Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (55 commits)
  net: fib_rules: fix error code for unsupported families
  netdevice: Fix wrong string handle in kernel command line parsing
  net: Tyop of sk_filter() comment
  netlink: Unneeded local variable
  net-sched: fix filter destruction in atm/hfsc qdisc destruction
  net-sched: change tcf_destroy_chain() to clear start of filter list
  ipv4: fix sysctl documentation of time related values
  mac80211: don't accept WEP keys other than WEP40 and WEP104
  hostap: fix sparse warnings
  hostap: don't report useless WDS frames by default
  textsearch: fix Boyer-Moore text search bug
  netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid ACK
  ipv6 route: Convert rt6_device_match() to use RT6_LOOKUP_F_xxx flags.
  netlabel: Fix a problem when dumping the default IPv6 static labels
  net/inet_lro: remove setting skb->ip_summed when not LRO-able
  inet fragments: fix race between inet_frag_find and inet_frag_secret_rebuild
  CONNECTOR: add a proc entry to list connectors
  netlink: Fix some doc comments in net/netlink/attr.c
  tcp: /proc/net/tcp rto,ato values not scaled properly (v2)
  include/linux/netdevice.h: don't export MAX_HEADER to userspace
  ...

35 files changed, 239 insertions, 155 deletions

diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 85e2ba7fcfba..bf4830082a13 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -27,6 +27,8 @@
 #include <linux/moduleparam.h>
 #include <linux/connector.h>
 #include <linux/mutex.h>
+#include <linux/proc_fs.h>
+#include <linux/spinlock.h>
 
 #include <net/sock.h>
 
@@ -403,6 +405,40 @@ static void cn_callback(void *data)
         mutex_unlock(&notify_lock);
 }
 
+static int cn_proc_show(struct seq_file *m, void *v)
+{
+        struct cn_queue_dev *dev = cdev.cbdev;
+        struct cn_callback_entry *cbq;
+
+        seq_printf(m, "Name            ID\n");
+
+        spin_lock_bh(&dev->queue_lock);
+
+        list_for_each_entry(cbq, &dev->queue_list, callback_entry) {
+                seq_printf(m, "%-15s %u:%u\n",
+                           cbq->id.name,
+                           cbq->id.id.idx,
+                           cbq->id.id.val);
+        }
+
+        spin_unlock_bh(&dev->queue_lock);
+
+        return 0;
+}
+
+static int cn_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, cn_proc_show, NULL);
+}
+
+static const struct file_operations cn_file_ops = {
+        .owner   = THIS_MODULE,
+        .open    = cn_proc_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = single_release
+};
+
 static int __devinit cn_init(void)
 {
         struct cn_dev *dev = &cdev;
@@ -434,6 +470,8 @@ static int __devinit cn_init(void)
                 return -EINVAL;
         }
 
+        proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
+
         return 0;
 }
 
@@ -443,6 +481,8 @@ static void __devexit cn_fini(void)
 
         cn_already_initialized = 0;
 
+        proc_net_remove(&init_net, "connector");
+
         cn_del_callback(&dev->id);
         cn_queue_free_dev(dev->cbdev);
         netlink_kernel_release(dev->nls);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 2edda8cc7f99..aabad8ce7458 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1768,9 +1768,10 @@ vortex_timer(unsigned long data)
         case XCVR_MII: case XCVR_NWAY:
                 {
                         ok = 1;
-                        spin_lock_bh(&vp->lock);
+                        /* Interrupts are already disabled */
+                        spin_lock(&vp->lock);
                         vortex_check_media(dev, 0);
-                        spin_unlock_bh(&vp->lock);
+                        spin_unlock(&vp->lock);
                 }
                 break;
           default:                                      /* Other media types handled by Tx timeouts. */
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index f3cba5e24ec5..1037b1332312 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1803,6 +1803,8 @@ static int e100_rx_alloc_skb(struct nic *nic, struct rx *rx)
         if (rx->prev->skb) {
                 struct rfd *prev_rfd = (struct rfd *)rx->prev->skb->data;
                 put_unaligned_le32(rx->dma_addr, &prev_rfd->link);
+                pci_dma_sync_single_for_device(nic->pdev, rx->prev->dma_addr,
+                        sizeof(struct rfd), PCI_DMA_TODEVICE);
         }
 
         return 0;
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 701531e72e7b..a3f6a9c72ec8 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -347,7 +347,7 @@ e1000_set_tso(struct net_device *netdev, u32 data)
         else
                 netdev->features &= ~NETIF_F_TSO;
 
-        if (data)
+        if (data && (adapter->hw.mac_type > e1000_82547_rev_2))
                 netdev->features |= NETIF_F_TSO6;
         else
                 netdev->features &= ~NETIF_F_TSO6;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index cab1835173cd..648a87bbf467 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2535,7 +2535,8 @@ void e1000e_down(struct e1000_adapter *adapter)
         adapter->link_speed = 0;
         adapter->link_duplex = 0;
 
