrl' expands to >-----------'
+          |
+      ,--'---,-------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `--------------------------------------------------|         |------'
+Total: 28 non-data bytes                                 `----.----'
+                                                              |
+       .- 'Frame data' expands to <---------------------------'
+       |
+       V
+      ,---------------------------------------------------.
+Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
+      |------|------|---------|----------|------|---------|
+Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
+      | DSAP | SSAP |         |          |      | Packet  |
+      | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
+      `-----------------------------------------|         |
+Total: 8 non-data bytes                         `----.----'
+                                                     |
+       .- 'IP Packet' expands, if WEP enabled, to <--'
+       |
+       V
+      ,-----------------------.
+Bytes |  4  |   0-2296  |  4  |
+      |-----|-----------|-----|
+Desc. | IV  | Encrypted | ICV |
+      |     | IP Packet |     |
+      `-----------------------'
+Total: 8 non-data bytes
+
+
+802.3 Ethernet Data Frame
+
+      ,-----------------------------------------.
+Bytes |   6   |   6   |  2   |  Variable |   4  |
+      |-------|-------|------|-----------|------|
+Desc. | Dest. | Source| Type | IP Packet |  fcs |
+      |  MAC  |  MAC  |      |           |      |
+      `-----------------------------------------'
+Total: 18 non-data bytes
+
+In the event that fragmentation is required, the incoming payload is split into
+N parts of size ieee->fts.  The first fragment contains the SNAP header and the
+remaining packets are just data.
+
+If encryption is enabled, each fragment payload size is reduced by enough space
+to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
+So if you have 1500 bytes of payload with ieee->fts set to 500 without
+encryption it will take 3 frames.  With WEP it will take 4 frames as the
+payload of each frame is reduced to 492 bytes.
+
+* SKB visualization
+*
+*  ,- skb->data
+* |
+* |    ETHERNET HEADER        ,-<-- PAYLOAD
+* |                           |     14 bytes from skb->data
+* |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
+* |                       | | |
+* |,-Dest.--. ,--Src.---. | | |
+* |  6 bytes| | 6 bytes | | | |
+* v         | |         | | | |
+* 0         | v       1 | v | v           2
+* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+*     ^     | ^         | ^ |
+*     |     | |         | | |
+*     |     | |         | `T' <---- 2 bytes for Type
+*     |     | |         |
+*     |     | '---SNAP--' <-------- 6 bytes for SNAP
+*     |     |
+*     `-IV--' <-------------------- 4 bytes for IV (WEP)
+*
+*      SNAP HEADER
+*
+*/
+
+static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
+static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
+
+static inline int ieee80211_put_snap(u8 *data, u16 h_proto)
+{
+	struct ieee80211_snap_hdr *snap;
+	u8 *oui;
+
+	snap = (struct ieee80211_snap_hdr *)data;
+	snap->dsap = 0xaa;
+	snap->ssap = 0xaa;
+	snap->ctrl = 0x03;
+
+	if (h_proto == 0x8137 || h_proto == 0x80f3)
+		oui = P802_1H_OUI;
+	else
+		oui = RFC1042_OUI;
+	snap->oui[0] = oui[0];
+	snap->oui[1] = oui[1];
+	snap->oui[2] = oui[2];
+
+	*(u16 *)(data + SNAP_SIZE) = htons(h_proto);
+
+	return SNAP_SIZE + sizeof(u16);
+}
+
+int ieee80211_encrypt_fragment(
+	struct ieee80211_device *ieee,
+	struct sk_buff *frag,
+	int hdr_len)
+{
+	struct ieee80211_crypt_data* crypt = ieee->crypt[ieee->tx_keyidx];
+	int res;
+
+ /*added to care about null crypt condition, to solve that system hangs when shared keys error*/
+        if (!crypt || !crypt->ops)
+        return -1;
+
+#ifdef CONFIG_IEEE80211_CRYPT_TKIP
+	struct ieee80211_hdr_4addr *header;
+
+	if (ieee->tkip_countermeasures &&
+	    crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
+		header = (struct ieee80211_hdr_4addr *)frag->data;
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
+			       "TX packet to %pM\n",
+			       ieee->dev->name, header->addr1);
+		}
+		return -1;
+	}
+#endif
+	/* To encrypt, frame format is:
+	 * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes) */
+
+	// PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU encryption.
+	/* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
+	 * call both MSDU and MPDU encryption functions from here. */
+	atomic_inc(&crypt->refcnt);
+	res = 0;
+	if (crypt->ops->encrypt_msdu)
+		res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
+	if (res == 0 && crypt->ops->encrypt_mpdu)
+		res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
+
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		printk(KERN_INFO "%s: Encryption failed: len=%d.\n",
+		       ieee->dev->name, frag->len);
+		ieee->ieee_stats.tx_discards++;
+		return -1;
+	}
+
+	return 0;
+}
+
+
+void ieee80211_txb_free(struct ieee80211_txb *txb) {
+	int i;
+	if (unlikely(!txb))
+		return;
+	for (i = 0; i < txb->nr_frags; i++)
+		if (txb->fragments[i])
+			dev_kfree_skb_any(txb->fragments[i]);
+	kfree(txb);
+}
+
+struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
+					  int gfp_mask)
+{
+	struct ieee80211_txb *txb;
+	int i;
+	txb = kmalloc(
+		sizeof(struct ieee80211_txb) + (sizeof(u8*) * nr_frags),
+		gfp_mask);
+	if (!txb)
+		return NULL;
+
+	memset(txb, 0, sizeof(struct ieee80211_txb));
+	txb->nr_frags = nr_frags;
+	txb->frag_size = txb_size;
+
+	for (i = 0; i < nr_frags; i++) {
+		txb->fragments[i] = dev_alloc_skb(txb_size);
+		if (unlikely(!txb->fragments[i])) {
+			i--;
+			break;
+		}
+	}
+	if (unlikely(i != nr_frags)) {
+		while (i >= 0)
+			dev_kfree_skb_any(txb->fragments[i--]);
+		kfree(txb);
+		return NULL;
+	}
+	return txb;
+}
+
+// Classify the to-be send data packet
+// Need to acquire the sent queue index.
+static int
+ieee80211_classify(struct sk_buff *skb, struct ieee80211_network *network)
+{
+  struct ether_header *eh = (struct ether_header*)skb->data;
+  unsigned int wme_UP = 0;
+
+  if(!network->QoS_Enable) {
+     skb->priority = 0;
+     return(wme_UP);
+  }
+
+  if(eh->ether_type == __constant_htons(ETHERTYPE_IP)) {
+    const struct iphdr *ih = (struct iphdr*)(skb->data + \
+		    sizeof(struct ether_header));
+    wme_UP = (ih->tos >> 5)&0x07;
+  } else if (vlan_tx_tag_present(skb)) {//vtag packet
+#ifndef VLAN_PRI_SHIFT
+#define VLAN_PRI_SHIFT  13              /* Shift to find VLAN user priority */
+#define VLAN_PRI_MASK   7               /* Mask for user priority bits in VLAN */
+#endif
+	u32 tag = vlan_tx_tag_get(skb);
+	wme_UP = (tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
+  } else if(ETH_P_PAE ==  ntohs(((struct ethhdr *)skb->data)->h_proto)) {
+    //printk(KERN_WARNING "type = normal packet\n");
+    wme_UP = 7;
+  }
+
+  skb->priority = wme_UP;
+  return(wme_UP);
+}
+
+/* SKBs are added to the ieee->tx_queue. */
+int ieee80211_rtl_xmit(struct sk_buff *skb,
+		   struct net_device *dev)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	struct ieee80211_txb *txb = NULL;
+	struct ieee80211_hdr_3addrqos *frag_hdr;
+	int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
+	unsigned long flags;
+	struct net_device_stats *stats = &ieee->stats;
+	int ether_type, encrypt;
+	int bytes, fc, qos_ctl, hdr_len;
+	struct sk_buff *skb_frag;
+	struct ieee80211_hdr_3addrqos header = { /* Ensure zero initialized */
+		.duration_id = 0,
+		.seq_ctl = 0,
+		.qos_ctl = 0
+	};
+	u8 dest[ETH_ALEN], src[ETH_ALEN];
+
+	struct ieee80211_crypt_data* crypt;
+
+	//printk(KERN_WARNING "upper layer packet!\n");
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	/* If there is no driver handler to take the TXB, dont' bother
+	 * creating it... */
+	if ((!ieee->hard_start_xmit && !(ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE))||
+	   ((!ieee->softmac_data_hard_start_xmit && (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)))) {
+		printk(KERN_WARNING "%s: No xmit handler.\n",
+		       ieee->dev->name);
+		goto success;
+	}
+
+	ieee80211_classify(skb,&ieee->current_network);
+	if(likely(ieee->raw_tx == 0)){
+
+		if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
+			printk(KERN_WARNING "%s: skb too small (%d).\n",
+			ieee->dev->name, skb->len);
+			goto success;
+		}
+
+		ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
+
+		crypt = ieee->crypt[ieee->tx_keyidx];
+
+		encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
+			ieee->host_encrypt && crypt && crypt->ops;
+
+		if (!encrypt && ieee->ieee802_1x &&
+		ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
+			stats->tx_dropped++;
+			goto success;
+		}
+
+	#ifdef CONFIG_IEEE80211_DEBUG
+		if (crypt && !encrypt && ether_type == ETH_P_PAE) {
+			struct eapol *eap = (struct eapol *)(skb->data +
+				sizeof(struct ethhdr) - SNAP_SIZE - sizeof(u16));
+			IEEE80211_DEBUG_EAP("TX: IEEE 802.11 EAPOL frame: %s\n",
+				eap_get_type(eap->type));
+		}
+	#endif
+
+		/* Save source and destination addresses */
+		memcpy(&dest, skb->data, ETH_ALEN);
+		memcpy(&src, skb->data+ETH_ALEN, ETH_ALEN);
+
+		/* Advance the SKB to the start of the payload */
+		skb_pull(skb, sizeof(struct ethhdr));
+
+		/* Determine total amount of storage required for TXB packets */
+		bytes = skb->len + SNAP_SIZE + sizeof(u16);
+
+		if(ieee->current_network.QoS_Enable) {
+			if (encrypt)
+				fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA |
+					IEEE80211_FCTL_WEP;
+			else
+				fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
+
+		} else {
+			if (encrypt)
+				fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
+					IEEE80211_FCTL_WEP;
+			else
+				fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
+		}
+
+		if (ieee->iw_mode == IW_MODE_INFRA) {
+			fc |= IEEE80211_FCTL_TODS;
+			/* To DS: Addr1 = BSSID, Addr2 = SA,
+			Addr3 = DA */
+			memcpy(&header.addr1, ieee->current_network.bssid, ETH_ALEN);
+			memcpy(&header.addr2, &src, ETH_ALEN);
+			memcpy(&header.addr3, &dest, ETH_ALEN);
+		} else if (ieee->iw_mode == IW_MODE_ADHOC) {
+			/* not From/To DS: Addr1 = DA, Addr2 = SA,
+			Addr3 = BSSID */
+			memcpy(&header.addr1, dest, ETH_ALEN);
+			memcpy(&header.addr2, src, ETH_ALEN);
+			memcpy(&header.addr3, ieee->current_network.bssid, ETH_ALEN);
+		}
+	//	printk(KERN_WARNING "essid MAC address is %pM", &header.addr1);
+		header.frame_ctl = cpu_to_le16(fc);
+		//hdr_len = IEEE80211_3ADDR_LEN;
+
+		/* Determine fragmentation size based on destination (multicast
+		* and broadcast are not fragmented) */
+//		if (is_multicast_ether_addr(dest) ||
+//		is_broadcast_ether_addr(dest)) {
+		if (is_multicast_ether_addr(header.addr1) ||
+		is_broadcast_ether_addr(header.addr1)) {
+			frag_size = MAX_FRAG_THRESHOLD;
+			qos_ctl = QOS_CTL_NOTCONTAIN_ACK;
+		}
+		else {
+			//printk(KERN_WARNING "&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&frag_size = %d\n", frag_size);
+			frag_size = ieee->fts;//default:392
+			qos_ctl = 0;
+		}
+
+		if (ieee->current_network.QoS_Enable)	{
+			hdr_len = IEEE80211_3ADDR_LEN + 2;
+			/* skb->priority is set in the ieee80211_classify() */
+			qos_ctl |= skb->priority;
+			header.qos_ctl = cpu_to_le16(qos_ctl);
+		} else {
+			hdr_len = IEEE80211_3ADDR_LEN;
+		}
+
+		/* Determine amount of payload per fragment.  Regardless of if
+		* this stack is providing the full 802.11 header, one will
+		* eventually be affixed to this fragment -- so we must account for
+		* it when determining the amount of payload space. */
+		//bytes_per_frag = frag_size - (IEEE80211_3ADDR_LEN + (ieee->current_network->QoS_Enable ? 2:0));
+		bytes_per_frag = frag_size - hdr_len;
+		if (ieee->config &
+		(CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
+			bytes_per_frag -= IEEE80211_FCS_LEN;
+
+		/* Each fragment may need to have room for encryption pre/postfix */
+		if (encrypt)
+			bytes_per_frag -= crypt->ops->extra_prefix_len +
+				crypt->ops->extra_postfix_len;
+
+		/* Number of fragments is the total bytes_per_frag /
+		* payload_per_fragment */
+		nr_frags = bytes / bytes_per_frag;
+		bytes_last_frag = bytes % bytes_per_frag;
+		if (bytes_last_frag)
+			nr_frags++;
+		else
+			bytes_last_frag = bytes_per_frag;
+
+		/* When we allocate the TXB we allocate enough space for the reserve
+		* and full fragment bytes (bytes_per_frag doesn't include prefix,
+		* postfix, header, FCS, etc.) */
+		txb = ieee80211_alloc_txb(nr_frags, frag_size, GFP_ATOMIC);
+		if (unlikely(!txb)) {
+			printk(KERN_WARNING "%s: Could not allocate TXB\n",
+			ieee->dev->name);
+			goto failed;
+		}
+		txb->encrypted = encrypt;
+		txb->payload_size = bytes;
+
+		for (i = 0; i < nr_frags; i++) {
+			skb_frag = txb->fragments[i];
+			skb_frag->priority = UP2AC(skb->priority);
+			if (encrypt)
+				skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
+
+			frag_hdr = (struct ieee80211_hdr_3addrqos *)skb_put(skb_frag, hdr_len);
+			memcpy(frag_hdr, &header, hdr_len);
+
+			/* If this is not the last fragment, then add the MOREFRAGS
+			* bit to the frame control */
+			if (i != nr_frags - 1) {
+				frag_hdr->frame_ctl = cpu_to_le16(
+					fc | IEEE80211_FCTL_MOREFRAGS);
+				bytes = bytes_per_frag;
+
+			} else {
+				/* The last fragment takes the remaining length */
+				bytes = bytes_last_frag;
+			}
+			if(ieee->current_network.QoS_Enable) {
+			  // add 1 only indicate to corresponding seq number control 2006/7/12
+			  frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[UP2AC(skb->priority)+1]<<4 | i);
+			  //printk(KERN_WARNING "skb->priority = %d,", skb->priority);
+			  //printk(KERN_WARNING "type:%d: seq = %d\n",UP2AC(skb->priority),ieee->seq_ctrl[UP2AC(skb->priority)+1]);
+			} else {
+			  frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0]<<4 | i);
+			}
+			//frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl<<4 | i);
+			//
+
+			/* Put a SNAP header on the first fragment */
+			if (i == 0) {
+				ieee80211_put_snap(
+					skb_put(skb_frag, SNAP_SIZE + sizeof(u16)),
+					ether_type);
+				bytes -= SNAP_SIZE + sizeof(u16);
+			}
+
+			memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
+
+			/* Advance the SKB... */
+			skb_pull(skb, bytes);
+
+			/* Encryption routine will move the header forward in order
+			* to insert the IV between the header and the payload */
+			if (encrypt)
+				ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
+			if (ieee->config &
+			(CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
+				skb_put(skb_frag, 4);
+		}
+		// Advance sequence number in data frame.
+		//printk(KERN_WARNING "QoS Enalbed? %s\n", ieee->current_network.QoS_Enable?"Y":"N");
+		if (ieee->current_network.QoS_Enable) {
+		  if (ieee->seq_ctrl[UP2AC(skb->priority) + 1] == 0xFFF)
+			ieee->seq_ctrl[UP2AC(skb->priority) + 1] = 0;
+		  else
+			ieee->seq_ctrl[UP2AC(skb->priority) + 1]++;
+		} else {
+  		  if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		  else
+			ieee->seq_ctrl[0]++;
+		}
+		//---
+	}else{
+		if (unlikely(skb->len < sizeof(struct ieee80211_hdr_3addr))) {
+			printk(KERN_WARNING "%s: skb too small (%d).\n",
+			ieee->dev->name, skb->len);
+			goto success;
+		}
+
+		txb = ieee80211_alloc_txb(1, skb->len, GFP_ATOMIC);
+		if(!txb){
+			printk(KERN_WARNING "%s: Could not allocate TXB\n",
+			ieee->dev->name);
+			goto failed;
+		}
+
+		txb->encrypted = 0;
+		txb->payload_size = skb->len;
+		memcpy(skb_put(txb->fragments[0],skb->len), skb->data, skb->len);
+	}
+
+ success:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+		dev_kfree_skb_any(skb);
+	if (txb) {
+		if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE){
+			ieee80211_softmac_xmit(txb, ieee);
+		}else{
+			if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
+				stats->tx_packets++;
+				stats->tx_bytes += txb->payload_size;
+				return NETDEV_TX_OK;
+			}
+			ieee80211_txb_free(txb);
+		}
+	}
+
+	return NETDEV_TX_OK;
+
+ failed:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	netif_stop_queue(dev);
+	stats->tx_errors++;
+	return NETDEV_TX_BUSY;
+
+}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
new file mode 100644
index 00000000..ca414a91
--- /dev/null
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
@@ -0,0 +1,747 @@
+/******************************************************************************
+
+  Copyright(c) 2004 Intel Corporation. All rights reserved.
+
+  Portions of this file are based on the WEP enablement code provided by the
+  Host AP project hostap-drivers v0.1.3
+  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+  <jkmaline@cc.hut.fi>
+  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+******************************************************************************/
+#include <linux/wireless.h>
+#include <linux/kmod.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+#include "ieee80211.h"
+static const char *ieee80211_modes[] = {
+	"?", "a", "b", "ab", "g", "ag", "bg", "abg"
+};
+
+#define MAX_CUSTOM_LEN 64
+static inline char *rtl818x_translate_scan(struct ieee80211_device *ieee,
+		                           char *start, char *stop,
+                                           struct ieee80211_network *network,
+                                           struct iw_request_info *info)
+{
+	char custom[MAX_CUSTOM_LEN];
+	char *p;
+	struct iw_event iwe;
+	int i, j;
+	u8 max_rate, rate;
+
+	/* First entry *MUST* be the AP MAC address */
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+	memcpy(iwe.u.ap_addr.sa_data, network->bssid, ETH_ALEN);
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
+
+	/* Remaining entries will be displayed in the order we provide them */
+
+	/* Add the ESSID */
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.flags = 1;
+	//YJ,modified,080903,for hidden ap
+	//if (network->flags & NETWORK_EMPTY_ESSID) {
+	if (network->ssid_len == 0) {
+	//YJ,modified,080903,end
+		iwe.u.data.length = sizeof("<hidden>");
+		start = iwe_stream_add_point(info, start, stop, &iwe, "<hidden>");
+	} else {
+		iwe.u.data.length = min(network->ssid_len, (u8)32);
+		start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
+	}
+	//printk("ESSID: %s\n",network->ssid);
+	/* Add the protocol name */
+	iwe.cmd = SIOCGIWNAME;
+	snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11%s", ieee80211_modes[network->mode]);
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
+
+        /* Add mode */
+        iwe.cmd = SIOCGIWMODE;
+        if (network->capability &
+	    (WLAN_CAPABILITY_BSS | WLAN_CAPABILITY_IBSS)) {
+		if (network->capability & WLAN_CAPABILITY_BSS)
+			iwe.u.mode = IW_MODE_MASTER;
+		else
+			iwe.u.mode = IW_MODE_ADHOC;
+
+		start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
+	}
+
+        /* Add frequency/channel */
+	iwe.cmd = SIOCGIWFREQ;
+/*	iwe.u.freq.m = ieee80211_frequency(network->channel, network->mode);
+	iwe.u.freq.e = 3; */
+	iwe.u.freq.m = network->channel;
+	iwe.u.freq.e = 0;
+	iwe.u.freq.i = 0;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
+
+	/* Add encryption capability */
+	iwe.cmd = SIOCGIWENCODE;
+	if (network->capability & WLAN_CAPABILITY_PRIVACY)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
+
+	/* Add basic and extended rates */
+	max_rate = 0;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+	for (i = 0, j = 0; i < network->rates_len; ) {
+		if (j < network->rates_ex_len &&
+		    ((network->rates_ex[j] & 0x7F) <
+		     (network->rates[i] & 0x7F)))
+			rate = network->rates_ex[j++] & 0x7F;
+		else
+			rate = network->rates[i++] & 0x7F;
+		if (rate > max_rate)
+			max_rate = rate;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+	}
+	for (; j < network->rates_ex_len; j++) {
+		rate = network->rates_ex[j] & 0x7F;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+		if (rate > max_rate)
+			max_rate = rate;
+	}
+
+	iwe.cmd = SIOCGIWRATE;
+	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+	iwe.u.bitrate.value = max_rate * 500000;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_PARAM_LEN);
+
+	iwe.cmd = IWEVCUSTOM;
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+		start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+
+	/* Add quality statistics */
+	/* TODO: Fix these values... */
+	if (network->stats.signal == 0 || network->stats.rssi == 0)
+	printk("========>signal:%d, rssi:%d\n", network->stats.signal, network->stats.rssi);
+	iwe.cmd = IWEVQUAL;
+//	printk("SIGNAL: %d,RSSI: %d,NOISE: %d\n",network->stats.signal,network->stats.rssi,network->stats.noise);
+	iwe.u.qual.qual = network->stats.signalstrength;
+	iwe.u.qual.level = network->stats.signal;
+	iwe.u.qual.noise = network->stats.noise;
+	iwe.u.qual.updated = network->stats.mask & IEEE80211_STATMASK_WEMASK;
+	if (!(network->stats.mask & IEEE80211_STATMASK_RSSI))
+		iwe.u.qual.updated |= IW_QUAL_LEVEL_INVALID;
+	if (!(network->stats.mask & IEEE80211_STATMASK_NOISE))
+		iwe.u.qual.updated |= IW_QUAL_NOISE_INVALID;
+	if (!(network->stats.mask & IEEE80211_STATMASK_SIGNAL))
+		iwe.u.qual.updated |= IW_QUAL_QUAL_INVALID;
+	iwe.u.qual.updated = 7;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
+
+	iwe.cmd = IWEVCUSTOM;
+	p = custom;
+
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+		start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+
+		memset(&iwe, 0, sizeof(iwe));
+        if (network->wpa_ie_len) {
+	//	printk("wpa_ie_len:%d\n", network->wpa_ie_len);
+                char buf[MAX_WPA_IE_LEN];
+                memcpy(buf, network->wpa_ie, network->wpa_ie_len);
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = network->wpa_ie_len;
+                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+        }
+
+        memset(&iwe, 0, sizeof(iwe));
+        if (network->rsn_ie_len) {
+	//	printk("=====>rsn_ie_len:\n", network->rsn_ie_len);
+                char buf[MAX_WPA_IE_LEN];
+                memcpy(buf, network->rsn_ie, network->rsn_ie_len);
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = network->rsn_ie_len;
+		start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+	}
+
+	/* Add EXTRA: Age to display seconds since last beacon/probe response
+	 * for given network. */
+	iwe.cmd = IWEVCUSTOM;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+		      " Last beacon: %lums ago", (jiffies - network->last_scanned) / (HZ / 100));
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+		start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+
+	return start;
+}
+
+int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
+			  struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct ieee80211_network *network;
+	unsigned long flags;
+	int err = 0;
+	char *ev = extra;
+	char *stop = ev + wrqu->data.length;//IW_SCAN_MAX_DATA;
+	//char *stop = ev + IW_SCAN_MAX_DATA;
+	int i = 0;
+
+	IEEE80211_DEBUG_WX("Getting scan\n");
+	down(&ieee->wx_sem);
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(!ieee->bHwRadioOff)
+	{
+		list_for_each_entry(network, &ieee->network_list, list) {
+			i++;
+
+			if((stop-ev)<200)
+			{
+				err = -E2BIG;
+				break;
+			}
+			if (ieee->scan_age == 0 ||
+			    time_after(network->last_scanned + ieee->scan_age, jiffies))
+			{
+				ev = rtl818x_translate_scan(ieee, ev, stop, network, info);
+			}
+			else
+				IEEE80211_DEBUG_SCAN(
+					"Not showing network '%s ("
+					"%pM)' due to age (%lums).\n",
+					escape_essid(network->ssid,
+						     network->ssid_len),
+					network->bssid,
+					(jiffies - network->last_scanned) / (HZ / 100));
+		}
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	up(&ieee->wx_sem);
+	wrqu->data.length = ev -  extra;
+	wrqu->data.flags = 0;
+	IEEE80211_DEBUG_WX("exit: %d networks returned.\n", i);
+
+	return err;
+}
+
+int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	struct iw_point *erq = &(wrqu->encoding);
+	struct net_device *dev = ieee->dev;
+	struct ieee80211_security sec = {
+		.flags = 0
+	};
+	int i, key, key_provided, len;
+	struct ieee80211_crypt_data **crypt;
+
+	IEEE80211_DEBUG_WX("SET_ENCODE\n");
+
+	key = erq->flags & IW_ENCODE_INDEX;
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+		key_provided = 1;
+	} else {
+		key_provided = 0;
+		key = ieee->tx_keyidx;
+	}
+
+	IEEE80211_DEBUG_WX("Key: %d [%s]\n", key, key_provided ?
+			   "provided" : "default");
+
+	crypt = &ieee->crypt[key];
+
+	if (erq->flags & IW_ENCODE_DISABLED) {
+		if (key_provided && *crypt) {
+			IEEE80211_DEBUG_WX("Disabling encryption on key %d.\n",
+					   key);
+			ieee80211_crypt_delayed_deinit(ieee, crypt);
+		} else
+			IEEE80211_DEBUG_WX("Disabling encryption.\n");
+
+		/* Check all the keys to see if any are still configured,
+		 * and if no key index was provided, de-init them all */
+		for (i = 0; i < WEP_KEYS; i++) {
+			if (ieee->crypt[i] != NULL) {
+				if (key_provided)
+					break;
+				ieee80211_crypt_delayed_deinit(
+					ieee, &ieee->crypt[i]);
+			}
+		}
+
+		if (i == WEP_KEYS) {
+			sec.enabled = 0;
+			sec.level = SEC_LEVEL_0;
+			sec.flags |= SEC_ENABLED | SEC_LEVEL;
+		}
+
+		goto done;
+	}
+
+
+
+	sec.enabled = 1;
+	sec.flags |= SEC_ENABLED;
+
+	if (*crypt != NULL && (*crypt)->ops != NULL &&
+	    strcmp((*crypt)->ops->name, "WEP") != 0) {
+		/* changing to use WEP; deinit previously used algorithm
+		 * on this key */
+		ieee80211_crypt_delayed_deinit(ieee, crypt);
+	}
+
+	if (*crypt == NULL) {
+		struct ieee80211_crypt_data *new_crypt;
+
+		/* take WEP into use */
+		new_crypt = kzalloc(sizeof(struct ieee80211_crypt_data),
+				    GFP_KERNEL);
+		if (new_crypt == NULL)
+			return -ENOMEM;
+		new_crypt->ops = ieee80211_get_crypto_ops("WEP");
+		if (!new_crypt->ops)
+			new_crypt->ops = ieee80211_get_crypto_ops("WEP");
+
+		if (new_crypt->ops)
+			new_crypt->priv = new_crypt->ops->init(key);
+
+		if (!new_crypt->ops || !new_crypt->priv) {
+			kfree(new_crypt);
+			new_crypt = NULL;
+
+			printk(KERN_WARNING "%s: could not initialize WEP: "
+			       "load module ieee80211_crypt_wep\n",
+			       dev->name);
+			return -EOPNOTSUPP;
+		}
+		*crypt = new_crypt;
+	}
+
+	/* If a new key was provided, set it up */
+	if (erq->length > 0) {
+		len = erq->length <= 5 ? 5 : 13;
+		memcpy(sec.keys[key], keybuf, erq->length);
+		if (len > erq->length)
+			memset(sec.keys[key] + erq->length, 0,
+			       len - erq->length);
+		IEEE80211_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
+				   key, escape_essid(sec.keys[key], len),
+				   erq->length, len);
+		sec.key_sizes[key] = len;
+ 		(*crypt)->ops->set_key(sec.keys[key], len, NULL,
+				       (*crypt)->priv);
+		sec.flags |= (1 << key);
+		/* This ensures a key will be activated if no key is
+		 * explicitely set */
+		if (key == sec.active_key)
+			sec.flags |= SEC_ACTIVE_KEY;
+		ieee->tx_keyidx = key;//by wb 080312
+	} else {
+		len = (*crypt)->ops->get_key(sec.keys[key], WEP_KEY_LEN,
+					     NULL, (*crypt)->priv);
+		if (len == 0) {
+			/* Set a default key of all 0 */
+			IEEE80211_DEBUG_WX("Setting key %d to all zero.\n",
+					   key);
+			memset(sec.keys[key], 0, 13);
+			(*crypt)->ops->set_key(sec.keys[key], 13, NULL,
+					       (*crypt)->priv);
+			sec.key_sizes[key] = 13;
+			sec.flags |= (1 << key);
+		}
+
+		/* No key data - just set the default TX key index */
+		if (key_provided) {
+			IEEE80211_DEBUG_WX(
+				"Setting key %d to default Tx key.\n", key);
+			ieee->tx_keyidx = key;
+			sec.active_key = key;
+			sec.flags |= SEC_ACTIVE_KEY;
+		}
+	}
+
+ done:
+	ieee->open_wep = !(erq->flags & IW_ENCODE_RESTRICTED);
+	sec.auth_mode = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
+	sec.flags |= SEC_AUTH_MODE;
+	IEEE80211_DEBUG_WX("Auth: %s\n", sec.auth_mode == WLAN_AUTH_OPEN ?
+			   "OPEN" : "SHARED KEY");
+
+	/* For now we just support WEP, so only set that security level...
+	 * TODO: When WPA is added this is one place that needs to change */
+	sec.flags |= SEC_LEVEL;
+	sec.level = SEC_LEVEL_1; /* 40 and 104 bit WEP */
+
+	if (ieee->set_security)
+		ieee->set_security(dev, &sec);
+
+	/* Do not reset port if card is in Managed mode since resetting will
+	 * generate new IEEE 802.11 authentication which may end up in looping
+	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
+	 * configuration (for example... Prism2), implement the reset_port in
+	 * the callbacks structures used to initialize the 802.11 stack. */
+	if (ieee->reset_on_keychange &&
+	    ieee->iw_mode != IW_MODE_INFRA &&
+	    ieee->reset_port && ieee->reset_port(dev)) {
+		printk(KERN_DEBUG "%s: reset_port failed\n", dev->name);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	struct iw_point *erq = &(wrqu->encoding);
+	int len, key;
+	struct ieee80211_crypt_data *crypt;
+
+	IEEE80211_DEBUG_WX("GET_ENCODE\n");
+
+	if(ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	key = erq->flags & IW_ENCODE_INDEX;
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+	} else
+		key = ieee->tx_keyidx;
+
+	crypt = ieee->crypt[key];
+	erq->flags = key + 1;
+
+	if (crypt == NULL || crypt->ops == NULL) {
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+		return 0;
+	}
+
+	if (strcmp(crypt->ops->name, "WEP") != 0) {
+		/* only WEP is supported with wireless extensions, so just
+		 * report that encryption is used */
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_ENABLED;
+		return 0;
+	}
+
+	len = crypt->ops->get_key(keybuf, WEP_KEY_LEN, NULL, crypt->priv);
+	erq->length = (len >= 0 ? len : 0);
+
+	erq->flags |= IW_ENCODE_ENABLED;
+
+	if (ieee->open_wep)
+		erq->flags |= IW_ENCODE_OPEN;
+	else
+		erq->flags |= IW_ENCODE_RESTRICTED;
+
+	return 0;
+}
+
+int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	struct net_device *dev = ieee->dev;
+        struct iw_point *encoding = &wrqu->encoding;
+        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+        int i, idx, ret = 0;
+        int group_key = 0;
+        const char *alg;
+        struct ieee80211_crypto_ops *ops;
+        struct ieee80211_crypt_data **crypt;
+
+        struct ieee80211_security sec = {
+                .flags = 0,
+        };
+	//printk("======>encoding flag:%x,ext flag:%x, ext alg:%d\n", encoding->flags,ext->ext_flags, ext->alg);
+        idx = encoding->flags & IW_ENCODE_INDEX;
+        if (idx) {
+                if (idx < 1 || idx > WEP_KEYS)
+                        return -EINVAL;
+                idx--;
+        } else
+                idx = ieee->tx_keyidx;
+
+        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+                crypt = &ieee->crypt[idx];
+                group_key = 1;
+        } else {
+                /* some Cisco APs use idx>0 for unicast in dynamic WEP */
+		//printk("not group key, flags:%x, ext->alg:%d\n", ext->ext_flags, ext->alg);
+                if (idx != 0 && ext->alg != IW_ENCODE_ALG_WEP)
+                        return -EINVAL;
+                if (ieee->iw_mode == IW_MODE_INFRA)
+                        crypt = &ieee->crypt[idx];
+                else
+                        return -EINVAL;
+        }
+
+        sec.flags |= SEC_ENABLED;// | SEC_ENCRYPT;
+        if ((encoding->flags & IW_ENCODE_DISABLED) ||
+            ext->alg == IW_ENCODE_ALG_NONE) {
+                if (*crypt)
+                        ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+                for (i = 0; i < WEP_KEYS; i++)
+                        if (ieee->crypt[i] != NULL)
+                                break;
+
+                if (i == WEP_KEYS) {
+                        sec.enabled = 0;
+                      //  sec.encrypt = 0;
+                        sec.level = SEC_LEVEL_0;
+                        sec.flags |= SEC_LEVEL;
+                }
+		//printk("disabled: flag:%x\n", encoding->flags);
+                goto done;
+        }
+
+	sec.enabled = 1;
+    //    sec.encrypt = 1;
+
+        switch (ext->alg) {
+        case IW_ENCODE_ALG_WEP:
+                alg = "WEP";
+                break;
+        case IW_ENCODE_ALG_TKIP:
+                alg = "TKIP";
+                break;
+        case IW_ENCODE_ALG_CCMP:
+                alg = "CCMP";
+                break;
+        default:
+                IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
+                                   dev->name, ext->alg);
+                ret = -EINVAL;
+                goto done;
+        }
+//	printk("8-09-08-9=====>%s, alg name:%s\n",__func__, alg);
+
+	 ops = ieee80211_get_crypto_ops(alg);
+        if (ops == NULL)
+                ops = ieee80211_get_crypto_ops(alg);
+        if (ops == NULL) {
+                IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
+                                   dev->name, ext->alg);
+		printk("========>unknown crypto alg %d\n", ext->alg);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        if (*crypt == NULL || (*crypt)->ops != ops) {
+                struct ieee80211_crypt_data *new_crypt;
+
+                ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+                new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
+                if (new_crypt == NULL) {
+                        ret = -ENOMEM;
+                        goto done;
+                }
+                new_crypt->ops = ops;
+                if (new_crypt->ops)
+                        new_crypt->priv = new_crypt->ops->init(idx);
+                if (new_crypt->priv == NULL) {
+                        kfree(new_crypt);
+                        ret = -EINVAL;
+                        goto done;
+                }
+                *crypt = new_crypt;
+
+ 	}
+
+        if (ext->key_len > 0 && (*crypt)->ops->set_key &&
+            (*crypt)->ops->set_key(ext->key, ext->key_len, ext->rx_seq,
+                                   (*crypt)->priv) < 0) {
+                IEEE80211_DEBUG_WX("%s: key setting failed\n", dev->name);
+		printk("key setting failed\n");
+                ret = -EINVAL;
+                goto done;
+        }
+#if 1
+ //skip_host_crypt:
+	//printk("skip_host_crypt:ext_flags:%x\n", ext->ext_flags);
+        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+                ieee->tx_keyidx = idx;
+                sec.active_key = idx;
+                sec.flags |= SEC_ACTIVE_KEY;
+        }
+
+        if (ext->alg != IW_ENCODE_ALG_NONE) {
+                memcpy(sec.keys[idx], ext->key, ext->key_len);
+                sec.key_sizes[idx] = ext->key_len;
+                sec.flags |= (1 << idx);
+                if (ext->alg == IW_ENCODE_ALG_WEP) {
+                      //  sec.encode_alg[idx] = SEC_ALG_WEP;
+                        sec.flags |= SEC_LEVEL;
+                        sec.level = SEC_LEVEL_1;
+                } else if (ext->alg == IW_ENCODE_ALG_TKIP) {
+                      //  sec.encode_alg[idx] = SEC_ALG_TKIP;
+                        sec.flags |= SEC_LEVEL;
+                        sec.level = SEC_LEVEL_2;
+                } else if (ext->alg == IW_ENCODE_ALG_CCMP) {
+                       // sec.encode_alg[idx] = SEC_ALG_CCMP;
+                        sec.flags |= SEC_LEVEL;
+                        sec.level = SEC_LEVEL_3;
+                }
+                /* Don't set sec level for group keys. */
+                if (group_key)
+                        sec.flags &= ~SEC_LEVEL;
+        }
+#endif
+done:
+        if (ieee->set_security)
+                ieee->set_security(ieee->dev, &sec);
+
+	 if (ieee->reset_on_keychange &&
+            ieee->iw_mode != IW_MODE_INFRA &&
+            ieee->reset_port && ieee->reset_port(dev)) {
+                IEEE80211_DEBUG_WX("%s: reset_port failed\n", dev->name);
+                return -EINVAL;
+        }
+
+        return ret;
+}
+int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	struct iw_mlme *mlme = (struct iw_mlme *) extra;
+//	printk("\ndkgadfslkdjgalskdf===============>%s(), cmd:%x\n", __func__, mlme->cmd);
+#if 1
+	switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+	case IW_MLME_DISASSOC:
+	//	printk("disassoc now\n");
+		ieee80211_disassociate(ieee);
+		break;
+	 default:
+                return -EOPNOTSUPP;
+        }
+#endif
+	return 0;
+}
+
+int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
+                               struct iw_request_info *info,
+                               struct iw_param *data, char *extra)
+{
+/*
+	 struct ieee80211_security sec = {
+                .flags = SEC_AUTH_MODE,
+	}
+*/
+	//printk("set auth:flag:%x, data value:%x\n", data->flags, data->value);
+	switch (data->flags & IW_AUTH_INDEX) {
+        case IW_AUTH_WPA_VERSION:
+	     /*need to support wpa2 here*/
+		//printk("wpa version:%x\n", data->value);
+		break;
+        case IW_AUTH_CIPHER_PAIRWISE:
+        case IW_AUTH_CIPHER_GROUP:
+        case IW_AUTH_KEY_MGMT:
+                /*
+ *                  * Host AP driver does not use these parameters and allows
+ *                                   * wpa_supplicant to control them internally.
+ *                                                    */
+                break;
+        case IW_AUTH_TKIP_COUNTERMEASURES:
+                ieee->tkip_countermeasures = data->value;
+                break;
+        case IW_AUTH_DROP_UNENCRYPTED:
+                ieee->drop_unencrypted = data->value;
+		break;
+
+	case IW_AUTH_80211_AUTH_ALG:
+		ieee->open_wep = (data->value&IW_AUTH_ALG_OPEN_SYSTEM)?1:0;
+		//printk("open_wep:%d\n", ieee->open_wep);
+		break;
+
+#if 1
+	case IW_AUTH_WPA_ENABLED:
+		ieee->wpa_enabled = (data->value)?1:0;
+		//printk("enable wpa:%d\n", ieee->wpa_enabled);
+		break;
+
+#endif
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+                ieee->ieee802_1x = data->value;
+		break;
+	case IW_AUTH_PRIVACY_INVOKED:
+		ieee->privacy_invoked = data->value;
+		break;
+	default:
+                return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+#if 1
+int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len)
+{
+	u8 *buf = NULL;
+
+	if (len>MAX_WPA_IE_LEN || (len && ie == NULL))
+	{
+		printk("return error out, len:%zu\n", len);
+	return -EINVAL;
+	}
+
+	if (len)
+	{
+		if (len != ie[1]+2){
+			printk("len:%zu, ie:%d\n", len, ie[1]);
+			return -EINVAL;
+		}
+		buf = kmemdup(ie, len, GFP_KERNEL);
+		if (buf == NULL)
+			return -ENOMEM;
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = buf;
+		ieee->wpa_ie_len = len;
+	}
+	else{
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = NULL;
+		ieee->wpa_ie_len = 0;
+	}
+//	printk("<=====out %s()\n", __func__);
+
+	return 0;
+
+}
+#endif
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
new file mode 100644
index 00000000..a2c46ae4
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -0,0 +1,718 @@
+/*
+   This is part of rtl8180 OpenSource driver.
+   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public Licence)
+
+   Parts of this driver are based on the GPL part of the
+   official realtek driver
+
+   Parts of this driver are based on the rtl8180 driver skeleton
+   from Patric Schenke & Andres Salomon
+
+   Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+   We want to tanks the Authors of those projects and the Ndiswrapper
+   project Authors.
+*/
+
+#ifndef R8180H
+#define R8180H
+
+#include <linux/interrupt.h>
+
+#define RTL8180_MODULE_NAME "r8180"
+#define DMESG(x,a...) printk(KERN_INFO RTL8180_MODULE_NAME ": " x "\n", ## a)
+#define DMESGW(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": WW:" x "\n", ## a)
+#define DMESGE(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": EE:" x "\n", ## a)
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+//#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/rtnetlink.h>	//for rtnl_lock()
+#include <linux/wireless.h>
+#include <linux/timer.h>
+#include <linux/proc_fs.h>	// Necessary because we use the proc fs
+#include <linux/if_arp.h>
+#include "ieee80211/ieee80211.h"
+#include <asm/io.h>
+//#include <asm/semaphore.h>
+
+#define EPROM_93c46 0
+#define EPROM_93c56 1
+
+#define RTL_IOCTL_WPA_SUPPLICANT		SIOCIWFIRSTPRIV+30
+
+#define DEFAULT_FRAG_THRESHOLD 2342U
+#define MIN_FRAG_THRESHOLD     256U
+#define DEFAULT_RTS_THRESHOLD 2342U
+#define MIN_RTS_THRESHOLD 0U
+#define MAX_RTS_THRESHOLD 2342U
+#define DEFAULT_BEACONINTERVAL 0x64U
+
+#define DEFAULT_RETRY_RTS 7
+#define DEFAULT_RETRY_DATA 7
+
+#define BEACON_QUEUE					6
+
+#define aSifsTime 	10
+
+#define sCrcLng         4
+#define sAckCtsLng	112		// bits in ACK and CTS frames
+//+by amy 080312
+#define RATE_ADAPTIVE_TIMER_PERIOD	300
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+} WIRELESS_MODE;
+
+typedef struct 	ChnlAccessSetting {
+	u16 SIFS_Timer;
+	u16 DIFS_Timer;
+	u16 SlotTimeTimer;
+	u16 EIFS_Timer;
+	u16 CWminIndex;
+	u16 CWmaxIndex;
+}*PCHANNEL_ACCESS_SETTING,CHANNEL_ACCESS_SETTING;
+
+typedef enum{
+        NIC_8185 = 1,
+        NIC_8185B
+        } nic_t;
+
+typedef u32 AC_CODING;
+#define AC0_BE	0		// ACI: 0x00	// Best Effort
+#define AC1_BK	1		// ACI: 0x01	// Background
+#define AC2_VI	2		// ACI: 0x10	// Video
+#define AC3_VO	3		// ACI: 0x11	// Voice
+#define AC_MAX	4		// Max: define total number; Should not to be used as a real enum.
+
+//
+// ECWmin/ECWmax field.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.13.
+//
+typedef	union _ECW{
+	u8	charData;
+	struct
+	{
+		u8	ECWmin:4;
+		u8	ECWmax:4;
+	}f;	// Field
+}ECW, *PECW;
+
+//
+// ACI/AIFSN Field.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
+//
+typedef	union _ACI_AIFSN{
+	u8	charData;
+
+	struct
+	{
+		u8	AIFSN:4;
+		u8	ACM:1;
+		u8	ACI:2;
+		u8	Reserved:1;
+	}f;	// Field
+}ACI_AIFSN, *PACI_AIFSN;
+
+//
+// AC Parameters Record Format.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
+//
+typedef	union _AC_PARAM{
+	u32	longData;
+	u8	charData[4];
+
+	struct
+	{
+		ACI_AIFSN	AciAifsn;
+		ECW		Ecw;
+		u16		TXOPLimit;
+	}f;	// Field
+}AC_PARAM, *PAC_PARAM;
+
+/* it is a wrong definition. -xiong-2006-11-17
+typedef struct ThreeWireReg {
+	u16	longData;
+	struct {
+		u8	enableB;
+		u8	data;
+		u8	clk;
+		u8	read_write;
+	} struc;
+} ThreeWireReg;
+*/
+
+typedef	union _ThreeWire{
+	struct _ThreeWireStruc{
+		u16		data:1;
+		u16		clk:1;
+		u16		enableB:1;
+		u16		read_write:1;
+		u16		resv1:12;
+//		u2Byte	resv2:14;
+//		u2Byte	ThreeWireEnable:1;
+//		u2Byte	resv3:1;
+	}struc;
+	u16			longData;
+}ThreeWireReg;
+
+
+typedef struct buffer
+{
+	struct buffer *next;
+	u32 *buf;
+	dma_addr_t dma;
+} buffer;
+
+//YJ,modified,080828
+typedef struct Stats
+{
+	unsigned long txrdu;
+	unsigned long rxrdu;
+	unsigned long rxnolast;
+	unsigned long rxnodata;
+//	unsigned long rxreset;
+//	unsigned long rxwrkaround;
+	unsigned long rxnopointer;
+	unsigned long txnperr;
+	unsigned long txresumed;
+	unsigned long rxerr;
+	unsigned long rxoverflow;
+	unsigned long rxint;
+	unsigned long txbkpokint;
+	unsigned long txbepoking;
+	unsigned long txbkperr;
+	unsigned long txbeperr;
+	unsigned long txnpokint;
+	unsigned long txhpokint;
+	unsigned long txhperr;
+	unsigned long ints;
+	unsigned long shints;
+	unsigned long txoverflow;
+	unsigned long rxdmafail;
+	unsigned long txbeacon;
+	unsigned long txbeaconerr;
+	unsigned long txlpokint;
+	unsigned long txlperr;
+	unsigned long txretry;//retry number  tony 20060601
+	unsigned long rxcrcerrmin;//crc error (0-500)
+	unsigned long rxcrcerrmid;//crc error (500-1000)
+	unsigned long rxcrcerrmax;//crc error (>1000)
+	unsigned long rxicverr;//ICV error
+} Stats;
+
+#define MAX_LD_SLOT_NUM 10
+#define KEEP_ALIVE_INTERVAL 				20 // in seconds.
+#define CHECK_FOR_HANG_PERIOD			2 //be equal to watchdog check time
+#define DEFAULT_KEEP_ALIVE_LEVEL			1
+#define DEFAULT_SLOT_NUM					2
+#define POWER_PROFILE_AC					0
+#define POWER_PROFILE_BATTERY			1
+
+typedef struct _link_detect_t
+{
+	u32				RxFrameNum[MAX_LD_SLOT_NUM];	// number of Rx Frame / CheckForHang_period  to determine link status
+	u16				SlotNum;	// number of CheckForHang period to determine link status, default is 2
+	u16				SlotIndex;
+
+	u32				NumTxOkInPeriod;  //number of packet transmitted during CheckForHang
+	u32				NumRxOkInPeriod;  //number of packet received during CheckForHang
+
+	u8				IdleCount;     // (KEEP_ALIVE_INTERVAL / CHECK_FOR_HANG_PERIOD)
+	u32				LastNumTxUnicast;
+	u32				LastNumRxUnicast;
+
+	bool				bBusyTraffic;    //when it is set to 1, UI cann't scan at will.
+}link_detect_t, *plink_detect_t;
+
+//YJ,modified,080828,end
+
+//by amy for led
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_8185{
+	SW_LED_MODE0, //
+	SW_LED_MODE1, //
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes)
+}LED_STRATEGY_8185, *PLED_STRATEGY_8185;
+//by amy for led
+//by amy for power save
+typedef	enum _LED_CTL_MODE{
+	LED_CTL_POWER_ON = 1,
+	LED_CTL_LINK = 2,
+	LED_CTL_NO_LINK = 3,
+	LED_CTL_TX = 4,
+	LED_CTL_RX = 5,
+	LED_CTL_SITE_SURVEY = 6,
+	LED_CTL_POWER_OFF = 7
+}LED_CTL_MODE;
+
+typedef	enum _RT_RF_POWER_STATE
+{
+	eRfOn,
+	eRfSleep,
+	eRfOff
+}RT_RF_POWER_STATE;
+
+enum	_ReasonCode{
+	unspec_reason	= 0x1,
+	auth_not_valid	= 0x2,
+	deauth_lv_ss	= 0x3,
+	inactivity		= 0x4,
+	ap_overload		= 0x5,
+	class2_err		= 0x6,
+	class3_err		= 0x7,
+	disas_lv_ss		= 0x8,
+	asoc_not_auth	= 0x9,
+
+	//----MIC_CHECK
+	mic_failure		= 0xe,
+	//----END MIC_CHECK
+
+	// Reason code defined in 802.11i D10.0 p.28.
+	invalid_IE		= 0x0d,
+	four_way_tmout	= 0x0f,
+	two_way_tmout	= 0x10,
+	IE_dismatch		= 0x11,
+	invalid_Gcipher	= 0x12,
+	invalid_Pcipher	= 0x13,
+	invalid_AKMP	= 0x14,
+	unsup_RSNIEver = 0x15,
+	invalid_RSNIE	= 0x16,
+	auth_802_1x_fail= 0x17,
+	ciper_reject		= 0x18,
+
+	// Reason code defined in 7.3.1.7, 802.1e D13.0, p.42. Added by Annie, 2005-11-15.
+	QoS_unspec		= 0x20,	// 32
+	QAP_bandwidth	= 0x21,	// 33
+	poor_condition	= 0x22,	// 34
+	no_facility		= 0x23,	// 35
+							// Where is 36???
+	req_declined	= 0x25,	// 37
+	invalid_param	= 0x26,	// 38
+	req_not_honored= 0x27,	// 39
+	TS_not_created	= 0x2F,	// 47
+	DL_not_allowed	= 0x30,	// 48
+	dest_not_exist	= 0x31,	// 49
+	dest_not_QSTA	= 0x32,	// 50
+};
+typedef	enum _RT_PS_MODE
+{
+	eActive,	// Active/Continuous access.
+	eMaxPs,		// Max power save mode.
+	eFastPs		// Fast power save mode.
+}RT_PS_MODE;
+//by amy for power save
+typedef struct r8180_priv
+{
+	struct pci_dev *pdev;
+
+	short epromtype;
+	int irq;
+	struct ieee80211_device *ieee80211;
+
+	short phy_ver; /* meaningful for rtl8225 1:A 2:B 3:C */
+	short enable_gpio0;
+	short hw_plcp_len;
+	short plcp_preamble_mode; // 0:auto 1:short 2:long
+
+	spinlock_t irq_lock;
+	spinlock_t irq_th_lock;
+	spinlock_t tx_lock;
+	spinlock_t ps_lock;
+	spinlock_t rf_ps_lock;
+
+	u16 irq_mask;
+	short irq_enabled;
+	struct net_device *dev;
+	short chan;
+	short sens;
+	short max_sens;
+	u8 chtxpwr[15]; //channels from 1 to 14, 0 not used
+	u8 chtxpwr_ofdm[15]; //channels from 1 to 14, 0 not used
+	//u8 challow[15]; //channels from 1 to 14, 0 not used
+	u8 channel_plan;  // it's the channel plan index
+	short up;
+	short crcmon; //if 1 allow bad crc frame reception in monitor mode
+	short prism_hdr;
+
+	struct timer_list scan_timer;
+	/*short scanpending;
+	short stopscan;*/
+	spinlock_t scan_lock;
+	u8 active_probe;
+	//u8 active_scan_num;
+	struct semaphore wx_sem;
+	struct semaphore rf_state;
+	short hw_wep;
+
+	short digphy;
+	short antb;
+	short diversity;
+	u8 cs_treshold;
+	short rcr_csense;
+	u32 key0[4];
+	short (*rf_set_sens)(struct net_device *dev,short sens);
+	void (*rf_set_chan)(struct net_device *dev,short ch);
+	void (*rf_close)(struct net_device *dev);
+	void (*rf_init)(struct net_device *dev);
+	void (*rf_sleep)(struct net_device *dev);
+	void (*rf_wakeup)(struct net_device *dev);
+	//short rate;
+	short promisc;
+	/*stats*/
+	struct Stats stats;
+	struct _link_detect_t link_detect;  //YJ,add,080828
+	struct iw_statistics wstats;
+	struct proc_dir_entry *dir_dev;
+
+	/*RX stuff*/
+	u32 *rxring;
+	u32 *rxringtail;
+	dma_addr_t rxringdma;
+	struct buffer *rxbuffer;
+	struct buffer *rxbufferhead;
+	int rxringcount;
+	u16 rxbuffersize;
+
+	struct sk_buff *rx_skb;
+
+	short rx_skb_complete;
+
+	u32 rx_prevlen;
+
+	/*TX stuff*/
+/*
+	u32 *txlpring;
+	u32 *txhpring;
+	u32 *txnpring;
+	dma_addr_t txlpringdma;
+	dma_addr_t txhpringdma;
+	dma_addr_t txnpringdma;
+	u32 *txlpringtail;
+	u32 *txhpringtail;
+	u32 *txnpringtail;
+	u32 *txlpringhead;
+	u32 *txhpringhead;
+	u32 *txnpringhead;
+	struct buffer *txlpbufs;
+	struct buffer *txhpbufs;
+	struct buffer *txnpbufs;
+	struct buffer *txlpbufstail;
+	struct buffer *txhpbufstail;
+	struct buffer *txnpbufstail;
+*/
+	u32 *txmapring;
+	u32 *txbkpring;
+	u32 *txbepring;
+	u32 *txvipring;
+	u32 *txvopring;
+	u32 *txhpring;
+	dma_addr_t txmapringdma;
+	dma_addr_t txbkpringdma;
+	dma_addr_t txbepringdma;
+	dma_addr_t txvipringdma;
+	dma_addr_t txvopringdma;
+	dma_addr_t txhpringdma;
+	u32 *txmapringtail;
+	u32 *txbkpringtail;
+	u32 *txbepringtail;
+	u32 *txvipringtail;
+	u32 *txvopringtail;
+	u32 *txhpringtail;
+	u32 *txmapringhead;
+	u32 *txbkpringhead;
+	u32 *txbepringhead;
+	u32 *txvipringhead;
+	u32 *txvopringhead;
+	u32 *txhpringhead;
+	struct buffer *txmapbufs;
+	struct buffer *txbkpbufs;
+	struct buffer *txbepbufs;
+	struct buffer *txvipbufs;
+	struct buffer *txvopbufs;
+	struct buffer *txhpbufs;
+	struct buffer *txmapbufstail;
+	struct buffer *txbkpbufstail;
+	struct buffer *txbepbufstail;
+	struct buffer *txvipbufstail;
+	struct buffer *txvopbufstail;
+	struct buffer *txhpbufstail;
+
+	int txringcount;
+	int txbuffsize;
+	//struct tx_pendingbuf txnp_pending;
+	//struct tasklet_struct irq_tx_tasklet;
+	struct tasklet_struct irq_rx_tasklet;
+	u8 dma_poll_mask;
+	//short tx_suspend;
+
+	/* adhoc/master mode stuff */
+	u32 *txbeaconringtail;
+	dma_addr_t txbeaconringdma;
+	u32 *txbeaconring;
+	int txbeaconcount;
+	struct buffer *txbeaconbufs;
+	struct buffer *txbeaconbufstail;
+	//char *master_essid;
+	//u16 master_beaconinterval;
+	//u32 master_beaconsize;
+	//u16 beacon_interval;
+
+	u8 retry_data;
+	u8 retry_rts;
+	u16 rts;
+
+//by amy for led
+	LED_STRATEGY_8185 LedStrategy;
+//by amy for led
+
+//by amy for power save
+	struct timer_list watch_dog_timer;
+	bool bInactivePs;
+	bool bSwRfProcessing;
+	RT_RF_POWER_STATE	eInactivePowerState;
+	RT_RF_POWER_STATE eRFPowerState;
+	u32 RfOffReason;
+	bool RFChangeInProgress;
+	bool bInHctTest;
+	bool SetRFPowerStateInProgress;
+	u8   RFProgType;
+	bool bLeisurePs;
+	RT_PS_MODE dot11PowerSaveMode;
+	//u32 NumRxOkInPeriod;   //YJ,del,080828
+	//u32 NumTxOkInPeriod;   //YJ,del,080828
+	u8   TxPollingTimes;
+
+	bool	bApBufOurFrame;// TRUE if AP buffer our unicast data , we will keep eAwake until receive data or timeout.
