Merge branch 'master' into upstream

Conflicts:

	drivers/scsi/libata-core.c
	drivers/scsi/libata-scsi.c
	include/linux/pci_ids.h

25 files changed, 3647 insertions, 1066 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index e0874cbfefe..30ec235e693 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -235,7 +235,35 @@ config IPW2200_MONITOR
           promiscuous mode via the Wireless Tool's Monitor mode.  While in this
           mode, no packets can be sent.
 
-config IPW_QOS
+config IPW2200_RADIOTAP
+        bool "Enable radiotap format 802.11 raw packet support"
+        depends on IPW2200_MONITOR
+
+config IPW2200_PROMISCUOUS
+        bool "Enable creation of a RF radiotap promiscuous interface"
+        depends on IPW2200_MONITOR
+        select IPW2200_RADIOTAP
+        ---help---
+          Enables the creation of a second interface prefixed 'rtap'. 
+          This second interface will provide every received in radiotap
+          format.
+
+          This is useful for performing wireless network analysis while
+          maintaining an active association.
+
+          Example usage:
+
+            % modprobe ipw2200 rtap_iface=1
+            % ifconfig rtap0 up
+            % tethereal -i rtap0
+
+          If you do not specify 'rtap_iface=1' as a module parameter then 
+          the rtap interface will not be created and you will need to turn 
+          it on via sysfs:
+        
+            % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
+
+config IPW2200_QOS
         bool "Enable QoS support"
         depends on IPW2200 && EXPERIMENTAL
 
@@ -503,6 +531,23 @@ config PRISM54
           say M here and read <file:Documentation/modules.txt>.  The module
           will be called prism54.ko.
 
+config USB_ZD1201
+        tristate "USB ZD1201 based Wireless device support"
+        depends on USB && NET_RADIO
+        select FW_LOADER
+        ---help---
+          Say Y if you want to use wireless LAN adapters based on the ZyDAS
+          ZD1201 chip.
+
+          This driver makes the adapter appear as a normal Ethernet interface,
+          typically on wlan0.
+
+          The zd1201 device requires external firmware to be loaded.
+          This can be found at http://linux-lc100020.sourceforge.net/
+
+          To compile this driver as a module, choose M here: the
+          module will be called zd1201.
+
 source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/bcm43xx/Kconfig"
 
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index c8677987936..512603de309 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -40,3 +40,5 @@ obj-$(CONFIG_BCM43XX)		+= bcm43xx/
 # 16-bit wireless PCMCIA client drivers
 obj-$(CONFIG_PCMCIA_RAYCS)      += ray_cs.o
 obj-$(CONFIG_PCMCIA_WL3501)     += wl3501_cs.o
+
+obj-$(CONFIG_USB_ZD1201)        += zd1201.o
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 00764ddd74d..4069b79d825 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -47,6 +47,7 @@
 #include <linux/ioport.h>
 #include <linux/pci.h>
 #include <asm/uaccess.h>
+#include <net/ieee80211.h>
 
 #include "airo.h"
 
@@ -467,6 +468,8 @@ static int do8bitIO = 0;
 #define RID_ECHOTEST_RESULTS 0xFF71
 #define RID_BSSLISTFIRST 0xFF72
 #define RID_BSSLISTNEXT  0xFF73
+#define RID_WPA_BSSLISTFIRST 0xFF74
+#define RID_WPA_BSSLISTNEXT  0xFF75
 
 typedef struct {
         u16 cmd;
@@ -739,6 +742,14 @@ typedef struct {
         u16 extSoftCap;
 } CapabilityRid;
 
+
+/* Only present on firmware >= 5.30.17 */
+typedef struct {
+  u16 unknown[4];
+  u8 fixed[12]; /* WLAN management frame */
+  u8 iep[624];
+} BSSListRidExtra;
+
 typedef struct {
   u16 len;
   u16 index; /* First is 0 and 0xffff means end of list */
@@ -767,6 +778,9 @@ typedef struct {
   } fh;
   u16 dsChannel;
   u16 atimWindow;
+
+  /* Only present on firmware >= 5.30.17 */
+  BSSListRidExtra extra;
 } BSSListRid;
 
 typedef struct {
@@ -1140,8 +1154,6 @@ struct airo_info {
         char defindex; // Used with auto wep
         struct proc_dir_entry *proc_entry;
         spinlock_t aux_lock;
-        unsigned long flags;
-#define FLAG_PROMISC    8       /* IFF_PROMISC 0x100 - include/linux/if.h */
 #define FLAG_RADIO_OFF  0       /* User disabling of MAC */
 #define FLAG_RADIO_DOWN 1       /* ifup/ifdown disabling of MAC */
 #define FLAG_RADIO_MASK 0x03
@@ -1151,6 +1163,7 @@ struct airo_info {
 #define FLAG_UPDATE_MULTI 5
 #define FLAG_UPDATE_UNI 6
 #define FLAG_802_11     7
+#define FLAG_PROMISC    8       /* IFF_PROMISC 0x100 - include/linux/if.h */
 #define FLAG_PENDING_XMIT 9
 #define FLAG_PENDING_XMIT11 10
 #define FLAG_MPI        11
@@ -1158,17 +1171,19 @@ struct airo_info {
 #define FLAG_COMMIT     13
 #define FLAG_RESET      14
 #define FLAG_FLASHING   15
-#define JOB_MASK        0x2ff0000
-#define JOB_DIE         16
-#define JOB_XMIT        17
-#define JOB_XMIT11      18
-#define JOB_STATS       19
-#define JOB_PROMISC     20
-#define JOB_MIC         21
-#define JOB_EVENT       22
-#define JOB_AUTOWEP     23
-#define JOB_WSTATS      24
-#define JOB_SCAN_RESULTS  25
+#define FLAG_WPA_CAPABLE        16
+        unsigned long flags;
+#define JOB_DIE 0
+#define JOB_XMIT        1
+#define JOB_XMIT11      2
+#define JOB_STATS       3
+#define JOB_PROMISC     4
+#define JOB_MIC 5
+#define JOB_EVENT       6
+#define JOB_AUTOWEP     7
+#define JOB_WSTATS      8
+#define JOB_SCAN_RESULTS  9
+        unsigned long jobs;
         int (*bap_read)(struct airo_info*, u16 *pu16Dst, int bytelen,
                         int whichbap);
         unsigned short *flash;
@@ -1208,6 +1223,11 @@ struct airo_info {
 #define PCI_SHARED_LEN          2*MPI_MAX_FIDS*PKTSIZE+RIDSIZE
         char                    proc_name[IFNAMSIZ];
 
+        /* WPA-related stuff */
+        unsigned int bssListFirst;
+        unsigned int bssListNext;
+        unsigned int bssListRidLen;
+
         struct list_head network_list;
         struct list_head network_free_list;
         BSSListElement *networks;
@@ -1264,7 +1284,7 @@ static void micinit(struct airo_info *ai)
 {
         MICRid mic_rid;
 
-        clear_bit(JOB_MIC, &ai->flags);
+        clear_bit(JOB_MIC, &ai->jobs);
         PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid), 0);
         up(&ai->sem);
 
@@ -1705,24 +1725,24 @@ static void emmh32_final(emmh32_context *context, u8 digest[4])
 static int readBSSListRid(struct airo_info *ai, int first,
                       BSSListRid *list) {
         int rc;
-                        Cmd cmd;
-                        Resp rsp;
+        Cmd cmd;
+        Resp rsp;
 
         if (first == 1) {
-                        if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
-                        memset(&cmd, 0, sizeof(cmd));
-                        cmd.cmd=CMD_LISTBSS;
-                        if (down_interruptible(&ai->sem))
-                                return -ERESTARTSYS;
-                        issuecommand(ai, &cmd, &rsp);
-                        up(&ai->sem);
-                        /* Let the command take effect */
-                        ai->task = current;
-                        ssleep(3);
-                        ai->task = NULL;
-                }
-        rc = PC4500_readrid(ai, first ? RID_BSSLISTFIRST : RID_BSSLISTNEXT,
-                            list, sizeof(*list), 1);
+                if (ai->flags & FLAG_RADIO_MASK) return -ENETDOWN;
+                memset(&cmd, 0, sizeof(cmd));
+                cmd.cmd=CMD_LISTBSS;
+                if (down_interruptible(&ai->sem))
+                        return -ERESTARTSYS;
+                issuecommand(ai, &cmd, &rsp);
+                up(&ai->sem);
+                /* Let the command take effect */
+                ai->task = current;
+                ssleep(3);
+                ai->task = NULL;
+        }
+        rc = PC4500_readrid(ai, first ? ai->bssListFirst : ai->bssListNext,
+                            list, ai->bssListRidLen, 1);
 
         list->len = le16_to_cpu(list->len);
         list->index = le16_to_cpu(list->index);
@@ -2112,7 +2132,7 @@ static void airo_end_xmit(struct net_device *dev) {
         int fid = priv->xmit.fid;
         u32 *fids = priv->fids;
 
-        clear_bit(JOB_XMIT, &priv->flags);
+        clear_bit(JOB_XMIT, &priv->jobs);
         clear_bit(FLAG_PENDING_XMIT, &priv->flags);
         status = transmit_802_3_packet (priv, fids[fid], skb->data);
         up(&priv->sem);
@@ -2162,7 +2182,7 @@ static int airo_start_xmit(struct sk_buff *skb, struct net_device *dev) {
         if (down_trylock(&priv->sem) != 0) {
                 set_bit(FLAG_PENDING_XMIT, &priv->flags);
                 netif_stop_queue(dev);
-                set_bit(JOB_XMIT, &priv->flags);
+                set_bit(JOB_XMIT, &priv->jobs);
                 wake_up_interruptible(&priv->thr_wait);
         } else
                 airo_end_xmit(dev);
@@ -2177,7 +2197,7 @@ static void airo_end_xmit11(struct net_device *dev) {
         int fid = priv->xmit11.fid;
         u32 *fids = priv->fids;
 
-        clear_bit(JOB_XMIT11, &priv->flags);
+        clear_bit(JOB_XMIT11, &priv->jobs);
         clear_bit(FLAG_PENDING_XMIT11, &priv->flags);
         status = transmit_802_11_packet (priv, fids[fid], skb->data);
         up(&priv->sem);
@@ -2233,7 +2253,7 @@ static int airo_start_xmit11(struct sk_buff *skb, struct net_device *dev) {
         if (down_trylock(&priv->sem) != 0) {
                 set_bit(FLAG_PENDING_XMIT11, &priv->flags);
                 netif_stop_queue(dev);
-                set_bit(JOB_XMIT11, &priv->flags);
+                set_bit(JOB_XMIT11, &priv->jobs);
                 wake_up_interruptible(&priv->thr_wait);
         } else
                 airo_end_xmit11(dev);
@@ -2244,7 +2264,7 @@ static void airo_read_stats(struct airo_info *ai) {
         StatsRid stats_rid;
         u32 *vals = stats_rid.vals;
 
-        clear_bit(JOB_STATS, &ai->flags);
+        clear_bit(JOB_STATS, &ai->jobs);
         if (ai->power.event) {
                 up(&ai->sem);
                 return;
@@ -2272,10 +2292,10 @@ static struct net_device_stats *airo_get_stats(struct net_device *dev)
 {
         struct airo_info *local =  dev->priv;
 
-        if (!test_bit(JOB_STATS, &local->flags)) {
+        if (!test_bit(JOB_STATS, &local->jobs)) {
                 /* Get stats out of the card if available */
                 if (down_trylock(&local->sem) != 0) {
-                        set_bit(JOB_STATS, &local->flags);
+                        set_bit(JOB_STATS, &local->jobs);
                         wake_up_interruptible(&local->thr_wait);
                 } else
                         airo_read_stats(local);
@@ -2290,7 +2310,7 @@ static void airo_set_promisc(struct airo_info *ai) {
 
         memset(&cmd, 0, sizeof(cmd));
         cmd.cmd=CMD_SETMODE;
-        clear_bit(JOB_PROMISC, &ai->flags);
+        clear_bit(JOB_PROMISC, &ai->jobs);
         cmd.parm0=(ai->flags&IFF_PROMISC) ? PROMISC : NOPROMISC;
         issuecommand(ai, &cmd, &rsp);
         up(&ai->sem);
@@ -2302,7 +2322,7 @@ static void airo_set_multicast_list(struct net_device *dev) {
         if ((dev->flags ^ ai->flags) & IFF_PROMISC) {
                 change_bit(FLAG_PROMISC, &ai->flags);
                 if (down_trylock(&ai->sem) != 0) {
-                        set_bit(JOB_PROMISC, &ai->flags);
+                        set_bit(JOB_PROMISC, &ai->jobs);
                         wake_up_interruptible(&ai->thr_wait);
                 } else
                         airo_set_promisc(ai);
@@ -2380,7 +2400,7 @@ void stop_airo_card( struct net_device *dev, int freeres )
                 }
                 clear_bit(FLAG_REGISTERED, &ai->flags);
         }
-        set_bit(JOB_DIE, &ai->flags);
+        set_bit(JOB_DIE, &ai->jobs);
         kill_proc(ai->thr_pid, SIGTERM, 1);
         wait_for_completion(&ai->thr_exited);
 
@@ -2701,14 +2721,14 @@ static int reset_card( struct net_device *dev , int lock) {
         return 0;
 }
 
-#define MAX_NETWORK_COUNT       64
+#define AIRO_MAX_NETWORK_COUNT  64
 static int airo_networks_allocate(struct airo_info *ai)
 {
         if (ai->networks)
                 return 0;
 
         ai->networks =
-            kzalloc(MAX_NETWORK_COUNT * sizeof(BSSListElement),
+            kzalloc(AIRO_MAX_NETWORK_COUNT * sizeof(BSSListElement),
                     GFP_KERNEL);
         if (!ai->networks) {
                 airo_print_warn(ai->dev->name, "Out of memory allocating beacons");
@@ -2732,11 +2752,33 @@ static void airo_networks_initialize(struct airo_info *ai)
 
         INIT_LIST_HEAD(&ai->network_free_list);
         INIT_LIST_HEAD(&ai->network_list);
-        for (i = 0; i < MAX_NETWORK_COUNT; i++)
+        for (i = 0; i < AIRO_MAX_NETWORK_COUNT; i++)
                 list_add_tail(&ai->networks[i].list,
                               &ai->network_free_list);
 }
 
+static int airo_test_wpa_capable(struct airo_info *ai)
+{
+        int status;
+        CapabilityRid cap_rid;
+        const char *name = ai->dev->name;
+
+        status = readCapabilityRid(ai, &cap_rid, 1);
+        if (status != SUCCESS) return 0;
+
+        /* Only firmware versions 5.30.17 or better can do WPA */
+        if ((cap_rid.softVer > 0x530)
+          || ((cap_rid.softVer == 0x530) && (cap_rid.softSubVer >= 17))) {
+                airo_print_info(name, "WPA is supported.");
+                return 1;
+        }
+
+        /* No WPA support */
+        airo_print_info(name, "WPA unsupported (only firmware versions 5.30.17"
+                " and greater support WPA.  Detected %s)", cap_rid.prodVer);
+        return 0;
+}
+
 static struct net_device *_init_airo_card( unsigned short irq, int port,
                                            int is_pcmcia, struct pci_dev *pci,
                                            struct device *dmdev )
@@ -2759,6 +2801,7 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
         ai = dev->priv;
         ai->wifidev = NULL;
         ai->flags = 0;
+        ai->jobs = 0;
         ai->dev = dev;
         if (pci && (pci->device == 0x5000 || pci->device == 0xa504)) {
                 airo_print_dbg(dev->name, "Found an MPI350 card");
@@ -2838,6 +2881,18 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
                 set_bit(FLAG_FLASHING, &ai->flags);
         }
 
+        /* Test for WPA support */
+        if (airo_test_wpa_capable(ai)) {
+                set_bit(FLAG_WPA_CAPABLE, &ai->flags);
+                ai->bssListFirst = RID_WPA_BSSLISTFIRST;
+                ai->bssListNext = RID_WPA_BSSLISTNEXT;
+                ai->bssListRidLen = sizeof(BSSListRid);
+        } else {
+                ai->bssListFirst = RID_BSSLISTFIRST;
+                ai->bssListNext = RID_BSSLISTNEXT;
+                ai->bssListRidLen = sizeof(BSSListRid) - sizeof(BSSListRidExtra);
+        }
+
         rc = register_netdev(dev);
         if (rc) {
                 airo_print_err(dev->name, "Couldn't register_netdev");
@@ -2875,7 +2930,7 @@ err_out_irq:
 err_out_unlink:
         del_airo_dev(dev);
 err_out_thr:
-        set_bit(JOB_DIE, &ai->flags);
+        set_bit(JOB_DIE, &ai->jobs);
         kill_proc(ai->thr_pid, SIGTERM, 1);
         wait_for_completion(&ai->thr_exited);
 err_out_free:
@@ -2933,7 +2988,7 @@ static void airo_send_event(struct net_device *dev) {
         union iwreq_data wrqu;
         StatusRid status_rid;
 
-        clear_bit(JOB_EVENT, &ai->flags);
+        clear_bit(JOB_EVENT, &ai->jobs);
         PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid), 0);
         up(&ai->sem);
         wrqu.data.length = 0;
@@ -2947,7 +3002,7 @@ static void airo_send_event(struct net_device *dev) {
 
 static void airo_process_scan_results (struct airo_info *ai) {
         union iwreq_data        wrqu;
-        BSSListRid BSSList;
+        BSSListRid bss;
         int rc;
         BSSListElement * loop_net;
         BSSListElement * tmp_net;
@@ -2960,15 +3015,15 @@ static void airo_process_scan_results (struct airo_info *ai) {
         }
 
         /* Try to read the first entry of the scan result */
-        rc = PC4500_readrid(ai, RID_BSSLISTFIRST, &BSSList, sizeof(BSSList), 0);
-        if((rc) || (BSSList.index == 0xffff)) {
+        rc = PC4500_readrid(ai, ai->bssListFirst, &bss, ai->bssListRidLen, 0);
+        if((rc) || (bss.index == 0xffff)) {
                 /* No scan results */
                 goto out;
         }
 
         /* Read and parse all entries */
         tmp_net = NULL;
-        while((!rc) && (BSSList.index != 0xffff)) {
+        while((!rc) && (bss.index != 0xffff)) {
                 /* Grab a network off the free list */
                 if (!list_empty(&ai->network_free_list)) {
                         tmp_net = list_entry(ai->network_free_list.next,
@@ -2977,19 +3032,19 @@ static void airo_process_scan_results (struct airo_info *ai) {
                 }
 
                 if (tmp_net != NULL) {
-                        memcpy(tmp_net, &BSSList, sizeof(tmp_net->bss));
+                        memcpy(tmp_net, &bss, sizeof(tmp_net->bss));
                         list_add_tail(&tmp_net->list, &ai->network_list);
                         tmp_net = NULL;
                 }
 
                 /* Read next entry */
-                rc = PC4500_readrid(ai, RID_BSSLISTNEXT,
-                                    &BSSList, sizeof(BSSList), 0);
+                rc = PC4500_readrid(ai, ai->bssListNext,
+                                    &bss, ai->bssListRidLen, 0);
         }
 
 out:
         ai->scan_timeout = 0;
-        clear_bit(JOB_SCAN_RESULTS, &ai->flags);
+        clear_bit(JOB_SCAN_RESULTS, &ai->jobs);
         up(&ai->sem);
 
         /* Send an empty event to user space.
@@ -3019,10 +3074,10 @@ static int airo_thread(void *data) {
                 /* make swsusp happy with our thread */
                 try_to_freeze();
 
-                if (test_bit(JOB_DIE, &ai->flags))
+                if (test_bit(JOB_DIE, &ai->jobs))
                         break;
 
-                if (ai->flags & JOB_MASK) {
+                if (ai->jobs) {
                         locked = down_interruptible(&ai->sem);
                 } else {
                         wait_queue_t wait;
@@ -3031,16 +3086,16 @@ static int airo_thread(void *data) {
                         add_wait_queue(&ai->thr_wait, &wait);
                         for (;;) {
                                 set_current_state(TASK_INTERRUPTIBLE);
-                                if (ai->flags & JOB_MASK)
+                                if (ai->jobs)
                                         break;
                                 if (ai->expires || ai->scan_timeout) {
                                         if (ai->scan_timeout &&
                                                         time_after_eq(jiffies,ai->scan_timeout)){
-                                                set_bit(JOB_SCAN_RESULTS,&ai->flags);
+                                                set_bit(JOB_SCAN_RESULTS, &ai->jobs);
                                                 break;
                                         } else if (ai->expires &&
                                                         time_after_eq(jiffies,ai->expires)){
-                                                set_bit(JOB_AUTOWEP,&ai->flags);
+                                                set_bit(JOB_AUTOWEP, &ai->jobs);
                                                 break;
                                         }
                                         if (!signal_pending(current)) {
@@ -3069,7 +3124,7 @@ static int airo_thread(void *data) {
                 if (locked)
                         continue;
 
-                if (test_bit(JOB_DIE, &ai->flags)) {
+                if (test_bit(JOB_DIE, &ai->jobs)) {
                         up(&ai->sem);
                         break;
                 }
@@ -3079,23 +3134,23 @@ static int airo_thread(void *data) {
                         continue;
                 }
 
-                if (test_bit(JOB_XMIT, &ai->flags))
+                if (test_bit(JOB_XMIT, &ai->jobs))
                         airo_end_xmit(dev);
-                else if (test_bit(JOB_XMIT11, &ai->flags))
+                else if (test_bit(JOB_XMIT11, &ai->jobs))
                         airo_end_xmit11(dev);
-                else if (test_bit(JOB_STATS, &ai->flags))
+                else if (test_bit(JOB_STATS, &ai->jobs))
                         airo_read_stats(ai);
-                else if (test_bit(JOB_WSTATS, &ai->flags))
+                else if (test_bit(JOB_WSTATS, &ai->jobs))
                         airo_read_wireless_stats(ai);
-                else if (test_bit(JOB_PROMISC, &ai->flags))
+                else if (test_bit(JOB_PROMISC, &ai->jobs))
                         airo_set_promisc(ai);
-                else if (test_bit(JOB_MIC, &ai->flags))
+                else if (test_bit(JOB_MIC, &ai->jobs))
                         micinit(ai);
-                else if (test_bit(JOB_EVENT, &ai->flags))
+                else if (test_bit(JOB_EVENT, &ai->jobs))
                         airo_send_event(dev);
-                else if (test_bit(JOB_AUTOWEP, &ai->flags))
+                else if (test_bit(JOB_AUTOWEP, &ai->jobs))
                         timer_func(dev);
-                else if (test_bit(JOB_SCAN_RESULTS, &ai->flags))
+                else if (test_bit(JOB_SCAN_RESULTS, &ai->jobs))
                         airo_process_scan_results(ai);
                 else  /* Shouldn't get here, but we make sure to unlock */
                         up(&ai->sem);
@@ -3133,7 +3188,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                 if ( status & EV_MIC ) {
                         OUT4500( apriv, EVACK, EV_MIC );
                         if (test_bit(FLAG_MIC_CAPABLE, &apriv->flags)) {
-                                set_bit(JOB_MIC, &apriv->flags);
+                                set_bit(JOB_MIC, &apriv->jobs);
                                 wake_up_interruptible(&apriv->thr_wait);
                         }
                 }
@@ -3187,7 +3242,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                                 set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
 
                                 if (down_trylock(&apriv->sem) != 0) {
-                                        set_bit(JOB_EVENT, &apriv->flags);
+                                        set_bit(JOB_EVENT, &apriv->jobs);
                                         wake_up_interruptible(&apriv->thr_wait);
                                 } else
                                         airo_send_event(dev);
@@ -5485,7 +5540,7 @@ static void timer_func( struct net_device *dev ) {
         up(&apriv->sem);
 
 /* Schedule check to see if the change worked */
-        clear_bit(JOB_AUTOWEP, &apriv->flags);
+        clear_bit(JOB_AUTOWEP, &apriv->jobs);
         apriv->expires = RUN_AT(HZ*3);
 }
 
@@ -6876,7 +6931,7 @@ static int airo_get_range(struct net_device *dev,
         }
         range->num_txpower = i;
         range->txpower_capa = IW_TXPOW_MWATT;
-        range->we_version_source = 12;
+        range->we_version_source = 19;
         range->we_version_compiled = WIRELESS_EXT;
         range->retry_capa = IW_RETRY_LIMIT | IW_RETRY_LIFETIME;
         range->retry_flags = IW_RETRY_LIMIT;
@@ -7152,6 +7207,7 @@ static inline char *airo_translate_scan(struct net_device *dev,
         u16                     capabilities;
         char *                  current_val;    /* For rates */
         int                     i;
+        char *          buf;
 
         /* First entry *MUST* be the AP MAC address */
         iwe.cmd = SIOCGIWAP;
@@ -7238,8 +7294,69 @@ static inline char *airo_translate_scan(struct net_device *dev,
         if((current_val - current_ev) > IW_EV_LCP_LEN)
                 current_ev = current_val;
 
-        /* The other data in the scan result are not really
-         * interesting, so for now drop it - Jean II */
+        /* Beacon interval */
+        buf = kmalloc(30, GFP_KERNEL);
+        if (buf) {
+                iwe.cmd = IWEVCUSTOM;
+                sprintf(buf, "bcn_int=%d", bss->beaconInterval);
+                iwe.u.data.length = strlen(buf);
+                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, buf);
+                kfree(buf);
+        }
+
+        /* Put WPA/RSN Information Elements into the event stream */
+        if (test_bit(FLAG_WPA_CAPABLE, &ai->flags)) {
+                unsigned int num_null_ies = 0;
+                u16 length = sizeof (bss->extra.iep);
+                struct ieee80211_info_element *info_element =
+                        (struct ieee80211_info_element *) &bss->extra.iep;
+
+                while ((length >= sizeof(*info_element)) && (num_null_ies < 2)) {
+                        if (sizeof(*info_element) + info_element->len > length) {
+                                /* Invalid element, don't continue parsing IE */
+                                break;
+                        }
+
+                        switch (info_element->id) {
+                        case MFIE_TYPE_SSID:
+                                /* Two zero-length SSID elements
+                                 * mean we're done parsing elements */
+                                if (!info_element->len)
+                                        num_null_ies++;
+                                break;
+
+                        case MFIE_TYPE_GENERIC:
+                                if (info_element->len >= 4 &&
+                                    info_element->data[0] == 0x00 &&
+                                    info_element->data[1] == 0x50 &&
+                                    info_element->data[2] == 0xf2 &&
+                                    info_element->data[3] == 0x01) {
+                                        iwe.cmd = IWEVGENIE;
+                                        iwe.u.data.length = min(info_element->len + 2,
+                                                                  MAX_WPA_IE_LEN);
+                                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                                                        &iwe, (char *) info_element);
+                                }
+                                break;
+
+                        case MFIE_TYPE_RSN:
+                                iwe.cmd = IWEVGENIE;
+                                iwe.u.data.length = min(info_element->len + 2,
+                                                          MAX_WPA_IE_LEN);
+                                current_ev = iwe_stream_add_point(current_ev, end_buf,
+                                                &iwe, (char *) info_element);
+                                break;
+
+                        default:
+                                break;
+                        }
+
+                        length -= sizeof(*info_element) + info_element->len;
+                        info_element =
+                            (struct ieee80211_info_element *)&info_element->
+                            data[info_element->len];
+                }
+        }
         return current_ev;
 }
 
@@ -7521,7 +7638,7 @@ static void airo_read_wireless_stats(struct airo_info *local)
         u32 *vals = stats_rid.vals;
 
         /* Get stats out of the card */
-        clear_bit(JOB_WSTATS, &local->flags);
+        clear_bit(JOB_WSTATS, &local->jobs);
         if (local->power.event) {
                 up(&local->sem);
                 return;
@@ -7565,10 +7682,10 @@ static struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
 {
         struct airo_info *local =  dev->priv;
 
-        if (!test_bit(JOB_WSTATS, &local->flags)) {
+        if (!test_bit(JOB_WSTATS, &local->jobs)) {
                 /* Get stats out of the card if available */
                 if (down_trylock(&local->sem) != 0) {
-                        set_bit(JOB_WSTATS, &local->flags);
+                        set_bit(JOB_WSTATS, &local->jobs);
                         wake_up_interruptible(&local->thr_wait);
                 } else
                         airo_read_wireless_stats(local);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index 2e83083935e..e66fdb1f3cf 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -645,7 +645,6 @@ struct bcm43xx_private {
         unsigned int irq;
 
         void __iomem *mmio_addr;
-        unsigned int mmio_len;
 
         /* Do not use the lock directly. Use the bcm43xx_lock* helper
          * functions, to be MMIO-safe. */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index 35a4fcb6d92..7497fb16076 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -92,7 +92,7 @@ static ssize_t devinfo_read_file(struct file *file, char __user *userbuf,
         fappend("subsystem_vendor: 0x%04x   subsystem_device: 0x%04x\n",
                 pci_dev->subsystem_vendor, pci_dev->subsystem_device);
         fappend("IRQ: %d\n", bcm->irq);
-        fappend("mmio_addr: 0x%p   mmio_len: %u\n", bcm->mmio_addr, bcm->mmio_len);
+        fappend("mmio_addr: 0x%p\n", bcm->mmio_addr);
         fappend("chip_id: 0x%04x   chip_rev: 0x%02x\n", bcm->chip_id, bcm->chip_rev);
         if ((bcm->core_80211[0].rev >= 3) && (bcm43xx_read32(bcm, 0x0158) & (1 << 16)))
                 fappend("Radio disabled by hardware!\n");
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 7ed18cad29f..736dde96c4a 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -128,13 +128,15 @@ MODULE_PARM_DESC(fwpostfix, "Postfix for .fw files. Useful for debugging.");
         static struct pci_device_id bcm43xx_pci_tbl[] = {
         /* Broadcom 4303 802.11b */
         { PCI_VENDOR_ID_BROADCOM, 0x4301, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-                /* Broadcom 4307 802.11b */
+        /* Broadcom 4307 802.11b */
         { PCI_VENDOR_ID_BROADCOM, 0x4307, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-                /* Broadcom 4318 802.11b/g */
+        /* Broadcom 4318 802.11b/g */
         { PCI_VENDOR_ID_BROADCOM, 0x4318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        /* Broadcom 4319 802.11a/b/g */
+        { PCI_VENDOR_ID_BROADCOM, 0x4319, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         /* Broadcom 4306 802.11b/g */
         { PCI_VENDOR_ID_BROADCOM, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-                /* Broadcom 4306 802.11a */
+        /* Broadcom 4306 802.11a */
 //      { PCI_VENDOR_ID_BROADCOM, 0x4321, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         /* Broadcom 4309 802.11a/b/g */
         { PCI_VENDOR_ID_BROADCOM, 0x4324, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
@@ -3299,8 +3301,7 @@ static void bcm43xx_detach_board(struct bcm43xx_private *bcm)
 
         bcm43xx_chipset_detach(bcm);
         /* Do _not_ access the chip, after it is detached. */
-        iounmap(bcm->mmio_addr);
-        
+        pci_iounmap(pci_dev, bcm->mmio_addr);
         pci_release_regions(pci_dev);
         pci_disable_device(pci_dev);
 