-        e1000e_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                e1000e_reset(adapter);
         e1000_clean_tx_ring(adapter);
         e1000_clean_rx_ring(adapter);
 
diff --git a/drivers/net/hamradio/dmascc.c b/drivers/net/hamradio/dmascc.c
index 0b94833e23f7..e8cfadefa4b6 100644
--- a/drivers/net/hamradio/dmascc.c
+++ b/drivers/net/hamradio/dmascc.c
@@ -1077,8 +1077,6 @@ static inline void rx_off(struct scc_priv *priv)
 
 static void start_timer(struct scc_priv *priv, int t, int r15)
 {
-        unsigned long flags;
-
         outb(priv->tmr_mode, priv->tmr_ctrl);
         if (t == 0) {
                 tm_isr(priv);
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index ae398f04c7b4..e79a26a886c8 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -718,7 +718,8 @@ void igb_down(struct igb_adapter *adapter)
         adapter->link_speed = 0;
         adapter->link_duplex = 0;
 
-        igb_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                igb_reset(adapter);
         igb_clean_all_tx_rings(adapter);
         igb_clean_all_rx_rings(adapter);
 }
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 679a0826780e..2c03f4e2ccc4 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -1271,7 +1271,7 @@ static void ipg_nic_rx_with_end(struct net_device *dev,
 
                         framelen = le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFRAMELEN;
 
-                        endframeLen = framelen - jumbo->current_size;
+                        endframelen = framelen - jumbo->current_size;
                         /*
                         if (framelen > IPG_RXFRAG_SIZE)
                                 framelen=IPG_RXFRAG_SIZE;
@@ -1279,8 +1279,8 @@ static void ipg_nic_rx_with_end(struct net_device *dev,
                         if (framelen > IPG_RXSUPPORT_SIZE)
                                 dev_kfree_skb_irq(jumbo->skb);
                         else {
-                                memcpy(skb_put(jumbo->skb, endframeLen),
-                                       skb->data, endframeLen);
+                                memcpy(skb_put(jumbo->skb, endframelen),
+                                       skb->data, endframelen);
 
                                 jumbo->skb->protocol =
                                     eth_type_trans(jumbo->skb, dev);
@@ -1352,16 +1352,16 @@ static int ipg_nic_rx(struct net_device *dev)
 
                 switch (ipg_nic_rx_check_frame_type(dev)) {
                 case FRAME_WITH_START_WITH_END:
-                        ipg_nic_rx_with_start_and_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_start_and_end(dev, sp, rxfd, entry);
                         break;
                 case FRAME_WITH_START:
-                        ipg_nic_rx_with_start(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_start(dev, sp, rxfd, entry);
                         break;
                 case FRAME_WITH_END:
-                        ipg_nic_rx_with_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_end(dev, sp, rxfd, entry);
                         break;
                 case FRAME_NO_START_NO_END:
-                        ipg_nic_rx_no_start_no_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_no_start_no_end(dev, sp, rxfd, entry);
                         break;
                 }
         }
@@ -1808,7 +1808,7 @@ static int ipg_nic_open(struct net_device *dev)
         /* initialize JUMBO Frame control variable */
         sp->jumbo.found_start = 0;
         sp->jumbo.current_size = 0;
-        sp->jumbo.skb = 0;
+        sp->jumbo.skb = NULL;
         dev->mtu = IPG_TXFRAG_SIZE;
 #endif
 
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7b859220c255..8f0460901153 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1969,7 +1969,8 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         netif_carrier_off(netdev);
         netif_stop_queue(netdev);
 
-        ixgbe_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                ixgbe_reset(adapter);
         ixgbe_clean_all_tx_rings(adapter);
         ixgbe_clean_all_rx_rings(adapter);
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 6797ed069f1f..63cd67b931e7 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -71,14 +71,18 @@ static irqreturn_t netxen_intr(int irq, void *data);
 static irqreturn_t netxen_msi_intr(int irq, void *data);
 
 /*  PCI Device ID Table  */
+#define ENTRY(device) \
+        {PCI_DEVICE(0x4040, (device)), \
+        .class = PCI_CLASS_NETWORK_ETHERNET << 8, .class_mask = ~0}
+
 static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
-        {PCI_DEVICE(0x4040, 0x0001), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0002), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0003), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0004), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0005), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0024), PCI_DEVICE_CLASS(0x020000, ~0)},
-        {PCI_DEVICE(0x4040, 0x0025), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0001),
+        ENTRY(0x0002),
+        ENTRY(0x0003),
+        ENTRY(0x0004),
+        ENTRY(0x0005),
+        ENTRY(0x0024),
+        ENTRY(0x0025),
         {0,}
 };
 
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index ce95c5d168fe..70d012e90dcf 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -525,12 +525,14 @@ static int axnet_open(struct net_device *dev)
     int ret;
     axnet_dev_t *info = PRIV(dev);
     struct pcmcia_device *link = info->p_dev;
+    unsigned int nic_base = dev->base_addr;
     