+	u8	WaitBufDataBcnCount;
+	u8	WaitBufDataTimeOut;
+
+//by amy for power save
+//by amy for antenna
+	u8 EEPROMSwAntennaDiversity;
+	bool EEPROMDefaultAntenna1;
+	u8 RegSwAntennaDiversityMechanism;
+	bool bSwAntennaDiverity;
+	u8 RegDefaultAntenna;
+	bool bDefaultAntenna1;
+	u8 SignalStrength;
+	long Stats_SignalStrength;
+	long LastSignalStrengthInPercent; // In percentange, used for smoothing, e.g. Moving Average.
+	u8	 SignalQuality; // in 0-100 index.
+	long Stats_SignalQuality;
+	long RecvSignalPower; // in dBm.
+	long Stats_RecvSignalPower;
+	u8	 LastRxPktAntenna;	// +by amy 080312 Antenn which received the lasted packet. 0: Aux, 1:Main. Added by Roger, 2008.01.25.
+	u32 AdRxOkCnt;
+	long AdRxSignalStrength;
+	u8 CurrAntennaIndex;			// Index to current Antenna (both Tx and Rx).
+	u8 AdTickCount;				// Times of SwAntennaDiversityTimer happened.
+	u8 AdCheckPeriod;				// # of period SwAntennaDiversityTimer to check Rx signal strength for SW Antenna Diversity.
+	u8 AdMinCheckPeriod;			// Min value of AdCheckPeriod.
+	u8 AdMaxCheckPeriod;			// Max value of AdCheckPeriod.
+	long AdRxSsThreshold;			// Signal strength threshold to switch antenna.
+	long AdMaxRxSsThreshold;			// Max value of AdRxSsThreshold.
+	bool bAdSwitchedChecking;		// TRUE if we shall shall check Rx signal strength for last time switching antenna.
+	long AdRxSsBeforeSwitched;		// Rx signal strength before we swithed antenna.
+	struct timer_list SwAntennaDiversityTimer;
+//by amy for antenna
+//{by amy 080312
+//
+	// Crystal calibration.
+	// Added by Roger, 2007.12.11.
+	//
+	bool		bXtalCalibration; // Crystal calibration.
+	u8			XtalCal_Xin; // Crystal calibration for Xin. 0~7.5pF
+	u8			XtalCal_Xout; // Crystal calibration for Xout. 0~7.5pF
+	//
+	// Tx power tracking with thermal meter indication.
+	// Added by Roger, 2007.12.11.
+	//
+	bool		bTxPowerTrack; // Tx Power tracking.
+	u8			ThermalMeter; // Thermal meter reference indication.
+	//
+	// Dynamic Initial Gain Adjustment Mechanism. Added by Bruce, 2007-02-14.
+	//
+	bool				bDigMechanism; // TRUE if DIG is enabled, FALSE ow.
+	bool				bRegHighPowerMechanism; // For High Power Mechanism. 061010, by rcnjko.
+	u32					FalseAlarmRegValue;
+	u8					RegDigOfdmFaUpTh; // Upper threhold of OFDM false alarm, which is used in DIG.
+	u8					DIG_NumberFallbackVote;
+	u8					DIG_NumberUpgradeVote;
+	// For HW antenna diversity, added by Roger, 2008.01.30.
+	u32			AdMainAntennaRxOkCnt;		// Main antenna Rx OK count.
+	u32			AdAuxAntennaRxOkCnt;		// Aux antenna Rx OK count.
+	bool		bHWAdSwitched;				// TRUE if we has switched default antenna by HW evaluation.
+	// RF High Power upper/lower threshold.
+	u8					RegHiPwrUpperTh;
+	u8					RegHiPwrLowerTh;
+	// RF RSSI High Power upper/lower Threshold.
+	u8					RegRSSIHiPwrUpperTh;
+	u8					RegRSSIHiPwrLowerTh;
+	// Current CCK RSSI value to determine CCK high power, asked by SD3 DZ, by Bruce, 2007-04-12.
+	u8			CurCCKRSSI;
+	bool        bCurCCKPkt;
+	//
+	// High Power Mechanism. Added by amy, 080312.
+	//
+	bool					bToUpdateTxPwr;
+	long					UndecoratedSmoothedSS;
+	long					UndercorateSmoothedRxPower;
+	u8						RSSI;
+	char					RxPower;
+	 u8 InitialGain;
+	 //For adjust Dig Threshold during Legacy/Leisure Power Save Mode
+	u32				DozePeriodInPast2Sec;
+	 // Don't access BB/RF under disable PLL situation.
+	u8					InitialGainBackUp;
+	 u8 RegBModeGainStage;
+//by amy for rate adaptive
+    struct timer_list rateadapter_timer;
+	u32    RateAdaptivePeriod;
+	bool   bEnhanceTxPwr;
+	bool   bUpdateARFR;
+	int	   ForcedDataRate; // Force Data Rate. 0: Auto, 0x02: 1M ~ 0x6C: 54M.)
+	u32     NumTxUnicast; //YJ,add,080828,for keep alive
+	u8      keepAliveLevel; //YJ,add,080828,for KeepAlive
+	unsigned long 	NumTxOkTotal;
+	u16                                 LastRetryCnt;
+        u16                                     LastRetryRate;
+        unsigned long       LastTxokCnt;
+        unsigned long           LastRxokCnt;
+        u16                                     CurrRetryCnt;
+        unsigned long           LastTxOKBytes;
+	unsigned long 		    NumTxOkBytesTotal;
+        u8                          LastFailTxRate;
+        long                        LastFailTxRateSS;
+        u8                          FailTxRateCount;
+        u32                         LastTxThroughput;
+        //for up rate
+        unsigned short          bTryuping;
+        u8                                      CurrTxRate;     //the rate before up
+        u16                                     CurrRetryRate;
+        u16                                     TryupingCount;
+        u8                                      TryDownCountLowData;
+        u8                                      TryupingCountNoData;
+
+        u8                  CurrentOperaRate;
+//by amy for rate adaptive
+//by amy 080312}
+//	short wq_hurryup;
+//	struct workqueue_struct *workqueue;
+	struct work_struct reset_wq;
+	struct work_struct watch_dog_wq;
+	struct work_struct tx_irq_wq;
+	short ack_tx_to_ieee;
+
+	u8 PowerProfile;
+	u32 CSMethod;
+	u8 cck_txpwr_base;
+	u8 ofdm_txpwr_base;
+	u8 dma_poll_stop_mask;
+
+	//u8 RegThreeWireMode;
+	u8 MWIEnable;
+	u16 ShortRetryLimit;
+	u16 LongRetryLimit;
+	u16 EarlyRxThreshold;
+	u32 TransmitConfig;
+	u32 ReceiveConfig;
+	u32 IntrMask;
+
+	struct 	ChnlAccessSetting  ChannelAccessSetting;
+}r8180_priv;
+
+#define MANAGE_PRIORITY 0
+#define BK_PRIORITY 1
+#define BE_PRIORITY 2
+#define VI_PRIORITY 3
+#define VO_PRIORITY 4
+#define HI_PRIORITY 5
+#define BEACON_PRIORITY 6
+
+#define LOW_PRIORITY VI_PRIORITY
+#define NORM_PRIORITY VO_PRIORITY
+//AC2Queue mapping
+#define AC2Q(_ac) (((_ac) == WME_AC_VO) ? VO_PRIORITY : \
+		((_ac) == WME_AC_VI) ? VI_PRIORITY : \
+		((_ac) == WME_AC_BK) ? BK_PRIORITY : \
+		BE_PRIORITY)
+
+short rtl8180_tx(struct net_device *dev,u8* skbuf, int len,int priority,
+	short morefrag,short fragdesc,int rate);
+
+u8 read_nic_byte(struct net_device *dev, int x);
+u32 read_nic_dword(struct net_device *dev, int x);
+u16 read_nic_word(struct net_device *dev, int x) ;
+void write_nic_byte(struct net_device *dev, int x,u8 y);
+void write_nic_word(struct net_device *dev, int x,u16 y);
+void write_nic_dword(struct net_device *dev, int x,u32 y);
+void force_pci_posting(struct net_device *dev);
+
+void rtl8180_rtx_disable(struct net_device *);
+void rtl8180_rx_enable(struct net_device *);
+void rtl8180_tx_enable(struct net_device *);
+void rtl8180_start_scanning(struct net_device *dev);
+void rtl8180_start_scanning_s(struct net_device *dev);
+void rtl8180_stop_scanning(struct net_device *dev);
+void rtl8180_disassociate(struct net_device *dev);
+//void fix_rx_fifo(struct net_device *dev);
+void rtl8180_set_anaparam(struct net_device *dev,u32 a);
+void rtl8185_set_anaparam2(struct net_device *dev,u32 a);
+void rtl8180_set_hw_wep(struct net_device *dev);
+void rtl8180_no_hw_wep(struct net_device *dev);
+void rtl8180_update_msr(struct net_device *dev);
+//void rtl8180_BSS_create(struct net_device *dev);
+void rtl8180_beacon_tx_disable(struct net_device *dev);
+void rtl8180_beacon_rx_disable(struct net_device *dev);
+void rtl8180_conttx_enable(struct net_device *dev);
+void rtl8180_conttx_disable(struct net_device *dev);
+int rtl8180_down(struct net_device *dev);
+int rtl8180_up(struct net_device *dev);
+void rtl8180_commit(struct net_device *dev);
+void rtl8180_set_chan(struct net_device *dev,short ch);
+void rtl8180_set_master_essid(struct net_device *dev,char *essid);
+void rtl8180_update_beacon_security(struct net_device *dev);
+void write_phy(struct net_device *dev, u8 adr, u8 data);
+void write_phy_cck(struct net_device *dev, u8 adr, u32 data);
+void write_phy_ofdm(struct net_device *dev, u8 adr, u32 data);
+void rtl8185_tx_antenna(struct net_device *dev, u8 ant);
+void rtl8185_rf_pins_enable(struct net_device *dev);
+void IBSS_randomize_cell(struct net_device *dev);
+void IPSEnter(struct net_device *dev);
+void IPSLeave(struct net_device *dev);
+int get_curr_tx_free_desc(struct net_device *dev, int priority);
+void UpdateInitialGain(struct net_device *dev);
+bool SetAntennaConfig87SE(struct net_device *dev, u8  DefaultAnt, bool bAntDiversity);
+
+//#ifdef CONFIG_RTL8185B
+void rtl8185b_adapter_start(struct net_device *dev);
+void rtl8185b_rx_enable(struct net_device *dev);
+void rtl8185b_tx_enable(struct net_device *dev);
+void rtl8180_reset(struct net_device *dev);
+void rtl8185b_irq_enable(struct net_device *dev);
+void fix_rx_fifo(struct net_device *dev);
+void fix_tx_fifo(struct net_device *dev);
+void rtl8225z2_SetTXPowerLevel(struct net_device *dev, short ch);
+void rtl8180_rate_adapter(struct work_struct * work);
+//#endif
+bool MgntActSet_RF_State(struct net_device *dev, RT_RF_POWER_STATE StateToSet, u32 ChangeSource);
+
+#endif
diff --git a/drivers/staging/rtl8187se/r8180_93cx6.h b/drivers/staging/rtl8187se/r8180_93cx6.h
new file mode 100644
index 00000000..79e7391a
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_93cx6.h
@@ -0,0 +1,54 @@
+/*
+	This is part of rtl8180 OpenSource driver
+	Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the official realtek driver
+	Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
+	Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+	We want to tanks the Authors of such projects and the Ndiswrapper project Authors.
+*/
+
+/*This files contains card eeprom (93c46 or 93c56) programming routines*/
+/*memory is addressed by WORDS*/
+
+#include "r8180.h"
+#include "r8180_hw.h"
+
+#define EPROM_DELAY 10
+
+#define EPROM_ANAPARAM_ADDRLWORD 0xd
+#define EPROM_ANAPARAM_ADDRHWORD 0xe
+
+#define RFCHIPID 0x6
+#define	RFCHIPID_INTERSIL 1
+#define	RFCHIPID_RFMD 2
+#define	RFCHIPID_PHILIPS 3
+#define	RFCHIPID_MAXIM 4
+#define	RFCHIPID_GCT 5
+#define RFCHIPID_RTL8225 9
+#define RF_ZEBRA2 11
+#define EPROM_TXPW_BASE 0x05
+#define RF_ZEBRA4 12
+#define RFCHIPID_RTL8255 0xa
+#define RF_PARAM 0x19
+#define RF_PARAM_DIGPHY_SHIFT 0
+#define RF_PARAM_ANTBDEFAULT_SHIFT 1
+#define RF_PARAM_CARRIERSENSE_SHIFT 2
+#define RF_PARAM_CARRIERSENSE_MASK (3<<2)
+#define ENERGY_TRESHOLD 0x17
+#define EPROM_VERSION 0x1E
+#define MAC_ADR 0x7
+
+#define CIS 0x18
+
+#define	EPROM_TXPW_OFDM_CH1_2 0x20
+
+#define	EPROM_TXPW_CH1_2 0x30
+
+#define RTL818X_EEPROM_CMD_READ		(1 << 0)
+#define RTL818X_EEPROM_CMD_WRITE	(1 << 1)
+#define RTL818X_EEPROM_CMD_CK		(1 << 2)
+#define RTL818X_EEPROM_CMD_CS		(1 << 3)
+
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
new file mode 100644
index 00000000..4fe52f6b
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -0,0 +1,4172 @@
+/*
+   This is part of rtl818x pci OpenSource driver - v 0.1
+   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public License)
+
+   Parts of this driver are based on the GPL part of the official
+   Realtek driver.
+
+   Parts of this driver are based on the rtl8180 driver skeleton
+   from Patric Schenke & Andres Salomon.
+
+   Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
+
+   Parts of BB/RF code are derived from David Young rtl8180 netbsd driver.
+
+   RSSI calc function from 'The Deuce'
+
+   Some ideas borrowed from the 8139too.c driver included in linux kernel.
+
+   We (I?) want to thanks the Authors of those projecs and also the
+   Ndiswrapper's project Authors.
+
+   A big big thanks goes also to Realtek corp. for their help in my attempt to
+   add RTL8185 and RTL8225 support, and to David Young also.
+
+   Power management interface routines.
+   Written by Mariusz Matuszek.
+*/
+
+#undef RX_DONT_PASS_UL
+#undef DUMMY_RX
+
+#include <linux/slab.h>
+#include <linux/syscalls.h>
+#include <linux/eeprom_93cx6.h>
+#include <linux/interrupt.h>
+
+#include "r8180_hw.h"
+#include "r8180.h"
+#include "r8180_rtl8225.h" /* RTL8225 Radio frontend */
+#include "r8180_93cx6.h"   /* Card EEPROM */
+#include "r8180_wx.h"
+#include "r8180_dm.h"
+
+#include "ieee80211/dot11d.h"
+
+static struct pci_device_id rtl8180_pci_id_tbl[] __devinitdata = {
+	{
+		.vendor = PCI_VENDOR_ID_REALTEK,
+		.device = 0x8199,
+		.subvendor = PCI_ANY_ID,
+		.subdevice = PCI_ANY_ID,
+		.driver_data = 0,
+	},
+	{
+		.vendor = 0,
+		.device = 0,
+		.subvendor = 0,
+		.subdevice = 0,
+		.driver_data = 0,
+	}
+};
+
+
+static char ifname[IFNAMSIZ] = "wlan%d";
+static int hwseqnum = 0;
+static int hwwep = 0;
+static int channels = 0x3fff;
+
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, rtl8180_pci_id_tbl);
+MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
+MODULE_DESCRIPTION("Linux driver for Realtek RTL8180 / RTL8185 WiFi cards");
+
+
+module_param_string(ifname, ifname, sizeof(ifname), S_IRUGO|S_IWUSR);
+module_param(hwseqnum, int, S_IRUGO|S_IWUSR);
+module_param(hwwep, int, S_IRUGO|S_IWUSR);
+module_param(channels, int, S_IRUGO|S_IWUSR);
+
+MODULE_PARM_DESC(devname, " Net interface name, wlan%d=default");
+MODULE_PARM_DESC(hwseqnum, " Try to use hardware 802.11 header sequence numbers. Zero=default");
+MODULE_PARM_DESC(hwwep, " Try to use hardware WEP support. Still broken and not available on all cards");
+MODULE_PARM_DESC(channels, " Channel bitmask for specific locales. NYI");
+
+
+static int __devinit rtl8180_pci_probe(struct pci_dev *pdev,
+				       const struct pci_device_id *id);
+
+static void __devexit rtl8180_pci_remove(struct pci_dev *pdev);
+
+static void rtl8180_shutdown(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	if (dev->netdev_ops->ndo_stop)
+		dev->netdev_ops->ndo_stop(dev);
+	pci_disable_device(pdev);
+}
+
+static int rtl8180_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+
+	if (!netif_running(dev))
+		goto out_pci_suspend;
+
+	if (dev->netdev_ops->ndo_stop)
+		dev->netdev_ops->ndo_stop(dev);
+
+	netif_device_detach(dev);
+
+out_pci_suspend:
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_set_power_state(pdev, pci_choose_state(pdev, state));
+	return 0;
+}
+
+static int rtl8180_resume(struct pci_dev *pdev)
+{
+	struct net_device *dev = pci_get_drvdata(pdev);
+	int err;
+	u32 val;
+
+	pci_set_power_state(pdev, PCI_D0);
+
+	err = pci_enable_device(pdev);
+	if (err) {
+		printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+				dev->name);
+
+		return err;
+	}
+
+	pci_restore_state(pdev);
+
+	/*
+	 * Suspend/Resume resets the PCI configuration space, so we have to
+	 * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
+	 * from interfering with C3 CPU state. pci_restore_state won't help
+	 * here since it only restores the first 64 bytes pci config header.
+	 */
+	pci_read_config_dword(pdev, 0x40, &val);
+	if ((val & 0x0000ff00) != 0)
+		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
+
+	if (!netif_running(dev))
+		goto out;
+
+	if (dev->netdev_ops->ndo_open)
+		dev->netdev_ops->ndo_open(dev);
+
+	netif_device_attach(dev);
+out:
+	return 0;
+}
+
+static struct pci_driver rtl8180_pci_driver = {
+	.name		= RTL8180_MODULE_NAME,
+	.id_table	= rtl8180_pci_id_tbl,
+	.probe		= rtl8180_pci_probe,
+	.remove		= __devexit_p(rtl8180_pci_remove),
+	.suspend	= rtl8180_suspend,
+	.resume		= rtl8180_resume,
+	.shutdown	= rtl8180_shutdown,
+};
+
+u8 read_nic_byte(struct net_device *dev, int x)
+{
+	return 0xff&readb((u8 *)dev->mem_start + x);
+}
+
+u32 read_nic_dword(struct net_device *dev, int x)
+{
+	return readl((u8 *)dev->mem_start + x);
+}
+
+u16 read_nic_word(struct net_device *dev, int x)
+{
+	return readw((u8 *)dev->mem_start + x);
+}
+
+void write_nic_byte(struct net_device *dev, int x, u8 y)
+{
+	writeb(y, (u8 *)dev->mem_start + x);
+	udelay(20);
+}
+
+void write_nic_dword(struct net_device *dev, int x, u32 y)
+{
+	writel(y, (u8 *)dev->mem_start + x);
+	udelay(20);
+}
+
+void write_nic_word(struct net_device *dev, int x, u16 y)
+{
+	writew(y, (u8 *)dev->mem_start + x);
+	udelay(20);
+}
+
+inline void force_pci_posting(struct net_device *dev)
+{
+	read_nic_byte(dev, EPROM_CMD);
+	mb();
+}
+
+irqreturn_t rtl8180_interrupt(int irq, void *netdev, struct pt_regs *regs);
+void set_nic_rxring(struct net_device *dev);
+void set_nic_txring(struct net_device *dev);
+static struct net_device_stats *rtl8180_stats(struct net_device *dev);
+void rtl8180_commit(struct net_device *dev);
+void rtl8180_start_tx_beacon(struct net_device *dev);
+
+static struct proc_dir_entry *rtl8180_proc = NULL;
+
+static int proc_get_registers(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	int len = 0;
+	int i, n;
+	int max = 0xff;
+
+	/* This dump the current register page */
+	for (n = 0; n <= max;) {
+		len += snprintf(page + len, count - len, "\nD:  %2x > ", n);
+
+		for (i = 0; i < 16 && n <= max; i++, n++)
+			len += snprintf(page + len, count - len, "%2x ",
+					read_nic_byte(dev, n));
+	}
+	len += snprintf(page + len, count - len, "\n");
+
+	*eof = 1;
+	return len;
+}
+
+int get_curr_tx_free_desc(struct net_device *dev, int priority);
+
+static int proc_get_stats_hw(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	int len = 0;
+
+	*eof = 1;
+	return len;
+}
+
+static int proc_get_stats_rx(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"RX OK: %lu\n"
+		"RX Retry: %lu\n"
+		"RX CRC Error(0-500): %lu\n"
+		"RX CRC Error(500-1000): %lu\n"
+		"RX CRC Error(>1000): %lu\n"
+		"RX ICV Error: %lu\n",
+		priv->stats.rxint,
+		priv->stats.rxerr,
+		priv->stats.rxcrcerrmin,
+		priv->stats.rxcrcerrmid,
+		priv->stats.rxcrcerrmax,
+		priv->stats.rxicverr
+		);
+
+	*eof = 1;
+	return len;
+}
+
+static int proc_get_stats_tx(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	int len = 0;
+	unsigned long totalOK;
+
+	totalOK = priv->stats.txnpokint+priv->stats.txhpokint+priv->stats.txlpokint;
+	len += snprintf(page + len, count - len,
+		"TX OK: %lu\n"
+		"TX Error: %lu\n"
+		"TX Retry: %lu\n"
+		"TX beacon OK: %lu\n"
+		"TX beacon error: %lu\n",
+		totalOK,
+		priv->stats.txnperr+priv->stats.txhperr+priv->stats.txlperr,
+		priv->stats.txretry,
+		priv->stats.txbeacon,
+		priv->stats.txbeaconerr
+	);
+
+	*eof = 1;
+	return len;
+}
+
+void rtl8180_proc_module_init(void)
+{
+	DMESG("Initializing proc filesystem");
+	rtl8180_proc = proc_mkdir(RTL8180_MODULE_NAME, init_net.proc_net);
+}
+
+void rtl8180_proc_module_remove(void)
+{
+	remove_proc_entry(RTL8180_MODULE_NAME, init_net.proc_net);
+}
+
+void rtl8180_proc_remove_one(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	if (priv->dir_dev) {
+		remove_proc_entry("stats-hw", priv->dir_dev);
+		remove_proc_entry("stats-tx", priv->dir_dev);
+		remove_proc_entry("stats-rx", priv->dir_dev);
+		remove_proc_entry("registers", priv->dir_dev);
+		remove_proc_entry(dev->name, rtl8180_proc);
+		priv->dir_dev = NULL;
+	}
+}
+
+void rtl8180_proc_init_one(struct net_device *dev)
+{
+	struct proc_dir_entry *e;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	priv->dir_dev = rtl8180_proc;
+	if (!priv->dir_dev) {
+		DMESGE("Unable to initialize /proc/net/r8180/%s\n",
+		      dev->name);
+		return;
+	}
+
+	e = create_proc_read_entry("stats-hw", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_hw, dev);
+	if (!e) {
+		DMESGE("Unable to initialize "
+		      "/proc/net/r8180/%s/stats-hw\n",
+		      dev->name);
+	}
+
+	e = create_proc_read_entry("stats-rx", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_rx, dev);
+	if (!e) {
+		DMESGE("Unable to initialize "
+		      "/proc/net/r8180/%s/stats-rx\n",
+		      dev->name);
+	}
+
+
+	e = create_proc_read_entry("stats-tx", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_tx, dev);
+	if (!e) {
+		DMESGE("Unable to initialize "
+		      "/proc/net/r8180/%s/stats-tx\n",
+		      dev->name);
+	}
+
+	e = create_proc_read_entry("registers", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_registers, dev);
+	if (!e) {
+		DMESGE("Unable to initialize "
+		      "/proc/net/r8180/%s/registers\n",
+		      dev->name);
+	}
+}
+
+/*
+  FIXME: check if we can use some standard already-existent
+  data type+functions in kernel
+*/
+
+short buffer_add(struct buffer **buffer, u32 *buf, dma_addr_t dma,
+		struct buffer **bufferhead)
+{
+	struct buffer *tmp;
+
+	if (!*buffer) {
+
+		*buffer = kmalloc(sizeof(struct buffer), GFP_KERNEL);
+
+		if (*buffer == NULL) {
+			DMESGE("Failed to kmalloc head of TX/RX struct");
+			return -1;
+		}
+		(*buffer)->next = *buffer;
+		(*buffer)->buf = buf;
+		(*buffer)->dma = dma;
+		if (bufferhead != NULL)
+			(*bufferhead) = (*buffer);
+		return 0;
+	}
+	tmp = *buffer;
+
+	while (tmp->next != (*buffer))
+		tmp = tmp->next;
+	tmp->next = kmalloc(sizeof(struct buffer), GFP_KERNEL);
+	if (tmp->next == NULL) {
+		DMESGE("Failed to kmalloc TX/RX struct");
+		return -1;
+	}
+	tmp->next->buf = buf;
+	tmp->next->dma = dma;
+	tmp->next->next = *buffer;
+
+	return 0;
+}
+
+void buffer_free(struct net_device *dev, struct buffer **buffer, int len, short consistent)
+{
+
+	struct buffer *tmp, *next;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct pci_dev *pdev = priv->pdev;
+
+	if (!*buffer)
+		return;
+
+	tmp = *buffer;
+
+	do {
+		next = tmp->next;
+		if (consistent) {
+			pci_free_consistent(pdev, len,
+				    tmp->buf, tmp->dma);
+		} else {
+			pci_unmap_single(pdev, tmp->dma,
+			len, PCI_DMA_FROMDEVICE);
+			kfree(tmp->buf);
+		}
+		kfree(tmp);
+		tmp = next;
+	} while (next != *buffer);
+
+	*buffer = NULL;
+}
+
+void print_buffer(u32 *buffer, int len)
+{
+	int i;
+	u8 *buf = (u8 *)buffer;
+
+	printk("ASCII BUFFER DUMP (len: %x):\n", len);
+
+	for (i = 0; i < len; i++)
+		printk("%c", buf[i]);
+
+	printk("\nBINARY BUFFER DUMP (len: %x):\n", len);
+
+	for (i = 0; i < len; i++)
+		printk("%02x", buf[i]);
+
+	printk("\n");
+}
+
+int get_curr_tx_free_desc(struct net_device *dev, int priority)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u32 *tail;
+	u32 *head;
+	int ret;
+
+	switch (priority) {
+	case MANAGE_PRIORITY:
+		head = priv->txmapringhead;
+		tail = priv->txmapringtail;
+		break;
+	case BK_PRIORITY:
+		head = priv->txbkpringhead;
+		tail = priv->txbkpringtail;
+		break;
+	case BE_PRIORITY:
+		head = priv->txbepringhead;
+		tail = priv->txbepringtail;
+		break;
+	case VI_PRIORITY:
+		head = priv->txvipringhead;
+		tail = priv->txvipringtail;
+		break;
+	case VO_PRIORITY:
+		head = priv->txvopringhead;
+		tail = priv->txvopringtail;
+		break;
+	case HI_PRIORITY:
+		head = priv->txhpringhead;
+		tail = priv->txhpringtail;
+		break;
+	default:
+		return -1;
+	}
+
+	if (head <= tail)
+		ret = priv->txringcount - (tail - head)/8;
+	else
+		ret = (head - tail)/8;
+
+	if (ret > priv->txringcount)
+		DMESG("BUG");
+
+	return ret;
+}
+
+short check_nic_enought_desc(struct net_device *dev, int priority)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	int requiredbyte, required;
+
+	requiredbyte = priv->ieee80211->fts + sizeof(struct ieee80211_header_data);
+
+	if (ieee->current_network.QoS_Enable)
+		requiredbyte += 2;
+
+	required = requiredbyte / (priv->txbuffsize-4);
+
+	if (requiredbyte % priv->txbuffsize)
+		required++;
+
+	/* for now we keep two free descriptor as a safety boundary
+	 * between the tail and the head
+	 */
+
+	return (required+2 < get_curr_tx_free_desc(dev, priority));
+}
+
+void fix_tx_fifo(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u32 *tmp;
+	int i;
+
+	for (tmp = priv->txmapring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	for (tmp = priv->txbkpring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	for (tmp = priv->txbepring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+	for (tmp = priv->txvipring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	for (tmp = priv->txvopring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	for (tmp = priv->txhpring, i = 0;
+	     i < priv->txringcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	for (tmp = priv->txbeaconring, i = 0;
+	     i < priv->txbeaconcount;
+	     tmp += 8, i++) {
+		*tmp = *tmp & ~(1<<31);
+	}
+
+	priv->txmapringtail = priv->txmapring;
+	priv->txmapringhead = priv->txmapring;
+	priv->txmapbufstail = priv->txmapbufs;
+
+	priv->txbkpringtail = priv->txbkpring;
+	priv->txbkpringhead = priv->txbkpring;
+	priv->txbkpbufstail = priv->txbkpbufs;
+
+	priv->txbepringtail = priv->txbepring;
+	priv->txbepringhead = priv->txbepring;
+	priv->txbepbufstail = priv->txbepbufs;
+
+	priv->txvipringtail = priv->txvipring;
+	priv->txvipringhead = priv->txvipring;
+	priv->txvipbufstail = priv->txvipbufs;
+
+	priv->txvopringtail = priv->txvopring;
+	priv->txvopringhead = priv->txvopring;
+	priv->txvopbufstail = priv->txvopbufs;
+
+	priv->txhpringtail = priv->txhpring;
+	priv->txhpringhead = priv->txhpring;
+	priv->txhpbufstail = priv->txhpbufs;
+
+	priv->txbeaconringtail = priv->txbeaconring;
+	priv->txbeaconbufstail = priv->txbeaconbufs;
+	set_nic_txring(dev);
+
+	ieee80211_reset_queue(priv->ieee80211);
+	priv->ack_tx_to_ieee = 0;
+}
+
+void fix_rx_fifo(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u32 *tmp;
+	struct buffer *rxbuf;
+	u8 rx_desc_size;
+
+	rx_desc_size = 8; /* 4*8 = 32 bytes */
+
+	for (tmp = priv->rxring, rxbuf = priv->rxbufferhead;
+	     (tmp < (priv->rxring)+(priv->rxringcount)*rx_desc_size);
+	     tmp += rx_desc_size, rxbuf = rxbuf->next) {
+		*(tmp+2) = rxbuf->dma;
+		*tmp = *tmp & ~0xfff;
+		*tmp = *tmp | priv->rxbuffersize;
+		*tmp |= (1<<31);
+	}
+
+	priv->rxringtail = priv->rxring;
+	priv->rxbuffer = priv->rxbufferhead;
+	priv->rx_skb_complete = 1;
+	set_nic_rxring(dev);
+}
+
+unsigned char QUALITY_MAP[] = {
+	0x64, 0x64, 0x64, 0x63, 0x63, 0x62, 0x62, 0x61,
+	0x61, 0x60, 0x60, 0x5f, 0x5f, 0x5e, 0x5d, 0x5c,
+	0x5b, 0x5a, 0x59, 0x57, 0x56, 0x54, 0x52, 0x4f,
+	0x4c, 0x49, 0x45, 0x41, 0x3c, 0x37, 0x31, 0x29,
+	0x24, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
+	0x22, 0x22, 0x21, 0x21, 0x21, 0x21, 0x21, 0x20,
+	0x20, 0x20, 0x20, 0x1f, 0x1f, 0x1e, 0x1e, 0x1e,
+	0x1d, 0x1d, 0x1c, 0x1c, 0x1b, 0x1a, 0x19, 0x19,
+	0x18, 0x17, 0x16, 0x15, 0x14, 0x12, 0x11, 0x0f,
+	0x0e, 0x0c, 0x0a, 0x08, 0x06, 0x04, 0x01, 0x00
+};
+
+unsigned char STRENGTH_MAP[] = {
+	0x64, 0x64, 0x63, 0x62, 0x61, 0x60, 0x5f, 0x5e,
+	0x5d, 0x5c, 0x5b, 0x5a, 0x57, 0x54, 0x52, 0x50,
+	0x4e, 0x4c, 0x4a, 0x48, 0x46, 0x44, 0x41, 0x3f,
+	0x3c, 0x3a, 0x37, 0x36, 0x36, 0x1c, 0x1c, 0x1b,
+	0x1b, 0x1a, 0x1a, 0x19, 0x19, 0x18, 0x18, 0x17,
+	0x17, 0x16, 0x16, 0x15, 0x15, 0x14, 0x14, 0x13,
+	0x13, 0x12, 0x12, 0x11, 0x11, 0x10, 0x10, 0x0f,
+	0x0f, 0x0e, 0x0e, 0x0d, 0x0d, 0x0c, 0x0c, 0x0b,
+	0x0b, 0x0a, 0x0a, 0x09, 0x09, 0x08, 0x08, 0x07,
+	0x07, 0x06, 0x06, 0x05, 0x04, 0x03, 0x02, 0x00
+};
+
+void rtl8180_RSSI_calc(struct net_device *dev, u8 *rssi, u8 *qual)
+{
+	u32 temp;
+	u32 temp2;
+	u32 q;
+	u32 orig_qual;
+	u8  _rssi;
+
+	q = *qual;
+	orig_qual = *qual;
+	_rssi = 0; /* avoid gcc complains.. */
+
+	if (q <= 0x4e) {
+		temp = QUALITY_MAP[q];
+	} else {
+		if (q & 0x80)
+			temp = 0x32;
+		else
+			temp = 1;
+	}
+
+	*qual = temp;
+	temp2 = *rssi;
+
+	if (_rssi < 0x64) {
+		if (_rssi == 0)
+			*rssi = 1;
+	} else {
+		*rssi = 0x64;
+	}
+
+	return;
+}
+
+void rtl8180_irq_enable(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	priv->irq_enabled = 1;
+	write_nic_word(dev, INTA_MASK, priv->irq_mask);
+}
+
+void rtl8180_irq_disable(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	write_nic_dword(dev, IMR, 0);
+	force_pci_posting(dev);
+	priv->irq_enabled = 0;
+}
+
+void rtl8180_set_mode(struct net_device *dev, int mode)
+{
+	u8 ecmd;
+
+	ecmd = read_nic_byte(dev, EPROM_CMD);
+	ecmd = ecmd & ~EPROM_CMD_OPERATING_MODE_MASK;
+	ecmd = ecmd | (mode<<EPROM_CMD_OPERATING_MODE_SHIFT);
+	ecmd = ecmd & ~(1<<EPROM_CS_SHIFT);
+	ecmd = ecmd & ~(1<<EPROM_CK_SHIFT);
+	write_nic_byte(dev, EPROM_CMD, ecmd);
+}
+
+void rtl8180_adapter_start(struct net_device *dev);
+void rtl8180_beacon_tx_enable(struct net_device *dev);
+
+void rtl8180_update_msr(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 msr;
+	u32 rxconf;
+
+	msr  = read_nic_byte(dev, MSR);
+	msr &= ~MSR_LINK_MASK;
+
+	rxconf = read_nic_dword(dev, RX_CONF);
+
+	if (priv->ieee80211->state == IEEE80211_LINKED)	{
+		if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+			msr |= (MSR_LINK_ADHOC<<MSR_LINK_SHIFT);
+		else if (priv->ieee80211->iw_mode == IW_MODE_MASTER)
+			msr |= (MSR_LINK_MASTER<<MSR_LINK_SHIFT);
+		else if (priv->ieee80211->iw_mode == IW_MODE_INFRA)
+			msr |= (MSR_LINK_MANAGED<<MSR_LINK_SHIFT);
+		else
+			msr |= (MSR_LINK_NONE<<MSR_LINK_SHIFT);
+		rxconf |= (1<<RX_CHECK_BSSID_SHIFT);
+
+	} else {
+		msr |= (MSR_LINK_NONE<<MSR_LINK_SHIFT);
+		rxconf &= ~(1<<RX_CHECK_BSSID_SHIFT);
+	}
+
+	write_nic_byte(dev, MSR, msr);
+	write_nic_dword(dev, RX_CONF, rxconf);
+}
+
+void rtl8180_set_chan(struct net_device *dev, short ch)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	if ((ch > 14) || (ch < 1)) {
+		printk("In %s: Invalid chnanel %d\n", __func__, ch);
+		return;
+	}
+
+	priv->chan = ch;
+	priv->rf_set_chan(dev, priv->chan);
+}
+
+void rtl8180_rx_enable(struct net_device *dev)
+{
+	u8 cmd;
+	u32 rxconf;
+	/* for now we accept data, management & ctl frame*/
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rxconf = read_nic_dword(dev, RX_CONF);
+	rxconf = rxconf & ~MAC_FILTER_MASK;
+	rxconf = rxconf | (1<<ACCEPT_MNG_FRAME_SHIFT);
+	rxconf = rxconf | (1<<ACCEPT_DATA_FRAME_SHIFT);
+	rxconf = rxconf | (1<<ACCEPT_BCAST_FRAME_SHIFT);
+	rxconf = rxconf | (1<<ACCEPT_MCAST_FRAME_SHIFT);
+	if (dev->flags & IFF_PROMISC)
+		DMESG("NIC in promisc mode");
+
+	if (priv->ieee80211->iw_mode == IW_MODE_MONITOR || \
+	   dev->flags & IFF_PROMISC) {
+		rxconf = rxconf | (1<<ACCEPT_ALLMAC_FRAME_SHIFT);
+	} else {
+		rxconf = rxconf | (1<<ACCEPT_NICMAC_FRAME_SHIFT);
+	}
+
+	if (priv->ieee80211->iw_mode == IW_MODE_MONITOR) {
+		rxconf = rxconf | (1<<ACCEPT_CTL_FRAME_SHIFT);
+		rxconf = rxconf | (1<<ACCEPT_ICVERR_FRAME_SHIFT);
+		rxconf = rxconf | (1<<ACCEPT_PWR_FRAME_SHIFT);
+	}
+
+	if (priv->crcmon == 1 && priv->ieee80211->iw_mode == IW_MODE_MONITOR)
+		rxconf = rxconf | (1<<ACCEPT_CRCERR_FRAME_SHIFT);
+
+	rxconf = rxconf & ~RX_FIFO_THRESHOLD_MASK;
+	rxconf = rxconf | (RX_FIFO_THRESHOLD_NONE << RX_FIFO_THRESHOLD_SHIFT);
+
+	rxconf = rxconf | (1<<RX_AUTORESETPHY_SHIFT);
+	rxconf = rxconf & ~MAX_RX_DMA_MASK;
+	rxconf = rxconf | (MAX_RX_DMA_2048<<MAX_RX_DMA_SHIFT);
+
+	rxconf = rxconf | RCR_ONLYERLPKT;
+
+	rxconf = rxconf & ~RCR_CS_MASK;
+
+	write_nic_dword(dev, RX_CONF, rxconf);
+
+	fix_rx_fifo(dev);
+
+	cmd = read_nic_byte(dev, CMD);
+	write_nic_byte(dev, CMD, cmd | (1<<CMD_RX_ENABLE_SHIFT));
+}
+
+void set_nic_txring(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	write_nic_dword(dev, TX_MANAGEPRIORITY_RING_ADDR, priv->txmapringdma);
+	write_nic_dword(dev, TX_BKPRIORITY_RING_ADDR, priv->txbkpringdma);
+	write_nic_dword(dev, TX_BEPRIORITY_RING_ADDR, priv->txbepringdma);
+	write_nic_dword(dev, TX_VIPRIORITY_RING_ADDR, priv->txvipringdma);
+	write_nic_dword(dev, TX_VOPRIORITY_RING_ADDR, priv->txvopringdma);
+	write_nic_dword(dev, TX_HIGHPRIORITY_RING_ADDR, priv->txhpringdma);
+	write_nic_dword(dev, TX_BEACON_RING_ADDR, priv->txbeaconringdma);
+}
+
+void rtl8180_conttx_enable(struct net_device *dev)
+{
+	u32 txconf;
+
+	txconf = read_nic_dword(dev, TX_CONF);
+	txconf = txconf & ~TX_LOOPBACK_MASK;
+	txconf = txconf | (TX_LOOPBACK_CONTINUE<<TX_LOOPBACK_SHIFT);
+	write_nic_dword(dev, TX_CONF, txconf);
+}
+
+void rtl8180_conttx_disable(struct net_device *dev)
+{
+	u32 txconf;
+
+	txconf = read_nic_dword(dev, TX_CONF);
+	txconf = txconf & ~TX_LOOPBACK_MASK;
+	txconf = txconf | (TX_LOOPBACK_NONE<<TX_LOOPBACK_SHIFT);
+	write_nic_dword(dev, TX_CONF, txconf);
+}
+
+void rtl8180_tx_enable(struct net_device *dev)
+{
+	u8 cmd;
+	u8 tx_agc_ctl;
+	u8 byte;
+	u32 txconf;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	txconf = read_nic_dword(dev, TX_CONF);
+
+	byte = read_nic_byte(dev, CW_CONF);
+	byte &= ~(1<<CW_CONF_PERPACKET_CW_SHIFT);
+	byte &= ~(1<<CW_CONF_PERPACKET_RETRY_SHIFT);
+	write_nic_byte(dev, CW_CONF, byte);
+
+	tx_agc_ctl = read_nic_byte(dev, TX_AGC_CTL);
+	tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_GAIN_SHIFT);
+	tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT);
+	tx_agc_ctl |= (1<<TX_AGC_CTL_FEEDBACK_ANT);
+	write_nic_byte(dev, TX_AGC_CTL, tx_agc_ctl);
+	write_nic_byte(dev, 0xec, 0x3f); /* Disable early TX */
+
+	txconf = txconf & ~(1<<TCR_PROBE_NOTIMESTAMP_SHIFT);
+
+	txconf = txconf & ~TX_LOOPBACK_MASK;
+	txconf = txconf | (TX_LOOPBACK_NONE<<TX_LOOPBACK_SHIFT);
+	txconf = txconf & ~TCR_DPRETRY_MASK;
+	txconf = txconf & ~TCR_RTSRETRY_MASK;
+	txconf = txconf | (priv->retry_data<<TX_DPRETRY_SHIFT);
+	txconf = txconf | (priv->retry_rts<<TX_RTSRETRY_SHIFT);
+	txconf = txconf & ~(1<<TX_NOCRC_SHIFT);
+
+	if (priv->hw_plcp_len)
+		txconf = txconf & ~TCR_PLCP_LEN;
+	else
+		txconf = txconf | TCR_PLCP_LEN;
+
+	txconf = txconf & ~TCR_MXDMA_MASK;
+	txconf = txconf | (TCR_MXDMA_2048<<TCR_MXDMA_SHIFT);
+	txconf = txconf | TCR_CWMIN;
+	txconf = txconf | TCR_DISCW;
+
+	txconf = txconf | (1 << TX_NOICV_SHIFT);
+
+	write_nic_dword(dev, TX_CONF, txconf);
+
+	fix_tx_fifo(dev);
+
+	cmd = read_nic_byte(dev, CMD);
+	write_nic_byte(dev, CMD, cmd | (1<<CMD_TX_ENABLE_SHIFT));
+
+	write_nic_dword(dev, TX_CONF, txconf);
+}
+
+void rtl8180_beacon_tx_enable(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	priv->dma_poll_stop_mask &= ~(TPPOLLSTOP_BQ);
+	write_nic_byte(dev, TPPollStop, priv->dma_poll_mask);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+}
+
+void rtl8180_beacon_tx_disable(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	priv->dma_poll_stop_mask |= TPPOLLSTOP_BQ;
+	write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+}
+
+void rtl8180_rtx_disable(struct net_device *dev)
+{
+	u8 cmd;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	cmd = read_nic_byte(dev, CMD);
+	write_nic_byte(dev, CMD, cmd & ~\
+		       ((1<<CMD_RX_ENABLE_SHIFT)|(1<<CMD_TX_ENABLE_SHIFT)));
+	force_pci_posting(dev);
+	mdelay(10);
+
+	if (!priv->rx_skb_complete)
+		dev_kfree_skb_any(priv->rx_skb);
+}
+
+short alloc_tx_desc_ring(struct net_device *dev, int bufsize, int count,
+			 int addr)
+{
+	int i;
+	u32 *desc;
+	u32 *tmp;
+	dma_addr_t dma_desc, dma_tmp;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct pci_dev *pdev = priv->pdev;
+	void *buf;
+
+	if ((bufsize & 0xfff) != bufsize) {
+		DMESGE("TX buffer allocation too large");
+		return 0;
+	}
+	desc = (u32 *)pci_alloc_consistent(pdev,
+					  sizeof(u32)*8*count+256, &dma_desc);
+	if (desc == NULL)
+		return -1;
+
+	if (dma_desc & 0xff)
+		/*
+		 * descriptor's buffer must be 256 byte aligned
+		 * we shouldn't be here, since we set DMA mask !
+		 */
+		WARN(1, "DMA buffer is not aligned\n");
+
+	tmp = desc;
+
+	for (i = 0; i < count; i++) {
+		buf = (void *)pci_alloc_consistent(pdev, bufsize, &dma_tmp);
+		if (buf == NULL)
+			return -ENOMEM;
+
+		switch (addr) {
+		case TX_MANAGEPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txmapbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer NP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_BKPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txbkpbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer LP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_BEPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txbepbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer NP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_VIPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txvipbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer LP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_VOPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txvopbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer NP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_HIGHPRIORITY_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txhpbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer HP");
+				return -ENOMEM;
+			}
+			break;
+		case TX_BEACON_RING_ADDR:
+			if (-1 == buffer_add(&(priv->txbeaconbufs), buf, dma_tmp, NULL)) {
+				DMESGE("Unable to allocate mem for buffer BP");
+				return -ENOMEM;
+			}
+			break;
+		}
+		*tmp = *tmp & ~(1<<31); /* descriptor empty, owned by the drv */
+		*(tmp+2) = (u32)dma_tmp;
+		*(tmp+3) = bufsize;
+
+		if (i+1 < count)
+			*(tmp+4) = (u32)dma_desc+((i+1)*8*4);
+		else
+			*(tmp+4) = (u32)dma_desc;
+
+		tmp = tmp+8;
+	}
+
+	switch (addr) {
+	case TX_MANAGEPRIORITY_RING_ADDR:
+		priv->txmapringdma = dma_desc;
+		priv->txmapring = desc;
+		break;
+	case TX_BKPRIORITY_RING_ADDR:
+		priv->txbkpringdma = dma_desc;
+		priv->txbkpring = desc;
+		break;
+	case TX_BEPRIORITY_RING_ADDR:
+		priv->txbepringdma = dma_desc;
+		priv->txbepring = desc;
+		break;
+	case TX_VIPRIORITY_RING_ADDR:
+		priv->txvipringdma = dma_desc;
+		priv->txvipring = desc;
+		break;
+	case TX_VOPRIORITY_RING_ADDR:
+		priv->txvopringdma = dma_desc;
+		priv->txvopring = desc;
+		break;
+	case TX_HIGHPRIORITY_RING_ADDR:
+		priv->txhpringdma = dma_desc;
+		priv->txhpring = desc;
+		break;
+	case TX_BEACON_RING_ADDR:
+		priv->txbeaconringdma = dma_desc;
+		priv->txbeaconring = desc;
+		break;
+
+	}
+
+	return 0;
+}
+
+void free_tx_desc_rings(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct pci_dev *pdev = priv->pdev;
+	int count = priv->txringcount;
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txmapring, priv->txmapringdma);
+	buffer_free(dev, &(priv->txmapbufs), priv->txbuffsize, 1);
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txbkpring, priv->txbkpringdma);
+	buffer_free(dev, &(priv->txbkpbufs), priv->txbuffsize, 1);
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txbepring, priv->txbepringdma);
+	buffer_free(dev, &(priv->txbepbufs), priv->txbuffsize, 1);
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txvipring, priv->txvipringdma);
+	buffer_free(dev, &(priv->txvipbufs), priv->txbuffsize, 1);
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txvopring, priv->txvopringdma);
+	buffer_free(dev, &(priv->txvopbufs), priv->txbuffsize, 1);
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txhpring, priv->txhpringdma);
+	buffer_free(dev, &(priv->txhpbufs), priv->txbuffsize, 1);
+
+	count = priv->txbeaconcount;
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->txbeaconring, priv->txbeaconringdma);
+	buffer_free(dev, &(priv->txbeaconbufs), priv->txbuffsize, 1);
+}
+
+void free_rx_desc_ring(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct pci_dev *pdev = priv->pdev;
+	int count = priv->rxringcount;
+
+	pci_free_consistent(pdev, sizeof(u32)*8*count+256,
+			    priv->rxring, priv->rxringdma);
+
+	buffer_free(dev, &(priv->rxbuffer), priv->rxbuffersize, 0);
+}
+
+short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
+{
+	int i;
+	u32 *desc;
+	u32 *tmp;
+	dma_addr_t dma_desc, dma_tmp;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct pci_dev *pdev = priv->pdev;
+	void *buf;
+	u8 rx_desc_size;
+
+	rx_desc_size = 8; /* 4*8 = 32 bytes */
+
+	if ((bufsize & 0xfff) != bufsize) {
+		DMESGE("RX buffer allocation too large");
+		return -1;
+	}
+
+	desc = (u32 *)pci_alloc_consistent(pdev, sizeof(u32)*rx_desc_size*count+256,
+					  &dma_desc);
+
+	if (dma_desc & 0xff)
+		/*
+		 * descriptor's buffer must be 256 byte aligned
+		 * should never happen since we specify the DMA mask
+		 */
+		WARN(1, "DMA buffer is not aligned\n");
+
+	priv->rxring = desc;
+	priv->rxringdma = dma_desc;
+	tmp = desc;
+
+	for (i = 0; i < count; i++) {
+		buf = kmalloc(bufsize * sizeof(u8), GFP_ATOMIC);
+		if (buf == NULL) {
+			DMESGE("Failed to kmalloc RX buffer");
+			return -1;
+		}
+
+		dma_tmp = pci_map_single(pdev, buf, bufsize * sizeof(u8),
+					 PCI_DMA_FROMDEVICE);
+
+		if (-1 == buffer_add(&(priv->rxbuffer), buf, dma_tmp,
+			   &(priv->rxbufferhead))) {
+			DMESGE("Unable to allocate mem RX buf");
+			return -1;
+		}
+		*tmp = 0; /* zero pads the header of the descriptor */
+		*tmp = *tmp | (bufsize&0xfff);
+		*(tmp+2) = (u32)dma_tmp;
+		*tmp = *tmp | (1<<31); /* descriptor void, owned by the NIC */
+
+		tmp = tmp+rx_desc_size;
+	}
+
+	*(tmp-rx_desc_size) = *(tmp-rx_desc_size) | (1<<30); /* this is the last descriptor */
+
+	return 0;
+}
+
+
+void set_nic_rxring(struct net_device *dev)
+{
+	u8 pgreg;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	pgreg = read_nic_byte(dev, PGSELECT);
+	write_nic_byte(dev, PGSELECT, pgreg & ~(1<<PGSELECT_PG_SHIFT));
+
+	write_nic_dword(dev, RXRING_ADDR, priv->rxringdma);
+}
+
+void rtl8180_reset(struct net_device *dev)
+{
+	u8 cr;
+
+	rtl8180_irq_disable(dev);
+
+	cr = read_nic_byte(dev, CMD);
+	cr = cr & 2;
+	cr = cr | (1<<CMD_RST_SHIFT);
+	write_nic_byte(dev, CMD, cr);
+
+	force_pci_posting(dev);
+
+	mdelay(200);
+
+	if (read_nic_byte(dev, CMD) & (1<<CMD_RST_SHIFT))
+		DMESGW("Card reset timeout!");
+	else
+		DMESG("Card successfully reset");
+
+	rtl8180_set_mode(dev, EPROM_CMD_LOAD);
+	force_pci_posting(dev);
+	mdelay(200);
+}
+
+inline u16 ieeerate2rtlrate(int rate)
+{
+	switch (rate) {
+	case 10:
+		return 0;
+	case 20:
+		return 1;
+	case 55:
+		return 2;
+	case 110:
+		return 3;
+	case 60:
+		return 4;
+	case 90:
+		return 5;
+	case 120:
+		return 6;
+	case 180:
+		return 7;
+	case 240:
+		return 8;
+	case 360:
+		return 9;
+	case 480:
+		return 10;
+	case 540:
+		return 11;
+	default:
+		return 3;
+	}
+}
+
+static u16 rtl_rate[] = {10, 20, 55, 110, 60, 90, 120, 180, 240, 360, 480, 540, 720};
+
+inline u16 rtl8180_rate2rate(short rate)
+{
+	if (rate > 12)
+		return 10;
+	return rtl_rate[rate];
+}
+
+inline u8 rtl8180_IsWirelessBMode(u16 rate)
+{
+	if (((rate <= 110) && (rate != 60) && (rate != 90)) || (rate == 220))
+		return 1;
+	else
+		return 0;
+}
+
+u16 N_DBPSOfRate(u16 DataRate);
+
+u16 ComputeTxTime(u16 FrameLength, u16 DataRate, u8 bManagementFrame,
+		  u8 bShortPreamble)
+{
+	u16	FrameTime;
+	u16	N_DBPS;
+	u16	Ceiling;
+
+	if (rtl8180_IsWirelessBMode(DataRate)) {
+		if (bManagementFrame || !bShortPreamble || DataRate == 10)
+			/* long preamble */
+			FrameTime = (u16)(144+48+(FrameLength*8/(DataRate/10)));
+		else
+			/* short preamble */
+			FrameTime = (u16)(72+24+(FrameLength*8/(DataRate/10)));
+
+		if ((FrameLength*8 % (DataRate/10)) != 0) /* get the ceilling */
+			FrameTime++;
+	} else {	/* 802.11g DSSS-OFDM PLCP length field calculation. */
+		N_DBPS = N_DBPSOfRate(DataRate);
+		Ceiling = (16 + 8*FrameLength + 6) / N_DBPS
+				+ (((16 + 8*FrameLength + 6) % N_DBPS) ? 1 : 0);
+		FrameTime = (u16)(16 + 4 + 4*Ceiling + 6);
+	}
+	return FrameTime;
+}
+
+u16 N_DBPSOfRate(u16 DataRate)
+{
+	 u16 N_DBPS = 24;
+
+	switch (DataRate) {
+	case 60:
+		N_DBPS = 24;
+		break;
+	case 90:
+		N_DBPS = 36;
+		break;
+	case 120:
+		N_DBPS = 48;
+		break;
+	case 180:
+		N_DBPS = 72;
+		break;
+	case 240:
+		N_DBPS = 96;
+		break;
+	case 360:
+		N_DBPS = 144;
+		break;
+	case 480:
+		N_DBPS = 192;
+		break;
+	case 540:
+		N_DBPS = 216;
+		break;
+	default:
+		break;
+	}
+
+	return N_DBPS;
+}
+
+/*
+ * For Netgear case, they want good-looking singal strength.