@@ -3390,40 +3391,26 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
         struct net_device *net_dev = bcm->net_dev;
         int err;
         int i;
-        unsigned long mmio_start, mmio_flags, mmio_len;
         u32 coremask;
 
         err = pci_enable_device(pci_dev);
         if (err) {
-                printk(KERN_ERR PFX "unable to wake up pci device (%i)\n", err);
+                printk(KERN_ERR PFX "pci_enable_device() failed\n");
                 goto out;
         }
-        mmio_start = pci_resource_start(pci_dev, 0);
-        mmio_flags = pci_resource_flags(pci_dev, 0);
-        mmio_len = pci_resource_len(pci_dev, 0);
-        if (!(mmio_flags & IORESOURCE_MEM)) {
-                printk(KERN_ERR PFX
-                       "%s, region #0 not an MMIO resource, aborting\n",
-                       pci_name(pci_dev));
-                err = -ENODEV;
-                goto err_pci_disable;
-        }
         err = pci_request_regions(pci_dev, KBUILD_MODNAME);
         if (err) {
-                printk(KERN_ERR PFX
-                       "could not access PCI resources (%i)\n", err);
+                printk(KERN_ERR PFX "pci_request_regions() failed\n");
                 goto err_pci_disable;
         }
         /* enable PCI bus-mastering */
         pci_set_master(pci_dev);
-        bcm->mmio_addr = ioremap(mmio_start, mmio_len);
+        bcm->mmio_addr = pci_iomap(pci_dev, 0, ~0UL);
         if (!bcm->mmio_addr) {
-                printk(KERN_ERR PFX "%s: cannot remap MMIO, aborting\n",
-                       pci_name(pci_dev));
+                printk(KERN_ERR PFX "pci_iomap() failed\n");
                 err = -EIO;
                 goto err_pci_release;
         }
-        bcm->mmio_len = mmio_len;
         net_dev->base_addr = (unsigned long)bcm->mmio_addr;
 
         bcm43xx_pci_read_config16(bcm, PCI_SUBSYSTEM_VENDOR_ID,
@@ -3517,7 +3504,7 @@ err_80211_unwind:
 err_chipset_detach:
         bcm43xx_chipset_detach(bcm);
 err_iounmap:
-        iounmap(bcm->mmio_addr);
+        pci_iounmap(pci_dev, bcm->mmio_addr);
 err_pci_release:
         pci_release_regions(pci_dev);
 err_pci_disable:
@@ -3568,7 +3555,7 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
         unsigned long flags;
         int keyidx;
         
-        dprintk(KERN_INFO PFX "set security called\n");
+        dprintk(KERN_INFO PFX "set security called");
 
         bcm43xx_lock_mmio(bcm, flags);
 
@@ -3581,24 +3568,25 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
         
         if (sec->flags & SEC_ACTIVE_KEY) {
                 secinfo->active_key = sec->active_key;
-                dprintk(KERN_INFO PFX "   .active_key = %d\n", sec->active_key);
+                dprintk(", .active_key = %d", sec->active_key);
         }
         if (sec->flags & SEC_UNICAST_GROUP) {
                 secinfo->unicast_uses_group = sec->unicast_uses_group;
-                dprintk(KERN_INFO PFX "   .unicast_uses_group = %d\n", sec->unicast_uses_group);
+                dprintk(", .unicast_uses_group = %d", sec->unicast_uses_group);
         }
         if (sec->flags & SEC_LEVEL) {
                 secinfo->level = sec->level;
-                dprintk(KERN_INFO PFX "   .level = %d\n", sec->level);
+                dprintk(", .level = %d", sec->level);
         }
         if (sec->flags & SEC_ENABLED) {
                 secinfo->enabled = sec->enabled;
-                dprintk(KERN_INFO PFX "   .enabled = %d\n", sec->enabled);
+                dprintk(", .enabled = %d", sec->enabled);
         }
         if (sec->flags & SEC_ENCRYPT) {
                 secinfo->encrypt = sec->encrypt;
-                dprintk(KERN_INFO PFX "   .encrypt = %d\n", sec->encrypt);
+                dprintk(", .encrypt = %d", sec->encrypt);
         }
+        dprintk("\n");
         if (bcm->initialized && !bcm->ieee->host_encrypt) {
                 if (secinfo->enabled) {
                         /* upload WEP keys to hardware */
diff --git a/drivers/net/wireless/hermes.c b/drivers/net/wireless/hermes.c
index 346c6febb03..2aa2f389c0d 100644
--- a/drivers/net/wireless/hermes.c
+++ b/drivers/net/wireless/hermes.c
@@ -121,12 +121,6 @@ void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing)
         hw->iobase = address;
         hw->reg_spacing = reg_spacing;
         hw->inten = 0x0;
-
-#ifdef HERMES_DEBUG_BUFFER
-        hw->dbufp = 0;
-        memset(&hw->dbuf, 0xff, sizeof(hw->dbuf));
-        memset(&hw->profile, 0, sizeof(hw->profile));
-#endif
 }
 
 int hermes_init(hermes_t *hw)
@@ -347,19 +341,6 @@ static int hermes_bap_seek(hermes_t *hw, int bap, u16 id, u16 offset)
                 reg = hermes_read_reg(hw, oreg);
         }
 
-#ifdef HERMES_DEBUG_BUFFER
-        hw->profile[HERMES_BAP_BUSY_TIMEOUT - k]++;
-
-        if (k < HERMES_BAP_BUSY_TIMEOUT) {
-                struct hermes_debug_entry *e = 
-                        &hw->dbuf[(hw->dbufp++) % HERMES_DEBUG_BUFSIZE];
-                e->bap = bap;
-                e->id = id;
-                e->offset = offset;
-                e->cycles = HERMES_BAP_BUSY_TIMEOUT - k;
-        }
-#endif
-
         if (reg & HERMES_OFFSET_BUSY)
                 return -ETIMEDOUT;
 
@@ -419,8 +400,7 @@ int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
 }
 
 /* Write a block of data to the chip's buffer, via the
- * BAP. Synchronization/serialization is the caller's problem. len
- * must be even.
+ * BAP. Synchronization/serialization is the caller's problem.
  *
  * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
  */
@@ -430,7 +410,7 @@ int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
         int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
         int err = 0;
 
-        if ( (len < 0) || (len % 2) )
+        if (len < 0)
                 return -EINVAL;
 
         err = hermes_bap_seek(hw, bap, id, offset);
@@ -438,49 +418,12 @@ int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
                 goto out;
         
         /* Actually do the transfer */
-        hermes_write_words(hw, dreg, buf, len/2);
+        hermes_write_bytes(hw, dreg, buf, len);
 
  out:   
         return err;
 }
 
-/* Write a block of data to the chip's buffer with padding if
- * neccessary, via the BAP. Synchronization/serialization is the
- * caller's problem. len must be even.
- *
- * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
- */
-int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf, unsigned data_len, int len,
-                      u16 id, u16 offset)
-{
-        int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
-        int err = 0;
-
-        if (len < 0 || len % 2 || data_len > len)
-                return -EINVAL;
-
-        err = hermes_bap_seek(hw, bap, id, offset);
-        if (err)
-                goto out;
-
-        /* Transfer all the complete words of data */
-        hermes_write_words(hw, dreg, buf, data_len/2);
-        /* If there is an odd byte left over pad and transfer it */
-        if (data_len & 1) {
-                u8 end[2];
-                end[1] = 0;
-                end[0] = ((unsigned char *)buf)[data_len - 1];
-                hermes_write_words(hw, dreg, end, 1);
-                data_len ++;
-        }
-        /* Now send zeros for the padding */
-        if (data_len < len)
-                hermes_clear_words(hw, dreg, (len - data_len) / 2);
-        /* Complete */
- out:
-        return err;
-}
-
 /* Read a Length-Type-Value record from the card.
  *
  * If length is NULL, we ignore the length read from the card, and
@@ -553,7 +496,7 @@ int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
 
         count = length - 1;
 
-        hermes_write_words(hw, dreg, value, count);
+        hermes_write_bytes(hw, dreg, value, count << 1);
 
         err = hermes_docmd_wait(hw, HERMES_CMD_ACCESS | HERMES_CMD_WRITE, 
                                 rid, NULL);
@@ -568,7 +511,6 @@ EXPORT_SYMBOL(hermes_allocate);
 
 EXPORT_SYMBOL(hermes_bap_pread);
 EXPORT_SYMBOL(hermes_bap_pwrite);
-EXPORT_SYMBOL(hermes_bap_pwrite_pad);
 EXPORT_SYMBOL(hermes_read_ltv);
 EXPORT_SYMBOL(hermes_write_ltv);
 
diff --git a/drivers/net/wireless/hermes.h b/drivers/net/wireless/hermes.h
index 7644f72a9f4..8e3f0e3edb5 100644
--- a/drivers/net/wireless/hermes.h
+++ b/drivers/net/wireless/hermes.h
@@ -328,16 +328,6 @@ struct hermes_multicast {
         u8 addr[HERMES_MAX_MULTICAST][ETH_ALEN];
 } __attribute__ ((packed));
 
-// #define HERMES_DEBUG_BUFFER 1
-#define HERMES_DEBUG_BUFSIZE 4096
-struct hermes_debug_entry {
-        int bap;
-        u16 id, offset;
-        int cycles;
-};
-
-#ifdef __KERNEL__
-
 /* Timeouts */
 #define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */
 
@@ -347,14 +337,7 @@ typedef struct hermes {
         int reg_spacing;
 #define HERMES_16BIT_REGSPACING 0
 #define HERMES_32BIT_REGSPACING 1
-
         u16 inten; /* Which interrupts should be enabled? */
-
-#ifdef HERMES_DEBUG_BUFFER
-        struct hermes_debug_entry dbuf[HERMES_DEBUG_BUFSIZE];
-        unsigned long dbufp;
-        unsigned long profile[HERMES_BAP_BUSY_TIMEOUT+1];
-#endif
 } hermes_t;
 
 /* Register access convenience macros */
@@ -376,8 +359,6 @@ int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
                        u16 id, u16 offset);
 int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
                         u16 id, u16 offset);
-int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf,
-                        unsigned data_len, int len, u16 id, u16 offset);
 int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
                     u16 *length, void *buf);
 int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
@@ -425,10 +406,13 @@ static inline void hermes_read_words(struct hermes *hw, int off, void *buf, unsi
         ioread16_rep(hw->iobase + off, buf, count);
 }
 
-static inline void hermes_write_words(struct hermes *hw, int off, const void *buf, unsigned count)
+static inline void hermes_write_bytes(struct hermes *hw, int off,
+                                      const char *buf, unsigned count)
 {
         off = off << hw->reg_spacing;
-        iowrite16_rep(hw->iobase + off, buf, count);
+        iowrite16_rep(hw->iobase + off, buf, count >> 1);
+        if (unlikely(count & 1))
+                iowrite8(buf[count - 1], hw->iobase + off);
 }
 
 static inline void hermes_clear_words(struct hermes *hw, int off, unsigned count)
@@ -462,21 +446,4 @@ static inline int hermes_write_wordrec(hermes_t *hw, int bap, u16 rid, u16 word)
         return HERMES_WRITE_RECORD(hw, bap, rid, &rec);
 }
 
-#else /* ! __KERNEL__ */
-
-/* These are provided for the benefit of userspace drivers and testing programs
-   which use ioperm() or iopl() */
-
-#define hermes_read_reg(base, off) (inw((base) + (off)))
-#define hermes_write_reg(base, off, val) (outw((val), (base) + (off)))
-
-#define hermes_read_regn(base, name) (hermes_read_reg((base), HERMES_##name))
-#define hermes_write_regn(base, name, val) (hermes_write_reg((base), HERMES_##name, (val)))
-
-/* Note that for the next two, the count is in 16-bit words, not bytes */
-#define hermes_read_data(base, off, buf, count) (insw((base) + (off), (buf), (count)))
-#define hermes_write_data(base, off, buf, count) (outsw((base) + (off), (buf), (count)))
-
-#endif /* ! __KERNEL__ */
-
 #endif  /* _HERMES_H */
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 06a5214145e..4a5be70c041 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -534,5 +534,4 @@ int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
 }
 
 
-EXPORT_SYMBOL(hostap_dump_tx_80211);
 EXPORT_SYMBOL(hostap_master_start_xmit);
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 06c3fa32b31..ba13125024c 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -3276,17 +3276,6 @@ EXPORT_SYMBOL(hostap_init_data);
 EXPORT_SYMBOL(hostap_init_ap_proc);
 EXPORT_SYMBOL(hostap_free_data);
 EXPORT_SYMBOL(hostap_check_sta_fw_version);
-EXPORT_SYMBOL(hostap_handle_sta_tx);
-EXPORT_SYMBOL(hostap_handle_sta_release);
 EXPORT_SYMBOL(hostap_handle_sta_tx_exc);
-EXPORT_SYMBOL(hostap_update_sta_ps);
-EXPORT_SYMBOL(hostap_handle_sta_rx);
-EXPORT_SYMBOL(hostap_is_sta_assoc);
-EXPORT_SYMBOL(hostap_is_sta_authorized);
-EXPORT_SYMBOL(hostap_add_sta);
-EXPORT_SYMBOL(hostap_update_rates);
-EXPORT_SYMBOL(hostap_add_wds_links);
-EXPORT_SYMBOL(hostap_wds_link_oper);
 #ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-EXPORT_SYMBOL(hostap_deauth_all_stas);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 55bed923fbe..db03dc2646d 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -881,6 +881,12 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12(
                 "ZoomAir 11Mbps High", "Rate wireless Networking",
                 0x273fe3db, 0x32a1eaee),
+        PCMCIA_DEVICE_PROD_ID123(
+                "Pretec", "CompactWLAN Card 802.11b", "2.5",
+                0x1cadd3e5, 0xe697636c, 0x7a5bfcf1),
+        PCMCIA_DEVICE_PROD_ID123(
+                "U.S. Robotics", "IEEE 802.11b PC-CARD", "Version 01.02",
+                0xc7b8df9d, 0x1700d087, 0x4b74baa0),
         PCMCIA_DEVICE_NULL
 };
 MODULE_DEVICE_TABLE(pcmcia, hostap_cs_ids);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 8dd4c4446a6..93786f4218f 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -1125,11 +1125,9 @@ EXPORT_SYMBOL(hostap_set_auth_algs);
 EXPORT_SYMBOL(hostap_dump_rx_header);
 EXPORT_SYMBOL(hostap_dump_tx_header);
 EXPORT_SYMBOL(hostap_80211_header_parse);
-EXPORT_SYMBOL(hostap_80211_prism_header_parse);
 EXPORT_SYMBOL(hostap_80211_get_hdrlen);
 EXPORT_SYMBOL(hostap_get_stats);
 EXPORT_SYMBOL(hostap_setup_dev);
-EXPORT_SYMBOL(hostap_proc);
 EXPORT_SYMBOL(hostap_set_multicast_list_queue);
 EXPORT_SYMBOL(hostap_set_hostapd);
 EXPORT_SYMBOL(hostap_set_hostapd_sta);
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index bca89cff85a..39f82f21974 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -33,7 +33,44 @@
 #include "ipw2200.h"
 #include <linux/version.h>
 
-#define IPW2200_VERSION "git-1.1.1"
+
+#ifndef KBUILD_EXTMOD
+#define VK "k"
+#else
+#define VK
+#endif
+
+#ifdef CONFIG_IPW2200_DEBUG
+#define VD "d"
+#else
+#define VD
+#endif
+
+#ifdef CONFIG_IPW2200_MONITOR
+#define VM "m"
+#else
+#define VM
+#endif
+
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+#define VP "p"
+#else
+#define VP
+#endif
+
+#ifdef CONFIG_IPW2200_RADIOTAP
+#define VR "r"
+#else
+#define VR
+#endif
+
+#ifdef CONFIG_IPW2200_QOS
+#define VQ "q"
+#else
+#define VQ
+#endif
+
+#define IPW2200_VERSION "1.1.2" VK VD VM VP VR VQ
 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
 #define DRV_VERSION     IPW2200_VERSION
@@ -46,7 +83,9 @@ MODULE_AUTHOR(DRV_COPYRIGHT);
 MODULE_LICENSE("GPL");
 
 static int cmdlog = 0;
+#ifdef CONFIG_IPW2200_DEBUG
 static int debug = 0;
+#endif
 static int channel = 0;
 static int mode = 0;
 
@@ -61,8 +100,14 @@ static int roaming = 1;
 static const char ipw_modes[] = {
         'a', 'b', 'g', '?'
 };
+static int antenna = CFG_SYS_ANTENNA_BOTH;
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
+#endif
+
+
+#ifdef CONFIG_IPW2200_QOS
 static int qos_enable = 0;
 static int qos_burst_enable = 0;
 static int qos_no_ack_mask = 0;
@@ -126,7 +171,7 @@ static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_q
                                        *qos_param);
 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
                                      *qos_param);
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
 static void ipw_remove_current_network(struct ipw_priv *priv);
@@ -1269,6 +1314,105 @@ static ssize_t show_cmd_log(struct device *d,
 
 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+static void ipw_prom_free(struct ipw_priv *priv);
+static int ipw_prom_alloc(struct ipw_priv *priv);
+static ssize_t store_rtap_iface(struct device *d,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        struct ipw_priv *priv = dev_get_drvdata(d);
+        int rc = 0;
+
+        if (count < 1)
+                return -EINVAL;
+
+        switch (buf[0]) {
+        case '0':
+                if (!rtap_iface)
+                        return count;
+
+                if (netif_running(priv->prom_net_dev)) {
+                        IPW_WARNING("Interface is up.  Cannot unregister.\n");
+                        return count;
+                }
+
+                ipw_prom_free(priv);
+                rtap_iface = 0;
+                break;
+
+        case '1':
+                if (rtap_iface)
+                        return count;
+
+                rc = ipw_prom_alloc(priv);
+                if (!rc)
+                        rtap_iface = 1;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        if (rc) {
+                IPW_ERROR("Failed to register promiscuous network "
+                          "device (error %d).\n", rc);
+        }
+
+        return count;
+}
+
+static ssize_t show_rtap_iface(struct device *d,
+                        struct device_attribute *attr,
+                        char *buf)
+{
+        struct ipw_priv *priv = dev_get_drvdata(d);
+        if (rtap_iface)
+                return sprintf(buf, "%s", priv->prom_net_dev->name);
+        else {
+                buf[0] = '-';
+                buf[1] = '1';
+                buf[2] = '\0';
+                return 3;
+        }
+}
+
+static DEVICE_ATTR(rtap_iface, S_IWUSR | S_IRUSR, show_rtap_iface,
+                   store_rtap_iface);
+
+static ssize_t store_rtap_filter(struct device *d,
+                         struct device_attribute *attr,
+                         const char *buf, size_t count)
+{
+        struct ipw_priv *priv = dev_get_drvdata(d);
+
+        if (!priv->prom_priv) {
+                IPW_ERROR("Attempting to set filter without "
+                          "rtap_iface enabled.\n");
+                return -EPERM;
+        }
+
+        priv->prom_priv->filter = simple_strtol(buf, NULL, 0);
+
+        IPW_DEBUG_INFO("Setting rtap filter to " BIT_FMT16 "\n",
+                       BIT_ARG16(priv->prom_priv->filter));
+
+        return count;
+}
+
+static ssize_t show_rtap_filter(struct device *d,
+                        struct device_attribute *attr,
+                        char *buf)
+{
+        struct ipw_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "0x%04X",
+                       priv->prom_priv ? priv->prom_priv->filter : 0);
+}
+
+static DEVICE_ATTR(rtap_filter, S_IWUSR | S_IRUSR, show_rtap_filter,
+                   store_rtap_filter);
+#endif
+
 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
                              char *buf)
 {
@@ -2025,16 +2169,11 @@ static int ipw_send_host_complete(struct ipw_priv *priv)
         return ipw_send_cmd_simple(priv, IPW_CMD_HOST_COMPLETE);
 }
 
-static int ipw_send_system_config(struct ipw_priv *priv,
-                                  struct ipw_sys_config *config)
+static int ipw_send_system_config(struct ipw_priv *priv)
 {
-        if (!priv || !config) {
-                IPW_ERROR("Invalid args\n");
-                return -1;
-        }
-
-        return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG, sizeof(*config),
-                                config);
+        return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG,
+                                sizeof(priv->sys_config),
+                                &priv->sys_config);
 }
 
 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
@@ -3104,10 +3243,10 @@ static int ipw_reset_nic(struct ipw_priv *priv)
 
 
 struct ipw_fw {
-        u32 ver;
-        u32 boot_size;
-        u32 ucode_size;
-        u32 fw_size;
+        __le32 ver;
+        __le32 boot_size;
+        __le32 ucode_size;
+        __le32 fw_size;
         u8 data[0];
 };
 
@@ -3131,8 +3270,8 @@ static int ipw_get_fw(struct ipw_priv *priv,
 
         fw = (void *)(*raw)->data;
 
-        if ((*raw)->size < sizeof(*fw) +
-            fw->boot_size + fw->ucode_size + fw->fw_size) {
+        if ((*raw)->size < sizeof(*fw) + le32_to_cpu(fw->boot_size) +
+            le32_to_cpu(fw->ucode_size) + le32_to_cpu(fw->fw_size)) {
                 IPW_ERROR("%s is too small or corrupt (%zd)\n",
                           name, (*raw)->size);
                 return -EINVAL;
@@ -3237,8 +3376,9 @@ static int ipw_load(struct ipw_priv *priv)
 
         fw = (void *)raw->data;
         boot_img = &fw->data[0];
-        ucode_img = &fw->data[fw->boot_size];
-        fw_img = &fw->data[fw->boot_size + fw->ucode_size];
+        ucode_img = &fw->data[le32_to_cpu(fw->boot_size)];
+        fw_img = &fw->data[le32_to_cpu(fw->boot_size) +
+                           le32_to_cpu(fw->ucode_size)];
 
         if (rc < 0)
                 goto error;
@@ -3272,7 +3412,7 @@ static int ipw_load(struct ipw_priv *priv)
                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
 
         /* DMA the initial boot firmware into the device */
-        rc = ipw_load_firmware(priv, boot_img, fw->boot_size);
+        rc = ipw_load_firmware(priv, boot_img, le32_to_cpu(fw->boot_size));
         if (rc < 0) {
                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
                 goto error;
@@ -3294,7 +3434,7 @@ static int ipw_load(struct ipw_priv *priv)
         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
 
         /* DMA the ucode into the device */
-        rc = ipw_load_ucode(priv, ucode_img, fw->ucode_size);
+        rc = ipw_load_ucode(priv, ucode_img, le32_to_cpu(fw->ucode_size));
         if (rc < 0) {
                 IPW_ERROR("Unable to load ucode: %d\n", rc);
                 goto error;
@@ -3304,7 +3444,7 @@ static int ipw_load(struct ipw_priv *priv)
         ipw_stop_nic(priv);
 
         /* DMA bss firmware into the device */
-        rc = ipw_load_firmware(priv, fw_img, fw->fw_size);
+        rc = ipw_load_firmware(priv, fw_img, le32_to_cpu(fw->fw_size));
         if (rc < 0) {
                 IPW_ERROR("Unable to load firmware: %d\n", rc);
                 goto error;
@@ -3700,7 +3840,17 @@ static void ipw_bg_disassociate(void *data)
 static void ipw_system_config(void *data)
 {
         struct ipw_priv *priv = data;
-        ipw_send_system_config(priv, &priv->sys_config);
+
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
+                priv->sys_config.accept_all_data_frames = 1;
+                priv->sys_config.accept_non_directed_frames = 1;
+                priv->sys_config.accept_all_mgmt_bcpr = 1;
+                priv->sys_config.accept_all_mgmt_frames = 1;
+        }
+#endif
+
+        ipw_send_system_config(priv);
 }
 
 struct ipw_status_code {
@@ -3771,6 +3921,13 @@ static void inline average_init(struct average *avg)
         memset(avg, 0, sizeof(*avg));
 }
 
+#define DEPTH_RSSI 8
+#define DEPTH_NOISE 16
+static s16 exponential_average(s16 prev_avg, s16 val, u8 depth)
+{
+        return ((depth-1)*prev_avg +  val)/depth;
+}
+
 static void average_add(struct average *avg, s16 val)
 {
         avg->sum -= avg->entries[avg->pos];
@@ -3800,8 +3957,8 @@ static void ipw_reset_stats(struct ipw_priv *priv)
         priv->quality = 0;
 
         average_init(&priv->average_missed_beacons);
-        average_init(&priv->average_rssi);
-        average_init(&priv->average_noise);
+        priv->exp_avg_rssi = -60;
+        priv->exp_avg_noise = -85 + 0x100;
 
         priv->last_rate = 0;
         priv->last_missed_beacons = 0;
@@ -4008,7 +4165,7 @@ static void ipw_gather_stats(struct ipw_priv *priv)
         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
                         tx_quality, tx_failures_delta, tx_packets_delta);
 
-        rssi = average_value(&priv->average_rssi);
+        rssi = priv->exp_avg_rssi;
         signal_quality =
             (100 *
              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
@@ -4185,7 +4342,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                         queue_work(priv->workqueue,
                                                    &priv->system_config);
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_ctl))
                                         if ((priv->status & STATUS_AUTH) &&
@@ -4482,6 +4639,24 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                  && priv->status & STATUS_ASSOCIATED)
                                 queue_delayed_work(priv->workqueue,
                                                    &priv->request_scan, HZ);
+
+                        /* Send an empty event to user space.
+                         * We don't send the received data on the event because
+                         * it would require us to do complex transcoding, and
+                         * we want to minimise the work done in the irq handler
+                         * Use a request to extract the data.
+                         * Also, we generate this even for any scan, regardless
+                         * on how the scan was initiated. User space can just
+                         * sync on periodic scan to get fresh data...
+                         * Jean II */
+                        if (x->status == SCAN_COMPLETED_STATUS_COMPLETE) {
+                                union iwreq_data wrqu;
+
+                                wrqu.data.length = 0;
+                                wrqu.data.flags = 0;
+                                wireless_send_event(priv->net_dev, SIOCGIWSCAN,
+                                                    &wrqu, NULL);
+                        }
                         break;
                 }
 
@@ -4577,11 +4752,10 @@ static void ipw_rx_notification(struct ipw_priv *priv,
 
         case HOST_NOTIFICATION_NOISE_STATS:{
                         if (notif->size == sizeof(u32)) {
-                                priv->last_noise =
-                                    (u8) (le32_to_cpu(notif->u.noise.value) &
-                                          0xff);
-                                average_add(&priv->average_noise,
-                                            priv->last_noise);
+                                priv->exp_avg_noise =
+                                    exponential_average(priv->exp_avg_noise,
+                                    (u8) (le32_to_cpu(notif->u.noise.value) & 0xff),
+                                    DEPTH_NOISE);
                                 break;
                         }
 
@@ -6170,8 +6344,6 @@ static void ipw_wpa_assoc_frame(struct ipw_priv *priv, char *wpa_ie,
 {
         /* make sure WPA is enabled */
         ipw_wpa_enable(priv, 1);
-
-        ipw_disassociate(priv);
 }
 
 static int ipw_set_rsn_capa(struct ipw_priv *priv,
@@ -6365,6 +6537,7 @@ static int ipw_wx_set_auth(struct net_device *dev,
 
         case IW_AUTH_WPA_ENABLED:
                 ret = ipw_wpa_enable(priv, param->value);
+                ipw_disassociate(priv);
                 break;
 
         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
@@ -6506,7 +6679,7 @@ static int ipw_wx_set_mlme(struct net_device *dev,
         return 0;
 }
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
 
 /* QoS */
 /*
@@ -6853,61 +7026,55 @@ static int ipw_get_tx_queue_number(struct ipw_priv *priv, u16 priority)
         return from_priority_to_tx_queue[priority] - 1;
 }
 
-/*
-* add QoS parameter to the TX command
-*/
-static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
-                                        u16 priority,
-                                        struct tfd_data *tfd, u8 unicast)
+static int ipw_is_qos_active(struct net_device *dev,
+                             struct sk_buff *skb)
 {
-        int ret = 0;
-        int tx_queue_id = 0;
+        struct ipw_priv *priv = ieee80211_priv(dev);
         struct ieee80211_qos_data *qos_data = NULL;
         int active, supported;
-        unsigned long flags;
+        u8 *daddr = skb->data + ETH_ALEN;
+        int unicast = !is_multicast_ether_addr(daddr);
 
         if (!(priv->status & STATUS_ASSOCIATED))
                 return 0;
 
         qos_data = &priv->assoc_network->qos_data;
 
-        spin_lock_irqsave(&priv->ieee->lock, flags);
-
         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
                 if (unicast == 0)
                         qos_data->active = 0;
                 else
                         qos_data->active = qos_data->supported;
         }
-
         active = qos_data->active;
         supported = qos_data->supported;
-
-        spin_unlock_irqrestore(&priv->ieee->lock, flags);
-
         IPW_DEBUG_QOS("QoS  %d network is QoS active %d  supported %d  "
                       "unicast %d\n",
                       priv->qos_data.qos_enable, active, supported, unicast);
-        if (active && priv->qos_data.qos_enable) {
-                ret = from_priority_to_tx_queue[priority];
-                tx_queue_id = ret - 1;
-                IPW_DEBUG_QOS("QoS packet priority is %d \n", priority);
-                if (priority <= 7) {
-                        tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
-                        tfd->tfd.tfd_26.mchdr.qos_ctrl = priority;
-                        tfd->tfd.tfd_26.mchdr.frame_ctl |=
-                            IEEE80211_STYPE_QOS_DATA;
-
-                        if (priv->qos_data.qos_no_ack_mask &
-                            (1UL << tx_queue_id)) {
-                                tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
-                                tfd->tfd.tfd_26.mchdr.qos_ctrl |=
-                                    CTRL_QOS_NO_ACK;
-                        }
-                }
-        }
+        if (active && priv->qos_data.qos_enable)
+                return 1;
 
-        return ret;
+        return 0;
+
+}
+/*
+* add QoS parameter to the TX command
+*/
+static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
+                                        u16 priority,
+                                        struct tfd_data *tfd)
+{
+        int tx_queue_id = 0;
+
+
+        tx_queue_id = from_priority_to_tx_queue[priority] - 1;
+        tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
+
+        if (priv->qos_data.qos_no_ack_mask & (1UL << tx_queue_id)) {
+                tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
+                tfd->tfd.tfd_26.mchdr.qos_ctrl |= CTRL_QOS_NO_ACK;
+        }
+        return 0;
 }
 
 /*
@@ -6977,7 +7144,7 @@ static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos
                                 qos_param);
 }
 
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
 static int ipw_associate_network(struct ipw_priv *priv,
                                  struct ieee80211_network *network,
@@ -7116,7 +7283,7 @@ static int ipw_associate_network(struct ipw_priv *priv,
         else
                 priv->sys_config.answer_broadcast_ssid_probe = 0;
 
-        err = ipw_send_system_config(priv, &priv->sys_config);
+        err = ipw_send_system_config(priv);
         if (err) {
                 IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
                 return err;
@@ -7141,7 +7308,7 @@ static int ipw_associate_network(struct ipw_priv *priv,
 
         priv->assoc_network = network;
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         ipw_qos_association(priv, network);
 #endif
 
