Merge branch 'fix/misc' into topic/misc

48 files changed, 245 insertions, 173 deletions

diff --git a/drivers/net/wireless/adm8211.h b/drivers/net/wireless/adm8211.h
index 4f6ab132218..b07e4d3a6b4 100644
--- a/drivers/net/wireless/adm8211.h
+++ b/drivers/net/wireless/adm8211.h
@@ -266,7 +266,7 @@ do {								\
 #define ADM8211_SYNCTL_CS1      (1 << 28)
 #define ADM8211_SYNCTL_CAL      (1 << 27)
 #define ADM8211_SYNCTL_SELCAL   (1 << 26)
-#define ADM8211_SYNCTL_RFtype   ((1 << 24) || (1 << 23) || (1 << 22))
+#define ADM8211_SYNCTL_RFtype   ((1 << 24) | (1 << 23) | (1 << 22))
 #define ADM8211_SYNCTL_RFMD     (1 << 22)
 #define ADM8211_SYNCTL_GENERAL  (0x7 << 22)
 /* SYNCTL 21:0 Data (Si4126: 18-bit data, 4-bit address) */
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7116a1aa20c..abf896a7390 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -4790,9 +4790,8 @@ static int proc_stats_rid_open( struct inode *inode,
 static int get_dec_u16( char *buffer, int *start, int limit ) {
         u16 value;
         int valid = 0;
-        for( value = 0; buffer[*start] >= '0' &&
-                     buffer[*start] <= '9' &&
-                     *start < limit; (*start)++ ) {
+        for (value = 0; *start < limit && buffer[*start] >= '0' &&
+                        buffer[*start] <= '9'; (*start)++) {
                 valid = 1;
                 value *= 10;
                 value += buffer[*start] - '0';
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 16a271787b8..1895d63aad0 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -679,7 +679,7 @@ static u8 ath_rc_get_highest_rix(struct ath_softc *sc,
                 return rate;
 
         if (rate_table->info[rate].valid_single_stream &&
-            !(ath_rc_priv->ht_cap & WLAN_RC_DS_FLAG));
+            !(ath_rc_priv->ht_cap & WLAN_RC_DS_FLAG))
                 return rate;
 
         /* This should not happen */
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fa1549a03c7..660716214d4 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -607,82 +607,7 @@ struct b43_qos_params {
         struct ieee80211_tx_queue_params p;
 };
 
-struct b43_wldev;
-
-/* Data structure for the WLAN parts (802.11 cores) of the b43 chip. */
-struct b43_wl {
-        /* Pointer to the active wireless device on this chip */
-        struct b43_wldev *current_dev;
-        /* Pointer to the ieee80211 hardware data structure */
-        struct ieee80211_hw *hw;
-
-        /* Global driver mutex. Every operation must run with this mutex locked. */
-        struct mutex mutex;
-        /* Hard-IRQ spinlock. This lock protects things used in the hard-IRQ
-         * handler, only. This basically is just the IRQ mask register. */
-        spinlock_t hardirq_lock;
-
-        /* The number of queues that were registered with the mac80211 subsystem
-         * initially. This is a backup copy of hw->queues in case hw->queues has
-         * to be dynamically lowered at runtime (Firmware does not support QoS).
-         * hw->queues has to be restored to the original value before unregistering
-         * from the mac80211 subsystem. */
-        u16 mac80211_initially_registered_queues;
-
-        /* We can only have one operating interface (802.11 core)
-         * at a time. General information about this interface follows.
-         */
-
-        struct ieee80211_vif *vif;
-        /* The MAC address of the operating interface. */
-        u8 mac_addr[ETH_ALEN];
-        /* Current BSSID */
-        u8 bssid[ETH_ALEN];
-        /* Interface type. (NL80211_IFTYPE_XXX) */
-        int if_type;
-        /* Is the card operating in AP, STA or IBSS mode? */
-        bool operating;
-        /* filter flags */
-        unsigned int filter_flags;
-        /* Stats about the wireless interface */
-        struct ieee80211_low_level_stats ieee_stats;
-
-#ifdef CONFIG_B43_HWRNG
-        struct hwrng rng;
-        bool rng_initialized;
-        char rng_name[30 + 1];
-#endif /* CONFIG_B43_HWRNG */
-
-        /* List of all wireless devices on this chip */
-        struct list_head devlist;
-        u8 nr_devs;
-
-        bool radiotap_enabled;
-        bool radio_enabled;
-
-        /* The beacon we are currently using (AP or IBSS mode). */
-        struct sk_buff *current_beacon;
-        bool beacon0_uploaded;
-        bool beacon1_uploaded;
-        bool beacon_templates_virgin; /* Never wrote the templates? */
-        struct work_struct beacon_update_trigger;
-
-        /* The current QOS parameters for the 4 queues. */
-        struct b43_qos_params qos_params[4];
-
-        /* Work for adjustment of the transmission power.
-         * This is scheduled when we determine that the actual TX output
-         * power doesn't match what we want. */
-        struct work_struct txpower_adjust_work;
-
-        /* Packet transmit work */
-        struct work_struct tx_work;
-        /* Queue of packets to be transmitted. */
-        struct sk_buff_head tx_queue;
-
-        /* The device LEDs. */
-        struct b43_leds leds;
-};
+struct b43_wl;
 