+ */
+long NetgearSignalStrengthTranslate(long LastSS, long CurrSS)
+{
+	long RetSS;
+
+	/* Step 1. Scale mapping. */
+	if (CurrSS >= 71 && CurrSS <= 100)
+		RetSS = 90 + ((CurrSS - 70) / 3);
+	else if (CurrSS >= 41 && CurrSS <= 70)
+		RetSS = 78 + ((CurrSS - 40) / 3);
+	else if (CurrSS >= 31 && CurrSS <= 40)
+		RetSS = 66 + (CurrSS - 30);
+	else if (CurrSS >= 21 && CurrSS <= 30)
+		RetSS = 54 + (CurrSS - 20);
+	else if (CurrSS >= 5 && CurrSS <= 20)
+		RetSS = 42 + (((CurrSS - 5) * 2) / 3);
+	else if (CurrSS == 4)
+		RetSS = 36;
+	else if (CurrSS == 3)
+		RetSS = 27;
+	else if (CurrSS == 2)
+		RetSS = 18;
+	else if (CurrSS == 1)
+		RetSS = 9;
+	else
+		RetSS = CurrSS;
+
+	/* Step 2. Smoothing. */
+	if (LastSS > 0)
+		RetSS = ((LastSS * 5) + (RetSS) + 5) / 6;
+
+	return RetSS;
+}
+
+/*
+ * Translate 0-100 signal strength index into dBm.
+ */
+long TranslateToDbm8185(u8 SignalStrengthIndex)
+{
+	long SignalPower;
+
+	/* Translate to dBm (x=0.5y-95). */
+	SignalPower = (long)((SignalStrengthIndex + 1) >> 1);
+	SignalPower -= 95;
+
+	return SignalPower;
+}
+
+/*
+ * Perform signal smoothing for dynamic mechanism.
+ * This is different with PerformSignalSmoothing8185 in smoothing fomula.
+ * No dramatic adjustion is apply because dynamic mechanism need some degree
+ * of correctness. Ported from 8187B.
+ */
+void PerformUndecoratedSignalSmoothing8185(struct r8180_priv *priv,
+					   bool bCckRate)
+{
+	/* Determin the current packet is CCK rate. */
+	priv->bCurCCKPkt = bCckRate;
+
+	if (priv->UndecoratedSmoothedSS >= 0)
+		priv->UndecoratedSmoothedSS = ((priv->UndecoratedSmoothedSS * 5) +
+					       (priv->SignalStrength * 10)) / 6;
+	else
+		priv->UndecoratedSmoothedSS = priv->SignalStrength * 10;
+
+	priv->UndercorateSmoothedRxPower = ((priv->UndercorateSmoothedRxPower * 50) +
+					    (priv->RxPower * 11)) / 60;
+
+	if (bCckRate)
+		priv->CurCCKRSSI = priv->RSSI;
+	else
+		priv->CurCCKRSSI = 0;
+}
+
+
+/*
+ * This is rough RX isr handling routine
+ */
+void rtl8180_rx(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct sk_buff *tmp_skb;
+	short first, last;
+	u32 len;
+	int lastlen;
+	unsigned char quality, signal;
+	u8 rate;
+	u32 *tmp, *tmp2;
+	u8 rx_desc_size;
+	u8 padding;
+	char rxpower = 0;
+	u32 RXAGC = 0;
+	long RxAGC_dBm = 0;
+	u8	LNA = 0, BB = 0;
+	u8	LNA_gain[4] = {02, 17, 29, 39};
+	u8  Antenna = 0;
+	struct ieee80211_hdr_4addr *hdr;
+	u16 fc, type;
+	u8 bHwError = 0, bCRC = 0, bICV = 0;
+	bool	bCckRate = false;
+	u8     RSSI = 0;
+	long	SignalStrengthIndex = 0;
+	struct ieee80211_rx_stats stats = {
+		.signal = 0,
+		.noise = -98,
+		.rate = 0,
+		.freq = IEEE80211_24GHZ_BAND,
+	};
+
+	stats.nic_type = NIC_8185B;
+	rx_desc_size = 8;
+
+	if ((*(priv->rxringtail)) & (1<<31)) {
+		/* we have got an RX int, but the descriptor
+		 * we are pointing is empty */
+
+		priv->stats.rxnodata++;
+		priv->ieee80211->stats.rx_errors++;
+
+		tmp2 = NULL;
+		tmp = priv->rxringtail;
+		do {
+			if (tmp == priv->rxring)
+				tmp  = priv->rxring + (priv->rxringcount - 1)*rx_desc_size;
+			else
+				tmp -= rx_desc_size;
+
+			if (!(*tmp & (1<<31)))
+				tmp2 = tmp;
+		} while (tmp != priv->rxring);
+
+		if (tmp2)
+			priv->rxringtail = tmp2;
+	}
+
+	/* while there are filled descriptors */
+	while (!(*(priv->rxringtail) & (1<<31))) {
+		if (*(priv->rxringtail) & (1<<26))
+			DMESGW("RX buffer overflow");
+		if (*(priv->rxringtail) & (1<<12))
+			priv->stats.rxicverr++;
+
+		if (*(priv->rxringtail) & (1<<27)) {
+			priv->stats.rxdmafail++;
+			/* DMESG("EE: RX DMA FAILED at buffer pointed by descriptor %x",(u32)priv->rxringtail); */
+			goto drop;
+		}
+
+		pci_dma_sync_single_for_cpu(priv->pdev,
+				    priv->rxbuffer->dma,
+				    priv->rxbuffersize * \
+				    sizeof(u8),
+				    PCI_DMA_FROMDEVICE);
+
+		first = *(priv->rxringtail) & (1<<29) ? 1 : 0;
+		if (first)
+			priv->rx_prevlen = 0;
+
+		last = *(priv->rxringtail) & (1<<28) ? 1 : 0;
+		if (last) {
+			lastlen = ((*priv->rxringtail) & 0xfff);
+
+			/* if the last descriptor (that should
+			 * tell us the total packet len) tell
+			 * us something less than the descriptors
+			 * len we had until now, then there is some
+			 * problem..
+			 * workaround to prevent kernel panic
+			 */
+			if (lastlen < priv->rx_prevlen)
+				len = 0;
+			else
+				len = lastlen-priv->rx_prevlen;
+
+			if (*(priv->rxringtail) & (1<<13)) {
+				if ((*(priv->rxringtail) & 0xfff) < 500)
+					priv->stats.rxcrcerrmin++;
+				else if ((*(priv->rxringtail) & 0x0fff) > 1000)
+					priv->stats.rxcrcerrmax++;
+				else
+					priv->stats.rxcrcerrmid++;
+
+			}
+
+		} else {
+			len = priv->rxbuffersize;
+		}
+
+		if (first && last) {
+			padding = ((*(priv->rxringtail+3))&(0x04000000))>>26;
+		} else if (first) {
+			padding = ((*(priv->rxringtail+3))&(0x04000000))>>26;
+			if (padding)
+				len -= 2;
+		} else {
+			padding = 0;
+		}
+		padding = 0;
+		priv->rx_prevlen += len;
+
+		if (priv->rx_prevlen > MAX_FRAG_THRESHOLD + 100) {
+			/* HW is probably passing several buggy frames
+			* without FD or LD flag set.
+			* Throw this garbage away to prevent skb
+			* memory exausting
+			*/
+			if (!priv->rx_skb_complete)
+				dev_kfree_skb_any(priv->rx_skb);
+			priv->rx_skb_complete = 1;
+		}
+
+		signal = (unsigned char)(((*(priv->rxringtail+3)) & (0x00ff0000))>>16);
+		signal = (signal & 0xfe) >> 1;
+
+		quality = (unsigned char)((*(priv->rxringtail+3)) & (0xff));
+
+		stats.mac_time[0] = *(priv->rxringtail+1);
+		stats.mac_time[1] = *(priv->rxringtail+2);
+		rxpower = ((char)(((*(priv->rxringtail+4)) & (0x00ff0000))>>16))/2 - 42;
+		RSSI = ((u8)(((*(priv->rxringtail+3)) & (0x0000ff00))>>8)) & (0x7f);
+
+		rate = ((*(priv->rxringtail)) &
+			((1<<23)|(1<<22)|(1<<21)|(1<<20)))>>20;
+
+		stats.rate = rtl8180_rate2rate(rate);
+		Antenna = (((*(priv->rxringtail+3)) & (0x00008000)) == 0) ? 0 : 1;
+		if (!rtl8180_IsWirelessBMode(stats.rate)) { /* OFDM rate. */
+			RxAGC_dBm = rxpower+1;	/* bias */
+		} else { /* CCK rate. */
+			RxAGC_dBm = signal; /* bit 0 discard */
+
+			LNA = (u8) (RxAGC_dBm & 0x60) >> 5; /* bit 6~ bit 5 */
+			BB  = (u8) (RxAGC_dBm & 0x1F); /* bit 4 ~ bit 0 */
+
+			RxAGC_dBm = -(LNA_gain[LNA] + (BB*2)); /* Pin_11b=-(LNA_gain+BB_gain) (dBm) */
+
+			RxAGC_dBm += 4; /* bias */
+		}
+
+		if (RxAGC_dBm & 0x80) /* absolute value */
+			RXAGC = ~(RxAGC_dBm)+1;
+		bCckRate = rtl8180_IsWirelessBMode(stats.rate);
+		/* Translate RXAGC into 1-100. */
+		if (!rtl8180_IsWirelessBMode(stats.rate)) { /* OFDM rate. */
+			if (RXAGC > 90)
+				RXAGC = 90;
+			else if (RXAGC < 25)
+				RXAGC = 25;
+			RXAGC = (90-RXAGC)*100/65;
+		} else { /* CCK rate. */
+			if (RXAGC > 95)
+				RXAGC = 95;
+			else if (RXAGC < 30)
+				RXAGC = 30;
+			RXAGC = (95-RXAGC)*100/65;
+		}
+		priv->SignalStrength = (u8)RXAGC;
+		priv->RecvSignalPower = RxAGC_dBm;
+		priv->RxPower = rxpower;
+		priv->RSSI = RSSI;
+		/* SQ translation formula is provided by SD3 DZ. 2006.06.27 */
+		if (quality >= 127)
+			quality = 1; /*0; */ /* 0 will cause epc to show signal zero , walk around now; */
+		else if (quality < 27)
+			quality = 100;
+		else
+			quality = 127 - quality;
+		priv->SignalQuality = quality;
+
+		stats.signal = (u8)quality; /*priv->wstats.qual.level = priv->SignalStrength; */
+		stats.signalstrength = RXAGC;
+		if (stats.signalstrength > 100)
+			stats.signalstrength = 100;
+		stats.signalstrength = (stats.signalstrength * 70)/100 + 30;
+		/* printk("==========================>rx : RXAGC is %d,signalstrength is %d\n",RXAGC,stats.signalstrength); */
+		stats.rssi = priv->wstats.qual.qual = priv->SignalQuality;
+		stats.noise = priv->wstats.qual.noise = 100 - priv->wstats.qual.qual;
+		bHwError = (((*(priv->rxringtail)) & (0x00000fff)) == 4080) |
+			   (((*(priv->rxringtail)) & (0x04000000)) != 0) |
+			   (((*(priv->rxringtail)) & (0x08000000)) != 0) |
+			   (((~(*(priv->rxringtail))) & (0x10000000)) != 0) |
+			   (((~(*(priv->rxringtail))) & (0x20000000)) != 0);
+		bCRC = ((*(priv->rxringtail)) & (0x00002000)) >> 13;
+		bICV = ((*(priv->rxringtail)) & (0x00001000)) >> 12;
+		hdr = (struct ieee80211_hdr_4addr *)priv->rxbuffer->buf;
+		    fc = le16_to_cpu(hdr->frame_ctl);
+		type = WLAN_FC_GET_TYPE(fc);
+
+		if (IEEE80211_FTYPE_CTL != type &&
+		    !bHwError && !bCRC && !bICV &&
+		    eqMacAddr(priv->ieee80211->current_network.bssid,
+			fc & IEEE80211_FCTL_TODS ? hdr->addr1 :
+			fc & IEEE80211_FCTL_FROMDS ? hdr->addr2 :
+			hdr->addr3)) {
+
+			/* Perform signal smoothing for dynamic
+			 * mechanism on demand. This is different
+			 * with PerformSignalSmoothing8185 in smoothing
+			 * fomula. No dramatic adjustion is apply
+			 * because dynamic mechanism need some degree
+			 * of correctness. */
+			PerformUndecoratedSignalSmoothing8185(priv, bCckRate);
+
+			/* For good-looking singal strength. */
+			SignalStrengthIndex = NetgearSignalStrengthTranslate(
+							priv->LastSignalStrengthInPercent,
+							priv->SignalStrength);
+
+			priv->LastSignalStrengthInPercent = SignalStrengthIndex;
+			priv->Stats_SignalStrength = TranslateToDbm8185((u8)SignalStrengthIndex);
+		/*
+		 * We need more correct power of received packets and the  "SignalStrength" of RxStats is beautified,
+		 * so we record the correct power here.
+		 */
+			priv->Stats_SignalQuality = (long)(priv->Stats_SignalQuality * 5 + (long)priv->SignalQuality + 5) / 6;
+			priv->Stats_RecvSignalPower = (long)(priv->Stats_RecvSignalPower * 5 + priv->RecvSignalPower - 1) / 6;
+
+		/* Figure out which antenna that received the lasted packet. */
+			priv->LastRxPktAntenna = Antenna ? 1 : 0; /* 0: aux, 1: main. */
+			SwAntennaDiversityRxOk8185(dev, priv->SignalStrength);
+		}
+
+		if (first) {
+			if (!priv->rx_skb_complete) {
+				/* seems that HW sometimes fails to reiceve and
+				   doesn't provide the last descriptor */
+				dev_kfree_skb_any(priv->rx_skb);
+				priv->stats.rxnolast++;
+			}
+			/* support for prism header has been originally added by Christian */
+			if (priv->prism_hdr && priv->ieee80211->iw_mode == IW_MODE_MONITOR) {
+
+			} else {
+				priv->rx_skb = dev_alloc_skb(len+2);
+				if (!priv->rx_skb)
+					goto drop;
+			}
+
+			priv->rx_skb_complete = 0;
+			priv->rx_skb->dev = dev;
+		} else {
+			/* if we are here we should  have already RXed
+			* the first frame.
+			* If we get here and the skb is not allocated then
+			* we have just throw out garbage (skb not allocated)
+			* and we are still rxing garbage....
+			*/
+			if (!priv->rx_skb_complete) {
+
+				tmp_skb = dev_alloc_skb(priv->rx_skb->len+len+2);
+
+				if (!tmp_skb)
+					goto drop;
+
+				tmp_skb->dev = dev;
+
+				memcpy(skb_put(tmp_skb, priv->rx_skb->len),
+					priv->rx_skb->data,
+					priv->rx_skb->len);
+
+				dev_kfree_skb_any(priv->rx_skb);
+
+				priv->rx_skb = tmp_skb;
+			}
+		}
+
+		if (!priv->rx_skb_complete) {
+			if (padding) {
+				memcpy(skb_put(priv->rx_skb, len),
+					(((unsigned char *)priv->rxbuffer->buf) + 2), len);
+			} else {
+				memcpy(skb_put(priv->rx_skb, len),
+					priv->rxbuffer->buf, len);
+			}
+		}
+
+		if (last && !priv->rx_skb_complete) {
+			if (priv->rx_skb->len > 4)
+				skb_trim(priv->rx_skb, priv->rx_skb->len-4);
+			if (!ieee80211_rtl_rx(priv->ieee80211,
+					 priv->rx_skb, &stats))
+				dev_kfree_skb_any(priv->rx_skb);
+			priv->rx_skb_complete = 1;
+		}
+
+		pci_dma_sync_single_for_device(priv->pdev,
+				    priv->rxbuffer->dma,
+				    priv->rxbuffersize * \
+				    sizeof(u8),
+				    PCI_DMA_FROMDEVICE);
+
+drop: /* this is used when we have not enough mem */
+		/* restore the descriptor */
+		*(priv->rxringtail+2) = priv->rxbuffer->dma;
+		*(priv->rxringtail) = *(priv->rxringtail) & ~0xfff;
+		*(priv->rxringtail) =
+			*(priv->rxringtail) | priv->rxbuffersize;
+
+		*(priv->rxringtail) =
+			*(priv->rxringtail) | (1<<31);
+
+		priv->rxringtail += rx_desc_size;
+		if (priv->rxringtail >=
+		   (priv->rxring)+(priv->rxringcount)*rx_desc_size)
+			priv->rxringtail = priv->rxring;
+
+		priv->rxbuffer = (priv->rxbuffer->next);
+	}
+}
+
+
+void rtl8180_dma_kick(struct net_device *dev, int priority)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	write_nic_byte(dev, TX_DMA_POLLING,
+			(1 << (priority + 1)) | priv->dma_poll_mask);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	force_pci_posting(dev);
+}
+
+void rtl8180_data_hard_stop(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	priv->dma_poll_stop_mask |= TPPOLLSTOP_AC_VIQ;
+	write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+}
+
+void rtl8180_data_hard_resume(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	priv->dma_poll_stop_mask &= ~(TPPOLLSTOP_AC_VIQ);
+	write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+}
+
+/*
+ * This function TX data frames when the ieee80211 stack requires this.
+ * It checks also if we need to stop the ieee tx queue, eventually do it
+ */
+void rtl8180_hard_data_xmit(struct sk_buff *skb, struct net_device *dev, int
+rate) {
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	int mode;
+	struct ieee80211_hdr_3addr *h = (struct ieee80211_hdr_3addr *) skb->data;
+	short morefrag = (h->frame_control) & IEEE80211_FCTL_MOREFRAGS;
+	unsigned long flags;
+	int priority;
+
+	mode = priv->ieee80211->iw_mode;
+
+	rate = ieeerate2rtlrate(rate);
+	/*
+	 * This function doesn't require lock because we make
+	 * sure it's called with the tx_lock already acquired.
+	 * this come from the kernel's hard_xmit callback (through
+	 * the ieee stack, or from the try_wake_queue (again through
+	 * the ieee stack.
+	 */
+	priority = AC2Q(skb->priority);
+	spin_lock_irqsave(&priv->tx_lock, flags);
+
+	if (priv->ieee80211->bHwRadioOff) {
+		spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+		return;
+	}
+
+	if (!check_nic_enought_desc(dev, priority)) {
+		DMESGW("Error: no descriptor left by previous TX (avail %d) ",
+			get_curr_tx_free_desc(dev, priority));
+		ieee80211_rtl_stop_queue(priv->ieee80211);
+	}
+	rtl8180_tx(dev, skb->data, skb->len, priority, morefrag, 0, rate);
+	if (!check_nic_enought_desc(dev, priority))
+		ieee80211_rtl_stop_queue(priv->ieee80211);
+
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+/*
+ * This is a rough attempt to TX a frame
+ * This is called by the ieee 80211 stack to TX management frames.
+ * If the ring is full packet are dropped (for data frame the queue
+ * is stopped before this can happen). For this reason it is better
+ * if the descriptors are larger than the largest management frame
+ * we intend to TX: i'm unsure what the HW does if it will not found
+ * the last fragment of a frame because it has been dropped...
+ * Since queues for Management and Data frames are different we
+ * might use a different lock than tx_lock (for example mgmt_tx_lock)
+ */
+/* these function may loops if invoked with 0 descriptors or 0 len buffer */
+int rtl8180_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	unsigned long flags;
+	int priority;
+
+	priority = MANAGE_PRIORITY;
+
+	spin_lock_irqsave(&priv->tx_lock, flags);
+
+	if (priv->ieee80211->bHwRadioOff) {
+		spin_unlock_irqrestore(&priv->tx_lock, flags);
+		dev_kfree_skb_any(skb);
+		return NETDEV_TX_OK;
+	}
+
+	rtl8180_tx(dev, skb->data, skb->len, priority,
+		0, 0, ieeerate2rtlrate(priv->ieee80211->basic_rate));
+
+	priv->ieee80211->stats.tx_bytes += skb->len;
+	priv->ieee80211->stats.tx_packets++;
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+	dev_kfree_skb_any(skb);
+	return NETDEV_TX_OK;
+}
+
+/* longpre 144+48 shortpre 72+24 */
+u16 rtl8180_len2duration(u32 len, short rate, short *ext)
+{
+	u16 duration;
+	u16 drift;
+	*ext = 0;
+
+	switch (rate) {
+	case 0: /* 1mbps */
+		*ext = 0;
+		duration = ((len+4)<<4) / 0x2;
+		drift = ((len+4)<<4) % 0x2;
+		if (drift == 0)
+			break;
+		duration++;
+		break;
+	case 1: /* 2mbps */
+		*ext = 0;
+		duration = ((len+4)<<4) / 0x4;
+		drift = ((len+4)<<4) % 0x4;
+		if (drift == 0)
+			break;
+		duration++;
+		break;
+	case 2: /* 5.5mbps */
+		*ext = 0;
+		duration = ((len+4)<<4) / 0xb;
+		drift = ((len+4)<<4) % 0xb;
+		if (drift == 0)
+			break;
+		duration++;
+		break;
+	default:
+	case 3: /* 11mbps */
+		*ext = 0;
+		duration = ((len+4)<<4) / 0x16;
+		drift = ((len+4)<<4) % 0x16;
+		if (drift == 0)
+			break;
+		duration++;
+		if (drift > 6)
+			break;
+		*ext = 1;
+		break;
+	}
+
+	return duration;
+}
+
+void rtl8180_prepare_beacon(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct sk_buff *skb;
+
+	u16 word  = read_nic_word(dev, BcnItv);
+	word &= ~BcnItv_BcnItv; /* clear Bcn_Itv */
+	word |= cpu_to_le16(priv->ieee80211->current_network.beacon_interval); /* 0x64; */
+	write_nic_word(dev, BcnItv, word);
+
+	skb = ieee80211_get_beacon(priv->ieee80211);
+	if (skb) {
+		rtl8180_tx(dev, skb->data, skb->len, BEACON_PRIORITY,
+			0, 0, ieeerate2rtlrate(priv->ieee80211->basic_rate));
+		dev_kfree_skb_any(skb);
+	}
+}
+
+/*
+ * This function do the real dirty work: it enqueues a TX command
+ * descriptor in the ring buffer, copyes the frame in a TX buffer
+ * and kicks the NIC to ensure it does the DMA transfer.
+ */
+short rtl8180_tx(struct net_device *dev, u8* txbuf, int len, int priority,
+		 short morefrag, short descfrag, int rate)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u32 *tail, *temp_tail;
+	u32 *begin;
+	u32 *buf;
+	int i;
+	int remain;
+	int buflen;
+	int count;
+	u16 duration;
+	short ext;
+	struct buffer *buflist;
+	struct ieee80211_hdr_3addr *frag_hdr = (struct ieee80211_hdr_3addr *)txbuf;
+	u8 dest[ETH_ALEN];
+	u8			bUseShortPreamble = 0;
+	u8			bCTSEnable = 0;
+	u8			bRTSEnable = 0;
+	u16			Duration = 0;
+	u16			RtsDur = 0;
+	u16			ThisFrameTime = 0;
+	u16			TxDescDuration = 0;
+	u8			ownbit_flag = false;
+
+	switch (priority) {
+	case MANAGE_PRIORITY:
+		tail = priv->txmapringtail;
+		begin = priv->txmapring;
+		buflist = priv->txmapbufstail;
+		count = priv->txringcount;
+		break;
+	case BK_PRIORITY:
+		tail = priv->txbkpringtail;
+		begin = priv->txbkpring;
+		buflist = priv->txbkpbufstail;
+		count = priv->txringcount;
+		break;
+	case BE_PRIORITY:
+		tail = priv->txbepringtail;
+		begin = priv->txbepring;
+		buflist = priv->txbepbufstail;
+		count = priv->txringcount;
+		break;
+	case VI_PRIORITY:
+		tail = priv->txvipringtail;
+		begin = priv->txvipring;
+		buflist = priv->txvipbufstail;
+		count = priv->txringcount;
+		break;
+	case VO_PRIORITY:
+		tail = priv->txvopringtail;
+		begin = priv->txvopring;
+		buflist = priv->txvopbufstail;
+		count = priv->txringcount;
+		break;
+	case HI_PRIORITY:
+		tail = priv->txhpringtail;
+		begin = priv->txhpring;
+		buflist = priv->txhpbufstail;
+		count = priv->txringcount;
+		break;
+	case BEACON_PRIORITY:
+		tail = priv->txbeaconringtail;
+		begin = priv->txbeaconring;
+		buflist = priv->txbeaconbufstail;
+		count = priv->txbeaconcount;
+		break;
+	default:
+		return -1;
+		break;
+	}
+
+		memcpy(&dest, frag_hdr->addr1, ETH_ALEN);
+		if (is_multicast_ether_addr(dest) ||
+				is_broadcast_ether_addr(dest)) {
+			Duration = 0;
+			RtsDur = 0;
+			bRTSEnable = 0;
+			bCTSEnable = 0;
+
+			ThisFrameTime = ComputeTxTime(len + sCrcLng, rtl8180_rate2rate(rate),
+						      0, bUseShortPreamble);
+			TxDescDuration = ThisFrameTime;
+		} else { /* Unicast packet */
+			u16 AckTime;
+
+			/* YJ,add,080828,for Keep alive */
+			priv->NumTxUnicast++;
+
+			/* Figure out ACK rate according to BSS basic rate
+			 * and Tx rate. */
+			AckTime = ComputeTxTime(14, 10, 0, 0);	/* AckCTSLng = 14 use 1M bps send */
+
+			if (((len + sCrcLng) > priv->rts) && priv->rts) { /* RTS/CTS. */
+				u16 RtsTime, CtsTime;
+				/* u16 CtsRate; */
+				bRTSEnable = 1;
+				bCTSEnable = 0;
+
+				/* Rate and time required for RTS. */
+				RtsTime = ComputeTxTime(sAckCtsLng/8, priv->ieee80211->basic_rate, 0, 0);
+				/* Rate and time required for CTS. */
+				CtsTime = ComputeTxTime(14, 10, 0, 0);	/* AckCTSLng = 14 use 1M bps send */
+
+				/* Figure out time required to transmit this frame. */
+				ThisFrameTime = ComputeTxTime(len + sCrcLng,
+						rtl8180_rate2rate(rate),
+						0,
+						bUseShortPreamble);
+
+				/* RTS-CTS-ThisFrame-ACK. */
+				RtsDur = CtsTime + ThisFrameTime + AckTime + 3*aSifsTime;
+
+				TxDescDuration = RtsTime + RtsDur;
+			} else { /* Normal case. */
+				bCTSEnable = 0;
+				bRTSEnable = 0;
+				RtsDur = 0;
+
+				ThisFrameTime = ComputeTxTime(len + sCrcLng, rtl8180_rate2rate(rate),
+							      0, bUseShortPreamble);
+				TxDescDuration = ThisFrameTime + aSifsTime + AckTime;
+			}
+
+			if (!(frag_hdr->frame_control & IEEE80211_FCTL_MOREFRAGS)) {
+				/* ThisFrame-ACK. */
+				Duration = aSifsTime + AckTime;
+			} else { /* One or more fragments remained. */
+				u16 NextFragTime;
+				NextFragTime = ComputeTxTime(len + sCrcLng, /* pretend following packet length equal current packet */
+						rtl8180_rate2rate(rate),
+						0,
+						bUseShortPreamble);
+
+				/* ThisFrag-ACk-NextFrag-ACK. */
+				Duration = NextFragTime + 3*aSifsTime + 2*AckTime;
+			}
+
+		} /* End of Unicast packet */
+
+		frag_hdr->duration_id = Duration;
+
+	buflen = priv->txbuffsize;
+	remain = len;
+	temp_tail = tail;
+
+	while (remain != 0) {
+		mb();
+		if (!buflist) {
+			DMESGE("TX buffer error, cannot TX frames. pri %d.", priority);
+			return -1;
+		}
+		buf = buflist->buf;
+
+		if ((*tail & (1 << 31)) && (priority != BEACON_PRIORITY)) {
+			DMESGW("No more TX desc, returning %x of %x",
+			       remain, len);
+			priv->stats.txrdu++;
+			return remain;
+		}
+
+		*tail = 0; /* zeroes header */
+		*(tail+1) = 0;
+		*(tail+3) = 0;
+		*(tail+5) = 0;
+		*(tail+6) = 0;
+		*(tail+7) = 0;
+
+		/* FIXME: this should be triggered by HW encryption parameters.*/
+		*tail |= (1<<15); /* no encrypt */
+
+		if (remain == len && !descfrag) {
+			ownbit_flag = false;
+			*tail = *tail | (1<<29) ; /* fist segment of the packet */
+			*tail = *tail | (len);
+		} else {
+			ownbit_flag = true;
+		}
+
+		for (i = 0; i < buflen && remain > 0; i++, remain--) {
+			((u8 *)buf)[i] = txbuf[i]; /* copy data into descriptor pointed DMAble buffer */
+			if (remain == 4 && i+4 >= buflen)
+				break;
+			/* ensure the last desc has at least 4 bytes payload */
+
+		}
+		txbuf = txbuf + i;
+		*(tail+3) = *(tail+3) & ~0xfff;
+		*(tail+3) = *(tail+3) | i; /* buffer length */
+		/* Use short preamble or not */
+		if (priv->ieee80211->current_network.capability&WLAN_CAPABILITY_SHORT_PREAMBLE)
+			if (priv->plcp_preamble_mode == 1 && rate != 0)	/*  short mode now, not long! */
+			; /* *tail |= (1<<16); */				/* enable short preamble mode. */
+
+		if (bCTSEnable)
+			*tail |= (1<<18);
+
+		if (bRTSEnable) { /* rts enable */
+			*tail |= ((ieeerate2rtlrate(priv->ieee80211->basic_rate))<<19); /* RTS RATE */
+			*tail |= (1<<23); /* rts enable */
+			*(tail+1) |= (RtsDur&0xffff); /* RTS Duration */
+		}
+		*(tail+3) |= ((TxDescDuration&0xffff)<<16); /* DURATION */
+		/* *(tail+3) |= (0xe6<<16); */
+		*(tail+5) |= (11<<8); /* (priv->retry_data<<8); */ /* retry lim; */
+
+		*tail = *tail | ((rate&0xf) << 24);
+
+		/* hw_plcp_len is not used for rtl8180 chip */
+		/* FIXME */
+		if (!priv->hw_plcp_len) {
+			duration = rtl8180_len2duration(len, rate, &ext);
+			*(tail+1) = *(tail+1) | ((duration & 0x7fff)<<16);
+			if (ext)
+				*(tail+1) = *(tail+1) | (1<<31); /* plcp length extension */
+		}
+
+		if (morefrag)
+			*tail = (*tail) | (1<<17); /* more fragment */
+		if (!remain)
+			*tail = (*tail) | (1<<28); /* last segment of frame */
+
+		*(tail+5) = *(tail+5)|(2<<27);
+		*(tail+7) = *(tail+7)|(1<<4);
+
+		wmb();
+		if (ownbit_flag)
+			*tail = *tail | (1<<31); /* descriptor ready to be txed */
+
+		if ((tail - begin)/8 == count-1)
+			tail = begin;
+		else
+			tail = tail+8;
+
+		buflist = buflist->next;
+
+		mb();
+
+		switch (priority) {
+		case MANAGE_PRIORITY:
+			priv->txmapringtail = tail;
+			priv->txmapbufstail = buflist;
+			break;
+		case BK_PRIORITY:
+			priv->txbkpringtail = tail;
+			priv->txbkpbufstail = buflist;
+			break;
+		case BE_PRIORITY:
+			priv->txbepringtail = tail;
+			priv->txbepbufstail = buflist;
+			break;
+		case VI_PRIORITY:
+			priv->txvipringtail = tail;
+			priv->txvipbufstail = buflist;
+			break;
+		case VO_PRIORITY:
+			priv->txvopringtail = tail;
+			priv->txvopbufstail = buflist;
+			break;
+		case HI_PRIORITY:
+			priv->txhpringtail = tail;
+			priv->txhpbufstail = buflist;
+			break;
+		case BEACON_PRIORITY:
+			/*
+			 * The HW seems to be happy with the 1st
+			 * descriptor filled and the 2nd empty...
+			 * So always update descriptor 1 and never
+			 * touch 2nd
+			 */
+			break;
+		}
+	}
+	*temp_tail = *temp_tail | (1<<31); /* descriptor ready to be txed */
+	rtl8180_dma_kick(dev, priority);
+
+	return 0;
+}
+
+void rtl8180_irq_rx_tasklet(struct r8180_priv *priv);
+
+void rtl8180_link_change(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u16 beacon_interval;
+	struct ieee80211_network *net = &priv->ieee80211->current_network;
+
+	rtl8180_update_msr(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+
+	write_nic_dword(dev, BSSID, ((u32 *)net->bssid)[0]);
+	write_nic_word(dev, BSSID+4, ((u16 *)net->bssid)[2]);
+
+	beacon_interval  = read_nic_dword(dev, BEACON_INTERVAL);
+	beacon_interval &= ~BEACON_INTERVAL_MASK;
+	beacon_interval |= net->beacon_interval;
+	write_nic_dword(dev, BEACON_INTERVAL, beacon_interval);
+
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	rtl8180_set_chan(dev, priv->chan);
+}
+
+void rtl8180_rq_tx_ack(struct net_device *dev)
+{
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	write_nic_byte(dev, CONFIG4, read_nic_byte(dev, CONFIG4) | CONFIG4_PWRMGT);
+	priv->ack_tx_to_ieee = 1;
+}
+
+short rtl8180_is_tx_queue_empty(struct net_device *dev)
+{
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u32 *d;
+
+	for (d = priv->txmapring;
+		d < priv->txmapring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+
+	for (d = priv->txbkpring;
+		d < priv->txbkpring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+
+	for (d = priv->txbepring;
+		d < priv->txbepring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+
+	for (d = priv->txvipring;
+		d < priv->txvipring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+
+	for (d = priv->txvopring;
+		d < priv->txvopring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+
+	for (d = priv->txhpring;
+		d < priv->txhpring + priv->txringcount; d += 8)
+			if (*d & (1<<31))
+				return 0;
+	return 1;
+}
+/* FIXME FIXME 5msecs is random */
+#define HW_WAKE_DELAY 5
+
+void rtl8180_hw_wakeup(struct net_device *dev)
+{
+	unsigned long flags;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	spin_lock_irqsave(&priv->ps_lock, flags);
+	write_nic_byte(dev, CONFIG4, read_nic_byte(dev, CONFIG4) & ~CONFIG4_PWRMGT);
+	if (priv->rf_wakeup)
+		priv->rf_wakeup(dev);
+	spin_unlock_irqrestore(&priv->ps_lock, flags);
+}
+
+void rtl8180_hw_sleep_down(struct net_device *dev)
+{
+	unsigned long flags;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	spin_lock_irqsave(&priv->ps_lock, flags);
+	if (priv->rf_sleep)
+		priv->rf_sleep(dev);
+	spin_unlock_irqrestore(&priv->ps_lock, flags);
+}
+
+void rtl8180_hw_sleep(struct net_device *dev, u32 th, u32 tl)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u32 rb = jiffies;
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->ps_lock, flags);
+
+	/*
+	 * Writing HW register with 0 equals to disable
+	 * the timer, that is not really what we want
+	 */
+	tl -= MSECS(4+16+7);
+
+	/*
+	 * If the interval in witch we are requested to sleep is too
+	 * short then give up and remain awake
+	 */
+	if (((tl >= rb) && (tl-rb) <= MSECS(MIN_SLEEP_TIME))
+		|| ((rb > tl) && (rb-tl) < MSECS(MIN_SLEEP_TIME))) {
+		spin_unlock_irqrestore(&priv->ps_lock, flags);
+		printk("too short to sleep\n");
+		return;
+	}
+
+	{
+		u32 tmp = (tl > rb) ? (tl-rb) : (rb-tl);
+
+		priv->DozePeriodInPast2Sec += jiffies_to_msecs(tmp);
+		/* as tl may be less than rb */
+		queue_delayed_work(priv->ieee80211->wq, &priv->ieee80211->hw_wakeup_wq, tmp);
+	}
+	/*
+	 * If we suspect the TimerInt is gone beyond tl
+	 * while setting it, then give up
+	 */
+
+	if (((tl > rb) && ((tl-rb) > MSECS(MAX_SLEEP_TIME))) ||
+		((tl < rb) && ((rb-tl) > MSECS(MAX_SLEEP_TIME)))) {
+		spin_unlock_irqrestore(&priv->ps_lock, flags);
+		return;
+	}
+
+	queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->hw_sleep_wq);
+	spin_unlock_irqrestore(&priv->ps_lock, flags);
+}
+
+void rtl8180_wmm_param_update(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, wmm_param_update_wq);
+	struct net_device *dev = ieee->dev;
+	u8 *ac_param = (u8 *)(ieee->current_network.wmm_param);
+	u8 mode = ieee->current_network.mode;
+	AC_CODING	eACI;
+	AC_PARAM	AcParam;
+	PAC_PARAM	pAcParam;
+	u8 i;
+
+	if (!ieee->current_network.QoS_Enable) {
+		/* legacy ac_xx_param update */
+		AcParam.longData = 0;
+		AcParam.f.AciAifsn.f.AIFSN = 2; /* Follow 802.11 DIFS. */
+		AcParam.f.AciAifsn.f.ACM = 0;
+		AcParam.f.Ecw.f.ECWmin = 3; /* Follow 802.11 CWmin. */
+		AcParam.f.Ecw.f.ECWmax = 7; /* Follow 802.11 CWmax. */
+		AcParam.f.TXOPLimit = 0;
+		for (eACI = 0; eACI < AC_MAX; eACI++) {
+			AcParam.f.AciAifsn.f.ACI = (u8)eACI;
+			{
+				u8		u1bAIFS;
+				u32		u4bAcParam;
+				pAcParam = (PAC_PARAM)(&AcParam);
+				/* Retrive paramters to udpate. */
+				u1bAIFS = pAcParam->f.AciAifsn.f.AIFSN * (((mode&IEEE_G) == IEEE_G) ? 9 : 20) + aSifsTime;
+				u4bAcParam = ((((u32)(pAcParam->f.TXOPLimit))<<AC_PARAM_TXOP_LIMIT_OFFSET)|
+					      (((u32)(pAcParam->f.Ecw.f.ECWmax))<<AC_PARAM_ECW_MAX_OFFSET)|
+					      (((u32)(pAcParam->f.Ecw.f.ECWmin))<<AC_PARAM_ECW_MIN_OFFSET)|
+					       (((u32)u1bAIFS) << AC_PARAM_AIFS_OFFSET));
+				switch (eACI) {
+				case AC1_BK:
+					write_nic_dword(dev, AC_BK_PARAM, u4bAcParam);
+					break;
+				case AC0_BE:
+					write_nic_dword(dev, AC_BE_PARAM, u4bAcParam);
+					break;
+				case AC2_VI:
+					write_nic_dword(dev, AC_VI_PARAM, u4bAcParam);
+					break;
+				case AC3_VO:
+					write_nic_dword(dev, AC_VO_PARAM, u4bAcParam);
+					break;
+				default:
+					printk(KERN_WARNING "SetHwReg8185():invalid ACI: %d!\n", eACI);
+					break;
+				}
+			}
+		}
+		return;
+	}
+
+	for (i = 0; i < AC_MAX; i++) {
+		/* AcParam.longData = 0; */
+		pAcParam = (AC_PARAM *)ac_param;
+		{
+			AC_CODING	eACI;
+			u8		u1bAIFS;
+			u32		u4bAcParam;
+
+			/* Retrive paramters to udpate. */
+			eACI = pAcParam->f.AciAifsn.f.ACI;
+			/* Mode G/A: slotTimeTimer = 9; Mode B: 20 */
+			u1bAIFS = pAcParam->f.AciAifsn.f.AIFSN * (((mode&IEEE_G) == IEEE_G) ? 9 : 20) + aSifsTime;
+			u4bAcParam = ((((u32)(pAcParam->f.TXOPLimit)) << AC_PARAM_TXOP_LIMIT_OFFSET)	|
+					(((u32)(pAcParam->f.Ecw.f.ECWmax)) << AC_PARAM_ECW_MAX_OFFSET)	|
+					(((u32)(pAcParam->f.Ecw.f.ECWmin)) << AC_PARAM_ECW_MIN_OFFSET)	|
+					(((u32)u1bAIFS) << AC_PARAM_AIFS_OFFSET));
+
+			switch (eACI) {
+			case AC1_BK:
+				write_nic_dword(dev, AC_BK_PARAM, u4bAcParam);
+				break;
+			case AC0_BE:
+				write_nic_dword(dev, AC_BE_PARAM, u4bAcParam);
+				break;
+			case AC2_VI:
+				write_nic_dword(dev, AC_VI_PARAM, u4bAcParam);
+				break;
+			case AC3_VO:
+				write_nic_dword(dev, AC_VO_PARAM, u4bAcParam);
+				break;
+			default:
+				printk(KERN_WARNING "SetHwReg8185(): invalid ACI: %d !\n", eACI);
+				break;
+			}
+		}
+		ac_param += (sizeof(AC_PARAM));
+	}
+}
+
+void rtl8180_tx_irq_wq(struct work_struct *work);
+void rtl8180_restart_wq(struct work_struct *work);
+/* void rtl8180_rq_tx_ack(struct work_struct *work); */
+void rtl8180_watch_dog_wq(struct work_struct *work);
+void rtl8180_hw_wakeup_wq(struct work_struct *work);
+void rtl8180_hw_sleep_wq(struct work_struct *work);
+void rtl8180_sw_antenna_wq(struct work_struct *work);
+void rtl8180_watch_dog(struct net_device *dev);
+
+void watch_dog_adaptive(unsigned long data)
+{
+	struct r8180_priv* priv = ieee80211_priv((struct net_device *)data);
+
+	if (!priv->up) {
+		DMESG("<----watch_dog_adaptive():driver is not up!\n");
+		return;
+	}
+
+	/* Tx High Power Mechanism. */
+	if (CheckHighPower((struct net_device *)data))
+		queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->tx_pw_wq);
+
+	/* Tx Power Tracking on 87SE. */
+	if (CheckTxPwrTracking((struct net_device *)data))
+		TxPwrTracking87SE((struct net_device *)data);
+
+	/* Perform DIG immediately. */
+	if (CheckDig((struct net_device *)data) == true)
+		queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->hw_dig_wq);
+	rtl8180_watch_dog((struct net_device *)data);
+
+	queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->GPIOChangeRFWorkItem);
+
+	priv->watch_dog_timer.expires = jiffies + MSECS(IEEE80211_WATCH_DOG_TIME);
+	add_timer(&priv->watch_dog_timer);
+}
+
+static CHANNEL_LIST ChannelPlan[] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64},19},		/* FCC */
+	{{1,2,3,4,5,6,7,8,9,10,11},11},					/* IC */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},	/* ETSI */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},	/* Spain. Change to ETSI. */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},	/* France. Change to ETSI. */
+	{{14,36,40,44,48,52,56,60,64},9},				/* MKK */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14, 36,40,44,48,52,56,60,64},22},/* MKK1 */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},	/* Israel. */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,34,38,42,46},17},		/* For 11a , TELEC */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14},  /* For Global Domain. 1-11:active scan, 12-14 passive scan. //+YJ, 080626 */
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13} /* world wide 13: ch1~ch11 active scan, ch12~13 passive //lzm add 080826 */
+};
+
+static void rtl8180_set_channel_map(u8 channel_plan, struct ieee80211_device *ieee)
+{
+	int i;
+
+	/* lzm add 080826 */
+	ieee->MinPassiveChnlNum = MAX_CHANNEL_NUMBER+1;
+	ieee->IbssStartChnl = 0;
+
+	switch (channel_plan) {
+	case COUNTRY_CODE_FCC:
+	case COUNTRY_CODE_IC:
+	case COUNTRY_CODE_ETSI:
+	case COUNTRY_CODE_SPAIN:
+	case COUNTRY_CODE_FRANCE:
+	case COUNTRY_CODE_MKK:
+	case COUNTRY_CODE_MKK1:
+	case COUNTRY_CODE_ISRAEL:
+	case COUNTRY_CODE_TELEC:
+		{
+			Dot11d_Init(ieee);
+			ieee->bGlobalDomain = false;
+			if (ChannelPlan[channel_plan].Len != 0) {
+				/* Clear old channel map */
+				memset(GET_DOT11D_INFO(ieee)->channel_map, 0, sizeof(GET_DOT11D_INFO(ieee)->channel_map));
+				/* Set new channel map */
+				for (i = 0; i < ChannelPlan[channel_plan].Len; i++) {
+					if (ChannelPlan[channel_plan].Channel[i] <= 14)
+						GET_DOT11D_INFO(ieee)->channel_map[ChannelPlan[channel_plan].Channel[i]] = 1;
+				}
+			}
+			break;
+		}
+	case COUNTRY_CODE_GLOBAL_DOMAIN:
+		{
+			GET_DOT11D_INFO(ieee)->bEnabled = 0;
+			Dot11d_Reset(ieee);
+			ieee->bGlobalDomain = true;
+			break;
+		}
+	case COUNTRY_CODE_WORLD_WIDE_13_INDEX:/* lzm add 080826 */
+		{
+			ieee->MinPassiveChnlNum = 12;
+			ieee->IbssStartChnl = 10;
+			break;
+		}
+	default:
+		{
+			Dot11d_Init(ieee);
+			ieee->bGlobalDomain = false;
+			memset(GET_DOT11D_INFO(ieee)->channel_map, 0, sizeof(GET_DOT11D_INFO(ieee)->channel_map));
+			for (i = 1; i <= 14; i++)
+				GET_DOT11D_INFO(ieee)->channel_map[i] = 1;
+			break;
+		}
+	}
+}
+
+void GPIOChangeRFWorkItemCallBack(struct work_struct *work);
+
+/* YJ,add,080828 */
+static void rtl8180_statistics_init(struct Stats *pstats)
+{
+	memset(pstats, 0, sizeof(struct Stats));
+}
+
+static void rtl8180_link_detect_init(plink_detect_t plink_detect)
+{
+	memset(plink_detect, 0, sizeof(link_detect_t));
+	plink_detect->SlotNum = DEFAULT_SLOT_NUM;
+}
+
+/* YJ,add,080828,end */
+static void rtl8187se_eeprom_register_read(struct eeprom_93cx6 *eeprom)
+{
+	struct net_device *dev = eeprom->data;
+	u8 reg = read_nic_byte(dev, EPROM_CMD);
+
+	eeprom->reg_data_in = reg & RTL818X_EEPROM_CMD_WRITE;
+	eeprom->reg_data_out = reg & RTL818X_EEPROM_CMD_READ;
+	eeprom->reg_data_clock = reg & RTL818X_EEPROM_CMD_CK;
+	eeprom->reg_chip_select = reg & RTL818X_EEPROM_CMD_CS;
+}
+
+static void rtl8187se_eeprom_register_write(struct eeprom_93cx6 *eeprom)
+{
+	struct net_device *dev = eeprom->data;
+	u8 reg = 2 << 6;
+
+	if (eeprom->reg_data_in)
+		reg |= RTL818X_EEPROM_CMD_WRITE;
+	if (eeprom->reg_data_out)
+		reg |= RTL818X_EEPROM_CMD_READ;
+	if (eeprom->reg_data_clock)
+		reg |= RTL818X_EEPROM_CMD_CK;
+	if (eeprom->reg_chip_select)
+		reg |= RTL818X_EEPROM_CMD_CS;
+
+	write_nic_byte(dev, EPROM_CMD, reg);
+	read_nic_byte(dev, EPROM_CMD);
+	udelay(10);
+}
+
+short rtl8180_init(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u16 word;
+	u16 version;
+	u32 usValue;
+	u16 tmpu16;
+	int i, j;
+	struct eeprom_93cx6 eeprom;
+	u16 eeprom_val;
+
+	eeprom.data = dev;
+	eeprom.register_read = rtl8187se_eeprom_register_read;
+	eeprom.register_write = rtl8187se_eeprom_register_write;
+	eeprom.width = PCI_EEPROM_WIDTH_93C46;
+
+	eeprom_93cx6_read(&eeprom, EEPROM_COUNTRY_CODE>>1, &eeprom_val);
+	priv->channel_plan = eeprom_val & 0xFF;
+	if (priv->channel_plan > COUNTRY_CODE_GLOBAL_DOMAIN) {
+		printk("rtl8180_init:Error channel plan! Set to default.\n");
+		priv->channel_plan = 0;
+	}
+
+	DMESG("Channel plan is %d\n", priv->channel_plan);
+	rtl8180_set_channel_map(priv->channel_plan, priv->ieee80211);
+
+	/* FIXME: these constants are placed in a bad pleace. */
+	priv->txbuffsize = 2048;	/* 1024; */
+	priv->txringcount = 32;		/* 32; */
+	priv->rxbuffersize = 2048;	/* 1024; */
+	priv->rxringcount = 64;		/* 32; */
+	priv->txbeaconcount = 2;
+	priv->rx_skb_complete = 1;
+
+	priv->RFChangeInProgress = false;
+	priv->SetRFPowerStateInProgress = false;
+	priv->RFProgType = 0;
+	priv->bInHctTest = false;
+
+	priv->irq_enabled = 0;
+
+	rtl8180_statistics_init(&priv->stats);
+	rtl8180_link_detect_init(&priv->link_detect);
+
+	priv->ack_tx_to_ieee = 0;
+	priv->ieee80211->current_network.beacon_interval = DEFAULT_BEACONINTERVAL;
+	priv->ieee80211->iw_mode = IW_MODE_INFRA;
+	priv->ieee80211->softmac_features  = IEEE_SOFTMAC_SCAN |
+		IEEE_SOFTMAC_ASSOCIATE | IEEE_SOFTMAC_PROBERQ |
+		IEEE_SOFTMAC_PROBERS | IEEE_SOFTMAC_TX_QUEUE;
+	priv->ieee80211->active_scan = 1;
+	priv->ieee80211->rate = 110; /* 11 mbps */
+	priv->ieee80211->modulation = IEEE80211_CCK_MODULATION;
+	priv->ieee80211->host_encrypt = 1;
+	priv->ieee80211->host_decrypt = 1;
+	priv->ieee80211->sta_wake_up = rtl8180_hw_wakeup;
+	priv->ieee80211->ps_request_tx_ack = rtl8180_rq_tx_ack;
+	priv->ieee80211->enter_sleep_state = rtl8180_hw_sleep;
+	priv->ieee80211->ps_is_queue_empty = rtl8180_is_tx_queue_empty;
+
+	priv->hw_wep = hwwep;
+	priv->prism_hdr = 0;
+	priv->dev = dev;
+	priv->retry_rts = DEFAULT_RETRY_RTS;
+	priv->retry_data = DEFAULT_RETRY_DATA;
+	priv->RFChangeInProgress = false;
+	priv->SetRFPowerStateInProgress = false;
+	priv->RFProgType = 0;
+	priv->bInHctTest = false;
+	priv->bInactivePs = true; /* false; */
+	priv->ieee80211->bInactivePs = priv->bInactivePs;
+	priv->bSwRfProcessing = false;
+	priv->eRFPowerState = eRfOff;
+	priv->RfOffReason = 0;
+	priv->LedStrategy = SW_LED_MODE0;
+	priv->TxPollingTimes = 0; /* lzm add 080826 */
+	priv->bLeisurePs = true;
+	priv->dot11PowerSaveMode = eActive;
+	priv->AdMinCheckPeriod = 5;
+	priv->AdMaxCheckPeriod = 10;
+	priv->AdMaxRxSsThreshold = 30;	/* 60->30 */
+	priv->AdRxSsThreshold = 20;	/* 50->20 */
+	priv->AdCheckPeriod = priv->AdMinCheckPeriod;
+	priv->AdTickCount = 0;
+	priv->AdRxSignalStrength = -1;
+	priv->RegSwAntennaDiversityMechanism = 0;
+	priv->RegDefaultAntenna = 0;
+	priv->SignalStrength = 0;
+	priv->AdRxOkCnt = 0;
+	priv->CurrAntennaIndex = 0;
+	priv->AdRxSsBeforeSwitched = 0;
+	init_timer(&priv->SwAntennaDiversityTimer);
+	priv->SwAntennaDiversityTimer.data = (unsigned long)dev;
+	priv->SwAntennaDiversityTimer.function = (void *)SwAntennaDiversityTimerCallback;
+	priv->bDigMechanism = 1;
+	priv->InitialGain = 6;
+	priv->bXtalCalibration = false;
+	priv->XtalCal_Xin = 0;
+	priv->XtalCal_Xout = 0;
+	priv->bTxPowerTrack = false;
+	priv->ThermalMeter = 0;
+	priv->FalseAlarmRegValue = 0;
+	priv->RegDigOfdmFaUpTh = 0xc; /* Upper threhold of OFDM false alarm, which is used in DIG. */
+	priv->DIG_NumberFallbackVote = 0;
+	priv->DIG_NumberUpgradeVote = 0;
+	priv->LastSignalStrengthInPercent = 0;
+	priv->Stats_SignalStrength = 0;
+	priv->LastRxPktAntenna = 0;
+	priv->SignalQuality = 0; /* in 0-100 index. */
+	priv->Stats_SignalQuality = 0;
+	priv->RecvSignalPower = 0; /* in dBm. */
+	priv->Stats_RecvSignalPower = 0;
+	priv->AdMainAntennaRxOkCnt = 0;
+	priv->AdAuxAntennaRxOkCnt = 0;
+	priv->bHWAdSwitched = false;
+	priv->bRegHighPowerMechanism = true;
+	priv->RegHiPwrUpperTh = 77;
+	priv->RegHiPwrLowerTh = 75;
+	priv->RegRSSIHiPwrUpperTh = 70;
+	priv->RegRSSIHiPwrLowerTh = 20;
+	priv->bCurCCKPkt = false;
+	priv->UndecoratedSmoothedSS = -1;
+	priv->bToUpdateTxPwr = false;
+	priv->CurCCKRSSI = 0;
+	priv->RxPower = 0;
+	priv->RSSI = 0;
+	priv->NumTxOkTotal = 0;
+	priv->NumTxUnicast = 0;
+	priv->keepAliveLevel = DEFAULT_KEEP_ALIVE_LEVEL;
+	priv->PowerProfile = POWER_PROFILE_AC;
+	priv->CurrRetryCnt = 0;
+	priv->LastRetryCnt = 0;
+	priv->LastTxokCnt = 0;
+	priv->LastRxokCnt = 0;
+	priv->LastRetryRate = 0;
+	priv->bTryuping = 0;
+	priv->CurrTxRate = 0;
+	priv->CurrRetryRate = 0;
+	priv->TryupingCount = 0;
+	priv->TryupingCountNoData = 0;
+	priv->TryDownCountLowData = 0;
+	priv->LastTxOKBytes = 0;
+	priv->LastFailTxRate = 0;
+	priv->LastFailTxRateSS = 0;
+	priv->FailTxRateCount = 0;
+	priv->LastTxThroughput = 0;
+	priv->NumTxOkBytesTotal = 0;
+	priv->ForcedDataRate = 0;
+	priv->RegBModeGainStage = 1;
+
+	priv->promisc = (dev->flags & IFF_PROMISC) ? 1 : 0;
+	spin_lock_init(&priv->irq_lock);
+	spin_lock_init(&priv->irq_th_lock);
+	spin_lock_init(&priv->tx_lock);
+	spin_lock_init(&priv->ps_lock);
+	spin_lock_init(&priv->rf_ps_lock);
+	sema_init(&priv->wx_sem, 1);
+	sema_init(&priv->rf_state, 1);
+	INIT_WORK(&priv->reset_wq, (void *)rtl8180_restart_wq);
+	INIT_WORK(&priv->tx_irq_wq, (void *)rtl8180_tx_irq_wq);
+	INIT_DELAYED_WORK(&priv->ieee80211->hw_wakeup_wq,
+			  (void *)rtl8180_hw_wakeup_wq);
+	INIT_DELAYED_WORK(&priv->ieee80211->hw_sleep_wq,
+			  (void *)rtl8180_hw_sleep_wq);
+	INIT_WORK(&priv->ieee80211->wmm_param_update_wq,
+		  (void *)rtl8180_wmm_param_update);
+	INIT_DELAYED_WORK(&priv->ieee80211->rate_adapter_wq,
+			  (void *)rtl8180_rate_adapter);
+	INIT_DELAYED_WORK(&priv->ieee80211->hw_dig_wq,
+			 (void *)rtl8180_hw_dig_wq);
+	INIT_DELAYED_WORK(&priv->ieee80211->tx_pw_wq,
+			 (void *)rtl8180_tx_pw_wq);
+	INIT_DELAYED_WORK(&priv->ieee80211->GPIOChangeRFWorkItem,
+			 (void *) GPIOChangeRFWorkItemCallBack);
+	tasklet_init(&priv->irq_rx_tasklet,
+		     (void(*)(unsigned long)) rtl8180_irq_rx_tasklet,
+		     (unsigned long)priv);
+
+	init_timer(&priv->watch_dog_timer);
+	priv->watch_dog_timer.data = (unsigned long)dev;
+	priv->watch_dog_timer.function = watch_dog_adaptive;
+
+	init_timer(&priv->rateadapter_timer);
+	priv->rateadapter_timer.data = (unsigned long)dev;
+	priv->rateadapter_timer.function = timer_rate_adaptive;
+	priv->RateAdaptivePeriod = RATE_ADAPTIVE_TIMER_PERIOD;
+	priv->bEnhanceTxPwr = false;
+
+	priv->ieee80211->softmac_hard_start_xmit = rtl8180_hard_start_xmit;
+	priv->ieee80211->set_chan = rtl8180_set_chan;
+	priv->ieee80211->link_change = rtl8180_link_change;
+	priv->ieee80211->softmac_data_hard_start_xmit = rtl8180_hard_data_xmit;
+	priv->ieee80211->data_hard_stop = rtl8180_data_hard_stop;
+	priv->ieee80211->data_hard_resume = rtl8180_data_hard_resume;
+
+	priv->ieee80211->init_wmmparam_flag = 0;
+
+	priv->ieee80211->start_send_beacons = rtl8180_start_tx_beacon;
+	priv->ieee80211->stop_send_beacons = rtl8180_beacon_tx_disable;
+	priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
+
+	priv->MWIEnable = 0;
+
+	priv->ShortRetryLimit = 7;
+	priv->LongRetryLimit = 7;
+	priv->EarlyRxThreshold = 7;
+
+	priv->CSMethod = (0x01 << 29);
+
+	priv->TransmitConfig =	TCR_DurProcMode_OFFSET |
+				(7<<TCR_MXDMA_OFFSET) |
+				(priv->ShortRetryLimit<<TCR_SRL_OFFSET) |
+				(priv->LongRetryLimit<<TCR_LRL_OFFSET) |
+				(0 ? TCR_SAT : 0);
+
+	priv->ReceiveConfig =	RCR_AMF | RCR_ADF | RCR_ACF |
+				RCR_AB | RCR_AM | RCR_APM |
+				(7<<RCR_MXDMA_OFFSET) |
+				(priv->EarlyRxThreshold<<RCR_FIFO_OFFSET) |
+				(priv->EarlyRxThreshold == 7 ?