     DEBUG(2, "axnet_open('%s')\n", dev->name);
 
     if (!pcmcia_dev_present(link))
         return -ENODEV;
 
+    outb_p(0xFF, nic_base + EN0_ISR); /* Clear bogus intr. */
     ret = request_irq(dev->irq, ei_irq_wrapper, IRQF_SHARED, "axnet_cs", dev);
     if (ret)
             return ret;
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index fd8158a86f64..2d4c4ad89b8d 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -969,6 +969,7 @@ static int pcnet_open(struct net_device *dev)
     int ret;
     pcnet_dev_t *info = PRIV(dev);
     struct pcmcia_device *link = info->p_dev;
+    unsigned int nic_base = dev->base_addr;
 
     DEBUG(2, "pcnet_open('%s')\n", dev->name);
 
@@ -976,6 +977,8 @@ static int pcnet_open(struct net_device *dev)
         return -ENODEV;
 
     set_misc_reg(dev);
+
+    outb_p(0xFF, nic_base + EN0_ISR); /* Clear bogus intr. */
     ret = request_irq(dev->irq, ei_irq_wrapper, IRQF_SHARED, dev_info, dev);
     if (ret)
             return ret;
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index b7f7b2227d56..bccee68bd48a 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -3701,7 +3701,9 @@ static int ql_cycle_adapter(struct ql3_adapter *qdev, int reset)
                 printk(KERN_ERR PFX
                                 "%s: Driver up/down cycle failed, "
                                 "closing device\n",qdev->ndev->name);
+                rtnl_lock();
                 dev_close(qdev->ndev);
+                rtnl_unlock();
                 return -1;
         }
         return 0;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 858b191517b3..504a48ff73c8 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -273,7 +273,7 @@ static void r6040_init_ring_desc(struct r6040_descriptor *desc_ring,
         dma_addr_t mapping = desc_dma;
 
         while (size-- > 0) {
-                mapping += sizeof(sizeof(*desc));
+                mapping += sizeof(*desc);
                 desc->ndesc = cpu_to_le32(mapping);
                 desc->vndescp = desc + 1;
                 desc++;
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index b5c1e663417d..ae7b697456b4 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2625,9 +2625,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                         rxdp1->Buffer0_ptr = pci_map_single
                             (ring->pdev, skb->data, size - NET_IP_ALIGN,
                                 PCI_DMA_FROMDEVICE);
-                        if( (rxdp1->Buffer0_ptr == 0) ||
-                                (rxdp1->Buffer0_ptr ==
-                                DMA_ERROR_CODE))
+                        if(pci_dma_mapping_error(rxdp1->Buffer0_ptr))
                                 goto pci_map_failed;
 
                         rxdp->Control_2 =
@@ -2657,6 +2655,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                         skb->data = (void *) (unsigned long)tmp;
                         skb_reset_tail_pointer(skb);
 
+                        /* AK: check is wrong. 0 can be valid dma address */
                         if (!(rxdp3->Buffer0_ptr))
                                 rxdp3->Buffer0_ptr =
                                    pci_map_single(ring->pdev, ba->ba_0,
@@ -2665,8 +2664,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                                 pci_dma_sync_single_for_device(ring->pdev,
                                 (dma_addr_t) rxdp3->Buffer0_ptr,
                                     BUF0_LEN, PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer0_ptr == 0) ||
-                                (rxdp3->Buffer0_ptr == DMA_ERROR_CODE))
+                        if (pci_dma_mapping_error(rxdp3->Buffer0_ptr))
                                 goto pci_map_failed;
 
                         rxdp->Control_2 = SET_BUFFER0_SIZE_3(BUF0_LEN);
@@ -2681,18 +2679,17 @@ static int fill_rx_buffers(struct ring_info *ring)
                                 (ring->pdev, skb->data, ring->mtu + 4,
                                                 PCI_DMA_FROMDEVICE);
 
-                                if( (rxdp3->Buffer2_ptr == 0) ||
-                                        (rxdp3->Buffer2_ptr == DMA_ERROR_CODE))
+                                if (pci_dma_mapping_error(rxdp3->Buffer2_ptr))
                                         goto pci_map_failed;
 
+                                /* AK: check is wrong */
                                 if (!rxdp3->Buffer1_ptr)
                                         rxdp3->Buffer1_ptr =
                                                 pci_map_single(ring->pdev,
                                                 ba->ba_1, BUF1_LEN,
                                                 PCI_DMA_FROMDEVICE);
 