@@ -7415,7 +7582,7 @@ static void ipw_handle_data_packet(struct ipw_priv *priv,
         }
 }
 
-#ifdef CONFIG_IEEE80211_RADIOTAP
+#ifdef CONFIG_IPW2200_RADIOTAP
 static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
                                            struct ipw_rx_mem_buffer *rxb,
                                            struct ieee80211_rx_stats *stats)
@@ -7432,15 +7599,7 @@ static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
         /* Magic struct that slots into the radiotap header -- no reason
          * to build this manually element by element, we can write it much
          * more efficiently than we can parse it. ORDER MATTERS HERE */
-        struct ipw_rt_hdr {
-                struct ieee80211_radiotap_header rt_hdr;
-                u8 rt_flags;    /* radiotap packet flags */
-                u8 rt_rate;     /* rate in 500kb/s */
-                u16 rt_channel; /* channel in mhz */
-                u16 rt_chbitmask;       /* channel bitfield */
-                s8 rt_dbmsignal;        /* signal in dbM, kluged to signed */
-                u8 rt_antenna;  /* antenna number */
-        } *ipw_rt;
+        struct ipw_rt_hdr *ipw_rt;
 
         short len = le16_to_cpu(pkt->u.frame.length);
 
@@ -7494,9 +7653,11 @@ static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
         /* Big bitfield of all the fields we provide in radiotap */
         ipw_rt->rt_hdr.it_present =
             ((1 << IEEE80211_RADIOTAP_FLAGS) |
+             (1 << IEEE80211_RADIOTAP_TSFT) |
              (1 << IEEE80211_RADIOTAP_RATE) |
              (1 << IEEE80211_RADIOTAP_CHANNEL) |
              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
+             (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
              (1 << IEEE80211_RADIOTAP_ANTENNA));
 
         /* Zero the flags, we'll add to them as we go */
@@ -7582,6 +7743,217 @@ static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
 }
 #endif
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+#define ieee80211_is_probe_response(fc) \
+   ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT && \
+    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP )
+
+#define ieee80211_is_management(fc) \
+   ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
+
+#define ieee80211_is_control(fc) \
+   ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
+
+#define ieee80211_is_data(fc) \
+   ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
+
+#define ieee80211_is_assoc_request(fc) \
+   ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_ASSOC_REQ)
+
+#define ieee80211_is_reassoc_request(fc) \
+   ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_REASSOC_REQ)
+
+static void ipw_handle_promiscuous_rx(struct ipw_priv *priv,
+                                      struct ipw_rx_mem_buffer *rxb,
+                                      struct ieee80211_rx_stats *stats)
+{
+        struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
+        struct ipw_rx_frame *frame = &pkt->u.frame;
+        struct ipw_rt_hdr *ipw_rt;
+
+        /* First cache any information we need before we overwrite
+         * the information provided in the skb from the hardware */
+        struct ieee80211_hdr *hdr;
+        u16 channel = frame->received_channel;
+        u8 phy_flags = frame->antennaAndPhy;
+        s8 signal = frame->rssi_dbm - IPW_RSSI_TO_DBM;
+        s8 noise = frame->noise;
+        u8 rate = frame->rate;
+        short len = le16_to_cpu(pkt->u.frame.length);
+        u64 tsf = 0;
+        struct sk_buff *skb;
+        int hdr_only = 0;
+        u16 filter = priv->prom_priv->filter;
+
+        /* If the filter is set to not include Rx frames then return */
+        if (filter & IPW_PROM_NO_RX)
+                return;
+
+        /* We received data from the HW, so stop the watchdog */
+        priv->prom_net_dev->trans_start = jiffies;
+
+        if (unlikely((len + IPW_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
+                priv->prom_priv->ieee->stats.rx_errors++;
+                IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
+                return;
+        }
+
+        /* We only process data packets if the interface is open */
+        if (unlikely(!netif_running(priv->prom_net_dev))) {
+                priv->prom_priv->ieee->stats.rx_dropped++;
+                IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
+                return;
+        }
+
+        /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
+         * that now */
+        if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
+                /* FIXME: Should alloc bigger skb instead */
+                priv->prom_priv->ieee->stats.rx_dropped++;
+                IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
+                return;
+        }
+
+        hdr = (void *)rxb->skb->data + IPW_RX_FRAME_SIZE;
+        if (ieee80211_is_management(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_MGMT)
+                        return;
+                if (filter & IPW_PROM_MGMT_HEADER_ONLY)
+                        hdr_only = 1;
+        } else if (ieee80211_is_control(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_CTL)
+                        return;
+                if (filter & IPW_PROM_CTL_HEADER_ONLY)
+                        hdr_only = 1;
+        } else if (ieee80211_is_data(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_DATA)
+                        return;
+                if (filter & IPW_PROM_DATA_HEADER_ONLY)
+                        hdr_only = 1;
+        }
+
+        /* Copy the SKB since this is for the promiscuous side */
+        skb = skb_copy(rxb->skb, GFP_ATOMIC);
+        if (skb == NULL) {
+                IPW_ERROR("skb_clone failed for promiscuous copy.\n");
+                return;
+        }
+
+        /* copy the frame data to write after where the radiotap header goes */
+        ipw_rt = (void *)skb->data;
+
+        if (hdr_only)
+                len = ieee80211_get_hdrlen(hdr->frame_ctl);
+
+        memcpy(ipw_rt->payload, hdr, len);
+
+        /* Zero the radiotap static buffer  ...  We only need to zero the bytes
+         * NOT part of our real header, saves a little time.
+         *
+         * No longer necessary since we fill in all our data.  Purge before
+         * merging patch officially.
+         * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
+         *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
+         */
+
+        ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
+        ipw_rt->rt_hdr.it_len = sizeof(*ipw_rt);        /* total header+data */
+
+        /* Set the size of the skb to the size of the frame */
+        skb_put(skb, ipw_rt->rt_hdr.it_len + len);
+
+        /* Big bitfield of all the fields we provide in radiotap */
+        ipw_rt->rt_hdr.it_present =
+            ((1 << IEEE80211_RADIOTAP_FLAGS) |
+             (1 << IEEE80211_RADIOTAP_TSFT) |
+             (1 << IEEE80211_RADIOTAP_RATE) |
+             (1 << IEEE80211_RADIOTAP_CHANNEL) |
+             (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
+             (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
+             (1 << IEEE80211_RADIOTAP_ANTENNA));
+
+        /* Zero the flags, we'll add to them as we go */
+        ipw_rt->rt_flags = 0;
+
+        ipw_rt->rt_tsf = tsf;
+
+        /* Convert to DBM */
+        ipw_rt->rt_dbmsignal = signal;
+        ipw_rt->rt_dbmnoise = noise;
+
+        /* Convert the channel data and set the flags */
+        ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(channel));
+        if (channel > 14) {     /* 802.11a */
+                ipw_rt->rt_chbitmask =
+                    cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
+        } else if (phy_flags & (1 << 5)) {      /* 802.11b */
+                ipw_rt->rt_chbitmask =
+                    cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
+        } else {                /* 802.11g */
+                ipw_rt->rt_chbitmask =
+                    (IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
+        }
+
+        /* set the rate in multiples of 500k/s */
+        switch (rate) {
+        case IPW_TX_RATE_1MB:
+                ipw_rt->rt_rate = 2;
+                break;
+        case IPW_TX_RATE_2MB:
+                ipw_rt->rt_rate = 4;
+                break;
+        case IPW_TX_RATE_5MB:
+                ipw_rt->rt_rate = 10;
+                break;
+        case IPW_TX_RATE_6MB:
+                ipw_rt->rt_rate = 12;
+                break;
+        case IPW_TX_RATE_9MB:
+                ipw_rt->rt_rate = 18;
+                break;
+        case IPW_TX_RATE_11MB:
+                ipw_rt->rt_rate = 22;
+                break;
+        case IPW_TX_RATE_12MB:
+                ipw_rt->rt_rate = 24;
+                break;
+        case IPW_TX_RATE_18MB:
+                ipw_rt->rt_rate = 36;
+                break;
+        case IPW_TX_RATE_24MB:
+                ipw_rt->rt_rate = 48;
+                break;
+        case IPW_TX_RATE_36MB:
+                ipw_rt->rt_rate = 72;
+                break;
+        case IPW_TX_RATE_48MB:
+                ipw_rt->rt_rate = 96;
+                break;
+        case IPW_TX_RATE_54MB:
+                ipw_rt->rt_rate = 108;
+                break;
+        default:
+                ipw_rt->rt_rate = 0;
+                break;
+        }
+
+        /* antenna number */
+        ipw_rt->rt_antenna = (phy_flags & 3);
+
+        /* set the preamble flag if we have it */
+        if (phy_flags & (1 << 6))
+                ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
+
+        IPW_DEBUG_RX("Rx packet of %d bytes.\n", skb->len);
+
+        if (!ieee80211_rx(priv->prom_priv->ieee, skb, stats)) {
+                priv->prom_priv->ieee->stats.rx_errors++;
+                dev_kfree_skb_any(skb);
+        }
+}
+#endif
+
 static int is_network_packet(struct ipw_priv *priv,
                                     struct ieee80211_hdr_4addr *header)
 {
@@ -7808,15 +8180,21 @@ static void ipw_rx(struct ipw_priv *priv)
 
                                 priv->rx_packets++;
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        if (priv->prom_net_dev && netif_running(priv->prom_net_dev))
+                ipw_handle_promiscuous_rx(priv, rxb, &stats);
+#endif
+
 #ifdef CONFIG_IPW2200_MONITOR
                                 if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-#ifdef CONFIG_IEEE80211_RADIOTAP
-                                        ipw_handle_data_packet_monitor(priv,
-                                                                       rxb,
-                                                                       &stats);
+#ifdef CONFIG_IPW2200_RADIOTAP
+
+                ipw_handle_data_packet_monitor(priv,
+                                               rxb,
+                                               &stats);
 #else
-                                        ipw_handle_data_packet(priv, rxb,
-                                                               &stats);
+                ipw_handle_data_packet(priv, rxb,
+                                       &stats);
 #endif
                                         break;
                                 }
@@ -7837,9 +8215,9 @@ static void ipw_rx(struct ipw_priv *priv)
                                 if (network_packet && priv->assoc_network) {
                                         priv->assoc_network->stats.rssi =
                                             stats.rssi;
-                                        average_add(&priv->average_rssi,
-                                                    stats.rssi);
-                                        priv->last_rx_rssi = stats.rssi;
+                                        priv->exp_avg_rssi =
+                                            exponential_average(priv->exp_avg_rssi,
+                                            stats.rssi, DEPTH_RSSI);
                                 }
 
                                 IPW_DEBUG_RX("Frame: len=%u\n",
@@ -7982,10 +8360,10 @@ static int ipw_sw_reset(struct ipw_priv *priv, int option)
                 IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
                 /* TODO: Validate that provided channel is in range */
         }
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         ipw_qos_init(priv, qos_enable, qos_burst_enable,
                      burst_duration_CCK, burst_duration_OFDM);
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
         switch (mode) {
         case 1:
@@ -7996,7 +8374,7 @@ static int ipw_sw_reset(struct ipw_priv *priv, int option)
 #ifdef CONFIG_IPW2200_MONITOR
         case 2:
                 priv->ieee->iw_mode = IW_MODE_MONITOR;
-#ifdef CONFIG_IEEE80211_RADIOTAP
+#ifdef CONFIG_IPW2200_RADIOTAP
                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
 #else
                 priv->net_dev->type = ARPHRD_IEEE80211;
@@ -8251,7 +8629,7 @@ static int ipw_wx_set_mode(struct net_device *dev,
                 priv->net_dev->type = ARPHRD_ETHER;
 
         if (wrqu->mode == IW_MODE_MONITOR)
-#ifdef CONFIG_IEEE80211_RADIOTAP
+#ifdef CONFIG_IPW2200_RADIOTAP
                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
 #else
                 priv->net_dev->type = ARPHRD_IEEE80211;
@@ -8379,7 +8757,8 @@ static int ipw_wx_get_range(struct net_device *dev,
         /* Event capability (kernel + driver) */
         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
-                                IW_EVENT_CAPA_MASK(SIOCGIWAP));
+                                IW_EVENT_CAPA_MASK(SIOCGIWAP) |
+                                IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
         range->event_capa[1] = IW_EVENT_CAPA_K_1;
 
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
@@ -8734,6 +9113,7 @@ static int ipw_wx_get_rate(struct net_device *dev,
         struct ipw_priv *priv = ieee80211_priv(dev);
         mutex_lock(&priv->mutex);
         wrqu->bitrate.value = priv->last_rate;
+        wrqu->bitrate.fixed = (priv->config & CFG_FIXED_RATE) ? 1 : 0;
         mutex_unlock(&priv->mutex);
         IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
         return 0;
@@ -9351,7 +9731,7 @@ static int ipw_wx_set_monitor(struct net_device *dev,
         IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
         if (enable) {
                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
-#ifdef CONFIG_IEEE80211_RADIOTAP
+#ifdef CONFIG_IPW2200_RADIOTAP
                         priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
 #else
                         priv->net_dev->type = ARPHRD_IEEE80211;
@@ -9579,8 +9959,8 @@ static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev)
         }
 
         wstats->qual.qual = priv->quality;
-        wstats->qual.level = average_value(&priv->average_rssi);
-        wstats->qual.noise = average_value(&priv->average_noise);
+        wstats->qual.level = priv->exp_avg_rssi;
+        wstats->qual.noise = priv->exp_avg_noise;
         wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
             IW_QUAL_NOISE_UPDATED | IW_QUAL_DBM;
 
@@ -9608,7 +9988,9 @@ static  void init_sys_config(struct ipw_sys_config *sys_config)
         sys_config->disable_unicast_decryption = 1;
         sys_config->exclude_multicast_unencrypted = 0;
         sys_config->disable_multicast_decryption = 1;
-        sys_config->antenna_diversity = CFG_SYS_ANTENNA_SLOW_DIV;
+        if (antenna < CFG_SYS_ANTENNA_BOTH || antenna > CFG_SYS_ANTENNA_B)
+                antenna = CFG_SYS_ANTENNA_BOTH;
+        sys_config->antenna_diversity = antenna;
         sys_config->pass_crc_to_host = 0;       /* TODO: See if 1 gives us FCS */
         sys_config->dot11g_auto_detection = 0;
         sys_config->enable_cts_to_self = 0;
@@ -9647,11 +10029,11 @@ we need to heavily modify the ieee80211_skb_to_txb.
 static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
                              int pri)
 {
-        struct ieee80211_hdr_3addr *hdr = (struct ieee80211_hdr_3addr *)
+        struct ieee80211_hdr_3addrqos *hdr = (struct ieee80211_hdr_3addrqos *)
             txb->fragments[0]->data;
         int i = 0;
         struct tfd_frame *tfd;
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         int tx_id = ipw_get_tx_queue_number(priv, pri);
         struct clx2_tx_queue *txq = &priv->txq[tx_id];
 #else
@@ -9662,9 +10044,9 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
         u16 remaining_bytes;
         int fc;
 
+        hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
         switch (priv->ieee->iw_mode) {
         case IW_MODE_ADHOC:
-                hdr_len = IEEE80211_3ADDR_LEN;
                 unicast = !is_multicast_ether_addr(hdr->addr1);
                 id = ipw_find_station(priv, hdr->addr1);
                 if (id == IPW_INVALID_STATION) {
@@ -9681,7 +10063,6 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
         case IW_MODE_INFRA:
         default:
                 unicast = !is_multicast_ether_addr(hdr->addr3);
-                hdr_len = IEEE80211_3ADDR_LEN;
                 id = 0;
                 break;
         }
@@ -9759,9 +10140,10 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
                 /* No hardware encryption */
                 tfd->u.data.tx_flags |= DCT_FLAG_NO_WEP;
 
-#ifdef CONFIG_IPW_QOS
-        ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data), unicast);
-#endif                          /* CONFIG_IPW_QOS */
+#ifdef CONFIG_IPW2200_QOS
+        if (fc & IEEE80211_STYPE_QOS_DATA)
+                ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data));
+#endif                          /* CONFIG_IPW2200_QOS */
 
         /* payload */
         tfd->u.data.num_chunks = cpu_to_le32(min((u8) (NUM_TFD_CHUNKS - 2),
@@ -9841,12 +10223,12 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
 static int ipw_net_is_queue_full(struct net_device *dev, int pri)
 {
         struct ipw_priv *priv = ieee80211_priv(dev);
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         int tx_id = ipw_get_tx_queue_number(priv, pri);
         struct clx2_tx_queue *txq = &priv->txq[tx_id];
 #else
         struct clx2_tx_queue *txq = &priv->txq[0];
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
         if (ipw_queue_space(&txq->q) < txq->q.high_mark)
                 return 1;
@@ -9854,6 +10236,88 @@ static int ipw_net_is_queue_full(struct net_device *dev, int pri)
         return 0;
 }
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
+                                      struct ieee80211_txb *txb)
+{
+        struct ieee80211_rx_stats dummystats;
+        struct ieee80211_hdr *hdr;
+        u8 n;
+        u16 filter = priv->prom_priv->filter;
+        int hdr_only = 0;
+
+        if (filter & IPW_PROM_NO_TX)
+                return;
+
+        memset(&dummystats, 0, sizeof(dummystats));
+
+        /* Filtering of fragment chains is done agains the first fragment */
+        hdr = (void *)txb->fragments[0]->data;
+        if (ieee80211_is_management(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_MGMT)
+                        return;
+                if (filter & IPW_PROM_MGMT_HEADER_ONLY)
+                        hdr_only = 1;
+        } else if (ieee80211_is_control(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_CTL)
+                        return;
+                if (filter & IPW_PROM_CTL_HEADER_ONLY)
+                        hdr_only = 1;
+        } else if (ieee80211_is_data(hdr->frame_ctl)) {
+                if (filter & IPW_PROM_NO_DATA)
+                        return;
+                if (filter & IPW_PROM_DATA_HEADER_ONLY)
+                        hdr_only = 1;
+        }
+
+        for(n=0; n<txb->nr_frags; ++n) {
+                struct sk_buff *src = txb->fragments[n];
+                struct sk_buff *dst;
+                struct ieee80211_radiotap_header *rt_hdr;
+                int len;
+
+                if (hdr_only) {
+                        hdr = (void *)src->data;
+                        len = ieee80211_get_hdrlen(hdr->frame_ctl);
+                } else
+                        len = src->len;
+
+                dst = alloc_skb(
+                        len + IEEE80211_RADIOTAP_HDRLEN, GFP_ATOMIC);
+                if (!dst) continue;
+
+                rt_hdr = (void *)skb_put(dst, sizeof(*rt_hdr));
+
+                rt_hdr->it_version = PKTHDR_RADIOTAP_VERSION;
+                rt_hdr->it_pad = 0;
+                rt_hdr->it_present = 0; /* after all, it's just an idea */
+                rt_hdr->it_present |=  (1 << IEEE80211_RADIOTAP_CHANNEL);
+
+                *(u16*)skb_put(dst, sizeof(u16)) = cpu_to_le16(
+                        ieee80211chan2mhz(priv->channel));
+                if (priv->channel > 14)         /* 802.11a */
+                        *(u16*)skb_put(dst, sizeof(u16)) =
+                                cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                             IEEE80211_CHAN_5GHZ);
+                else if (priv->ieee->mode == IEEE_B) /* 802.11b */
+                        *(u16*)skb_put(dst, sizeof(u16)) =
+                                cpu_to_le16(IEEE80211_CHAN_CCK |
+                                             IEEE80211_CHAN_2GHZ);
+                else            /* 802.11g */
+                        *(u16*)skb_put(dst, sizeof(u16)) =
+                                cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                 IEEE80211_CHAN_2GHZ);
+
+                rt_hdr->it_len = dst->len;
+
+                memcpy(skb_put(dst, len), src->data, len);
+
+                if (!ieee80211_rx(priv->prom_priv->ieee, dst, &dummystats))
+                        dev_kfree_skb_any(dst);
+        }
+}
+#endif
+
 static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
                                    struct net_device *dev, int pri)
 {
@@ -9871,6 +10335,11 @@ static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
                 goto fail_unlock;
         }
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        if (rtap_iface && netif_running(priv->prom_net_dev))
+                ipw_handle_promiscuous_tx(priv, txb);
+#endif
+
         ret = ipw_tx_skb(priv, txb, pri);
         if (ret == NETDEV_TX_OK)
                 __ipw_led_activity_on(priv);
@@ -10169,10 +10638,10 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
         INIT_WORK(&priv->merge_networks,
                   (void (*)(void *))ipw_merge_adhoc_network, priv);
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         INIT_WORK(&priv->qos_activate, (void (*)(void *))ipw_bg_qos_activate,
                   priv);
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                      ipw_irq_tasklet, (unsigned long)priv);
@@ -10318,12 +10787,21 @@ static int ipw_config(struct ipw_priv *priv)
                             |= CFG_BT_COEXISTENCE_OOB;
         }
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
+                priv->sys_config.accept_all_data_frames = 1;
+                priv->sys_config.accept_non_directed_frames = 1;
+                priv->sys_config.accept_all_mgmt_bcpr = 1;
+                priv->sys_config.accept_all_mgmt_frames = 1;
+        }
+#endif
+
         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
                 priv->sys_config.answer_broadcast_ssid_probe = 1;
         else
                 priv->sys_config.answer_broadcast_ssid_probe = 0;
 
-        if (ipw_send_system_config(priv, &priv->sys_config))
+        if (ipw_send_system_config(priv))
                 goto error;
 
         init_supported_rates(priv, &priv->rates);
@@ -10335,10 +10813,10 @@ static int ipw_config(struct ipw_priv *priv)
                 if (ipw_send_rts_threshold(priv, priv->rts_threshold))
                         goto error;
         }
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
         IPW_DEBUG_QOS("QoS: call ipw_qos_activate\n");
         ipw_qos_activate(priv, NULL);
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
         if (ipw_set_random_seed(priv))
                 goto error;
@@ -10639,6 +11117,7 @@ static int ipw_up(struct ipw_priv *priv)
                 if (priv->cmdlog == NULL) {
                         IPW_ERROR("Error allocating %d command log entries.\n",
                                   cmdlog);
+                        return -ENOMEM;
                 } else {
                         memset(priv->cmdlog, 0, sizeof(*priv->cmdlog) * cmdlog);
                         priv->cmdlog_len = cmdlog;
@@ -10860,6 +11339,10 @@ static struct attribute *ipw_sysfs_entries[] = {
         &dev_attr_led.attr,
         &dev_attr_speed_scan.attr,
         &dev_attr_net_stats.attr,
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        &dev_attr_rtap_iface.attr,
+        &dev_attr_rtap_filter.attr,
+#endif
         NULL
 };
 
@@ -10868,6 +11351,109 @@ static struct attribute_group ipw_attribute_group = {
         .attrs = ipw_sysfs_entries,
 };
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+static int ipw_prom_open(struct net_device *dev)
+{
+        struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
+        struct ipw_priv *priv = prom_priv->priv;
+
+        IPW_DEBUG_INFO("prom dev->open\n");
+        netif_carrier_off(dev);
+        netif_stop_queue(dev);
+
+        if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
+                priv->sys_config.accept_all_data_frames = 1;
+                priv->sys_config.accept_non_directed_frames = 1;
+                priv->sys_config.accept_all_mgmt_bcpr = 1;
+                priv->sys_config.accept_all_mgmt_frames = 1;
+
+                ipw_send_system_config(priv);
+        }
+
+        return 0;
+}
+
+static int ipw_prom_stop(struct net_device *dev)
+{
+        struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
+        struct ipw_priv *priv = prom_priv->priv;
+
+        IPW_DEBUG_INFO("prom dev->stop\n");
+
+        if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
+                priv->sys_config.accept_all_data_frames = 0;
+                priv->sys_config.accept_non_directed_frames = 0;
+                priv->sys_config.accept_all_mgmt_bcpr = 0;
+                priv->sys_config.accept_all_mgmt_frames = 0;
+
+                ipw_send_system_config(priv);
+        }
+
+        return 0;
+}
+
+static int ipw_prom_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        IPW_DEBUG_INFO("prom dev->xmit\n");
+        netif_stop_queue(dev);
+        return -EOPNOTSUPP;
+}
+
+static struct net_device_stats *ipw_prom_get_stats(struct net_device *dev)
+{
+        struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
+        return &prom_priv->ieee->stats;
+}
+
+static int ipw_prom_alloc(struct ipw_priv *priv)
+{
+        int rc = 0;
+
+        if (priv->prom_net_dev)
+                return -EPERM;
+
+        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
+        if (priv->prom_net_dev == NULL)
+                return -ENOMEM;
+
+        priv->prom_priv = ieee80211_priv(priv->prom_net_dev);
+        priv->prom_priv->ieee = netdev_priv(priv->prom_net_dev);
+        priv->prom_priv->priv = priv;
+
+        strcpy(priv->prom_net_dev->name, "rtap%d");
+
+        priv->prom_net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
+        priv->prom_net_dev->open = ipw_prom_open;
+        priv->prom_net_dev->stop = ipw_prom_stop;
+        priv->prom_net_dev->get_stats = ipw_prom_get_stats;
+        priv->prom_net_dev->hard_start_xmit = ipw_prom_hard_start_xmit;
+
+        priv->prom_priv->ieee->iw_mode = IW_MODE_MONITOR;
+
+        rc = register_netdev(priv->prom_net_dev);
+        if (rc) {
+                free_ieee80211(priv->prom_net_dev);
+                priv->prom_net_dev = NULL;
+                return rc;
+        }
+
+        return 0;
+}
+
+static void ipw_prom_free(struct ipw_priv *priv)
+{
+        if (!priv->prom_net_dev)
+                return;
+
+        unregister_netdev(priv->prom_net_dev);
+        free_ieee80211(priv->prom_net_dev);
+
+        priv->prom_net_dev = NULL;
+}
+
+#endif
+
+
 static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int err = 0;
@@ -10959,11 +11545,12 @@ static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         priv->ieee->set_security = shim__set_security;
         priv->ieee->is_queue_full = ipw_net_is_queue_full;
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_QOS
+        priv->ieee->is_qos_active = ipw_is_qos_active;
         priv->ieee->handle_probe_response = ipw_handle_beacon;
         priv->ieee->handle_beacon = ipw_handle_probe_response;
         priv->ieee->handle_assoc_response = ipw_handle_assoc_response;
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
         priv->ieee->perfect_rssi = -20;
         priv->ieee->worst_rssi = -85;
@@ -10997,6 +11584,18 @@ static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_remove_sysfs;
         }
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        if (rtap_iface) {
+                err = ipw_prom_alloc(priv);
+                if (err) {
+                        IPW_ERROR("Failed to register promiscuous network "
+                                  "device (error %d).\n", err);
+                        unregister_netdev(priv->net_dev);
+                        goto out_remove_sysfs;
+                }
+        }
+#endif
+
         printk(KERN_INFO DRV_NAME ": Detected geography %s (%d 802.11bg "
                "channels, %d 802.11a channels)\n",
                priv->ieee->geo.name, priv->ieee->geo.bg_channels,
@@ -11076,6 +11675,10 @@ static void ipw_pci_remove(struct pci_dev *pdev)
                 priv->error = NULL;
         }
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        ipw_prom_free(priv);
+#endif
+
         free_irq(pdev->irq, priv);
         iounmap(priv->hw_base);
         pci_release_regions(pdev);
@@ -11200,7 +11803,12 @@ MODULE_PARM_DESC(debug, "debug output mask");
 module_param(channel, int, 0444);
 MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
 
-#ifdef CONFIG_IPW_QOS
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+module_param(rtap_iface, int, 0444);
+MODULE_PARM_DESC(rtap_iface, "create the rtap interface (1 - create, default 0)");
+#endif
+
+#ifdef CONFIG_IPW2200_QOS
 module_param(qos_enable, int, 0444);
 MODULE_PARM_DESC(qos_enable, "enable all QoS functionalitis");
 
@@ -11215,7 +11823,7 @@ MODULE_PARM_DESC(burst_duration_CCK, "set CCK burst value");
 
 module_param(burst_duration_OFDM, int, 0444);
 MODULE_PARM_DESC(burst_duration_OFDM, "set OFDM burst value");
-#endif                          /* CONFIG_IPW_QOS */
+#endif                          /* CONFIG_IPW2200_QOS */
 
 #ifdef CONFIG_IPW2200_MONITOR
 module_param(mode, int, 0444);
@@ -11238,5 +11846,8 @@ MODULE_PARM_DESC(cmdlog,
 module_param(roaming, int, 0444);
 MODULE_PARM_DESC(roaming, "enable roaming support (default on)");
 
+module_param(antenna, int, 0444);
+MODULE_PARM_DESC(antenna, "select antenna 1=Main, 3=Aux, default 0 [both], 2=slow_diversity (choose the one with lower background noise)");
+
 module_exit(ipw_exit);
 module_init(ipw_init);
diff --git a/drivers/net/wireless/ipw2200.h b/drivers/net/wireless/ipw2200.h
index 4b980490070..6044c0be2c8 100644
--- a/drivers/net/wireless/ipw2200.h
+++ b/drivers/net/wireless/ipw2200.h
@@ -789,7 +789,7 @@ struct ipw_sys_config {
         u8 bt_coexist_collision_thr;
         u8 silence_threshold;
         u8 accept_all_mgmt_bcpr;
-        u8 accept_all_mgtm_frames;
+        u8 accept_all_mgmt_frames;
         u8 pass_noise_stats_to_host;
         u8 reserved3;
 } __attribute__ ((packed));
@@ -1122,6 +1122,52 @@ struct ipw_fw_error {
         u8 payload[0];
 } __attribute__ ((packed));
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+
+enum ipw_prom_filter {
+        IPW_PROM_CTL_HEADER_ONLY = (1 << 0),
+        IPW_PROM_MGMT_HEADER_ONLY = (1 << 1),
+        IPW_PROM_DATA_HEADER_ONLY = (1 << 2),
+        IPW_PROM_ALL_HEADER_ONLY = 0xf, /* bits 0..3 */
+        IPW_PROM_NO_TX = (1 << 4),
+        IPW_PROM_NO_RX = (1 << 5),
+        IPW_PROM_NO_CTL = (1 << 6),
+        IPW_PROM_NO_MGMT = (1 << 7),
+        IPW_PROM_NO_DATA = (1 << 8),
+};
+
+struct ipw_priv;
+struct ipw_prom_priv {
+        struct ipw_priv *priv;
+        struct ieee80211_device *ieee;
+        enum ipw_prom_filter filter;
+        int tx_packets;
+        int rx_packets;
+};
+#endif
+
+#if defined(CONFIG_IPW2200_RADIOTAP) || defined(CONFIG_IPW2200_PROMISCUOUS)
+/* Magic struct that slots into the radiotap header -- no reason
+ * to build this manually element by element, we can write it much
+ * more efficiently than we can parse it. ORDER MATTERS HERE
+ *
+ * When sent to us via the simulated Rx interface in sysfs, the entire
+ * structure is provided regardless of any bits unset.
+ */
+struct ipw_rt_hdr {
+        struct ieee80211_radiotap_header rt_hdr;
+        u64 rt_tsf;      /* TSF */
+        u8 rt_flags;    /* radiotap packet flags */
+        u8 rt_rate;     /* rate in 500kb/s */
+        u16 rt_channel; /* channel in mhz */
+        u16 rt_chbitmask;       /* channel bitfield */
+        s8 rt_dbmsignal;        /* signal in dbM, kluged to signed */
+        s8 rt_dbmnoise;
+        u8 rt_antenna;  /* antenna number */
+        u8 payload[0];  /* payload... */
+} __attribute__ ((packed));
+#endif
+
 struct ipw_priv {
         /* ieee device used by generic ieee processing code */
         struct ieee80211_device *ieee;
@@ -1133,6 +1179,12 @@ struct ipw_priv {
         struct pci_dev *pci_dev;
         struct net_device *net_dev;
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        /* Promiscuous mode */
+        struct ipw_prom_priv *prom_priv;
+        struct net_device *prom_net_dev;
+#endif
+
         /* pci hardware address support */
         void __iomem *hw_base;
         unsigned long hw_len;
@@ -1153,11 +1205,9 @@ struct ipw_priv {
         u32 config;
         u32 capability;
 