+					 RCR_ONLYERLPKT : 0);
+
+	priv->IntrMask		= IMR_TMGDOK | IMR_TBDER | IMR_THPDER |
+				  IMR_THPDER | IMR_THPDOK |
+				  IMR_TVODER | IMR_TVODOK |
+				  IMR_TVIDER | IMR_TVIDOK |
+				  IMR_TBEDER | IMR_TBEDOK |
+				  IMR_TBKDER | IMR_TBKDOK |
+				  IMR_RDU |
+				  IMR_RER | IMR_ROK |
+				  IMR_RQoSOK;
+
+	priv->InitialGain = 6;
+
+	DMESG("MAC controller is a RTL8187SE b/g");
+	priv->phy_ver = 2;
+
+	priv->ieee80211->modulation |= IEEE80211_OFDM_MODULATION;
+	priv->ieee80211->short_slot = 1;
+
+	/* just for sync 85 */
+	priv->enable_gpio0 = 0;
+
+	eeprom_93cx6_read(&eeprom, EEPROM_SW_REVD_OFFSET, &eeprom_val);
+	usValue = eeprom_val;
+	DMESG("usValue is 0x%x\n", usValue);
+	/* 3Read AntennaDiversity */
+
+	/* SW Antenna Diversity. */
+	if ((usValue & EEPROM_SW_AD_MASK) != EEPROM_SW_AD_ENABLE)
+		priv->EEPROMSwAntennaDiversity = false;
+	else
+		priv->EEPROMSwAntennaDiversity = true;
+
+	/* Default Antenna to use. */
+	if ((usValue & EEPROM_DEF_ANT_MASK) != EEPROM_DEF_ANT_1)
+		priv->EEPROMDefaultAntenna1 = false;
+	else
+		priv->EEPROMDefaultAntenna1 = true;
+
+	if (priv->RegSwAntennaDiversityMechanism == 0) /* Auto */
+		/* 0: default from EEPROM. */
+		priv->bSwAntennaDiverity = priv->EEPROMSwAntennaDiversity;
+	else
+		/* 1:disable antenna diversity, 2: enable antenna diversity. */
+		priv->bSwAntennaDiverity = ((priv->RegSwAntennaDiversityMechanism == 1) ? false : true);
+
+	if (priv->RegDefaultAntenna == 0)
+		/* 0: default from EEPROM. */
+		priv->bDefaultAntenna1 = priv->EEPROMDefaultAntenna1;
+	else
+		/* 1: main, 2: aux. */
+		priv->bDefaultAntenna1 = ((priv->RegDefaultAntenna == 2) ? true : false);
+
+	/* rtl8185 can calc plcp len in HW. */
+	priv->hw_plcp_len = 1;
+
+	priv->plcp_preamble_mode = 2;
+	/* the eeprom type is stored in RCR register bit #6 */
+	if (RCR_9356SEL & read_nic_dword(dev, RCR))
+		priv->epromtype = EPROM_93c56;
+	else
+		priv->epromtype = EPROM_93c46;
+
+	eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)
+			       dev->dev_addr, 3);
+
+	for (i = 1, j = 0; i < 14; i += 2, j++) {
+		eeprom_93cx6_read(&eeprom, EPROM_TXPW_CH1_2 + j, &word);
+		priv->chtxpwr[i] = word & 0xff;
+		priv->chtxpwr[i+1] = (word & 0xff00)>>8;
+	}
+	for (i = 1, j = 0; i < 14; i += 2, j++) {
+		eeprom_93cx6_read(&eeprom, EPROM_TXPW_OFDM_CH1_2 + j, &word);
+		priv->chtxpwr_ofdm[i] = word & 0xff;
+		priv->chtxpwr_ofdm[i+1] = (word & 0xff00) >> 8;
+	}
+
+	/* 3Read crystal calibtration and thermal meter indication on 87SE. */
+	eeprom_93cx6_read(&eeprom, EEPROM_RSV>>1, &tmpu16);
+
+	/* Crystal calibration for Xin and Xout resp. */
+	priv->XtalCal_Xout = tmpu16 & EEPROM_XTAL_CAL_XOUT_MASK;
+	priv->XtalCal_Xin = (tmpu16 & EEPROM_XTAL_CAL_XIN_MASK) >> 4;
+	if ((tmpu16 & EEPROM_XTAL_CAL_ENABLE) >> 12)
+		priv->bXtalCalibration = true;
+
+	/* Thermal meter reference indication. */
+	priv->ThermalMeter =  (u8)((tmpu16 & EEPROM_THERMAL_METER_MASK) >> 8);
+	if ((tmpu16 & EEPROM_THERMAL_METER_ENABLE) >> 13)
+		priv->bTxPowerTrack = true;
+
+	eeprom_93cx6_read(&eeprom, EPROM_TXPW_BASE, &word);
+	priv->cck_txpwr_base = word & 0xf;
+	priv->ofdm_txpwr_base = (word>>4) & 0xf;
+
+	eeprom_93cx6_read(&eeprom, EPROM_VERSION, &version);
+	DMESG("EEPROM version %x", version);
+	priv->rcr_csense = 3;
+
+	eeprom_93cx6_read(&eeprom, ENERGY_TRESHOLD, &eeprom_val);
+	priv->cs_treshold = (eeprom_val & 0xff00) >> 8;
+
+	eeprom_93cx6_read(&eeprom, RFCHIPID, &eeprom_val);
+	priv->rf_sleep = rtl8225z4_rf_sleep;
+	priv->rf_wakeup = rtl8225z4_rf_wakeup;
+	DMESGW("**PLEASE** REPORT SUCCESSFUL/UNSUCCESSFUL TO Realtek!");
+
+	priv->rf_close = rtl8225z2_rf_close;
+	priv->rf_init = rtl8225z2_rf_init;
+	priv->rf_set_chan = rtl8225z2_rf_set_chan;
+	priv->rf_set_sens = NULL;
+
+	if (0 != alloc_rx_desc_ring(dev, priv->rxbuffersize, priv->rxringcount))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				  TX_MANAGEPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				 TX_BKPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				 TX_BEPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				  TX_VIPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				  TX_VOPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
+				  TX_HIGHPRIORITY_RING_ADDR))
+		return -ENOMEM;
+
+	if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txbeaconcount,
+				  TX_BEACON_RING_ADDR))
+		return -ENOMEM;
+
+	if (request_irq(dev->irq, (void *)rtl8180_interrupt, IRQF_SHARED, dev->name, dev)) {
+		DMESGE("Error allocating IRQ %d", dev->irq);
+		return -1;
+	} else {
+		priv->irq = dev->irq;
+		DMESG("IRQ %d", dev->irq);
+	}
+
+	return 0;
+}
+
+void rtl8180_no_hw_wep(struct net_device *dev)
+{
+}
+
+void rtl8180_set_hw_wep(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 pgreg;
+	u8 security;
+	u32 key0_word4;
+
+	pgreg = read_nic_byte(dev, PGSELECT);
+	write_nic_byte(dev, PGSELECT, pgreg & ~(1<<PGSELECT_PG_SHIFT));
+
+	key0_word4 = read_nic_dword(dev, KEY0+4+4+4);
+	key0_word4 &= ~0xff;
+	key0_word4 |= priv->key0[3] & 0xff;
+	write_nic_dword(dev, KEY0, (priv->key0[0]));
+	write_nic_dword(dev, KEY0+4, (priv->key0[1]));
+	write_nic_dword(dev, KEY0+4+4, (priv->key0[2]));
+	write_nic_dword(dev, KEY0+4+4+4, (key0_word4));
+
+	security  = read_nic_byte(dev, SECURITY);
+	security |= (1<<SECURITY_WEP_TX_ENABLE_SHIFT);
+	security |= (1<<SECURITY_WEP_RX_ENABLE_SHIFT);
+	security &= ~SECURITY_ENCRYP_MASK;
+	security |= (SECURITY_ENCRYP_104<<SECURITY_ENCRYP_SHIFT);
+
+	write_nic_byte(dev, SECURITY, security);
+
+	DMESG("key %x %x %x %x", read_nic_dword(dev, KEY0+4+4+4),
+	      read_nic_dword(dev, KEY0+4+4), read_nic_dword(dev, KEY0+4),
+	      read_nic_dword(dev, KEY0));
+}
+
+
+void rtl8185_rf_pins_enable(struct net_device *dev)
+{
+	/* u16 tmp; */
+	/* tmp = read_nic_word(dev, RFPinsEnable); */
+	write_nic_word(dev, RFPinsEnable, 0x1fff); /* | tmp); */
+}
+
+void rtl8185_set_anaparam2(struct net_device *dev, u32 a)
+{
+	u8 conf3;
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+
+	conf3 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, conf3 | (1<<CONFIG3_ANAPARAM_W_SHIFT));
+	write_nic_dword(dev, ANAPARAM2, a);
+
+	conf3 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, conf3 & ~(1<<CONFIG3_ANAPARAM_W_SHIFT));
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+}
+
+void rtl8180_set_anaparam(struct net_device *dev, u32 a)
+{
+	u8 conf3;
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+
+	conf3 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, conf3 | (1<<CONFIG3_ANAPARAM_W_SHIFT));
+	write_nic_dword(dev, ANAPARAM, a);
+
+	conf3 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, conf3 & ~(1<<CONFIG3_ANAPARAM_W_SHIFT));
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+}
+
+void rtl8185_tx_antenna(struct net_device *dev, u8 ant)
+{
+	write_nic_byte(dev, TX_ANTENNA, ant);
+	force_pci_posting(dev);
+	mdelay(1);
+}
+
+void rtl8185_write_phy(struct net_device *dev, u8 adr, u32 data)
+{
+	u32 phyw;
+
+	adr |= 0x80;
+
+	phyw = ((data<<8) | adr);
+
+	/* Note that, we must write 0xff7c after 0x7d-0x7f to write BB register. */
+	write_nic_byte(dev, 0x7f, ((phyw & 0xff000000) >> 24));
+	write_nic_byte(dev, 0x7e, ((phyw & 0x00ff0000) >> 16));
+	write_nic_byte(dev, 0x7d, ((phyw & 0x0000ff00) >> 8));
+	write_nic_byte(dev, 0x7c, ((phyw & 0x000000ff)));
+
+	/* this is ok to fail when we write AGC table. check for AGC table might be
+	 * done by masking with 0x7f instead of 0xff
+	 */
+	/* if (phyr != (data&0xff)) DMESGW("Phy write timeout %x %x %x", phyr, data, adr); */
+}
+
+inline void write_phy_ofdm(struct net_device *dev, u8 adr, u32 data)
+{
+	data = data & 0xff;
+	rtl8185_write_phy(dev, adr, data);
+}
+
+void write_phy_cck(struct net_device *dev, u8 adr, u32 data)
+{
+	data = data & 0xff;
+	rtl8185_write_phy(dev, adr, data | 0x10000);
+}
+
+void rtl8185_set_rate(struct net_device *dev)
+{
+	int i;
+	u16 word;
+	int basic_rate, min_rr_rate, max_rr_rate;
+
+	basic_rate = ieeerate2rtlrate(240);
+	min_rr_rate = ieeerate2rtlrate(60);
+	max_rr_rate = ieeerate2rtlrate(240);
+
+	write_nic_byte(dev, RESP_RATE,
+		       max_rr_rate<<MAX_RESP_RATE_SHIFT |
+		       min_rr_rate<<MIN_RESP_RATE_SHIFT);
+
+	word  = read_nic_word(dev, BRSR);
+	word &= ~BRSR_MBR_8185;
+
+	for (i = 0; i <= basic_rate; i++)
+		word |= (1<<i);
+
+	write_nic_word(dev, BRSR, word);
+}
+
+void rtl8180_adapter_start(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	rtl8180_rtx_disable(dev);
+	rtl8180_reset(dev);
+
+	/* enable beacon timeout, beacon TX ok and err
+	 * LP tx ok and err, HP TX ok and err, NP TX ok and err,
+	 * RX ok and ERR, and GP timer
+	 */
+	priv->irq_mask = 0x6fcf;
+
+	priv->dma_poll_mask = 0;
+
+	rtl8180_beacon_tx_disable(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	write_nic_dword(dev, MAC0, ((u32 *)dev->dev_addr)[0]);
+	write_nic_word(dev, MAC4, ((u32 *)dev->dev_addr)[1] & 0xffff);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	rtl8180_update_msr(dev);
+
+	/* These might be unnecessary since we do in rx_enable / tx_enable */
+	fix_rx_fifo(dev);
+	fix_tx_fifo(dev);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+
+	/*
+	 * The following is very strange. seems to be that 1 means test mode,
+	 * but we need to acknolwledges the nic when a packet is ready
+	 * although we set it to 0
+	 */
+
+	write_nic_byte(dev,
+		       CONFIG2, read_nic_byte(dev, CONFIG2) & ~\
+		       (1<<CONFIG2_DMA_POLLING_MODE_SHIFT));
+	/* ^the nic isn't in test mode */
+	write_nic_byte(dev,
+		       CONFIG2, read_nic_byte(dev, CONFIG2)|(1<<4));
+
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	write_nic_dword(dev, INT_TIMEOUT, 0);
+
+	write_nic_byte(dev, WPA_CONFIG, 0);
+
+	rtl8180_no_hw_wep(dev);
+
+	rtl8185_set_rate(dev);
+	write_nic_byte(dev, RATE_FALLBACK, 0x81);
+
+	write_nic_byte(dev, GP_ENABLE, read_nic_byte(dev, GP_ENABLE) & ~(1<<6));
+
+	/* FIXME cfg 3 ClkRun enable - isn't it ReadOnly ? */
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	write_nic_byte(dev, CONFIG3, read_nic_byte(dev, CONFIG3)
+		       | (1 << CONFIG3_CLKRUN_SHIFT));
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	priv->rf_init(dev);
+
+	if (priv->rf_set_sens != NULL)
+		priv->rf_set_sens(dev, priv->sens);
+	rtl8180_irq_enable(dev);
+
+	netif_start_queue(dev);
+}
+
+/*
+ * This configures registers for beacon tx and enables it via
+ * rtl8180_beacon_tx_enable(). rtl8180_beacon_tx_disable() might
+ * be used to stop beacon transmission
+ */
+void rtl8180_start_tx_beacon(struct net_device *dev)
+{
+	u16 word;
+
+	DMESG("Enabling beacon TX");
+	rtl8180_prepare_beacon(dev);
+	rtl8180_irq_disable(dev);
+	rtl8180_beacon_tx_enable(dev);
+
+	word = read_nic_word(dev, AtimWnd) & ~AtimWnd_AtimWnd;
+	write_nic_word(dev, AtimWnd, word); /* word |= */
+
+	word  = read_nic_word(dev, BintrItv);
+	word &= ~BintrItv_BintrItv;
+	word |= 1000; /* priv->ieee80211->current_network.beacon_interval *
+		((priv->txbeaconcount > 1)?(priv->txbeaconcount-1):1);
+	// FIXME: check if correct ^^ worked with 0x3e8;
+	*/
+	write_nic_word(dev, BintrItv, word);
+
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	rtl8185b_irq_enable(dev);
+}
+
+static struct net_device_stats *rtl8180_stats(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	return &priv->ieee80211->stats;
+}
+
+/*
+ * Change current and default preamble mode.
+ */
+bool
+MgntActSet_802_11_PowerSaveMode(
+	struct r8180_priv *priv,
+	RT_PS_MODE		rtPsMode
+)
+{
+	/* Currently, we do not change power save mode on IBSS mode. */
+	if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+		return false;
+
+	priv->ieee80211->ps = rtPsMode;
+
+	return true;
+}
+
+void LeisurePSEnter(struct r8180_priv *priv)
+{
+	if (priv->bLeisurePs) {
+		if (priv->ieee80211->ps == IEEE80211_PS_DISABLED)
+			/* IEEE80211_PS_ENABLE */
+			MgntActSet_802_11_PowerSaveMode(priv, IEEE80211_PS_MBCAST|IEEE80211_PS_UNICAST);
+	}
+}
+
+void LeisurePSLeave(struct r8180_priv *priv)
+{
+	if (priv->bLeisurePs) {
+		if (priv->ieee80211->ps != IEEE80211_PS_DISABLED)
+			MgntActSet_802_11_PowerSaveMode(priv, IEEE80211_PS_DISABLED);
+	}
+}
+
+void rtl8180_hw_wakeup_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, hw_wakeup_wq);
+	struct net_device *dev = ieee->dev;
+
+	rtl8180_hw_wakeup(dev);
+}
+
+void rtl8180_hw_sleep_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, hw_sleep_wq);
+	struct net_device *dev = ieee->dev;
+
+	rtl8180_hw_sleep_down(dev);
+}
+
+static void MgntLinkKeepAlive(struct r8180_priv *priv)
+{
+	if (priv->keepAliveLevel == 0)
+		return;
+
+	if (priv->ieee80211->state == IEEE80211_LINKED) {
+		/*
+		 * Keep-Alive.
+		 */
+
+		if ((priv->keepAliveLevel == 2) ||
+			(priv->link_detect.LastNumTxUnicast == priv->NumTxUnicast &&
+			priv->link_detect.LastNumRxUnicast == priv->ieee80211->NumRxUnicast)
+			) {
+			priv->link_detect.IdleCount++;
+
+			/*
+			 * Send a Keep-Alive packet packet to AP if we had been idle for a while.
+			 */
+			if (priv->link_detect.IdleCount >= ((KEEP_ALIVE_INTERVAL / CHECK_FOR_HANG_PERIOD)-1)) {
+				priv->link_detect.IdleCount = 0;
+				ieee80211_sta_ps_send_null_frame(priv->ieee80211, false);
+			}
+		} else {
+			priv->link_detect.IdleCount = 0;
+		}
+		priv->link_detect.LastNumTxUnicast = priv->NumTxUnicast;
+		priv->link_detect.LastNumRxUnicast = priv->ieee80211->NumRxUnicast;
+	}
+}
+
+static u8 read_acadapter_file(char *filename);
+
+void rtl8180_watch_dog(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	bool bEnterPS = false;
+	bool bBusyTraffic = false;
+	u32 TotalRxNum = 0;
+	u16 SlotIndex = 0;
+	u16 i = 0;
+	if (priv->ieee80211->actscanning == false) {
+		if ((priv->ieee80211->iw_mode != IW_MODE_ADHOC) &&
+		    (priv->ieee80211->state == IEEE80211_NOLINK) &&
+		    (priv->ieee80211->beinretry == false) &&
+		    (priv->eRFPowerState == eRfOn))
+			IPSEnter(dev);
+	}
+	/* YJ,add,080828,for link state check */
+	if ((priv->ieee80211->state == IEEE80211_LINKED) && (priv->ieee80211->iw_mode == IW_MODE_INFRA)) {
+		SlotIndex = (priv->link_detect.SlotIndex++) % priv->link_detect.SlotNum;
+		priv->link_detect.RxFrameNum[SlotIndex] = priv->ieee80211->NumRxDataInPeriod + priv->ieee80211->NumRxBcnInPeriod;
+		for (i = 0; i < priv->link_detect.SlotNum; i++)
+			TotalRxNum += priv->link_detect.RxFrameNum[i];
+
+		if (TotalRxNum == 0) {
+			priv->ieee80211->state = IEEE80211_ASSOCIATING;
+			queue_work(priv->ieee80211->wq, &priv->ieee80211->associate_procedure_wq);
+		}
+	}
+
+	/* YJ,add,080828,for KeepAlive */
+	MgntLinkKeepAlive(priv);
+
+	/* YJ,add,080828,for LPS */
+	if (priv->PowerProfile == POWER_PROFILE_BATTERY)
+		priv->bLeisurePs = true;
+	else if (priv->PowerProfile == POWER_PROFILE_AC) {
+		LeisurePSLeave(priv);
+		priv->bLeisurePs = false;
+	}
+
+	if (priv->ieee80211->state == IEEE80211_LINKED) {
+		priv->link_detect.NumRxOkInPeriod = priv->ieee80211->NumRxDataInPeriod;
+		if (priv->link_detect.NumRxOkInPeriod > 666 ||
+			priv->link_detect.NumTxOkInPeriod > 666) {
+			bBusyTraffic = true;
+		}
+		if (((priv->link_detect.NumRxOkInPeriod + priv->link_detect.NumTxOkInPeriod) > 8)
+			|| (priv->link_detect.NumRxOkInPeriod > 2)) {
+			bEnterPS = false;
+		} else
+			bEnterPS = true;
+
+		if (bEnterPS)
+			LeisurePSEnter(priv);
+		else
+			LeisurePSLeave(priv);
+	} else
+		LeisurePSLeave(priv);
+	priv->link_detect.bBusyTraffic = bBusyTraffic;
+	priv->link_detect.NumRxOkInPeriod = 0;
+	priv->link_detect.NumTxOkInPeriod = 0;
+	priv->ieee80211->NumRxDataInPeriod = 0;
+	priv->ieee80211->NumRxBcnInPeriod = 0;
+}
+
+int _rtl8180_up(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	priv->up = 1;
+
+	DMESG("Bringing up iface");
+	rtl8185b_adapter_start(dev);
+	rtl8185b_rx_enable(dev);
+	rtl8185b_tx_enable(dev);
+	if (priv->bInactivePs) {
+		if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+			IPSLeave(dev);
+	}
+	timer_rate_adaptive((unsigned long)dev);
+	watch_dog_adaptive((unsigned long)dev);
+	if (priv->bSwAntennaDiverity)
+			SwAntennaDiversityTimerCallback(dev);
+	ieee80211_softmac_start_protocol(priv->ieee80211);
+	return 0;
+}
+
+int rtl8180_open(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	down(&priv->wx_sem);
+	ret = rtl8180_up(dev);
+	up(&priv->wx_sem);
+	return ret;
+}
+
+int rtl8180_up(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->up == 1)
+		return -1;
+
+	return _rtl8180_up(dev);
+}
+
+int rtl8180_close(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	down(&priv->wx_sem);
+	ret = rtl8180_down(dev);
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+int rtl8180_down(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->up == 0)
+		return -1;
+
+	priv->up = 0;
+
+	ieee80211_softmac_stop_protocol(priv->ieee80211);
+	/* FIXME */
+	if (!netif_queue_stopped(dev))
+		netif_stop_queue(dev);
+	rtl8180_rtx_disable(dev);
+	rtl8180_irq_disable(dev);
+	del_timer_sync(&priv->watch_dog_timer);
+	del_timer_sync(&priv->rateadapter_timer);
+	cancel_delayed_work(&priv->ieee80211->rate_adapter_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_wakeup_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_sleep_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_dig_wq);
+	cancel_delayed_work(&priv->ieee80211->tx_pw_wq);
+	del_timer_sync(&priv->SwAntennaDiversityTimer);
+	SetZebraRFPowerState8185(dev, eRfOff);
+	memset(&(priv->ieee80211->current_network), 0, sizeof(struct ieee80211_network));
+	priv->ieee80211->state = IEEE80211_NOLINK;
+	return 0;
+}
+
+void rtl8180_restart_wq(struct work_struct *work)
+{
+	struct r8180_priv *priv = container_of(work, struct r8180_priv, reset_wq);
+	struct net_device *dev = priv->dev;
+
+	down(&priv->wx_sem);
+
+	rtl8180_commit(dev);
+
+	up(&priv->wx_sem);
+}
+
+void rtl8180_restart(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	schedule_work(&priv->reset_wq);
+}
+
+void rtl8180_commit(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->up == 0)
+		return ;
+
+	del_timer_sync(&priv->watch_dog_timer);
+	del_timer_sync(&priv->rateadapter_timer);
+	cancel_delayed_work(&priv->ieee80211->rate_adapter_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_wakeup_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_sleep_wq);
+	cancel_delayed_work(&priv->ieee80211->hw_dig_wq);
+	cancel_delayed_work(&priv->ieee80211->tx_pw_wq);
+	del_timer_sync(&priv->SwAntennaDiversityTimer);
+	ieee80211_softmac_stop_protocol(priv->ieee80211);
+	rtl8180_irq_disable(dev);
+	rtl8180_rtx_disable(dev);
+	_rtl8180_up(dev);
+}
+
+static void r8180_set_multicast(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	short promisc;
+
+	promisc = (dev->flags & IFF_PROMISC) ? 1 : 0;
+
+	if (promisc != priv->promisc)
+		rtl8180_restart(dev);
+
+	priv->promisc = promisc;
+}
+
+int r8180_set_mac_adr(struct net_device *dev, void *mac)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct sockaddr *addr = mac;
+
+	down(&priv->wx_sem);
+
+	memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+
+	if (priv->ieee80211->iw_mode == IW_MODE_MASTER)
+		memcpy(priv->ieee80211->current_network.bssid, dev->dev_addr, ETH_ALEN);
+
+	if (priv->up) {
+		rtl8180_down(dev);
+		rtl8180_up(dev);
+	}
+
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+/* based on ipw2200 driver */
+int rtl8180_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct iwreq *wrq = (struct iwreq *) rq;
+	int ret = -1;
+
+	switch (cmd) {
+	case RTL_IOCTL_WPA_SUPPLICANT:
+		ret = ieee80211_wpa_supplicant_ioctl(priv->ieee80211, &wrq->u.data);
+		return ret;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return -EOPNOTSUPP;
+}
+
+static const struct net_device_ops rtl8180_netdev_ops = {
+	.ndo_open		= rtl8180_open,
+	.ndo_stop		= rtl8180_close,
+	.ndo_get_stats		= rtl8180_stats,
+	.ndo_tx_timeout		= rtl8180_restart,
+	.ndo_do_ioctl		= rtl8180_ioctl,
+	.ndo_set_rx_mode	= r8180_set_multicast,
+	.ndo_set_mac_address	= r8180_set_mac_adr,
+	.ndo_validate_addr	= eth_validate_addr,
+	.ndo_change_mtu		= eth_change_mtu,
+	.ndo_start_xmit		= ieee80211_rtl_xmit,
+};
+
+static int __devinit rtl8180_pci_probe(struct pci_dev *pdev,
+				       const struct pci_device_id *id)
+{
+	unsigned long ioaddr = 0;
+	struct net_device *dev = NULL;
+	struct r8180_priv *priv = NULL;
+	u8 unit = 0;
+	int ret = -ENODEV;
+
+	unsigned long pmem_start, pmem_len, pmem_flags;
+
+	DMESG("Configuring chip resources");
+
+	if (pci_enable_device(pdev)) {
+		DMESG("Failed to enable PCI device");
+		return -EIO;
+	}
+
+	pci_set_master(pdev);
+	pci_set_dma_mask(pdev, 0xffffff00ULL);
+	pci_set_consistent_dma_mask(pdev, 0xffffff00ULL);
+	dev = alloc_ieee80211(sizeof(struct r8180_priv));
+	if (!dev) {
+		ret = -ENOMEM;
+		goto fail_free;
+	}
+	priv = ieee80211_priv(dev);
+	priv->ieee80211 = netdev_priv(dev);
+
+	pci_set_drvdata(pdev, dev);
+	SET_NETDEV_DEV(dev, &pdev->dev);
+
+	priv = ieee80211_priv(dev);
+	priv->pdev = pdev;
+
+	pmem_start = pci_resource_start(pdev, 1);
+	pmem_len = pci_resource_len(pdev, 1);
+	pmem_flags = pci_resource_flags(pdev, 1);
+
+	if (!(pmem_flags & IORESOURCE_MEM)) {
+		DMESG("region #1 not a MMIO resource, aborting");
+		goto fail;
+	}
+
+	if (!request_mem_region(pmem_start, pmem_len, RTL8180_MODULE_NAME)) {
+		DMESG("request_mem_region failed!");
+		goto fail;
+	}
+
+	ioaddr = (unsigned long)ioremap_nocache(pmem_start, pmem_len);
+	if (ioaddr == (unsigned long)NULL) {
+		DMESG("ioremap failed!");
+		goto fail1;
+	}
+
+	dev->mem_start = ioaddr; /* shared mem start */
+	dev->mem_end = ioaddr + pci_resource_len(pdev, 0); /* shared mem end */
+
+	pci_read_config_byte(pdev, 0x05, &unit);
+	pci_write_config_byte(pdev, 0x05, unit & (~0x04));
+
+	dev->irq = pdev->irq;
+	priv->irq = 0;
+
+	dev->netdev_ops = &rtl8180_netdev_ops;
+	dev->wireless_handlers = &r8180_wx_handlers_def;
+
+	dev->type = ARPHRD_ETHER;
+	dev->watchdog_timeo = HZ*3;
+
+	if (dev_alloc_name(dev, ifname) < 0) {
+		DMESG("Oops: devname already taken! Trying wlan%%d...\n");
+		strcpy(ifname, "wlan%d");
+		dev_alloc_name(dev, ifname);
+	}
+
+	if (rtl8180_init(dev) != 0) {
+		DMESG("Initialization failed");
+		goto fail1;
+	}
+
+	netif_carrier_off(dev);
+
+	register_netdev(dev);
+
+	rtl8180_proc_init_one(dev);
+
+	DMESG("Driver probe completed\n");
+	return 0;
+fail1:
+	if (dev->mem_start != (unsigned long)NULL) {
+		iounmap((void *)dev->mem_start);
+		release_mem_region(pci_resource_start(pdev, 1),
+				   pci_resource_len(pdev, 1));
+	}
+fail:
+	if (dev) {
+		if (priv->irq) {
+			free_irq(dev->irq, dev);
+			dev->irq = 0;
+		}
+		free_ieee80211(dev);
+	}
+
+fail_free:
+	pci_disable_device(pdev);
+
+	DMESG("wlan driver load failed\n");
+	pci_set_drvdata(pdev, NULL);
+	return ret;
+}
+
+static void __devexit rtl8180_pci_remove(struct pci_dev *pdev)
+{
+	struct r8180_priv *priv;
+	struct net_device *dev = pci_get_drvdata(pdev);
+
+	if (dev) {
+		unregister_netdev(dev);
+
+		priv = ieee80211_priv(dev);
+
+		rtl8180_proc_remove_one(dev);
+		rtl8180_down(dev);
+		priv->rf_close(dev);
+		rtl8180_reset(dev);
+		mdelay(10);
+
+		if (priv->irq) {
+			DMESG("Freeing irq %d", dev->irq);
+			free_irq(dev->irq, dev);
+			priv->irq = 0;
+		}
+
+		free_rx_desc_ring(dev);
+		free_tx_desc_rings(dev);
+
+		if (dev->mem_start != (unsigned long)NULL) {
+			iounmap((void *)dev->mem_start);
+			release_mem_region(pci_resource_start(pdev, 1),
+					   pci_resource_len(pdev, 1));
+		}
+
+		free_ieee80211(dev);
+	}
+	pci_disable_device(pdev);
+
+	DMESG("wlan driver removed\n");
+}
+
+/* fun with the built-in ieee80211 stack... */
+extern int ieee80211_crypto_init(void);
+extern void ieee80211_crypto_deinit(void);
+extern int ieee80211_crypto_tkip_init(void);
+extern void ieee80211_crypto_tkip_exit(void);
+extern int ieee80211_crypto_ccmp_init(void);
+extern void ieee80211_crypto_ccmp_exit(void);
+extern int ieee80211_crypto_wep_init(void);
+extern void ieee80211_crypto_wep_exit(void);
+
+static int __init rtl8180_pci_module_init(void)
+{
+	int ret;
+
+	ret = ieee80211_crypto_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
+		return ret;
+	}
+	ret = ieee80211_crypto_tkip_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n", ret);
+		return ret;
+	}
+	ret = ieee80211_crypto_ccmp_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n", ret);
+		return ret;
+	}
+	ret = ieee80211_crypto_wep_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
+		return ret;
+	}
+
+	printk(KERN_INFO "\nLinux kernel driver for RTL8180 / RTL8185 based WLAN cards\n");
+	printk(KERN_INFO "Copyright (c) 2004-2005, Andrea Merello\n");
+	DMESG("Initializing module");
+	DMESG("Wireless extensions version %d", WIRELESS_EXT);
+	rtl8180_proc_module_init();
+
+	if (pci_register_driver(&rtl8180_pci_driver)) {
+		DMESG("No device found");
+		return -ENODEV;
+	}
+	return 0;
+}
+
+static void __exit rtl8180_pci_module_exit(void)
+{
+	pci_unregister_driver(&rtl8180_pci_driver);
+	rtl8180_proc_module_remove();
+	ieee80211_crypto_tkip_exit();
+	ieee80211_crypto_ccmp_exit();
+	ieee80211_crypto_wep_exit();
+	ieee80211_crypto_deinit();
+	DMESG("Exiting");
+}
+
+void rtl8180_try_wake_queue(struct net_device *dev, int pri)
+{
+	unsigned long flags;
+	short enough_desc;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	spin_lock_irqsave(&priv->tx_lock, flags);
+	enough_desc = check_nic_enought_desc(dev, pri);
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+	if (enough_desc)
+		ieee80211_rtl_wake_queue(priv->ieee80211);
+}
+
+void rtl8180_tx_isr(struct net_device *dev, int pri, short error)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u32 *tail; /* tail virtual addr */
+	u32 *head; /* head virtual addr */
+	u32 *begin; /* start of ring virtual addr */
+	u32 *nicv; /* nic pointer virtual addr */
+	u32 nic; /* nic pointer physical addr */
+	u32 nicbegin; /* start of ring physical addr */
+	unsigned long flag;
+	/* physical addr are ok on 32 bits since we set DMA mask */
+	int offs;
+	int j, i;
+	int hd;
+	if (error)
+		priv->stats.txretry++; /* tony 20060601 */
+	spin_lock_irqsave(&priv->tx_lock, flag);
+	switch (pri) {
+	case MANAGE_PRIORITY:
+		tail = priv->txmapringtail;
+		begin = priv->txmapring;
+		head = priv->txmapringhead;
+		nic = read_nic_dword(dev, TX_MANAGEPRIORITY_RING_ADDR);
+		nicbegin = priv->txmapringdma;
+		break;
+	case BK_PRIORITY:
+		tail = priv->txbkpringtail;
+		begin = priv->txbkpring;
+		head = priv->txbkpringhead;
+		nic = read_nic_dword(dev, TX_BKPRIORITY_RING_ADDR);
+		nicbegin = priv->txbkpringdma;
+		break;
+	case BE_PRIORITY:
+		tail = priv->txbepringtail;
+		begin = priv->txbepring;
+		head = priv->txbepringhead;
+		nic = read_nic_dword(dev, TX_BEPRIORITY_RING_ADDR);
+		nicbegin = priv->txbepringdma;
+		break;
+	case VI_PRIORITY:
+		tail = priv->txvipringtail;
+		begin = priv->txvipring;
+		head = priv->txvipringhead;
+		nic = read_nic_dword(dev, TX_VIPRIORITY_RING_ADDR);
+		nicbegin = priv->txvipringdma;
+		break;
+	case VO_PRIORITY:
+		tail = priv->txvopringtail;
+		begin = priv->txvopring;
+		head = priv->txvopringhead;
+		nic = read_nic_dword(dev, TX_VOPRIORITY_RING_ADDR);
+		nicbegin = priv->txvopringdma;
+		break;
+	case HI_PRIORITY:
+		tail = priv->txhpringtail;
+		begin = priv->txhpring;
+		head = priv->txhpringhead;
+		nic = read_nic_dword(dev, TX_HIGHPRIORITY_RING_ADDR);
+		nicbegin = priv->txhpringdma;
+		break;
+
+	default:
+		spin_unlock_irqrestore(&priv->tx_lock, flag);
+		return ;
+	}
+
+	nicv = (u32 *)((nic - nicbegin) + (u8*)begin);
+	if ((head <= tail && (nicv > tail || nicv < head)) ||
+		(head > tail && (nicv > tail && nicv < head))) {
+			DMESGW("nic has lost pointer");
+			spin_unlock_irqrestore(&priv->tx_lock, flag);
+			rtl8180_restart(dev);
+			return;
+		}
+
+	/*
+	 * We check all the descriptors between the head and the nic,
+	 * but not the currently pointed by the nic (the next to be txed)
+	 * and the previous of the pointed (might be in process ??)
+	 */
+	offs = (nic - nicbegin);
+	offs = offs / 8 / 4;
+	hd = (head - begin) / 8;
+
+	if (offs >= hd)
+		j = offs - hd;
+	else
+		j = offs + (priv->txringcount-1-hd);
+
+	j -= 2;
+	if (j < 0)
+		j = 0;
+
+	for (i = 0; i < j; i++) {
+		if ((*head) & (1<<31))
+			break;
+		if (((*head)&(0x10000000)) != 0) {
+			priv->CurrRetryCnt += (u16)((*head) & (0x000000ff));
+			if (!error)
+				priv->NumTxOkTotal++;
+		}
+
+		if (!error)
+			priv->NumTxOkBytesTotal += (*(head+3)) & (0x00000fff);
+
+		*head = *head & ~(1<<31);
+
+		if ((head - begin)/8 == priv->txringcount-1)
+			head = begin;
+		else
+			head += 8;
+	}
+
+	/*
+	 * The head has been moved to the last certainly TXed
+	 * (or at least processed by the nic) packet.
+	 * The driver take forcefully owning of all these packets
+	 * If the packet previous of the nic pointer has been
+	 * processed this doesn't matter: it will be checked
+	 * here at the next round. Anyway if no more packet are
+	 * TXed no memory leak occur at all.
+	 */
+
+	switch (pri) {
+	case MANAGE_PRIORITY:
+		priv->txmapringhead = head;
+
+		if (priv->ack_tx_to_ieee) {
+			if (rtl8180_is_tx_queue_empty(dev)) {
+				priv->ack_tx_to_ieee = 0;
+				ieee80211_ps_tx_ack(priv->ieee80211, !error);
+			}
+		}
+		break;
+	case BK_PRIORITY:
+		priv->txbkpringhead = head;
+		break;
+	case BE_PRIORITY:
+		priv->txbepringhead = head;
+		break;
+	case VI_PRIORITY:
+		priv->txvipringhead = head;
+		break;
+	case VO_PRIORITY:
+		priv->txvopringhead = head;
+		break;
+	case HI_PRIORITY:
+		priv->txhpringhead = head;
+		break;
+	}
+
+	spin_unlock_irqrestore(&priv->tx_lock, flag);
+}
+
+void rtl8180_tx_irq_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device * ieee = (struct ieee80211_device *)
+		container_of(dwork, struct ieee80211_device, watch_dog_wq);
+	struct net_device *dev = ieee->dev;
+
+	rtl8180_tx_isr(dev, MANAGE_PRIORITY, 0);
+}
+irqreturn_t rtl8180_interrupt(int irq, void *netdev, struct pt_regs *regs)
+{
+	struct net_device *dev = (struct net_device *) netdev;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	unsigned long flags;
+	u32 inta;
+
+	/* We should return IRQ_NONE, but for now let me keep this */
+	if (priv->irq_enabled == 0)
+		return IRQ_HANDLED;
+
+	spin_lock_irqsave(&priv->irq_th_lock, flags);
+
+	/* ISR: 4bytes */
+	inta = read_nic_dword(dev, ISR); /* & priv->IntrMask; */
+	write_nic_dword(dev, ISR, inta); /* reset int situation */
+
+	priv->stats.shints++;
+
+	if (!inta) {
+		spin_unlock_irqrestore(&priv->irq_th_lock, flags);
+		return IRQ_HANDLED;
+	/*
+	 * most probably we can safely return IRQ_NONE,
+	 * but for now is better to avoid problems
+	 */
+	}
+
+	if (inta == 0xffff) {
+		/* HW disappared */
+		spin_unlock_irqrestore(&priv->irq_th_lock, flags);
+		return IRQ_HANDLED;
+	}
+
+	priv->stats.ints++;
+
+	if (!netif_running(dev)) {
+		spin_unlock_irqrestore(&priv->irq_th_lock, flags);
+		return IRQ_HANDLED;
+	}
+
+	if (inta & ISR_TimeOut)
+		write_nic_dword(dev, TimerInt, 0);
+
+	if (inta & ISR_TBDOK)
+		priv->stats.txbeacon++;
+
+	if (inta & ISR_TBDER)
+		priv->stats.txbeaconerr++;
+
+	if (inta & IMR_TMGDOK)
+		rtl8180_tx_isr(dev, MANAGE_PRIORITY, 0);
+
+	if (inta & ISR_THPDER) {
+		priv->stats.txhperr++;
+		rtl8180_tx_isr(dev, HI_PRIORITY, 1);
+		priv->ieee80211->stats.tx_errors++;
+	}
+
+	if (inta & ISR_THPDOK) { /* High priority tx ok */
+		priv->link_detect.NumTxOkInPeriod++; /* YJ,add,080828 */
+		priv->stats.txhpokint++;
+		rtl8180_tx_isr(dev, HI_PRIORITY, 0);
+	}
+
+	if (inta & ISR_RER)
+		priv->stats.rxerr++;
+
+	if (inta & ISR_TBKDER) { /* corresponding to BK_PRIORITY */
+		priv->stats.txbkperr++;
+		priv->ieee80211->stats.tx_errors++;
+		rtl8180_tx_isr(dev, BK_PRIORITY, 1);
+		rtl8180_try_wake_queue(dev, BE_PRIORITY);
+	}
+
+	if (inta & ISR_TBEDER) { /* corresponding to BE_PRIORITY */
+		priv->stats.txbeperr++;
+		priv->ieee80211->stats.tx_errors++;
+		rtl8180_tx_isr(dev, BE_PRIORITY, 1);
+		rtl8180_try_wake_queue(dev, BE_PRIORITY);
+	}
+	if (inta & ISR_TNPDER) { /* corresponding to VO_PRIORITY */
+		priv->stats.txnperr++;
+		priv->ieee80211->stats.tx_errors++;
+		rtl8180_tx_isr(dev, NORM_PRIORITY, 1);
+		rtl8180_try_wake_queue(dev, NORM_PRIORITY);
+	}
+
+	if (inta & ISR_TLPDER) { /* corresponding to VI_PRIORITY */
+		priv->stats.txlperr++;
+		priv->ieee80211->stats.tx_errors++;
+		rtl8180_tx_isr(dev, LOW_PRIORITY, 1);
+		rtl8180_try_wake_queue(dev, LOW_PRIORITY);
+	}
+
+	if (inta & ISR_ROK) {
+		priv->stats.rxint++;
+		tasklet_schedule(&priv->irq_rx_tasklet);
+	}
+
+	if (inta & ISR_RQoSOK) {
+		priv->stats.rxint++;
+		tasklet_schedule(&priv->irq_rx_tasklet);
+	}
+
+	if (inta & ISR_BcnInt)
+		rtl8180_prepare_beacon(dev);
+
+	if (inta & ISR_RDU) {
+		DMESGW("No RX descriptor available");
+		priv->stats.rxrdu++;
+		tasklet_schedule(&priv->irq_rx_tasklet);
+	}
+
+	if (inta & ISR_RXFOVW) {
+		priv->stats.rxoverflow++;
+		tasklet_schedule(&priv->irq_rx_tasklet);
+	}
+
+	if (inta & ISR_TXFOVW)
+		priv->stats.txoverflow++;
+
+	if (inta & ISR_TNPDOK) { /* Normal priority tx ok */
+		priv->link_detect.NumTxOkInPeriod++; /* YJ,add,080828 */
+		priv->stats.txnpokint++;
+		rtl8180_tx_isr(dev, NORM_PRIORITY, 0);
+	}
+
+	if (inta & ISR_TLPDOK) { /* Low priority tx ok */
+		priv->link_detect.NumTxOkInPeriod++; /* YJ,add,080828 */
+		priv->stats.txlpokint++;
+		rtl8180_tx_isr(dev, LOW_PRIORITY, 0);
+		rtl8180_try_wake_queue(dev, LOW_PRIORITY);
+	}
+
+	if (inta & ISR_TBKDOK) { /* corresponding to BK_PRIORITY */
+		priv->stats.txbkpokint++;
+		priv->link_detect.NumTxOkInPeriod++; /* YJ,add,080828 */
+		rtl8180_tx_isr(dev, BK_PRIORITY, 0);
+		rtl8180_try_wake_queue(dev, BE_PRIORITY);
+	}
+
+	if (inta & ISR_TBEDOK) { /* corresponding to BE_PRIORITY */
+		priv->stats.txbeperr++;
+		priv->link_detect.NumTxOkInPeriod++; /* YJ,add,080828 */
+		rtl8180_tx_isr(dev, BE_PRIORITY, 0);
+		rtl8180_try_wake_queue(dev, BE_PRIORITY);
+	}
+	force_pci_posting(dev);
+	spin_unlock_irqrestore(&priv->irq_th_lock, flags);
+
+	return IRQ_HANDLED;
+}
+
+void rtl8180_irq_rx_tasklet(struct r8180_priv *priv)
+{
+	rtl8180_rx(priv->dev);
+}
+
+void GPIOChangeRFWorkItemCallBack(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, GPIOChangeRFWorkItem.work);
+	struct net_device *dev = ieee->dev;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 btPSR;
+	u8 btConfig0;
+	RT_RF_POWER_STATE	eRfPowerStateToSet;
+	bool bActuallySet = false;
+
+	char *argv[3];
+	static char *RadioPowerPath = "/etc/acpi/events/RadioPower.sh";
+	static char *envp[] = {"HOME=/", "TERM=linux", "PATH=/usr/bin:/bin", NULL};
+	static int readf_count = 0;
+
+	if (readf_count % 10 == 0)
+		priv->PowerProfile = read_acadapter_file("/proc/acpi/ac_adapter/AC0/state");
+
+	readf_count = (readf_count+1)%0xffff;
+	/* We should turn off LED before polling FF51[4]. */
+
+	/* Turn off LED. */
+	btPSR = read_nic_byte(dev, PSR);
+	write_nic_byte(dev, PSR, (btPSR & ~BIT3));
+
+	/* It need to delay 4us suggested by Jong, 2008-01-16 */
+	udelay(4);
+
+	/* HW radio On/Off according to the value of FF51[4](config0) */
+	btConfig0 = btPSR = read_nic_byte(dev, CONFIG0);
+
+	eRfPowerStateToSet = (btConfig0 & BIT4) ?  eRfOn : eRfOff;
+
+	/* Turn LED back on when radio enabled */
+	if (eRfPowerStateToSet == eRfOn)
+		write_nic_byte(dev, PSR, btPSR | BIT3);
+
+	if ((priv->ieee80211->bHwRadioOff == true) &&
+	   (eRfPowerStateToSet == eRfOn)) {
+		priv->ieee80211->bHwRadioOff = false;
+		bActuallySet = true;
+	} else if ((priv->ieee80211->bHwRadioOff == false) &&
+		  (eRfPowerStateToSet == eRfOff)) {
+		priv->ieee80211->bHwRadioOff = true;
+		bActuallySet = true;
+	}
+
+	if (bActuallySet) {
+		MgntActSet_RF_State(dev, eRfPowerStateToSet, RF_CHANGE_BY_HW);
+
+		/* To update the UI status for Power status changed */
+		if (priv->ieee80211->bHwRadioOff == true)
+			argv[1] = "RFOFF";
+		else
+			argv[1] = "RFON";
+		argv[0] = RadioPowerPath;
+		argv[2] = NULL;
+
+		call_usermodehelper(RadioPowerPath, argv, envp, UMH_WAIT_PROC);
+	}
+}
+
+static u8 read_acadapter_file(char *filename)
+{
+	return 0;
+}
+
+module_init(rtl8180_pci_module_init);
+module_exit(rtl8180_pci_module_exit);
diff --git a/drivers/staging/rtl8187se/r8180_dm.c b/drivers/staging/rtl8187se/r8180_dm.c
new file mode 100644
index 00000000..4d7a5951
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_dm.c
@@ -0,0 +1,1141 @@
+#include "r8180_dm.h"
+#include "r8180_hw.h"
+#include "r8180_93cx6.h"
+
+ /*	Return TRUE if we shall perform High Power Mecahnism, FALSE otherwise. */
+#define RATE_ADAPTIVE_TIMER_PERIOD      300
+
+bool CheckHighPower(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+
+	if(!priv->bRegHighPowerMechanism)
+		return false;
+
+	if(ieee->state == IEEE80211_LINKED_SCANNING)
+		return false;
+
+	return true;
+}
+
+/*
+ *	Description:
+ *		Update Tx power level if necessary.
+ *		See also DoRxHighPower() and SetTxPowerLevel8185() for reference.
+ *
+ *	Note:
+ *		The reason why we udpate Tx power level here instead of DoRxHighPower()
+ *		is the number of IO to change Tx power is much more than channel TR switch
+ *		and they are related to OFDM and MAC registers.
+ *		So, we don't want to update it so frequently in per-Rx packet base.