-                                if( (rxdp3->Buffer1_ptr == 0) ||
-                                        (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
+                                if (pci_dma_mapping_error(rxdp3->Buffer1_ptr)) {
                                         pci_unmap_single
                                                 (ring->pdev,
                                                 (dma_addr_t)(unsigned long)
@@ -4264,16 +4261,14 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                 txdp->Buffer_Pointer = pci_map_single(sp->pdev,
                                         fifo->ufo_in_band_v,
                                         sizeof(u64), PCI_DMA_TODEVICE);
-                if((txdp->Buffer_Pointer == 0) ||
-                        (txdp->Buffer_Pointer == DMA_ERROR_CODE))
+                if (pci_dma_mapping_error(txdp->Buffer_Pointer))
                         goto pci_map_failed;
                 txdp++;
         }
 
         txdp->Buffer_Pointer = pci_map_single
             (sp->pdev, skb->data, frg_len, PCI_DMA_TODEVICE);
-        if((txdp->Buffer_Pointer == 0) ||
-                (txdp->Buffer_Pointer == DMA_ERROR_CODE))
+        if (pci_dma_mapping_error(txdp->Buffer_Pointer))
                 goto pci_map_failed;
 
         txdp->Host_Control = (unsigned long) skb;
@@ -6884,10 +6879,8 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                                 pci_map_single( sp->pdev, (*skb)->data,
                                         size - NET_IP_ALIGN,
                                         PCI_DMA_FROMDEVICE);
-                        if( (rxdp1->Buffer0_ptr == 0) ||
-                                (rxdp1->Buffer0_ptr == DMA_ERROR_CODE)) {
+                        if (pci_dma_mapping_error(rxdp1->Buffer0_ptr))
                                 goto memalloc_failed;
-                        }
                         rxdp->Host_Control = (unsigned long) (*skb);
                 }
         } else if ((sp->rxd_mode == RXD_MODE_3B) && (rxdp->Host_Control == 0)) {
@@ -6913,15 +6906,12 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                                 pci_map_single(sp->pdev, (*skb)->data,
                                                dev->mtu + 4,
                                                PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer2_ptr == 0) ||
-                                (rxdp3->Buffer2_ptr == DMA_ERROR_CODE)) {
+                        if (pci_dma_mapping_error(rxdp3->Buffer2_ptr))
                                 goto memalloc_failed;
-                        }
                         rxdp3->Buffer0_ptr = *temp0 =
                                 pci_map_single( sp->pdev, ba->ba_0, BUF0_LEN,
                                                 PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer0_ptr == 0) ||
-                                (rxdp3->Buffer0_ptr == DMA_ERROR_CODE)) {
+                        if (pci_dma_mapping_error(rxdp3->Buffer0_ptr)) {
                                 pci_unmap_single (sp->pdev,
                                         (dma_addr_t)rxdp3->Buffer2_ptr,
                                         dev->mtu + 4, PCI_DMA_FROMDEVICE);
@@ -6933,8 +6923,7 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                         rxdp3->Buffer1_ptr = *temp1 =
                                 pci_map_single(sp->pdev, ba->ba_1, BUF1_LEN,
                                                 PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer1_ptr == 0) ||
-                                (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
+                        if (pci_dma_mapping_error(rxdp3->Buffer1_ptr)) {
                                 pci_unmap_single (sp->pdev,
                                         (dma_addr_t)rxdp3->Buffer0_ptr,
                                         BUF0_LEN, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 4706f7f9acb6..1827b6686c98 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -75,10 +75,6 @@ static int debug_level = ERR_DBG;
 /* DEBUG message print. */
 #define DBG_PRINT(dbg_level, args...)  if(!(debug_level<dbg_level)) printk(args)
 
-#ifndef DMA_ERROR_CODE
-#define DMA_ERROR_CODE          (~(dma_addr_t)0x0)
-#endif
-
 /* Protocol assist features of the NIC */
 #define L3_CKSUM_OK 0xFFFF
 #define L4_CKSUM_OK 0xFFFF
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 10e4e85da3fc..b07b8cbadeaf 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1394,6 +1394,7 @@ tc35815_open(struct net_device *dev)
         tc35815_chip_init(dev);
         spin_unlock_irq(&lp->lock);
 
+        netif_carrier_off(dev);
         /* schedule a link state check */
         phy_start(lp->phy_dev);
 
@@ -1735,7 +1736,6 @@ tc35815_rx(struct net_device *dev)
                         skb = lp->rx_skbs[cur_bd].skb;
                         prefetch(skb->data);
                         lp->rx_skbs[cur_bd].skb = NULL;
-                        lp->fbl_count--;
                         pci_unmap_single(lp->pci_dev,
                                          lp->rx_skbs[cur_bd].skb_dma,
                                          RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
@@ -1791,6 +1791,7 @@ tc35815_rx(struct net_device *dev)
 #ifdef TC35815_USE_PACKEDBUFFER
                         while (lp->fbl_curid != id)
 #else
+                        lp->fbl_count--;
                         while (lp->fbl_count < RX_BUF_NUM)
 #endif
                         {
@@ -2453,6 +2454,7 @@ static int tc35815_resume(struct pci_dev *pdev)
                 return 0;
         pci_set_power_state(pdev, PCI_D0);
         tc35815_restart(dev);
+        netif_carrier_off(dev);
         if (lp->phy_dev)
                 phy_start(lp->phy_dev);
         netif_device_attach(dev);
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 249e18053d5f..069f8bb0a99f 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -32,6 +32,7 @@
 #include <linux/x25.h>
 #include <linux/lapb.h>
 #include <linux/init.h>
+#include <linux/rtnetlink.h>
 #include "x25_asy.h"
 