-        u8 last_rx_rssi;
-        u8 last_noise;
         struct average average_missed_beacons;
-        struct average average_rssi;
-        struct average average_noise;
+        s16 exp_avg_rssi;
+        s16 exp_avg_noise;
         u32 port_type;
         int rx_bufs_min;          /**< minimum number of bufs in Rx queue */
         int rx_pend_max;          /**< maximum pending buffers for one IRQ */
@@ -1308,6 +1358,29 @@ struct ipw_priv {
 
 /* debug macros */
 
+/* Debug and printf string expansion helpers for printing bitfields */
+#define BIT_FMT8 "%c%c%c%c-%c%c%c%c"
+#define BIT_FMT16 BIT_FMT8 ":" BIT_FMT8
+#define BIT_FMT32 BIT_FMT16 " " BIT_FMT16
+
+#define BITC(x,y) (((x>>y)&1)?'1':'0')
+#define BIT_ARG8(x) \
+BITC(x,7),BITC(x,6),BITC(x,5),BITC(x,4),\
+BITC(x,3),BITC(x,2),BITC(x,1),BITC(x,0)
+
+#define BIT_ARG16(x) \
+BITC(x,15),BITC(x,14),BITC(x,13),BITC(x,12),\
+BITC(x,11),BITC(x,10),BITC(x,9),BITC(x,8),\
+BIT_ARG8(x)
+
+#define BIT_ARG32(x) \
+BITC(x,31),BITC(x,30),BITC(x,29),BITC(x,28),\
+BITC(x,27),BITC(x,26),BITC(x,25),BITC(x,24),\
+BITC(x,23),BITC(x,22),BITC(x,21),BITC(x,20),\
+BITC(x,19),BITC(x,18),BITC(x,17),BITC(x,16),\
+BIT_ARG16(x)
+
+
 #ifdef CONFIG_IPW2200_DEBUG
 #define IPW_DEBUG(level, fmt, args...) \
 do { if (ipw_debug_level & (level)) \
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index c2d0b09e041..8a31b591a90 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -201,41 +201,12 @@ static struct {
 /* Data types                                                       */
 /********************************************************************/
 
-/* Used in Event handling.
- * We avoid nested structures as they break on ARM -- Moustafa */
-struct hermes_tx_descriptor_802_11 {
-        /* hermes_tx_descriptor */
-        __le16 status;
-        __le16 reserved1;
-        __le16 reserved2;
-        __le32 sw_support;
-        u8 retry_count;
-        u8 tx_rate;
-        __le16 tx_control;
-
-        /* ieee80211_hdr */
+/* Beginning of the Tx descriptor, used in TxExc handling */
+struct hermes_txexc_data {
+        struct hermes_tx_descriptor desc;
         __le16 frame_ctl;
         __le16 duration_id;
         u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-        u8 addr3[ETH_ALEN];
-        __le16 seq_ctl;
-        u8 addr4[ETH_ALEN];
-
-        __le16 data_len;
-
-        /* ethhdr */
-        u8 h_dest[ETH_ALEN];    /* destination eth addr */
-        u8 h_source[ETH_ALEN];  /* source ether addr    */
-        __be16 h_proto;         /* packet type ID field */
-
-        /* p8022_hdr */
-        u8 dsap;
-        u8 ssap;
-        u8 ctrl;
-        u8 oui[3];
-
-        __be16 ethertype;
 } __attribute__ ((packed));
 
 /* Rx frame header except compatibility 802.3 header */
@@ -450,53 +421,39 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
         hermes_t *hw = &priv->hw;
         int err = 0;
         u16 txfid = priv->txfid;
-        char *p;
         struct ethhdr *eh;
-        int len, data_len, data_off;
+        int data_off;
         struct hermes_tx_descriptor desc;
         unsigned long flags;
 
-        TRACE_ENTER(dev->name);
-
         if (! netif_running(dev)) {
                 printk(KERN_ERR "%s: Tx on stopped device!\n",
                        dev->name);
-                TRACE_EXIT(dev->name);
-                return 1;
+                return NETDEV_TX_BUSY;
         }
         
         if (netif_queue_stopped(dev)) {
                 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n", 
                        dev->name);
-                TRACE_EXIT(dev->name);
-                return 1;
+                return NETDEV_TX_BUSY;
         }
         
         if (orinoco_lock(priv, &flags) != 0) {
                 printk(KERN_ERR "%s: orinoco_xmit() called while hw_unavailable\n",
                        dev->name);
-                TRACE_EXIT(dev->name);
-                return 1;
+                return NETDEV_TX_BUSY;
         }
 
         if (! netif_carrier_ok(dev) || (priv->iw_mode == IW_MODE_MONITOR)) {
                 /* Oops, the firmware hasn't established a connection,
                    silently drop the packet (this seems to be the
                    safest approach). */
-                stats->tx_errors++;
-                orinoco_unlock(priv, &flags);
-                dev_kfree_skb(skb);
-                TRACE_EXIT(dev->name);
-                return 0;
+                goto drop;
         }
 
-        /* Length of the packet body */
-        /* FIXME: what if the skb is smaller than this? */
-        len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN);
-        skb = skb_padto(skb, len);
-        if (skb == NULL)
-                goto fail;
-        len -= ETH_HLEN;
+        /* Check packet length */
+        if (skb->len < ETH_HLEN)
+                goto drop;
 
         eh = (struct ethhdr *)skb->data;
 
@@ -507,8 +464,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (net_ratelimit())
                         printk(KERN_ERR "%s: Error %d writing Tx descriptor "
                                "to BAP\n", dev->name, err);
-                stats->tx_errors++;
-                goto fail;
+                goto busy;
         }
 
         /* Clear the 802.11 header and data length fields - some
@@ -519,50 +475,38 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Encapsulate Ethernet-II frames */
         if (ntohs(eh->h_proto) > ETH_DATA_LEN) { /* Ethernet-II frame */
-                struct header_struct hdr;
-                data_len = len;
-                data_off = HERMES_802_3_OFFSET + sizeof(hdr);
-                p = skb->data + ETH_HLEN;
-
-                /* 802.3 header */
-                memcpy(hdr.dest, eh->h_dest, ETH_ALEN);
-                memcpy(hdr.src, eh->h_source, ETH_ALEN);
-                hdr.len = htons(data_len + ENCAPS_OVERHEAD);
-                
-                /* 802.2 header */
-                memcpy(&hdr.dsap, &encaps_hdr, sizeof(encaps_hdr));
-                        
-                hdr.ethertype = eh->h_proto;
-                err  = hermes_bap_pwrite(hw, USER_BAP, &hdr, sizeof(hdr),
-                                         txfid, HERMES_802_3_OFFSET);
+                struct header_struct {
+                        struct ethhdr eth;      /* 802.3 header */
+                        u8 encap[6];            /* 802.2 header */
+                } __attribute__ ((packed)) hdr;
+
+                /* Strip destination and source from the data */
+                skb_pull(skb, 2 * ETH_ALEN);
+                data_off = HERMES_802_2_OFFSET + sizeof(encaps_hdr);
+
+                /* And move them to a separate header */
+                memcpy(&hdr.eth, eh, 2 * ETH_ALEN);
+                hdr.eth.h_proto = htons(sizeof(encaps_hdr) + skb->len);
+                memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr));
+
+                err = hermes_bap_pwrite(hw, USER_BAP, &hdr, sizeof(hdr),
+                                        txfid, HERMES_802_3_OFFSET);
                 if (err) {
                         if (net_ratelimit())
                                 printk(KERN_ERR "%s: Error %d writing packet "
                                        "header to BAP\n", dev->name, err);
-                        stats->tx_errors++;
-                        goto fail;
+                        goto busy;
                 }
-                /* Actual xfer length - allow for padding */
-                len = ALIGN(data_len, 2);
-                if (len < ETH_ZLEN - ETH_HLEN)
-                        len = ETH_ZLEN - ETH_HLEN;
         } else { /* IEEE 802.3 frame */
-                data_len = len + ETH_HLEN;
                 data_off = HERMES_802_3_OFFSET;
-                p = skb->data;
-                /* Actual xfer length - round up for odd length packets */
-                len = ALIGN(data_len, 2);
-                if (len < ETH_ZLEN)
-                        len = ETH_ZLEN;
         }
 
-        err = hermes_bap_pwrite_pad(hw, USER_BAP, p, data_len, len,
+        err = hermes_bap_pwrite(hw, USER_BAP, skb->data, skb->len,
                                 txfid, data_off);
         if (err) {
                 printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
                        dev->name, err);
-                stats->tx_errors++;
-                goto fail;
+                goto busy;
         }
 
         /* Finally, we actually initiate the send */
@@ -575,25 +519,27 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (net_ratelimit())
                         printk(KERN_ERR "%s: Error %d transmitting packet\n",
                                 dev->name, err);
-                stats->tx_errors++;
-                goto fail;
+                goto busy;
         }
 
         dev->trans_start = jiffies;
-        stats->tx_bytes += data_off + data_len;
+        stats->tx_bytes += data_off + skb->len;
+        goto ok;
 
-        orinoco_unlock(priv, &flags);
+ drop:
+        stats->tx_errors++;
+        stats->tx_dropped++;
 
+ ok:
+        orinoco_unlock(priv, &flags);
         dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
 
-        TRACE_EXIT(dev->name);
-
-        return 0;
- fail:
-        TRACE_EXIT(dev->name);
-
+ busy:
+        if (err == -EIO)
+                schedule_work(&priv->reset_work);
         orinoco_unlock(priv, &flags);
-        return err;
+        return NETDEV_TX_BUSY;
 }
 
 static void __orinoco_ev_alloc(struct net_device *dev, hermes_t *hw)
@@ -629,7 +575,7 @@ static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
         struct net_device_stats *stats = &priv->stats;
         u16 fid = hermes_read_regn(hw, TXCOMPLFID);
         u16 status;
-        struct hermes_tx_descriptor_802_11 hdr;
+        struct hermes_txexc_data hdr;
         int err = 0;
 
         if (fid == DUMMY_FID)
@@ -637,8 +583,7 @@ static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
 
         /* Read part of the frame header - we need status and addr1 */
         err = hermes_bap_pread(hw, IRQ_BAP, &hdr,
-                               offsetof(struct hermes_tx_descriptor_802_11,
-                                        addr2),
+                               sizeof(struct hermes_txexc_data),
                                fid, 0);
 
         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
@@ -658,7 +603,7 @@ static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
          * exceeded, because that's the only status that really mean
          * that this particular node went away.
          * Other errors means that *we* screwed up. - Jean II */
-        status = le16_to_cpu(hdr.status);
+        status = le16_to_cpu(hdr.desc.status);
         if (status & (HERMES_TXSTAT_RETRYERR | HERMES_TXSTAT_AGEDERR)) {
                 union iwreq_data        wrqu;
 
@@ -1398,16 +1343,12 @@ int __orinoco_down(struct net_device *dev)
         return 0;
 }
 
-int orinoco_reinit_firmware(struct net_device *dev)
+static int orinoco_allocate_fid(struct net_device *dev)
 {
         struct orinoco_private *priv = netdev_priv(dev);
         struct hermes *hw = &priv->hw;
         int err;
 
-        err = hermes_init(hw);
-        if (err)
-                return err;
-
         err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
         if (err == -EIO && priv->nicbuf_size > TX_NICBUF_SIZE_BUG) {
                 /* Try workaround for old Symbol firmware bug */
@@ -1426,6 +1367,19 @@ int orinoco_reinit_firmware(struct net_device *dev)
         return err;
 }
 
+int orinoco_reinit_firmware(struct net_device *dev)
+{
+        struct orinoco_private *priv = netdev_priv(dev);
+        struct hermes *hw = &priv->hw;
+        int err;
+
+        err = hermes_init(hw);
+        if (!err)
+                err = orinoco_allocate_fid(dev);
+
+        return err;
+}
+
 static int __orinoco_hw_set_bitrate(struct orinoco_private *priv)
 {
         hermes_t *hw = &priv->hw;
@@ -1833,7 +1787,9 @@ static int __orinoco_program_rids(struct net_device *dev)
         /* Set promiscuity / multicast*/
         priv->promiscuous = 0;
         priv->mc_count = 0;
-        __orinoco_set_multicast_list(dev); /* FIXME: what about the xmit_lock */
+
+        /* FIXME: what about netif_tx_lock */
+        __orinoco_set_multicast_list(dev);
 
         return 0;
 }
@@ -2272,14 +2228,12 @@ static int orinoco_init(struct net_device *dev)
         u16 reclen;
         int len;
 
-        TRACE_ENTER(dev->name);
-
         /* No need to lock, the hw_unavailable flag is already set in
          * alloc_orinocodev() */
         priv->nicbuf_size = IEEE80211_FRAME_LEN + ETH_HLEN;
 
         /* Initialize the firmware */
-        err = orinoco_reinit_firmware(dev);
+        err = hermes_init(hw);
         if (err != 0) {
                 printk(KERN_ERR "%s: failed to initialize firmware (err = %d)\n",
                        dev->name, err);
@@ -2337,6 +2291,13 @@ static int orinoco_init(struct net_device *dev)
 
         printk(KERN_DEBUG "%s: Station name \"%s\"\n", dev->name, priv->nick);
 
+        err = orinoco_allocate_fid(dev);
+        if (err) {
+                printk(KERN_ERR "%s: failed to allocate NIC buffer!\n",
+                       dev->name);
+                goto out;
+        }
+
         /* Get allowed channels */
         err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_CHANNELLIST,
                                   &priv->channel_mask);
@@ -2427,7 +2388,6 @@ static int orinoco_init(struct net_device *dev)
         printk(KERN_DEBUG "%s: ready\n", dev->name);
 
  out:
-        TRACE_EXIT(dev->name);
         return err;
 }
 
@@ -2795,8 +2755,6 @@ static int orinoco_ioctl_getiwrange(struct net_device *dev,
         int numrates;
         int i, k;
 
-        TRACE_ENTER(dev->name);
-
         rrq->length = sizeof(struct iw_range);
         memset(range, 0, sizeof(struct iw_range));
 
@@ -2886,8 +2844,6 @@ static int orinoco_ioctl_getiwrange(struct net_device *dev,
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
         IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
 
-        TRACE_EXIT(dev->name);
-
         return 0;
 }
 
@@ -3069,8 +3025,6 @@ static int orinoco_ioctl_getessid(struct net_device *dev,
         int err = 0;
         unsigned long flags;
 
-        TRACE_ENTER(dev->name);
-
         if (netif_running(dev)) {
                 err = orinoco_hw_get_essid(priv, &active, essidbuf);
                 if (err)
@@ -3085,8 +3039,6 @@ static int orinoco_ioctl_getessid(struct net_device *dev,
         erq->flags = 1;
         erq->length = strlen(essidbuf) + 1;
 
-        TRACE_EXIT(dev->name);
-        
         return 0;
 }
 
@@ -4347,69 +4299,6 @@ static struct ethtool_ops orinoco_ethtool_ops = {
 };
 
 /********************************************************************/
-/* Debugging                                                        */
-/********************************************************************/
-
-#if 0
-static void show_rx_frame(struct orinoco_rxframe_hdr *frame)
-{
-        printk(KERN_DEBUG "RX descriptor:\n");
-        printk(KERN_DEBUG "  status      = 0x%04x\n", frame->desc.status);
-        printk(KERN_DEBUG "  time        = 0x%08x\n", frame->desc.time);
-        printk(KERN_DEBUG "  silence     = 0x%02x\n", frame->desc.silence);
-        printk(KERN_DEBUG "  signal      = 0x%02x\n", frame->desc.signal);
-        printk(KERN_DEBUG "  rate        = 0x%02x\n", frame->desc.rate);
-        printk(KERN_DEBUG "  rxflow      = 0x%02x\n", frame->desc.rxflow);
-        printk(KERN_DEBUG "  reserved    = 0x%08x\n", frame->desc.reserved);
-
-        printk(KERN_DEBUG "IEEE 802.11 header:\n");
-        printk(KERN_DEBUG "  frame_ctl   = 0x%04x\n",
-               frame->p80211.frame_ctl);
-        printk(KERN_DEBUG "  duration_id = 0x%04x\n",
-               frame->p80211.duration_id);
-        printk(KERN_DEBUG "  addr1       = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p80211.addr1[0], frame->p80211.addr1[1],
-               frame->p80211.addr1[2], frame->p80211.addr1[3],
-               frame->p80211.addr1[4], frame->p80211.addr1[5]);
-        printk(KERN_DEBUG "  addr2       = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p80211.addr2[0], frame->p80211.addr2[1],
-               frame->p80211.addr2[2], frame->p80211.addr2[3],
-               frame->p80211.addr2[4], frame->p80211.addr2[5]);
-        printk(KERN_DEBUG "  addr3       = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p80211.addr3[0], frame->p80211.addr3[1],
-               frame->p80211.addr3[2], frame->p80211.addr3[3],
-               frame->p80211.addr3[4], frame->p80211.addr3[5]);
-        printk(KERN_DEBUG "  seq_ctl     = 0x%04x\n",
-               frame->p80211.seq_ctl);
-        printk(KERN_DEBUG "  addr4       = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p80211.addr4[0], frame->p80211.addr4[1],
-               frame->p80211.addr4[2], frame->p80211.addr4[3],
-               frame->p80211.addr4[4], frame->p80211.addr4[5]);
-        printk(KERN_DEBUG "  data_len    = 0x%04x\n",
-               frame->p80211.data_len);
-
-        printk(KERN_DEBUG "IEEE 802.3 header:\n");
-        printk(KERN_DEBUG "  dest        = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p8023.h_dest[0], frame->p8023.h_dest[1],
-               frame->p8023.h_dest[2], frame->p8023.h_dest[3],
-               frame->p8023.h_dest[4], frame->p8023.h_dest[5]);
-        printk(KERN_DEBUG "  src         = %02x:%02x:%02x:%02x:%02x:%02x\n",
-               frame->p8023.h_source[0], frame->p8023.h_source[1],
-               frame->p8023.h_source[2], frame->p8023.h_source[3],
-               frame->p8023.h_source[4], frame->p8023.h_source[5]);
-        printk(KERN_DEBUG "  len         = 0x%04x\n", frame->p8023.h_proto);
-
-        printk(KERN_DEBUG "IEEE 802.2 LLC/SNAP header:\n");
-        printk(KERN_DEBUG "  DSAP        = 0x%02x\n", frame->p8022.dsap);
-        printk(KERN_DEBUG "  SSAP        = 0x%02x\n", frame->p8022.ssap);
-        printk(KERN_DEBUG "  ctrl        = 0x%02x\n", frame->p8022.ctrl);
-        printk(KERN_DEBUG "  OUI         = %02x:%02x:%02x\n",
-               frame->p8022.oui[0], frame->p8022.oui[1], frame->p8022.oui[2]);
-        printk(KERN_DEBUG "  ethertype  = 0x%04x\n", frame->ethertype);
-}
-#endif /* 0 */
-
-/********************************************************************/
 /* Module initialization                                            */
 /********************************************************************/
 
diff --git a/drivers/net/wireless/orinoco.h b/drivers/net/wireless/orinoco.h
index f5d856db92a..16db3e14b7d 100644
--- a/drivers/net/wireless/orinoco.h
+++ b/drivers/net/wireless/orinoco.h
@@ -7,7 +7,7 @@
 #ifndef _ORINOCO_H
 #define _ORINOCO_H
 
-#define DRIVER_VERSION "0.15rc3"
+#define DRIVER_VERSION "0.15"
 
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -30,20 +30,6 @@ struct orinoco_key {
         char data[ORINOCO_MAX_KEY_SIZE];
 } __attribute__ ((packed));
 
-struct header_struct {
-        /* 802.3 */
-        u8 dest[ETH_ALEN];
-        u8 src[ETH_ALEN];
-        __be16 len;
-        /* 802.2 */
-        u8 dsap;
-        u8 ssap;
-        u8 ctrl;
-        /* SNAP */
-        u8 oui[3];
-        unsigned short ethertype;
-} __attribute__ ((packed));
-
 typedef enum {
         FIRMWARE_TYPE_AGERE,
         FIRMWARE_TYPE_INTERSIL,
@@ -132,9 +118,6 @@ extern int orinoco_debug;
 #define DEBUG(n, args...) do { } while (0)
 #endif  /* ORINOCO_DEBUG */
 
-#define TRACE_ENTER(devname) DEBUG(2, "%s: -> %s()\n", devname, __FUNCTION__);
-#define TRACE_EXIT(devname)  DEBUG(2, "%s: <- %s()\n", devname, __FUNCTION__);
-
 /********************************************************************/
 /* Exported prototypes                                              */
 /********************************************************************/
diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c
index 434f7d7ad84..b2aec4d9fbb 100644
--- a/drivers/net/wireless/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -147,14 +147,11 @@ static void orinoco_cs_detach(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
 
+        if (link->dev_node)
+                unregister_netdev(dev);
+
         orinoco_cs_release(link);
 
-        DEBUG(0, PFX "detach: link=%p link->dev_node=%p\n", link, link->dev_node);
-        if (link->dev_node) {
-                DEBUG(0, PFX "About to unregister net device %p\n",
-                      dev);
-                unregister_netdev(dev);
-        }
         free_orinocodev(dev);
 }                               /* orinoco_cs_detach */
 
@@ -178,13 +175,10 @@ orinoco_cs_config(struct pcmcia_device *link)
         int last_fn, last_ret;
         u_char buf[64];
         config_info_t conf;
-        cisinfo_t info;
         tuple_t tuple;
         cisparse_t parse;
         void __iomem *mem;
 
-        CS_CHECK(ValidateCIS, pcmcia_validate_cis(link, &info));
-
         /*
          * This reads the card's CONFIG tuple to find its
          * configuration registers.
@@ -234,12 +228,6 @@ orinoco_cs_config(struct pcmcia_device *link)
                         goto next_entry;
                 link->conf.ConfigIndex = cfg->index;
 
-                /* Does this card need audio output? */
-                if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
-                        link->conf.Attributes |= CONF_ENABLE_SPKR;
-                        link->conf.Status = CCSR_AUDIO_ENA;
-                }
-
                 /* Use power settings for Vcc and Vpp if present */
                 /* Note that the CIS values need to be rescaled */
                 if (cfg->vcc.present & (1 << CISTPL_POWER_VNOM)) {
@@ -355,19 +343,10 @@ orinoco_cs_config(struct pcmcia_device *link)
                                     net_device has been registered */
 
         /* Finally, report what we've done */
-        printk(KERN_DEBUG "%s: index 0x%02x: ",
-               dev->name, link->conf.ConfigIndex);
-        if (link->conf.Vpp)
-                printk(", Vpp %d.%d", link->conf.Vpp / 10,
-                       link->conf.Vpp % 10);
-        printk(", irq %d", link->irq.AssignedIRQ);
-        if (link->io.NumPorts1)
-                printk(", io 0x%04x-0x%04x", link->io.BasePort1,
-                       link->io.BasePort1 + link->io.NumPorts1 - 1);
-        if (link->io.NumPorts2)
-                printk(" & 0x%04x-0x%04x", link->io.BasePort2,
-                       link->io.BasePort2 + link->io.NumPorts2 - 1);
-        printk("\n");
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s, irq %d, io "
+               "0x%04x-0x%04x\n", dev->name, dev->class_dev.dev->bus_id,
+               link->irq.AssignedIRQ, link->io.BasePort1,
+               link->io.BasePort1 + link->io.NumPorts1 - 1);
 
         return 0;
 
@@ -436,7 +415,6 @@ static int orinoco_cs_resume(struct pcmcia_device *link)
         struct orinoco_private *priv = netdev_priv(dev);
         struct orinoco_pccard *card = priv->card;
         int err = 0;
-        unsigned long flags;
 
         if (! test_bit(0, &card->hard_reset_in_progress)) {
                 err = orinoco_reinit_firmware(dev);
@@ -446,7 +424,7 @@ static int orinoco_cs_resume(struct pcmcia_device *link)
                         return -EIO;
                 }
 
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock(&priv->lock);
 
                 netif_device_attach(dev);
                 priv->hw_unavailable--;
@@ -458,10 +436,10 @@ static int orinoco_cs_resume(struct pcmcia_device *link)
                                        dev->name, err);
                 }
 
-                spin_unlock_irqrestore(&priv->lock, flags);
+                spin_unlock(&priv->lock);
         }
 
-        return 0;
+        return err;
 }
 
 
diff --git a/drivers/net/wireless/orinoco_nortel.c b/drivers/net/wireless/orinoco_nortel.c
index d1a670b3533..74b9d5b2ba9 100644
--- a/drivers/net/wireless/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco_nortel.c
@@ -1,9 +1,8 @@
 /* orinoco_nortel.c
- * 
+ *
  * Driver for Prism II devices which would usually be driven by orinoco_cs,
  * but are connected to the PCI bus by a PCI-to-PCMCIA adapter used in
  * Nortel emobility, Symbol LA-4113 and Symbol LA-4123.
- * but are connected to the PCI bus by a Nortel PCI-PCMCIA-Adapter. 
  *
  * Copyright (C) 2002 Tobias Hoffmann
  *           (C) 2003 Christoph Jungegger <disdos@traum404.de>
@@ -50,67 +49,62 @@
 #include <pcmcia/cisreg.h>
 
 #include "orinoco.h"
+#include "orinoco_pci.h"
 
 #define COR_OFFSET    (0xe0)    /* COR attribute offset of Prism2 PC card */
 #define COR_VALUE     (COR_LEVEL_REQ | COR_FUNC_ENA)    /* Enable PC card with interrupt in level trigger */
 
 
-/* Nortel specific data */
-struct nortel_pci_card {
-        unsigned long iobase1;
-        unsigned long iobase2;
-};
-
 /*
- * Do a soft reset of the PCI card using the Configuration Option Register
+ * Do a soft reset of the card using the Configuration Option Register
  * We need this to get going...
  * This is the part of the code that is strongly inspired from wlan-ng
  *
  * Note bis : Don't try to access HERMES_CMD during the reset phase.
  * It just won't work !
  */
-static int nortel_pci_cor_reset(struct orinoco_private *priv)
+static int orinoco_nortel_cor_reset(struct orinoco_private *priv)
 {
-        struct nortel_pci_card *card = priv->card;
+        struct orinoco_pci_card *card = priv->card;
 
-        /* Assert the reset until the card notice */
-        outw_p(8, card->iobase1 + 2);
-        inw(card->iobase2 + COR_OFFSET);
-        outw_p(0x80, card->iobase2 + COR_OFFSET);
+        /* Assert the reset until the card notices */
+        iowrite16(8, card->bridge_io + 2);
+        ioread16(card->attr_io + COR_OFFSET);
+        iowrite16(0x80, card->attr_io + COR_OFFSET);
         mdelay(1);
 
         /* Give time for the card to recover from this hard effort */
-        outw_p(0, card->iobase2 + COR_OFFSET);
-        outw_p(0, card->iobase2 + COR_OFFSET);
+        iowrite16(0, card->attr_io + COR_OFFSET);
+        iowrite16(0, card->attr_io + COR_OFFSET);
         mdelay(1);
 
-        /* set COR as usual */
-        outw_p(COR_VALUE, card->iobase2 + COR_OFFSET);
-        outw_p(COR_VALUE, card->iobase2 + COR_OFFSET);
+        /* Set COR as usual */
+        iowrite16(COR_VALUE, card->attr_io + COR_OFFSET);
+        iowrite16(COR_VALUE, card->attr_io + COR_OFFSET);
         mdelay(1);
 
-        outw_p(0x228, card->iobase1 + 2);
+        iowrite16(0x228, card->bridge_io + 2);
 
         return 0;
 }
 
-static int nortel_pci_hw_init(struct nortel_pci_card *card)
+static int orinoco_nortel_hw_init(struct orinoco_pci_card *card)
 {
         int i;
         u32 reg;
 
-        /* setup bridge */
-        if (inw(card->iobase1) & 1) {
+        /* Setup bridge */
+        if (ioread16(card->bridge_io) & 1) {
                 printk(KERN_ERR PFX "brg1 answer1 wrong\n");
                 return -EBUSY;
         }
-        outw_p(0x118, card->iobase1 + 2);
-        outw_p(0x108, card->iobase1 + 2);
+        iowrite16(0x118, card->bridge_io + 2);
+        iowrite16(0x108, card->bridge_io + 2);
         mdelay(30);
-        outw_p(0x8, card->iobase1 + 2);
+        iowrite16(0x8, card->bridge_io + 2);
         for (i = 0; i < 30; i++) {
                 mdelay(30);
-                if (inw(card->iobase1) & 0x10) {
+                if (ioread16(card->bridge_io) & 0x10) {
                         break;
                 }
         }
@@ -118,42 +112,42 @@ static int nortel_pci_hw_init(struct nortel_pci_card *card)
                 printk(KERN_ERR PFX "brg1 timed out\n");
                 return -EBUSY;
         }
-        if (inw(card->iobase2 + 0xe0) & 1) {
+        if (ioread16(card->attr_io + COR_OFFSET) & 1) {
                 printk(KERN_ERR PFX "brg2 answer1 wrong\n");
                 return -EBUSY;
         }
-        if (inw(card->iobase2 + 0xe2) & 1) {
+        if (ioread16(card->attr_io + COR_OFFSET + 2) & 1) {
                 printk(KERN_ERR PFX "brg2 answer2 wrong\n");
                 return -EBUSY;
         }
-        if (inw(card->iobase2 + 0xe4) & 1) {
+        if (ioread16(card->attr_io + COR_OFFSET + 4) & 1) {
                 printk(KERN_ERR PFX "brg2 answer3 wrong\n");
                 return -EBUSY;
         }
 
-        /* set the PCMCIA COR-Register */
-        outw_p(COR_VALUE, card->iobase2 + COR_OFFSET);
+        /* Set the PCMCIA COR register */
+        iowrite16(COR_VALUE, card->attr_io + COR_OFFSET);
         mdelay(1);
-        reg = inw(card->iobase2 + COR_OFFSET);
+        reg = ioread16(card->attr_io + COR_OFFSET);
         if (reg != COR_VALUE) {
                 printk(KERN_ERR PFX "Error setting COR value (reg=%x)\n",
                        reg);
                 return -EBUSY;
         }
 