+ */
+void DoTxHighPower(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u16			HiPwrUpperTh = 0;
+	u16			HiPwrLowerTh = 0;
+	u8			RSSIHiPwrUpperTh;
+	u8			RSSIHiPwrLowerTh;
+	u8			u1bTmp;
+	char			OfdmTxPwrIdx, CckTxPwrIdx;
+
+	HiPwrUpperTh = priv->RegHiPwrUpperTh;
+	HiPwrLowerTh = priv->RegHiPwrLowerTh;
+
+	HiPwrUpperTh = HiPwrUpperTh * 10;
+	HiPwrLowerTh = HiPwrLowerTh * 10;
+	RSSIHiPwrUpperTh = priv->RegRSSIHiPwrUpperTh;
+	RSSIHiPwrLowerTh = priv->RegRSSIHiPwrLowerTh;
+
+	/* lzm add 080826 */
+	OfdmTxPwrIdx  = priv->chtxpwr_ofdm[priv->ieee80211->current_network.channel];
+	CckTxPwrIdx  = priv->chtxpwr[priv->ieee80211->current_network.channel];
+
+	if ((priv->UndecoratedSmoothedSS > HiPwrUpperTh) ||
+		(priv->bCurCCKPkt && (priv->CurCCKRSSI > RSSIHiPwrUpperTh))) {
+		/* Stevenl suggested that degrade 8dbm in high power sate. 2007-12-04 Isaiah */
+
+		priv->bToUpdateTxPwr = true;
+		u1bTmp= read_nic_byte(dev, CCK_TXAGC);
+
+		/* If it never enter High Power. */
+		if (CckTxPwrIdx == u1bTmp) {
+			u1bTmp = (u1bTmp > 16) ? (u1bTmp -16): 0;  /* 8dbm */
+			write_nic_byte(dev, CCK_TXAGC, u1bTmp);
+
+			u1bTmp= read_nic_byte(dev, OFDM_TXAGC);
+			u1bTmp = (u1bTmp > 16) ? (u1bTmp -16): 0;  /* 8dbm */
+			write_nic_byte(dev, OFDM_TXAGC, u1bTmp);
+		}
+
+	} else if ((priv->UndecoratedSmoothedSS < HiPwrLowerTh) &&
+		(!priv->bCurCCKPkt || priv->CurCCKRSSI < RSSIHiPwrLowerTh)) {
+		if (priv->bToUpdateTxPwr) {
+			priv->bToUpdateTxPwr = false;
+			/* SD3 required. */
+			u1bTmp= read_nic_byte(dev, CCK_TXAGC);
+			if (u1bTmp < CckTxPwrIdx) {
+				write_nic_byte(dev, CCK_TXAGC, CckTxPwrIdx);
+			}
+
+			u1bTmp= read_nic_byte(dev, OFDM_TXAGC);
+			if (u1bTmp < OfdmTxPwrIdx) {
+				write_nic_byte(dev, OFDM_TXAGC, OfdmTxPwrIdx);
+			}
+		}
+	}
+}
+
+
+/*
+ *	Description:
+ *		Callback function of UpdateTxPowerWorkItem.
+ *		Because of some event happened, e.g. CCX TPC, High Power Mechanism,
+ *		We update Tx power of current channel again.
+ */
+void rtl8180_tx_pw_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork,struct ieee80211_device,tx_pw_wq);
+	struct net_device *dev = ieee->dev;
+
+	DoTxHighPower(dev);
+}
+
+
+/*
+ *	Return TRUE if we shall perform DIG Mecahnism, FALSE otherwise.
+ */
+bool CheckDig(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+
+	if (!priv->bDigMechanism)
+		return false;
+
+	if (ieee->state != IEEE80211_LINKED)
+		return false;
+
+	if ((priv->ieee80211->rate / 5) < 36) /* Schedule Dig under all OFDM rates. By Bruce, 2007-06-01. */
+		return false;
+	return true;
+}
+/*
+ *	Implementation of DIG for Zebra and Zebra2.
+ */
+void DIG_Zebra(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u16			CCKFalseAlarm, OFDMFalseAlarm;
+	u16			OfdmFA1, OfdmFA2;
+	int			InitialGainStep = 7; /* The number of initial gain stages. */
+	int			LowestGainStage = 4; /* The capable lowest stage of performing dig workitem. */
+	u32			AwakePeriodIn2Sec = 0;
+
+	CCKFalseAlarm = (u16)(priv->FalseAlarmRegValue & 0x0000ffff);
+	OFDMFalseAlarm = (u16)((priv->FalseAlarmRegValue >> 16) & 0x0000ffff);
+	OfdmFA1 =  0x15;
+	OfdmFA2 = ((u16)(priv->RegDigOfdmFaUpTh)) << 8;
+
+	/* The number of initial gain steps is different, by Bruce, 2007-04-13. */
+	if (priv->InitialGain == 0) { /* autoDIG */
+		/* Advised from SD3 DZ */
+		priv->InitialGain = 4; /* In 87B, m74dBm means State 4 (m82dBm) */
+	}
+	/* Advised from SD3 DZ */
+	OfdmFA1 = 0x20;
+
+#if 1 /* lzm reserved 080826 */
+	AwakePeriodIn2Sec = (2000 - priv->DozePeriodInPast2Sec);
+	priv ->DozePeriodInPast2Sec = 0;
+
+	if (AwakePeriodIn2Sec) {
+		OfdmFA1 = (u16)((OfdmFA1 * AwakePeriodIn2Sec) / 2000) ;
+		OfdmFA2 = (u16)((OfdmFA2 * AwakePeriodIn2Sec) / 2000) ;
+	} else {
+		;
+	}
+#endif
+
+	InitialGainStep = 8;
+	LowestGainStage = priv->RegBModeGainStage; /* Lowest gain stage. */
+
+	if (OFDMFalseAlarm > OfdmFA1) {
+		if (OFDMFalseAlarm > OfdmFA2) {
+			priv->DIG_NumberFallbackVote++;
+			if (priv->DIG_NumberFallbackVote > 1) {
+				/* serious OFDM  False Alarm, need fallback */
+				if (priv->InitialGain < InitialGainStep) {
+					priv->InitialGainBackUp = priv->InitialGain;
+
+					priv->InitialGain = (priv->InitialGain + 1);
+					UpdateInitialGain(dev);
+				}
+				priv->DIG_NumberFallbackVote = 0;
+				priv->DIG_NumberUpgradeVote = 0;
+			}
+		} else {
+			if (priv->DIG_NumberFallbackVote)
+				priv->DIG_NumberFallbackVote--;
+		}
+		priv->DIG_NumberUpgradeVote = 0;
+	} else {
+		if (priv->DIG_NumberFallbackVote)
+			priv->DIG_NumberFallbackVote--;
+		priv->DIG_NumberUpgradeVote++;
+
+		if (priv->DIG_NumberUpgradeVote > 9) {
+			if (priv->InitialGain > LowestGainStage) { /* In 87B, m78dBm means State 4 (m864dBm) */
+				priv->InitialGainBackUp = priv->InitialGain;
+
+				priv->InitialGain = (priv->InitialGain - 1);
+				UpdateInitialGain(dev);
+			}
+			priv->DIG_NumberFallbackVote = 0;
+			priv->DIG_NumberUpgradeVote = 0;
+		}
+	}
+}
+
+/*
+ *	Dispatch DIG implementation according to RF.
+ */
+void DynamicInitGain(struct net_device *dev)
+{
+	DIG_Zebra(dev);
+}
+
+void rtl8180_hw_dig_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork,struct ieee80211_device,hw_dig_wq);
+	struct net_device *dev = ieee->dev;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	/* Read CCK and OFDM False Alarm. */
+	priv->FalseAlarmRegValue = read_nic_dword(dev, CCK_FALSE_ALARM);
+
+
+	/* Adjust Initial Gain dynamically. */
+	DynamicInitGain(dev);
+
+}
+
+int IncludedInSupportedRates(struct r8180_priv *priv, u8 TxRate)
+{
+	u8 rate_len;
+	u8 rate_ex_len;
+	u8                      RateMask = 0x7F;
+	u8                      idx;
+	unsigned short          Found = 0;
+	u8                      NaiveTxRate = TxRate&RateMask;
+
+	rate_len = priv->ieee80211->current_network.rates_len;
+	rate_ex_len = priv->ieee80211->current_network.rates_ex_len;
+	for (idx=0; idx < rate_len; idx++) {
+		if ((priv->ieee80211->current_network.rates[idx] & RateMask) == NaiveTxRate) {
+			Found = 1;
+			goto found_rate;
+		}
+	}
+	for (idx = 0; idx < rate_ex_len; idx++) {
+		if ((priv->ieee80211->current_network.rates_ex[idx] & RateMask) == NaiveTxRate) {
+			Found = 1;
+			goto found_rate;
+		}
+	}
+	return Found;
+	found_rate:
+	return Found;
+}
+
+/*
+ *	Get the Tx rate one degree up form the input rate in the supported rates.
+ *	Return the upgrade rate if it is successed, otherwise return the input rate.
+ */
+u8 GetUpgradeTxRate(struct net_device *dev, u8 rate)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8                      UpRate;
+
+	/* Upgrade 1 degree. */
+	switch (rate) {
+	case 108: /* Up to 54Mbps. */
+		UpRate = 108;
+		break;
+
+	case 96: /* Up to 54Mbps. */
+		UpRate = 108;
+		break;
+
+	case 72: /* Up to 48Mbps. */
+		UpRate = 96;
+		break;
+
+	case 48: /* Up to 36Mbps. */
+		UpRate = 72;
+		break;
+
+	case 36: /* Up to 24Mbps. */
+		UpRate = 48;
+		break;
+
+	case 22: /* Up to 18Mbps. */
+		UpRate = 36;
+		break;
+
+	case 11: /* Up to 11Mbps. */
+		UpRate = 22;
+		break;
+
+	case 4: /* Up to 5.5Mbps. */
+		UpRate = 11;
+		break;
+
+	case 2: /* Up to 2Mbps. */
+		UpRate = 4;
+		break;
+
+	default:
+		printk("GetUpgradeTxRate(): Input Tx Rate(%d) is undefined!\n", rate);
+		return rate;
+	}
+	/* Check if the rate is valid. */
+	if (IncludedInSupportedRates(priv, UpRate)) {
+		return UpRate;
+	} else {
+		return rate;
+	}
+	return rate;
+}
+/*
+ *	Get the Tx rate one degree down form the input rate in the supported rates.
+ *	Return the degrade rate if it is successed, otherwise return the input rate.
+ */
+
+u8 GetDegradeTxRate(struct net_device *dev, u8 rate)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8                      DownRate;
+
+	/* Upgrade 1 degree. */
+	switch (rate) {
+	case 108: /* Down to 48Mbps. */
+		DownRate = 96;
+		break;
+
+	case 96: /* Down to 36Mbps. */
+		DownRate = 72;
+		break;
+
+	case 72: /* Down to 24Mbps. */
+		DownRate = 48;
+		break;
+
+	case 48: /* Down to 18Mbps. */
+		DownRate = 36;
+		break;
+
+	case 36: /* Down to 11Mbps. */
+		DownRate = 22;
+		break;
+
+	case 22: /* Down to 5.5Mbps. */
+		DownRate = 11;
+		break;
+
+	case 11: /* Down to 2Mbps. */
+		DownRate = 4;
+		break;
+
+	case 4: /* Down to 1Mbps. */
+		DownRate = 2;
+		break;
+
+	case 2: /* Down to 1Mbps. */
+		DownRate = 2;
+		break;
+
+	default:
+		printk("GetDegradeTxRate(): Input Tx Rate(%d) is undefined!\n", rate);
+		return rate;
+	}
+	/* Check if the rate is valid. */
+	if (IncludedInSupportedRates(priv, DownRate)) {
+		return DownRate;
+	} else {
+		return rate;
+	}
+	return rate;
+}
+/*
+ *      Helper function to determine if specified data rate is
+ *      CCK rate.
+ */
+
+bool MgntIsCckRate(u16 rate)
+{
+	bool bReturn = false;
+
+	if ((rate <= 22) && (rate != 12) && (rate != 18)) {
+		bReturn = true;
+	}
+
+	return bReturn;
+}
+/*
+ *	Description:
+ *		Tx Power tracking mechanism routine on 87SE.
+ */
+void TxPwrTracking87SE(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u8	tmpu1Byte, CurrentThermal, Idx;
+	char	CckTxPwrIdx, OfdmTxPwrIdx;
+
+	tmpu1Byte = read_nic_byte(dev, EN_LPF_CAL);
+	CurrentThermal = (tmpu1Byte & 0xf0) >> 4; /*[ 7:4]: thermal meter indication. */
+	CurrentThermal = (CurrentThermal > 0x0c) ? 0x0c:CurrentThermal;/* lzm add 080826 */
+
+	if (CurrentThermal != priv->ThermalMeter) {
+		/* Update Tx Power level on each channel. */
+		for (Idx = 1; Idx < 15; Idx++) {
+			CckTxPwrIdx = priv->chtxpwr[Idx];
+			OfdmTxPwrIdx = priv->chtxpwr_ofdm[Idx];
+
+			if (CurrentThermal > priv->ThermalMeter) {
+				/* higher thermal meter. */
+				CckTxPwrIdx += (CurrentThermal - priv->ThermalMeter) * 2;
+				OfdmTxPwrIdx += (CurrentThermal - priv->ThermalMeter) * 2;
+
+				if (CckTxPwrIdx > 35)
+					CckTxPwrIdx = 35; /* Force TxPower to maximal index. */
+				if (OfdmTxPwrIdx > 35)
+					OfdmTxPwrIdx = 35;
+			} else {
+				/* lower thermal meter. */
+				CckTxPwrIdx -= (priv->ThermalMeter - CurrentThermal) * 2;
+				OfdmTxPwrIdx -= (priv->ThermalMeter - CurrentThermal) * 2;
+
+				if (CckTxPwrIdx < 0)
+					CckTxPwrIdx = 0;
+				if (OfdmTxPwrIdx < 0)
+					OfdmTxPwrIdx = 0;
+			}
+
+			/* Update TxPower level on CCK and OFDM resp. */
+			priv->chtxpwr[Idx] = CckTxPwrIdx;
+			priv->chtxpwr_ofdm[Idx] = OfdmTxPwrIdx;
+		}
+
+		/* Update TxPower level immediately. */
+		rtl8225z2_SetTXPowerLevel(dev, priv->ieee80211->current_network.channel);
+	}
+	priv->ThermalMeter = CurrentThermal;
+}
+void StaRateAdaptive87SE(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	unsigned long	CurrTxokCnt;
+	u16		CurrRetryCnt;
+	u16		CurrRetryRate;
+	unsigned long	CurrRxokCnt;
+	bool		bTryUp = false;
+	bool		bTryDown = false;
+	u8		TryUpTh = 1;
+	u8		TryDownTh = 2;
+	u32		TxThroughput;
+	long		CurrSignalStrength;
+	bool		bUpdateInitialGain = false;
+	u8		u1bOfdm = 0, u1bCck = 0;
+	char		OfdmTxPwrIdx, CckTxPwrIdx;
+
+	priv->RateAdaptivePeriod = RATE_ADAPTIVE_TIMER_PERIOD;
+
+
+	CurrRetryCnt	= priv->CurrRetryCnt;
+	CurrTxokCnt	= priv->NumTxOkTotal - priv->LastTxokCnt;
+	CurrRxokCnt	= priv->ieee80211->NumRxOkTotal - priv->LastRxokCnt;
+	CurrSignalStrength = priv->Stats_RecvSignalPower;
+	TxThroughput = (u32)(priv->NumTxOkBytesTotal - priv->LastTxOKBytes);
+	priv->LastTxOKBytes = priv->NumTxOkBytesTotal;
+	priv->CurrentOperaRate = priv->ieee80211->rate / 5;
+	/* 2 Compute retry ratio. */
+	if (CurrTxokCnt > 0) {
+		CurrRetryRate = (u16)(CurrRetryCnt * 100 / CurrTxokCnt);
+	} else {
+	/* It may be serious retry. To distinguish serious retry or no packets modified by Bruce */
+		CurrRetryRate = (u16)(CurrRetryCnt * 100 / 1);
+	}
+
+	priv->LastRetryCnt = priv->CurrRetryCnt;
+	priv->LastTxokCnt = priv->NumTxOkTotal;
+	priv->LastRxokCnt = priv->ieee80211->NumRxOkTotal;
+	priv->CurrRetryCnt = 0;
+
+	/* 2No Tx packets, return to init_rate or not? */
+	if (CurrRetryRate == 0 && CurrTxokCnt == 0) {
+		/*
+		 * After 9 (30*300ms) seconds in this condition, we try to raise rate.
+		 */
+		priv->TryupingCountNoData++;
+
+		/* [TRC Dell Lab] Extend raised period from 4.5sec to 9sec, Isaiah 2008-02-15 18:00 */
+		if (priv->TryupingCountNoData > 30) {
+			priv->TryupingCountNoData = 0;
+			priv->CurrentOperaRate = GetUpgradeTxRate(dev, priv->CurrentOperaRate);
+			/* Reset Fail Record */
+			priv->LastFailTxRate = 0;
+			priv->LastFailTxRateSS = -200;
+			priv->FailTxRateCount = 0;
+		}
+		goto SetInitialGain;
+	} else {
+		priv->TryupingCountNoData = 0; /*Reset trying up times. */
+	}
+
+
+	/*
+	 * For Netgear case, I comment out the following signal strength estimation,
+	 * which can results in lower rate to transmit when sample is NOT enough (e.g. PING request).
+	 *
+	 * Restructure rate adaptive as the following main stages:
+	 * (1) Add retry threshold in 54M upgrading condition with signal strength.
+	 * (2) Add the mechanism to degrade to CCK rate according to signal strength
+	 *		and retry rate.
+	 * (3) Remove all Initial Gain Updates over OFDM rate. To avoid the complicated
+	 *		situation, Initial Gain Update is upon on DIG mechanism except CCK rate.
+	 * (4) Add the mehanism of trying to upgrade tx rate.
+	 * (5) Record the information of upping tx rate to avoid trying upping tx rate constantly.
+	 *
+	 */
+
+	/*
+ 	 *  11Mbps or 36Mbps
+	 * Check more times in these rate(key rates).
+	 */
+	if (priv->CurrentOperaRate == 22 || priv->CurrentOperaRate == 72)
+		TryUpTh += 9;
+	/*
+	 * Let these rates down more difficult.
+	 */
+	if (MgntIsCckRate(priv->CurrentOperaRate) || priv->CurrentOperaRate == 36)
+		TryDownTh += 1;
+
+	/* 1 Adjust Rate. */
+	if (priv->bTryuping == true) {
+		/* 2 For Test Upgrading mechanism
+		 * Note:
+		 *	Sometimes the throughput is upon on the capability bwtween the AP and NIC,
+		 *	thus the low data rate does not improve the performance.
+		 *	We randomly upgrade the data rate and check if the retry rate is improved.
+		 */
+
+		/* Upgrading rate did not improve the retry rate, fallback to the original rate. */
+		if ((CurrRetryRate > 25) && TxThroughput < priv->LastTxThroughput) {
+			/*Not necessary raising rate, fall back rate. */
+			bTryDown = true;
+		} else {
+			priv->bTryuping = false;
+		}
+	} else if (CurrSignalStrength > -47 && (CurrRetryRate < 50)) {
+		/*
+ 		 * 2For High Power
+		 *
+		 * Return to highest data rate, if signal strength is good enough.
+		 * SignalStrength threshold(-50dbm) is for RTL8186.
+		 * Revise SignalStrength threshold to -51dbm.
+		 */
+		/* Also need to check retry rate for safety, by Bruce, 2007-06-05. */
+		if (priv->CurrentOperaRate != priv->ieee80211->current_network.HighestOperaRate) {
+			bTryUp = true;
+			/* Upgrade Tx Rate directly. */
+			priv->TryupingCount += TryUpTh;
+		}
+
+	} else if (CurrTxokCnt > 9 && CurrTxokCnt < 100 && CurrRetryRate >= 600) {
+		/*
+		 *2 For Serious Retry
+		 *
+		 * Traffic is not busy but our Tx retry is serious.
+		 */
+		bTryDown = true;
+		/* Let Rate Mechanism to degrade tx rate directly. */
+		priv->TryDownCountLowData += TryDownTh;
+	} else if (priv->CurrentOperaRate == 108) {
+		/* 2For 54Mbps */
+		/* Air Link */
+		if ((CurrRetryRate > 26) && (priv->LastRetryRate > 25)) {
+			bTryDown = true;
+		}
+		/* Cable Link */
+		else if ((CurrRetryRate > 17) && (priv->LastRetryRate > 16) && (CurrSignalStrength > -72)) {
+			bTryDown = true;
+		}
+
+		if (bTryDown && (CurrSignalStrength < -75)) /* cable link */
+			priv->TryDownCountLowData += TryDownTh;
+	}
+	else if (priv->CurrentOperaRate == 96) {
+		/* 2For 48Mbps */
+		/* Air Link */
+		if (((CurrRetryRate > 48) && (priv->LastRetryRate > 47))) {
+			bTryDown = true;
+		} else if (((CurrRetryRate > 21) && (priv->LastRetryRate > 20)) && (CurrSignalStrength > -74)) { /* Cable Link */
+			/* Down to rate 36Mbps. */
+			bTryDown = true;
+		} else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
+			bTryDown = true;
+			priv->TryDownCountLowData += TryDownTh;
+		} else if ((CurrRetryRate < 8) && (priv->LastRetryRate < 8)) { /* TO DO: need to consider (RSSI) */
+			bTryUp = true;
+		}
+
+		if (bTryDown && (CurrSignalStrength < -75)){
+			priv->TryDownCountLowData += TryDownTh;
+		}
+	} else if (priv->CurrentOperaRate == 72) {
+		/* 2For 36Mbps */
+		if ((CurrRetryRate > 43) && (priv->LastRetryRate > 41)) {
+			/* Down to rate 24Mbps. */
+			bTryDown = true;
+		} else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
+			bTryDown = true;
+			priv->TryDownCountLowData += TryDownTh;
+		} else if ((CurrRetryRate < 15) &&  (priv->LastRetryRate < 16)) { /* TO DO: need to consider (RSSI) */
+			bTryUp = true;
+		}
+
+		if (bTryDown && (CurrSignalStrength < -80))
+			priv->TryDownCountLowData += TryDownTh;
+
+	} else if (priv->CurrentOperaRate == 48) {
+		/* 2For 24Mbps */
+		/* Air Link */
+		if (((CurrRetryRate > 63) && (priv->LastRetryRate > 62))) {
+			bTryDown = true;
+		} else if (((CurrRetryRate > 33) && (priv->LastRetryRate > 32)) && (CurrSignalStrength > -82)) { /* Cable Link */
+			bTryDown = true;
+		} else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2 )) {
+			bTryDown = true;
+			priv->TryDownCountLowData += TryDownTh;
+		} else if ((CurrRetryRate < 20) && (priv->LastRetryRate < 21)) { /* TO DO: need to consider (RSSI) */
+			bTryUp = true;
+		}
+
+		if (bTryDown && (CurrSignalStrength < -82))
+			priv->TryDownCountLowData += TryDownTh;
+
+	} else if (priv->CurrentOperaRate == 36) {
+		if (((CurrRetryRate > 85) && (priv->LastRetryRate > 86))) {
+			bTryDown = true;
+		} else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
+			bTryDown = true;
+			priv->TryDownCountLowData += TryDownTh;
+		} else if ((CurrRetryRate < 22) && (priv->LastRetryRate < 23)) { /* TO DO: need to consider (RSSI) */
+			bTryUp = true;
+		}
+	} else if (priv->CurrentOperaRate == 22) {
+		/* 2For 11Mbps */
+		if (CurrRetryRate > 95) {
+			bTryDown = true;
+		}
+		else if ((CurrRetryRate < 29) && (priv->LastRetryRate < 30)) { /*TO DO: need to consider (RSSI) */
+			bTryUp = true;
+		}
+	} else if (priv->CurrentOperaRate == 11) {
+		/* 2For 5.5Mbps */
+		if (CurrRetryRate > 149) {
+			bTryDown = true;
+		} else if ((CurrRetryRate < 60) && (priv->LastRetryRate < 65)) {
+			bTryUp = true;
+		}
+	} else if (priv->CurrentOperaRate == 4) {
+		/* 2For 2 Mbps */
+		if ((CurrRetryRate > 99) && (priv->LastRetryRate > 99)) {
+			bTryDown = true;
+		} else if ((CurrRetryRate < 65) && (priv->LastRetryRate < 70)) {
+			bTryUp = true;
+		}
+	} else if (priv->CurrentOperaRate == 2) {
+		/* 2For 1 Mbps */
+		if ((CurrRetryRate < 70) && (priv->LastRetryRate < 75)) {
+			bTryUp = true;
+		}
+	}
+
+	if (bTryUp && bTryDown)
+	printk("StaRateAdaptive87B(): Tx Rate tried upping and downing simultaneously!\n");
+
+	/* 1 Test Upgrading Tx Rate
+	 * Sometimes the cause of the low throughput (high retry rate) is the compatibility between the AP and NIC.
+	 * To test if the upper rate may cause lower retry rate, this mechanism randomly occurs to test upgrading tx rate.
+	 */ 
+	if (!bTryUp && !bTryDown && (priv->TryupingCount == 0) && (priv->TryDownCountLowData == 0)
+		&& priv->CurrentOperaRate != priv->ieee80211->current_network.HighestOperaRate && priv->FailTxRateCount < 2) {
+		if (jiffies % (CurrRetryRate + 101) == 0) {
+			bTryUp = true;
+			priv->bTryuping = true;
+		}
+	}
+
+	/* 1 Rate Mechanism */
+	if (bTryUp) {
+		priv->TryupingCount++;
+		priv->TryDownCountLowData = 0;
+
+		/*
+		 * Check more times if we need to upgrade indeed.
+		 * Because the largest value of pHalData->TryupingCount is 0xFFFF and
+		 * the largest value of pHalData->FailTxRateCount is 0x14,
+		 * this condition will be satisfied at most every 2 min.
+		 */
+
+		if ((priv->TryupingCount > (TryUpTh + priv->FailTxRateCount * priv->FailTxRateCount)) ||
+			(CurrSignalStrength > priv->LastFailTxRateSS) || priv->bTryuping) {
+			priv->TryupingCount = 0;
+			/*
+			 * When transferring from CCK to OFDM, DIG is an important issue.
+			 */
+			if (priv->CurrentOperaRate == 22)
+				bUpdateInitialGain = true;
+
+			/* 
+			 * The difference in throughput between 48Mbps and 36Mbps is 8M.
+			 * So, we must be carefully in this rate scale. Isaiah 2008-02-15.
+			 */
+			if (((priv->CurrentOperaRate == 72) || (priv->CurrentOperaRate == 48) || (priv->CurrentOperaRate == 36)) &&
+				(priv->FailTxRateCount > 2))
+				priv->RateAdaptivePeriod = (RATE_ADAPTIVE_TIMER_PERIOD / 2);
+
+			/* (1)To avoid upgrade frequently to the fail tx rate, add the FailTxRateCount into the threshold. */
+			/* (2)If the signal strength is increased, it may be able to upgrade. */
+
+			priv->CurrentOperaRate = GetUpgradeTxRate(dev, priv->CurrentOperaRate);
+
+			if (priv->CurrentOperaRate == 36) {
+				priv->bUpdateARFR = true;
+				write_nic_word(dev, ARFR, 0x0F8F); /* bypass 12/9/6 */
+			} else if(priv->bUpdateARFR) {
+				priv->bUpdateARFR = false;
+				write_nic_word(dev, ARFR, 0x0FFF); /* set 1M ~ 54Mbps. */
+			}
+
+			/* Update Fail Tx rate and count. */
+			if (priv->LastFailTxRate != priv->CurrentOperaRate) {
+				priv->LastFailTxRate = priv->CurrentOperaRate;
+				priv->FailTxRateCount = 0;
+				priv->LastFailTxRateSS = -200; /* Set lowest power. */
+			}
+		}
+	} else {
+		if (priv->TryupingCount > 0)
+			priv->TryupingCount --;
+	}
+
+	if (bTryDown) {
+		priv->TryDownCountLowData++;
+		priv->TryupingCount = 0;
+
+		/* Check if Tx rate can be degraded or Test trying upgrading should fallback. */
+		if (priv->TryDownCountLowData > TryDownTh || priv->bTryuping) {
+			priv->TryDownCountLowData = 0;
+			priv->bTryuping = false;
+			/* Update fail information. */
+			if (priv->LastFailTxRate == priv->CurrentOperaRate) {
+				priv->FailTxRateCount++;
+				/* Record the Tx fail rate signal strength. */
+				if (CurrSignalStrength > priv->LastFailTxRateSS)
+					priv->LastFailTxRateSS = CurrSignalStrength;
+			} else {
+				priv->LastFailTxRate = priv->CurrentOperaRate;
+				priv->FailTxRateCount = 1;
+				priv->LastFailTxRateSS = CurrSignalStrength;
+			}
+			priv->CurrentOperaRate = GetDegradeTxRate(dev, priv->CurrentOperaRate);
+
+			/* Reduce chariot training time at weak signal strength situation. SD3 ED demand. */
+			if ((CurrSignalStrength < -80) && (priv->CurrentOperaRate > 72 )) {
+				priv->CurrentOperaRate = 72;
+			}
+
+			if (priv->CurrentOperaRate == 36) {
+				priv->bUpdateARFR = true;
+				write_nic_word(dev, ARFR, 0x0F8F); /* bypass 12/9/6 */
+			} else if (priv->bUpdateARFR) {
+				priv->bUpdateARFR = false;
+				write_nic_word(dev, ARFR, 0x0FFF); /* set 1M ~ 54Mbps. */
+			}
+
+			/*
+			 * When it is CCK rate, it may need to update initial gain to receive lower power packets.
+			 */
+			if (MgntIsCckRate(priv->CurrentOperaRate)) {
+				bUpdateInitialGain = true;
+			}
+		}
+	} else {
+		if (priv->TryDownCountLowData > 0)
+			priv->TryDownCountLowData--;
+	}
+
+	/* 
+ 	 * Keep the Tx fail rate count to equal to 0x15 at most. 
+	 * Reduce the fail count at least to 10 sec if tx rate is tending stable.
+	 */
+	if (priv->FailTxRateCount >= 0x15 ||
+		(!bTryUp && !bTryDown && priv->TryDownCountLowData == 0 && priv->TryupingCount && priv->FailTxRateCount > 0x6)) {
+		priv->FailTxRateCount--;
+	}
+
+
+	OfdmTxPwrIdx  = priv->chtxpwr_ofdm[priv->ieee80211->current_network.channel];
+	CckTxPwrIdx  = priv->chtxpwr[priv->ieee80211->current_network.channel];
+
+	/* Mac0x9e increase 2 level in 36M~18M situation */
+	if ((priv->CurrentOperaRate < 96) && (priv->CurrentOperaRate > 22)) {
+		u1bCck = read_nic_byte(dev, CCK_TXAGC);
+		u1bOfdm = read_nic_byte(dev, OFDM_TXAGC);
+
+		/* case 1: Never enter High power */
+		if (u1bCck == CckTxPwrIdx) {
+			if (u1bOfdm != (OfdmTxPwrIdx + 2)) {
+			priv->bEnhanceTxPwr = true;
+			u1bOfdm = ((u1bOfdm + 2) > 35) ? 35: (u1bOfdm + 2);
+			write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
+			}
+		} else if (u1bCck < CckTxPwrIdx) {
+		/* case 2: enter high power */
+			if (!priv->bEnhanceTxPwr) {
+				priv->bEnhanceTxPwr = true;
+				u1bOfdm = ((u1bOfdm + 2) > 35) ? 35: (u1bOfdm + 2);
+				write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
+			}
+		}
+	} else if (priv->bEnhanceTxPwr) {  /* 54/48/11/5.5/2/1 */
+		u1bCck = read_nic_byte(dev, CCK_TXAGC);
+		u1bOfdm = read_nic_byte(dev, OFDM_TXAGC);
+
+		/* case 1: Never enter High power */
+		if (u1bCck == CckTxPwrIdx) {
+			priv->bEnhanceTxPwr = false;
+			write_nic_byte(dev, OFDM_TXAGC, OfdmTxPwrIdx);
+		}
+		/* case 2: enter high power */
+		else if (u1bCck < CckTxPwrIdx) {
+			priv->bEnhanceTxPwr = false;
+			u1bOfdm = ((u1bOfdm - 2) > 0) ? (u1bOfdm - 2): 0;
+			write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
+		}
+	}
+
+	/*
+	 * We need update initial gain when we set tx rate "from OFDM to CCK" or
+	 * "from CCK to OFDM".
+	 */
+SetInitialGain:
+	if (bUpdateInitialGain) {
+		if (MgntIsCckRate(priv->CurrentOperaRate)) { /* CCK */
+			if (priv->InitialGain > priv->RegBModeGainStage) {
+				priv->InitialGainBackUp = priv->InitialGain;
+
+				if (CurrSignalStrength < -85) /* Low power, OFDM [0x17] = 26. */
+					/* SD3 SYs suggest that CurrSignalStrength < -65, ofdm 0x17=26. */
+					priv->InitialGain = priv->RegBModeGainStage;
+
+				else if (priv->InitialGain > priv->RegBModeGainStage + 1)
+					priv->InitialGain -= 2;
+
+				else
+					priv->InitialGain--;
+
+				printk("StaRateAdaptive87SE(): update init_gain to index %d for date rate %d\n",priv->InitialGain, priv->CurrentOperaRate);
+				UpdateInitialGain(dev);
+			}
+		} else { /* OFDM */
+			if (priv->InitialGain < 4) {
+				priv->InitialGainBackUp = priv->InitialGain;
+
+				priv->InitialGain++;
+				printk("StaRateAdaptive87SE(): update init_gain to index %d for date rate %d\n",priv->InitialGain, priv->CurrentOperaRate);
+				UpdateInitialGain(dev);
+			}
+		}
+	}
+
+	/* Record the related info */
+	priv->LastRetryRate = CurrRetryRate;
+	priv->LastTxThroughput = TxThroughput;
+	priv->ieee80211->rate = priv->CurrentOperaRate * 5;
+}
+
+void rtl8180_rate_adapter(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, rate_adapter_wq);
+	struct net_device *dev = ieee->dev;
+	StaRateAdaptive87SE(dev);
+}
+void timer_rate_adaptive(unsigned long data)
+{
+	struct r8180_priv *priv = ieee80211_priv((struct net_device *)data);
+	if (!priv->up) {
+		return;
+	}
+	if ((priv->ieee80211->iw_mode != IW_MODE_MASTER)
+			&& (priv->ieee80211->state == IEEE80211_LINKED) &&
+			(priv->ForcedDataRate == 0)) {
+		queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->rate_adapter_wq);
+	}
+	priv->rateadapter_timer.expires = jiffies + MSECS(priv->RateAdaptivePeriod);
+	add_timer(&priv->rateadapter_timer);
+}
+
+void SwAntennaDiversityRxOk8185(struct net_device *dev, u8 SignalStrength)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	priv->AdRxOkCnt++;
+
+	if (priv->AdRxSignalStrength != -1) {
+		priv->AdRxSignalStrength = ((priv->AdRxSignalStrength * 7) + (SignalStrength * 3)) / 10;
+	} else { /* Initialization case. */
+		priv->AdRxSignalStrength = SignalStrength;
+	}
+	
+	if (priv->LastRxPktAntenna) /* Main antenna. */
+		priv->AdMainAntennaRxOkCnt++;
+	else	 /* Aux antenna. */
+		priv->AdAuxAntennaRxOkCnt++;
+}
+ /*	Change Antenna Switch. */
+bool SetAntenna8185(struct net_device *dev, u8 u1bAntennaIndex)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	bool bAntennaSwitched = false;
+
+	switch (u1bAntennaIndex) {
+	case 0:
+		/* Mac register, main antenna */
+		write_nic_byte(dev, ANTSEL, 0x03);
+		/* base band */
+		write_phy_cck(dev, 0x11, 0x9b); /* Config CCK RX antenna. */
+		write_phy_ofdm(dev, 0x0d, 0x5c); /* Config OFDM RX antenna. */
+
+		bAntennaSwitched = true;
+		break;
+
+	case 1:
+		/* Mac register, aux antenna */
+		write_nic_byte(dev, ANTSEL, 0x00);
+		/* base band */
+		write_phy_cck(dev, 0x11, 0xbb); /* Config CCK RX antenna. */
+		write_phy_ofdm(dev, 0x0d, 0x54); /* Config OFDM RX antenna. */
+
+		bAntennaSwitched = true;
+
+		break;
+
+	default:
+		printk("SetAntenna8185: unknown u1bAntennaIndex(%d)\n", u1bAntennaIndex);
+		break;
+	}
+
+	if(bAntennaSwitched)
+		priv->CurrAntennaIndex = u1bAntennaIndex;
+
+	return bAntennaSwitched;
+}
+ /*	Toggle Antenna switch. */
+bool SwitchAntenna(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	bool		bResult;
+
+	if (priv->CurrAntennaIndex == 0) {
+		bResult = SetAntenna8185(dev, 1);
+	} else {
+		bResult = SetAntenna8185(dev, 0);
+	}
+
+	return bResult;
+}
+/*
+ * Engine of SW Antenna Diversity mechanism.
+ * Since 8187 has no Tx part information,
+ * this implementation is only dependend on Rx part information.
+ */
+void SwAntennaDiversity(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	bool   bSwCheckSS = false;
+	if (bSwCheckSS) {
+		priv->AdTickCount++;
+
+		printk("(1) AdTickCount: %d, AdCheckPeriod: %d\n",
+			priv->AdTickCount, priv->AdCheckPeriod);
+		printk("(2) AdRxSignalStrength: %ld, AdRxSsThreshold: %ld\n",
+			priv->AdRxSignalStrength, priv->AdRxSsThreshold);
+	}
+
+	/* Case 1. No Link. */
+	if (priv->ieee80211->state != IEEE80211_LINKED) {
+		priv->bAdSwitchedChecking = false;
+		/* I switch antenna here to prevent any one of antenna is broken before link established, 2006.04.18, by rcnjko.. */
+		SwitchAntenna(dev);
+
+	  /* Case 2. Linked but no packet receive.d */
+	} else if (priv->AdRxOkCnt == 0) {
+		priv->bAdSwitchedChecking = false;
+		SwitchAntenna(dev);
+
+	  /* Case 3. Evaluate last antenna switch action and undo it if necessary. */
+	} else if (priv->bAdSwitchedChecking == true) {
+		priv->bAdSwitchedChecking = false;
+
+		/* Adjust Rx signal strength threshold. */
+		priv->AdRxSsThreshold = (priv->AdRxSignalStrength + priv->AdRxSsBeforeSwitched) / 2;
+
+		priv->AdRxSsThreshold = (priv->AdRxSsThreshold > priv->AdMaxRxSsThreshold) ?
+					priv->AdMaxRxSsThreshold: priv->AdRxSsThreshold;
+		if(priv->AdRxSignalStrength < priv->AdRxSsBeforeSwitched) {
+		/* Rx signal strength is not improved after we swtiched antenna. => Swich back. */
+			/* Increase Antenna Diversity checking period due to bad decision. */
+			priv->AdCheckPeriod *= 2;
+			/* Increase Antenna Diversity checking period. */
+			if (priv->AdCheckPeriod > priv->AdMaxCheckPeriod)
+				priv->AdCheckPeriod = priv->AdMaxCheckPeriod;
+
+			/* Wrong deceision => switch back. */
+			SwitchAntenna(dev);
+		} else {
+		/* Rx Signal Strength is improved. */
+
+			/* Reset Antenna Diversity checking period to its min value. */
+			priv->AdCheckPeriod = priv->AdMinCheckPeriod;
+		}
+
+	}
+	/* Case 4. Evaluate if we shall switch antenna now. */
+	/* Cause Table Speed is very fast in TRC Dell Lab, we check it every time. */
+	else {
+		priv->AdTickCount = 0;
+
+		/*
+		 * <Roger_Notes> We evaluate RxOk counts for each antenna first and than
+		 * evaluate signal strength.
+		 * The following operation can overcome the disability of CCA on both two antennas
+		 * When signal strength was extremely low or high.
+		 * 2008.01.30.
+		 */
+
+		/*
+		 * Evaluate RxOk count from each antenna if we shall switch default antenna now.
+		 */
+		if ((priv->AdMainAntennaRxOkCnt < priv->AdAuxAntennaRxOkCnt)
+			&& (priv->CurrAntennaIndex == 0)) {
+		/* We set Main antenna as default but RxOk count was less than Aux ones. */
+
+			/* Switch to Aux antenna. */
+			SwitchAntenna(dev);
+			priv->bHWAdSwitched = true;
+		} else if ((priv->AdAuxAntennaRxOkCnt < priv->AdMainAntennaRxOkCnt)
+			&& (priv->CurrAntennaIndex == 1)) {
+		/* We set Aux antenna as default but RxOk count was less than Main ones. */
+
+			/* Switch to Main antenna. */
+			SwitchAntenna(dev);
+			priv->bHWAdSwitched = true;
+		} else {
+		/* Default antenna is better. */
+
+			/* Still need to check current signal strength. */
+			priv->bHWAdSwitched = false;
+		}
+		/*
+		 * <Roger_Notes> We evaluate Rx signal strength ONLY when default antenna
+		 * didn't changed by HW evaluation.
+		 * 2008.02.27.
+		 *
+		 * [TRC Dell Lab] SignalStrength is inaccuracy. Isaiah 2008-03-05
+		 * For example, Throughput of aux is better than main antenna(about 10M v.s 2M),
+		 * but AdRxSignalStrength is less than main.
+		 * Our guess is that main antenna have lower throughput and get many change
+		 * to receive more CCK packets(ex.Beacon) which have stronger SignalStrength.
+		 */
+		if ((!priv->bHWAdSwitched) && (bSwCheckSS)) {
+			/* Evaluate Rx signal strength if we shall switch antenna now. */
+			if (priv->AdRxSignalStrength < priv->AdRxSsThreshold) {
+			/* Rx signal strength is weak => Switch Antenna. */
+				priv->AdRxSsBeforeSwitched = priv->AdRxSignalStrength;
+				priv->bAdSwitchedChecking = true;
+
+				SwitchAntenna(dev);
+			} else {
+			/* Rx signal strength is OK. */
+				priv->bAdSwitchedChecking = false;
+				/* Increase Rx signal strength threshold if necessary. */
+				if ((priv->AdRxSignalStrength > (priv->AdRxSsThreshold + 10)) && /* Signal is much stronger than current threshold */
+					priv->AdRxSsThreshold <= priv->AdMaxRxSsThreshold) { /* Current threhold is not yet reach upper limit. */
+
+					priv->AdRxSsThreshold = (priv->AdRxSsThreshold + priv->AdRxSignalStrength) / 2;
+					priv->AdRxSsThreshold = (priv->AdRxSsThreshold > priv->AdMaxRxSsThreshold) ?
+								priv->AdMaxRxSsThreshold: priv->AdRxSsThreshold;/* +by amy 080312 */
+				}
+
+				/* Reduce Antenna Diversity checking period if possible. */
+				if (priv->AdCheckPeriod > priv->AdMinCheckPeriod)
+					priv->AdCheckPeriod /= 2;
+			}
+		}
+	}
+	/* Reset antenna diversity Rx related statistics. */
+	priv->AdRxOkCnt = 0;
+	priv->AdMainAntennaRxOkCnt = 0;
+	priv->AdAuxAntennaRxOkCnt = 0;
+}
+
+ /*	Return TRUE if we shall perform Tx Power Tracking Mecahnism, FALSE otherwise. */
+bool CheckTxPwrTracking(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	if (!priv->bTxPowerTrack)
+		return false;
+
+	/* if 87SE is in High Power , don't do Tx Power Tracking. asked by SD3 ED. 2008-08-08 Isaiah */
+	if (priv->bToUpdateTxPwr)
+		return false;
+
+	return true;
+}
+
+
+ /*	Timer callback function of SW Antenna Diversity. */
+void SwAntennaDiversityTimerCallback(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	RT_RF_POWER_STATE rtState;
+
+	 /* We do NOT need to switch antenna while RF is off. */
+	rtState = priv->eRFPowerState;
+	do {
+		if (rtState == eRfOff) {
+			break;
+		} else if (rtState == eRfSleep) {
+			/* Don't access BB/RF under Disable PLL situation. */
+			break;
+		}
+		SwAntennaDiversity(dev);
+
+	} while (false);
+
+	if (priv->up) {
+		priv->SwAntennaDiversityTimer.expires = jiffies + MSECS(ANTENNA_DIVERSITY_TIMER_PERIOD);
+		add_timer(&priv->SwAntennaDiversityTimer);
+	}
+}
+
diff --git a/drivers/staging/rtl8187se/r8180_dm.h b/drivers/staging/rtl8187se/r8180_dm.h
new file mode 100644
index 00000000..b7758254
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_dm.h
@@ -0,0 +1,23 @@
+#ifndef R8180_DM_H
+#define R8180_DM_H
+
+#include "r8180.h"
+/* #include "r8180_hw.h"	*/
+/* #include "r8180_93cx6.h"	*/
+void SwAntennaDiversityRxOk8185(struct net_device *dev, u8 SignalStrength);
+bool SetAntenna8185(struct net_device *dev,	u8 u1bAntennaIndex);
+bool SwitchAntenna(struct net_device *dev);
+void SwAntennaDiversity(struct net_device *dev);
+void SwAntennaDiversityTimerCallback(struct net_device *dev);
+bool CheckDig(struct net_device *dev);
+bool CheckHighPower(struct net_device *dev);
+void rtl8180_hw_dig_wq(struct work_struct *work);
+void rtl8180_tx_pw_wq(struct work_struct *work);
+void rtl8180_rate_adapter(struct work_struct * work);
+void TxPwrTracking87SE(struct net_device *dev);
+bool CheckTxPwrTracking(struct net_device *dev);
+void rtl8180_rate_adapter(struct work_struct * work);
+void timer_rate_adaptive(unsigned long data);
+
+
+#endif
diff --git a/drivers/staging/rtl8187se/r8180_hw.h b/drivers/staging/rtl8187se/r8180_hw.h
new file mode 100644
index 00000000..3fca144a
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_hw.h
@@ -0,0 +1,583 @@
+/*
+	This is part of rtl8180 OpenSource driver.
+	Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the
+	official Realtek driver.
+	Parts of this driver are based on the rtl8180 driver skeleton
+	from Patric Schenke & Andres Salomon.
+	Parts of this driver are based on the Intel Pro Wireless
+	2100 GPL driver.
+
+	We want to tanks the Authors of those projects
+	and the Ndiswrapper project Authors.
+*/
+
+/* Mariusz Matuszek added full registers definition with Realtek's name */
+
+/* this file contains register definitions for the rtl8180 MAC controller */
+#ifndef R8180_HW
+#define R8180_HW
+
+
+#define BIT0	0x00000001
+#define BIT1	0x00000002
+#define BIT2	0x00000004
+#define BIT3	0x00000008
+#define BIT4	0x00000010
+#define BIT5	0x00000020
+#define BIT6	0x00000040
+#define BIT7	0x00000080
+#define BIT9	0x00000200
+#define BIT11	0x00000800
+#define BIT13	0x00002000
+#define BIT15	0x00008000
+#define BIT20	0x00100000
+#define BIT21	0x00200000
+#define BIT22	0x00400000
+#define BIT23	0x00800000
+#define BIT24	0x01000000
+#define BIT25	0x02000000
+#define BIT26	0x04000000
+#define BIT27	0x08000000
+#define BIT28	0x10000000
+#define BIT29	0x20000000
+#define BIT30	0x40000000
+#define BIT31	0x80000000
+
+#define MAX_SLEEP_TIME (10000)
+#define MIN_SLEEP_TIME (50)
+
+#define BB_HOST_BANG_EN (1<<2)
+#define BB_HOST_BANG_CLK (1<<1)
+
+#define MAC0 0
+#define MAC4 4
+
+#define CMD 0x37
+#define CMD_RST_SHIFT 4
+#define CMD_RX_ENABLE_SHIFT 3
+#define CMD_TX_ENABLE_SHIFT 2
+
+#define EPROM_CMD 0x50
+#define EPROM_CMD_RESERVED_MASK ((1<<5)|(1<<4))
+#define EPROM_CMD_OPERATING_MODE_SHIFT 6
+#define EPROM_CMD_OPERATING_MODE_MASK ((1<<7)|(1<<6))
+#define EPROM_CMD_CONFIG 0x3
+#define EPROM_CMD_NORMAL 0
+#define EPROM_CMD_LOAD 1
+#define EPROM_CMD_PROGRAM 2
+#define EPROM_CS_SHIFT 3
+#define EPROM_CK_SHIFT 2
+#define EPROM_W_SHIFT 1
+#define EPROM_R_SHIFT 0
+#define CONFIG2_DMA_POLLING_MODE_SHIFT 3
+
+#define INTA_TXOVERFLOW (1<<15)
+#define INTA_TIMEOUT (1<<14)
+#define INTA_HIPRIORITYDESCERR (1<<9)
+#define INTA_HIPRIORITYDESCOK (1<<8)
+#define INTA_NORMPRIORITYDESCERR (1<<7)
+#define INTA_NORMPRIORITYDESCOK (1<<6)
+#define INTA_RXOVERFLOW (1<<5)
+#define INTA_RXDESCERR (1<<4)
+#define INTA_LOWPRIORITYDESCERR (1<<3)
+#define INTA_LOWPRIORITYDESCOK (1<<2)
+#define INTA_RXOK (1)
+#define INTA_MASK 0x3c
+
+#define RXRING_ADDR 0xe4 /* page 0 */
+#define PGSELECT 0x5e
+#define PGSELECT_PG_SHIFT 0
+#define RX_CONF 0x44
+#define MAC_FILTER_MASK ((1<<0) | (1<<1) | (1<<2) | (1<<3) | (1<<5) | \
+(1<<12) | (1<<18) | (1<<19) | (1<<20) | (1<<21) | (1<<22) | (1<<23))
+#define RX_CHECK_BSSID_SHIFT 23
+#define ACCEPT_PWR_FRAME_SHIFT 22
+#define ACCEPT_MNG_FRAME_SHIFT 20
+#define ACCEPT_CTL_FRAME_SHIFT 19
+#define ACCEPT_DATA_FRAME_SHIFT 18
+#define ACCEPT_ICVERR_FRAME_SHIFT 12
+#define ACCEPT_CRCERR_FRAME_SHIFT 5
+#define ACCEPT_BCAST_FRAME_SHIFT 3
+#define ACCEPT_MCAST_FRAME_SHIFT 2
+#define ACCEPT_ALLMAC_FRAME_SHIFT 0
+#define ACCEPT_NICMAC_FRAME_SHIFT 1
+
+#define RX_FIFO_THRESHOLD_MASK ((1<<13) | (1<<14) | (1<<15))
+#define RX_FIFO_THRESHOLD_SHIFT 13
+#define RX_FIFO_THRESHOLD_NONE 7
+#define RX_AUTORESETPHY_SHIFT 28
+
+#define TX_CONF 0x40
+#define TX_CONF_HEADER_AUTOICREMENT_SHIFT 30
+#define TX_LOOPBACK_SHIFT 17
+#define TX_LOOPBACK_NONE 0
+#define TX_LOOPBACK_CONTINUE 3
+#define TX_LOOPBACK_MASK ((1<<17)|(1<<18))
+#define TX_DPRETRY_SHIFT 0
+#define R8180_MAX_RETRY 255
+#define TX_RTSRETRY_SHIFT 8
+#define TX_NOICV_SHIFT 19
+#define TX_NOCRC_SHIFT 16
+#define TX_DMA_POLLING 0xd9
+#define TX_DMA_POLLING_BEACON_SHIFT 7
+#define TX_DMA_POLLING_HIPRIORITY_SHIFT 6
+#define TX_DMA_POLLING_NORMPRIORITY_SHIFT 5
+#define TX_DMA_POLLING_LOWPRIORITY_SHIFT 4
+#define TX_MANAGEPRIORITY_RING_ADDR 0x0C
+#define TX_BKPRIORITY_RING_ADDR 0x10
+#define TX_BEPRIORITY_RING_ADDR 0x14
+#define TX_VIPRIORITY_RING_ADDR 0x20
+#define TX_VOPRIORITY_RING_ADDR 0x24
+#define TX_HIGHPRIORITY_RING_ADDR 0x28
+#define MAX_RX_DMA_MASK ((1<<8) | (1<<9) | (1<<10))
+#define MAX_RX_DMA_2048 7
+#define MAX_RX_DMA_1024	6
+#define MAX_RX_DMA_SHIFT 10
+#define INT_TIMEOUT 0x48
+#define CONFIG3_CLKRUN_SHIFT 2
+#define CONFIG3_ANAPARAM_W_SHIFT 6
+#define ANAPARAM 0x54
+#define BEACON_INTERVAL 0x70
+#define BEACON_INTERVAL_MASK ((1<<0)|(1<<1)|(1<<2)|(1<<3)|(1<<4)|(1<<5)| \
+(1<<6)|(1<<7)|(1<<8)|(1<<9))
+#define ATIM_MASK ((1<<0)|(1<<1)|(1<<2)|(1<<3)|(1<<4)|(1<<5)|(1<<6)|(1<<7)| \
+(1<<8)|(1<<9))
+#define ATIM 0x72
+#define EPROM_CS_SHIFT 3
+#define EPROM_CK_SHIFT 2
+#define PHY_ADR 0x7c
+#define SECURITY 0x5f /* 1209 this is sth wrong */
+#define SECURITY_WEP_TX_ENABLE_SHIFT 1
+#define SECURITY_WEP_RX_ENABLE_SHIFT 0
+#define SECURITY_ENCRYP_104 1
+#define SECURITY_ENCRYP_SHIFT 4
+#define SECURITY_ENCRYP_MASK ((1<<4)|(1<<5))
+#define KEY0 0x90  /* 1209 this is sth wrong */
+#define CONFIG2_ANTENNA_SHIFT 6
+#define TX_BEACON_RING_ADDR 0x4c
+#define CONFIG0_WEP40_SHIFT 7
+#define CONFIG0_WEP104_SHIFT 6
+#define AGCRESET_SHIFT 5
+
+
+
+/*
+ * Operational registers offsets in PCI (I/O) space.
+ * RealTek names are used.