 /* The type of the firmware file. */
 enum b43_firmware_file_type {
@@ -824,6 +749,97 @@ struct b43_wldev {
 #endif
 };
 
+/*
+ * Include goes here to avoid a dependency problem.
+ * A better fix would be to integrate xmit.h into b43.h.
+ */
+#include "xmit.h"
+
+/* Data structure for the WLAN parts (802.11 cores) of the b43 chip. */
+struct b43_wl {
+        /* Pointer to the active wireless device on this chip */
+        struct b43_wldev *current_dev;
+        /* Pointer to the ieee80211 hardware data structure */
+        struct ieee80211_hw *hw;
+
+        /* Global driver mutex. Every operation must run with this mutex locked. */
+        struct mutex mutex;
+        /* Hard-IRQ spinlock. This lock protects things used in the hard-IRQ
+         * handler, only. This basically is just the IRQ mask register. */
+        spinlock_t hardirq_lock;
+
+        /* The number of queues that were registered with the mac80211 subsystem
+         * initially. This is a backup copy of hw->queues in case hw->queues has
+         * to be dynamically lowered at runtime (Firmware does not support QoS).
+         * hw->queues has to be restored to the original value before unregistering
+         * from the mac80211 subsystem. */
+        u16 mac80211_initially_registered_queues;
+
+        /* We can only have one operating interface (802.11 core)
+         * at a time. General information about this interface follows.
+         */
+
+        struct ieee80211_vif *vif;
+        /* The MAC address of the operating interface. */
+        u8 mac_addr[ETH_ALEN];
+        /* Current BSSID */
+        u8 bssid[ETH_ALEN];
+        /* Interface type. (NL80211_IFTYPE_XXX) */
+        int if_type;
+        /* Is the card operating in AP, STA or IBSS mode? */
+        bool operating;
+        /* filter flags */
+        unsigned int filter_flags;
+        /* Stats about the wireless interface */
+        struct ieee80211_low_level_stats ieee_stats;
+
+#ifdef CONFIG_B43_HWRNG
+        struct hwrng rng;
+        bool rng_initialized;
+        char rng_name[30 + 1];
+#endif /* CONFIG_B43_HWRNG */
+
+        /* List of all wireless devices on this chip */
+        struct list_head devlist;
+        u8 nr_devs;
+
+        bool radiotap_enabled;
+        bool radio_enabled;
+
+        /* The beacon we are currently using (AP or IBSS mode). */
+        struct sk_buff *current_beacon;
+        bool beacon0_uploaded;
+        bool beacon1_uploaded;
+        bool beacon_templates_virgin; /* Never wrote the templates? */
+        struct work_struct beacon_update_trigger;
+
+        /* The current QOS parameters for the 4 queues. */
+        struct b43_qos_params qos_params[4];
+
+        /* Work for adjustment of the transmission power.
+         * This is scheduled when we determine that the actual TX output
+         * power doesn't match what we want. */
+        struct work_struct txpower_adjust_work;
+
+        /* Packet transmit work */
+        struct work_struct tx_work;
+        /* Queue of packets to be transmitted. */
+        struct sk_buff_head tx_queue;
+
+        /* The device LEDs. */
+        struct b43_leds leds;
+
+#ifdef CONFIG_B43_PIO
+        /*
+         * RX/TX header/tail buffers used by the frame transmit functions.
+         */
+        struct b43_rxhdr_fw4 rxhdr;
+        struct b43_txhdr txhdr;
+        u8 rx_tail[4];
+        u8 tx_tail[4];
+#endif /* CONFIG_B43_PIO */
+};
+
 static inline struct b43_wl *hw_to_b43_wl(struct ieee80211_hw *hw)
 {
         return hw->priv;
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 8701034569f..de4e804bedf 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1157,8 +1157,9 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
 }
 
 static int dma_tx_fragment(struct b43_dmaring *ring,
-                           struct sk_buff *skb)
+                           struct sk_buff **in_skb)
 {
+        struct sk_buff *skb = *in_skb;
         const struct b43_dma_ops *ops = ring->ops;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u8 *header;
@@ -1224,8 +1225,14 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
                 }
 
                 memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+                bounce_skb->dev = skb->dev;
+                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+                info = IEEE80211_SKB_CB(bounce_skb);
+
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
+                *in_skb = bounce_skb;
                 meta->skb = skb;
                 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
                 if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1355,7 +1362,11 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
          * static, so we don't need to store it per frame. */
         ring->queue_prio = skb_get_queue_mapping(skb);
 
-        err = dma_tx_fragment(ring, skb);
+        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+         * into the skb data or cb now. */
+        hdr = NULL;
+        info = NULL;
+        err = dma_tx_fragment(ring, &skb);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
                  * anymore and must not transmit it unencrypted. */
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index fbe3d4f62ce..1e8dba48800 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -348,9 +348,9 @@ void b43_leds_register(struct b43_wldev *dev)
         }
 }
 