-        /* set leds */
-        outw_p(1, card->iobase1 + 10);
+        /* Set LEDs */
+        iowrite16(1, card->bridge_io + 10);
         return 0;
 }
 
-static int nortel_pci_init_one(struct pci_dev *pdev,
-                               const struct pci_device_id *ent)
+static int orinoco_nortel_init_one(struct pci_dev *pdev,
+                                   const struct pci_device_id *ent)
 {
         int err;
         struct orinoco_private *priv;
-        struct nortel_pci_card *card;
+        struct orinoco_pci_card *card;
         struct net_device *dev;
-        void __iomem *iomem;
+        void __iomem *hermes_io, *bridge_io, *attr_io;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -162,19 +156,34 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
         }
 
         err = pci_request_regions(pdev, DRIVER_NAME);
-        if (err != 0) {
+        if (err) {
                 printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
                 goto fail_resources;
         }
 
-        iomem = pci_iomap(pdev, 2, 0);
-        if (!iomem) {
-                err = -ENOMEM;
-                goto fail_map_io;
+        bridge_io = pci_iomap(pdev, 0, 0);
+        if (!bridge_io) {
+                printk(KERN_ERR PFX "Cannot map bridge registers\n");
+                err = -EIO;
+                goto fail_map_bridge;
+        }
+
+        attr_io = pci_iomap(pdev, 1, 0);
+        if (!attr_io) {
+                printk(KERN_ERR PFX "Cannot map PCMCIA attributes\n");
+                err = -EIO;
+                goto fail_map_attr;
+        }
+
+        hermes_io = pci_iomap(pdev, 2, 0);
+        if (!hermes_io) {
+                printk(KERN_ERR PFX "Cannot map chipset registers\n");
+                err = -EIO;
+                goto fail_map_hermes;
         }
 
         /* Allocate network device */
-        dev = alloc_orinocodev(sizeof(*card), nortel_pci_cor_reset);
+        dev = alloc_orinocodev(sizeof(*card), orinoco_nortel_cor_reset);
         if (!dev) {
                 printk(KERN_ERR PFX "Cannot allocate network device\n");
                 err = -ENOMEM;
@@ -183,16 +192,12 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
 
         priv = netdev_priv(dev);
         card = priv->card;
-        card->iobase1 = pci_resource_start(pdev, 0);
-        card->iobase2 = pci_resource_start(pdev, 1);
-        dev->base_addr = pci_resource_start(pdev, 2);
+        card->bridge_io = bridge_io;
+        card->attr_io = attr_io;
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-        hermes_struct_init(&priv->hw, iomem, HERMES_16BIT_REGSPACING);
-
-        printk(KERN_DEBUG PFX "Detected Nortel PCI device at %s irq:%d, "
-               "io addr:0x%lx\n", pci_name(pdev), pdev->irq, dev->base_addr);
+        hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING);
 
         err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
                           dev->name, dev);
@@ -201,21 +206,19 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
                 err = -EBUSY;
                 goto fail_irq;
         }
-        dev->irq = pdev->irq;
 
-        err = nortel_pci_hw_init(card);
+        err = orinoco_nortel_hw_init(card);
         if (err) {
                 printk(KERN_ERR PFX "Hardware initialization failed\n");
                 goto fail;
         }
 
-        err = nortel_pci_cor_reset(priv);
+        err = orinoco_nortel_cor_reset(priv);
         if (err) {
                 printk(KERN_ERR PFX "Initial reset failed\n");
                 goto fail;
         }
 
-
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR PFX "Cannot register network device\n");
@@ -223,6 +226,8 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
         }
 
         pci_set_drvdata(pdev, dev);
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s\n", dev->name,
+               pci_name(pdev));
 
         return 0;
 
@@ -234,9 +239,15 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
         free_orinocodev(dev);
 
  fail_alloc:
-        pci_iounmap(pdev, iomem);
+        pci_iounmap(pdev, hermes_io);
 
- fail_map_io:
+ fail_map_hermes:
+        pci_iounmap(pdev, attr_io);
+
+ fail_map_attr:
+        pci_iounmap(pdev, bridge_io);
+
+ fail_map_bridge:
         pci_release_regions(pdev);
 
  fail_resources:
@@ -245,26 +256,27 @@ static int nortel_pci_init_one(struct pci_dev *pdev,
         return err;
 }
 
-static void __devexit nortel_pci_remove_one(struct pci_dev *pdev)
+static void __devexit orinoco_nortel_remove_one(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct orinoco_private *priv = netdev_priv(dev);
-        struct nortel_pci_card *card = priv->card;
+        struct orinoco_pci_card *card = priv->card;
 
-        /* clear leds */
-        outw_p(0, card->iobase1 + 10);
+        /* Clear LEDs */
+        iowrite16(0, card->bridge_io + 10);
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
+        free_irq(pdev->irq, dev);
         pci_set_drvdata(pdev, NULL);
         free_orinocodev(dev);
         pci_iounmap(pdev, priv->hw.iobase);
+        pci_iounmap(pdev, card->attr_io);
+        pci_iounmap(pdev, card->bridge_io);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 }
 
-
-static struct pci_device_id nortel_pci_id_table[] = {
+static struct pci_device_id orinoco_nortel_id_table[] = {
         /* Nortel emobility PCI */
         {0x126c, 0x8030, PCI_ANY_ID, PCI_ANY_ID,},
         /* Symbol LA-4123 PCI */
@@ -272,13 +284,15 @@ static struct pci_device_id nortel_pci_id_table[] = {
         {0,},
 };
 
-MODULE_DEVICE_TABLE(pci, nortel_pci_id_table);
+MODULE_DEVICE_TABLE(pci, orinoco_nortel_id_table);
 
-static struct pci_driver nortel_pci_driver = {
-        .name = DRIVER_NAME,
-        .id_table = nortel_pci_id_table,
-        .probe = nortel_pci_init_one,
-        .remove = __devexit_p(nortel_pci_remove_one),
+static struct pci_driver orinoco_nortel_driver = {
+        .name           = DRIVER_NAME,
+        .id_table       = orinoco_nortel_id_table,
+        .probe          = orinoco_nortel_init_one,
+        .remove         = __devexit_p(orinoco_nortel_remove_one),
+        .suspend        = orinoco_pci_suspend,
+        .resume         = orinoco_pci_resume,
 };
 
 static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
@@ -288,20 +302,19 @@ MODULE_DESCRIPTION
     ("Driver for wireless LAN cards using the Nortel PCI bridge");
 MODULE_LICENSE("Dual MPL/GPL");
 
-static int __init nortel_pci_init(void)
+static int __init orinoco_nortel_init(void)
 {
         printk(KERN_DEBUG "%s\n", version);
-        return pci_module_init(&nortel_pci_driver);
+        return pci_module_init(&orinoco_nortel_driver);
 }
 
-static void __exit nortel_pci_exit(void)
+static void __exit orinoco_nortel_exit(void)
 {
-        pci_unregister_driver(&nortel_pci_driver);
-        ssleep(1);
+        pci_unregister_driver(&orinoco_nortel_driver);
 }
 
-module_init(nortel_pci_init);
-module_exit(nortel_pci_exit);
+module_init(orinoco_nortel_init);
+module_exit(orinoco_nortel_exit);
 
 /*
  * Local variables:
diff --git a/drivers/net/wireless/orinoco_pci.c b/drivers/net/wireless/orinoco_pci.c
index 5362c214fc8..1c105f40f8d 100644
--- a/drivers/net/wireless/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco_pci.c
@@ -1,11 +1,11 @@
 /* orinoco_pci.c
  * 
- * Driver for Prism II devices that have a direct PCI interface
- * (i.e., not in a Pcmcia or PLX bridge)
- *
- * Specifically here we're talking about the Linksys WMP11
+ * Driver for Prism 2.5/3 devices that have a direct PCI interface
+ * (i.e. these are not PCMCIA cards in a PCMCIA-to-PCI bridge).
+ * The card contains only one PCI region, which contains all the usual
+ * hermes registers, as well as the COR register.
  *
- * Current maintainers (as of 29 September 2003) are:
+ * Current maintainers are:
  *      Pavel Roskin <proski AT gnu.org>
  * and  David Gibson <hermes AT gibson.dropbear.id.au>
  *
@@ -41,54 +41,6 @@
  * under either the MPL or the GPL.
  */
 
-/*
- * Theory of operation...
- * -------------------
- * Maybe you had a look in orinoco_plx. Well, this is totally different...
- *
- * The card contains only one PCI region, which contains all the usual
- * hermes registers.
- *
- * The driver will memory map this region in normal memory. Because
- * the hermes registers are mapped in normal memory and not in ISA I/O
- * post space, we can't use the usual inw/outw macros and we need to
- * use readw/writew.
- * This slight difference force us to compile our own version of
- * hermes.c with the register access macro changed. That's a bit
- * hackish but works fine.
- *
- * Note that the PCI region is pretty big (4K). That's much more than
- * the usual set of hermes register (0x0 -> 0x3E). I've got a strong
- * suspicion that the whole memory space of the adapter is in fact in
- * this region. Accessing directly the adapter memory instead of going
- * through the usual register would speed up significantely the
- * operations...
- *
- * Finally, the card looks like this :
------------------------
-  Bus  0, device  14, function  0:
-    Network controller: PCI device 1260:3873 (Harris Semiconductor) (rev 1).
-      IRQ 11.
-      Master Capable.  Latency=248.  
-      Prefetchable 32 bit memory at 0xffbcc000 [0xffbccfff].
------------------------
-00:0e.0 Network controller: Harris Semiconductor: Unknown device 3873 (rev 01)
-        Subsystem: Unknown device 1737:3874
-        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
-        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
-        Latency: 248 set, cache line size 08
-        Interrupt: pin A routed to IRQ 11
-        Region 0: Memory at ffbcc000 (32-bit, prefetchable) [size=4K]
-        Capabilities: [dc] Power Management version 2
-                Flags: PMEClk- AuxPwr- DSI- D1+ D2+ PME+
-                Status: D0 PME-Enable- DSel=0 DScale=0 PME-
------------------------
- *
- * That's all..
- *
- * Jean II
- */
-
 #define DRIVER_NAME "orinoco_pci"
 #define PFX DRIVER_NAME ": "
 
@@ -100,12 +52,14 @@
 #include <linux/pci.h>
 
 #include "orinoco.h"
+#include "orinoco_pci.h"
 
-/* All the magic there is from wlan-ng */
-/* Magic offset of the reset register of the PCI card */
+/* Offset of the COR register of the PCI card */
 #define HERMES_PCI_COR          (0x26)
-/* Magic bitmask to reset the card */
+
+/* Bitmask to reset the card */
 #define HERMES_PCI_COR_MASK     (0x0080)
+
 /* Magic timeouts for doing the reset.
  * Those times are straight from wlan-ng, and it is claimed that they
  * are necessary. Alan will kill me. Take your time and grab a coffee. */
@@ -113,13 +67,8 @@
 #define HERMES_PCI_COR_OFFT     (500)           /* ms */
 #define HERMES_PCI_COR_BUSYT    (500)           /* ms */
 
-/* Orinoco PCI specific data */
-struct orinoco_pci_card {
-        void __iomem *pci_ioaddr;
-};
-
 /*
- * Do a soft reset of the PCI card using the Configuration Option Register
+ * Do a soft reset of the card using the Configuration Option Register
  * We need this to get going...
  * This is the part of the code that is strongly inspired from wlan-ng
  *
@@ -131,14 +80,13 @@ struct orinoco_pci_card {
  * Note bis : Don't try to access HERMES_CMD during the reset phase.
  * It just won't work !
  */
-static int
-orinoco_pci_cor_reset(struct orinoco_private *priv)
+static int orinoco_pci_cor_reset(struct orinoco_private *priv)
 {
         hermes_t *hw = &priv->hw;
-        unsigned long   timeout;
-        u16     reg;
+        unsigned long timeout;
+        u16 reg;
 
-        /* Assert the reset until the card notice */
+        /* Assert the reset until the card notices */
         hermes_write_regn(hw, PCI_COR, HERMES_PCI_COR_MASK);
         mdelay(HERMES_PCI_COR_ONT);
 
@@ -163,19 +111,14 @@ orinoco_pci_cor_reset(struct orinoco_private *priv)
         return 0;
 }
 
-/*
- * Initialise a card. Mostly similar to PLX code.
- */
 static int orinoco_pci_init_one(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
-        int err = 0;
-        unsigned long pci_iorange;
-        u16 __iomem *pci_ioaddr = NULL;
-        unsigned long pci_iolen;
-        struct orinoco_private *priv = NULL;
+        int err;
+        struct orinoco_private *priv;
         struct orinoco_pci_card *card;
-        struct net_device *dev = NULL;
+        struct net_device *dev;
+        void __iomem *hermes_io;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -184,39 +127,32 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
         }
 
         err = pci_request_regions(pdev, DRIVER_NAME);
-        if (err != 0) {
+        if (err) {
                 printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
                 goto fail_resources;
         }
 
-        /* Resource 0 is mapped to the hermes registers */
-        pci_iorange = pci_resource_start(pdev, 0);
-        pci_iolen = pci_resource_len(pdev, 0);
-        pci_ioaddr = ioremap(pci_iorange, pci_iolen);
-        if (!pci_iorange) {
-                printk(KERN_ERR PFX "Cannot remap hardware registers\n");
-                goto fail_map;
+        hermes_io = pci_iomap(pdev, 0, 0);
+        if (!hermes_io) {
+                printk(KERN_ERR PFX "Cannot remap chipset registers\n");
+                err = -EIO;
+                goto fail_map_hermes;
         }
 
         /* Allocate network device */
         dev = alloc_orinocodev(sizeof(*card), orinoco_pci_cor_reset);
-        if (! dev) {
+        if (!dev) {
+                printk(KERN_ERR PFX "Cannot allocate network device\n");
                 err = -ENOMEM;
                 goto fail_alloc;
         }
 
         priv = netdev_priv(dev);
         card = priv->card;
-        card->pci_ioaddr = pci_ioaddr;
-        dev->mem_start = pci_iorange;
-        dev->mem_end = pci_iorange + pci_iolen - 1;
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-        hermes_struct_init(&priv->hw, pci_ioaddr, HERMES_32BIT_REGSPACING);
-
-        printk(KERN_DEBUG PFX "Detected device %s, mem:0x%lx-0x%lx, irq %d\n",
-               pci_name(pdev), dev->mem_start, dev->mem_end, pdev->irq);
+        hermes_struct_init(&priv->hw, hermes_io, HERMES_32BIT_REGSPACING);
 
         err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
                           dev->name, dev);
@@ -225,9 +161,7 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
                 err = -EBUSY;
                 goto fail_irq;
         }
-        dev->irq = pdev->irq;
 
-        /* Perform a COR reset to start the card */
         err = orinoco_pci_cor_reset(priv);
         if (err) {
                 printk(KERN_ERR PFX "Initial reset failed\n");
@@ -236,11 +170,13 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
 
         err = register_netdev(dev);
         if (err) {
-                printk(KERN_ERR PFX "Failed to register net device\n");
+                printk(KERN_ERR PFX "Cannot register network device\n");
                 goto fail;
         }
 
         pci_set_drvdata(pdev, dev);
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s\n", dev->name,
+               pci_name(pdev));
 
         return 0;
 
@@ -252,9 +188,9 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
         free_orinocodev(dev);
 
  fail_alloc:
-        iounmap(pci_ioaddr);
+        pci_iounmap(pdev, hermes_io);
 
- fail_map:
+ fail_map_hermes:
         pci_release_regions(pdev);
 
  fail_resources:
@@ -267,87 +203,17 @@ static void __devexit orinoco_pci_remove_one(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct orinoco_private *priv = netdev_priv(dev);
-        struct orinoco_pci_card *card = priv->card;
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
+        free_irq(pdev->irq, dev);
         pci_set_drvdata(pdev, NULL);
         free_orinocodev(dev);
-        iounmap(card->pci_ioaddr);
+        pci_iounmap(pdev, priv->hw.iobase);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 }
 
-static int orinoco_pci_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        struct orinoco_private *priv = netdev_priv(dev);
-        unsigned long flags;
-        int err;
-        
-
-        err = orinoco_lock(priv, &flags);
-        if (err) {
-                printk(KERN_ERR "%s: hw_unavailable on orinoco_pci_suspend\n",
-                       dev->name);
-                return err;
-        }
-
-        err = __orinoco_down(dev);
-        if (err)
-                printk(KERN_WARNING "%s: orinoco_pci_suspend(): Error %d downing interface\n",
-                       dev->name, err);
-        
-        netif_device_detach(dev);
-
-        priv->hw_unavailable++;
-        
-        orinoco_unlock(priv, &flags);
-
-        pci_save_state(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-
-        return 0;
-}
-
-static int orinoco_pci_resume(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        struct orinoco_private *priv = netdev_priv(dev);
-        unsigned long flags;
-        int err;
-
-        printk(KERN_DEBUG "%s: Orinoco-PCI waking up\n", dev->name);
-
-        pci_set_power_state(pdev, 0);
-        pci_restore_state(pdev);
-
-        err = orinoco_reinit_firmware(dev);
-        if (err) {
-                printk(KERN_ERR "%s: Error %d re-initializing firmware on orinoco_pci_resume()\n",
-                       dev->name, err);
-                return err;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        netif_device_attach(dev);
-
-        priv->hw_unavailable--;
-
-        if (priv->open && (! priv->hw_unavailable)) {
-                err = __orinoco_up(dev);
-                if (err)
-                        printk(KERN_ERR "%s: Error %d restarting card on orinoco_pci_resume()\n",
-                               dev->name, err);
-        }
-        
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-
-static struct pci_device_id orinoco_pci_pci_id_table[] = {
+static struct pci_device_id orinoco_pci_id_table[] = {
         /* Intersil Prism 3 */
         {0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID,},
         /* Intersil Prism 2.5 */
@@ -357,11 +223,11 @@ static struct pci_device_id orinoco_pci_pci_id_table[] = {
         {0,},
 };
 
-MODULE_DEVICE_TABLE(pci, orinoco_pci_pci_id_table);
+MODULE_DEVICE_TABLE(pci, orinoco_pci_id_table);
 
 static struct pci_driver orinoco_pci_driver = {
         .name           = DRIVER_NAME,
-        .id_table       = orinoco_pci_pci_id_table,
+        .id_table       = orinoco_pci_id_table,
         .probe          = orinoco_pci_init_one,
         .remove         = __devexit_p(orinoco_pci_remove_one),
         .suspend        = orinoco_pci_suspend,
diff --git a/drivers/net/wireless/orinoco_pci.h b/drivers/net/wireless/orinoco_pci.h
new file mode 100644
index 00000000000..7eb1e08113e
--- /dev/null
+++ b/drivers/net/wireless/orinoco_pci.h
@@ -0,0 +1,104 @@
+/* orinoco_pci.h
+ * 
+ * Common code for all Orinoco drivers for PCI devices, including
+ * both native PCI and PCMCIA-to-PCI bridges.
+ *
+ * Copyright (C) 2005, Pavel Roskin.
+ * See orinoco.c for license.
+ */
+
+#ifndef _ORINOCO_PCI_H
+#define _ORINOCO_PCI_H
+
+#include <linux/netdevice.h>
+
+/* Driver specific data */
+struct orinoco_pci_card {
+        void __iomem *bridge_io;
+        void __iomem *attr_io;
+};
+
+#ifdef CONFIG_PM
+static int orinoco_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct orinoco_private *priv = netdev_priv(dev);
+        unsigned long flags;
+        int err;
+
+        err = orinoco_lock(priv, &flags);
+        if (err) {
+                printk(KERN_ERR "%s: cannot lock hardware for suspend\n",
+                       dev->name);
+                return err;
+        }
+
+        err = __orinoco_down(dev);
+        if (err)
+                printk(KERN_WARNING "%s: error %d bringing interface down "
+                       "for suspend\n", dev->name, err);
+        
+        netif_device_detach(dev);
+
+        priv->hw_unavailable++;
+        
+        orinoco_unlock(priv, &flags);
+
+        free_irq(pdev->irq, dev);
+        pci_save_state(pdev);
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+
+        return 0;
+}
+
+static int orinoco_pci_resume(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct orinoco_private *priv = netdev_priv(dev);
+        unsigned long flags;
+        int err;
+
+        pci_set_power_state(pdev, 0);
+        pci_enable_device(pdev);
+        pci_restore_state(pdev);
+
+        err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
+                          dev->name, dev);
+        if (err) {
+                printk(KERN_ERR "%s: cannot re-allocate IRQ on resume\n",
+                       dev->name);
+                pci_disable_device(pdev);
+                return -EBUSY;
+        }
+
+        err = orinoco_reinit_firmware(dev);
+        if (err) {
+                printk(KERN_ERR "%s: error %d re-initializing firmware "
+                       "on resume\n", dev->name, err);
+                return err;
+        }
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        netif_device_attach(dev);
+
+        priv->hw_unavailable--;
+
+        if (priv->open && (! priv->hw_unavailable)) {
+                err = __orinoco_up(dev);
+                if (err)
+                        printk(KERN_ERR "%s: Error %d restarting card on resume\n",
+                               dev->name, err);
+        }
+        
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+#else
+#define orinoco_pci_suspend NULL
+#define orinoco_pci_resume NULL
+#endif
+
+#endif /* _ORINOCO_PCI_H */
diff --git a/drivers/net/wireless/orinoco_plx.c b/drivers/net/wireless/orinoco_plx.c
index 210e7377654..84f696c7755 100644
--- a/drivers/net/wireless/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco_plx.c
@@ -3,7 +3,7 @@
  * Driver for Prism II devices which would usually be driven by orinoco_cs,
  * but are connected to the PCI bus by a PLX9052.
  *
- * Current maintainers (as of 29 September 2003) are:
+ * Current maintainers are:
  *      Pavel Roskin <proski AT gnu.org>
  * and  David Gibson <hermes AT gibson.dropbear.id.au>
  *
@@ -30,38 +30,18 @@
  * other provisions required by the GPL.  If you do not delete the
  * provisions above, a recipient may use your version of this file
  * under either the MPL or the GPL.
-
- * Caution: this is experimental and probably buggy.  For success and
- * failure reports for different cards and adaptors, see
- * orinoco_plx_pci_id_table near the end of the file.  If you have a
- * card we don't have the PCI id for, and looks like it should work,
- * drop me mail with the id and "it works"/"it doesn't work".
- *
- * Note: if everything gets detected fine but it doesn't actually send
- * or receive packets, your first port of call should probably be to
- * try newer firmware in the card.  Especially if you're doing Ad-Hoc
- * modes.
- *
- * The actual driving is done by orinoco.c, this is just resource
- * allocation stuff.  The explanation below is courtesy of Ryan Niemi
- * on the linux-wlan-ng list at
- * http://archives.neohapsis.com/archives/dev/linux-wlan/2001-q1/0026.html
  *
- * The PLX9052-based cards (WL11000 and several others) are a
- * different beast than the usual PCMCIA-based PRISM2 configuration
- * expected by wlan-ng.  Here's the general details on how the WL11000
- * PCI adapter works:
+ * Here's the general details on how the PLX9052 adapter works:
  *
  * - Two PCI I/O address spaces, one 0x80 long which contains the
  * PLX9052 registers, and one that's 0x40 long mapped to the PCMCIA
  * slot I/O address space.
  *
- * - One PCI memory address space, mapped to the PCMCIA memory space
+ * - One PCI memory address space, mapped to the PCMCIA attribute space
  * (containing the CIS).
  *
- * After identifying the I/O and memory space, you can read through
- * the memory space to confirm the CIS's device ID or manufacturer ID
- * to make sure it's the expected card.  qKeep in mind that the PCMCIA
+ * Using the later, you can read through the CIS data to make sure the
+ * card is compatible with the driver. Keep in mind that the PCMCIA
  * spec specifies the CIS as the lower 8 bits of each word read from
  * the CIS, so to read the bytes of the CIS, read every other byte
  * (0,2,4,...). Passing that test, you need to enable the I/O address
@@ -71,7 +51,7 @@
  * within the PCI memory space. Write 0x41 to the COR register to
  * enable I/O mode and to select level triggered interrupts. To
  * confirm you actually succeeded, read the COR register back and make
- * sure it actually got set to 0x41, incase you have an unexpected
+ * sure it actually got set to 0x41, in case you have an unexpected
  * card inserted.
  *
  * Following that, you can treat the second PCI I/O address space (the
@@ -101,16 +81,6 @@
  * that, I've hot-swapped a number of times during debugging and
  * driver development for various reasons (stuck WAIT# line after the
  * radio card's firmware locks up).
- *
- * Hope this is enough info for someone to add PLX9052 support to the
- * wlan-ng card. In the case of the WL11000, the PCI ID's are
- * 0x1639/0x0200, with matching subsystem ID's. Other PLX9052-based
- * manufacturers other than Eumitcom (or on cards other than the
- * WL11000) may have different PCI ID's.
- *
- * If anyone needs any more specific info, let me know. I haven't had
- * time to implement support myself yet, and with the way things are
- * going, might not have time for a while..
  */
 
 #define DRIVER_NAME "orinoco_plx"
@@ -125,6 +95,7 @@
 #include <pcmcia/cisreg.h>
 
 #include "orinoco.h"
+#include "orinoco_pci.h"
 
 #define COR_OFFSET      (0x3e0) /* COR attribute offset of Prism2 PC card */
 #define COR_VALUE       (COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */
@@ -134,30 +105,20 @@
 #define PLX_INTCSR              0x4c /* Interrupt Control & Status Register */
 #define PLX_INTCSR_INTEN        (1<<6) /* Interrupt Enable bit */
 
-static const u8 cis_magic[] = {
-        0x01, 0x03, 0x00, 0x00, 0xff, 0x17, 0x04, 0x67
-};
-
-/* Orinoco PLX specific data */
-struct orinoco_plx_card {
-        void __iomem *attr_mem;
-};
-
 /*
  * Do a soft reset of the card using the Configuration Option Register
  */
 static int orinoco_plx_cor_reset(struct orinoco_private *priv)
 {
         hermes_t *hw = &priv->hw;
-        struct orinoco_plx_card *card = priv->card;
-        u8 __iomem *attr_mem = card->attr_mem;
+        struct orinoco_pci_card *card = priv->card;
         unsigned long timeout;
         u16 reg;
 
-        writeb(COR_VALUE | COR_RESET, attr_mem + COR_OFFSET);
+        iowrite8(COR_VALUE | COR_RESET, card->attr_io + COR_OFFSET);
         mdelay(1);
 
-        writeb(COR_VALUE, attr_mem + COR_OFFSET);
+        iowrite8(COR_VALUE, card->attr_io + COR_OFFSET);
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
@@ -168,7 +129,7 @@ static int orinoco_plx_cor_reset(struct orinoco_private *priv)
                 reg = hermes_read_regn(hw, CMD);
         }
 
-        /* Did we timeout ? */
+        /* Still busy? */
         if (reg & HERMES_CMD_BUSY) {
                 printk(KERN_ERR PFX "Busy timeout\n");
                 return -ETIMEDOUT;
@@ -177,20 +138,55 @@ static int orinoco_plx_cor_reset(struct orinoco_private *priv)
         return 0;
 }
 
+static int orinoco_plx_hw_init(struct orinoco_pci_card *card)
+{
+        int i;
+        u32 csr_reg;
+        static const u8 cis_magic[] = {
+                0x01, 0x03, 0x00, 0x00, 0xff, 0x17, 0x04, 0x67
+        };
+
+        printk(KERN_DEBUG PFX "CIS: ");
+        for (i = 0; i < 16; i++) {
+                printk("%02X:", ioread8(card->attr_io + (i << 1)));
+        }
+        printk("\n");
+
+        /* Verify whether a supported PC card is present */
+        /* FIXME: we probably need to be smarted about this */
+        for (i = 0; i < sizeof(cis_magic); i++) {
+                if (cis_magic[i] != ioread8(card->attr_io + (i << 1))) {
+                        printk(KERN_ERR PFX "The CIS value of Prism2 PC "
+                               "card is unexpected\n");
+                        return -ENODEV;
+                }
+        }
+
+        /* bjoern: We need to tell the card to enable interrupts, in
+           case the serial eprom didn't do this already.  See the
+           PLX9052 data book, p8-1 and 8-24 for reference. */
+        csr_reg = ioread32(card->bridge_io + PLX_INTCSR);
+        if (!(csr_reg & PLX_INTCSR_INTEN)) {
+                csr_reg |= PLX_INTCSR_INTEN;
+                iowrite32(csr_reg, card->bridge_io + PLX_INTCSR);
+                csr_reg = ioread32(card->bridge_io + PLX_INTCSR);
+                if (!(csr_reg & PLX_INTCSR_INTEN)) {
+                        printk(KERN_ERR PFX "Cannot enable interrupts\n");
+                        return -EIO;
+                }
+        }
+
+        return 0;
+}
 
 static int orinoco_plx_init_one(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
-        int err = 0;
-        u8 __iomem *attr_mem = NULL;
-        u32 csr_reg, plx_addr;
-        struct orinoco_private *priv = NULL;
-        struct orinoco_plx_card *card;
-        unsigned long pccard_ioaddr = 0;
-        unsigned long pccard_iolen = 0;
-        struct net_device *dev = NULL;
-        void __iomem *mem;
-        int i;
+        int err;
+        struct orinoco_private *priv;
+        struct orinoco_pci_card *card;
+        struct net_device *dev;
+        void __iomem *hermes_io, *attr_io, *bridge_io;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -199,30 +195,30 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
         }
 
         err = pci_request_regions(pdev, DRIVER_NAME);
-        if (err != 0) {
+        if (err) {
                 printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
                 goto fail_resources;
         }
 
-        /* Resource 1 is mapped to PLX-specific registers */
-        plx_addr = pci_resource_start(pdev, 1);
+        bridge_io = pci_iomap(pdev, 1, 0);
+        if (!bridge_io) {
+                printk(KERN_ERR PFX "Cannot map bridge registers\n");
+                err = -EIO;
+                goto fail_map_bridge;
+        }
 
-        /* Resource 2 is mapped to the PCMCIA attribute memory */
-        attr_mem = ioremap(pci_resource_start(pdev, 2),
-                           pci_resource_len(pdev, 2));
-        if (!attr_mem) {
-                printk(KERN_ERR PFX "Cannot remap PCMCIA space\n");
+        attr_io = pci_iomap(pdev, 2, 0);
+        if (!attr_io) {
+                printk(KERN_ERR PFX "Cannot map PCMCIA attributes\n");
+                err = -EIO;
                 goto fail_map_attr;
         }
 
-        /* Resource 3 is mapped to the PCMCIA I/O address space */
-        pccard_ioaddr = pci_resource_start(pdev, 3);
-        pccard_iolen = pci_resource_len(pdev, 3);
-
-        mem = pci_iomap(pdev, 3, 0);
-        if (!mem) {
-                err = -ENOMEM;
-                goto fail_map_io;
+        hermes_io = pci_iomap(pdev, 3, 0);
+        if (!hermes_io) {
+                printk(KERN_ERR PFX "Cannot map chipset registers\n");
+                err = -EIO;
+                goto fail_map_hermes;
         }
 