+ */
+
+#define TSFTR 0x0018
+
+#define TLPDA 0x0020
+
+#define BSSID 0x002E
+
+#define CR 0x0037
+
+#define RF_SW_CONFIG	        0x8			/* store data which is transmitted to RF for driver	*/
+#define RF_SW_CFG_SI		BIT1
+#define EIFS			0x2D			/* Extended InterFrame Space Timer, in unit of 4 us.	*/
+
+#define BRSR			0x34			/* Basic rate set										*/
+
+#define IMR 0x006C
+#define ISR 0x003C
+
+#define TCR 0x0040
+
+#define RCR 0x0044
+
+#define TimerInt 0x0048
+
+#define CR9346 0x0050
+
+#define CONFIG0 0x0051
+#define CONFIG2 0x0053
+
+#define MSR 0x0058
+
+#define CONFIG3 0x0059
+#define CONFIG4 0x005A
+	/* SD3 szuyitasi: Mac0x57= CC -> B0 Mac0x60= D1 -> C6	*/
+	/* Mac0x60 = 0x000004C6 power save parameters			*/
+	#define ANAPARM_ASIC_ON    0xB0054D00
+	#define ANAPARM2_ASIC_ON  0x000004C6
+
+	#define ANAPARM_ON ANAPARM_ASIC_ON
+	#define ANAPARM2_ON ANAPARM2_ASIC_ON
+
+#define TESTR 0x005B
+
+#define PSR 0x005E
+
+#define BcnItv 0x0070
+
+#define AtimWnd 0x0072
+
+#define BintrItv 0x0074
+
+#define PhyAddr 0x007C
+#define PhyDataR 0x007E
+
+/* following are for rtl8185 */
+#define RFPinsOutput 0x80
+#define RFPinsEnable 0x82
+#define RF_TIMING 0x8c
+#define RFPinsSelect 0x84
+#define ANAPARAM2 0x60
+#define RF_PARA 0x88
+#define RFPinsInput 0x86
+#define GP_ENABLE 0x90
+#define GPIO 0x91
+#define SW_CONTROL_GPIO 0x400
+#define TX_ANTENNA 0x9f
+#define TX_GAIN_OFDM 0x9e
+#define TX_GAIN_CCK 0x9d
+#define WPA_CONFIG 0xb0
+#define TX_AGC_CTL 0x9c
+#define TX_AGC_CTL_PERPACKET_GAIN_SHIFT 0
+#define TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT 1
+#define TX_AGC_CTL_FEEDBACK_ANT 2
+#define RESP_RATE 0x34
+#define SIFS 0xb4
+#define DIFS 0xb5
+
+#define SLOT 0xb6
+#define CW_CONF 0xbc
+#define CW_CONF_PERPACKET_RETRY_SHIFT 1
+#define CW_CONF_PERPACKET_CW_SHIFT 0
+#define CW_VAL 0xbd
+#define MAX_RESP_RATE_SHIFT 4
+#define MIN_RESP_RATE_SHIFT 0
+#define RATE_FALLBACK 0xbe
+
+#define CONFIG5 0x00D8
+
+#define PHYPR			0xDA			/* 0xDA - 0x0B PHY Parameter Register.	*/
+
+#define FEMR			0x1D4	/* Function Event Mask register	*/
+
+#define FFER 0x00FC
+#define FFER_END 0x00FF
+
+
+
+/*
+ * Bitmasks for specific register functions.
+ * Names are derived from the register name and function name.
+ *
+ * <REGISTER>_<FUNCTION>[<bit>]
+ *
+ * this leads to some awkward names...
+ */
+
+#define BRSR_BPLCP  ((1 << 8))
+#define BRSR_MBR    ((1 << 1)|(1 << 0))
+#define BRSR_MBR_8185 ((1 << 11)|(1 << 10)|(1 << 9)|(1 << 8)|(1 << 7)|(1 << 6)|(1 << 5)|(1 << 4)|(1 << 3)|(1 << 2)|(1 << 1)|(1 << 0))
+#define BRSR_MBR0   ((1 << 0))
+#define BRSR_MBR1   ((1 << 1))
+
+#define CR_RST      ((1 << 4))
+#define CR_RE       ((1 << 3))
+#define CR_TE       ((1 << 2))
+#define CR_MulRW    ((1 << 0))
+
+#define IMR_Dot11hInt	((1 << 25))			/*802.11h Measurement Interrupt					*/
+#define IMR_BcnDmaInt	((1 << 24))			/*Beacon DMA Interrupt */ /*What differenct between BcnDmaInt and BcnInt???	*/
+#define IMR_WakeInt		((1 << 23))			/*Wake Up Interrupt								*/
+#define IMR_TXFOVW		((1 << 22))			/*Tx FIFO Overflow Interrupt					*/
+#define IMR_TimeOut1	((1 << 21))			/*Time Out Interrupt 1							*/
+#define IMR_BcnInt		((1 << 20))			/*Beacon Time out Interrupt						*/
+#define IMR_ATIMInt		((1 << 19))			/*ATIM Time Out Interrupt						*/
+#define IMR_TBDER		((1 << 18))			/*Tx Beacon Descriptor Error Interrupt			*/
+#define IMR_TBDOK		((1 << 17))			/*Tx Beacon Descriptor OK Interrupt				*/
+#define IMR_THPDER		((1 << 16))			/*Tx High Priority Descriptor Error Interrupt	*/
+#define IMR_THPDOK		((1 << 15))			/*Tx High Priority Descriptor OK Interrupt		*/
+#define IMR_TVODER		((1 << 14))			/*Tx AC_VO Descriptor Error Interrupt			*/
+#define IMR_TVODOK		((1 << 13))			/*Tx AC_VO Descriptor OK Interrupt				*/
+#define IMR_FOVW		((1 << 12))			/*Rx FIFO Overflow Interrupt					*/
+#define IMR_RDU			((1 << 11))			/*Rx Descriptor Unavailable Interrupt			*/
+#define IMR_TVIDER		((1 << 10))			/*Tx AC_VI Descriptor Error Interrupt			*/
+#define IMR_TVIDOK		((1 << 9))			/*Tx AC_VI Descriptor OK Interrupt				*/
+#define IMR_RER			((1 << 8))			/*Rx Error Interrupt							*/
+#define IMR_ROK			((1 << 7))			/*Receive OK Interrupt							*/
+#define IMR_TBEDER		((1 << 6))			/*Tx AC_BE Descriptor Error Interrupt			*/
+#define IMR_TBEDOK		((1 << 5))			/*Tx AC_BE Descriptor OK Interrupt				*/
+#define IMR_TBKDER		((1 << 4))			/*Tx AC_BK Descriptor Error Interrupt			*/
+#define IMR_TBKDOK		((1 << 3))			/*Tx AC_BK Descriptor OK Interrupt				*/
+#define IMR_RQoSOK		((1 << 2))			/*Rx QoS OK Interrupt							*/
+#define IMR_TimeOut2	((1 << 1))			/*Time Out Interrupt 2							*/
+#define IMR_TimeOut3	((1 << 0))			/*Time Out Interrupt 3							*/
+#define IMR_TMGDOK      ((1 << 30))
+#define ISR_Dot11hInt	((1 << 25))			/*802.11h Measurement Interrupt					*/
+#define ISR_BcnDmaInt	((1 << 24))			/*Beacon DMA Interrupt	*/ /*What differenct between BcnDmaInt and BcnInt???	*/
+#define ISR_WakeInt		((1 << 23))			/*Wake Up Interrupt								*/
+#define ISR_TXFOVW		((1 << 22))			/*Tx FIFO Overflow Interrupt					*/
+#define ISR_TimeOut1	((1 << 21))			/*Time Out Interrupt 1							*/
+#define ISR_BcnInt		((1 << 20))			/*Beacon Time out Interrupt						*/
+#define ISR_ATIMInt		((1 << 19))			/*ATIM Time Out Interrupt						*/
+#define ISR_TBDER		((1 << 18))			/*Tx Beacon Descriptor Error Interrupt			*/
+#define ISR_TBDOK		((1 << 17))			/*Tx Beacon Descriptor OK Interrupt				*/
+#define ISR_THPDER		((1 << 16))			/*Tx High Priority Descriptor Error Interrupt	*/
+#define ISR_THPDOK		((1 << 15))			/*Tx High Priority Descriptor OK Interrupt		*/
+#define ISR_TVODER		((1 << 14))			/*Tx AC_VO Descriptor Error Interrupt			*/
+#define ISR_TVODOK		((1 << 13))			/*Tx AC_VO Descriptor OK Interrupt				*/
+#define ISR_FOVW		((1 << 12))			/*Rx FIFO Overflow Interrupt					*/
+#define ISR_RDU			((1 << 11))			/*Rx Descriptor Unavailable Interrupt			*/
+#define ISR_TVIDER		((1 << 10))			/*Tx AC_VI Descriptor Error Interrupt			*/
+#define ISR_TVIDOK		((1 << 9))			/*Tx AC_VI Descriptor OK Interrupt				*/
+#define ISR_RER			((1 << 8))			/*Rx Error Interrupt							*/
+#define ISR_ROK			((1 << 7))			/*Receive OK Interrupt							*/
+#define ISR_TBEDER		((1 << 6))			/*Tx AC_BE Descriptor Error Interrupt			*/
+#define ISR_TBEDOK		((1 << 5))			/*Tx AC_BE Descriptor OK Interrupt				*/
+#define ISR_TBKDER		((1 << 4))			/*Tx AC_BK Descriptor Error Interrupt			*/
+#define ISR_TBKDOK		((1 << 3))			/*Tx AC_BK Descriptor OK Interrupt				*/
+#define ISR_RQoSOK		((1 << 2))			/*Rx QoS OK Interrupt							*/
+#define ISR_TimeOut2	((1 << 1))			/*Time Out Interrupt 2							*/
+#define ISR_TimeOut3	((1 << 0))			/*Time Out Interrupt 3							*/
+
+/* these definition is used for Tx/Rx test temporarily */
+#define ISR_TLPDER  ISR_TVIDER
+#define ISR_TLPDOK  ISR_TVIDOK
+#define ISR_TNPDER  ISR_TVODER
+#define ISR_TNPDOK  ISR_TVODOK
+#define ISR_TimeOut ISR_TimeOut1
+#define ISR_RXFOVW ISR_FOVW
+
+
+#define HW_VERID_R8180_F 3
+#define HW_VERID_R8180_ABCD 2
+#define HW_VERID_R8185_ABC 4
+#define HW_VERID_R8185_D 5
+#define HW_VERID_R8185B_B 6
+
+#define TCR_CWMIN   ((1 << 31))
+#define TCR_SWSEQ   ((1 << 30))
+#define TCR_HWVERID_MASK ((1 << 27)|(1 << 26)|(1 << 25))
+#define TCR_HWVERID_SHIFT 25
+#define TCR_SAT     ((1 << 24))
+#define TCR_PLCP_LEN TCR_SAT /* rtl8180 */
+#define TCR_MXDMA_MASK   ((1 << 23)|(1 << 22)|(1 << 21))
+#define TCR_MXDMA_1024 6
+#define TCR_MXDMA_2048 7
+#define TCR_MXDMA_SHIFT  21
+#define TCR_DISCW   ((1 << 20))
+#define TCR_ICV     ((1 << 19))
+#define TCR_LBK     ((1 << 18)|(1 << 17))
+#define TCR_LBK1    ((1 << 18))
+#define TCR_LBK0    ((1 << 17))
+#define TCR_CRC     ((1 << 16))
+#define TCR_DPRETRY_MASK   ((1 << 15)|(1 << 14)|(1 << 13)|(1 << 12)|(1 << 11)|(1 << 10)|(1 << 9)|(1 << 8))
+#define TCR_RTSRETRY_MASK   ((1 << 0)|(1 << 1)|(1 << 2)|(1 << 3)|(1 << 4)|(1 << 5)|(1 << 6)|(1 << 7))
+#define TCR_PROBE_NOTIMESTAMP_SHIFT 29 /* rtl8185 */
+
+#define RCR_ONLYERLPKT ((1 << 31))
+#define RCR_CS_SHIFT   29
+#define RCR_CS_MASK    ((1 << 30) | (1 << 29))
+#define RCR_ENMARP     ((1 << 28))
+#define RCR_CBSSID     ((1 << 23))
+#define RCR_APWRMGT    ((1 << 22))
+#define RCR_ADD3       ((1 << 21))
+#define RCR_AMF        ((1 << 20))
+#define RCR_ACF        ((1 << 19))
+#define RCR_ADF        ((1 << 18))
+#define RCR_RXFTH      ((1 << 15)|(1 << 14)|(1 << 13))
+#define RCR_RXFTH2     ((1 << 15))
+#define RCR_RXFTH1     ((1 << 14))
+#define RCR_RXFTH0     ((1 << 13))
+#define RCR_AICV       ((1 << 12))
+#define RCR_MXDMA      ((1 << 10)|(1 << 9)|(1 << 8))
+#define RCR_MXDMA2     ((1 << 10))
+#define RCR_MXDMA1     ((1 << 9))
+#define RCR_MXDMA0     ((1 << 8))
+#define RCR_9356SEL    ((1 << 6))
+#define RCR_ACRC32     ((1 << 5))
+#define RCR_AB         ((1 << 3))
+#define RCR_AM         ((1 << 2))
+#define RCR_APM        ((1 << 1))
+#define RCR_AAP        ((1 << 0))
+
+#define CR9346_EEM     ((1 << 7)|(1 << 6))
+#define CR9346_EEM1    ((1 << 7))
+#define CR9346_EEM0    ((1 << 6))
+#define CR9346_EECS    ((1 << 3))
+#define CR9346_EESK    ((1 << 2))
+#define CR9346_EED1    ((1 << 1))
+#define CR9346_EED0    ((1 << 0))
+
+#define CONFIG3_PARM_En    ((1 << 6))
+#define CONFIG3_FuncRegEn  ((1 << 1))
+
+#define CONFIG4_PWRMGT     ((1 << 5))
+
+#define MSR_LINK_MASK      ((1 << 2)|(1 << 3))
+#define MSR_LINK_MANAGED   2
+#define MSR_LINK_NONE      0
+#define MSR_LINK_SHIFT     2
+#define MSR_LINK_ADHOC     1
+#define MSR_LINK_MASTER    3
+
+#define BcnItv_BcnItv      (0x01FF)
+
+#define AtimWnd_AtimWnd    (0x01FF)
+
+#define BintrItv_BintrItv  (0x01FF)
+
+#define FEMR_INTR    ((1 << 15))
+#define FEMR_WKUP    ((1 << 14))
+#define FEMR_GWAKE   ((1 << 4))
+
+#define FFER_INTR    ((1 << 15))
+#define FFER_GWAKE   ((1 << 4))
+
+/* Three wire mode.					*/
+#define SW_THREE_WIRE			0
+#define HW_THREE_WIRE			2
+/* RTL8187S by amy					*/
+#define HW_THREE_WIRE_PI		5
+#define HW_THREE_WIRE_SI		6
+/* by amy							*/
+#define TCR_LRL_OFFSET		0
+#define TCR_SRL_OFFSET		8
+#define TCR_MXDMA_OFFSET	21
+#define TCR_DISReqQsize_OFFSET		28
+#define TCR_DurProcMode_OFFSET		30
+
+#define RCR_MXDMA_OFFSET				8
+#define RCR_FIFO_OFFSET					13
+
+#define AckTimeOutReg	0x79		/* ACK timeout register, in unit of 4 us. */
+
+#define RFTiming			0x8C
+
+#define TPPollStop		0x93
+
+#define TXAGC_CTL		0x9C			/*< RJ_TODO_8185B> TX_AGC_CONTROL (0x9C seems be removed at 8185B, see p37). */
+#define CCK_TXAGC		0x9D
+#define OFDM_TXAGC		0x9E
+#define ANTSEL			0x9F
+
+#define ACM_CONTROL             0x00BF      /* ACM Control Registe */
+
+#define	IntMig			0xE2			/* Interrupt Migration (0xE2 ~ 0xE3)	*/
+
+#define TID_AC_MAP		0xE8			/* TID to AC Mapping Register			*/
+
+#define ANAPARAM3		0xEE			/* <RJ_TODO_8185B> How to use it?		*/
+
+#define AC_VO_PARAM		0xF0			/* AC_VO Parameters Record				*/
+#define AC_VI_PARAM		0xF4			/* AC_VI Parameters Record				*/
+#define AC_BE_PARAM		0xF8			/* AC_BE Parameters Record				*/
+#define AC_BK_PARAM		0xFC			/* AC_BK Parameters Record				*/
+
+#define GPIOCtrl			0x16B			/*GPIO Control Register.			*/
+#define ARFR			0x1E0	/* Auto Rate Fallback Register (0x1e0 ~ 0x1e2)	*/
+
+#define RFSW_CTRL			0x272	/* 0x272-0x273.								*/
+#define SW_3W_DB0			0x274	/* Software 3-wire data buffer bit 31~0.		*/
+#define SW_3W_DB1			0x278	/* Software 3-wire data buffer bit 63~32.	*/
+#define SW_3W_CMD0			0x27C	/* Software 3-wire Control/Status Register.	*/
+#define SW_3W_CMD1			0x27D	/* Software 3-wire Control/Status Register.	*/
+
+#define PI_DATA_READ		0X360	/* 0x360 - 0x361  Parallel Interface Data Register.	*/
+#define SI_DATA_READ		0x362	/* 0x362 - 0x363  Serial Interface Data Register.	*/
+
+/*
+----------------------------------------------------------------------------
+		8185B TPPollStop bits					(offset 0x93, 1 byte)
+----------------------------------------------------------------------------
+*/
+#define TPPOLLSTOP_BQ			(0x01 << 7)
+#define TPPOLLSTOP_AC_VIQ		(0x01 << 4)
+
+#define MSR_LINK_ENEDCA	   (1<<4)
+
+/*
+----------------------------------------------------------------------------
+		8187B AC_XX_PARAM bits
+----------------------------------------------------------------------------
+*/
+#define AC_PARAM_TXOP_LIMIT_OFFSET		16
+#define AC_PARAM_ECW_MAX_OFFSET			12
+#define AC_PARAM_ECW_MIN_OFFSET			8
+#define AC_PARAM_AIFS_OFFSET			0
+
+/*
+----------------------------------------------------------------------------
+		8187B ACM_CONTROL bits					(Offset 0xBF, 1 Byte)
+----------------------------------------------------------------------------
+*/
+#define VOQ_ACM_EN				(0x01 << 7)	/*BIT7	*/
+#define VIQ_ACM_EN				(0x01 << 6)	/*BIT6	*/
+#define BEQ_ACM_EN				(0x01 << 5)	/*BIT5	*/
+#define ACM_HW_EN				(0x01 << 4)	/*BIT4	*/
+#define VOQ_ACM_CTL				(0x01 << 2)	/*BIT2	*/	/* Set to 1 when AC_VO used time reaches or exceeds the admitted time	*/
+#define VIQ_ACM_CTL				(0x01 << 1)	/*BIT1	*/	/* Set to 1 when AC_VI used time reaches or exceeds the admitted time	*/
+#define BEQ_ACM_CTL				(0x01 << 0)	/*BIT0	*/	/* Set to 1 when AC_BE used time reaches or exceeds the admitted time	*/
+
+
+/*
+----------------------------------------------------------------------------
+		8185B SW_3W_CMD bits					(Offset 0x27C-0x27D, 16bit)
+----------------------------------------------------------------------------
+*/
+#define SW_3W_CMD0_HOLD		((1 << 7))
+#define SW_3W_CMD1_RE		((1 << 0)) /* BIT8		*/
+#define SW_3W_CMD1_WE		((1 << 1)) /* BIT9		*/
+#define SW_3W_CMD1_DONE		((1 << 2)) /* BIT10		*/
+
+#define BB_HOST_BANG_RW		(1 << 3)
+
+/*
+----------------------------------------------------------------------------
+		8185B RATE_FALLBACK_CTL bits			(Offset 0xBE, 8bit)
+----------------------------------------------------------------------------
+*/
+#define RATE_FALLBACK_CTL_ENABLE				((1 << 7))
+#define RATE_FALLBACK_CTL_ENABLE_RTSCTS		((1 << 6))
+/* Auto rate fallback per 2^n retry. */
+#define RATE_FALLBACK_CTL_AUTO_STEP0	0x00
+#define RATE_FALLBACK_CTL_AUTO_STEP1	0x01
+#define RATE_FALLBACK_CTL_AUTO_STEP2	0x02
+#define RATE_FALLBACK_CTL_AUTO_STEP3	0x03
+
+
+#define RTL8225z2_ANAPARAM_OFF	0x55480658
+#define RTL8225z2_ANAPARAM2_OFF	0x72003f70
+/* by amy for power save		*/
+#define RF_CHANGE_BY_HW BIT30
+#define RF_CHANGE_BY_PS BIT29
+#define RF_CHANGE_BY_IPS BIT28
+/* by amy for power save		*/
+/* by amy for antenna			*/
+#define EEPROM_SW_REVD_OFFSET 0x3f
+/*  BIT[8-9] is for SW Antenna Diversity. Only the value EEPROM_SW_AD_ENABLE means enable, other values are diable.					*/
+#define EEPROM_SW_AD_MASK			0x0300
+#define EEPROM_SW_AD_ENABLE			0x0100
+
+/* BIT[10-11] determine if Antenna 1 is the Default Antenna. Only the value EEPROM_DEF_ANT_1 means TRUE, other values are FALSE.	*/
+#define EEPROM_DEF_ANT_MASK			0x0C00
+#define EEPROM_DEF_ANT_1			0x0400
+/*by amy for antenna																				*/
+/* {by amy 080312																					*/
+/* 0x7C, 0x7D Crystal calibration and Tx Power tracking mechanism. Added by Roger. 2007.12.10.		*/
+#define EEPROM_RSV						0x7C
+#define EEPROM_XTAL_CAL_XOUT_MASK	0x0F	/* 0x7C[3:0], Crystal calibration for Xout.				*/
+#define EEPROM_XTAL_CAL_XIN_MASK		0xF0	/* 0x7C[7:4], Crystal calibration for Xin.			*/
+#define EEPROM_THERMAL_METER_MASK	0x0F00	/* 0x7D[3:0], Thermal meter reference level.			*/
+#define EEPROM_XTAL_CAL_ENABLE		0x1000	/* 0x7D[4], Crystal calibration enabled/disabled BIT.	*/
+#define EEPROM_THERMAL_METER_ENABLE	0x2000	/* 0x7D[5], Thermal meter enabled/disabled BIT.			*/
+#define EN_LPF_CAL			0x238	/* Enable LPF Calibration.										*/
+#define PWR_METER_EN		BIT1
+/* <RJ_TODO_8185B> where are false alarm counters in 8185B? */
+#define CCK_FALSE_ALARM		0xD0
+/* by amy 080312} */
+
+/* YJ,add for Country IE, 080630 */
+#define EEPROM_COUNTRY_CODE  0x2E
+/* YJ,add,080630,end */
+
+#endif
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225.h b/drivers/staging/rtl8187se/r8180_rtl8225.h
new file mode 100644
index 00000000..494ea861
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_rtl8225.h
@@ -0,0 +1,34 @@
+/*
+	This is part of the rtl8180-sa2400 driver
+	released under the GPL (See file COPYING for details).
+	Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+
+	This files contains programming code for the rtl8225
+	radio frontend.
+
+	*Many* thanks to Realtek Corp. for their great support!
+
+*/
+
+#include "r8180.h"
+
+#define RTL8225_ANAPARAM_ON  0xa0000b59
+#define RTL8225_ANAPARAM_OFF 0xa00beb59
+#define RTL8225_ANAPARAM2_OFF 0x840dec11
+#define RTL8225_ANAPARAM2_ON  0x860dec11
+#define RTL8225_ANAPARAM_SLEEP 0xa00bab59
+#define RTL8225_ANAPARAM2_SLEEP 0x840dec11
+
+void rtl8225z2_rf_init(struct net_device *dev);
+void rtl8225z2_rf_set_chan(struct net_device *dev, short ch);
+void rtl8225z2_rf_close(struct net_device *dev);
+
+void RF_WriteReg(struct net_device *dev, u8 offset, u32	data);
+u32 RF_ReadReg(struct net_device *dev, u8 offset);
+
+void rtl8180_set_mode(struct net_device *dev, int mode);
+void rtl8180_set_mode(struct net_device *dev, int mode);
+bool SetZebraRFPowerState8185(struct net_device *dev, RT_RF_POWER_STATE  eRFPowerState);
+void rtl8225z4_rf_sleep(struct net_device *dev);
+void rtl8225z4_rf_wakeup(struct net_device *dev);
+
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225z2.c b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
new file mode 100644
index 00000000..ee5b867f
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
@@ -0,0 +1,1055 @@
+/*
+ * This is part of the rtl8180-sa2400 driver
+ * released under the GPL (See file COPYING for details).
+ * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * This files contains programming code for the rtl8225
+ * radio frontend.
+ *
+ * *Many* thanks to Realtek Corp. for their great support!
+ */
+
+#include "r8180_hw.h"
+#include "r8180_rtl8225.h"
+#include "r8180_93cx6.h"
+
+#include "ieee80211/dot11d.h"
+
+
+static void write_rtl8225(struct net_device *dev, u8 adr, u16 data)
+{
+	int i;
+	u16 out, select;
+	u8 bit;
+	u32 bangdata = (data << 4) | (adr & 0xf);
+
+	out = read_nic_word(dev, RFPinsOutput) & 0xfff3;
+
+	write_nic_word(dev, RFPinsEnable,
+		(read_nic_word(dev, RFPinsEnable) | 0x7));
+
+	select = read_nic_word(dev, RFPinsSelect);
+
+	write_nic_word(dev, RFPinsSelect, select | 0x7 |
+		       SW_CONTROL_GPIO);
+
+	force_pci_posting(dev);
+	udelay(10);
+
+	write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
+
+	force_pci_posting(dev);
+	udelay(2);
+
+	write_nic_word(dev, RFPinsOutput, out);
+
+	force_pci_posting(dev);
+	udelay(10);
+
+	for (i = 15; i >= 0; i--) {
+		bit = (bangdata & (1 << i)) >> i;
+
+		write_nic_word(dev, RFPinsOutput, bit | out);
+
+		write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
+		write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
+
+		i--;
+		bit = (bangdata & (1 << i)) >> i;
+
+		write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
+		write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
+
+		write_nic_word(dev, RFPinsOutput, bit | out);
+
+	}
+
+	write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
+
+	force_pci_posting(dev);
+	udelay(10);
+
+	write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
+
+	write_nic_word(dev, RFPinsSelect, select | SW_CONTROL_GPIO);
+
+	rtl8185_rf_pins_enable(dev);
+}
+
+static const u16 rtl8225bcd_rxgain[] = {
+	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
+	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
+	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
+	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
+	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
+	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
+	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
+	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
+	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
+	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
+	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
+	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
+
+};
+
+static const u8 rtl8225_agc[] = {
+	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e,
+	0x9d, 0x9c, 0x9b, 0x9a, 0x99, 0x98, 0x97, 0x96,
+	0x95, 0x94, 0x93, 0x92, 0x91, 0x90, 0x8f, 0x8e,
+	0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86,
+	0x85, 0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e,
+	0x3d, 0x3c, 0x3b, 0x3a, 0x39, 0x38, 0x37, 0x36,
+	0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f, 0x2e,
+	0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26,
+	0x25, 0x24, 0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e,
+	0x1d, 0x1c, 0x1b, 0x1a, 0x19, 0x18, 0x17, 0x16,
+	0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
+	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06,
+	0x05, 0x04, 0x03, 0x02, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+};
+
+static const u8 rtl8225_gain[] = {
+	0x23, 0x88, 0x7c, 0xa5,	/* -82dBm */
+	0x23, 0x88, 0x7c, 0xb5,	/* -82dBm */
+	0x23, 0x88, 0x7c, 0xc5,	/* -82dBm */
+	0x33, 0x80, 0x79, 0xc5,	/* -78dBm */
+	0x43, 0x78, 0x76, 0xc5,	/* -74dBm */
+	0x53, 0x60, 0x73, 0xc5,	/* -70dBm */
+	0x63, 0x58, 0x70, 0xc5,	/* -66dBm */
+};
+
+static const u8 rtl8225_tx_gain_cck_ofdm[] = {
+	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
+};
+
+static const u8 rtl8225_tx_power_cck[] = {
+	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
+	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
+	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
+	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
+	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
+	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
+};
+
+static const u8 rtl8225_tx_power_cck_ch14[] = {
+	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
+	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
+	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
+	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
+	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
+	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
+};
+
+static const u8 rtl8225_tx_power_ofdm[] = {
+	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
+};
+
+static const u32 rtl8225_chan[] = {
+	0,
+	0x0080, 0x0100, 0x0180, 0x0200, 0x0280, 0x0300, 0x0380,
+	0x0400, 0x0480, 0x0500, 0x0580, 0x0600, 0x0680, 0x074A,
+};
+
+static void rtl8225_SetTXPowerLevel(struct net_device *dev, short ch)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int GainIdx;
+	int GainSetting;
+	int i;
+	u8 power;
+	const u8 *cck_power_table;
+	u8 max_cck_power_level;
+	u8 max_ofdm_power_level;
+	u8 min_ofdm_power_level;
+	u8 cck_power_level = 0xff & priv->chtxpwr[ch];
+	u8 ofdm_power_level = 0xff & priv->chtxpwr_ofdm[ch];
+
+	max_cck_power_level = 35;
+	max_ofdm_power_level = 35;
+	min_ofdm_power_level = 0;
+
+	if (cck_power_level > max_cck_power_level)
+		cck_power_level = max_cck_power_level;
+
+	GainIdx = cck_power_level % 6;
+	GainSetting = cck_power_level / 6;
+
+	if (ch == 14)
+		cck_power_table = rtl8225_tx_power_cck_ch14;
+	else
+		cck_power_table = rtl8225_tx_power_cck;
+
+	write_nic_byte(dev, TX_GAIN_CCK,
+		       rtl8225_tx_gain_cck_ofdm[GainSetting] >> 1);
+
+	for (i = 0; i < 8; i++) {
+		power = cck_power_table[GainIdx * 8 + i];
+		write_phy_cck(dev, 0x44 + i, power);
+	}
+
+	/* FIXME Is this delay really needeed ? */
+	force_pci_posting(dev);
+	mdelay(1);
+
+	if (ofdm_power_level > (max_ofdm_power_level - min_ofdm_power_level))
+		ofdm_power_level = max_ofdm_power_level;
+	else
+		ofdm_power_level += min_ofdm_power_level;
+
+	if (ofdm_power_level > 35)
+		ofdm_power_level = 35;
+
+	GainIdx = ofdm_power_level % 6;
+	GainSetting = ofdm_power_level / 6;
+
+	rtl8185_set_anaparam2(dev, RTL8225_ANAPARAM2_ON);
+
+	write_phy_ofdm(dev, 2, 0x42);
+	write_phy_ofdm(dev, 6, 0x00);
+	write_phy_ofdm(dev, 8, 0x00);
+
+	write_nic_byte(dev, TX_GAIN_OFDM,
+		       rtl8225_tx_gain_cck_ofdm[GainSetting] >> 1);
+
+	power = rtl8225_tx_power_ofdm[GainIdx];
+
+	write_phy_ofdm(dev, 5, power);
+	write_phy_ofdm(dev, 7, power);
+
+	force_pci_posting(dev);
+	mdelay(1);
+}
+
+static const u8 rtl8225z2_threshold[] = {
+	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd,
+};
+
+static const u8 rtl8225z2_gain_bg[] = {
+	0x23, 0x15, 0xa5, /* -82-1dBm */
+	0x23, 0x15, 0xb5, /* -82-2dBm */
+	0x23, 0x15, 0xc5, /* -82-3dBm */
+	0x33, 0x15, 0xc5, /* -78dBm */
+	0x43, 0x15, 0xc5, /* -74dBm */
+	0x53, 0x15, 0xc5, /* -70dBm */
+	0x63, 0x15, 0xc5, /* -66dBm */
+};
+
+static const u8 rtl8225z2_gain_a[] = {
+	0x13, 0x27, 0x5a, /* -82dBm */
+	0x23, 0x23, 0x58, /* -82dBm */
+	0x33, 0x1f, 0x56, /* -82dBm */
+	0x43, 0x1b, 0x54, /* -78dBm */
+	0x53, 0x17, 0x51, /* -74dBm */
+	0x63, 0x24, 0x4f, /* -70dBm */
+	0x73, 0x0f, 0x4c, /* -66dBm */
+};
+
+static const u16 rtl8225z2_rxgain[] = {
+	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
+	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
+	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
+	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
+	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
+	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
+	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
+	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
+	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
+	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
+	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
+	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
+
+};
+
+static const u8 ZEBRA2_CCK_OFDM_GAIN_SETTING[] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
+	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
+	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+};
+
+static const u8 rtl8225z2_tx_power_ofdm[] = {
+	0x42, 0x00, 0x40, 0x00, 0x40
+};
+
+static const u8 rtl8225z2_tx_power_cck_ch14[] = {
+	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
+};
+
+static const u8 rtl8225z2_tx_power_cck[] = {
+	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
+};
+
+void rtl8225z2_set_gain(struct net_device *dev, short gain)
+{
+	const u8 *rtl8225_gain;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 mode = priv->ieee80211->mode;
+
+	if (mode == IEEE_B || mode == IEEE_G)
+		rtl8225_gain = rtl8225z2_gain_bg;
+	else
+		rtl8225_gain = rtl8225z2_gain_a;
+
+	write_phy_ofdm(dev, 0x0b, rtl8225_gain[gain * 3]);
+	write_phy_ofdm(dev, 0x1b, rtl8225_gain[gain * 3 + 1]);
+	write_phy_ofdm(dev, 0x1d, rtl8225_gain[gain * 3 + 2]);
+	write_phy_ofdm(dev, 0x21, 0x37);
+}
+
+static u32 read_rtl8225(struct net_device *dev, u8 adr)
+{
+	u32 data2Write = ((u32)(adr & 0x1f)) << 27;
+	u32 dataRead;
+	u32 mask;
+	u16 oval, oval2, oval3, tmp;
+	int i;
+	short bit, rw;
+	u8 wLength = 6;
+	u8 rLength = 12;
+	u8 low2high = 0;
+
+	oval = read_nic_word(dev, RFPinsOutput);
+	oval2 = read_nic_word(dev, RFPinsEnable);
+	oval3 = read_nic_word(dev, RFPinsSelect);
+
+	write_nic_word(dev, RFPinsEnable, (oval2|0xf));
+	write_nic_word(dev, RFPinsSelect, (oval3|0xf));
+
+	dataRead = 0;
+
+	oval &= ~0xf;
+
+	write_nic_word(dev, RFPinsOutput, oval | BB_HOST_BANG_EN);
+	udelay(4);
+
+	write_nic_word(dev, RFPinsOutput, oval);
+	udelay(5);
+
+	rw = 0;
+
+	mask = (low2high) ? 0x01 : (((u32)0x01)<<(32-1));
+
+	for (i = 0; i < wLength/2; i++) {
+		bit = ((data2Write&mask) != 0) ? 1 : 0;
+		write_nic_word(dev, RFPinsOutput, bit | oval | rw);
+		udelay(1);
+
+		write_nic_word(dev, RFPinsOutput,
+				bit | oval | BB_HOST_BANG_CLK | rw);
+		udelay(2);
+		write_nic_word(dev, RFPinsOutput,
+				bit | oval | BB_HOST_BANG_CLK | rw);
+		udelay(2);
+
+		mask = (low2high) ? (mask<<1) : (mask>>1);
+
+		if (i == 2) {
+			rw = BB_HOST_BANG_RW;
+			write_nic_word(dev, RFPinsOutput,
+					bit | oval | BB_HOST_BANG_CLK | rw);
+			udelay(2);
+			write_nic_word(dev, RFPinsOutput, bit | oval | rw);
+			udelay(2);
+			break;
+		}
+
+		bit = ((data2Write&mask) != 0) ? 1 : 0;
+
+		write_nic_word(dev, RFPinsOutput,
+				oval | bit | rw | BB_HOST_BANG_CLK);
+		udelay(2);
+		write_nic_word(dev, RFPinsOutput,
+				oval | bit | rw | BB_HOST_BANG_CLK);
+		udelay(2);
+
+		write_nic_word(dev, RFPinsOutput, oval | bit | rw);
+		udelay(1);
+
+		mask = (low2high) ? (mask<<1) : (mask>>1);
+	}
+
+	write_nic_word(dev, RFPinsOutput, rw|oval);
+	udelay(2);
+	mask = (low2high) ? 0x01 : (((u32)0x01) << (12-1));
+
+	/*
+	 * We must set data pin to HW controlled, otherwise RF can't driver it
+	 * and value RF register won't be able to read back properly.
+	 */
+	write_nic_word(dev, RFPinsEnable, (oval2 & (~0x01)));
+
+	for (i = 0; i < rLength; i++) {
+		write_nic_word(dev, RFPinsOutput, rw|oval); udelay(1);
+
+		write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
+		udelay(2);
+		write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
+		udelay(2);
+		write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
+		udelay(2);
+		tmp = read_nic_word(dev, RFPinsInput);
+
+		dataRead |= (tmp & BB_HOST_BANG_CLK ? mask : 0);
+
+		write_nic_word(dev, RFPinsOutput, (rw|oval)); udelay(2);
+
+		mask = (low2high) ? (mask<<1) : (mask>>1);
+	}
+
+	write_nic_word(dev, RFPinsOutput,
+			BB_HOST_BANG_EN | BB_HOST_BANG_RW | oval);
+	udelay(2);
+
+	write_nic_word(dev, RFPinsEnable, oval2);
+	write_nic_word(dev, RFPinsSelect, oval3); /* Set To SW Switch */
+	write_nic_word(dev, RFPinsOutput, 0x3a0);
+
+	return dataRead;
+}
+
+short rtl8225_is_V_z2(struct net_device *dev)
+{
+	short vz2 = 1;
+
+	if (read_rtl8225(dev, 8) != 0x588)
+		vz2 = 0;
+	else	/* reg 9 pg 1 = 24 */
+		if (read_rtl8225(dev, 9) != 0x700)
+			vz2 = 0;
+
+	/* sw back to pg 0 */
+	write_rtl8225(dev, 0, 0xb7);
+
+	return vz2;
+}
+
+void rtl8225z2_rf_close(struct net_device *dev)
+{
+	RF_WriteReg(dev, 0x4, 0x1f);
+
+	force_pci_posting(dev);
+	mdelay(1);
+
+	rtl8180_set_anaparam(dev, RTL8225z2_ANAPARAM_OFF);
+	rtl8185_set_anaparam2(dev, RTL8225z2_ANAPARAM2_OFF);
+}
+
+/*
+ * Map dBm into Tx power index according to current HW model, for example,
+ * RF and PA, and current wireless mode.
+ */
+s8 DbmToTxPwrIdx(struct r8180_priv *priv, WIRELESS_MODE WirelessMode,
+		 s32 PowerInDbm)
+{
+	bool bUseDefault = true;
+	s8 TxPwrIdx = 0;
+
+	/*
+	 * OFDM Power in dBm = Index * 0.5 + 0
+	 * CCK Power in dBm = Index * 0.25 + 13
+	 */
+	s32 tmp = 0;
+
+	if (WirelessMode == WIRELESS_MODE_G) {
+		bUseDefault = false;
+		tmp = (2 * PowerInDbm);
+
+		if (tmp < 0)
+			TxPwrIdx = 0;
+		else if (tmp > 40) /* 40 means 20 dBm. */
+			TxPwrIdx = 40;
+		else
+			TxPwrIdx = (s8)tmp;
+	} else if (WirelessMode == WIRELESS_MODE_B) {
+		bUseDefault = false;
+		tmp = (4 * PowerInDbm) - 52;
+
+		if (tmp < 0)
+			TxPwrIdx = 0;
+		else if (tmp > 28) /* 28 means 20 dBm. */
+			TxPwrIdx = 28;
+		else
+			TxPwrIdx = (s8)tmp;
+	}
+
+	/*
+	 * TRUE if we want to use a default implementation.
+	 * We shall set it to FALSE when we have exact translation formular
+	 * for target IC. 070622, by rcnjko.
+	 */
+	if (bUseDefault) {
+		if (PowerInDbm < 0)
+			TxPwrIdx = 0;
+		else if (PowerInDbm > 35)
+			TxPwrIdx = 35;
+		else
+			TxPwrIdx = (u8)PowerInDbm;
+	}
+
+	return TxPwrIdx;
+}
+
+void rtl8225z2_SetTXPowerLevel(struct net_device *dev, short ch)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 max_cck_power_level;
+	u8 max_ofdm_power_level;
+	u8 min_ofdm_power_level;
+	char cck_power_level = (char)(0xff & priv->chtxpwr[ch]);
+	char ofdm_power_level = (char)(0xff & priv->chtxpwr_ofdm[ch]);
+
+	if (IS_DOT11D_ENABLE(priv->ieee80211) &&
+	    IS_DOT11D_STATE_DONE(priv->ieee80211)) {
+		u8 MaxTxPwrInDbm = DOT11D_GetMaxTxPwrInDbm(priv->ieee80211, ch);
+		u8 CckMaxPwrIdx = DbmToTxPwrIdx(priv, WIRELESS_MODE_B,
+							MaxTxPwrInDbm);
+		u8 OfdmMaxPwrIdx = DbmToTxPwrIdx(priv, WIRELESS_MODE_G,
+							MaxTxPwrInDbm);
+
+		if (cck_power_level > CckMaxPwrIdx)
+			cck_power_level = CckMaxPwrIdx;
+		if (ofdm_power_level > OfdmMaxPwrIdx)
+			ofdm_power_level = OfdmMaxPwrIdx;
+	}
+
+	max_cck_power_level = 15;
+	max_ofdm_power_level = 25;
+	min_ofdm_power_level = 10;
+
+	if (cck_power_level > 35)
+		cck_power_level = 35;
+
+	write_nic_byte(dev, CCK_TXAGC,
+		       (ZEBRA2_CCK_OFDM_GAIN_SETTING[(u8)cck_power_level]));
+	force_pci_posting(dev);
+	mdelay(1);
+
+	if (ofdm_power_level > 35)
+		ofdm_power_level = 35;
+
+	if (priv->up == 0) {
+		write_phy_ofdm(dev, 2, 0x42);
+		write_phy_ofdm(dev, 5, 0x00);
+		write_phy_ofdm(dev, 6, 0x40);
+		write_phy_ofdm(dev, 7, 0x00);
+		write_phy_ofdm(dev, 8, 0x40);
+	}
+
+	write_nic_byte(dev, OFDM_TXAGC,
+		       ZEBRA2_CCK_OFDM_GAIN_SETTING[(u8)ofdm_power_level]);
+
+	if (ofdm_power_level <= 11) {
+		write_phy_ofdm(dev, 0x07, 0x5c);
+		write_phy_ofdm(dev, 0x09, 0x5c);
+	}
+
+	if (ofdm_power_level <= 17) {
+		write_phy_ofdm(dev, 0x07, 0x54);
+		write_phy_ofdm(dev, 0x09, 0x54);
+	} else {
+		write_phy_ofdm(dev, 0x07, 0x50);
+		write_phy_ofdm(dev, 0x09, 0x50);
+	}
+
+	force_pci_posting(dev);
+	mdelay(1);
+}
+
+void rtl8225z2_rf_set_chan(struct net_device *dev, short ch)
+{
+	rtl8225z2_SetTXPowerLevel(dev, ch);
+
+	RF_WriteReg(dev, 0x7, rtl8225_chan[ch]);
+
+	if ((RF_ReadReg(dev, 0x7) & 0x0F80) != rtl8225_chan[ch])
+		RF_WriteReg(dev, 0x7, rtl8225_chan[ch]);
+
+	mdelay(1);
+
+	force_pci_posting(dev);
+	mdelay(10);
+}
+
+static void rtl8225_host_pci_init(struct net_device *dev)
+{
+	write_nic_word(dev, RFPinsOutput, 0x480);
+
+	rtl8185_rf_pins_enable(dev);
+
+	write_nic_word(dev, RFPinsSelect, 0x88 | SW_CONTROL_GPIO);
+
+	write_nic_byte(dev, GP_ENABLE, 0);
+
+	force_pci_posting(dev);
+	mdelay(200);
+
+	/* bit 6 is for RF on/off detection */
+	write_nic_word(dev, GP_ENABLE, 0xff & (~(1 << 6)));
+}
+
+static void rtl8225_rf_set_chan(struct net_device *dev, short ch)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	short gset = (priv->ieee80211->state == IEEE80211_LINKED &&
+		ieee80211_is_54g(&priv->ieee80211->current_network)) ||
+		priv->ieee80211->iw_mode == IW_MODE_MONITOR;
+
+	rtl8225_SetTXPowerLevel(dev, ch);
+
+	write_rtl8225(dev, 0x7, rtl8225_chan[ch]);
+
+	force_pci_posting(dev);
+	mdelay(10);
+
+	if (gset) {
+		write_nic_byte(dev, SIFS, 0x22);
+		write_nic_byte(dev, DIFS, 0x14);
+	} else {
+		write_nic_byte(dev, SIFS, 0x44);
+		write_nic_byte(dev, DIFS, 0x24);
+	}
+
+	if (priv->ieee80211->state == IEEE80211_LINKED &&
+	    ieee80211_is_shortslot(&priv->ieee80211->current_network))
+		write_nic_byte(dev, SLOT, 0x9);
+	else
+		write_nic_byte(dev, SLOT, 0x14);
+
+	if (gset) {
+		write_nic_byte(dev, EIFS, 81);
+		write_nic_byte(dev, CW_VAL, 0x73);
+	} else {
+		write_nic_byte(dev, EIFS, 81);
+		write_nic_byte(dev, CW_VAL, 0xa5);
+	}
+}
+
+void rtl8225z2_rf_init(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int i;
+	short channel = 1;
+	u16	brsr;
+	u32	data, addr;
+
+	priv->chan = channel;
+
+	rtl8225_host_pci_init(dev);
+
+	write_nic_dword(dev, RF_TIMING, 0x000a8008);
+
+	brsr = read_nic_word(dev, BRSR);
+
+	write_nic_word(dev, BRSR, 0xffff);
+
+	write_nic_dword(dev, RF_PARA, 0x100044);
+
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	write_nic_byte(dev, CONFIG3, 0x44);
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
+
+	rtl8185_rf_pins_enable(dev);
+
+	write_rtl8225(dev, 0x0, 0x2bf); mdelay(1);
+	write_rtl8225(dev, 0x1, 0xee0); mdelay(1);
+	write_rtl8225(dev, 0x2, 0x44d); mdelay(1);
+	write_rtl8225(dev, 0x3, 0x441); mdelay(1);
+	write_rtl8225(dev, 0x4, 0x8c3); mdelay(1);
+	write_rtl8225(dev, 0x5, 0xc72); mdelay(1);
+	write_rtl8225(dev, 0x6, 0xe6);  mdelay(1);
+	write_rtl8225(dev, 0x7, rtl8225_chan[channel]);  mdelay(1);
+	write_rtl8225(dev, 0x8, 0x3f);  mdelay(1);
+	write_rtl8225(dev, 0x9, 0x335); mdelay(1);
+	write_rtl8225(dev, 0xa, 0x9d4); mdelay(1);
+	write_rtl8225(dev, 0xb, 0x7bb); mdelay(1);
+	write_rtl8225(dev, 0xc, 0x850); mdelay(1);
+	write_rtl8225(dev, 0xd, 0xcdf); mdelay(1);
+	write_rtl8225(dev, 0xe, 0x2b);  mdelay(1);
+	write_rtl8225(dev, 0xf, 0x114);
+
+	mdelay(100);
+
+	write_rtl8225(dev, 0x0, 0x1b7);
+
+	for (i = 0; i < 95; i++) {
+		write_rtl8225(dev, 0x1, (u8)(i + 1));
+		write_rtl8225(dev, 0x2, rtl8225z2_rxgain[i]);
+	}
+
+	write_rtl8225(dev, 0x3, 0x80);
+	write_rtl8225(dev, 0x5, 0x4);
+
+	write_rtl8225(dev, 0x0, 0xb7);
+
+	write_rtl8225(dev, 0x2, 0xc4d);
+
+	/* FIXME!! rtl8187 we have to check if calibrarion
+	 * is successful and eventually cal. again (repeat
+	 * the two write on reg 2)
+	 */
+	data = read_rtl8225(dev, 6);
+	if (!(data & 0x00000080)) {
+		write_rtl8225(dev, 0x02, 0x0c4d);
+		force_pci_posting(dev); mdelay(200);
+		write_rtl8225(dev, 0x02, 0x044d);
+		force_pci_posting(dev); mdelay(100);
+		data = read_rtl8225(dev, 6);
+		if (!(data & 0x00000080))
+			DMESGW("RF Calibration Failed!!!!\n");
+	}
+
+	mdelay(200);
+
+	write_rtl8225(dev, 0x0, 0x2bf);
+
+	for (i = 0; i < 128; i++) {
+		data = rtl8225_agc[i];
+
+		addr = i + 0x80; /* enable writing AGC table */
+		write_phy_ofdm(dev, 0xb, data);
+		mdelay(1);
+
+		write_phy_ofdm(dev, 0xa, addr);
+		mdelay(1);
+	}
+
+	force_pci_posting(dev);
+	mdelay(1);
+
+	write_phy_ofdm(dev, 0x00, 0x01); mdelay(1);
+	write_phy_ofdm(dev, 0x01, 0x02); mdelay(1);
+	write_phy_ofdm(dev, 0x02, 0x62); mdelay(1);
+	write_phy_ofdm(dev, 0x03, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x04, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x05, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x06, 0x40); mdelay(1);
+	write_phy_ofdm(dev, 0x07, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x08, 0x40); mdelay(1);
+	write_phy_ofdm(dev, 0x09, 0xfe); mdelay(1);
+	write_phy_ofdm(dev, 0x0a, 0x08); mdelay(1);
+	write_phy_ofdm(dev, 0x0b, 0x80); mdelay(1);
+	write_phy_ofdm(dev, 0x0c, 0x01); mdelay(1);
+	write_phy_ofdm(dev, 0x0d, 0x43);
+	write_phy_ofdm(dev, 0x0e, 0xd3); mdelay(1);
+	write_phy_ofdm(dev, 0x0f, 0x38); mdelay(1);
+	write_phy_ofdm(dev, 0x10, 0x84); mdelay(1);
+	write_phy_ofdm(dev, 0x11, 0x07); mdelay(1);
+	write_phy_ofdm(dev, 0x12, 0x20); mdelay(1);
+	write_phy_ofdm(dev, 0x13, 0x20); mdelay(1);
+	write_phy_ofdm(dev, 0x14, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x15, 0x40); mdelay(1);
+	write_phy_ofdm(dev, 0x16, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x17, 0x40); mdelay(1);
+	write_phy_ofdm(dev, 0x18, 0xef); mdelay(1);
+	write_phy_ofdm(dev, 0x19, 0x19); mdelay(1);
+	write_phy_ofdm(dev, 0x1a, 0x20); mdelay(1);
+	write_phy_ofdm(dev, 0x1b, 0x15); mdelay(1);
+	write_phy_ofdm(dev, 0x1c, 0x04); mdelay(1);
+	write_phy_ofdm(dev, 0x1d, 0xc5); mdelay(1);
+	write_phy_ofdm(dev, 0x1e, 0x95); mdelay(1);
+	write_phy_ofdm(dev, 0x1f, 0x75); mdelay(1);
+	write_phy_ofdm(dev, 0x20, 0x1f); mdelay(1);
+	write_phy_ofdm(dev, 0x21, 0x17); mdelay(1);
+	write_phy_ofdm(dev, 0x22, 0x16); mdelay(1);
+	write_phy_ofdm(dev, 0x23, 0x80); mdelay(1); /* FIXME maybe not needed */
+	write_phy_ofdm(dev, 0x24, 0x46); mdelay(1);
+	write_phy_ofdm(dev, 0x25, 0x00); mdelay(1);
+	write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);
+	write_phy_ofdm(dev, 0x27, 0x88); mdelay(1);
+
+	rtl8225z2_set_gain(dev, 4);
+
+	write_phy_cck(dev, 0x0, 0x98); mdelay(1);
+	write_phy_cck(dev, 0x3, 0x20); mdelay(1);
+	write_phy_cck(dev, 0x4, 0x7e); mdelay(1);
+	write_phy_cck(dev, 0x5, 0x12); mdelay(1);
+	write_phy_cck(dev, 0x6, 0xfc); mdelay(1);
+	write_phy_cck(dev, 0x7, 0x78); mdelay(1);
+	write_phy_cck(dev, 0x8, 0x2e); mdelay(1);
+	write_phy_cck(dev, 0x10, 0x93); mdelay(1);
+	write_phy_cck(dev, 0x11, 0x88); mdelay(1);
+	write_phy_cck(dev, 0x12, 0x47); mdelay(1);
+	write_phy_cck(dev, 0x13, 0xd0);
+	write_phy_cck(dev, 0x19, 0x00);
+	write_phy_cck(dev, 0x1a, 0xa0);
+	write_phy_cck(dev, 0x1b, 0x08);
+	write_phy_cck(dev, 0x40, 0x86); /* CCK Carrier Sense Threshold */
+	write_phy_cck(dev, 0x41, 0x8d); mdelay(1);
+	write_phy_cck(dev, 0x42, 0x15); mdelay(1);
+	write_phy_cck(dev, 0x43, 0x18); mdelay(1);
+	write_phy_cck(dev, 0x44, 0x36); mdelay(1);
+	write_phy_cck(dev, 0x45, 0x35); mdelay(1);
+	write_phy_cck(dev, 0x46, 0x2e); mdelay(1);
+	write_phy_cck(dev, 0x47, 0x25); mdelay(1);
+	write_phy_cck(dev, 0x48, 0x1c); mdelay(1);
+	write_phy_cck(dev, 0x49, 0x12); mdelay(1);
+	write_phy_cck(dev, 0x4a, 0x09); mdelay(1);
+	write_phy_cck(dev, 0x4b, 0x04); mdelay(1);
+	write_phy_cck(dev, 0x4c, 0x05); mdelay(1);
+
+	write_nic_byte(dev, 0x5b, 0x0d); mdelay(1);
+
+	rtl8225z2_SetTXPowerLevel(dev, channel);
+
+	/* RX antenna default to A */
+	write_phy_cck(dev, 0x11, 0x9b); mdelay(1);		/* B: 0xDB */
+	write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);		/* B: 0x10 */
+
+	rtl8185_tx_antenna(dev, 0x03);				/* B: 0x00 */
+
+	/* switch to high-speed 3-wire
+	 * last digit. 2 for both cck and ofdm
+	 */
+	write_nic_dword(dev, 0x94, 0x15c00002);
+	rtl8185_rf_pins_enable(dev);
+
+	rtl8225_rf_set_chan(dev, priv->chan);
+}
+
+void rtl8225z2_rf_set_mode(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->mode == IEEE_A) {
+		write_rtl8225(dev, 0x5, 0x1865);
+		write_nic_dword(dev, RF_PARA, 0x10084);
+		write_nic_dword(dev, RF_TIMING, 0xa8008);
+		write_phy_ofdm(dev, 0x0, 0x0);
+		write_phy_ofdm(dev, 0xa, 0x6);
+		write_phy_ofdm(dev, 0xb, 0x99);
+		write_phy_ofdm(dev, 0xf, 0x20);
+		write_phy_ofdm(dev, 0x11, 0x7);
+
+		rtl8225z2_set_gain(dev, 4);
+
+		write_phy_ofdm(dev, 0x15, 0x40);
+		write_phy_ofdm(dev, 0x17, 0x40);
+
+		write_nic_dword(dev, 0x94, 0x10000000);
+	} else {
+		write_rtl8225(dev, 0x5, 0x1864);
+		write_nic_dword(dev, RF_PARA, 0x10044);
+		write_nic_dword(dev, RF_TIMING, 0xa8008);
+		write_phy_ofdm(dev, 0x0, 0x1);
+		write_phy_ofdm(dev, 0xa, 0x6);
+		write_phy_ofdm(dev, 0xb, 0x99);
+		write_phy_ofdm(dev, 0xf, 0x20);
+		write_phy_ofdm(dev, 0x11, 0x7);
+
+		rtl8225z2_set_gain(dev, 4);
+
+		write_phy_ofdm(dev, 0x15, 0x40);
+		write_phy_ofdm(dev, 0x17, 0x40);
+
+		write_nic_dword(dev, 0x94, 0x04000002);
+	}
+}
+
+#define MAX_DOZE_WAITING_TIMES_85B		20
+#define MAX_POLLING_24F_TIMES_87SE		10
+#define LPS_MAX_SLEEP_WAITING_TIMES_87SE	5
+
+bool SetZebraRFPowerState8185(struct net_device *dev,
+			      RT_RF_POWER_STATE eRFPowerState)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8			btCR9346, btConfig3;
+	bool bActionAllowed = true, bTurnOffBB = true;
+	u8			u1bTmp;
+	int			i;
+	bool		bResult = true;
+	u8			QueueID;
+
+	if (priv->SetRFPowerStateInProgress == true)
+		return false;
+
+	priv->SetRFPowerStateInProgress = true;
+
+	btCR9346 = read_nic_byte(dev, CR9346);
+	write_nic_byte(dev, CR9346, (btCR9346 | 0xC0));
+
+	btConfig3 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, (btConfig3 | CONFIG3_PARM_En));
+
+	switch (eRFPowerState) {
+	case eRfOn:
+		write_nic_word(dev, 0x37C, 0x00EC);
+
+		/* turn on AFE */
+		write_nic_byte(dev, 0x54, 0x00);
+		write_nic_byte(dev, 0x62, 0x00);
+
+		/* turn on RF */
+		RF_WriteReg(dev, 0x0, 0x009f); udelay(500);
+		RF_WriteReg(dev, 0x4, 0x0972); udelay(500);
+
+		/* turn on RF again */
+		RF_WriteReg(dev, 0x0, 0x009f); udelay(500);
+		RF_WriteReg(dev, 0x4, 0x0972); udelay(500);
+
+		/* turn on BB */
+		write_phy_ofdm(dev, 0x10, 0x40);
+		write_phy_ofdm(dev, 0x12, 0x40);
+
+		/* Avoid power down at init time. */
+		write_nic_byte(dev, CONFIG4, priv->RFProgType);
+
+		u1bTmp = read_nic_byte(dev, 0x24E);
+		write_nic_byte(dev, 0x24E, (u1bTmp & (~(BIT5 | BIT6))));
+		break;
+	case eRfSleep:
+		for (QueueID = 0, i = 0; QueueID < 6;) {
+			if (get_curr_tx_free_desc(dev, QueueID) ==
+							priv->txringcount) {
+				QueueID++;
+				continue;
+			} else {
+				priv->TxPollingTimes++;
+				if (priv->TxPollingTimes >=
+					LPS_MAX_SLEEP_WAITING_TIMES_87SE) {
+					bActionAllowed = false;
+					break;
+				} else
+					udelay(10);
+			}
+		}
+
+		if (bActionAllowed) {
+			/* turn off BB RXIQ matrix to cut off rx signal */
+			write_phy_ofdm(dev, 0x10, 0x00);
+			write_phy_ofdm(dev, 0x12, 0x00);
+
+			/* turn off RF */
+			RF_WriteReg(dev, 0x4, 0x0000);
+			RF_WriteReg(dev, 0x0, 0x0000);
+
+			/* turn off AFE except PLL */
+			write_nic_byte(dev, 0x62, 0xff);
+			write_nic_byte(dev, 0x54, 0xec);
+
+			mdelay(1);
+
+			{
+				int i = 0;
+				while (true) {
+					u8 tmp24F = read_nic_byte(dev, 0x24f);
+
+					if ((tmp24F == 0x01) ||
+							(tmp24F == 0x09)) {
+						bTurnOffBB = true;
+						break;
+					} else {
+						udelay(10);
+						i++;
+						priv->TxPollingTimes++;
+
+						if (priv->TxPollingTimes >= LPS_MAX_SLEEP_WAITING_TIMES_87SE) {
+							bTurnOffBB = false;
+							break;
+						} else
+							udelay(10);
+					}
+				}
+			}
+
+			if (bTurnOffBB) {
+				/* turn off BB */
+				u1bTmp = read_nic_byte(dev, 0x24E);
+				write_nic_byte(dev, 0x24E,
+						(u1bTmp | BIT5 | BIT6));
+
+				/* turn off AFE PLL */
+				write_nic_byte(dev, 0x54, 0xFC);
+				write_nic_word(dev, 0x37C, 0x00FC);
+			}
+		}
+		break;
+	case eRfOff:
+		for (QueueID = 0, i = 0; QueueID < 6;) {
+			if (get_curr_tx_free_desc(dev, QueueID) ==
+					priv->txringcount) {
+				QueueID++;
+				continue;
+			} else {
+				udelay(10);
+				i++;
+			}
+
+			if (i >= MAX_DOZE_WAITING_TIMES_85B)
+				break;
+		}
+
+		/* turn off BB RXIQ matrix to cut off rx signal */
+		write_phy_ofdm(dev, 0x10, 0x00);
+		write_phy_ofdm(dev, 0x12, 0x00);
+
+		/* turn off RF */
+		RF_WriteReg(dev, 0x4, 0x0000);
+		RF_WriteReg(dev, 0x0, 0x0000);
+
+		/* turn off AFE except PLL */
+		write_nic_byte(dev, 0x62, 0xff);
+		write_nic_byte(dev, 0x54, 0xec);
+
+		mdelay(1);
+
+		{
+			int i = 0;
+
+			while (true) {
+				u8 tmp24F = read_nic_byte(dev, 0x24f);
+
+				if ((tmp24F == 0x01) || (tmp24F == 0x09)) {
+					bTurnOffBB = true;
+					break;
+				} else {
+					bTurnOffBB = false;
+					udelay(10);
+					i++;
+				}
+
+				if (i > MAX_POLLING_24F_TIMES_87SE)
+					break;
+			}
+		}
+
+		if (bTurnOffBB) {
+			/* turn off BB */
+			u1bTmp = read_nic_byte(dev, 0x24E);
+			write_nic_byte(dev, 0x24E, (u1bTmp | BIT5 | BIT6));
+
+			/* turn off AFE PLL (80M) */
+			write_nic_byte(dev, 0x54, 0xFC);
+			write_nic_word(dev, 0x37C, 0x00FC);
+		}
+		break;
+	}
+
+	btConfig3 &= ~(CONFIG3_PARM_En);
+	write_nic_byte(dev, CONFIG3, btConfig3);
+
+	btCR9346 &= ~(0xC0);
+	write_nic_byte(dev, CR9346, btCR9346);
+
+	if (bResult && bActionAllowed)
+		priv->eRFPowerState = eRFPowerState;
+
+	priv->SetRFPowerStateInProgress = false;
+
+	return bResult && bActionAllowed;
+}
+
+void rtl8225z4_rf_sleep(struct net_device *dev)
+{
+	MgntActSet_RF_State(dev, eRfSleep, RF_CHANGE_BY_PS);
+}
+
+void rtl8225z4_rf_wakeup(struct net_device *dev)
+{
+	MgntActSet_RF_State(dev, eRfOn, RF_CHANGE_BY_PS);
+}
diff --git a/drivers/staging/rtl8187se/r8180_wx.c b/drivers/staging/rtl8187se/r8180_wx.c
new file mode 100644
index 00000000..303ec691
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_wx.c
@@ -0,0 +1,1411 @@
+/*
+	This file contains wireless extension handlers.