 #include <net/x25device.h>
@@ -601,8 +602,10 @@ static void x25_asy_close_tty(struct tty_struct *tty)
         if (!sl || sl->magic != X25_ASY_MAGIC)
                 return;
 
+        rtnl_lock();
         if (sl->dev->flags & IFF_UP)
                 dev_close(sl->dev);
+        rtnl_unlock();
 
         tty->disc_data = NULL;
         sl->tty = NULL;
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index 36a9c42df835..76f4c7bad8b8 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -72,6 +72,9 @@ static void b43_led_brightness_set(struct led_classdev *led_dev,
         struct b43_wldev *dev = led->dev;
         bool radio_enabled;
 
+        if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED))
+                return;
+
         /* Checking the radio-enabled status here is slightly racy,
          * but we want to avoid the locking overhead and we don't care
          * whether the LED has the wrong state for a second. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index fa4b0d8b74a2..a70827793086 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2883,12 +2883,11 @@ static int b43_op_tx(struct ieee80211_hw *hw,
 
         if (unlikely(skb->len < 2 + 2 + 6)) {
                 /* Too short, this can't be a valid frame. */
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
+                goto drop_packet;
         }
         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
         if (unlikely(!dev))
-                return NETDEV_TX_BUSY;
+                goto drop_packet;
 
         /* Transmissions on seperate queues can run concurrently. */
         read_lock_irqsave(&wl->tx_lock, flags);
@@ -2904,7 +2903,12 @@ static int b43_op_tx(struct ieee80211_hw *hw,
         read_unlock_irqrestore(&wl->tx_lock, flags);
 
         if (unlikely(err))
-                return NETDEV_TX_BUSY;
+                goto drop_packet;
+        return NETDEV_TX_OK;
+
+drop_packet:
+        /* We can not transmit this packet. Drop it. */
+        dev_kfree_skb_any(skb);
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index c990f87b107a..93ddc1cbcc8b 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -876,6 +876,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
         if (!ring)
                 goto out;
         ring->type = type;
+        ring->dev = dev;
 
         nr_slots = B43legacy_RXRING_SLOTS;
         if (for_tx)
@@ -922,7 +923,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
                                  DMA_TO_DEVICE);
         }
 
-        ring->dev = dev;
         ring->nr_slots = nr_slots;
         ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index);
         ring->index = controller_index;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 204077c13870..3e612d0a13e8 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2378,8 +2378,10 @@ static int b43legacy_op_tx(struct ieee80211_hw *hw,
         } else
                 err = b43legacy_dma_tx(dev, skb, ctl);
 out:
-        if (unlikely(err))
-                return NETDEV_TX_BUSY;
+        if (unlikely(err)) {
+                /* Drop the packet. */
+                dev_kfree_skb_any(skb);
+        }
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 4fd73809602e..020f450e9dba 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -64,7 +64,7 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
         int hdrlen, phdrlen, head_need, tail_need;
         u16 fc;
         int prism_header, ret;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr_4addr *fhdr;
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -83,8 +83,8 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
                 phdrlen = 0;
         }
 
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
+        fhdr = (struct ieee80211_hdr_4addr *) skb->data;
+        fc = le16_to_cpu(fhdr->frame_ctl);
 
         if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) {
                 printk(KERN_DEBUG "%s: dropped management frame with header "
@@ -551,7 +551,7 @@ hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr_4addr *hdr,
              hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff ||
              hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) {
                 /* RA (or BSSID) is not ours - drop */
-                PDEBUG(DEBUG_EXTRA, "%s: received WDS frame with "
+                PDEBUG(DEBUG_EXTRA2, "%s: received WDS frame with "
                        "not own or broadcast %s=%s\n",
                        local->dev->name,
                        fc & IEEE80211_FCTL_FROMDS ? "RA" : "BSSID",
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 0acd9589c48c..ab981afd481d 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -1930,7 +1930,7 @@ static void handle_pspoll(local_info_t *local,
                 PDEBUG(DEBUG_PS, "   PSPOLL and AID[15:14] not set\n");
                 return;
         }
-        aid &= ~BIT(15) & ~BIT(14);
+        aid &= ~(BIT(15) | BIT(14));
         if (aid == 0 || aid > MAX_AID_TABLE_SIZE) {
                 PDEBUG(DEBUG_PS, "   invalid aid=%d\n", aid);
                 return;
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index ed4317a17cbb..80039a0ae027 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -533,10 +533,10 @@ static void prism2_detach(struct pcmcia_device *link)
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
 #define CFG_CHECK2(fn, retf) \
-do { int ret = (retf); \
-if (ret != 0) { \
-        PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", ret); \
-        cs_error(link, fn, ret); \
+do { int _ret = (retf); \
+if (_ret != 0) { \
+        PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", _ret); \
+        cs_error(link, fn, _ret); \
         goto next_entry; \
 } \
 } while (0)
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index cdf90c40f11b..936f52e3d95c 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2835,7 +2835,7 @@ static void hostap_passive_scan(unsigned long data)
 {
         local_info_t *local = (local_info_t *) data;
         struct net_device *dev = local->dev;
-        u16 channel;
+        u16 chan;
 