-void b43_leds_unregister(struct b43_wldev *dev)
+void b43_leds_unregister(struct b43_wl *wl)
 {
-        struct b43_leds *leds = &dev->wl->leds;
+        struct b43_leds *leds = &wl->leds;
 
         b43_unregister_led(&leds->led_tx);
         b43_unregister_led(&leds->led_rx);
diff --git a/drivers/net/wireless/b43/leds.h b/drivers/net/wireless/b43/leds.h
index 9592e4c5a5f..32b66d53cda 100644
--- a/drivers/net/wireless/b43/leds.h
+++ b/drivers/net/wireless/b43/leds.h
@@ -1,6 +1,7 @@
 #ifndef B43_LEDS_H_
 #define B43_LEDS_H_
 
+struct b43_wl;
 struct b43_wldev;
 
 #ifdef CONFIG_B43_LEDS
@@ -60,7 +61,7 @@ enum b43_led_behaviour {
 };
 
 void b43_leds_register(struct b43_wldev *dev);
-void b43_leds_unregister(struct b43_wldev *dev);
+void b43_leds_unregister(struct b43_wl *wl);
 void b43_leds_init(struct b43_wldev *dev);
 void b43_leds_exit(struct b43_wldev *dev);
 void b43_leds_stop(struct b43_wldev *dev);
@@ -76,7 +77,7 @@ struct b43_leds {
 static inline void b43_leds_register(struct b43_wldev *dev)
 {
 }
-static inline void b43_leds_unregister(struct b43_wldev *dev)
+static inline void b43_leds_unregister(struct b43_wl *wl)
 {
 }
 static inline void b43_leds_init(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 9b907a36bb8..86f35827f00 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3874,6 +3874,7 @@ static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
         struct b43_wldev *orig_dev;
+        u32 mask;
 
 redo:
         if (!dev || b43_status(dev) < B43_STAT_STARTED)
@@ -3920,7 +3921,8 @@ redo:
                         goto redo;
                 return dev;
         }
-        B43_WARN_ON(b43_read32(dev, B43_MMIO_GEN_IRQ_MASK));
+        mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
+        B43_WARN_ON(mask != 0xFFFFFFFF && mask);
 
         /* Drain the TX queue */
         while (skb_queue_len(&wl->tx_queue))
@@ -4997,7 +4999,7 @@ static void b43_remove(struct ssb_device *dev)
 
         if (list_empty(&wl->devlist)) {
                 b43_rng_exit(wl);
-                b43_leds_unregister(wldev);
+                b43_leds_unregister(wl);
                 /* Last core on the chip unregistered.
                  * We can destroy common struct b43_wl.
                  */
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index 9c1397996e0..9b904440021 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -30,6 +30,7 @@
 #include "xmit.h"
 
 #include <linux/delay.h>
+#include <linux/sched.h>
 
 
 static u16 generate_cookie(struct b43_pio_txqueue *q,
@@ -331,6 +332,7 @@ static u16 tx_write_2byte_queue(struct b43_pio_txqueue *q,
                                 unsigned int data_len)
 {
         struct b43_wldev *dev = q->dev;
+        struct b43_wl *wl = dev->wl;
         const u8 *data = _data;
 
         ctl |= B43_PIO_TXCTL_WRITELO | B43_PIO_TXCTL_WRITEHI;
@@ -340,13 +342,12 @@ static u16 tx_write_2byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO_TXDATA,
                         sizeof(u16));
         if (data_len & 1) {
-                u8 tail[2] = { 0, };
-
                 /* Write the last byte. */
                 ctl &= ~B43_PIO_TXCTL_WRITEHI;
                 b43_piotx_write16(q, B43_PIO_TXCTL, ctl);
-                tail[0] = data[data_len - 1];
-                ssb_block_write(dev->dev, tail, 2,
+                wl->tx_tail[0] = data[data_len - 1];
+                wl->tx_tail[1] = 0;
+                ssb_block_write(dev->dev, wl->tx_tail, 2,
                                 q->mmio_base + B43_PIO_TXDATA,
                                 sizeof(u16));
         }
@@ -381,6 +382,7 @@ static u32 tx_write_4byte_queue(struct b43_pio_txqueue *q,
                                 unsigned int data_len)
 {
         struct b43_wldev *dev = q->dev;
+        struct b43_wl *wl = dev->wl;
         const u8 *data = _data;
 