         /* Allocate network device */
@@ -235,16 +231,12 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
 
         priv = netdev_priv(dev);
         card = priv->card;
-        card->attr_mem = attr_mem;
-        dev->base_addr = pccard_ioaddr;
+        card->bridge_io = bridge_io;
+        card->attr_io = attr_io;
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-        hermes_struct_init(&priv->hw, mem, HERMES_16BIT_REGSPACING);
-
-        printk(KERN_DEBUG PFX "Detected Orinoco/Prism2 PLX device "
-               "at %s irq:%d, io addr:0x%lx\n", pci_name(pdev), pdev->irq,
-               pccard_ioaddr);
+        hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING);
 
         err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
                           dev->name, dev);
@@ -253,20 +245,11 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
                 err = -EBUSY;
                 goto fail_irq;
         }
-        dev->irq = pdev->irq;
 
-        /* bjoern: We need to tell the card to enable interrupts, in
-           case the serial eprom didn't do this already.  See the
-           PLX9052 data book, p8-1 and 8-24 for reference. */
-        csr_reg = inl(plx_addr + PLX_INTCSR);
-        if (!(csr_reg & PLX_INTCSR_INTEN)) {
-                csr_reg |= PLX_INTCSR_INTEN;
-                outl(csr_reg, plx_addr + PLX_INTCSR);
-                csr_reg = inl(plx_addr + PLX_INTCSR);
-                if (!(csr_reg & PLX_INTCSR_INTEN)) {
-                        printk(KERN_ERR PFX "Cannot enable interrupts\n");
-                        goto fail;
-                }
+        err = orinoco_plx_hw_init(card);
+        if (err) {
+                printk(KERN_ERR PFX "Hardware initialization failed\n");
+                goto fail;
         }
 
         err = orinoco_plx_cor_reset(priv);
@@ -275,23 +258,6 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
                 goto fail;
         }
 
-        printk(KERN_DEBUG PFX "CIS: ");
-        for (i = 0; i < 16; i++) {
-                printk("%02X:", readb(attr_mem + 2*i));
-        }
-        printk("\n");
-
-        /* Verify whether a supported PC card is present */
-        /* FIXME: we probably need to be smarted about this */
-        for (i = 0; i < sizeof(cis_magic); i++) {
-                if (cis_magic[i] != readb(attr_mem +2*i)) {
-                        printk(KERN_ERR PFX "The CIS value of Prism2 PC "
-                               "card is unexpected\n");
-                        err = -EIO;
-                        goto fail;
-                }
-        }
-
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR PFX "Cannot register network device\n");
@@ -299,6 +265,8 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
         }
 
         pci_set_drvdata(pdev, dev);
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s\n", dev->name,
+               pci_name(pdev));
 
         return 0;
 
@@ -310,12 +278,15 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
         free_orinocodev(dev);
 
  fail_alloc:
-        pci_iounmap(pdev, mem);
+        pci_iounmap(pdev, hermes_io);
 
- fail_map_io:
-        iounmap(attr_mem);
+ fail_map_hermes:
+        pci_iounmap(pdev, attr_io);
 
  fail_map_attr:
+        pci_iounmap(pdev, bridge_io);
+
+ fail_map_bridge:
         pci_release_regions(pdev);
 
  fail_resources:
@@ -328,23 +299,20 @@ static void __devexit orinoco_plx_remove_one(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct orinoco_private *priv = netdev_priv(dev);
-        struct orinoco_plx_card *card = priv->card;
-        u8 __iomem *attr_mem = card->attr_mem;
-
-        BUG_ON(! dev);
+        struct orinoco_pci_card *card = priv->card;
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
+        free_irq(pdev->irq, dev);
         pci_set_drvdata(pdev, NULL);
         free_orinocodev(dev);
         pci_iounmap(pdev, priv->hw.iobase);
-        iounmap(attr_mem);
+        pci_iounmap(pdev, card->attr_io);
+        pci_iounmap(pdev, card->bridge_io);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 }
 
-
-static struct pci_device_id orinoco_plx_pci_id_table[] = {
+static struct pci_device_id orinoco_plx_id_table[] = {
         {0x111a, 0x1023, PCI_ANY_ID, PCI_ANY_ID,},      /* Siemens SpeedStream SS1023 */
         {0x1385, 0x4100, PCI_ANY_ID, PCI_ANY_ID,},      /* Netgear MA301 */
         {0x15e8, 0x0130, PCI_ANY_ID, PCI_ANY_ID,},      /* Correga  - does this work? */
@@ -362,13 +330,15 @@ static struct pci_device_id orinoco_plx_pci_id_table[] = {
         {0,},
 };
 
-MODULE_DEVICE_TABLE(pci, orinoco_plx_pci_id_table);
+MODULE_DEVICE_TABLE(pci, orinoco_plx_id_table);
 
 static struct pci_driver orinoco_plx_driver = {
         .name           = DRIVER_NAME,
-        .id_table       = orinoco_plx_pci_id_table,
+        .id_table       = orinoco_plx_id_table,
         .probe          = orinoco_plx_init_one,
         .remove         = __devexit_p(orinoco_plx_remove_one),
+        .suspend        = orinoco_pci_suspend,
+        .resume         = orinoco_pci_resume,
 };
 
 static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
@@ -388,7 +358,6 @@ static int __init orinoco_plx_init(void)
 static void __exit orinoco_plx_exit(void)
 {
         pci_unregister_driver(&orinoco_plx_driver);
-        ssleep(1);
 }
 
 module_init(orinoco_plx_init);
diff --git a/drivers/net/wireless/orinoco_tmd.c b/drivers/net/wireless/orinoco_tmd.c
index 5e68b702618..d2b4decb7a7 100644
--- a/drivers/net/wireless/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco_tmd.c
@@ -1,5 +1,5 @@
 /* orinoco_tmd.c
- * 
+ *
  * Driver for Prism II devices which would usually be driven by orinoco_cs,
  * but are connected to the PCI bus by a TMD7160. 
  *
@@ -26,25 +26,13 @@
  * other provisions required by the GPL.  If you do not delete the
  * provisions above, a recipient may use your version of this file
  * under either the MPL or the GPL.
-
- * Caution: this is experimental and probably buggy.  For success and
- * failure reports for different cards and adaptors, see
- * orinoco_tmd_pci_id_table near the end of the file.  If you have a
- * card we don't have the PCI id for, and looks like it should work,
- * drop me mail with the id and "it works"/"it doesn't work".
- *
- * Note: if everything gets detected fine but it doesn't actually send
- * or receive packets, your first port of call should probably be to   
- * try newer firmware in the card.  Especially if you're doing Ad-Hoc
- * modes
  *
  * The actual driving is done by orinoco.c, this is just resource
  * allocation stuff.
  *
  * This driver is modeled after the orinoco_plx driver. The main
- * difference is that the TMD chip has only IO port ranges and no
- * memory space, i.e.  no access to the CIS. Compared to the PLX chip,
- * the io range functionalities are exchanged.
+ * difference is that the TMD chip has only IO port ranges and doesn't
+ * provide access to the PCMCIA attribute space.
  *
  * Pheecom sells cards with the TMD chip as "ASIC version"
  */
@@ -61,32 +49,26 @@
 #include <pcmcia/cisreg.h>
 
 #include "orinoco.h"
+#include "orinoco_pci.h"
 
 #define COR_VALUE       (COR_LEVEL_REQ | COR_FUNC_ENA) /* Enable PC card with interrupt in level trigger */
 #define COR_RESET     (0x80)    /* reset bit in the COR register */
 #define TMD_RESET_TIME  (500)   /* milliseconds */
 
-/* Orinoco TMD specific data */
-struct orinoco_tmd_card {
-        u32 tmd_io;
-};
-
-
 /*
  * Do a soft reset of the card using the Configuration Option Register
  */
 static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
 {
         hermes_t *hw = &priv->hw;
-        struct orinoco_tmd_card *card = priv->card;
-        u32 addr = card->tmd_io;
+        struct orinoco_pci_card *card = priv->card;
         unsigned long timeout;
         u16 reg;
 
-        outb(COR_VALUE | COR_RESET, addr);
+        iowrite8(COR_VALUE | COR_RESET, card->bridge_io);
         mdelay(1);
 
-        outb(COR_VALUE, addr);
+        iowrite8(COR_VALUE, card->bridge_io);
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
@@ -97,7 +79,7 @@ static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
                 reg = hermes_read_regn(hw, CMD);
         }
 
-        /* Did we timeout ? */
+        /* Still busy? */
         if (reg & HERMES_CMD_BUSY) {
                 printk(KERN_ERR PFX "Busy timeout\n");
                 return -ETIMEDOUT;
@@ -110,11 +92,11 @@ static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
 static int orinoco_tmd_init_one(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
-        int err = 0;
-        struct orinoco_private *priv = NULL;
-        struct orinoco_tmd_card *card;
-        struct net_device *dev = NULL;
-        void __iomem *mem;
+        int err;
+        struct orinoco_private *priv;
+        struct orinoco_pci_card *card;
+        struct net_device *dev;
+        void __iomem *hermes_io, *bridge_io;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -123,20 +105,28 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
         }
 
         err = pci_request_regions(pdev, DRIVER_NAME);
-        if (err != 0) {
+        if (err) {
                 printk(KERN_ERR PFX "Cannot obtain PCI resources\n");
                 goto fail_resources;
         }
 
-        mem = pci_iomap(pdev, 2, 0);
-        if (! mem) {
-                err = -ENOMEM;
-                goto fail_iomap;
+        bridge_io = pci_iomap(pdev, 1, 0);
+        if (!bridge_io) {
+                printk(KERN_ERR PFX "Cannot map bridge registers\n");
+                err = -EIO;
+                goto fail_map_bridge;
+        }
+
+        hermes_io = pci_iomap(pdev, 2, 0);
+        if (!hermes_io) {
+                printk(KERN_ERR PFX "Cannot map chipset registers\n");
+                err = -EIO;
+                goto fail_map_hermes;
         }
 
         /* Allocate network device */
         dev = alloc_orinocodev(sizeof(*card), orinoco_tmd_cor_reset);
-        if (! dev) {
+        if (!dev) {
                 printk(KERN_ERR PFX "Cannot allocate network device\n");
                 err = -ENOMEM;
                 goto fail_alloc;
@@ -144,16 +134,11 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
 
         priv = netdev_priv(dev);
         card = priv->card;
-        card->tmd_io = pci_resource_start(pdev, 1);
-        dev->base_addr = pci_resource_start(pdev, 2);
+        card->bridge_io = bridge_io;
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-        hermes_struct_init(&priv->hw, mem, HERMES_16BIT_REGSPACING);
-
-        printk(KERN_DEBUG PFX "Detected Orinoco/Prism2 TMD device "
-               "at %s irq:%d, io addr:0x%lx\n", pci_name(pdev), pdev->irq,
-               dev->base_addr);
+        hermes_struct_init(&priv->hw, hermes_io, HERMES_16BIT_REGSPACING);
 
         err = request_irq(pdev->irq, orinoco_interrupt, SA_SHIRQ,
                           dev->name, dev);
@@ -162,7 +147,6 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
                 err = -EBUSY;
                 goto fail_irq;
         }
-        dev->irq = pdev->irq;
 
         err = orinoco_tmd_cor_reset(priv);
         if (err) {
@@ -177,6 +161,8 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
         }
 
         pci_set_drvdata(pdev, dev);
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s\n", dev->name,
+               pci_name(pdev));
 
         return 0;
 
@@ -188,9 +174,12 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
         free_orinocodev(dev);
 
  fail_alloc:
-        pci_iounmap(pdev, mem);
+        pci_iounmap(pdev, hermes_io);
+
+ fail_map_hermes:
+        pci_iounmap(pdev, bridge_io);
 
- fail_iomap:
+ fail_map_bridge:
         pci_release_regions(pdev);
 
  fail_resources:
@@ -203,31 +192,32 @@ static void __devexit orinoco_tmd_remove_one(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct orinoco_private *priv = dev->priv;
-
-        BUG_ON(! dev);
+        struct orinoco_pci_card *card = priv->card;
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
+        free_irq(pdev->irq, dev);
         pci_set_drvdata(pdev, NULL);
         free_orinocodev(dev);
         pci_iounmap(pdev, priv->hw.iobase);
+        pci_iounmap(pdev, card->bridge_io);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 }
 
-
-static struct pci_device_id orinoco_tmd_pci_id_table[] = {
+static struct pci_device_id orinoco_tmd_id_table[] = {
         {0x15e8, 0x0131, PCI_ANY_ID, PCI_ANY_ID,},      /* NDC and OEMs, e.g. pheecom */
         {0,},
 };
 
-MODULE_DEVICE_TABLE(pci, orinoco_tmd_pci_id_table);
+MODULE_DEVICE_TABLE(pci, orinoco_tmd_id_table);
 
 static struct pci_driver orinoco_tmd_driver = {
         .name           = DRIVER_NAME,
-        .id_table       = orinoco_tmd_pci_id_table,
+        .id_table       = orinoco_tmd_id_table,
         .probe          = orinoco_tmd_init_one,
         .remove         = __devexit_p(orinoco_tmd_remove_one),
+        .suspend        = orinoco_pci_suspend,
+        .resume         = orinoco_pci_resume,
 };
 
 static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
@@ -245,7 +235,6 @@ static int __init orinoco_tmd_init(void)
 static void __exit orinoco_tmd_exit(void)
 {
         pci_unregister_driver(&orinoco_tmd_driver);
-        ssleep(1);
 }
 
 module_init(orinoco_tmd_init);
diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c
index f7b77ce54d7..7f9aa139c34 100644
--- a/drivers/net/wireless/spectrum_cs.c
+++ b/drivers/net/wireless/spectrum_cs.c
@@ -1,6 +1,6 @@
 /*
  * Driver for 802.11b cards using RAM-loadable Symbol firmware, such as
- * Symbol Wireless Networker LA4100, CompactFlash cards by Socket
+ * Symbol Wireless Networker LA4137, CompactFlash cards by Socket
  * Communications and Intel PRO/Wireless 2011B.
  *
  * The driver implements Symbol firmware download.  The rest is handled
@@ -120,8 +120,8 @@ static void spectrum_cs_release(struct pcmcia_device *link);
  * Each block has the following structure.
  */
 struct dblock {
-        __le32 _addr;           /* adapter address where to write the block */
-        __le16 _len;            /* length of the data only, in bytes */
+        __le32 addr;            /* adapter address where to write the block */
+        __le16 len;             /* length of the data only, in bytes */
         char data[0];           /* data to be written */
 } __attribute__ ((packed));
 
@@ -131,9 +131,9 @@ struct dblock {
  * items with matching ID should be written.
  */
 struct pdr {
-        __le32 _id;             /* record ID */
-        __le32 _addr;           /* adapter address where to write the data */
-        __le32 _len;            /* expected length of the data, in bytes */
+        __le32 id;              /* record ID */
+        __le32 addr;            /* adapter address where to write the data */
+        __le32 len;             /* expected length of the data, in bytes */
         char next[0];           /* next PDR starts here */
 } __attribute__ ((packed));
 
@@ -144,8 +144,8 @@ struct pdr {
  * be plugged into the secondary firmware.
  */
 struct pdi {
-        __le16 _len;            /* length of ID and data, in words */
-        __le16 _id;             /* record ID */
+        __le16 len;             /* length of ID and data, in words */
+        __le16 id;              /* record ID */
         char data[0];           /* plug data */
 } __attribute__ ((packed));
 
@@ -154,44 +154,44 @@ struct pdi {
 static inline u32
 dblock_addr(const struct dblock *blk)
 {
-        return le32_to_cpu(blk->_addr);
+        return le32_to_cpu(blk->addr);
 }
 
 static inline u32
 dblock_len(const struct dblock *blk)
 {
-        return le16_to_cpu(blk->_len);
+        return le16_to_cpu(blk->len);
 }
 
 static inline u32
 pdr_id(const struct pdr *pdr)
 {
-        return le32_to_cpu(pdr->_id);
+        return le32_to_cpu(pdr->id);
 }
 
 static inline u32
 pdr_addr(const struct pdr *pdr)
 {
-        return le32_to_cpu(pdr->_addr);
+        return le32_to_cpu(pdr->addr);
 }
 
 static inline u32
 pdr_len(const struct pdr *pdr)
 {
-        return le32_to_cpu(pdr->_len);
+        return le32_to_cpu(pdr->len);
 }
 
 static inline u32
 pdi_id(const struct pdi *pdi)
 {
-        return le16_to_cpu(pdi->_id);
+        return le16_to_cpu(pdi->id);
 }
 
 /* Return length of the data only, in bytes */
 static inline u32
 pdi_len(const struct pdi *pdi)
 {
-        return 2 * (le16_to_cpu(pdi->_len) - 1);
+        return 2 * (le16_to_cpu(pdi->len) - 1);
 }
 
 
@@ -343,8 +343,7 @@ spectrum_plug_pdi(hermes_t *hw, struct pdr *first_pdr, struct pdi *pdi)
 
         /* do the actual plugging */
         spectrum_aux_setaddr(hw, pdr_addr(pdr));
-        hermes_write_words(hw, HERMES_AUXDATA, pdi->data,
-                           pdi_len(pdi) / 2);
+        hermes_write_bytes(hw, HERMES_AUXDATA, pdi->data, pdi_len(pdi));
 
         return 0;
 }
@@ -424,8 +423,8 @@ spectrum_load_blocks(hermes_t *hw, const struct dblock *first_block)
 
         while (dblock_addr(blk) != BLOCK_END) {
                 spectrum_aux_setaddr(hw, blkaddr);
-                hermes_write_words(hw, HERMES_AUXDATA, blk->data,
-                                   blklen / 2);
+                hermes_write_bytes(hw, HERMES_AUXDATA, blk->data,
+                                   blklen);
 
                 blk = (struct dblock *) &blk->data[blklen];
                 blkaddr = dblock_addr(blk);
@@ -626,14 +625,11 @@ static void spectrum_cs_detach(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
 
+        if (link->dev_node)
+                unregister_netdev(dev);
+
         spectrum_cs_release(link);
 
-        DEBUG(0, PFX "detach: link=%p link->dev_node=%p\n", link, link->dev_node);
-        if (link->dev_node) {
-                DEBUG(0, PFX "About to unregister net device %p\n",
-                      dev);
-                unregister_netdev(dev);
-        }
         free_orinocodev(dev);
 }                               /* spectrum_cs_detach */
 
@@ -653,13 +649,10 @@ spectrum_cs_config(struct pcmcia_device *link)
         int last_fn, last_ret;
         u_char buf[64];
         config_info_t conf;
-        cisinfo_t info;
         tuple_t tuple;
         cisparse_t parse;
         void __iomem *mem;
 
-        CS_CHECK(ValidateCIS, pcmcia_validate_cis(link, &info));
-
         /*
          * This reads the card's CONFIG tuple to find its
          * configuration registers.
@@ -709,12 +702,6 @@ spectrum_cs_config(struct pcmcia_device *link)
                         goto next_entry;
                 link->conf.ConfigIndex = cfg->index;
 
-                /* Does this card need audio output? */
-                if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
-                        link->conf.Attributes |= CONF_ENABLE_SPKR;
-                        link->conf.Status = CCSR_AUDIO_ENA;
-                }
-
                 /* Use power settings for Vcc and Vpp if present */
                 /* Note that the CIS values need to be rescaled */
                 if (cfg->vcc.present & (1 << CISTPL_POWER_VNOM)) {
@@ -835,19 +822,10 @@ spectrum_cs_config(struct pcmcia_device *link)
                                     net_device has been registered */
 
         /* Finally, report what we've done */
-        printk(KERN_DEBUG "%s: index 0x%02x: ",
-               dev->name, link->conf.ConfigIndex);
-        if (link->conf.Vpp)
-                printk(", Vpp %d.%d", link->conf.Vpp / 10,
-                       link->conf.Vpp % 10);
-        printk(", irq %d", link->irq.AssignedIRQ);
-        if (link->io.NumPorts1)
-                printk(", io 0x%04x-0x%04x", link->io.BasePort1,
-                       link->io.BasePort1 + link->io.NumPorts1 - 1);
-        if (link->io.NumPorts2)
-                printk(" & 0x%04x-0x%04x", link->io.BasePort2,
-                       link->io.BasePort2 + link->io.NumPorts2 - 1);
-        printk("\n");
+        printk(KERN_DEBUG "%s: " DRIVER_NAME " at %s, irq %d, io "
+               "0x%04x-0x%04x\n", dev->name, dev->class_dev.dev->bus_id,
+               link->irq.AssignedIRQ, link->io.BasePort1,
+               link->io.BasePort1 + link->io.NumPorts1 - 1);
 
         return 0;
 
@@ -888,11 +866,10 @@ spectrum_cs_suspend(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
-        unsigned long flags;
         int err = 0;
 
         /* Mark the device as stopped, to block IO until later */
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock(&priv->lock);
 
         err = __orinoco_down(dev);
         if (err)
@@ -902,9 +879,9 @@ spectrum_cs_suspend(struct pcmcia_device *link)
         netif_device_detach(dev);
         priv->hw_unavailable++;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->lock);
 
-        return 0;
+        return err;
 }
 
 static int
@@ -932,7 +909,7 @@ static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
         " David Gibson <hermes@gibson.dropbear.id.au>, et al)";
 