+
+	This is part of rtl8180 OpenSource driver.
+	Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part
+	of the official realtek driver.
+
+	Parts of this driver are based on the rtl8180 driver skeleton
+	from Patric Schenke & Andres Salomon.
+
+	Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
+
+	We want to tanks the Authors of those projects and the Ndiswrapper
+	project Authors.
+*/
+
+
+#include "r8180.h"
+#include "r8180_hw.h"
+
+#include "ieee80211/dot11d.h"
+
+u32 rtl8180_rates[] = {1000000, 2000000, 5500000, 11000000,
+	6000000, 9000000, 12000000, 18000000, 24000000, 36000000, 48000000, 54000000};
+
+#define RATE_COUNT ARRAY_SIZE(rtl8180_rates)
+
+static CHANNEL_LIST DefaultChannelPlan[] = {
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 36, 40, 44, 48, 52, 56, 60, 64}, 19},		/* FCC */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},						/* IC */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},	/* ETSI	*/
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},	/* Spain. Change to ETSI. */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},	/* France. Change to ETSI. */
+	{{14, 36, 40, 44, 48, 52, 56, 60, 64}, 9},						/* MKK */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 36, 40, 44, 48, 52, 56, 60, 64}, 22},	/* MKK1	*/
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},	/* Israel */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 34, 38, 42, 46}, 17},			/* For 11a , TELEC */
+	{{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14}					/* For Global Domain. 1-11:active scan, 12-14 passive scan.*/	/* +YJ, 080626 */
+};
+static int r8180_wx_get_freq(struct net_device *dev,
+			     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_freq(priv->ieee80211, a, wrqu, b);
+}
+
+
+int r8180_wx_set_key(struct net_device *dev, struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *key)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct iw_point *erq = &(wrqu->encoding);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	if (erq->flags & IW_ENCODE_DISABLED)
+
+	if (erq->length > 0) {
+		u32* tkey = (u32*) key;
+		priv->key0[0] = tkey[0];
+		priv->key0[1] = tkey[1];
+		priv->key0[2] = tkey[2];
+		priv->key0[3] = tkey[3] & 0xff;
+		DMESG("Setting wep key to %x %x %x %x",
+		      tkey[0], tkey[1], tkey[2], tkey[3]);
+		rtl8180_set_hw_wep(dev);
+	}
+	return 0;
+}
+
+
+static int r8180_wx_set_beaconinterval(struct net_device *dev, struct iw_request_info *aa,
+			  union iwreq_data *wrqu, char *b)
+{
+	int *parms = (int *)b;
+	int bi = parms[0];
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	DMESG("setting beacon interval to %x", bi);
+
+	priv->ieee80211->current_network.beacon_interval = bi;
+	rtl8180_commit(dev);
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+
+
+static int r8180_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_mode(priv->ieee80211, a, wrqu, b);
+}
+
+
+
+static int r8180_wx_get_rate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_rate(priv->ieee80211, info, wrqu, extra);
+}
+
+
+
+static int r8180_wx_set_rate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_rate(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+static int r8180_wx_set_crcmon(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int *parms = (int *)extra;
+	int enable = (parms[0] > 0);
+	short prev = priv->crcmon;
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	if (enable)
+		priv->crcmon = 1;
+	else
+		priv->crcmon = 0;
+
+	DMESG("bad CRC in monitor mode are %s",
+	      priv->crcmon ? "accepted" : "rejected");
+
+	if (prev != priv->crcmon && priv->up)	{
+		rtl8180_down(dev);
+		rtl8180_up(dev);
+	}
+
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+
+static int r8180_wx_set_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	if (priv->bInactivePs)	{
+		if (wrqu->mode == IW_MODE_ADHOC)
+			IPSLeave(dev);
+	}
+	ret = ieee80211_wx_set_mode(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+/* YJ,add,080819,for hidden ap */
+struct  iw_range_with_scan_capa	{
+		/* Informative stuff (to choose between different interface) */
+
+		__u32		throughput; /* To give an idea... */
+
+		/* In theory this value should be the maximum benchmarked
+		 * TCP/IP throughput, because with most of these devices the
+		 * bit rate is meaningless (overhead an co) to estimate how
+		 * fast the connection will go and pick the fastest one.
+		 * I suggest people to play with Netperf or any benchmark...
+		 */
+
+		/* NWID (or domain id)	*/
+		__u32           min_nwid; /* Minimal NWID we are able to set */
+		__u32			max_nwid; /* Maximal NWID we are able to set */
+
+		/* Old Frequency (backward compat - moved lower ) */
+		__u16			old_num_channels;
+		__u8			old_num_frequency;
+
+		/* Scan capabilities */
+		__u8			scan_capa;
+};
+/* YJ,add,080819,for hidden ap */
+
+
+static int rtl8180_wx_get_range(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u16 val;
+	int i;
+
+	wrqu->data.length = sizeof(*range);
+	memset(range, 0, sizeof(*range));
+
+	/* Let's try to keep this struct in the same order as in
+	 * linux/include/wireless.h
+	 */
+
+	/* TODO: See what values we can set, and remove the ones we can't
+	 * set, or fill them with some default data.
+	 */
+
+	/* ~5 Mb/s real (802.11b) */
+	range->throughput = 5 * 1000 * 1000;
+
+	/* TODO: Not used in 802.11b?	*/
+/*	range->min_nwid; */	/* Minimal NWID we are able to set */
+	/* TODO: Not used in 802.11b?	*/
+/*	range->max_nwid; */	/* Maximal NWID we are able to set */
+
+		/* Old Frequency (backward compat - moved lower ) */
+/*	range->old_num_channels; */
+/*	range->old_num_frequency; */
+/*	range->old_freq[6]; */ /* Filler to keep "version" at the same offset */
+	if (priv->rf_set_sens != NULL)
+		range->sensitivity = priv->max_sens;	/* signal level threshold range */
+
+	range->max_qual.qual = 100;
+	/* TODO: Find real max RSSI and stick here */
+	range->max_qual.level = 0;
+	range->max_qual.noise = -98;
+	range->max_qual.updated = 7; /* Updated all three */
+
+	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
+	range->avg_qual.level = 20 + -98;
+	range->avg_qual.noise = 0;
+	range->avg_qual.updated = 7; /* Updated all three */
+
+	range->num_bitrates = RATE_COUNT;
+
+	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++)
+		range->bitrate[i] = rtl8180_rates[i];
+
+	range->min_frag = MIN_FRAG_THRESHOLD;
+	range->max_frag = MAX_FRAG_THRESHOLD;
+
+	range->pm_capa = 0;
+
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 16;
+
+		range->num_channels = 14;
+
+	for (i = 0, val = 0; i < 14; i++) {
+
+		/* Include only legal frequencies for some countries */
+		if ((GET_DOT11D_INFO(priv->ieee80211)->channel_map)[i+1]) {
+				range->freq[val].i = i + 1;
+			range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000;
+			range->freq[val].e = 1;
+			val++;
+		} else {
+			/* FIXME: do we need to set anything for channels */
+			/* we don't use ? */
+		}
+
+		if (val == IW_MAX_FREQUENCIES)
+		break;
+	}
+
+	range->num_frequency = val;
+	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
+						IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
+
+	return 0;
+}
+
+
+static int r8180_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+	struct ieee80211_device* ieee = priv->ieee80211;
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	if (wrqu->data.flags & IW_SCAN_THIS_ESSID)	{
+		struct iw_scan_req* req = (struct iw_scan_req*)b;
+		if (req->essid_len)		{
+			ieee->current_network.ssid_len = req->essid_len;
+			memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
+		}
+	}
+
+	down(&priv->wx_sem);
+	if (priv->up)	{
+		priv->ieee80211->actscanning = true;
+		if (priv->bInactivePs && (priv->ieee80211->state != IEEE80211_LINKED))	{
+			IPSLeave(dev);
+		ieee80211_softmac_ips_scan_syncro(priv->ieee80211);
+			ret = 0;
+		}	else	{
+			/* prevent scan in BusyTraffic */
+			/* FIXME: Need to consider last scan time */
+			if ((priv->link_detect.bBusyTraffic) && (true))	{
+				ret = 0;
+				printk("Now traffic is busy, please try later!\n");
+			}	else
+				/* prevent scan in BusyTraffic,end */
+				ret = ieee80211_wx_set_scan(priv->ieee80211, a, wrqu, b);
+		}
+	}	else
+			ret = -1;
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+static int r8180_wx_get_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+	if (priv->up)
+		ret = ieee80211_wx_get_scan(priv->ieee80211, a, wrqu, b);
+	else
+		ret = -1;
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+
+static int r8180_wx_set_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *b)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	int ret;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	if (priv->bInactivePs)
+		IPSLeave(dev);
+
+	ret = ieee80211_wx_set_essid(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+
+static int r8180_wx_get_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_get_essid(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+static int r8180_wx_set_freq(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_freq(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+
+static int r8180_wx_get_name(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_name(priv->ieee80211, info, wrqu, extra);
+}
+
+static int r8180_wx_set_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	if (wrqu->frag.disabled)
+		priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
+	else {
+		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
+		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
+			return -EINVAL;
+
+		priv->ieee80211->fts = wrqu->frag.value & ~0x1;
+	}
+
+	return 0;
+}
+
+
+static int r8180_wx_get_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	wrqu->frag.value = priv->ieee80211->fts;
+	wrqu->frag.fixed = 0;	/* no auto select */
+	wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FRAG_THRESHOLD);
+
+	return 0;
+}
+
+
+static int r8180_wx_set_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_wap(priv->ieee80211, info, awrq, extra);
+
+	up(&priv->wx_sem);
+	return ret;
+
+}
+
+
+static int r8180_wx_get_wap(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_wap(priv->ieee80211, info, wrqu, extra);
+}
+
+
+static int r8180_wx_set_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *key)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+
+	down(&priv->wx_sem);
+
+	if (priv->hw_wep) ret = r8180_wx_set_key(dev, info, wrqu, key);
+	else	{
+		DMESG("Setting SW wep key");
+		ret = ieee80211_wx_set_encode(priv->ieee80211, info, wrqu, key);
+	}
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+
+static int r8180_wx_get_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *key)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_encode(priv->ieee80211, info, wrqu, key);
+}
+
+
+static int r8180_wx_set_scan_type(struct net_device *dev, struct iw_request_info *aa, union
+	iwreq_data *wrqu, char *p)	{
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int *parms = (int*)p;
+	int mode = parms[0];
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	priv->ieee80211->active_scan = mode;
+
+	return 1;
+}
+
+static int r8180_wx_set_retry(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int err = 0;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	if (wrqu->retry.flags & IW_RETRY_LIFETIME ||
+	    wrqu->retry.disabled)	{
+		err = -EINVAL;
+		goto exit;
+	}
+	if (!(wrqu->retry.flags & IW_RETRY_LIMIT))	{
+		err = -EINVAL;
+		goto exit;
+	}
+
+	if (wrqu->retry.value > R8180_MAX_RETRY)	{
+		err = -EINVAL;
+		goto exit;
+	}
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		priv->retry_rts = wrqu->retry.value;
+		DMESG("Setting retry for RTS/CTS data to %d", wrqu->retry.value);
+
+	}	else {
+		priv->retry_data = wrqu->retry.value;
+		DMESG("Setting retry for non RTS/CTS data to %d", wrqu->retry.value);
+	}
+
+	/* FIXME !
+	 * We might try to write directly the TX config register
+	 * or to restart just the (R)TX process.
+	 * I'm unsure if whole reset is really needed
+	 */
+
+	rtl8180_commit(dev);
+exit:
+	up(&priv->wx_sem);
+
+	return err;
+}
+
+static int r8180_wx_get_retry(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	wrqu->retry.disabled = 0; /* can't be disabled */
+
+	if ((wrqu->retry.flags & IW_RETRY_TYPE) ==
+	    IW_RETRY_LIFETIME)
+		return -EINVAL;
+
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		wrqu->retry.flags = IW_RETRY_LIMIT & IW_RETRY_MAX;
+		wrqu->retry.value = priv->retry_rts;
+	} else {
+		wrqu->retry.flags = IW_RETRY_LIMIT & IW_RETRY_MIN;
+		wrqu->retry.value = priv->retry_data;
+	}
+
+	return 0;
+}
+
+static int r8180_wx_get_sens(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	if (priv->rf_set_sens == NULL)
+		return -1; /* we have not this support for this radio */
+	wrqu->sens.value = priv->sens;
+	return 0;
+}
+
+
+static int r8180_wx_set_sens(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	short err = 0;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	if (priv->rf_set_sens == NULL) {
+		err = -1; /* we have not this support for this radio */
+		goto exit;
+	}
+	if (priv->rf_set_sens(dev, wrqu->sens.value) == 0)
+		priv->sens = wrqu->sens.value;
+	else
+		err = -EINVAL;
+
+exit:
+	up(&priv->wx_sem);
+
+	return err;
+}
+
+
+static int r8180_wx_set_rawtx(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_rawtx(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+
+}
+
+static int r8180_wx_get_power(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_get_power(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+static int r8180_wx_set_power(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	printk("=>>>>>>>>>>=============================>set power:%d, %d!\n", wrqu->power.disabled, wrqu->power.flags);
+	if (wrqu->power.disabled == 0) {
+		wrqu->power.flags |= IW_POWER_ALL_R;
+		wrqu->power.flags |= IW_POWER_TIMEOUT;
+		wrqu->power.value = 1000;
+	}
+
+	ret = ieee80211_wx_set_power(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+static int r8180_wx_set_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	if (wrqu->rts.disabled)
+		priv->rts = DEFAULT_RTS_THRESHOLD;
+	else {
+		if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
+		    wrqu->rts.value > MAX_RTS_THRESHOLD)
+			return -EINVAL;
+
+		priv->rts = wrqu->rts.value;
+	}
+
+	return 0;
+}
+static int r8180_wx_get_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+
+	wrqu->rts.value = priv->rts;
+	wrqu->rts.fixed = 0;	/* no auto select */
+	wrqu->rts.disabled = (wrqu->rts.value == 0);
+
+	return 0;
+}
+static int dummy(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu, char *b)
+{
+	return -1;
+}
+
+static int r8180_wx_get_iwmode(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee;
+	int ret = 0;
+
+
+
+	down(&priv->wx_sem);
+
+	ieee = priv->ieee80211;
+
+	strcpy(extra, "802.11");
+	if (ieee->modulation & IEEE80211_CCK_MODULATION) {
+		strcat(extra, "b");
+		if (ieee->modulation & IEEE80211_OFDM_MODULATION)
+			strcat(extra, "/g");
+	} else if (ieee->modulation & IEEE80211_OFDM_MODULATION)
+		strcat(extra, "g");
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+static int r8180_wx_set_iwmode(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	int *param = (int *)extra;
+	int ret = 0;
+	int modulation = 0, mode = 0;
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+
+	if (*param == 1) {
+		modulation |= IEEE80211_CCK_MODULATION;
+		mode = IEEE_B;
+	printk(KERN_INFO "B mode!\n");
+	} else if (*param == 2) {
+		modulation |= IEEE80211_OFDM_MODULATION;
+		mode = IEEE_G;
+	printk(KERN_INFO "G mode!\n");
+	} else if (*param == 3) {
+		modulation |= IEEE80211_CCK_MODULATION;
+		modulation |= IEEE80211_OFDM_MODULATION;
+		mode = IEEE_B|IEEE_G;
+	printk(KERN_INFO "B/G mode!\n");
+	}
+
+	if (ieee->proto_started) {
+		ieee80211_stop_protocol(ieee);
+		ieee->mode = mode;
+		ieee->modulation = modulation;
+		ieee80211_start_protocol(ieee);
+	} else {
+		ieee->mode = mode;
+		ieee->modulation = modulation;
+	}
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+static int r8180_wx_get_preamble(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+
+	down(&priv->wx_sem);
+
+
+
+	*extra = (char) priv->plcp_preamble_mode;	/* 0:auto 1:short 2:long */
+	up(&priv->wx_sem);
+
+	return 0;
+}
+static int r8180_wx_set_preamble(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret = 0;
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	if (*extra < 0 || *extra > 2)
+		ret = -1;
+	else
+		priv->plcp_preamble_mode = *((short *)extra) ;
+
+
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+static int r8180_wx_get_siglevel(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret = 0;
+
+
+
+	down(&priv->wx_sem);
+	/* Modify by hikaru 6.5 */
+	*((int *)extra) = priv->wstats.qual.level;/*for interface test ,it should be the priv->wstats.qual.level; */
+
+
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+static int r8180_wx_get_sigqual(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret = 0;
+
+
+
+	down(&priv->wx_sem);
+	/* Modify by hikaru 6.5	*/
+	*((int *)extra) = priv->wstats.qual.qual;/* for interface test ,it should be the priv->wstats.qual.qual; */
+
+
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+static int r8180_wx_reset_stats(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	down(&priv->wx_sem);
+
+	priv->stats.txrdu = 0;
+	priv->stats.rxrdu = 0;
+	priv->stats.rxnolast = 0;
+	priv->stats.rxnodata = 0;
+	priv->stats.rxnopointer = 0;
+	priv->stats.txnperr = 0;
+	priv->stats.txresumed = 0;
+	priv->stats.rxerr = 0;
+	priv->stats.rxoverflow = 0;
+	priv->stats.rxint = 0;
+
+	priv->stats.txnpokint = 0;
+	priv->stats.txhpokint = 0;
+	priv->stats.txhperr = 0;
+	priv->stats.ints = 0;
+	priv->stats.shints = 0;
+	priv->stats.txoverflow = 0;
+	priv->stats.rxdmafail = 0;
+	priv->stats.txbeacon = 0;
+	priv->stats.txbeaconerr = 0;
+	priv->stats.txlpokint = 0;
+	priv->stats.txlperr = 0;
+	priv->stats.txretry = 0;/* 20060601 */
+	priv->stats.rxcrcerrmin = 0 ;
+	priv->stats.rxcrcerrmid = 0;
+	priv->stats.rxcrcerrmax = 0;
+	priv->stats.rxicverr = 0;
+
+	up(&priv->wx_sem);
+
+	return 0;
+
+}
+static int r8180_wx_radio_on(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+
+	down(&priv->wx_sem);
+	priv->rf_wakeup(dev);
+
+	up(&priv->wx_sem);
+
+	return 0;
+
+}
+
+static int r8180_wx_radio_off(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+
+	down(&priv->wx_sem);
+	priv->rf_sleep(dev);
+
+	up(&priv->wx_sem);
+
+	return 0;
+
+}
+static int r8180_wx_get_channelplan(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+
+	down(&priv->wx_sem);
+	*extra = priv->channel_plan;
+
+
+
+	up(&priv->wx_sem);
+
+	return 0;
+}
+static int r8180_wx_set_channelplan(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int *val = (int *)extra;
+	int i;
+	printk("-----in fun %s\n", __func__);
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	/* unsigned long flags; */
+	down(&priv->wx_sem);
+	if (DefaultChannelPlan[*val].Len != 0)	{
+		priv->channel_plan = *val;
+		/* Clear old channel map 8 */
+		for (i = 1; i <= MAX_CHANNEL_NUMBER; i++)
+			GET_DOT11D_INFO(priv->ieee80211)->channel_map[i] = 0;
+
+		/* Set new channel map */
+		for (i = 1; i <= DefaultChannelPlan[*val].Len; i++)
+			GET_DOT11D_INFO(priv->ieee80211)->channel_map[DefaultChannelPlan[*val].Channel[i-1]] = 1;
+		
+	}
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+static int r8180_wx_get_version(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	/* struct ieee80211_device *ieee; */
+
+	down(&priv->wx_sem);
+	strcpy(extra, "1020.0808");
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+/* added by amy 080818 */
+/*receive datarate from user typing valid rate is from 2 to 108 (1 - 54M), if input 0, return to normal rate adaptive. */
+static int r8180_wx_set_forcerate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	u8 forcerate = *extra;
+
+	down(&priv->wx_sem);
+
+	printk("==============>%s(): forcerate is %d\n", __func__, forcerate);
+	if ((forcerate == 2) || (forcerate == 4) || (forcerate == 11) || (forcerate == 22) || (forcerate == 12) ||
+		(forcerate == 18) || (forcerate == 24) || (forcerate == 36) || (forcerate == 48) || (forcerate == 72) ||
+		(forcerate == 96) || (forcerate == 108))
+	{
+		priv->ForcedDataRate = 1;
+		priv->ieee80211->rate = forcerate * 5;
+	}	else if (forcerate == 0)	{
+		priv->ForcedDataRate = 0;
+		printk("OK! return rate adaptive\n");
+	}	else
+			printk("ERR: wrong rate\n");
+	up(&priv->wx_sem);
+	return 0;
+}
+
+static int r8180_wx_set_enc_ext(struct net_device *dev,
+										struct iw_request_info *info,
+										union iwreq_data *wrqu, char *extra)
+{
+
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+	int ret = 0;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_encode_ext(priv->ieee80211, info, wrqu, extra);
+	up(&priv->wx_sem);
+	return ret;
+
+}
+static int r8180_wx_set_auth(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	int ret = 0;
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_auth(priv->ieee80211, info, &wrqu->param, extra);
+	up(&priv->wx_sem);
+	return ret;
+}
+
+static int r8180_wx_set_mlme(struct net_device *dev,
+										struct iw_request_info *info,
+										union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+
+	down(&priv->wx_sem);
+#if 1
+	ret = ieee80211_wx_set_mlme(priv->ieee80211, info, wrqu, extra);
+#endif
+	up(&priv->wx_sem);
+	return ret;
+}
+static int r8180_wx_set_gen_ie(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+		struct r8180_priv *priv = ieee80211_priv(dev);
+
+
+	if (priv->ieee80211->bHwRadioOff)
+		return 0;
+
+		down(&priv->wx_sem);
+#if 1
+		ret = ieee80211_wx_set_gen_ie(priv->ieee80211, extra, wrqu->data.length);
+#endif
+		up(&priv->wx_sem);
+		return ret;
+
+
+}
+static iw_handler r8180_wx_handlers[] =	{
+		NULL,					/* SIOCSIWCOMMIT */
+		r8180_wx_get_name,			/* SIOCGIWNAME */
+		dummy,					/* SIOCSIWNWID */
+		dummy,					/* SIOCGIWNWID */
+		r8180_wx_set_freq,			/* SIOCSIWFREQ */
+		r8180_wx_get_freq,			/* SIOCGIWFREQ */
+		r8180_wx_set_mode,			/* SIOCSIWMODE */
+		r8180_wx_get_mode,			/* SIOCGIWMODE */
+		r8180_wx_set_sens,			/* SIOCSIWSENS */
+		r8180_wx_get_sens,			/* SIOCGIWSENS */
+		NULL,					/* SIOCSIWRANGE */
+		rtl8180_wx_get_range,			/* SIOCGIWRANGE */
+		NULL,					/* SIOCSIWPRIV */
+		NULL,					/* SIOCGIWPRIV */
+		NULL,					/* SIOCSIWSTATS */
+		NULL,					/* SIOCGIWSTATS */
+		dummy,					/* SIOCSIWSPY */
+		dummy,					/* SIOCGIWSPY */
+		NULL,					/* SIOCGIWTHRSPY */
+		NULL,					/* SIOCWIWTHRSPY */
+		r8180_wx_set_wap,			/* SIOCSIWAP */
+		r8180_wx_get_wap,			/* SIOCGIWAP */
+		r8180_wx_set_mlme,			/* SIOCSIWMLME*/
+		dummy,					/* SIOCGIWAPLIST -- depricated */
+		r8180_wx_set_scan,			/* SIOCSIWSCAN */
+		r8180_wx_get_scan,			/* SIOCGIWSCAN */
+		r8180_wx_set_essid,			/* SIOCSIWESSID */
+		r8180_wx_get_essid,			/* SIOCGIWESSID */
+		dummy,					/* SIOCSIWNICKN */
+		dummy,					/* SIOCGIWNICKN */
+		NULL,					/* -- hole -- */
+		NULL,					/* -- hole -- */
+		r8180_wx_set_rate,			/* SIOCSIWRATE */
+		r8180_wx_get_rate,			/* SIOCGIWRATE */
+		r8180_wx_set_rts,			/* SIOCSIWRTS */
+		r8180_wx_get_rts,			/* SIOCGIWRTS */
+		r8180_wx_set_frag,			/* SIOCSIWFRAG */
+		r8180_wx_get_frag,			/* SIOCGIWFRAG */
+		dummy,					/* SIOCSIWTXPOW */
+		dummy,					/* SIOCGIWTXPOW */
+		r8180_wx_set_retry,			/* SIOCSIWRETRY */
+		r8180_wx_get_retry,			/* SIOCGIWRETRY */
+		r8180_wx_set_enc,			/* SIOCSIWENCODE */
+		r8180_wx_get_enc,			/* SIOCGIWENCODE */
+		r8180_wx_set_power,			/* SIOCSIWPOWER */
+		r8180_wx_get_power,			/* SIOCGIWPOWER */
+		NULL,					/*---hole---*/
+		NULL,					/*---hole---*/
+		r8180_wx_set_gen_ie,			/* SIOCSIWGENIE */
+		NULL,					/* SIOCSIWGENIE */
+		r8180_wx_set_auth,			/* SIOCSIWAUTH */
+		NULL,					/* SIOCSIWAUTH */
+		r8180_wx_set_enc_ext,			/* SIOCSIWENCODEEXT */
+		NULL,					/* SIOCSIWENCODEEXT */
+		NULL,					/* SIOCSIWPMKSA */
+		NULL,					/*---hole---*/
+};
+
+
+static const struct iw_priv_args r8180_private_args[] = {
+	{
+		SIOCIWFIRSTPRIV + 0x0,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "badcrc"
+	},
+	{	SIOCIWFIRSTPRIV + 0x1,
+		0, 0, "dummy"
+
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x2,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "beaconint"
+	},
+	{	SIOCIWFIRSTPRIV + 0x3,
+		0, 0, "dummy"
+
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x4,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "activescan"
+
+	},
+	{	SIOCIWFIRSTPRIV + 0x5,
+		0, 0, "dummy"
+
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x6,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "rawtx"
+
+	},
+	{	SIOCIWFIRSTPRIV + 0x7,
+		0, 0, "dummy"
+
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x8,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setiwmode"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x9,
+		0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 32, "getiwmode"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xA,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setpreamble"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xB,
+		0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getpreamble"
+	},
+	{	SIOCIWFIRSTPRIV + 0xC,
+		0, 0, "dummy"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xD,
+		0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getrssi"
+	},
+	{	SIOCIWFIRSTPRIV + 0xE,
+		0, 0, "dummy"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xF,
+		0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getlinkqual"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x10,
+		0, 0, "resetstats"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x11,
+		0, 0, "dummy"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x12,
+		0, 0, "radioon"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x13,
+		0, 0, "radiooff"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x14,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setchannel"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x15,
+		0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getchannel"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x16,
+		0, 0, "dummy"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x17,
+		0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 32, "getversion"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x18,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setrate"
+	},
+};
+
+
+static iw_handler r8180_private_handler[] = {
+	r8180_wx_set_crcmon, /*SIOCIWSECONDPRIV*/
+	dummy,
+	r8180_wx_set_beaconinterval,
+	dummy,
+	/* r8180_wx_set_monitor_type, */
+	r8180_wx_set_scan_type,
+	dummy,
+	r8180_wx_set_rawtx,
+	dummy,
+	r8180_wx_set_iwmode,
+	r8180_wx_get_iwmode,
+	r8180_wx_set_preamble,
+	r8180_wx_get_preamble,
+	dummy,
+	r8180_wx_get_siglevel,
+	dummy,
+	r8180_wx_get_sigqual,
+	r8180_wx_reset_stats,
+	dummy,/* r8180_wx_get_stats */
+	r8180_wx_radio_on,
+	r8180_wx_radio_off,
+	r8180_wx_set_channelplan,
+	r8180_wx_get_channelplan,
+	dummy,
+	r8180_wx_get_version,
+	r8180_wx_set_forcerate,
+};
+
+static inline int is_same_network(struct ieee80211_network *src,
+									struct ieee80211_network *dst,
+				  struct ieee80211_device *ieee)
+{
+		/* A network is only a duplicate if the channel, BSSID, ESSID
+		 * and the capability field (in particular IBSS and BSS) all match.
+		 * We treat all <hidden> with the same BSSID and channel
+		 * as one network
+		 */
+		return (((src->ssid_len == dst->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) && /* YJ,mod, 080819,for hidden ap */
+			(src->channel == dst->channel) &&
+			!memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
+			(!memcmp(src->ssid, dst->ssid, src->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&  /* YJ,mod, 080819,for hidden ap */
+			((src->capability & WLAN_CAPABILITY_IBSS) ==
+			(dst->capability & WLAN_CAPABILITY_IBSS)) &&
+			((src->capability & WLAN_CAPABILITY_BSS) ==
+			(dst->capability & WLAN_CAPABILITY_BSS)));
+}
+
+/* WB modefied to show signal to GUI on 18-01-2008 */
+static struct iw_statistics *r8180_get_wireless_stats(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	struct iw_statistics* wstats = &priv->wstats;
+	int tmp_level = 0;
+	int tmp_qual = 0;
+	int tmp_noise = 0;
+
+	if (ieee->state < IEEE80211_LINKED)	{
+		wstats->qual.qual = 0;
+		wstats->qual.level = 0;
+		wstats->qual.noise = 0;
+		wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+		return wstats;
+	}
+
+	tmp_level = (&ieee->current_network)->stats.signal;
+	tmp_qual = (&ieee->current_network)->stats.signalstrength;
+	tmp_noise = (&ieee->current_network)->stats.noise;
+
+	wstats->qual.level = tmp_level;
+	wstats->qual.qual = tmp_qual;
+	wstats->qual.noise = tmp_noise;
+	wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+	return wstats;
+}
+
+struct iw_handler_def  r8180_wx_handlers_def = {
+	.standard = r8180_wx_handlers,
+	.num_standard = ARRAY_SIZE(r8180_wx_handlers),
+	.private = r8180_private_handler,
+	.num_private = ARRAY_SIZE(r8180_private_handler),
+	.num_private_args = sizeof(r8180_private_args) / sizeof(struct iw_priv_args),
+	.get_wireless_stats = r8180_get_wireless_stats,
+	.private_args = (struct iw_priv_args *)r8180_private_args,
+};
+
+
diff --git a/drivers/staging/rtl8187se/r8180_wx.h b/drivers/staging/rtl8187se/r8180_wx.h
new file mode 100644
index 00000000..735d03dc
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8180_wx.h
@@ -0,0 +1,21 @@
+/*
+	This is part of rtl8180 OpenSource driver - v 0.3
+	Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the official realtek driver
+	Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
+	Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+	We want to tanks the Authors of such projects and the Ndiswrapper project Authors.
+*/
+
+/* this file (will) contains wireless extension handlers*/
+
+#ifndef R8180_WX_H
+#define R8180_WX_H
+#include <linux/wireless.h>
+#include "ieee80211/ieee80211.h"
+extern struct iw_handler_def r8180_wx_handlers_def;
+
+#endif
diff --git a/drivers/staging/rtl8187se/r8185b_init.c b/drivers/staging/rtl8187se/r8185b_init.c
new file mode 100644
index 00000000..4b0b830f
--- /dev/null
+++ b/drivers/staging/rtl8187se/r8185b_init.c
@@ -0,0 +1,1768 @@
+/*++
+Copyright (c) Realtek Semiconductor Corp. All rights reserved.
+
+Module Name:
+	r8185b_init.c
+
+Abstract:
+	Hardware Initialization and Hardware IO for RTL8185B
+
+Major Change History:
+	When		Who				What
+	----------	---------------		-------------------------------
+	2006-11-15    Xiong		Created
+
+Notes:
+	This file is ported from RTL8185B Windows driver.
+
+
+--*/
+
+/*--------------------------Include File------------------------------------*/
+#include <linux/spinlock.h>
+#include "r8180_hw.h"
+#include "r8180.h"
+#include "r8180_rtl8225.h" /* RTL8225 Radio frontend */
+#include "r8180_93cx6.h"   /* Card EEPROM */
+#include "r8180_wx.h"
+
+#include "ieee80211/dot11d.h"
+
+
+/* #define CONFIG_RTL8180_IO_MAP */
+
+#define TC_3W_POLL_MAX_TRY_CNT 5
+static u8 MAC_REG_TABLE[][2] =	{
+                        /*PAGA 0:	*/
+						/* 0x34(BRSR), 0xBE(RATE_FALLBACK_CTL), 0x1E0(ARFR) would set in HwConfigureRTL8185()	*/
+						/* 0x272(RFSW_CTRL), 0x1CE(AESMSK_QC) set in InitializeAdapter8185().					*/
+						/* 0x1F0~0x1F8  set in MacConfig_85BASIC()												*/
+						{0x08, 0xae}, {0x0a, 0x72}, {0x5b, 0x42},
+						{0x84, 0x88}, {0x85, 0x24}, {0x88, 0x54}, {0x8b, 0xb8}, {0x8c, 0x03},
+						{0x8d, 0x40}, {0x8e, 0x00}, {0x8f, 0x00}, {0x5b, 0x18}, {0x91, 0x03},
+						{0x94, 0x0F}, {0x95, 0x32},
+						{0x96, 0x00}, {0x97, 0x07}, {0xb4, 0x22}, {0xdb, 0x00},
+						{0xf0, 0x32}, {0xf1, 0x32}, {0xf2, 0x00}, {0xf3, 0x00}, {0xf4, 0x32},
+						{0xf5, 0x43}, {0xf6, 0x00}, {0xf7, 0x00}, {0xf8, 0x46}, {0xf9, 0xa4},
+						{0xfa, 0x00}, {0xfb, 0x00}, {0xfc, 0x96}, {0xfd, 0xa4}, {0xfe, 0x00},
+						{0xff, 0x00},
+
+						/*PAGE 1:	*/
+						/* For Flextronics system Logo PCIHCT failure:	*/
+				/* 0x1C4~0x1CD set no-zero value to avoid PCI configuration space 0x45[7]=1	*/
+						{0x5e, 0x01},
+						{0x58, 0x00}, {0x59, 0x00}, {0x5a, 0x04}, {0x5b, 0x00}, {0x60, 0x24},
+						{0x61, 0x97}, {0x62, 0xF0}, {0x63, 0x09}, {0x80, 0x0F}, {0x81, 0xFF},
+						{0x82, 0xFF}, {0x83, 0x03},
+						{0xC4, 0x22}, {0xC5, 0x22}, {0xC6, 0x22}, {0xC7, 0x22}, {0xC8, 0x22}, /* lzm add 080826 */
+						{0xC9, 0x22}, {0xCA, 0x22}, {0xCB, 0x22}, {0xCC, 0x22}, {0xCD, 0x22},/* lzm add 080826 */
+						{0xe2, 0x00},
+
+
+						/* PAGE 2: */
+						{0x5e, 0x02},
+						{0x0c, 0x04}, {0x4c, 0x30}, {0x4d, 0x08}, {0x50, 0x05}, {0x51, 0xf5},
+						{0x52, 0x04}, {0x53, 0xa0}, {0x54, 0xff}, {0x55, 0xff}, {0x56, 0xff},
+						{0x57, 0xff}, {0x58, 0x08}, {0x59, 0x08}, {0x5a, 0x08}, {0x5b, 0x08},
+						{0x60, 0x08}, {0x61, 0x08}, {0x62, 0x08}, {0x63, 0x08}, {0x64, 0x2f},
+						{0x8c, 0x3f}, {0x8d, 0x3f}, {0x8e, 0x3f},
+						{0x8f, 0x3f}, {0xc4, 0xff}, {0xc5, 0xff}, {0xc6, 0xff}, {0xc7, 0xff},
+						{0xc8, 0x00}, {0xc9, 0x00}, {0xca, 0x80}, {0xcb, 0x00},
+
+						/* PAGA 0: */
+						{0x5e, 0x00}, {0x9f, 0x03}
+			};
+
+
+static u8  ZEBRA_AGC[]	=	{
+			0,
+			0x7E, 0x7E, 0x7E, 0x7E, 0x7D, 0x7C, 0x7B, 0x7A, 0x79, 0x78, 0x77, 0x76, 0x75, 0x74, 0x73, 0x72,
+			0x71, 0x70, 0x6F, 0x6E, 0x6D, 0x6C, 0x6B, 0x6A, 0x69, 0x68, 0x67, 0x66, 0x65, 0x64, 0x63, 0x62,
+			0x48, 0x47, 0x46, 0x45, 0x44, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24, 0x23, 0x22, 0x21, 0x08, 0x07,
+			0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+			0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x15, 0x16,
+			0x17, 0x17, 0x18, 0x18, 0x19, 0x1a, 0x1a, 0x1b, 0x1b, 0x1c, 0x1c, 0x1d, 0x1d, 0x1d, 0x1e, 0x1e,
+			0x1f, 0x1f, 0x1f, 0x20, 0x20, 0x20, 0x20, 0x21, 0x21, 0x21, 0x22, 0x22, 0x22, 0x23, 0x23, 0x24,
+			0x24, 0x25, 0x25, 0x25, 0x26, 0x26, 0x27, 0x27, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F
+			};
+
+static u32 ZEBRA_RF_RX_GAIN_TABLE[]	=	{
+			0x0096, 0x0076, 0x0056, 0x0036, 0x0016, 0x01f6, 0x01d6, 0x01b6,
+			0x0196, 0x0176, 0x00F7, 0x00D7, 0x00B7, 0x0097, 0x0077, 0x0057,
+			0x0037, 0x00FB, 0x00DB, 0x00BB, 0x00FF, 0x00E3, 0x00C3, 0x00A3,
+			0x0083, 0x0063, 0x0043, 0x0023, 0x0003, 0x01E3, 0x01C3, 0x01A3,
+			0x0183, 0x0163, 0x0143, 0x0123, 0x0103
+	};
+
+static u8 OFDM_CONFIG[]	=	{
+			/* OFDM reg0x06[7:0]=0xFF: Enable power saving mode in RX				*/
+			/* OFDM reg0x3C[4]=1'b1: Enable RX power saving mode					*/
+			/* ofdm 0x3a = 0x7b ,(original : 0xfb) For ECS shielding room TP test	*/
+
+			/* 0x00	*/
+			0x10, 0x0F, 0x0A, 0x0C, 0x14, 0xFA, 0xFF, 0x50,
+			0x00, 0x50, 0x00, 0x00, 0x00, 0x5C, 0x00, 0x00,
+			/* 0x10	*/
+			0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xA8, 0x26,
+			0x32, 0x33, 0x06, 0xA5, 0x6F, 0x55, 0xC8, 0xBB,
+			/* 0x20	*/
+			0x0A, 0xE1, 0x2C, 0x4A, 0x86, 0x83, 0x34, 0x00,
+			0x4F, 0x24, 0x6F, 0xC2, 0x03, 0x40, 0x80, 0x00,
+			/* 0x30	*/
+			0xC0, 0xC1, 0x58, 0xF1, 0x00, 0xC4, 0x90, 0x3e,
+			0xD8, 0x3C, 0x7B, 0x10, 0x10
+		};
+
+/*	---------------------------------------------------------------
+	*	Hardware IO
+	*	the code is ported from Windows source code
+	----------------------------------------------------------------*/
+
+void
+PlatformIOWrite1Byte(
+	struct net_device *dev,
+	u32		offset,
+	u8		data
+	)
+{
+	write_nic_byte(dev, offset, data);
+	read_nic_byte(dev, offset); /* To make sure write operation is completed, 2005.11.09, by rcnjko.	*/
+
+}
+
+void
+PlatformIOWrite2Byte(
+	struct net_device *dev,
+	u32		offset,
+	u16		data
+	)
+{
+	write_nic_word(dev, offset, data);
+	read_nic_word(dev, offset); /* To make sure write operation is completed, 2005.11.09, by rcnjko. */
+
+
+}
+u8 PlatformIORead1Byte(struct net_device *dev, u32 offset);
+
+void
+PlatformIOWrite4Byte(
+	struct net_device *dev,
+	u32		offset,
+	u32		data
+	)
+{
+/* {by amy 080312 */
+if (offset == PhyAddr)	{
+/* For Base Band configuration. */
+		unsigned char	cmdByte;
+		unsigned long	dataBytes;
+		unsigned char	idx;
+		u8	u1bTmp;
+
+		cmdByte = (u8)(data & 0x000000ff);
+		dataBytes = data>>8;
+
+		/*
+			071010, rcnjko:
+			The critical section is only BB read/write race condition.
+			Assumption:
+			1. We assume NO one will access BB at DIRQL, otherwise, system will crash for
+			acquiring the spinlock in such context.
+			2. PlatformIOWrite4Byte() MUST NOT be recursive.
+		*/
+/*		NdisAcquireSpinLock( &(pDevice->IoSpinLock) );	*/
+
+		for (idx = 0; idx < 30; idx++)	{ 
+		/* Make sure command bit is clear before access it.	*/
+			u1bTmp = PlatformIORead1Byte(dev, PhyAddr);
+			if ((u1bTmp & BIT7) == 0)
+				break;
+			else
+				mdelay(10);
+		}
+
+		for (idx = 0; idx < 3; idx++)
+			PlatformIOWrite1Byte(dev, offset+1+idx, ((u8 *)&dataBytes)[idx]);
+
+		write_nic_byte(dev, offset, cmdByte);
+
+/*		NdisReleaseSpinLock( &(pDevice->IoSpinLock) ); */
+	}
+/* by amy 080312} */
+	else	{
+		write_nic_dword(dev, offset, data);
+		read_nic_dword(dev, offset); /* To make sure write operation is completed, 2005.11.09, by rcnjko. */
+	}
+}
+
+u8
+PlatformIORead1Byte(
+	struct net_device *dev,
+	u32		offset
+	)
+{
+	u8	data = 0;
+
+	data = read_nic_byte(dev, offset);
+
+
+	return data;
+}
+
+u16
+PlatformIORead2Byte(
+	struct net_device *dev,
+	u32		offset
+	)
+{
+	u16	data = 0;
+
+	data = read_nic_word(dev, offset);
+
+
+	return data;
+}
+
+u32
+PlatformIORead4Byte(
+	struct net_device *dev,
+	u32		offset
+	)
+{
+	u32	data = 0;
+
+	data = read_nic_dword(dev, offset);
+
+
+	return data;
+}
+
+void SetOutputEnableOfRfPins(struct net_device *dev)
+{
+	write_nic_word(dev, RFPinsEnable, 0x1bff);
+}
+
+static int
+HwHSSIThreeWire(
+	struct net_device *dev,
+	u8			*pDataBuf,
+	u8			nDataBufBitCnt,
+	int			bSI,
+	int			bWrite
+	)
+{
+	int	bResult = 1;
+	u8	TryCnt;
+	u8	u1bTmp;
+
+	do	{
+		/* Check if WE and RE are cleared. */
+		for (TryCnt = 0; TryCnt < TC_3W_POLL_MAX_TRY_CNT; TryCnt++)	{
+			u1bTmp = read_nic_byte(dev, SW_3W_CMD1);
+			if ((u1bTmp & (SW_3W_CMD1_RE|SW_3W_CMD1_WE)) == 0)
+				break;
+
+			udelay(10);
+		}
+		if (TryCnt == TC_3W_POLL_MAX_TRY_CNT) {
+			printk(KERN_ERR "rtl8187se: HwThreeWire(): CmdReg:"
+			       " %#X RE|WE bits are not clear!!\n", u1bTmp);
+			dump_stack();
+			return 0;
+		}
+
+		/* RTL8187S HSSI Read/Write Function */
+		u1bTmp = read_nic_byte(dev, RF_SW_CONFIG);
+
+		if (bSI)
+			u1bTmp |=   RF_SW_CFG_SI;   /* reg08[1]=1 Serial Interface(SI)	*/
+
+		else
+			u1bTmp &= ~RF_SW_CFG_SI;  /* reg08[1]=0 Parallel Interface(PI)	*/
+
+
+		write_nic_byte(dev, RF_SW_CONFIG, u1bTmp);
+
+		if (bSI)	{
+			/* jong: HW SI read must set reg84[3]=0. */
+			u1bTmp = read_nic_byte(dev, RFPinsSelect);
+			u1bTmp &= ~BIT3;
+			write_nic_byte(dev, RFPinsSelect, u1bTmp);
+		}
+		/*  Fill up data buffer for write operation. */
+
+		if (bWrite)	{
+			if (nDataBufBitCnt == 16)	{
+				write_nic_word(dev, SW_3W_DB0, *((u16 *)pDataBuf));
+			}	else if (nDataBufBitCnt == 64)	{
+			/* RTL8187S shouldn't enter this case */
+				write_nic_dword(dev, SW_3W_DB0, *((u32 *)pDataBuf));
+				write_nic_dword(dev, SW_3W_DB1, *((u32 *)(pDataBuf + 4)));
+			}	else	{
+				int idx;
+				int ByteCnt = nDataBufBitCnt / 8;
+								/* printk("%d\n",nDataBufBitCnt); */
+				if ((nDataBufBitCnt % 8) != 0) {
+					printk(KERN_ERR "rtl8187se: "
+					       "HwThreeWire(): nDataBufBitCnt(%d)"
+					       " should be multiple of 8!!!\n",
+					       nDataBufBitCnt);
+					dump_stack();
+					nDataBufBitCnt += 8;
+					nDataBufBitCnt &= ~7;
+				}
+
+			       if (nDataBufBitCnt > 64) {
+					printk(KERN_ERR "rtl8187se: HwThreeWire():"
+					       " nDataBufBitCnt(%d) should <= 64!!!\n",
+					       nDataBufBitCnt);
+					dump_stack();
+					nDataBufBitCnt = 64;
+				}
+
+				for (idx = 0; idx < ByteCnt; idx++)
+					write_nic_byte(dev, (SW_3W_DB0+idx), *(pDataBuf+idx));
+
+			}
+		}	else	{	/* read */
+			if (bSI)	{
+				/* SI - reg274[3:0] : RF register's Address	*/
+				write_nic_word(dev, SW_3W_DB0, *((u16 *)pDataBuf));
+			}	else	{
+				/*  PI - reg274[15:12] : RF register's Address */
+				write_nic_word(dev, SW_3W_DB0, (*((u16 *)pDataBuf)) << 12);
+			}
+		}
+
+		/* Set up command: WE or RE. */
+		if (bWrite)
+			write_nic_byte(dev, SW_3W_CMD1, SW_3W_CMD1_WE);
+
+		else
+			write_nic_byte(dev, SW_3W_CMD1, SW_3W_CMD1_RE);
+
+
+		/* Check if DONE is set. */
+		for (TryCnt = 0; TryCnt < TC_3W_POLL_MAX_TRY_CNT; TryCnt++)	{
+			u1bTmp = read_nic_byte(dev, SW_3W_CMD1);
+			if ((u1bTmp & SW_3W_CMD1_DONE) != 0)
+				break;
+
+			udelay(10);
+		}
+
+		write_nic_byte(dev, SW_3W_CMD1, 0);
+
+		/* Read back data for read operation.	*/
+		if (bWrite == 0)	{
+			if (bSI)		{
+				/* Serial Interface : reg363_362[11:0] */
+				*((u16 *)pDataBuf) = read_nic_word(dev, SI_DATA_READ) ;
+			}	else	{
+				/* Parallel Interface : reg361_360[11:0] */
+				*((u16 *)pDataBuf) = read_nic_word(dev, PI_DATA_READ);
+			}
+
+			*((u16 *)pDataBuf) &= 0x0FFF;
+		}
+
+	}	while (0);
+
+	return bResult;
+}
+
+void
+RF_WriteReg(struct net_device *dev, u8 offset, u32 data)
+{
+	u32 data2Write;
+	u8 len;
+
+	/* Pure HW 3-wire. */
+	data2Write = (data << 4) | (u32)(offset & 0x0f);
+	len = 16;
+
+	HwHSSIThreeWire(dev, (u8 *)(&data2Write), len, 1, 1);
+}
+
+u32 RF_ReadReg(struct net_device *dev, u8 offset)
+{
+	u32 data2Write;
+	u8 wlen;
+	u32 dataRead;
+
+	data2Write = ((u32)(offset & 0x0f));
+	wlen = 16;
+	HwHSSIThreeWire(dev, (u8 *)(&data2Write), wlen, 1, 0);
+	dataRead = data2Write;
+
+	return dataRead;
+}
+
+
+/* by Owen on 04/07/14 for writing BB register successfully */
+void
+WriteBBPortUchar(
+	struct net_device *dev,
+	u32		Data
+	)
+{
+	/* u8	TimeoutCounter; */
+	u8	RegisterContent;
+	u8	UCharData;
+
+	UCharData = (u8)((Data & 0x0000ff00) >> 8);
+	PlatformIOWrite4Byte(dev, PhyAddr, Data);
+	/* for(TimeoutCounter = 10; TimeoutCounter > 0; TimeoutCounter--) */
+	{
+		PlatformIOWrite4Byte(dev, PhyAddr, Data & 0xffffff7f);
+		RegisterContent = PlatformIORead1Byte(dev, PhyDataR);
+		/*if(UCharData == RegisterContent)	*/
+		/*	break;	*/
+	}
+}
+
+u8
+ReadBBPortUchar(
+	struct net_device *dev,
+	u32		addr
+	)
+{
+	/*u8	TimeoutCounter; */
+	u8	RegisterContent;
+
+	PlatformIOWrite4Byte(dev, PhyAddr, addr & 0xffffff7f);
+	RegisterContent = PlatformIORead1Byte(dev, PhyDataR);
+
+	return RegisterContent;
+}
+/* {by amy 080312 */
+/*
+	Description:
+	Perform Antenna settings with antenna diversity on 87SE.