         ctl |= B43_PIO8_TXCTL_0_7 | B43_PIO8_TXCTL_8_15 |
@@ -391,29 +393,31 @@ static u32 tx_write_4byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO8_TXDATA,
                         sizeof(u32));
         if (data_len & 3) {
-                u8 tail[4] = { 0, };
-
+                wl->tx_tail[3] = 0;
                 /* Write the last few bytes. */
                 ctl &= ~(B43_PIO8_TXCTL_8_15 | B43_PIO8_TXCTL_16_23 |
                          B43_PIO8_TXCTL_24_31);
                 switch (data_len & 3) {
                 case 3:
                         ctl |= B43_PIO8_TXCTL_16_23 | B43_PIO8_TXCTL_8_15;
-                        tail[0] = data[data_len - 3];
-                        tail[1] = data[data_len - 2];
-                        tail[2] = data[data_len - 1];
+                        wl->tx_tail[0] = data[data_len - 3];
+                        wl->tx_tail[1] = data[data_len - 2];
+                        wl->tx_tail[2] = data[data_len - 1];
                         break;
                 case 2:
                         ctl |= B43_PIO8_TXCTL_8_15;
-                        tail[0] = data[data_len - 2];
-                        tail[1] = data[data_len - 1];
+                        wl->tx_tail[0] = data[data_len - 2];
+                        wl->tx_tail[1] = data[data_len - 1];
+                        wl->tx_tail[2] = 0;
                         break;
                 case 1:
-                        tail[0] = data[data_len - 1];
+                        wl->tx_tail[0] = data[data_len - 1];
+                        wl->tx_tail[1] = 0;
+                        wl->tx_tail[2] = 0;
                         break;
                 }
                 b43_piotx_write32(q, B43_PIO8_TXCTL, ctl);
-                ssb_block_write(dev->dev, tail, 4,
+                ssb_block_write(dev->dev, wl->tx_tail, 4,
                                 q->mmio_base + B43_PIO8_TXDATA,
                                 sizeof(u32));
         }
@@ -445,8 +449,9 @@ static void pio_tx_frame_4byte_queue(struct b43_pio_txpacket *pack,
 static int pio_tx_frame(struct b43_pio_txqueue *q,
                         struct sk_buff *skb)
 {
+        struct b43_wldev *dev = q->dev;
+        struct b43_wl *wl = dev->wl;
         struct b43_pio_txpacket *pack;
-        struct b43_txhdr txhdr;
         u16 cookie;
         int err;
         unsigned int hdrlen;
@@ -457,8 +462,8 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
                           struct b43_pio_txpacket, list);
 
         cookie = generate_cookie(q, pack);
-        hdrlen = b43_txhdr_size(q->dev);
-        err = b43_generate_txhdr(q->dev, (u8 *)&txhdr, skb,
+        hdrlen = b43_txhdr_size(dev);
+        err = b43_generate_txhdr(dev, (u8 *)&wl->txhdr, skb,
                                  info, cookie);
         if (err)
                 return err;
@@ -466,15 +471,15 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
         if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
                 /* Tell the firmware about the cookie of the last
                  * mcast frame, so it can clear the more-data bit in it. */
-                b43_shm_write16(q->dev, B43_SHM_SHARED,
+                b43_shm_write16(dev, B43_SHM_SHARED,
                                 B43_SHM_SH_MCASTCOOKIE, cookie);
         }
 
         pack->skb = skb;
         if (q->rev >= 8)
-                pio_tx_frame_4byte_queue(pack, (const u8 *)&txhdr, hdrlen);
+                pio_tx_frame_4byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
         else
-                pio_tx_frame_2byte_queue(pack, (const u8 *)&txhdr, hdrlen);
+                pio_tx_frame_2byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
 
         /* Remove it from the list of available packet slots.
          * It will be put back when we receive the status report. */
@@ -614,14 +619,14 @@ void b43_pio_get_tx_stats(struct b43_wldev *dev,
 static bool pio_rx_frame(struct b43_pio_rxqueue *q)
 {
         struct b43_wldev *dev = q->dev;
-        struct b43_rxhdr_fw4 rxhdr;
+        struct b43_wl *wl = dev->wl;
         u16 len;
         u32 macstat;
         unsigned int i, padding;
         struct sk_buff *skb;
         const char *err_msg = NULL;
 
-        memset(&rxhdr, 0, sizeof(rxhdr));
+        memset(&wl->rxhdr, 0, sizeof(wl->rxhdr));
 
         /* Check if we have data and wait for it to get ready. */
         if (q->rev >= 8) {
@@ -659,16 +664,16 @@ data_ready:
 
         /* Get the preamble (RX header) */
         if (q->rev >= 8) {
-                ssb_block_read(dev->dev, &rxhdr, sizeof(rxhdr),
+                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
         } else {
-                ssb_block_read(dev->dev, &rxhdr, sizeof(rxhdr),
+                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
         }
         /* Sanity checks. */
-        len = le16_to_cpu(rxhdr.frame_len);
+        len = le16_to_cpu(wl->rxhdr.frame_len);
         if (unlikely(len > 0x700)) {
                 err_msg = "len > 0x700";
                 goto rx_error;
@@ -678,7 +683,7 @@ data_ready:
                 goto rx_error;
         }
 
-        macstat = le32_to_cpu(rxhdr.mac_status);
+        macstat = le32_to_cpu(wl->rxhdr.mac_status);
         if (macstat & B43_RX_MAC_FCSERR) {
                 if (!(q->dev->wl->filter_flags & FIF_FCSFAIL)) {
                         /* Drop frames with failed FCS. */
@@ -703,24 +708,22 @@ data_ready:
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
                 if (len & 3) {
-                        u8 tail[4] = { 0, };
-
                         /* Read the last few bytes. */
-                        ssb_block_read(dev->dev, tail, 4,
+                        ssb_block_read(dev->dev, wl->rx_tail, 4,
                                        q->mmio_base + B43_PIO8_RXDATA,
                                        sizeof(u32));
                         switch (len & 3) {
                         case 3:
-                                skb->data[len + padding - 3] = tail[0];
-                                skb->data[len + padding - 2] = tail[1];
-                                skb->data[len + padding - 1] = tail[2];
+                                skb->data[len + padding - 3] = wl->rx_tail[0];
+                                skb->data[len + padding - 2] = wl->rx_tail[1];
+                                skb->data[len + padding - 1] = wl->rx_tail[2];
                                 break;
                         case 2:
-                                skb->data[len + padding - 2] = tail[0];
-                                skb->data[len + padding - 1] = tail[1];
+                                skb->data[len + padding - 2] = wl->rx_tail[0];
+                                skb->data[len + padding - 1] = wl->rx_tail[1];
                                 break;
                         case 1:
-                                skb->data[len + padding - 1] = tail[0];
+                                skb->data[len + padding - 1] = wl->rx_tail[0];
                                 break;
                         }
                 }
@@ -729,17 +732,15 @@ data_ready:
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
                 if (len & 1) {
-                        u8 tail[2] = { 0, };
-
                         /* Read the last byte. */
-                        ssb_block_read(dev->dev, tail, 2,
+                        ssb_block_read(dev->dev, wl->rx_tail, 2,
                                        q->mmio_base + B43_PIO_RXDATA,
                                        sizeof(u16));
-                        skb->data[len + padding - 1] = tail[0];
+                        skb->data[len + padding - 1] = wl->rx_tail[0];
                 }
         }
 