 static struct pcmcia_device_id spectrum_cs_ids[] = {
-        PCMCIA_DEVICE_MANF_CARD(0x026c, 0x0001), /* Symbol Spectrum24 LA4100 */
+        PCMCIA_DEVICE_MANF_CARD(0x026c, 0x0001), /* Symbol Spectrum24 LA4137 */
         PCMCIA_DEVICE_MANF_CARD(0x0104, 0x0001), /* Socket Communications CF */
         PCMCIA_DEVICE_PROD_ID12("Intel", "PRO/Wireless LAN PC Card", 0x816cc815, 0x6fbf459a), /* 2011B, not 2011 */
         PCMCIA_DEVICE_NULL,
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
new file mode 100644
index 00000000000..662ecc8a33f
--- /dev/null
+++ b/drivers/net/wireless/zd1201.c
@@ -0,0 +1,1929 @@
+/*
+ *      Driver for ZyDAS zd1201 based wireless USB devices.
+ *
+ *      Copyright (c) 2004, 2005 Jeroen Vreeken (pe1rxq@amsat.org)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      version 2 as published by the Free Software Foundation.
+ *
+ *      Parts of this driver have been derived from a wlan-ng version
+ *      modified by ZyDAS. They also made documentation available, thanks!
+ *      Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <linux/string.h>
+#include <linux/if_arp.h>
+#include <linux/firmware.h>
+#include <net/ieee80211.h>
+#include "zd1201.h"
+
+static struct usb_device_id zd1201_table[] = {
+        {USB_DEVICE(0x0586, 0x3400)}, /* Peabird Wireless USB Adapter */
+        {USB_DEVICE(0x0ace, 0x1201)}, /* ZyDAS ZD1201 Wireless USB Adapter */
+        {USB_DEVICE(0x050d, 0x6051)}, /* Belkin F5D6051 usb  adapter */
+        {USB_DEVICE(0x0db0, 0x6823)}, /* MSI UB11B usb  adapter */
+        {USB_DEVICE(0x1044, 0x8005)}, /* GIGABYTE GN-WLBZ201 usb adapter */
+        {}
+};
+
+static int ap;  /* Are we an AP or a normal station? */
+
+#define ZD1201_VERSION  "0.15"
+
+MODULE_AUTHOR("Jeroen Vreeken <pe1rxq@amsat.org>");
+MODULE_DESCRIPTION("Driver for ZyDAS ZD1201 based USB Wireless adapters");
+MODULE_VERSION(ZD1201_VERSION);
+MODULE_LICENSE("GPL");
+module_param(ap, int, 0);
+MODULE_PARM_DESC(ap, "If non-zero Access Point firmware will be loaded");
+MODULE_DEVICE_TABLE(usb, zd1201_table);
+
+
+static int zd1201_fw_upload(struct usb_device *dev, int apfw)
+{
+        const struct firmware *fw_entry;
+        char *data;
+        unsigned long len;
+        int err;
+        unsigned char ret;
+        char *buf;
+        char *fwfile;
+
+        if (apfw)
+                fwfile = "zd1201-ap.fw";
+        else
+                fwfile = "zd1201.fw";
+
+        err = request_firmware(&fw_entry, fwfile, &dev->dev);
+        if (err) {
+                dev_err(&dev->dev, "Failed to load %s firmware file!\n", fwfile);
+                dev_err(&dev->dev, "Make sure the hotplug firmware loader is installed.\n");
+                dev_err(&dev->dev, "Goto http://linux-lc100020.sourceforge.net for more info.\n");
+                return err;
+        }
+
+        data = fw_entry->data;
+        len = fw_entry->size;
+
+        buf = kmalloc(1024, GFP_ATOMIC);
+        if (!buf)
+                goto exit;
+        
+        while (len > 0) {
+                int translen = (len > 1024) ? 1024 : len;
+                memcpy(buf, data, translen);
+
+                err = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0,
+                    USB_DIR_OUT | 0x40, 0, 0, buf, translen,
+                    ZD1201_FW_TIMEOUT);
+                if (err < 0)
+                        goto exit;
+
+                len -= translen;
+                data += translen;
+        }
+                                        
+        err = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0x2,
+            USB_DIR_OUT | 0x40, 0, 0, NULL, 0, ZD1201_FW_TIMEOUT);
+        if (err < 0)
+                goto exit;
+
+        err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
+            USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
+        if (err < 0)
+                goto exit;
+
+        if (ret & 0x80) {
+                err = -EIO;
+                goto exit;
+        }
+
+        err = 0;
+exit:
+        kfree(buf);
+        release_firmware(fw_entry);
+        return err;
+}
+
+static void zd1201_usbfree(struct urb *urb, struct pt_regs *regs)
+{
+        struct zd1201 *zd = urb->context;
+
+        switch(urb->status) {
+                case -EILSEQ:
+                case -ENODEV:
+                case -ETIMEDOUT:
+                case -ENOENT:
+                case -EPIPE:
+                case -EOVERFLOW:
+                case -ESHUTDOWN:
+                        dev_warn(&zd->usb->dev, "%s: urb failed: %d\n", 
+                            zd->dev->name, urb->status);
+        }
+
+        kfree(urb->transfer_buffer);
+        usb_free_urb(urb);
+        return;
+}
+
+/* cmdreq message: 
+        u32 type
+        u16 cmd
+        u16 parm0
+        u16 parm1
+        u16 parm2
+        u8  pad[4]
+
+        total: 4 + 2 + 2 + 2 + 2 + 4 = 16
+*/
+static int zd1201_docmd(struct zd1201 *zd, int cmd, int parm0,
+                        int parm1, int parm2)
+{
+        unsigned char *command;
+        int ret;
+        struct urb *urb;
+
+        command = kmalloc(16, GFP_ATOMIC);
+        if (!command)
+                return -ENOMEM;
+
+        *((__le32*)command) = cpu_to_le32(ZD1201_USB_CMDREQ);
+        *((__le16*)&command[4]) = cpu_to_le16(cmd);
+        *((__le16*)&command[6]) = cpu_to_le16(parm0);
+        *((__le16*)&command[8]) = cpu_to_le16(parm1);
+        *((__le16*)&command[10])= cpu_to_le16(parm2);
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb) {
+                kfree(command);
+                return -ENOMEM;
+        }
+        usb_fill_bulk_urb(urb, zd->usb, usb_sndbulkpipe(zd->usb, zd->endp_out2),
+                          command, 16, zd1201_usbfree, zd);
+        ret = usb_submit_urb(urb, GFP_ATOMIC);
+        if (ret) {
+                kfree(command);
+                usb_free_urb(urb);
+        }
+
+        return ret;
+}
+
+/* Callback after sending out a packet */
+static void zd1201_usbtx(struct urb *urb, struct pt_regs *regs)
+{
+        struct zd1201 *zd = urb->context;
+        netif_wake_queue(zd->dev);
+        return;
+}
+
+/* Incoming data */
+static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
+{
+        struct zd1201 *zd = urb->context;
+        int free = 0;
+        unsigned char *data = urb->transfer_buffer;
+        struct sk_buff *skb;
+        unsigned char type;
+
+        if (!zd) {
+                free = 1;
+                goto exit;
+        }
+
+        switch(urb->status) {
+                case -EILSEQ:
+                case -ENODEV:
+                case -ETIMEDOUT:
+                case -ENOENT:
+                case -EPIPE:
+                case -EOVERFLOW:
+                case -ESHUTDOWN:
+                        dev_warn(&zd->usb->dev, "%s: rx urb failed: %d\n",
+                            zd->dev->name, urb->status);
+                        free = 1;
+                        goto exit;
+        }
+        
+        if (urb->status != 0 || urb->actual_length == 0)
+                goto resubmit;
+
+        type = data[0];
+        if (type == ZD1201_PACKET_EVENTSTAT || type == ZD1201_PACKET_RESOURCE) {
+                memcpy(zd->rxdata, data, urb->actual_length);
+                zd->rxlen = urb->actual_length;
+                zd->rxdatas = 1;
+                wake_up(&zd->rxdataq);
+        }
+        /* Info frame */
+        if (type == ZD1201_PACKET_INQUIRE) {
+                int i = 0;
+                unsigned short infotype, framelen, copylen;
+                framelen = le16_to_cpu(*(__le16*)&data[4]);
+                infotype = le16_to_cpu(*(__le16*)&data[6]);
+
+                if (infotype == ZD1201_INF_LINKSTATUS) {
+                        short linkstatus;
+
+                        linkstatus = le16_to_cpu(*(__le16*)&data[8]);
+                        switch(linkstatus) {
+                                case 1:
+                                        netif_carrier_on(zd->dev);
+                                        break;
+                                case 2:
+                                        netif_carrier_off(zd->dev);
+                                        break;
+                                case 3:
+                                        netif_carrier_off(zd->dev);
+                                        break;
+                                case 4:
+                                        netif_carrier_on(zd->dev);
+                                        break;
+                                default:
+                                        netif_carrier_off(zd->dev);
+                        }
+                        goto resubmit;
+                }
+                if (infotype == ZD1201_INF_ASSOCSTATUS) {
+                        short status = le16_to_cpu(*(__le16*)(data+8));
+                        int event;
+                        union iwreq_data wrqu;
+
+                        switch (status) {
+                                case ZD1201_ASSOCSTATUS_STAASSOC:
+                                case ZD1201_ASSOCSTATUS_REASSOC:
+                                        event = IWEVREGISTERED;
+                                        break;
+                                case ZD1201_ASSOCSTATUS_DISASSOC:
+                                case ZD1201_ASSOCSTATUS_ASSOCFAIL:
+                                case ZD1201_ASSOCSTATUS_AUTHFAIL:
+                                default:
+                                        event = IWEVEXPIRED;
+                        }
+                        memcpy(wrqu.addr.sa_data, data+10, ETH_ALEN);
+                        wrqu.addr.sa_family = ARPHRD_ETHER;
+
+                        /* Send event to user space */
+                        wireless_send_event(zd->dev, event, &wrqu, NULL);
+
+                        goto resubmit;
+                }
+                if (infotype == ZD1201_INF_AUTHREQ) {
+                        union iwreq_data wrqu;
+
+                        memcpy(wrqu.addr.sa_data, data+8, ETH_ALEN);
+                        wrqu.addr.sa_family = ARPHRD_ETHER;
+                        /* There isn't a event that trully fits this request.
+                           We assume that userspace will be smart enough to
+                           see a new station being expired and sends back a
+                           authstation ioctl to authorize it. */
+                        wireless_send_event(zd->dev, IWEVEXPIRED, &wrqu, NULL);
+                        goto resubmit;
+                }
+                /* Other infotypes are handled outside this handler */
+                zd->rxlen = 0;
+                while (i < urb->actual_length) {
+                        copylen = le16_to_cpu(*(__le16*)&data[i+2]);
+                        /* Sanity check, sometimes we get junk */
+                        if (copylen+zd->rxlen > sizeof(zd->rxdata))
+                                break;
+                        memcpy(zd->rxdata+zd->rxlen, data+i+4, copylen);
+                        zd->rxlen += copylen;
+                        i += 64;
+                }
+                if (i >= urb->actual_length) {
+                        zd->rxdatas = 1;
+                        wake_up(&zd->rxdataq);
+                }
+                goto  resubmit;
+        }
+        /* Actual data */
+        if (data[urb->actual_length-1] == ZD1201_PACKET_RXDATA) {
+                int datalen = urb->actual_length-1;
+                unsigned short len, fc, seq;
+                struct hlist_node *node;
+
+                len = ntohs(*(__be16 *)&data[datalen-2]);
+                if (len>datalen)
+                        len=datalen;
+                fc = le16_to_cpu(*(__le16 *)&data[datalen-16]);
+                seq = le16_to_cpu(*(__le16 *)&data[datalen-24]);
+
+                if (zd->monitor) {
+                        if (datalen < 24)
+                                goto resubmit;
+                        if (!(skb = dev_alloc_skb(datalen+24)))
+                                goto resubmit;
+                        
+                        memcpy(skb_put(skb, 2), &data[datalen-16], 2);
+                        memcpy(skb_put(skb, 2), &data[datalen-2], 2);
+                        memcpy(skb_put(skb, 6), &data[datalen-14], 6);
+                        memcpy(skb_put(skb, 6), &data[datalen-22], 6);
+                        memcpy(skb_put(skb, 6), &data[datalen-8], 6);
+                        memcpy(skb_put(skb, 2), &data[datalen-24], 2);
+                        memcpy(skb_put(skb, len), data, len);
+                        skb->dev = zd->dev;
+                        skb->dev->last_rx = jiffies;
+                        skb->protocol = eth_type_trans(skb, zd->dev);
+                        zd->stats.rx_packets++;
+                        zd->stats.rx_bytes += skb->len;
+                        netif_rx(skb);
+                        goto resubmit;
+                }
+                        
+                if ((seq & IEEE80211_SCTL_FRAG) ||
+                    (fc & IEEE80211_FCTL_MOREFRAGS)) {
+                        struct zd1201_frag *frag = NULL;
+                        char *ptr;
+
+                        if (datalen<14)
+                                goto resubmit;
+                        if ((seq & IEEE80211_SCTL_FRAG) == 0) {
+                                frag = kmalloc(sizeof(*frag), GFP_ATOMIC);
+                                if (!frag)
+                                        goto resubmit;
+                                skb = dev_alloc_skb(IEEE80211_DATA_LEN +14+2);
+                                if (!skb) {
+                                        kfree(frag);
+                                        goto resubmit;
+                                }
+                                frag->skb = skb;
+                                frag->seq = seq & IEEE80211_SCTL_SEQ;
+                                skb_reserve(skb, 2);
+                                memcpy(skb_put(skb, 12), &data[datalen-14], 12);
+                                memcpy(skb_put(skb, 2), &data[6], 2);
+                                memcpy(skb_put(skb, len), data+8, len);
+                                hlist_add_head(&frag->fnode, &zd->fraglist);
+                                goto resubmit;
+                        }
+                        hlist_for_each_entry(frag, node, &zd->fraglist, fnode)
+                                if (frag->seq == (seq&IEEE80211_SCTL_SEQ))
+                                        break;
+                        if (!frag)
+                                goto resubmit;
+                        skb = frag->skb;
+                        ptr = skb_put(skb, len);
+                        if (ptr)
+                                memcpy(ptr, data+8, len);
+                        if (fc & IEEE80211_FCTL_MOREFRAGS)
+                                goto resubmit;
+                        hlist_del_init(&frag->fnode);
+                        kfree(frag);
+                } else {
+                        if (datalen<14)
+                                goto resubmit;
+                        skb = dev_alloc_skb(len + 14 + 2);
+                        if (!skb)
+                                goto resubmit;
+                        skb_reserve(skb, 2);
+                        memcpy(skb_put(skb, 12), &data[datalen-14], 12);
+                        memcpy(skb_put(skb, 2), &data[6], 2);
+                        memcpy(skb_put(skb, len), data+8, len);
+                }
+                skb->dev = zd->dev;
+                skb->dev->last_rx = jiffies;
+                skb->protocol = eth_type_trans(skb, zd->dev);
+                zd->stats.rx_packets++;
+                zd->stats.rx_bytes += skb->len;
+                netif_rx(skb);
+        }
+resubmit:
+        memset(data, 0, ZD1201_RXSIZE);
+
+        urb->status = 0;
+        urb->dev = zd->usb;
+        if(usb_submit_urb(urb, GFP_ATOMIC))
+                free = 1;
+
+exit:
+        if (free) {
+                zd->rxlen = 0;
+                zd->rxdatas = 1;
+                wake_up(&zd->rxdataq);
+                kfree(urb->transfer_buffer);
+        }
+        return;
+}
+
+static int zd1201_getconfig(struct zd1201 *zd, int rid, void *riddata,
+        unsigned int riddatalen)
+{
+        int err;
+        int i = 0;
+        int code;
+        int rid_fid;
+        int length;
+        unsigned char *pdata;
+
+        zd->rxdatas = 0;
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_ACCESS, rid, 0, 0);
+        if (err)
+                return err;
+
+        wait_event_interruptible(zd->rxdataq, zd->rxdatas);
+        if (!zd->rxlen)
+                return -EIO;
+
+        code = le16_to_cpu(*(__le16*)(&zd->rxdata[4]));
+        rid_fid = le16_to_cpu(*(__le16*)(&zd->rxdata[6]));
+        length = le16_to_cpu(*(__le16*)(&zd->rxdata[8]));
+        if (length > zd->rxlen)
+                length = zd->rxlen-6;
+
+        /* If access bit is not on, then error */
+        if ((code & ZD1201_ACCESSBIT) != ZD1201_ACCESSBIT || rid_fid != rid )
+                return -EINVAL;
+
+        /* Not enough buffer for allocating data */
+        if (riddatalen != (length - 4)) {
+                dev_dbg(&zd->usb->dev, "riddatalen mismatches, expected=%u, (packet=%u) length=%u, rid=0x%04X, rid_fid=0x%04X\n",
+                    riddatalen, zd->rxlen, length, rid, rid_fid);
+                return -ENODATA;
+        }
+
+        zd->rxdatas = 0;
+        /* Issue SetRxRid commnd */                     
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_SETRXRID, rid, 0, length);
+        if (err)
+                return err;
+
+        /* Receive RID record from resource packets */
+        wait_event_interruptible(zd->rxdataq, zd->rxdatas);
+        if (!zd->rxlen)
+                return -EIO;
+
+        if (zd->rxdata[zd->rxlen - 1] != ZD1201_PACKET_RESOURCE) {
+                dev_dbg(&zd->usb->dev, "Packet type mismatch: 0x%x not 0x3\n",
+                    zd->rxdata[zd->rxlen-1]);
+                return -EINVAL;
+        }
+
+        /* Set the data pointer and received data length */
+        pdata = zd->rxdata;
+        length = zd->rxlen;
+
+        do {
+                int actual_length;
+
+                actual_length = (length > 64) ? 64 : length;
+
+                if (pdata[0] != 0x3) {
+                        dev_dbg(&zd->usb->dev, "Rx Resource packet type error: %02X\n",
+                            pdata[0]);
+                        return -EINVAL;
+                }
+
+                if (actual_length != 64) {
+                        /* Trim the last packet type byte */
+                        actual_length--;
+                }
+
+                /* Skip the 4 bytes header (RID length and RID) */
+                if (i == 0) {
+                        pdata += 8;
+                        actual_length -= 8;
+                } else {
+                        pdata += 4;
+                        actual_length -= 4;
+                }
+                
+                memcpy(riddata, pdata, actual_length);
+                riddata += actual_length;
+                pdata += actual_length;
+                length -= 64;
+                i++;
+        } while (length > 0);
+
+        return 0;
+}
+
+/*
+ *      resreq:
+ *              byte    type
+ *              byte    sequence
+ *              u16     reserved
+ *              byte    data[12]
+ *      total: 16
+ */
+static int zd1201_setconfig(struct zd1201 *zd, int rid, void *buf, int len, int wait)
+{
+        int err;
+        unsigned char *request;
+        int reqlen;
+        char seq=0;
+        struct urb *urb;
+        gfp_t gfp_mask = wait ? GFP_NOIO : GFP_ATOMIC;
+
+        len += 4;                       /* first 4 are for header */
+
+        zd->rxdatas = 0;
+        zd->rxlen = 0;
+        for (seq=0; len > 0; seq++) {
+                request = kmalloc(16, gfp_mask);
+                if (!request)
+                        return -ENOMEM;
+                urb = usb_alloc_urb(0, gfp_mask);
+                if (!urb) {
+                        kfree(request);
+                        return -ENOMEM;
+                }
+                memset(request, 0, 16);
+                reqlen = len>12 ? 12 : len;
+                request[0] = ZD1201_USB_RESREQ;
+                request[1] = seq;
+                request[2] = 0;
+                request[3] = 0;
+                if (request[1] == 0) {
+                        /* add header */
+                        *(__le16*)&request[4] = cpu_to_le16((len-2+1)/2);
+                        *(__le16*)&request[6] = cpu_to_le16(rid);
+                        memcpy(request+8, buf, reqlen-4);
+                        buf += reqlen-4;
+                } else {
+                        memcpy(request+4, buf, reqlen);
+                        buf += reqlen;
+                }
+
+                len -= reqlen;
+
+                usb_fill_bulk_urb(urb, zd->usb, usb_sndbulkpipe(zd->usb,
+                    zd->endp_out2), request, 16, zd1201_usbfree, zd);
+                err = usb_submit_urb(urb, gfp_mask);
+                if (err)
+                        goto err;
+        }
+
+        request = kmalloc(16, gfp_mask);
+        if (!request)
+                return -ENOMEM;
+        urb = usb_alloc_urb(0, gfp_mask);
+        if (!urb) {
+                kfree(request);
+                return -ENOMEM;
+        }
+        *((__le32*)request) = cpu_to_le32(ZD1201_USB_CMDREQ);
+        *((__le16*)&request[4]) = 
+            cpu_to_le16(ZD1201_CMDCODE_ACCESS|ZD1201_ACCESSBIT);
+        *((__le16*)&request[6]) = cpu_to_le16(rid);
+        *((__le16*)&request[8]) = cpu_to_le16(0);
+        *((__le16*)&request[10]) = cpu_to_le16(0);
+        usb_fill_bulk_urb(urb, zd->usb, usb_sndbulkpipe(zd->usb, zd->endp_out2),
+             request, 16, zd1201_usbfree, zd);
+        err = usb_submit_urb(urb, gfp_mask);
+        if (err)
+                goto err;
+        
+        if (wait) {
+                wait_event_interruptible(zd->rxdataq, zd->rxdatas);
+                if (!zd->rxlen || le16_to_cpu(*(__le16*)&zd->rxdata[6]) != rid) {
+                        dev_dbg(&zd->usb->dev, "wrong or no RID received\n");
+                }
+        }
+
+        return 0;
+err:
+        kfree(request);
+        usb_free_urb(urb);
+        return err;
+}
+
+static inline int zd1201_getconfig16(struct zd1201 *zd, int rid, short *val)
+{
+        int err;
+        __le16 zdval;
+
+        err = zd1201_getconfig(zd, rid, &zdval, sizeof(__le16));
+        if (err)
+                return err;
+        *val = le16_to_cpu(zdval);
+        return 0;
+}
+
+static inline int zd1201_setconfig16(struct zd1201 *zd, int rid, short val)
+{
+        __le16 zdval = cpu_to_le16(val);
+        return (zd1201_setconfig(zd, rid, &zdval, sizeof(__le16), 1));
+}
+
+static int zd1201_drvr_start(struct zd1201 *zd)
+{
+        int err, i;
+        short max;
+        __le16 zdmax;
+        unsigned char *buffer;
+
+        buffer = kzalloc(ZD1201_RXSIZE, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
+        usb_fill_bulk_urb(zd->rx_urb, zd->usb, 
+            usb_rcvbulkpipe(zd->usb, zd->endp_in), buffer, ZD1201_RXSIZE,
+            zd1201_usbrx, zd);
+
+        err = usb_submit_urb(zd->rx_urb, GFP_KERNEL);
+        if (err)
+                goto err_buffer;
+
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_INIT, 0, 0, 0);
+        if (err)
+                goto err_urb;
+
+        err = zd1201_getconfig(zd, ZD1201_RID_CNFMAXTXBUFFERNUMBER, &zdmax,
+            sizeof(__le16));
+        if (err)
+                goto err_urb;
+
+        max = le16_to_cpu(zdmax);
+        for (i=0; i<max; i++) {
+                err = zd1201_docmd(zd, ZD1201_CMDCODE_ALLOC, 1514, 0, 0);
+                if (err)
+                        goto err_urb;
+        }
+
+        return 0;
+
+err_urb:
+        usb_kill_urb(zd->rx_urb);
+        return err;
+err_buffer:
+        kfree(buffer);
+        return err;
+}
+
+/*      Magic alert: The firmware doesn't seem to like the MAC state being
+ *      toggled in promisc (aka monitor) mode.
+ *      (It works a number of times, but will halt eventually)
+ *      So we turn it of before disabling and on after enabling if needed.
+ */
+static int zd1201_enable(struct zd1201 *zd)
+{
+        int err;
+
+        if (zd->mac_enabled)
+                return 0;
+
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_ENABLE, 0, 0, 0);
+        if (!err)
+                zd->mac_enabled = 1;
+
+        if (zd->monitor)
+                err = zd1201_setconfig16(zd, ZD1201_RID_PROMISCUOUSMODE, 1);
+
+        return err;
+}
+
+static int zd1201_disable(struct zd1201 *zd)
+{
+        int err;
+
+        if (!zd->mac_enabled)
+                return 0;
+        if (zd->monitor) {
+                err = zd1201_setconfig16(zd, ZD1201_RID_PROMISCUOUSMODE, 0);
+                if (err)
+                        return err;
+        }
+
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_DISABLE, 0, 0, 0);
+        if (!err)
+                zd->mac_enabled = 0;
+        return err;
+}
+
+static int zd1201_mac_reset(struct zd1201 *zd)
+{
+        if (!zd->mac_enabled)
+                return 0;
+        zd1201_disable(zd);
+        return zd1201_enable(zd);
+}
+
+static int zd1201_join(struct zd1201 *zd, char *essid, int essidlen)
+{
+        int err, val;
+        char buf[IW_ESSID_MAX_SIZE+2];
+
+        err = zd1201_disable(zd);
+        if (err)
+                return err;
+
+        val = ZD1201_CNFAUTHENTICATION_OPENSYSTEM;
+        val |= ZD1201_CNFAUTHENTICATION_SHAREDKEY;
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFAUTHENTICATION, val);
+        if (err)
+                return err;
+
+        *(__le16 *)buf = cpu_to_le16(essidlen);
+        memcpy(buf+2, essid, essidlen);
+        if (!zd->ap) {  /* Normal station */
+                err = zd1201_setconfig(zd, ZD1201_RID_CNFDESIREDSSID, buf,
+                    IW_ESSID_MAX_SIZE+2, 1);
+                if (err)
+                        return err;
+        } else {        /* AP */
+                err = zd1201_setconfig(zd, ZD1201_RID_CNFOWNSSID, buf,
+                    IW_ESSID_MAX_SIZE+2, 1);
+                if (err)
+                        return err;
+        }
+
+        err = zd1201_setconfig(zd, ZD1201_RID_CNFOWNMACADDR, 
+            zd->dev->dev_addr, zd->dev->addr_len, 1);
+        if (err)
+                return err;
+
+        err = zd1201_enable(zd);
+        if (err)
+                return err;
+
+        msleep(100);
+        return 0;
+}
+
+static int zd1201_net_open(struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        /* Start MAC with wildcard if no essid set */
+        if (!zd->mac_enabled)
+                zd1201_join(zd, zd->essid, zd->essidlen);
+        netif_start_queue(dev);
+
+        return 0;
+}
+
+static int zd1201_net_stop(struct net_device *dev)
+{
+        netif_stop_queue(dev);
+        return 0;
+}
+
+/*
+        RFC 1042 encapsulates Ethernet frames in 802.11 frames
+        by prefixing them with 0xaa, 0xaa, 0x03) followed by a SNAP OID of 0
+        (0x00, 0x00, 0x00). Zd requires an additional padding, copy
+        of ethernet addresses, length of the standard RFC 1042 packet
+        and a command byte (which is nul for tx).
+        
+        tx frame (from Wlan NG):
+        RFC 1042:
+                llc             0xAA 0xAA 0x03 (802.2 LLC)
+                snap            0x00 0x00 0x00 (Ethernet encapsulated)
+                type            2 bytes, Ethernet type field
+                payload         (minus eth header)
+        Zydas specific:
+                padding         1B if (skb->len+8+1)%64==0
+                Eth MAC addr    12 bytes, Ethernet MAC addresses
+                length          2 bytes, RFC 1042 packet length 
+                                (llc+snap+type+payload)
+                zd              1 null byte, zd1201 packet type
+ */
+static int zd1201_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        unsigned char *txbuf = zd->txdata;
+        int txbuflen, pad = 0, err;
+        struct urb *urb = zd->tx_urb;
+
+        if (!zd->mac_enabled || zd->monitor) {
+                zd->stats.tx_dropped++;
+                kfree_skb(skb);
+                return 0;
+        }
+        netif_stop_queue(dev);
+
+        txbuflen = skb->len + 8 + 1;
+        if (txbuflen%64 == 0) {
+                pad = 1;
+                txbuflen++;
+        }
+        txbuf[0] = 0xAA;
+        txbuf[1] = 0xAA;
+        txbuf[2] = 0x03;
+        txbuf[3] = 0x00;        /* rfc1042 */
+        txbuf[4] = 0x00;
+        txbuf[5] = 0x00;
+
+        memcpy(txbuf+6, skb->data+12, skb->len-12);
+        if (pad)
+                txbuf[skb->len-12+6]=0;
+        memcpy(txbuf+skb->len-12+6+pad, skb->data, 12);
+        *(__be16*)&txbuf[skb->len+6+pad] = htons(skb->len-12+6);
+        txbuf[txbuflen-1] = 0;
+
+        usb_fill_bulk_urb(urb, zd->usb, usb_sndbulkpipe(zd->usb, zd->endp_out),
+            txbuf, txbuflen, zd1201_usbtx, zd);
+
+        err = usb_submit_urb(zd->tx_urb, GFP_ATOMIC);
+        if (err) {
+                zd->stats.tx_errors++;
+                netif_start_queue(dev);
+                return err;
+        }
+        zd->stats.tx_packets++;
+        zd->stats.tx_bytes += skb->len;
+        dev->trans_start = jiffies;
+        kfree_skb(skb);
+
+        return 0;
+}
+
+static void zd1201_tx_timeout(struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        if (!zd)
+                return;
+        dev_warn(&zd->usb->dev, "%s: TX timeout, shooting down urb\n",
+            dev->name);
+        usb_unlink_urb(zd->tx_urb);
+        zd->stats.tx_errors++;
+        /* Restart the timeout to quiet the watchdog: */
+        dev->trans_start = jiffies;
+}
+
+static int zd1201_set_mac_address(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        int err;
+
+        if (!zd)
+                return -ENODEV;
+
+        err = zd1201_setconfig(zd, ZD1201_RID_CNFOWNMACADDR, 
+            addr->sa_data, dev->addr_len, 1);
+        if (err)
+                return err;
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+
+        return zd1201_mac_reset(zd);
+}
+
+static struct net_device_stats *zd1201_get_stats(struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        return &zd->stats;
+}
+
+static struct iw_statistics *zd1201_get_wireless_stats(struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        return &zd->iwstats;
+}
+
+static void zd1201_set_multicast(struct net_device *dev)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        struct dev_mc_list *mc = dev->mc_list;
+        unsigned char reqbuf[ETH_ALEN*ZD1201_MAXMULTI];
+        int i;
+
+        if (dev->mc_count > ZD1201_MAXMULTI)
+                return;
+
+        for (i=0; i<dev->mc_count; i++) {
+                memcpy(reqbuf+i*ETH_ALEN, mc->dmi_addr, ETH_ALEN);
+                mc = mc->next;
+        }
+        zd1201_setconfig(zd, ZD1201_RID_CNFGROUPADDRESS, reqbuf,
+            dev->mc_count*ETH_ALEN, 0);
+        
+}
+
+static int zd1201_config_commit(struct net_device *dev, 
+    struct iw_request_info *info, struct iw_point *data, char *essid)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        return zd1201_mac_reset(zd);
+}
+
+static int zd1201_get_name(struct net_device *dev,
+    struct iw_request_info *info, char *name, char *extra)
+{
+        strcpy(name, "IEEE 802.11b");
+        return 0;
+}
+
+static int zd1201_set_freq(struct net_device *dev,
+    struct iw_request_info *info, struct iw_freq *freq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short channel = 0;
+        int err;
+
+        if (freq->e == 0)
+                channel = freq->m;
+        else {
+                if (freq->m >= 2482)
+                        channel = 14;
+                if (freq->m >= 2407)
+                        channel = (freq->m-2407)/5;
+        }
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFOWNCHANNEL, channel);
+        if (err)
+                return err;
+
+        zd1201_mac_reset(zd);
+
+        return 0;
+}
+
+static int zd1201_get_freq(struct net_device *dev,
+    struct iw_request_info *info, struct iw_freq *freq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short channel;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFOWNCHANNEL, &channel);
+        if (err)
+                return err;
+        freq->e = 0;
+        freq->m = channel;
+
+        return 0;
+}
+
+static int zd1201_set_mode(struct net_device *dev,
+    struct iw_request_info *info, __u32 *mode, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short porttype, monitor = 0;
+        unsigned char buffer[IW_ESSID_MAX_SIZE+2];
+        int err;
+
+        if (zd->ap) {
+                if (*mode != IW_MODE_MASTER)
+                        return -EINVAL;
+                return 0;
+        }
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_PROMISCUOUSMODE, 0);
+        if (err)
+                return err;
+        zd->dev->type = ARPHRD_ETHER;
+        switch(*mode) {
+                case IW_MODE_MONITOR:
+                        monitor = 1;
+                        zd->dev->type = ARPHRD_IEEE80211;
+                        /* Make sure we are no longer associated with by
+                           setting an 'impossible' essid.
+                           (otherwise we mess up firmware)
+                         */
+                        zd1201_join(zd, "\0-*#\0", 5);
+                        /* Put port in pIBSS */
+                case 8: /* No pseudo-IBSS in wireless extensions (yet) */
+                        porttype = ZD1201_PORTTYPE_PSEUDOIBSS;
+                        break;
+                case IW_MODE_ADHOC:
+                        porttype = ZD1201_PORTTYPE_IBSS;
+                        break;
+                case IW_MODE_INFRA:
+                        porttype = ZD1201_PORTTYPE_BSS;
+                        break;
+                default:
+                        return -EINVAL;
+        }
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFPORTTYPE, porttype);
+        if (err)
+                return err;
+        if (zd->monitor && !monitor) {
+                        zd1201_disable(zd);
+                        *(__le16 *)buffer = cpu_to_le16(zd->essidlen);
+                        memcpy(buffer+2, zd->essid, zd->essidlen);
+                        err = zd1201_setconfig(zd, ZD1201_RID_CNFDESIREDSSID,
+                            buffer, IW_ESSID_MAX_SIZE+2, 1);
+                        if (err)
+                                return err;
+        }
+        zd->monitor = monitor;
+        /* If monitor mode is set we don't actually turn it on here since it
+         * is done during mac reset anyway (see zd1201_mac_enable).
+         */
+        zd1201_mac_reset(zd);
+
+        return 0;
+}
+
+static int zd1201_get_mode(struct net_device *dev,
+    struct iw_request_info *info, __u32 *mode, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short porttype;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFPORTTYPE, &porttype);