         if (local->passive_scan_interval <= 0)
                 return;
@@ -2872,11 +2872,11 @@ static void hostap_passive_scan(unsigned long data)
 
                 printk(KERN_DEBUG "%s: passive scan channel %d\n",
                        dev->name, local->passive_scan_channel);
-                channel = local->passive_scan_channel;
+                chan = local->passive_scan_channel;
                 local->passive_scan_state = PASSIVE_SCAN_WAIT;
                 local->passive_scan_timer.expires = jiffies + HZ / 10;
         } else {
-                channel = local->channel;
+                chan = local->channel;
                 local->passive_scan_state = PASSIVE_SCAN_LISTEN;
                 local->passive_scan_timer.expires = jiffies +
                         local->passive_scan_interval * HZ;
@@ -2884,9 +2884,9 @@ static void hostap_passive_scan(unsigned long data)
 
         if (hfa384x_cmd_callback(dev, HFA384X_CMDCODE_TEST |
                                  (HFA384X_TEST_CHANGE_CHANNEL << 8),
-                                 channel, NULL, 0))
+                                 chan, NULL, 0))
                 printk(KERN_ERR "%s: passive scan channel set %d "
-                       "failed\n", dev->name, channel);
+                       "failed\n", dev->name, chan);
 
         add_timer(&local->passive_scan_timer);
 }
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index f7aec9309d04..a38e85f334df 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -594,7 +594,8 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
 }
 
 
-int hostap_80211_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int hostap_80211_header_parse(const struct sk_buff *skb,
+                                     unsigned char *haddr)
 {
         struct hostap_interface *iface = netdev_priv(skb->dev);
         local_info_t *local = iface->local;
@@ -857,7 +858,6 @@ const struct header_ops hostap_80211_ops = {
         .rebuild        = eth_rebuild_header,
         .cache          = eth_header_cache,
         .cache_update   = eth_header_cache_update,
-
         .parse          = hostap_80211_header_parse,
 };
 EXPORT_SYMBOL(hostap_80211_ops);
@@ -1150,7 +1150,6 @@ EXPORT_SYMBOL(hostap_set_roaming);
 EXPORT_SYMBOL(hostap_set_auth_algs);
 EXPORT_SYMBOL(hostap_dump_rx_header);
 EXPORT_SYMBOL(hostap_dump_tx_header);
-EXPORT_SYMBOL(hostap_80211_header_parse);
 EXPORT_SYMBOL(hostap_80211_get_hdrlen);
 EXPORT_SYMBOL(hostap_get_stats);
 EXPORT_SYMBOL(hostap_setup_dev);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 13925b627e3b..b1b3c523185d 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2227,7 +2227,10 @@ static int iwl3945_scan_initiate(struct iwl3945_priv *priv)
         }
 
         IWL_DEBUG_INFO("Starting scan...\n");
-        priv->scan_bands = 2;
+        if (priv->cfg->sku & IWL_SKU_G)
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        if (priv->cfg->sku & IWL_SKU_A)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
         set_bit(STATUS_SCANNING, &priv->status);
         priv->scan_start = jiffies;
         priv->scan_pass_start = priv->scan_start;
@@ -3352,13 +3355,18 @@ static void iwl3945_rx_scan_complete_notif(struct iwl3945_priv *priv,
         cancel_delayed_work(&priv->scan_check);
 
         IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands == 2) ? "2.4" : "5.2",
+                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
+                                                        "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
                                         (priv->scan_pass_start, jiffies)));
 
-        /* Remove this scanned band from the list
-         * of pending bands to scan */
-        priv->scan_bands--;
+        /* Remove this scanned band from the list of pending
+         * bands to scan, band G precedes A in order of scanning
+         * as seen in iwl3945_bg_request_scan */
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
+        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
 
         /* If a request to abort was given, or the scan did not succeed
          * then we reset the scan state machine and terminate,
@@ -4972,7 +4980,7 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv,
 
                 ch_info = iwl3945_get_channel_info(priv, band, scan_ch->channel);
                 if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
+                        IWL_DEBUG_SCAN("Channel %d is INVALID for this band.\n",
                                        scan_ch->channel);
                         continue;
                 }
@@ -6315,21 +6323,16 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         /* flags + rate selection */
 
-        switch (priv->scan_bands) {
-        case 2:
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
                 scan->good_CRC_th = 0;
                 band = IEEE80211_BAND_2GHZ;
-                break;
-
-        case 1:
+        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
                 band = IEEE80211_BAND_5GHZ;
-                break;
-
-        default:
+        } else {
                 IWL_WARNING("Invalid scan band count\n");
                 goto done;
         }
@@ -6770,7 +6773,7 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         ch_info = iwl3945_get_channel_info(priv, conf->channel->band,
                                            conf->channel->hw_value);
         if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this SKU.\n",
+                IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this band.\n",
                                conf->channel->hw_value, conf->channel->band);
                 IWL_DEBUG_MAC80211("leave - invalid channel\n");
                 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 883b42f7e998..5ed16ce78468 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -1774,7 +1774,10 @@ static int iwl4965_scan_initiate(struct iwl_priv *priv)
         }
 