-        b43_rx(q->dev, skb, &rxhdr);
+        b43_rx(q->dev, skb, &wl->rxhdr);
 
         return 1;
 
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 7a3218c5ba7..ffdce6f3c90 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -33,7 +33,8 @@ bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
                       & B43_MMIO_RADIO_HWENABLED_HI_MASK))
                         return 1;
         } else {
-                if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+                if (b43_status(dev) >= B43_STAT_STARTED &&
+                    b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
                     & B43_MMIO_RADIO_HWENABLED_LO_MASK)
                         return 1;
         }
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index ac9f600995e..f4e9695ec18 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -27,7 +27,7 @@
 
 */
 
-#include "xmit.h"
+#include "b43.h"
 #include "phy_common.h"
 #include "dma.h"
 #include "pio.h"
@@ -690,7 +690,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         }
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+        local_bh_disable();
         ieee80211_rx(dev->wl->hw, skb);
+        local_bh_enable();
 
 #if B43_DEBUG
         dev->rx_count++;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 1d9223b3d4c..4b60148a5e6 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -37,6 +37,7 @@
 #include <linux/firmware.h>
 #include <linux/wireless.h>
 #include <linux/workqueue.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/dma-mapping.h>
 #include <net/dst.h>
diff --git a/drivers/net/wireless/b43legacy/phy.c b/drivers/net/wireless/b43legacy/phy.c
index 11319ec2d64..aaf227203a9 100644
--- a/drivers/net/wireless/b43legacy/phy.c
+++ b/drivers/net/wireless/b43legacy/phy.c
@@ -31,6 +31,7 @@
 
 #include <linux/delay.h>
 #include <linux/pci.h>
+#include <linux/sched.h>
 #include <linux/types.h>
 
 #include "b43legacy.h"
diff --git a/drivers/net/wireless/hostap/hostap_info.c b/drivers/net/wireless/hostap/hostap_info.c
index 6fa14a4e4b5..4dfb40a84c9 100644
--- a/drivers/net/wireless/hostap/hostap_info.c
+++ b/drivers/net/wireless/hostap/hostap_info.c
@@ -1,6 +1,7 @@
 /* Host AP driver Info Frame processing (part of hostap.o module) */
 
 #include <linux/if_arp.h>
+#include <linux/sched.h>
 #include "hostap_wlan.h"
 #include "hostap.h"
 #include "hostap_ap.h"
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 3f2bda881a4..9419cebca8a 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1,6 +1,7 @@
 /* ioctl() (mostly Linux Wireless Extensions) routines for Host AP driver */
 
 #include <linux/types.h>
+#include <linux/sched.h>
 #include <linux/ethtool.h>
 #include <linux/if_arp.h>
 #include <net/lib80211.h>
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 240cff1e697..a741d37fd96 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6325,8 +6325,10 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
       fail:
         if (dev) {
-                if (registered)
+                if (registered) {
+                        unregister_ieee80211(priv->ieee);
                         unregister_netdev(dev);
+                }
 
                 ipw2100_hw_stop_adapter(priv);
 
@@ -6383,6 +6385,7 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
                 /* Unregister the device first - this results in close()
                  * being called if the device is open.  If we free storage
                  * first, then close() will crash. */
+                unregister_ieee80211(priv->ieee);
                 unregister_netdev(dev);
 
                 /* ipw2100_down will ensure that there is no more pending work
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 8d58e6ed4e7..9b0f2c0646e 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -30,6 +30,7 @@
 
 ******************************************************************************/
 
+#include <linux/sched.h>
 #include "ipw2200.h"
 
 
@@ -11821,6 +11822,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                 if (err) {
                         IPW_ERROR("Failed to register promiscuous network "
                                   "device (error %d).\n", err);
+                        unregister_ieee80211(priv->ieee);
                         unregister_netdev(priv->net_dev);
                         goto out_remove_sysfs;
                 }
@@ -11871,6 +11873,7 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
 
         mutex_unlock(&priv->mutex);
 