+		Created by Roger, 2008.01.25.
+*/
+bool
+SetAntennaConfig87SE(
+	struct net_device *dev,
+	u8			DefaultAnt,		/* 0: Main, 1: Aux.			*/
+	bool		bAntDiversity	/* 1:Enable, 0: Disable.	*/
+)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	bool   bAntennaSwitched = true;
+
+	/* printk("SetAntennaConfig87SE(): DefaultAnt(%d), bAntDiversity(%d)\n", DefaultAnt, bAntDiversity); */
+
+	/* Threshold for antenna diversity.	*/
+	write_phy_cck(dev, 0x0c, 0x09); /* Reg0c : 09 */
+
+	if (bAntDiversity)	{	/*	Enable Antenna Diversity.	*/
+		if (DefaultAnt == 1)	{	/* aux antenna			*/
+
+			/* Mac register, aux antenna	*/
+			write_nic_byte(dev, ANTSEL, 0x00);
+
+			/* Config CCK RX antenna.		*/
+			write_phy_cck(dev, 0x11, 0xbb); /* Reg11 : bb */
+			write_phy_cck(dev, 0x01, 0xc7); /* Reg01 : c7 */
+
+			/* Config OFDM RX antenna.	*/
+			write_phy_ofdm(dev, 0x0D, 0x54);	/* Reg0d : 54	*/
+			write_phy_ofdm(dev, 0x18, 0xb2);	/* Reg18 : b2		*/
+		}	else	{	/*  use main antenna	*/
+			/* Mac register, main antenna		*/
+			write_nic_byte(dev, ANTSEL, 0x03);
+			/* base band				*/
+			/*  Config CCK RX antenna.	*/
+			write_phy_cck(dev, 0x11, 0x9b); /* Reg11 : 9b	*/
+			write_phy_cck(dev, 0x01, 0xc7); /* Reg01 : c7	*/
+
+			/* Config OFDM RX antenna. */
+			write_phy_ofdm(dev, 0x0d, 0x5c);  /* Reg0d : 5c	*/
+			write_phy_ofdm(dev, 0x18, 0xb2);  /* Reg18 : b2	*/
+		}
+	}	else	{
+		/* Disable Antenna Diversity. */
+		if (DefaultAnt == 1)	{	/* aux Antenna */
+			/* Mac register, aux antenna */
+			write_nic_byte(dev, ANTSEL, 0x00);
+
+			/* Config CCK RX antenna. */
+			write_phy_cck(dev, 0x11, 0xbb); /* Reg11 : bb	*/
+			write_phy_cck(dev, 0x01, 0x47); /* Reg01 : 47	*/
+
+			/* Config OFDM RX antenna. */
+			write_phy_ofdm(dev, 0x0D, 0x54);	/* Reg0d : 54	*/
+			write_phy_ofdm(dev, 0x18, 0x32);	/* Reg18 : 32	*/
+		}	else	{	/* main Antenna */
+			/* Mac register, main antenna */
+			write_nic_byte(dev, ANTSEL, 0x03);
+
+			/* Config CCK RX antenna.	*/
+			write_phy_cck(dev, 0x11, 0x9b); /* Reg11 : 9b */
+			write_phy_cck(dev, 0x01, 0x47); /* Reg01 : 47 */
+
+			/* Config OFDM RX antenna.		*/
+			write_phy_ofdm(dev, 0x0D, 0x5c);	/* Reg0d : 5c	*/
+			write_phy_ofdm(dev, 0x18, 0x32);	/*Reg18 : 32	*/
+		}
+	}
+	priv->CurrAntennaIndex = DefaultAnt; /* Update default settings. */
+	return	bAntennaSwitched;
+}
+/* by amy 080312 */
+/*
+---------------------------------------------------------------
+	*	Hardware Initialization.
+	*	the code is ported from Windows source code
+----------------------------------------------------------------*/
+
+void
+ZEBRA_Config_85BASIC_HardCode(
+	struct net_device *dev
+	)
+{
+
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u32			i;
+	u32	addr, data;
+	u32	u4bRegOffset, u4bRegValue, u4bRF23, u4bRF24;
+	u8			u1b24E;
+	int d_cut = 0;
+
+
+/*
+=============================================================================
+	87S_PCIE :: RADIOCFG.TXT
+=============================================================================
+*/
+
+
+	/* Page1 : reg16-reg30 */
+	RF_WriteReg(dev, 0x00, 0x013f);			mdelay(1); /* switch to page1 */
+	u4bRF23 = RF_ReadReg(dev, 0x08);			mdelay(1);
+	u4bRF24 = RF_ReadReg(dev, 0x09);			mdelay(1);
+
+	if (u4bRF23 == 0x818 && u4bRF24 == 0x70C) {
+		d_cut = 1;
+		printk(KERN_INFO "rtl8187se: card type changed from C- to D-cut\n");
+	}
+
+	/* Page0 : reg0-reg15	*/
+
+	RF_WriteReg(dev, 0x00, 0x009f);			mdelay(1);/* 1	*/
+
+	RF_WriteReg(dev, 0x01, 0x06e0);			mdelay(1);
+
+	RF_WriteReg(dev, 0x02, 0x004d);			mdelay(1);/* 2	*/
+
+	RF_WriteReg(dev, 0x03, 0x07f1);			mdelay(1);/* 3	*/
+
+	RF_WriteReg(dev, 0x04, 0x0975);			mdelay(1);
+	RF_WriteReg(dev, 0x05, 0x0c72);			mdelay(1);
+	RF_WriteReg(dev, 0x06, 0x0ae6);			mdelay(1);
+	RF_WriteReg(dev, 0x07, 0x00ca);			mdelay(1);
+	RF_WriteReg(dev, 0x08, 0x0e1c);			mdelay(1);
+	RF_WriteReg(dev, 0x09, 0x02f0);			mdelay(1);
+	RF_WriteReg(dev, 0x0a, 0x09d0);			mdelay(1);
+	RF_WriteReg(dev, 0x0b, 0x01ba);			mdelay(1);
+	RF_WriteReg(dev, 0x0c, 0x0640);			mdelay(1);
+	RF_WriteReg(dev, 0x0d, 0x08df);			mdelay(1);
+	RF_WriteReg(dev, 0x0e, 0x0020);			mdelay(1);
+	RF_WriteReg(dev, 0x0f, 0x0990);			mdelay(1);
+
+
+	/*  Page1 : reg16-reg30 */
+	RF_WriteReg(dev, 0x00, 0x013f);			mdelay(1);
+
+	RF_WriteReg(dev, 0x03, 0x0806);			mdelay(1);
+
+	RF_WriteReg(dev, 0x04, 0x03a7);			mdelay(1);
+	RF_WriteReg(dev, 0x05, 0x059b);			mdelay(1);
+	RF_WriteReg(dev, 0x06, 0x0081);			mdelay(1);
+
+
+	RF_WriteReg(dev, 0x07, 0x01A0);			mdelay(1);
+/* Don't write RF23/RF24 to make a difference between 87S C cut and D cut. asked by SD3 stevenl. */
+	RF_WriteReg(dev, 0x0a, 0x0001);			mdelay(1);
+	RF_WriteReg(dev, 0x0b, 0x0418);			mdelay(1);
+
+	if (d_cut) {
+		RF_WriteReg(dev, 0x0c, 0x0fbe);			mdelay(1);
+		RF_WriteReg(dev, 0x0d, 0x0008);			mdelay(1);
+		RF_WriteReg(dev, 0x0e, 0x0807);			mdelay(1); /* RX LO buffer */
+	}	else	{
+		RF_WriteReg(dev, 0x0c, 0x0fbe);			mdelay(1);
+		RF_WriteReg(dev, 0x0d, 0x0008);			mdelay(1);
+		RF_WriteReg(dev, 0x0e, 0x0806);			mdelay(1); /* RX LO buffer */
+	}
+
+	RF_WriteReg(dev, 0x0f, 0x0acc);			mdelay(1);
+
+	RF_WriteReg(dev, 0x00, 0x01d7);			mdelay(1); /* 6 */
+
+	RF_WriteReg(dev, 0x03, 0x0e00);			mdelay(1);
+	RF_WriteReg(dev, 0x04, 0x0e50);			mdelay(1);
+	for (i = 0; i <= 36; i++)	{
+		RF_WriteReg(dev, 0x01, i);                     mdelay(1);
+		RF_WriteReg(dev, 0x02, ZEBRA_RF_RX_GAIN_TABLE[i]); mdelay(1);
+	}
+
+	RF_WriteReg(dev, 0x05, 0x0203);			mdelay(1);	/* 203, 343	*/
+	RF_WriteReg(dev, 0x06, 0x0200);			mdelay(1);	/* 400		*/
+
+	RF_WriteReg(dev, 0x00, 0x0137);			mdelay(1);	/* switch to reg16-reg30, and HSSI disable 137	*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd */
+
+	RF_WriteReg(dev, 0x0d, 0x0008);			mdelay(1);	/* Z4 synthesizer loop filter setting, 392		*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd */
+
+	RF_WriteReg(dev, 0x00, 0x0037);			mdelay(1);	/* switch to reg0-reg15, and HSSI disable		*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+
+	RF_WriteReg(dev, 0x04, 0x0160);			mdelay(1);	/* CBC on, Tx Rx disable, High gain				*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+
+	RF_WriteReg(dev, 0x07, 0x0080);			mdelay(1);	/* Z4 setted channel 1							*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+
+	RF_WriteReg(dev, 0x02, 0x088D);			mdelay(1);	/* LC calibration								*/
+	mdelay(200);	/* Deay 200 ms.	*/	/* 0xfd	*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+
+	RF_WriteReg(dev, 0x00, 0x0137);			mdelay(1);	/* switch to reg16-reg30 137, and HSSI disable 137	*/
+	mdelay(10);		/* Deay 10 ms.	*/	/* 0xfd	*/
+
+	RF_WriteReg(dev, 0x07, 0x0000);			mdelay(1);
+	RF_WriteReg(dev, 0x07, 0x0180);			mdelay(1);
+	RF_WriteReg(dev, 0x07, 0x0220);			mdelay(1);
+	RF_WriteReg(dev, 0x07, 0x03E0);			mdelay(1);
+
+	/* DAC calibration off 20070702	*/
+	RF_WriteReg(dev, 0x06, 0x00c1);			mdelay(1);
+	RF_WriteReg(dev, 0x0a, 0x0001);			mdelay(1);
+/* {by amy 080312 */
+	/* For crystal calibration, added by Roger, 2007.12.11. */
+	if (priv->bXtalCalibration)	{	/* reg 30.	*/
+	 /* enable crystal calibration.
+			RF Reg[30], (1)Xin:[12:9], Xout:[8:5],  addr[4:0].
+			(2)PA Pwr delay timer[15:14], default: 2.4us, set BIT15=0
+			(3)RF signal on/off when calibration[13], default: on, set BIT13=0.
+			So we should minus 4 BITs offset.		*/
+		RF_WriteReg(dev, 0x0f, (priv->XtalCal_Xin<<5) | (priv->XtalCal_Xout<<1) | BIT11 | BIT9);			mdelay(1);
+		printk("ZEBRA_Config_85BASIC_HardCode(): (%02x)\n",
+				(priv->XtalCal_Xin<<5) | (priv->XtalCal_Xout<<1) | BIT11 | BIT9);
+	}	else	{
+		/* using default value. Xin=6, Xout=6.	*/
+		RF_WriteReg(dev, 0x0f, 0x0acc);			mdelay(1);
+	}
+/* by amy 080312 */
+
+	RF_WriteReg(dev, 0x00, 0x00bf);			mdelay(1); /* switch to reg0-reg15, and HSSI enable	*/
+	RF_WriteReg(dev, 0x0d, 0x08df);			mdelay(1); /* Rx BB start calibration, 00c//+edward	*/
+	RF_WriteReg(dev, 0x02, 0x004d);			mdelay(1); /* temperature meter off					*/
+	RF_WriteReg(dev, 0x04, 0x0975);			mdelay(1); /* Rx mode								*/
+	mdelay(10);	/* Deay 10 ms.*/	/* 0xfe	*/
+	mdelay(10);	/* Deay 10 ms.*/	/* 0xfe	*/
+	mdelay(10);	/* Deay 10 ms.*/	/* 0xfe	*/
+	RF_WriteReg(dev, 0x00, 0x0197);			mdelay(1); /* Rx mode*/	/*+edward	*/
+	RF_WriteReg(dev, 0x05, 0x05ab);			mdelay(1); /* Rx mode*/	/*+edward	*/
+	RF_WriteReg(dev, 0x00, 0x009f);			mdelay(1); /* Rx mode*/	/*+edward	*/
+
+	RF_WriteReg(dev, 0x01, 0x0000);			mdelay(1); /* Rx mode*/	/*+edward	*/
+	RF_WriteReg(dev, 0x02, 0x0000);			mdelay(1); /* Rx mode*/	/*+edward	*/
+	/* power save parameters.	*/
+	u1b24E = read_nic_byte(dev, 0x24E);
+	write_nic_byte(dev, 0x24E, (u1b24E & (~(BIT5|BIT6))));
+
+	/*=============================================================================
+
+	=============================================================================
+	CCKCONF.TXT
+	=============================================================================
+	*/
+	/*	[POWER SAVE] Power Saving Parameters by jong. 2007-11-27
+		CCK reg0x00[7]=1'b1 :power saving for TX (default)
+		CCK reg0x00[6]=1'b1: power saving for RX (default)
+		CCK reg0x06[4]=1'b1: turn off channel estimation related circuits if not doing channel estimation.
+		CCK reg0x06[3]=1'b1: turn off unused circuits before cca = 1
+		CCK reg0x06[2]=1'b1: turn off cck's circuit if macrst =0
+	*/
+
+	write_phy_cck(dev, 0x00, 0xc8);
+	write_phy_cck(dev, 0x06, 0x1c);
+	write_phy_cck(dev, 0x10, 0x78);
+	write_phy_cck(dev, 0x2e, 0xd0);
+	write_phy_cck(dev, 0x2f, 0x06);
+	write_phy_cck(dev, 0x01, 0x46);
+
+	/* power control	*/
+	write_nic_byte(dev, CCK_TXAGC, 0x10);
+	write_nic_byte(dev, OFDM_TXAGC, 0x1B);
+	write_nic_byte(dev, ANTSEL, 0x03);
+
+
+
+	/*
+	=============================================================================
+		AGC.txt
+	=============================================================================
+	*/
+
+	write_phy_ofdm(dev, 0x00, 0x12);
+
+	for (i = 0; i < 128; i++)	{
+
+		data = ZEBRA_AGC[i+1];
+		data = data << 8;
+		data = data | 0x0000008F;
+
+		addr = i + 0x80; /* enable writing AGC table */
+		addr = addr << 8;
+		addr = addr | 0x0000008E;
+
+		WriteBBPortUchar(dev, data);
+		WriteBBPortUchar(dev, addr);
+		WriteBBPortUchar(dev, 0x0000008E);
+	}
+
+	PlatformIOWrite4Byte(dev, PhyAddr, 0x00001080);	/* Annie, 2006-05-05 */
+
+	/*
+	=============================================================================
+
+	=============================================================================
+	OFDMCONF.TXT
+	=============================================================================
+	*/
+
+	for (i = 0; i < 60; i++)	{
+		u4bRegOffset = i;
+		u4bRegValue = OFDM_CONFIG[i];
+
+		WriteBBPortUchar(dev,
+						(0x00000080 |
+						(u4bRegOffset & 0x7f) |
+						((u4bRegValue & 0xff) << 8)));
+	}
+
+	/*
+	=============================================================================
+	by amy for antenna
+	=============================================================================
+	*/
+/* {by amy 080312 */
+	/* Config Sw/Hw  Combinational Antenna Diversity. Added by Roger, 2008.02.26.	*/
+	SetAntennaConfig87SE(dev, priv->bDefaultAntenna1, priv->bSwAntennaDiverity);
+/* by amy 080312} */
+/* by amy for antenna */
+}
+
+
+void
+UpdateInitialGain(
+	struct net_device *dev
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	/* lzm add 080826 */
+	if (priv->eRFPowerState != eRfOn)	{
+		/*	Don't access BB/RF under disable PLL situation.
+			RT_TRACE(COMP_DIG, DBG_LOUD, ("UpdateInitialGain - pHalData->eRFPowerState!=eRfOn\n"));
+			Back to the original state
+		*/
+		priv->InitialGain = priv->InitialGainBackUp;
+		return;
+	}
+
+	switch (priv->InitialGain) {
+	case 1: /* m861dBm */
+		write_phy_ofdm(dev, 0x17, 0x26);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x86);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfa);	mdelay(1);
+		break;
+
+	case 2: /* m862dBm */
+		write_phy_ofdm(dev, 0x17, 0x36);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x86);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfa);	mdelay(1);
+		break;
+
+	case 3: /* m863dBm */
+		write_phy_ofdm(dev, 0x17, 0x36);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x86);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfb);	mdelay(1);
+		break;
+
+	case 4: /* m864dBm */
+		write_phy_ofdm(dev, 0x17, 0x46);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x86);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfb);	mdelay(1);
+		break;
+
+	case 5: /* m82dBm */
+		write_phy_ofdm(dev, 0x17, 0x46);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x96);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfb);	mdelay(1);
+		break;
+
+	case 6: /* m78dBm */
+		write_phy_ofdm(dev, 0x17, 0x56);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x96);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfc);	mdelay(1);
+		break;
+
+	case 7: /* m74dBm */
+		write_phy_ofdm(dev, 0x17, 0x56);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0xa6);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfc);	mdelay(1);
+		break;
+
+	case 8:
+		write_phy_ofdm(dev, 0x17, 0x66);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0xb6);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfc);	mdelay(1);
+		break;
+
+	default:	/* MP */
+		write_phy_ofdm(dev, 0x17, 0x26);	mdelay(1);
+		write_phy_ofdm(dev, 0x24, 0x86);	mdelay(1);
+		write_phy_ofdm(dev, 0x05, 0xfa);	mdelay(1);
+		break;
+	}
+}
+/*
+	Description:
+		Tx Power tracking mechanism routine on 87SE.
+	Created by Roger, 2007.12.11.
+*/
+void
+InitTxPwrTracking87SE(
+	struct net_device *dev
+)
+{
+	u32	u4bRfReg;
+
+	u4bRfReg = RF_ReadReg(dev, 0x02);
+
+	/* Enable Thermal meter indication.	*/
+	RF_WriteReg(dev, 0x02, u4bRfReg|PWR_METER_EN);			mdelay(1);
+}
+
+void
+PhyConfig8185(
+	struct net_device *dev
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+		write_nic_dword(dev, RCR, priv->ReceiveConfig);
+	   priv->RFProgType = read_nic_byte(dev, CONFIG4) & 0x03;
+	/*  RF config */
+	ZEBRA_Config_85BASIC_HardCode(dev);
+/* {by amy 080312 */
+	/* Set default initial gain state to 4, approved by SD3 DZ, by Bruce, 2007-06-06. */
+	if (priv->bDigMechanism)	{
+		if (priv->InitialGain == 0)
+			priv->InitialGain = 4;
+	}
+
+	/*
+		Enable thermal meter indication to implement TxPower tracking on 87SE.
+		We initialize thermal meter here to avoid unsuccessful configuration.
+		Added by Roger, 2007.12.11.
+	*/
+	if (priv->bTxPowerTrack)
+		InitTxPwrTracking87SE(dev);
+
+/* by amy 080312} */
+	priv->InitialGainBackUp = priv->InitialGain;
+	UpdateInitialGain(dev);
+
+	return;
+}
+
+void
+HwConfigureRTL8185(
+		struct net_device *dev
+		)
+{
+	/* RTL8185_TODO: Determine Retrylimit, TxAGC, AutoRateFallback control. */
+	u8		bUNIVERSAL_CONTROL_RL = 0;
+	u8		bUNIVERSAL_CONTROL_AGC = 1;
+	u8		bUNIVERSAL_CONTROL_ANT = 1;
+	u8		bAUTO_RATE_FALLBACK_CTL = 1;
+	u8		val8;
+	write_nic_word(dev, BRSR, 0x0fff);
+	/* Retry limit */
+	val8 = read_nic_byte(dev, CW_CONF);
+
+	if (bUNIVERSAL_CONTROL_RL)
+		val8 = val8 & 0xfd;
+	else
+		val8 = val8 | 0x02;
+
+	write_nic_byte(dev, CW_CONF, val8);
+
+	/* Tx AGC */
+	val8 = read_nic_byte(dev, TXAGC_CTL);
+	if (bUNIVERSAL_CONTROL_AGC)	{
+		write_nic_byte(dev, CCK_TXAGC, 128);
+		write_nic_byte(dev, OFDM_TXAGC, 128);
+		val8 = val8 & 0xfe;
+	}	else	{
+		val8 = val8 | 0x01 ;
+	}
+
+
+	write_nic_byte(dev, TXAGC_CTL, val8);
+
+	/* Tx Antenna including Feedback control	*/
+	val8 = read_nic_byte(dev, TXAGC_CTL);
+
+	if (bUNIVERSAL_CONTROL_ANT)	{
+		write_nic_byte(dev, ANTSEL, 0x00);
+		val8 = val8 & 0xfd;
+	}	else	{
+		val8 = val8 & (val8|0x02); /* xiong-2006-11-15 */
+	}
+
+	write_nic_byte(dev, TXAGC_CTL, val8);
+
+	/* Auto Rate fallback control	*/
+	val8 = read_nic_byte(dev, RATE_FALLBACK);
+	val8 &= 0x7c;
+	if (bAUTO_RATE_FALLBACK_CTL)	{
+		val8 |= RATE_FALLBACK_CTL_ENABLE | RATE_FALLBACK_CTL_AUTO_STEP1;
+
+		/* <RJ_TODO_8185B> We shall set up the ARFR according to user's setting. */
+		PlatformIOWrite2Byte(dev, ARFR, 0x0fff); /* set 1M ~ 54Mbps. */
+	}
+	write_nic_byte(dev, RATE_FALLBACK, val8);
+}
+
+static void
+MacConfig_85BASIC_HardCode(
+	struct net_device *dev)
+{
+	/*
+	============================================================================
+	MACREG.TXT
+	============================================================================
+	*/
+	int			nLinesRead = 0;
+
+	u32	u4bRegOffset, u4bRegValue, u4bPageIndex = 0;
+	int	i;
+
+	nLinesRead = sizeof(MAC_REG_TABLE)/2;
+
+	for (i = 0; i < nLinesRead; i++)	{	/* nLinesRead=101 */
+		u4bRegOffset = MAC_REG_TABLE[i][0];
+		u4bRegValue = MAC_REG_TABLE[i][1];
+
+				if (u4bRegOffset == 0x5e)
+					u4bPageIndex = u4bRegValue;
+
+				else
+						u4bRegOffset |= (u4bPageIndex << 8);
+
+		write_nic_byte(dev, u4bRegOffset, (u8)u4bRegValue);
+	}
+	/* ============================================================================ */
+}
+
+static void
+MacConfig_85BASIC(
+	struct net_device *dev)
+{
+
+	u8			u1DA;
+	MacConfig_85BASIC_HardCode(dev);
+
+	/* ============================================================================ */
+
+	/* Follow TID_AC_MAP of WMac. */
+	write_nic_word(dev, TID_AC_MAP, 0xfa50);
+
+	/* Interrupt Migration, Jong suggested we use set 0x0000 first, 2005.12.14, by rcnjko. */
+	write_nic_word(dev, IntMig, 0x0000);
+
+	/* Prevent TPC to cause CRC error. Added by Annie, 2006-06-10. */
+	PlatformIOWrite4Byte(dev, 0x1F0, 0x00000000);
+	PlatformIOWrite4Byte(dev, 0x1F4, 0x00000000);
+	PlatformIOWrite1Byte(dev, 0x1F8, 0x00);
+
+	/* Asked for by SD3 CM Lin, 2006.06.27, by rcnjko.	*/
+	/* power save parameter based on "87SE power save parameters 20071127.doc", as follow.	*/
+
+	/* Enable DA10 TX power saving */
+	u1DA = read_nic_byte(dev, PHYPR);
+	write_nic_byte(dev, PHYPR, (u1DA | BIT2));
+
+	/* POWER:	*/
+	write_nic_word(dev, 0x360, 0x1000);
+	write_nic_word(dev, 0x362, 0x1000);
+
+	/* AFE.		*/
+	write_nic_word(dev, 0x370, 0x0560);
+	write_nic_word(dev, 0x372, 0x0560);
+	write_nic_word(dev, 0x374, 0x0DA4);
+	write_nic_word(dev, 0x376, 0x0DA4);
+	write_nic_word(dev, 0x378, 0x0560);
+	write_nic_word(dev, 0x37A, 0x0560);
+	write_nic_word(dev, 0x37C, 0x00EC);
+	write_nic_word(dev, 0x37E, 0x00EC);	/*+edward	*/
+	write_nic_byte(dev, 0x24E, 0x01);
+}
+
+u8
+GetSupportedWirelessMode8185(
+	struct net_device *dev
+)
+{
+	u8			btSupportedWirelessMode = 0;
+
+	btSupportedWirelessMode = (WIRELESS_MODE_B | WIRELESS_MODE_G);
+	return btSupportedWirelessMode;
+}
+
+void
+ActUpdateChannelAccessSetting(
+	struct net_device *dev,
+	WIRELESS_MODE			WirelessMode,
+	PCHANNEL_ACCESS_SETTING	ChnlAccessSetting
+	)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	AC_CODING	eACI;
+	AC_PARAM	AcParam;
+	u8	bFollowLegacySetting = 0;
+	u8   u1bAIFS;
+
+	/*
+		<RJ_TODO_8185B>
+		TODO: We still don't know how to set up these registers, just follow WMAC to
+		verify 8185B FPAG.
+
+		<RJ_TODO_8185B>
+		Jong said CWmin/CWmax register are not functional in 8185B,
+		so we shall fill channel access realted register into AC parameter registers,
+		even in nQBss.
+	*/
+	ChnlAccessSetting->SIFS_Timer = 0x22; /* Suggested by Jong, 2005.12.08. */
+	ChnlAccessSetting->DIFS_Timer = 0x1C; /* 2006.06.02, by rcnjko.			*/
+	ChnlAccessSetting->SlotTimeTimer = 9; /* 2006.06.02, by rcnjko.			*/
+	ChnlAccessSetting->EIFS_Timer = 0x5B; /* Suggested by wcchu, it is the default value of EIFS register, 2005.12.08.	*/
+	ChnlAccessSetting->CWminIndex = 3; /* 2006.06.02, by rcnjko.			*/
+	ChnlAccessSetting->CWmaxIndex = 7; /* 2006.06.02, by rcnjko.			*/
+
+	write_nic_byte(dev, SIFS, ChnlAccessSetting->SIFS_Timer);
+	write_nic_byte(dev, SLOT, ChnlAccessSetting->SlotTimeTimer);	/* Rewrited from directly use PlatformEFIOWrite1Byte(), by Annie, 2006-03-29. */
+
+	u1bAIFS = aSifsTime + (2 * ChnlAccessSetting->SlotTimeTimer);
+
+	write_nic_byte(dev, EIFS, ChnlAccessSetting->EIFS_Timer);
+
+	write_nic_byte(dev, AckTimeOutReg, 0x5B); /* <RJ_EXPR_QOS> Suggested by wcchu, it is the default value of EIFS register, 2005.12.08. */
+
+	{ /* Legacy 802.11. */
+		bFollowLegacySetting = 1;
+
+	}
+
+	/* this setting is copied from rtl8187B.  xiong-2006-11-13 */
+	if (bFollowLegacySetting)	{
+
+		/*
+			Follow 802.11 seeting to AC parameter, all AC shall use the same parameter.
+			2005.12.01, by rcnjko.
+		*/
+		AcParam.longData = 0;
+		AcParam.f.AciAifsn.f.AIFSN = 2; /* Follow 802.11 DIFS.	*/
+		AcParam.f.AciAifsn.f.ACM = 0;
+		AcParam.f.Ecw.f.ECWmin = ChnlAccessSetting->CWminIndex; /*	Follow 802.11 CWmin.	*/
+		AcParam.f.Ecw.f.ECWmax = ChnlAccessSetting->CWmaxIndex; /*	Follow 802.11 CWmax.	*/
+		AcParam.f.TXOPLimit = 0;
+
+		/* lzm reserved 080826 */
+		/* For turbo mode setting. port from 87B by Isaiah 2008-08-01 */
+		if (ieee->current_network.Turbo_Enable == 1)
+			AcParam.f.TXOPLimit = 0x01FF;
+		/* For 87SE with Intel 4965  Ad-Hoc mode have poor throughput (19MB) */
+		if (ieee->iw_mode == IW_MODE_ADHOC)
+			AcParam.f.TXOPLimit = 0x0020;
+
+		for (eACI = 0; eACI < AC_MAX; eACI++)	{
+			AcParam.f.AciAifsn.f.ACI = (u8)eACI;
+			{
+				PAC_PARAM	pAcParam = (PAC_PARAM)(&AcParam);
+				AC_CODING	eACI;
+				u8		u1bAIFS;
+				u32		u4bAcParam;
+
+				/*  Retrive paramters to udpate. */
+				eACI = pAcParam->f.AciAifsn.f.ACI;
+				u1bAIFS = pAcParam->f.AciAifsn.f.AIFSN * ChnlAccessSetting->SlotTimeTimer + aSifsTime;
+				u4bAcParam = ((((u32)(pAcParam->f.TXOPLimit)) << AC_PARAM_TXOP_LIMIT_OFFSET)	|
+						(((u32)(pAcParam->f.Ecw.f.ECWmax)) << AC_PARAM_ECW_MAX_OFFSET)	|
+						(((u32)(pAcParam->f.Ecw.f.ECWmin)) << AC_PARAM_ECW_MIN_OFFSET)	|
+						(((u32)u1bAIFS) << AC_PARAM_AIFS_OFFSET));
+
+				switch (eACI)	{
+				case AC1_BK:
+					/* write_nic_dword(dev, AC_BK_PARAM, u4bAcParam); */
+					break;
+
+				case AC0_BE:
+					/* write_nic_dword(dev, AC_BK_PARAM, u4bAcParam); */
+					break;
+
+				case AC2_VI:
+					/* write_nic_dword(dev, AC_BK_PARAM, u4bAcParam); */
+					break;
+
+				case AC3_VO:
+					/* write_nic_dword(dev, AC_BK_PARAM, u4bAcParam); */
+					break;
+
+				default:
+					DMESGW("SetHwReg8185(): invalid ACI: %d !\n", eACI);
+					break;
+				}
+
+				/* Cehck ACM bit.	*/
+				/* If it is set, immediately set ACM control bit to downgrading AC for passing WMM testplan. Annie, 2005-12-13.	*/
+				{
+					PACI_AIFSN	pAciAifsn = (PACI_AIFSN)(&pAcParam->f.AciAifsn);
+					AC_CODING	eACI = pAciAifsn->f.ACI;
+
+					/*modified Joseph				*/
+					/*for 8187B AsynIORead issue	*/
+					u8	AcmCtrl = 0;
+					if (pAciAifsn->f.ACM)	{
+						/* ACM bit is 1. */
+						switch (eACI)	{
+						case AC0_BE:
+							AcmCtrl |= (BEQ_ACM_EN|BEQ_ACM_CTL|ACM_HW_EN);	/* or 0x21 */
+							break;
+
+						case AC2_VI:
+							AcmCtrl |= (VIQ_ACM_EN|VIQ_ACM_CTL|ACM_HW_EN);	/* or 0x42	*/
+							break;
+
+						case AC3_VO:
+							AcmCtrl |= (VOQ_ACM_EN|VOQ_ACM_CTL|ACM_HW_EN);	/* or 0x84 */
+							break;
+
+						default:
+							DMESGW("SetHwReg8185(): [HW_VAR_ACM_CTRL] ACM set failed: eACI is %d\n", eACI);
+							break;
+						}
+					}	else	{
+						/* ACM bit is 0. */
+						switch (eACI)	{
+						case AC0_BE:
+							AcmCtrl &= ((~BEQ_ACM_EN) & (~BEQ_ACM_CTL) & (~ACM_HW_EN));	/* and 0xDE */
+							break;
+
+						case AC2_VI:
+							AcmCtrl &= ((~VIQ_ACM_EN) & (~VIQ_ACM_CTL) & (~ACM_HW_EN));	/* and 0xBD */
+							break;
+
+						case AC3_VO:
+							AcmCtrl &= ((~VOQ_ACM_EN) & (~VOQ_ACM_CTL) & (~ACM_HW_EN));	/* and 0x7B */
+							break;
+
+						default:
+							break;
+						}
+					}
+					write_nic_byte(dev, ACM_CONTROL, 0);
+				}
+			}
+		}
+	}
+}
+
+void
+ActSetWirelessMode8185(
+	struct net_device *dev,
+	u8				btWirelessMode
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	u8	btSupportedWirelessMode = GetSupportedWirelessMode8185(dev);
+
+	if ((btWirelessMode & btSupportedWirelessMode) == 0)	{
+		/* Don't switch to unsupported wireless mode, 2006.02.15, by rcnjko.	*/
+		DMESGW("ActSetWirelessMode8185(): WirelessMode(%d) is not supported (%d)!\n",
+			btWirelessMode, btSupportedWirelessMode);
+		return;
+	}
+
+	/* 1. Assign wireless mode to swtich if necessary.	*/
+	if (btWirelessMode == WIRELESS_MODE_AUTO)	{
+		if ((btSupportedWirelessMode & WIRELESS_MODE_A))	{
+			btWirelessMode = WIRELESS_MODE_A;
+		}	else if (btSupportedWirelessMode & WIRELESS_MODE_G)	{
+				btWirelessMode = WIRELESS_MODE_G;
+
+		}	else if ((btSupportedWirelessMode & WIRELESS_MODE_B))	{
+				btWirelessMode = WIRELESS_MODE_B;
+		}	else	{
+				DMESGW("ActSetWirelessMode8185(): No valid wireless mode supported, btSupportedWirelessMode(%x)!!!\n",
+						btSupportedWirelessMode);
+				btWirelessMode = WIRELESS_MODE_B;
+		}
+	}
+
+	/* 2. Swtich band: RF or BB specific actions,
+	 * for example, refresh tables in omc8255, or change initial gain if necessary.
+	 * Nothing to do for Zebra to switch band.
+	 * Update current wireless mode if we swtich to specified band successfully. */
+
+	ieee->mode = (WIRELESS_MODE)btWirelessMode;
+
+	/* 3. Change related setting.	*/
+	if( ieee->mode == WIRELESS_MODE_A )	{
+		DMESG("WIRELESS_MODE_A\n");
+	}	else if( ieee->mode == WIRELESS_MODE_B )	{
+			DMESG("WIRELESS_MODE_B\n");
+	}	else if( ieee->mode == WIRELESS_MODE_G )	{
+			DMESG("WIRELESS_MODE_G\n");
+	}
+	ActUpdateChannelAccessSetting( dev, ieee->mode, &priv->ChannelAccessSetting);
+}
+
+void rtl8185b_irq_enable(struct net_device *dev)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	priv->irq_enabled = 1;
+	write_nic_dword(dev, IMR, priv->IntrMask);
+}
+/* by amy for power save */
+void
+DrvIFIndicateDisassociation(
+	struct net_device *dev,
+	u16			reason
+	)
+{
+		/* nothing is needed after disassociation request. */
+	}
+void
+MgntDisconnectIBSS(
+	struct net_device *dev
+)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u8			i;
+
+	DrvIFIndicateDisassociation(dev, unspec_reason);
+
+	for (i = 0; i < 6 ; i++)
+		priv->ieee80211->current_network.bssid[i] = 0x55;
+
+
+
+	priv->ieee80211->state = IEEE80211_NOLINK;
+	/*
+		Stop Beacon.
+
+		Vista add a Adhoc profile, HW radio off until OID_DOT11_RESET_REQUEST
+		Driver would set MSR=NO_LINK, then HW Radio ON, MgntQueue Stuck.
+		Because Bcn DMA isn't complete, mgnt queue would stuck until Bcn packet send.
+
+		Disable Beacon Queue Own bit, suggested by jong	*/
+	ieee80211_stop_send_beacons(priv->ieee80211);
+
+	priv->ieee80211->link_change(dev);
+	notify_wx_assoc_event(priv->ieee80211);
+}
+void
+MlmeDisassociateRequest(
+	struct net_device *dev,
+	u8 *asSta,
+	u8	asRsn
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	u8 i;
+
+	SendDisassociation(priv->ieee80211, asSta, asRsn);
+
+	if (memcmp(priv->ieee80211->current_network.bssid, asSta, 6) == 0)	{
+		/*ShuChen TODO: change media status.			*/
+		/*ShuChen TODO: What to do when disassociate.	*/
+		DrvIFIndicateDisassociation(dev, unspec_reason);
+
+
+
+		for (i = 0; i < 6; i++)
+			priv->ieee80211->current_network.bssid[i] = 0x22;
+
+		ieee80211_disassociate(priv->ieee80211);
+	}
+
+}
+
+void
+MgntDisconnectAP(
+	struct net_device *dev,
+	u8			asRsn
+)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	/*
+	Commented out by rcnjko, 2005.01.27:
+	I move SecClearAllKeys() to MgntActSet_802_11_DISASSOCIATE().
+
+		2004/09/15, kcwu, the key should be cleared, or the new handshaking will not success
+
+		In WPA WPA2 need to Clear all key ... because new key will set after new handshaking.
+		2004.10.11, by rcnjko. */
+	MlmeDisassociateRequest(dev, priv->ieee80211->current_network.bssid, asRsn);
+
+	priv->ieee80211->state = IEEE80211_NOLINK;
+}
+bool
+MgntDisconnect(
+	struct net_device *dev,
+	u8			asRsn
+)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	/*
+		Schedule an workitem to wake up for ps mode, 070109, by rcnjko.
+	*/
+
+	if (IS_DOT11D_ENABLE(priv->ieee80211))
+		Dot11d_Reset(priv->ieee80211);
+	/* In adhoc mode, update beacon frame.	*/
+	if (priv->ieee80211->state == IEEE80211_LINKED)	{
+		if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+			MgntDisconnectIBSS(dev);
+
+		if (priv->ieee80211->iw_mode == IW_MODE_INFRA)	{
+			/*	We clear key here instead of MgntDisconnectAP() because that
+				MgntActSet_802_11_DISASSOCIATE() is an interface called by OS,
+				e.g. OID_802_11_DISASSOCIATE in Windows while as MgntDisconnectAP() is
+				used to handle disassociation related things to AP, e.g. send Disassoc
+				frame to AP.  2005.01.27, by rcnjko.	*/
+			MgntDisconnectAP(dev, asRsn);
+		}
+		/* Inidicate Disconnect, 2005.02.23, by rcnjko.	*/
+	}
+	return true;
+}
+/*
+	Description:
+		Chang RF Power State.
+		Note that, only MgntActSet_RF_State() is allowed to set HW_VAR_RF_STATE.
+
+	Assumption:
+		PASSIVE LEVEL.
+*/
+bool
+SetRFPowerState(
+	struct net_device *dev,
+	RT_RF_POWER_STATE	eRFPowerState
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	bool			bResult = false;
+
+	if (eRFPowerState == priv->eRFPowerState)
+		return bResult;
+
+	 bResult = SetZebraRFPowerState8185(dev, eRFPowerState);
+
+	return bResult;
+}
+void
+HalEnableRx8185Dummy(
+	struct net_device *dev
+	)
+{
+}
+void
+HalDisableRx8185Dummy(
+	struct net_device *dev
+	)
+{
+}
+
+bool
+MgntActSet_RF_State(
+	struct net_device *dev,
+	RT_RF_POWER_STATE	StateToSet,
+	u32	ChangeSource
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	bool				bActionAllowed = false;
+	bool				bConnectBySSID = false;
+	RT_RF_POWER_STATE	rtState;
+	u16				RFWaitCounter = 0;
+	unsigned long flag;
+	/*
+		Prevent the race condition of RF state change. By Bruce, 2007-11-28.
+		Only one thread can change the RF state at one time, and others should wait to be executed.
+	*/
+	while (true)	{
+		spin_lock_irqsave(&priv->rf_ps_lock, flag);
+		if (priv->RFChangeInProgress)	{
+			spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
+			/*  Set RF after the previous action is done.	*/
+			while (priv->RFChangeInProgress)	{
+				RFWaitCounter++;
+				udelay(1000); /* 1 ms	*/
+
+				/* Wait too long, return FALSE to avoid to be stuck here.	*/
+				if (RFWaitCounter > 1000)	{	/* 1sec	*/
+					printk("MgntActSet_RF_State(): Wait too long to set RF\n");
+					/* TODO: Reset RF state?	*/
+					return false;
+				}
+			}
+		}	else	{
+			priv->RFChangeInProgress = true;
+			spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
+			break;
+		}
+	}
+	rtState = priv->eRFPowerState;
+
+	switch (StateToSet)	{
+	case eRfOn:
+		/*
+			Turn On RF no matter the IPS setting because we need to update the RF state to Ndis under Vista, or
+			the Windows does not allow the driver to perform site survey any more. By Bruce, 2007-10-02.
+		*/
+		priv->RfOffReason &= (~ChangeSource);
+
+		if (!priv->RfOffReason)	{
+			priv->RfOffReason = 0;
+			bActionAllowed = true;
+
+			if (rtState == eRfOff && ChangeSource >= RF_CHANGE_BY_HW && !priv->bInHctTest)
+				bConnectBySSID = true;
+
+		}	else
+				;
+		break;
+
+	case eRfOff:
+		 /* 070125, rcnjko: we always keep connected in AP mode.	*/
+
+			if (priv->RfOffReason > RF_CHANGE_BY_IPS)	{
+				/*
+					060808, Annie:
+					Disconnect to current BSS when radio off. Asked by QuanTa.
+
+					Calling MgntDisconnect() instead of MgntActSet_802_11_DISASSOCIATE(),
+					because we do NOT need to set ssid to dummy ones.
+				*/
+				MgntDisconnect(dev, disas_lv_ss);
+
+				/* Clear content of bssDesc[] and bssDesc4Query[] to avoid reporting old bss to UI.	*/
+			}
+
+		priv->RfOffReason |= ChangeSource;
+		bActionAllowed = true;
+		break;
+	case eRfSleep:
+		priv->RfOffReason |= ChangeSource;
+		bActionAllowed = true;
+		break;
+	default:
+		break;
+	}
+
+	if (bActionAllowed)	{
+				/* Config HW to the specified mode.	*/
+		SetRFPowerState(dev, StateToSet);
+
+		/* Turn on RF.	*/
+		if (StateToSet == eRfOn)		{
+			HalEnableRx8185Dummy(dev);
+			if (bConnectBySSID)	{
+				/* by amy not supported	*/
+			}
+		}
+		/* Turn off RF.	*/
+		else if (StateToSet == eRfOff)
+			HalDisableRx8185Dummy(dev);
+
+	}
+
+	/* Release RF spinlock	*/
+	spin_lock_irqsave(&priv->rf_ps_lock, flag);
+	priv->RFChangeInProgress = false;
+	spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
+	return bActionAllowed;
+}
+void
+InactivePowerSave(
+	struct net_device *dev
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	/*
+		This flag "bSwRfProcessing", indicates the status of IPS procedure, should be set if the IPS workitem
+		is really scheduled.
+		The old code, sets this flag before scheduling the IPS workitem and however, at the same time the
+		previous IPS workitem did not end yet, fails to schedule the current workitem. Thus, bSwRfProcessing
+		blocks the IPS procedure of switching RF.
+	*/
+	priv->bSwRfProcessing = true;
+
+	MgntActSet_RF_State(dev, priv->eInactivePowerState, RF_CHANGE_BY_IPS);
+
+	/*
+		To solve CAM values miss in RF OFF, rewrite CAM values after RF ON. By Bruce, 2007-09-20.
+	*/
+
+	priv->bSwRfProcessing = false;
+}
+
+/*
+	Description:
+		Enter the inactive power save mode. RF will be off
+*/
+void
+IPSEnter(
+	struct net_device *dev
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	RT_RF_POWER_STATE rtState;
+	if (priv->bInactivePs)	{
+		rtState = priv->eRFPowerState;
+
+		/*
+			Do not enter IPS in the following conditions:
+			(1) RF is already OFF or Sleep
+			(2) bSwRfProcessing (indicates the IPS is still under going)
+			(3) Connectted (only disconnected can trigger IPS)
+			(4) IBSS (send Beacon)
+			(5) AP mode (send Beacon)
+		*/
+		if (rtState == eRfOn && !priv->bSwRfProcessing
+			&& (priv->ieee80211->state != IEEE80211_LINKED))	{
+			priv->eInactivePowerState = eRfOff;
+			InactivePowerSave(dev);
+		}
+	}
+}
+void
+IPSLeave(
+	struct net_device *dev
+	)
+{
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+	RT_RF_POWER_STATE rtState;
+	if (priv->bInactivePs)	{
+		rtState = priv->eRFPowerState;
+		if ((rtState == eRfOff || rtState == eRfSleep) && (!priv->bSwRfProcessing) && priv->RfOffReason <= RF_CHANGE_BY_IPS)	{
+			priv->eInactivePowerState = eRfOn;
+			InactivePowerSave(dev);
+		}
+	}
+}
+
+void rtl8185b_adapter_start(struct net_device *dev)
+{
+	struct r8180_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+
+	u8 SupportedWirelessMode;
+	u8			InitWirelessMode;
+	u8			bInvalidWirelessMode = 0;
+	u8 tmpu8;
+	u8 btCR9346;
+	u8 TmpU1b;
+	u8 btPSR;
+
+	write_nic_byte(dev, 0x24e, (BIT5|BIT6|BIT0));
+	rtl8180_reset(dev);
+
+	priv->dma_poll_mask = 0;
+	priv->dma_poll_stop_mask = 0;
+
+	HwConfigureRTL8185(dev);
+	write_nic_dword(dev, MAC0, ((u32 *)dev->dev_addr)[0]);
+	write_nic_word(dev, MAC4, ((u32 *)dev->dev_addr)[1] & 0xffff);
+	write_nic_byte(dev, MSR, read_nic_byte(dev, MSR) & 0xf3);	/* default network type to 'No	Link'	*/
+	write_nic_word(dev, BcnItv, 100);
+	write_nic_word(dev, AtimWnd, 2);
+	PlatformIOWrite2Byte(dev, FEMR, 0xFFFF);
+	write_nic_byte(dev, WPA_CONFIG, 0);
+	MacConfig_85BASIC(dev);
+	/*	Override the RFSW_CTRL (MAC offset 0x272-0x273), 2006.06.07, by rcnjko.	*/
+	/*	BT_DEMO_BOARD type	*/
+	PlatformIOWrite2Byte(dev, RFSW_CTRL, 0x569a);
+
+	/*
+	-----------------------------------------------------------------------------
+		Set up PHY related.
+	-----------------------------------------------------------------------------
+	*/
+	/* Enable Config3.PARAM_En to revise AnaaParm.	*/
+	write_nic_byte(dev, CR9346, 0xc0);	/* enable config register write */
+	tmpu8 = read_nic_byte(dev, CONFIG3);
+	write_nic_byte(dev, CONFIG3, (tmpu8 | CONFIG3_PARM_En));
+	/* Turn on Analog power.	*/
+	/* Asked for by William, otherwise, MAC 3-wire can't work, 2006.06.27, by rcnjko.	*/
+	write_nic_dword(dev, ANAPARAM2, ANAPARM2_ASIC_ON);
+	write_nic_dword(dev, ANAPARAM, ANAPARM_ASIC_ON);
+	write_nic_word(dev, ANAPARAM3, 0x0010);
+
+	write_nic_byte(dev, CONFIG3, tmpu8);
+	write_nic_byte(dev, CR9346, 0x00);
+	/* enable EEM0 and EEM1 in 9346CR			*/
+	btCR9346 = read_nic_byte(dev, CR9346);
+	write_nic_byte(dev, CR9346, (btCR9346 | 0xC0));
+
+	/* B cut use LED1 to control HW RF on/off	*/
+	TmpU1b = read_nic_byte(dev, CONFIG5);
+	TmpU1b = TmpU1b & ~BIT3;
+	write_nic_byte(dev, CONFIG5, TmpU1b);
+
+	/* disable EEM0 and EEM1 in 9346CR	*/
+	btCR9346 &= ~(0xC0);
+	write_nic_byte(dev, CR9346, btCR9346);
+
+	/* Enable Led (suggested by Jong)	*/
+	/* B-cut RF Radio on/off  5e[3]=0	*/
+	btPSR = read_nic_byte(dev, PSR);
+	write_nic_byte(dev, PSR, (btPSR | BIT3));
+	/* setup initial timing for RFE.	*/
+	write_nic_word(dev, RFPinsOutput, 0x0480);
+	SetOutputEnableOfRfPins(dev);
+	write_nic_word(dev, RFPinsSelect, 0x2488);
+
+	/* PHY config.	*/
+	PhyConfig8185(dev);
+
+	/*
+		We assume RegWirelessMode has already been initialized before,
+		however, we has to validate the wireless mode here and provide a
+		reasonable initialized value if necessary. 2005.01.13, by rcnjko.
+	*/
+	SupportedWirelessMode = GetSupportedWirelessMode8185(dev);
+	if ((ieee->mode != WIRELESS_MODE_B) &&
+		(ieee->mode != WIRELESS_MODE_G) &&
+		(ieee->mode != WIRELESS_MODE_A) &&
+		(ieee->mode != WIRELESS_MODE_AUTO))	{
+		/* It should be one of B, G, A, or AUTO.	*/
+		bInvalidWirelessMode = 1;
+	}	else	{
+	/* One of B, G, A, or AUTO.	*/
+		/* Check if the wireless mode is supported by RF.	*/
+		if	((ieee->mode != WIRELESS_MODE_AUTO) &&
+			(ieee->mode & SupportedWirelessMode) == 0)	{
+			bInvalidWirelessMode = 1;
+		}
+	}
+
+	if (bInvalidWirelessMode || ieee->mode == WIRELESS_MODE_AUTO)	{
+		/* Auto or other invalid value.				*/
+		/* Assigne a wireless mode to initialize.	*/
+		if ((SupportedWirelessMode & WIRELESS_MODE_A))	{
+			InitWirelessMode = WIRELESS_MODE_A;
+		}	else if ((SupportedWirelessMode & WIRELESS_MODE_G))	{
+			InitWirelessMode = WIRELESS_MODE_G;
+		}	else if ((SupportedWirelessMode & WIRELESS_MODE_B))	{
+			InitWirelessMode = WIRELESS_MODE_B;
+		}	else	{
+			DMESGW("InitializeAdapter8185(): No valid wireless mode supported, SupportedWirelessMode(%x)!!!\n",
+				 SupportedWirelessMode);
+			InitWirelessMode = WIRELESS_MODE_B;
+		}
+
+		/* Initialize RegWirelessMode if it is not a valid one.	*/
+		if (bInvalidWirelessMode)
+			ieee->mode = (WIRELESS_MODE)InitWirelessMode;
+
+	}	else	{
+	/* One of B, G, A.	*/
+		InitWirelessMode = ieee->mode;
+	}
+/* by amy for power save	*/
+	priv->eRFPowerState = eRfOff;
+	priv->RfOffReason = 0;
+	{
+		MgntActSet_RF_State(dev, eRfOn, 0);
+	}
+		/*
+			If inactive power mode is enabled, disable rf while in disconnected state.
+		*/
+	if (priv->bInactivePs)
+		MgntActSet_RF_State(dev , eRfOff, RF_CHANGE_BY_IPS);
+
+/* by amy for power save	*/
+
+	ActSetWirelessMode8185(dev, (u8)(InitWirelessMode));
+
+	/* ----------------------------------------------------------------------------- */
+
+	rtl8185b_irq_enable(dev);
+
+	netif_start_queue(dev);
+	}
+
+void rtl8185b_rx_enable(struct net_device *dev)
+{
+	u8 cmd;
+	/* for now we accept data, management & ctl frame*/
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+
+	if (dev->flags & IFF_PROMISC)
+		DMESG("NIC in promisc mode");
+
+	if (priv->ieee80211->iw_mode == IW_MODE_MONITOR || \
+	   dev->flags & IFF_PROMISC)	{
+		priv->ReceiveConfig = priv->ReceiveConfig & (~RCR_APM);
+		priv->ReceiveConfig = priv->ReceiveConfig | RCR_AAP;
+	}
+
+	if (priv->ieee80211->iw_mode == IW_MODE_MONITOR)
+		priv->ReceiveConfig = priv->ReceiveConfig | RCR_ACF | RCR_APWRMGT | RCR_AICV;
+
+
+	if (priv->crcmon == 1 && priv->ieee80211->iw_mode == IW_MODE_MONITOR)
+		priv->ReceiveConfig = priv->ReceiveConfig | RCR_ACRC32;
+
+	write_nic_dword(dev, RCR, priv->ReceiveConfig);
+
+	fix_rx_fifo(dev);
+
+	cmd = read_nic_byte(dev, CMD);
+	write_nic_byte(dev, CMD, cmd | (1<<CMD_RX_ENABLE_SHIFT));
+
+}
+
+void rtl8185b_tx_enable(struct net_device *dev)
+{
+	u8 cmd;
+	u8 byte;
+	struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
+
+	write_nic_dword(dev, TCR, priv->TransmitConfig);
+	byte = read_nic_byte(dev, MSR);
+	byte |= MSR_LINK_ENEDCA;
+	write_nic_byte(dev, MSR, byte);
+
+	fix_tx_fifo(dev);
+
+	cmd = read_nic_byte(dev, CMD);
+	write_nic_byte(dev, CMD, cmd | (1<<CMD_TX_ENABLE_SHIFT));
+}
+