         IWL_DEBUG_INFO("Starting scan...\n");
-        priv->scan_bands = 2;
+        if (priv->cfg->sku & IWL_SKU_G)
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        if (priv->cfg->sku & IWL_SKU_A)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
         set_bit(STATUS_SCANNING, &priv->status);
         priv->scan_start = jiffies;
         priv->scan_pass_start = priv->scan_start;
@@ -3023,8 +3026,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 
         IWL_DEBUG_TX_REPLY("Tx queue reclaim %d\n", index);
         if (index != -1) {
-                int freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
 #ifdef CONFIG_IWL4965_HT
+                int freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
+
                 if (tid != MAX_TID_COUNT)
                         priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
                 if (iwl4965_queue_space(&txq->q) > txq->q.low_mark &&
@@ -3276,13 +3280,18 @@ static void iwl4965_rx_scan_complete_notif(struct iwl_priv *priv,
         cancel_delayed_work(&priv->scan_check);
 
         IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands == 2) ? "2.4" : "5.2",
+                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
+                                                "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
                                         (priv->scan_pass_start, jiffies)));
 
-        /* Remove this scanned band from the list
-         * of pending bands to scan */
-        priv->scan_bands--;
+        /* Remove this scanned band from the list of pending
+         * bands to scan, band G precedes A in order of scanning
+         * as seen in iwl_bg_request_scan */
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
+        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
 
         /* If a request to abort was given, or the scan did not succeed
          * then we reset the scan state machine and terminate,
@@ -3292,7 +3301,7 @@ static void iwl4965_rx_scan_complete_notif(struct iwl_priv *priv,
                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
         } else {
                 /* If there are more bands on this scan pass reschedule */
-                if (priv->scan_bands > 0)
+                if (priv->scan_bands)
                         goto reschedule;
         }
 
@@ -4635,10 +4644,9 @@ static int iwl4965_get_channels_for_scan(struct iwl_priv *priv,
 
                 scan_ch->channel = ieee80211_frequency_to_channel(channels[i].center_freq);
 
-                ch_info = iwl_get_channel_info(priv, band,
-                                         scan_ch->channel);
+                ch_info = iwl_get_channel_info(priv, band, scan_ch->channel);
                 if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
+                        IWL_DEBUG_SCAN("Channel %d is INVALID for this band.\n",
                                        scan_ch->channel);
                         continue;
                 }
@@ -5830,8 +5838,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 
 
-        switch (priv->scan_bands) {
-        case 2:
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate_n_flags =
                                 iwl4965_hw_set_rate_n_flags(IWL_RATE_1M_PLCP,
@@ -5839,17 +5846,13 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
 
                 scan->good_CRC_th = 0;
                 band = IEEE80211_BAND_2GHZ;
-                break;
-
-        case 1:
+        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 scan->tx_cmd.rate_n_flags =
                                 iwl4965_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
                                 RATE_MCS_ANT_B_MSK);
                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
                 band = IEEE80211_BAND_5GHZ;
-                break;
-
-        default:
+        } else {
                 IWL_WARNING("Invalid scan band count\n");
                 goto done;
         }
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 762e85bef55d..e43bae97ed8f 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -290,7 +290,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
 
                 avs->version = cpu_to_be32(P80211CAPTURE_VERSION);
                 avs->length = cpu_to_be32(sizeof (struct avs_80211_1_header));
-                avs->mactime = cpu_to_be64(le64_to_cpu(clock));
+                avs->mactime = cpu_to_be64(clock);
                 avs->hosttime = cpu_to_be64(jiffies);
                 avs->phytype = cpu_to_be32(6);  /*OFDM: 6 for (g), 8 for (a) */
                 avs->channel = cpu_to_be32(channel_of_freq(freq));
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index fdbd0ef2be4b..61e59c17a60a 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -138,11 +138,8 @@ static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Write failed.\n");
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
+                goto exit_fail;
 
         /*
          * Write the data into the BBP.
@@ -155,6 +152,13 @@ static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
         rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);
 
         mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR8 register busy. Write failed.\n");
 }
 
 static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
@@ -168,10 +172,8 @@ static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
-                return;
-        }
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
+                goto exit_fail;
 