+        unregister_ieee80211(priv->ieee);
         unregister_netdev(priv->net_dev);
 
         if (priv->rxq) {
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index bf45391172f..f42ade6c2d3 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -1020,6 +1020,7 @@ static inline int libipw_is_cck_rate(u8 rate)
 /* ieee80211.c */
 extern void free_ieee80211(struct net_device *dev, int monitor);
 extern struct net_device *alloc_ieee80211(int sizeof_priv, int monitor);
+extern void unregister_ieee80211(struct libipw_device *ieee);
 extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
 
 extern void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index a0e9f6aed7d..be5b809ec97 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -235,16 +235,19 @@ void free_ieee80211(struct net_device *dev, int monitor)
         libipw_networks_free(ieee);
 
         /* free cfg80211 resources */
-        if (!monitor) {
-                wiphy_unregister(ieee->wdev.wiphy);
-                kfree(ieee->a_band.channels);
-                kfree(ieee->bg_band.channels);
+        if (!monitor)
                 wiphy_free(ieee->wdev.wiphy);
-        }
 
         free_netdev(dev);
 }
 
+void unregister_ieee80211(struct libipw_device *ieee)
+{
+        wiphy_unregister(ieee->wdev.wiphy);
+        kfree(ieee->a_band.channels);
+        kfree(ieee->bg_band.channels);
+}
+
 #ifdef CONFIG_LIBIPW_DEBUG
 
 static int debug = 0;
@@ -330,3 +333,4 @@ module_init(libipw_init);
 
 EXPORT_SYMBOL(alloc_ieee80211);
 EXPORT_SYMBOL(free_ieee80211);
+EXPORT_SYMBOL(unregister_ieee80211);
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index a16bd4147ea..cbb0585083a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -702,7 +702,7 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
                 u8 sta_id = iwl_find_station(priv, hdr->addr1);
 
                 if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pm\n",
+                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
                                        hdr->addr1);
                         sta_id = iwl_add_station(priv, hdr->addr1, false,
                                 CMD_ASYNC, NULL);
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index e70c5b0af36..f059b49dc69 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -610,7 +611,7 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
         if (rx_status.band == IEEE80211_BAND_5GHZ)
                 rx_status.rate_idx -= IWL_FIRST_OFDM_RATE;
 
-        rx_status.antenna = le16_to_cpu(rx_hdr->phy_flags &
+        rx_status.antenna = (le16_to_cpu(rx_hdr->phy_flags) &
                                         RX_RES_PHY_FLAGS_ANTENNA_MSK) >> 4;
 
         /* set the preamble flag if appropriate */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index a22a0501c19..6f703a04184 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index eb08f441100..6e6f516ba40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -29,6 +29,7 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -317,7 +318,7 @@ static void iwl5000_gain_computation(struct iwl_priv *priv,
                         (s32)average_noise[i])) / 1500;
                 /* bound gain by 2 bits value max, 3rd bit is sign */
                 data->delta_gain_code[i] =
-                        min(abs(delta_g), CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
+                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
 
                 if (delta_g < 0)
                         /* set negative sign */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index cdc07c47745..eaafae091f5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -33,6 +33,7 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -3105,8 +3106,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  out_pci_disable_device:
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
-        ieee80211_free_hw(priv->hw);
         iwl_free_traffic_mem(priv);
+        ieee80211_free_hw(priv->hw);
  out:
         return err;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 2c5c88fc38f..4afaf773aea 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -1154,7 +1154,7 @@ struct iwl_wep_cmd {
 #define RX_RES_PHY_FLAGS_MOD_CCK_MSK            cpu_to_le16(1 << 1)
 #define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     cpu_to_le16(1 << 2)
 #define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        cpu_to_le16(1 << 3)
-#define RX_RES_PHY_FLAGS_ANTENNA_MSK            cpu_to_le16(0xf0)
+#define RX_RES_PHY_FLAGS_ANTENNA_MSK            0xf0
 #define RX_RES_PHY_FLAGS_ANTENNA_POS            4
 
 #define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 484d5c1a731..2dc92875545 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -29,6 +29,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
+#include <linux/sched.h>
 #include <net/mac80211.h>
 
 #include "iwl-eeprom.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 3d2b93a61e6..e14c9952a93 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -410,7 +410,6 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                                         u16 *validblockaddr)
 {
         u16 next_link_addr = 0, link_value = 0, valid_addr;
-        int ret = 0;
         int usedblocks = 0;
 