+        if (err)
+                return err;
+        switch(porttype) {
+                case ZD1201_PORTTYPE_IBSS:
+                        *mode = IW_MODE_ADHOC;
+                        break;
+                case ZD1201_PORTTYPE_BSS:
+                        *mode = IW_MODE_INFRA;
+                        break;
+                case ZD1201_PORTTYPE_WDS:
+                        *mode = IW_MODE_REPEAT;
+                        break;
+                case ZD1201_PORTTYPE_PSEUDOIBSS:
+                        *mode = 8;/* No Pseudo-IBSS... */
+                        break;
+                case ZD1201_PORTTYPE_AP:
+                        *mode = IW_MODE_MASTER;
+                        break;
+                default:
+                        dev_dbg(&zd->usb->dev, "Unknown porttype: %d\n",
+                            porttype);
+                        *mode = IW_MODE_AUTO;
+        }
+        if (zd->monitor)
+                *mode = IW_MODE_MONITOR;
+
+        return 0;
+}
+
+static int zd1201_get_range(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *wrq, char *extra)
+{
+        struct iw_range *range = (struct iw_range *)extra;
+
+        wrq->length = sizeof(struct iw_range);
+        memset(range, 0, sizeof(struct iw_range));
+        range->we_version_compiled = WIRELESS_EXT;
+        range->we_version_source = WIRELESS_EXT;
+
+        range->max_qual.qual = 128;
+        range->max_qual.level = 128;
+        range->max_qual.noise = 128;
+        range->max_qual.updated = 7;
+
+        range->encoding_size[0] = 5;
+        range->encoding_size[1] = 13;
+        range->num_encoding_sizes = 2;
+        range->max_encoding_tokens = ZD1201_NUMKEYS;
+
+        range->num_bitrates = 4;
+        range->bitrate[0] = 1000000;
+        range->bitrate[1] = 2000000;
+        range->bitrate[2] = 5500000;
+        range->bitrate[3] = 11000000;
+
+        range->min_rts = 0;
+        range->min_frag = ZD1201_FRAGMIN;
+        range->max_rts = ZD1201_RTSMAX;
+        range->min_frag = ZD1201_FRAGMAX;
+
+        return 0;
+}
+
+/*      Little bit of magic here: we only get the quality if we poll
+ *      for it, and we never get an actual request to trigger such
+ *      a poll. Therefore we 'assume' that the user will soon ask for
+ *      the stats after asking the bssid.
+ */
+static int zd1201_get_wap(struct net_device *dev,
+    struct iw_request_info *info, struct sockaddr *ap_addr, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        unsigned char buffer[6];
+
+        if (!zd1201_getconfig(zd, ZD1201_RID_COMMSQUALITY, buffer, 6)) {
+                /* Unfortunately the quality and noise reported is useless.
+                   they seem to be accumulators that increase until you
+                   read them, unless we poll on a fixed interval we can't
+                   use them
+                 */
+                /*zd->iwstats.qual.qual = le16_to_cpu(((__le16 *)buffer)[0]);*/
+                zd->iwstats.qual.level = le16_to_cpu(((__le16 *)buffer)[1]);
+                /*zd->iwstats.qual.noise = le16_to_cpu(((__le16 *)buffer)[2]);*/
+                zd->iwstats.qual.updated = 2;
+        }
+
+        return zd1201_getconfig(zd, ZD1201_RID_CURRENTBSSID, ap_addr->sa_data, 6);
+}
+
+static int zd1201_set_scan(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *srq, char *extra)
+{
+        /* We do everything in get_scan */
+        return 0;
+}
+
+static int zd1201_get_scan(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *srq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        int err, i, j, enabled_save;
+        struct iw_event iwe;
+        char *cev = extra;
+        char *end_buf = extra + IW_SCAN_MAX_DATA;
+
+        /* No scanning in AP mode */
+        if (zd->ap)
+                return -EOPNOTSUPP;
+
+        /* Scan doesn't seem to work if disabled */
+        enabled_save = zd->mac_enabled;
+        zd1201_enable(zd);
+
+        zd->rxdatas = 0;
+        err = zd1201_docmd(zd, ZD1201_CMDCODE_INQUIRE, 
+             ZD1201_INQ_SCANRESULTS, 0, 0);
+        if (err)
+                return err;
+
+        wait_event_interruptible(zd->rxdataq, zd->rxdatas);
+        if (!zd->rxlen)
+                return -EIO;
+
+        if (le16_to_cpu(*(__le16*)&zd->rxdata[2]) != ZD1201_INQ_SCANRESULTS)
+                return -EIO;
+
+        for(i=8; i<zd->rxlen; i+=62) {
+                iwe.cmd = SIOCGIWAP;
+                iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+                memcpy(iwe.u.ap_addr.sa_data, zd->rxdata+i+6, 6);
+                cev = iwe_stream_add_event(cev, end_buf, &iwe, IW_EV_ADDR_LEN);
+
+                iwe.cmd = SIOCGIWESSID;
+                iwe.u.data.length = zd->rxdata[i+16];
+                iwe.u.data.flags = 1;
+                cev = iwe_stream_add_point(cev, end_buf, &iwe, zd->rxdata+i+18);
+
+                iwe.cmd = SIOCGIWMODE;
+                if (zd->rxdata[i+14]&0x01)
+                        iwe.u.mode = IW_MODE_MASTER;
+                else
+                        iwe.u.mode = IW_MODE_ADHOC;
+                cev = iwe_stream_add_event(cev, end_buf, &iwe, IW_EV_UINT_LEN);
+                
+                iwe.cmd = SIOCGIWFREQ;
+                iwe.u.freq.m = zd->rxdata[i+0];
+                iwe.u.freq.e = 0;
+                cev = iwe_stream_add_event(cev, end_buf, &iwe, IW_EV_FREQ_LEN);
+                
+                iwe.cmd = SIOCGIWRATE;
+                iwe.u.bitrate.fixed = 0;
+                iwe.u.bitrate.disabled = 0;
+                for (j=0; j<10; j++) if (zd->rxdata[i+50+j]) {
+                        iwe.u.bitrate.value = (zd->rxdata[i+50+j]&0x7f)*500000;
+                        cev=iwe_stream_add_event(cev, end_buf, &iwe,
+                            IW_EV_PARAM_LEN);
+                }
+                
+                iwe.cmd = SIOCGIWENCODE;
+                iwe.u.data.length = 0;
+                if (zd->rxdata[i+14]&0x10)
+                        iwe.u.data.flags = IW_ENCODE_ENABLED;
+                else
+                        iwe.u.data.flags = IW_ENCODE_DISABLED;
+                cev = iwe_stream_add_point(cev, end_buf, &iwe, NULL);
+                
+                iwe.cmd = IWEVQUAL;
+                iwe.u.qual.qual = zd->rxdata[i+4];
+                iwe.u.qual.noise= zd->rxdata[i+2]/10-100;
+                iwe.u.qual.level = (256+zd->rxdata[i+4]*100)/255-100;
+                iwe.u.qual.updated = 7;
+                cev = iwe_stream_add_event(cev, end_buf, &iwe, IW_EV_QUAL_LEN);
+        }
+
+        if (!enabled_save)
+                zd1201_disable(zd);
+
+        srq->length = cev - extra;
+        srq->flags = 0;
+
+        return 0;
+}
+
+static int zd1201_set_essid(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *data, char *essid)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        if (data->length > IW_ESSID_MAX_SIZE)
+                return -EINVAL;
+        if (data->length < 1)
+                data->length = 1;
+        zd->essidlen = data->length-1;
+        memset(zd->essid, 0, IW_ESSID_MAX_SIZE+1);
+        memcpy(zd->essid, essid, data->length);
+        return zd1201_join(zd, zd->essid, zd->essidlen);
+}
+
+static int zd1201_get_essid(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *data, char *essid)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        memcpy(essid, zd->essid, zd->essidlen);
+        data->flags = 1;
+        data->length = zd->essidlen;
+
+        return 0;
+}
+
+static int zd1201_get_nick(struct net_device *dev, struct iw_request_info *info,
+    struct iw_point *data, char *nick)
+{
+        strcpy(nick, "zd1201");
+        data->flags = 1;
+        data->length = strlen(nick);
+        return 0;
+}
+
+static int zd1201_set_rate(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short rate;
+        int err;
+
+        switch (rrq->value) {
+                case 1000000:
+                        rate = ZD1201_RATEB1;
+                        break;
+                case 2000000:
+                        rate = ZD1201_RATEB2;
+                        break;
+                case 5500000:
+                        rate = ZD1201_RATEB5;
+                        break;
+                case 11000000:
+                default:
+                        rate = ZD1201_RATEB11;
+                        break;
+        }
+        if (!rrq->fixed) { /* Also enable all lower bitrates */
+                rate |= rate-1;
+        }
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_TXRATECNTL, rate);
+        if (err)
+                return err;
+
+        return zd1201_mac_reset(zd);
+}
+
+static int zd1201_get_rate(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short rate;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CURRENTTXRATE, &rate);
+        if (err)
+                return err;
+
+        switch(rate) {
+                case 1:
+                        rrq->value = 1000000;
+                        break;
+                case 2:
+                        rrq->value = 2000000;
+                        break;
+                case 5:
+                        rrq->value = 5500000;
+                        break;
+                case 11:
+                        rrq->value = 11000000;
+                        break;
+                default:
+                        rrq->value = 0;
+        }
+        rrq->fixed = 0;
+        rrq->disabled = 0;
+
+        return 0;
+}
+
+static int zd1201_set_rts(struct net_device *dev, struct iw_request_info *info,
+    struct iw_param *rts, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        int err;
+        short val = rts->value;
+
+        if (rts->disabled || !rts->fixed)
+                val = ZD1201_RTSMAX;
+        if (val > ZD1201_RTSMAX)
+                return -EINVAL;
+        if (val < 0)
+                return -EINVAL;
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFRTSTHRESHOLD, val);
+        if (err)
+                return err;
+        return zd1201_mac_reset(zd);
+}
+
+static int zd1201_get_rts(struct net_device *dev, struct iw_request_info *info,
+    struct iw_param *rts, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short rtst;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFRTSTHRESHOLD, &rtst);
+        if (err)
+                return err;
+        rts->value = rtst;
+        rts->disabled = (rts->value == ZD1201_RTSMAX);
+        rts->fixed = 1;
+
+        return 0;
+}
+
+static int zd1201_set_frag(struct net_device *dev, struct iw_request_info *info,
+    struct iw_param *frag, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        int err;
+        short val = frag->value;
+
+        if (frag->disabled || !frag->fixed)
+                val = ZD1201_FRAGMAX;
+        if (val > ZD1201_FRAGMAX)
+                return -EINVAL;
+        if (val < ZD1201_FRAGMIN)
+                return -EINVAL;
+        if (val & 1)
+                return -EINVAL;
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFFRAGTHRESHOLD, val);
+        if (err)
+                return err;
+        return zd1201_mac_reset(zd);
+}
+
+static int zd1201_get_frag(struct net_device *dev, struct iw_request_info *info,
+    struct iw_param *frag, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short fragt;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFFRAGTHRESHOLD, &fragt);
+        if (err)
+                return err;
+        frag->value = fragt;
+        frag->disabled = (frag->value == ZD1201_FRAGMAX);
+        frag->fixed = 1;
+
+        return 0;
+}
+
+static int zd1201_set_retry(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        return 0;
+}
+
+static int zd1201_get_retry(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        return 0;
+}
+
+static int zd1201_set_encode(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *erq, char *key)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short i;
+        int err, rid;
+
+        if (erq->length > ZD1201_MAXKEYLEN)
+                return -EINVAL;
+
+        i = (erq->flags & IW_ENCODE_INDEX)-1;
+        if (i == -1) {
+                err = zd1201_getconfig16(zd,ZD1201_RID_CNFDEFAULTKEYID,&i);
+                if (err)
+                        return err;
+        } else {
+                err = zd1201_setconfig16(zd, ZD1201_RID_CNFDEFAULTKEYID, i);
+                if (err)
+                        return err;
+        }
+
+        if (i < 0 || i >= ZD1201_NUMKEYS)
+                return -EINVAL;
+
+        rid = ZD1201_RID_CNFDEFAULTKEY0 + i;
+        err = zd1201_setconfig(zd, rid, key, erq->length, 1);
+        if (err)
+                return err;
+        zd->encode_keylen[i] = erq->length;
+        memcpy(zd->encode_keys[i], key, erq->length);
+
+        i=0;
+        if (!(erq->flags & IW_ENCODE_DISABLED & IW_ENCODE_MODE)) {
+                i |= 0x01;
+                zd->encode_enabled = 1;
+        } else
+                zd->encode_enabled = 0;
+        if (erq->flags & IW_ENCODE_RESTRICTED & IW_ENCODE_MODE) {
+                i |= 0x02;
+                zd->encode_restricted = 1;
+        } else
+                zd->encode_restricted = 0;
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFWEBFLAGS, i);
+        if (err)
+                return err;
+
+        if (zd->encode_enabled)
+                i = ZD1201_CNFAUTHENTICATION_SHAREDKEY;
+        else
+                i = ZD1201_CNFAUTHENTICATION_OPENSYSTEM;
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFAUTHENTICATION, i);
+        if (err)
+                return err;
+
+        return zd1201_mac_reset(zd);
+}
+
+static int zd1201_get_encode(struct net_device *dev,
+    struct iw_request_info *info, struct iw_point *erq, char *key)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short i;
+        int err;
+
+        if (zd->encode_enabled)
+                erq->flags = IW_ENCODE_ENABLED;
+        else
+                erq->flags = IW_ENCODE_DISABLED;
+        if (zd->encode_restricted)
+                erq->flags |= IW_ENCODE_RESTRICTED;
+        else
+                erq->flags |= IW_ENCODE_OPEN;
+
+        i = (erq->flags & IW_ENCODE_INDEX) -1;
+        if (i == -1) {
+                err = zd1201_getconfig16(zd, ZD1201_RID_CNFDEFAULTKEYID, &i);
+                if (err)
+                        return err;
+        }
+        if (i<0 || i>= ZD1201_NUMKEYS)
+                return -EINVAL;
+
+        erq->flags |= i+1;
+
+        erq->length = zd->encode_keylen[i];
+        memcpy(key, zd->encode_keys[i], erq->length);
+
+        return 0;
+}
+
+static int zd1201_set_power(struct net_device *dev, 
+    struct iw_request_info *info, struct iw_param *vwrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short enabled, duration, level;
+        int err;
+
+        enabled = vwrq->disabled ? 0 : 1;
+        if (enabled) {
+                if (vwrq->flags & IW_POWER_PERIOD) {
+                        duration = vwrq->value;
+                        err = zd1201_setconfig16(zd, 
+                            ZD1201_RID_CNFMAXSLEEPDURATION, duration);
+                        if (err)
+                                return err;
+                        goto out;
+                }
+                if (vwrq->flags & IW_POWER_TIMEOUT) {
+                        err = zd1201_getconfig16(zd, 
+                            ZD1201_RID_CNFMAXSLEEPDURATION, &duration);
+                        if (err)
+                                return err;
+                        level = vwrq->value * 4 / duration;
+                        if (level > 4)
+                                level = 4;
+                        if (level < 0)
+                                level = 0;
+                        err = zd1201_setconfig16(zd, ZD1201_RID_CNFPMEPS,
+                            level);
+                        if (err)
+                                return err;
+                        goto out;
+                }
+                return -EINVAL;
+        }
+out:
+        return zd1201_setconfig16(zd, ZD1201_RID_CNFPMENABLED, enabled);
+}
+
+static int zd1201_get_power(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *vwrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short enabled, level, duration;
+        int err;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFPMENABLED, &enabled);
+        if (err)
+                return err;
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFPMEPS, &level);
+        if (err)
+                return err;
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFMAXSLEEPDURATION, &duration);
+        if (err)
+                return err;
+        vwrq->disabled = enabled ? 0 : 1;
+        if (vwrq->flags & IW_POWER_TYPE) {
+                if (vwrq->flags & IW_POWER_PERIOD) {
+                        vwrq->value = duration;
+                        vwrq->flags = IW_POWER_PERIOD;
+                } else {
+                        vwrq->value = duration * level / 4;
+                        vwrq->flags = IW_POWER_TIMEOUT;
+                }
+        }
+        if (vwrq->flags & IW_POWER_MODE) {
+                if (enabled && level)
+                        vwrq->flags = IW_POWER_UNICAST_R;
+                else
+                        vwrq->flags = IW_POWER_ALL_R;
+        }
+
+        return 0;
+}
+
+
+static const iw_handler zd1201_iw_handler[] =
+{
+        (iw_handler) zd1201_config_commit,      /* SIOCSIWCOMMIT */
+        (iw_handler) zd1201_get_name,           /* SIOCGIWNAME */
+        (iw_handler) NULL,                      /* SIOCSIWNWID */
+        (iw_handler) NULL,                      /* SIOCGIWNWID */
+        (iw_handler) zd1201_set_freq,           /* SIOCSIWFREQ */
+        (iw_handler) zd1201_get_freq,           /* SIOCGIWFREQ */
+        (iw_handler) zd1201_set_mode,           /* SIOCSIWMODE */
+        (iw_handler) zd1201_get_mode,           /* SIOCGIWMODE */
+        (iw_handler) NULL,                      /* SIOCSIWSENS */
+        (iw_handler) NULL,                      /* SIOCGIWSENS */
+        (iw_handler) NULL,                      /* SIOCSIWRANGE */
+        (iw_handler) zd1201_get_range,           /* SIOCGIWRANGE */
+        (iw_handler) NULL,                      /* SIOCSIWPRIV */
+        (iw_handler) NULL,                      /* SIOCGIWPRIV */
+        (iw_handler) NULL,                      /* SIOCSIWSTATS */
+        (iw_handler) NULL,                      /* SIOCGIWSTATS */
+        (iw_handler) NULL,                      /* SIOCSIWSPY */
+        (iw_handler) NULL,                      /* SIOCGIWSPY */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL/*zd1201_set_wap*/,            /* SIOCSIWAP */
+        (iw_handler) zd1201_get_wap,            /* SIOCGIWAP */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL,                      /* SIOCGIWAPLIST */
+        (iw_handler) zd1201_set_scan,           /* SIOCSIWSCAN */
+        (iw_handler) zd1201_get_scan,           /* SIOCGIWSCAN */
+        (iw_handler) zd1201_set_essid,          /* SIOCSIWESSID */
+        (iw_handler) zd1201_get_essid,          /* SIOCGIWESSID */
+        (iw_handler) NULL,                      /* SIOCSIWNICKN */
+        (iw_handler) zd1201_get_nick,           /* SIOCGIWNICKN */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) NULL,                      /* -- hole -- */
+        (iw_handler) zd1201_set_rate,           /* SIOCSIWRATE */
+        (iw_handler) zd1201_get_rate,           /* SIOCGIWRATE */
+        (iw_handler) zd1201_set_rts,            /* SIOCSIWRTS */
+        (iw_handler) zd1201_get_rts,            /* SIOCGIWRTS */
+        (iw_handler) zd1201_set_frag,           /* SIOCSIWFRAG */
+        (iw_handler) zd1201_get_frag,           /* SIOCGIWFRAG */
+        (iw_handler) NULL,                      /* SIOCSIWTXPOW */
+        (iw_handler) NULL,                      /* SIOCGIWTXPOW */
+        (iw_handler) zd1201_set_retry,          /* SIOCSIWRETRY */
+        (iw_handler) zd1201_get_retry,          /* SIOCGIWRETRY */
+        (iw_handler) zd1201_set_encode,         /* SIOCSIWENCODE */
+        (iw_handler) zd1201_get_encode,         /* SIOCGIWENCODE */
+        (iw_handler) zd1201_set_power,          /* SIOCSIWPOWER */
+        (iw_handler) zd1201_get_power,          /* SIOCGIWPOWER */
+};
+
+static int zd1201_set_hostauth(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+
+        if (!zd->ap)
+                return -EOPNOTSUPP;
+
+        return zd1201_setconfig16(zd, ZD1201_RID_CNFHOSTAUTH, rrq->value);
+}
+
+static int zd1201_get_hostauth(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short hostauth;
+        int err;
+
+        if (!zd->ap)
+                return -EOPNOTSUPP;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFHOSTAUTH, &hostauth);
+        if (err)
+                return err;
+        rrq->value = hostauth;
+        rrq->fixed = 1;
+
+        return 0;
+}
+
+static int zd1201_auth_sta(struct net_device *dev,
+    struct iw_request_info *info, struct sockaddr *sta, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        unsigned char buffer[10];
+
+        if (!zd->ap)
+                return -EOPNOTSUPP;
+
+        memcpy(buffer, sta->sa_data, ETH_ALEN);
+        *(short*)(buffer+6) = 0;        /* 0==success, 1==failure */
+        *(short*)(buffer+8) = 0;
+
+        return zd1201_setconfig(zd, ZD1201_RID_AUTHENTICATESTA, buffer, 10, 1);
+}
+
+static int zd1201_set_maxassoc(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        int err;
+
+        if (!zd->ap)
+                return -EOPNOTSUPP;
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFMAXASSOCSTATIONS, rrq->value);
+        if (err)
+                return err;
+        return 0;
+}
+
+static int zd1201_get_maxassoc(struct net_device *dev,
+    struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+        struct zd1201 *zd = (struct zd1201 *)dev->priv;
+        short maxassoc;
+        int err;
+
+        if (!zd->ap)
+                return -EOPNOTSUPP;
+
+        err = zd1201_getconfig16(zd, ZD1201_RID_CNFMAXASSOCSTATIONS, &maxassoc);
+        if (err)
+                return err;
+        rrq->value = maxassoc;
+        rrq->fixed = 1;
+
+        return 0;
+}
+
+static const iw_handler zd1201_private_handler[] = {
+        (iw_handler) zd1201_set_hostauth,       /* ZD1201SIWHOSTAUTH */
+        (iw_handler) zd1201_get_hostauth,       /* ZD1201GIWHOSTAUTH */
+        (iw_handler) zd1201_auth_sta,           /* ZD1201SIWAUTHSTA */
+        (iw_handler) NULL,                      /* nothing to get */
+        (iw_handler) zd1201_set_maxassoc,       /* ZD1201SIMAXASSOC */
+        (iw_handler) zd1201_get_maxassoc,       /* ZD1201GIMAXASSOC */
+};
+
+static const struct iw_priv_args zd1201_private_args[] = {
+        { ZD1201SIWHOSTAUTH, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+            IW_PRIV_TYPE_NONE, "sethostauth" },
+        { ZD1201GIWHOSTAUTH, IW_PRIV_TYPE_NONE,
+            IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethostauth" },
+        { ZD1201SIWAUTHSTA, IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1,
+            IW_PRIV_TYPE_NONE, "authstation" },
+        { ZD1201SIWMAXASSOC, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+            IW_PRIV_TYPE_NONE, "setmaxassoc" },
+        { ZD1201GIWMAXASSOC, IW_PRIV_TYPE_NONE,
+            IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getmaxassoc" },
+};
+
+static const struct iw_handler_def zd1201_iw_handlers = {
+        .num_standard           = ARRAY_SIZE(zd1201_iw_handler),
+        .num_private            = ARRAY_SIZE(zd1201_private_handler),
+        .num_private_args       = ARRAY_SIZE(zd1201_private_args),
+        .standard               = (iw_handler *)zd1201_iw_handler,
+        .private                = (iw_handler *)zd1201_private_handler,
+        .private_args           = (struct iw_priv_args *) zd1201_private_args,
+        .get_wireless_stats     = zd1201_get_wireless_stats,
+};
+
+static int zd1201_probe(struct usb_interface *interface,
+                        const struct usb_device_id *id)
+{
+        struct zd1201 *zd;
+        struct usb_device *usb;
+        int err;
+        short porttype;
+        char buf[IW_ESSID_MAX_SIZE+2];
+
+        usb = interface_to_usbdev(interface);
+
+        zd = kzalloc(sizeof(struct zd1201), GFP_KERNEL);
+        if (!zd)
+                return -ENOMEM;
+        zd->ap = ap;
+        zd->usb = usb;
+        zd->removed = 0;
+        init_waitqueue_head(&zd->rxdataq);
+        INIT_HLIST_HEAD(&zd->fraglist);
+        
+        err = zd1201_fw_upload(usb, zd->ap);
+        if (err) {
+                dev_err(&usb->dev, "zd1201 firmware upload failed: %d\n", err);
+                goto err_zd;
+        }
+        
+        zd->endp_in = 1;
+        zd->endp_out = 1;
+        zd->endp_out2 = 2;
+        zd->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        zd->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!zd->rx_urb || !zd->tx_urb)
+                goto err_zd;
+
+        mdelay(100);
+        err = zd1201_drvr_start(zd);
+        if (err)
+                goto err_zd;
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFMAXDATALEN, 2312);
+        if (err)
+                goto err_start;
+
+        err = zd1201_setconfig16(zd, ZD1201_RID_TXRATECNTL,
+            ZD1201_RATEB1 | ZD1201_RATEB2 | ZD1201_RATEB5 | ZD1201_RATEB11);
+        if (err)
+                goto err_start;
+
+        zd->dev = alloc_etherdev(0);
+        if (!zd->dev)
+                goto err_start;
+
+        zd->dev->priv = zd;
+        zd->dev->open = zd1201_net_open;
+        zd->dev->stop = zd1201_net_stop;
+        zd->dev->get_stats = zd1201_get_stats;
+        zd->dev->wireless_handlers =
+            (struct iw_handler_def *)&zd1201_iw_handlers;
+        zd->dev->hard_start_xmit = zd1201_hard_start_xmit;
+        zd->dev->watchdog_timeo = ZD1201_TX_TIMEOUT;
+        zd->dev->tx_timeout = zd1201_tx_timeout;
+        zd->dev->set_multicast_list = zd1201_set_multicast;
+        zd->dev->set_mac_address = zd1201_set_mac_address;
+        strcpy(zd->dev->name, "wlan%d");
+
+        err = zd1201_getconfig(zd, ZD1201_RID_CNFOWNMACADDR, 
+            zd->dev->dev_addr, zd->dev->addr_len);
+        if (err)
+                goto err_net;
+
+        /* Set wildcard essid to match zd->essid */
+        *(__le16 *)buf = cpu_to_le16(0);
+        err = zd1201_setconfig(zd, ZD1201_RID_CNFDESIREDSSID, buf,
+            IW_ESSID_MAX_SIZE+2, 1);
+        if (err)
+                goto err_net;
+
+        if (zd->ap)
+                porttype = ZD1201_PORTTYPE_AP;
+        else
+                porttype = ZD1201_PORTTYPE_BSS;
+        err = zd1201_setconfig16(zd, ZD1201_RID_CNFPORTTYPE, porttype);
+        if (err)
+                goto err_net;
+
+        SET_NETDEV_DEV(zd->dev, &usb->dev);
+
+        err = register_netdev(zd->dev);
+        if (err)
+                goto err_net;
+        dev_info(&usb->dev, "%s: ZD1201 USB Wireless interface\n",
+            zd->dev->name);
+
+        usb_set_intfdata(interface, zd);
+        return 0;
+
+err_net:
+        free_netdev(zd->dev);
+err_start:
+        /* Leave the device in reset state */
+        zd1201_docmd(zd, ZD1201_CMDCODE_INIT, 0, 0, 0);
+err_zd:
+        if (zd->tx_urb)
+                usb_free_urb(zd->tx_urb);
+        if (zd->rx_urb)
+                usb_free_urb(zd->rx_urb);
+        kfree(zd);
+        return err;
+}
+
+static void zd1201_disconnect(struct usb_interface *interface)
+{
+        struct zd1201 *zd=(struct zd1201 *)usb_get_intfdata(interface);
+        struct hlist_node *node, *node2;
+        struct zd1201_frag *frag;
+
+        if (!zd)
+                return;
+        usb_set_intfdata(interface, NULL);
+        if (zd->dev) {
+                unregister_netdev(zd->dev);
+                free_netdev(zd->dev);
+        }
+
+        hlist_for_each_entry_safe(frag, node, node2, &zd->fraglist, fnode) {
+                hlist_del_init(&frag->fnode);
+                kfree_skb(frag->skb);
+                kfree(frag);
+        }
+
+        if (zd->tx_urb) {
+                usb_kill_urb(zd->tx_urb);
+                usb_free_urb(zd->tx_urb);
+        }
+        if (zd->rx_urb) {
+                usb_kill_urb(zd->rx_urb);
+                usb_free_urb(zd->rx_urb);
+        }
+        kfree(zd);
+}
+
+#ifdef CONFIG_PM
+
+static int zd1201_suspend(struct usb_interface *interface,
+                           pm_message_t message)
+{
+        struct zd1201 *zd = usb_get_intfdata(interface);
+
+        netif_device_detach(zd->dev);
+
+        zd->was_enabled = zd->mac_enabled;
+
+        if (zd->was_enabled)
+                return zd1201_disable(zd);
+        else
+                return 0;
+}
+
+static int zd1201_resume(struct usb_interface *interface)
+{
+        struct zd1201 *zd = usb_get_intfdata(interface);
+
+        if (!zd || !zd->dev)
+                return -ENODEV;
+
+        netif_device_attach(zd->dev);
+
+        if (zd->was_enabled)
+                return zd1201_enable(zd);
+        else
+                return 0;
+}
+
+#else
+
+#define zd1201_suspend NULL
+#define zd1201_resume  NULL
+
+#endif
+
+static struct usb_driver zd1201_usb = {
+        .name = "zd1201",
+        .probe = zd1201_probe,
+        .disconnect = zd1201_disconnect,
+        .id_table = zd1201_table,
+        .suspend = zd1201_suspend,
+        .resume = zd1201_resume,
+};
+
+static int __init zd1201_init(void)
+{
+        return usb_register(&zd1201_usb);
+}
+
+static void __exit zd1201_cleanup(void)
+{
+        usb_deregister(&zd1201_usb);
+}
+
+module_init(zd1201_init);
+module_exit(zd1201_cleanup);
diff --git a/drivers/net/wireless/zd1201.h b/drivers/net/wireless/zd1201.h
new file mode 100644
index 00000000000..235f0ee34b2
--- /dev/null
+++ b/drivers/net/wireless/zd1201.h
@@ -0,0 +1,148 @@
+/*
+ *      Copyright (c) 2004, 2005 Jeroen Vreeken (pe1rxq@amsat.org)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      version 2 as published by the Free Software Foundation.
+ *
+ *      Parts of this driver have been derived from a wlan-ng version
+ *      modified by ZyDAS.
+ *      Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
+ */
+
+#ifndef _INCLUDE_ZD1201_H_
+#define _INCLUDE_ZD1201_H_
+
+#define ZD1201_NUMKEYS          4
+#define ZD1201_MAXKEYLEN        13
+#define ZD1201_MAXMULTI         16
+#define ZD1201_FRAGMAX          2500
+#define ZD1201_FRAGMIN          256
+#define ZD1201_RTSMAX           2500
+
+#define ZD1201_RXSIZE           3000
+
+struct zd1201 {
+        struct usb_device       *usb;
+        int                     removed;
+        struct net_device       *dev;
+        struct net_device_stats stats;
+        struct iw_statistics    iwstats;
+
+        int                     endp_in;
+        int                     endp_out;
+        int                     endp_out2;
+        struct urb              *rx_urb;
+        struct urb              *tx_urb;
+
+        unsigned char           rxdata[ZD1201_RXSIZE];
+        int                     rxlen;
+        wait_queue_head_t       rxdataq;
+        int                     rxdatas;
+        struct hlist_head       fraglist;
+        unsigned char           txdata[ZD1201_RXSIZE];
+
+        int                     ap;
+        char                    essid[IW_ESSID_MAX_SIZE+1];
+        int                     essidlen;
+        int                     mac_enabled;
+        int                     was_enabled;
+        int                     monitor;
+        int                     encode_enabled;
+        int                     encode_restricted;
+        unsigned char           encode_keys[ZD1201_NUMKEYS][ZD1201_MAXKEYLEN];
+        int                     encode_keylen[ZD1201_NUMKEYS];
+};
+
+struct zd1201_frag {
+        struct hlist_node       fnode;
+        int                     seq;
+        struct sk_buff          *skb;
+};
+
+#define ZD1201SIWHOSTAUTH SIOCIWFIRSTPRIV
+#define ZD1201GIWHOSTAUTH ZD1201SIWHOSTAUTH+1
+#define ZD1201SIWAUTHSTA SIOCIWFIRSTPRIV+2
+#define ZD1201SIWMAXASSOC SIOCIWFIRSTPRIV+4
+#define ZD1201GIWMAXASSOC ZD1201SIWMAXASSOC+1
+
+#define ZD1201_FW_TIMEOUT       (1000)
+
+#define ZD1201_TX_TIMEOUT       (2000)
+
+#define ZD1201_USB_CMDREQ       0
+#define ZD1201_USB_RESREQ       1
+
+#define ZD1201_CMDCODE_INIT     0x00
+#define ZD1201_CMDCODE_ENABLE   0x01
+#define ZD1201_CMDCODE_DISABLE  0x02
+#define ZD1201_CMDCODE_ALLOC    0x0a
+#define ZD1201_CMDCODE_INQUIRE  0x11
+#define ZD1201_CMDCODE_SETRXRID 0x17
+#define ZD1201_CMDCODE_ACCESS   0x21
+
+#define ZD1201_PACKET_EVENTSTAT 0x0
+#define ZD1201_PACKET_RXDATA    0x1
+#define ZD1201_PACKET_INQUIRE   0x2
+#define ZD1201_PACKET_RESOURCE  0x3
+
+#define ZD1201_ACCESSBIT        0x0100
+
+#define ZD1201_RID_CNFPORTTYPE          0xfc00
+#define ZD1201_RID_CNFOWNMACADDR        0xfc01
+#define ZD1201_RID_CNFDESIREDSSID       0xfc02
+#define ZD1201_RID_CNFOWNCHANNEL        0xfc03
+#define ZD1201_RID_CNFOWNSSID           0xfc04
+#define ZD1201_RID_CNFMAXDATALEN        0xfc07
+#define ZD1201_RID_CNFPMENABLED         0xfc09
+#define ZD1201_RID_CNFPMEPS             0xfc0a
+#define ZD1201_RID_CNFMAXSLEEPDURATION  0xfc0c
+#define ZD1201_RID_CNFDEFAULTKEYID      0xfc23
+#define ZD1201_RID_CNFDEFAULTKEY0       0xfc24
+#define ZD1201_RID_CNFDEFAULTKEY1       0xfc25
+#define ZD1201_RID_CNFDEFAULTKEY2       0xfc26
+#define ZD1201_RID_CNFDEFAULTKEY3       0xfc27
+#define ZD1201_RID_CNFWEBFLAGS          0xfc28
+#define ZD1201_RID_CNFAUTHENTICATION    0xfc2a
+#define ZD1201_RID_CNFMAXASSOCSTATIONS  0xfc2b
+#define ZD1201_RID_CNFHOSTAUTH          0xfc2e
+#define ZD1201_RID_CNFGROUPADDRESS      0xfc80
+#define ZD1201_RID_CNFFRAGTHRESHOLD     0xfc82
+#define ZD1201_RID_CNFRTSTHRESHOLD      0xfc83
+#define ZD1201_RID_TXRATECNTL           0xfc84
+#define ZD1201_RID_PROMISCUOUSMODE      0xfc85
+#define ZD1201_RID_CNFBASICRATES        0xfcb3
+#define ZD1201_RID_AUTHENTICATESTA      0xfce3
+#define ZD1201_RID_CURRENTBSSID         0xfd42
+#define ZD1201_RID_COMMSQUALITY         0xfd43
+#define ZD1201_RID_CURRENTTXRATE        0xfd44
+#define ZD1201_RID_CNFMAXTXBUFFERNUMBER 0xfda0
+#define ZD1201_RID_CURRENTCHANNEL       0xfdc1
+
+#define ZD1201_INQ_SCANRESULTS          0xf101
+
+#define ZD1201_INF_LINKSTATUS           0xf200
+#define ZD1201_INF_ASSOCSTATUS          0xf201
+#define ZD1201_INF_AUTHREQ              0xf202
+
+#define ZD1201_ASSOCSTATUS_STAASSOC     0x1
+#define ZD1201_ASSOCSTATUS_REASSOC      0x2
+#define ZD1201_ASSOCSTATUS_DISASSOC     0x3
+#define ZD1201_ASSOCSTATUS_ASSOCFAIL    0x4
+#define ZD1201_ASSOCSTATUS_AUTHFAIL     0x5
+
+#define ZD1201_PORTTYPE_IBSS            0
+#define ZD1201_PORTTYPE_BSS             1
+#define ZD1201_PORTTYPE_WDS             2
+#define ZD1201_PORTTYPE_PSEUDOIBSS      3
+#define ZD1201_PORTTYPE_AP              6
+
+#define ZD1201_RATEB1   1
+#define ZD1201_RATEB2   2
+#define ZD1201_RATEB5   4       /* 5.5 really, but 5 is shorter :) */
+#define ZD1201_RATEB11  8
+
+#define ZD1201_CNFAUTHENTICATION_OPENSYSTEM     0x0001
+#define ZD1201_CNFAUTHENTICATION_SHAREDKEY      0x0002
+
+#endif /* _INCLUDE_ZD1201_H_ */