         /*
          * Write the request into the BBP.
@@ -186,17 +188,21 @@ static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
-                *value = 0xff;
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
+                goto exit_fail;
 
         rt2500usb_register_read_lock(rt2x00dev, PHY_CSR7, &reg);
         *value = rt2x00_get_field16(reg, PHY_CSR7_DATA);
 
         mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
+        *value = 0xff;
 }
 
 static void rt2500usb_rf_write(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 611d98320593..b4bf1e09cf9a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -821,6 +821,7 @@ struct rt2x00_dev {
         /*
          * Scheduled work.
          */
+        struct workqueue_struct *workqueue;
         struct work_struct intf_work;
         struct work_struct filter_work;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2673d568bcac..c997d4f28ab3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -75,7 +75,7 @@ static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
 
         rt2x00lib_reset_link_tuner(rt2x00dev);
 
-        queue_delayed_work(rt2x00dev->hw->workqueue,
+        queue_delayed_work(rt2x00dev->workqueue,
                            &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
 }
 
@@ -137,14 +137,6 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
                 return;
 
         /*
-         * Stop all scheduled work.
-         */
-        if (work_pending(&rt2x00dev->intf_work))
-                cancel_work_sync(&rt2x00dev->intf_work);
-        if (work_pending(&rt2x00dev->filter_work))
-                cancel_work_sync(&rt2x00dev->filter_work);
-
-        /*
          * Stop the TX queues.
          */
         ieee80211_stop_queues(rt2x00dev->hw);
@@ -398,8 +390,8 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
          * Increase tuner counter, and reschedule the next link tuner run.
          */
         rt2x00dev->link.count++;
-        queue_delayed_work(rt2x00dev->hw->workqueue, &rt2x00dev->link.work,
-                           LINK_TUNE_INTERVAL);
+        queue_delayed_work(rt2x00dev->workqueue,
+                           &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
 }
 
 static void rt2x00lib_packetfilter_scheduled(struct work_struct *work)
@@ -433,6 +425,15 @@ static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
 
         spin_unlock(&intf->lock);
 
+        /*
+         * It is possible the radio was disabled while the work had been
+         * scheduled. If that happens we should return here immediately,
+         * note that in the spinlock protected area above the delayed_flags
+         * have been cleared correctly.
+         */
+        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
+                return;
+
         if (delayed_flags & DELAYED_UPDATE_BEACON) {
                 skb = ieee80211_beacon_get(rt2x00dev->hw, vif, &control);
                 if (skb && rt2x00dev->ops->hw->beacon_update(rt2x00dev->hw,
@@ -441,7 +442,7 @@ static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
         }
 
         if (delayed_flags & DELAYED_CONFIG_ERP)
-                rt2x00lib_config_erp(rt2x00dev, intf, &intf->conf);
+                rt2x00lib_config_erp(rt2x00dev, intf, &conf);
 
         if (delayed_flags & DELAYED_LED_ASSOC)
                 rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
@@ -487,7 +488,7 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
                                                    rt2x00lib_beacondone_iter,
                                                    rt2x00dev);
 
-        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
+        queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_beacondone);
 
@@ -1130,6 +1131,10 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize configuration work.
          */
+        rt2x00dev->workqueue = create_singlethread_workqueue("rt2x00lib");
+        if (!rt2x00dev->workqueue)
+                goto exit;
+
         INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
         INIT_WORK(&rt2x00dev->filter_work, rt2x00lib_packetfilter_scheduled);
         INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00lib_link_tuner);
@@ -1190,6 +1195,13 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00leds_unregister(rt2x00dev);
 
         /*
+         * Stop all queued work. Note that most tasks will already be halted
+         * during rt2x00lib_disable_radio() and rt2x00lib_uninitialize().
+         */
+        flush_workqueue(rt2x00dev->workqueue);
+        destroy_workqueue(rt2x00dev->workqueue);
+
+        /*
          * Free ieee80211_hw memory.
          */
         rt2x00lib_remove_hw(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 87e280a21971..9cb023edd2e9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -428,7 +428,7 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
         if (!test_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags))
                 rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
         else
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->filter_work);
+                queue_work(rt2x00dev->workqueue, &rt2x00dev->filter_work);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_configure_filter);
 
@@ -509,7 +509,7 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
         memcpy(&intf->conf, bss_conf, sizeof(*bss_conf));
         if (delayed) {
                 intf->delayed_flags |= delayed;
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
+                queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
         }
         spin_unlock(&intf->lock);
 }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index fff8386e816b..83cc0147f698 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -134,11 +134,8 @@ static void rt73usb_bbp_write(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         /*
          * Write the data into the BBP.
@@ -151,6 +148,13 @@ static void rt73usb_bbp_write(struct rt2x00_dev *rt2x00dev,
 
         rt73usb_register_write_lock(rt2x00dev, PHY_CSR3, reg);
         mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
 }
 
 static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
@@ -164,11 +168,8 @@ static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         /*
          * Write the request into the BBP.
@@ -184,14 +185,19 @@ static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
          * Wait until the BBP becomes ready.
          */
         reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
-                *value = 0xff;
-                return;
-        }
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
+                goto exit_fail;
 
         *value = rt2x00_get_field32(reg, PHY_CSR3_VALUE);
         mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return;
+
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
+        *value = 0xff;
 }
 
 static void rt73usb_rf_write(struct rt2x00_dev *rt2x00dev,