         /* set addressing mode to absolute to traverse the link list */
@@ -430,29 +429,29 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                  * check for more block on the link list
                  */
                 valid_addr = next_link_addr;
-                next_link_addr = link_value;
+                next_link_addr = link_value * sizeof(u16);
                 IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
                                usedblocks, next_link_addr);
                 if (iwl_read_otp_word(priv, next_link_addr, &link_value))
                         return -EINVAL;
                 if (!link_value) {
                         /*
-                         * reach the end of link list,
+                         * reach the end of link list, return success and
                          * set address point to the starting address
                          * of the image
                          */
-                        goto done;
+                        *validblockaddr = valid_addr;
+                        /* skip first 2 bytes (link list pointer) */
+                        *validblockaddr += 2;
+                        return 0;
                 }
                 /* more in the link list, continue */
                 usedblocks++;
-        } while (usedblocks < priv->cfg->max_ll_items);
-        /* OTP full, use last block */
-        IWL_DEBUG_INFO(priv, "OTP is full, use last block\n");
-done:
-        *validblockaddr = valid_addr;
-        /* skip first 2 bytes (link list pointer) */
-        *validblockaddr += 2;
-        return ret;
+        } while (usedblocks <= priv->cfg->max_ll_items);
+
+        /* OTP has no valid blocks */
+        IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n");
+        return -EINVAL;
 }
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 6b68db7b1b8..80b9e45d9b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -220,35 +220,35 @@ struct iwl_eeprom_enhanced_txpwr {
  * Section 10: 2.4 GHz 40MHz channels: 132, 44 (_above_)
  */
 /* 2.4 GHz band: CCK */
-#define EEPROM_LB_CCK_20_COMMON       ((0xAA)\
+#define EEPROM_LB_CCK_20_COMMON       ((0xA8)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 8 bytes */
 /* 2.4 GHz band: 20MHz-Legacy, 20MHz-HT, 40MHz-HT */
-#define EEPROM_LB_OFDM_COMMON       ((0xB2)\
+#define EEPROM_LB_OFDM_COMMON       ((0xB0)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
 /* 5.2 GHz band: 20MHz-Legacy, 20MHz-HT, 40MHz-HT */
-#define EEPROM_HB_OFDM_COMMON       ((0xCA)\
+#define EEPROM_HB_OFDM_COMMON       ((0xC8)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
 /* 2.4GHz band channels:
  *      1Legacy, 1HT, 2Legacy, 2HT, 10Legacy, 10HT, 11Legacy, 11HT */
-#define EEPROM_LB_OFDM_20_BAND       ((0xE2)\
+#define EEPROM_LB_OFDM_20_BAND       ((0xE0)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 64 bytes */
 /* 2.4 GHz band HT40 channels: (1,+1) (2,+1) (6,+1) (7,+1) (9,+1) */
-#define EEPROM_LB_OFDM_HT40_BAND       ((0x122)\
+#define EEPROM_LB_OFDM_HT40_BAND       ((0x120)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 40 bytes */
 /* 5.2GHz band channels: 36Legacy, 36HT, 64Legacy, 64HT, 100Legacy, 100HT */
-#define EEPROM_HB_OFDM_20_BAND       ((0x14A)\
+#define EEPROM_HB_OFDM_20_BAND       ((0x148)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 48 bytes */
 /* 5.2 GHz band HT40 channels: (36,+1) (60,+1) (100,+1) */
-#define EEPROM_HB_OFDM_HT40_BAND       ((0x17A)\
+#define EEPROM_HB_OFDM_HT40_BAND       ((0x178)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
 /* 2.4 GHz band, channnel 13: Legacy, HT */
-#define EEPROM_LB_OFDM_20_CHANNEL_13       ((0x192)\
+#define EEPROM_LB_OFDM_20_CHANNEL_13       ((0x190)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 16 bytes */
 /* 5.2 GHz band, channnel 140: Legacy, HT */
-#define EEPROM_HB_OFDM_20_CHANNEL_140       ((0x1A2)\
+#define EEPROM_HB_OFDM_20_CHANNEL_140       ((0x1A0)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 16 bytes */
 /* 5.2 GHz band, HT40 channnels (132,+1) (44,+1) */
-#define EEPROM_HB_OFDM_HT40_BAND_1       ((0x1B2)\
+#define EEPROM_HB_OFDM_HT40_BAND_1       ((0x1B0)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 16 bytes */
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 532c8d6cd8d..a6856daf14c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -28,6 +28,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <net/mac80211.h>
 
 #include "iwl-dev.h" /* FIXME: remove */
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 8e1bb53c0aa..493626bcd3e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1044,7 +1044,7 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
          * as a bitmask.
          */
         rx_status.antenna =
-                le16_to_cpu(phy_res->phy_flags & RX_RES_PHY_FLAGS_ANTENNA_MSK)
+                (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
                 >> RX_RES_PHY_FLAGS_ANTENNA_POS;
 
         /* set the preamble flag if appropriate */
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index c1890754470..fb9bcfa6d94 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -28,6 +28,7 @@
  *****************************************************************************/
 
 #include <linux/etherdevice.h>
+#include <linux/sched.h>
 #include <net/mac80211.h>
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c390dbd877e..d00a8033409 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -33,6 +33,7 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -4096,8 +4097,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
-        ieee80211_free_hw(priv->hw);
         iwl_free_traffic_mem(priv);
+        ieee80211_free_hw(priv->hw);
  out:
         return err;
 }
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index a56a2b0ac99..f3c55658225 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -23,6 +23,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/sched.h>
 #include <linux/etherdevice.h>
 #include <linux/wireless.h>
 #include <linux/ieee80211.h>
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 23b52fa2605..84158b6d35d 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -40,6 +40,7 @@
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
+#include <linux/sched.h>
 
 #include "iwm.h"
 #include "bus.h"
diff --git a/drivers/net/wireless/iwmc3200wifi/main.c b/drivers/net/wireless/iwmc3200wifi/main.c
index d668e475632..222eb2cf1b3 100644
--- a/drivers/net/wireless/iwmc3200wifi/main.c
+++ b/drivers/net/wireless/iwmc3200wifi/main.c
@@ -38,6 +38,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/sched.h>
 #include <linux/ieee80211.h>
 #include <linux/wireless.h>
 
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 40dbcbc1659..771a301003c 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -38,6 +38,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/sched.h>
 #include <linux/etherdevice.h>
 #include <linux/wireless.h>
 #include <linux/ieee80211.h>
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 685098148e1..0a324dcd264 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -6,6 +6,7 @@
 #include <net/iw_handler.h>
 #include <net/lib80211.h>
 #include <linux/kfifo.h>
+#include <linux/sched.h>
 #include "host.h"
 #include "hostcmd.h"
 #include "decl.h"
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index c42d3faa266..23f684337fd 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -3,6 +3,7 @@
   * responses as well as events generated by firmware.
   */
 #include <linux/delay.h>
+#include <linux/sched.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
 #include <asm/unaligned.h>
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index cb8be8d7abc..5b3672c4d0c 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -134,7 +134,7 @@ static void spu_transaction_finish(struct if_spi_card *card)
 static int spu_write(struct if_spi_card *card, u16 reg, const u8 *buf, int len)
 {
         int err = 0;
-        u16 reg_out = cpu_to_le16(reg | IF_SPI_WRITE_OPERATION_MASK);
+        __le16 reg_out = cpu_to_le16(reg | IF_SPI_WRITE_OPERATION_MASK);
         struct spi_message m;
         struct spi_transfer reg_trans;
         struct spi_transfer data_trans;
@@ -166,7 +166,7 @@ static int spu_write(struct if_spi_card *card, u16 reg, const u8 *buf, int len)
 
 static inline int spu_write_u16(struct if_spi_card *card, u16 reg, u16 val)
 {
-        u16 buff;
+        __le16 buff;
 
         buff = cpu_to_le16(val);
         return spu_write(card, reg, (u8 *)&buff, sizeof(u16));
@@ -188,7 +188,7 @@ static int spu_read(struct if_spi_card *card, u16 reg, u8 *buf, int len)
 {
         unsigned int delay;
         int err = 0;
-        u16 reg_out = cpu_to_le16(reg | IF_SPI_READ_OPERATION_MASK);
+        __le16 reg_out = cpu_to_le16(reg | IF_SPI_READ_OPERATION_MASK);
         struct spi_message m;
         struct spi_transfer reg_trans;
         struct spi_transfer dummy_trans;
@@ -235,7 +235,7 @@ static int spu_read(struct if_spi_card *card, u16 reg, u8 *buf, int len)
 /* Read 16 bits from an SPI register */
 static inline int spu_read_u16(struct if_spi_card *card, u16 reg, u16 *val)
 {
-        u16 buf;
+        __le16 buf;
         int ret;
 
         ret = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
@@ -248,7 +248,7 @@ static inline int spu_read_u16(struct if_spi_card *card, u16 reg, u16 *val)
  * The low 16 bits are read first. */
 static int spu_read_u32(struct if_spi_card *card, u16 reg, u32 *val)
 {
-        u32 buf;
+        __le32 buf;
         int err;
 
         err = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 92bc8c5f1ca..3fac4efa5ac 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -508,7 +508,7 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
         /* Fill the receive configuration URB and initialise the Rx call back */
         usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
                           usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
-                          (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET),
+                          skb->data + IPFIELD_ALIGN_OFFSET,
                           MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
                           cardp);
 
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index 4c018f7a0a8..8c3766a6e8e 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -3,6 +3,7 @@
   */
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/sched.h>
 
 #include "hostcmd.h"
 #include "radiotap.h"
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 4c97c6ad6f5..bc08464d832 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -19,6 +19,7 @@
  *
  */
 
+#include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index e26d7b3ceab..2505be56ae3 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -23,6 +23,7 @@
 #include <linux/netdevice.h>
 #include <linux/ethtool.h>
 #include <linux/pci.h>
+#include <linux/sched.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
 #include <linux/if_arp.h>
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index f7c677e2094..69d2f882fd0 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -20,6 +20,7 @@
 #include <linux/netdevice.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/sched.h>
 
 #include <asm/io.h>
 #include <asm/system.h>
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 88cd58eb3b9..1c88c2ea59a 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -2879,7 +2879,7 @@ static int write_essid(struct file *file, const char __user *buffer,
                        unsigned long count, void *data)
 {
         static char proc_essid[33];
-        int len = count;
+        unsigned int len = count;
 
         if (len > 32)
                 len = 32;
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a084077a1c6..9fe770f7d7b 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1994,7 +1994,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
         rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
                            test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
-                               (skbdesc->entry->entry_idx + 1) : 0xff);
+                           txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
                            skb->len - txdesc->l2pad);
         rt2x00_set_field32(&word, TXWI_W1_PACKETID,
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 7b3ee8c2eae..68bc9bb1dbf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/poll.h>
+#include <linux/sched.h>
 #include <linux/uaccess.h>
 
 #include "rt2x00.h"
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index b8f5ee33445..14e7bb21007 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2389,10 +2389,13 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
         /* MSI */
+        { USB_DEVICE(0x0db0, 0x4600), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Ralink */
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2420,6 +2423,8 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Planex */
         { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* WideTell */
+        { USB_DEVICE(0x7167, 0x3840), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Zcom */
         { USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
         /* ZyXEL */