Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

57 files changed, 648 insertions, 505 deletions

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index e90665876c47..e8c6529dc366 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2505,7 +2505,7 @@ he_close(struct atm_vcc *vcc)
                  * TBRQ, the host issues the close command to the adapter.
                  */
 
-                while (((tx_inuse = atomic_read(&sk_atm(vcc)->sk_wmem_alloc)) > 0) &&
+                while (((tx_inuse = atomic_read(&sk_atm(vcc)->sk_wmem_alloc)) > 1) &&
                        (retry < MAX_RETRY)) {
                         msleep(sleep);
                         if (sleep < 250)
@@ -2514,7 +2514,7 @@ he_close(struct atm_vcc *vcc)
                         ++retry;
                 }
 
-                if (tx_inuse)
+                if (tx_inuse > 1)
                         hprintk("close tx cid 0x%x tx_inuse = %d\n", cid, tx_inuse);
 
                 /* 2.3.1.1 generic close operations with flush */
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 82ed1cd14ff5..664b0c519c3e 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -29,7 +29,7 @@
 #endif
 
 /* Module parameters */
-int gigaset_debuglevel = DEBUG_DEFAULT;
+int gigaset_debuglevel;
 EXPORT_SYMBOL_GPL(gigaset_debuglevel);
 module_param_named(debug, gigaset_debuglevel, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(debug, "debug level");
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 0bbd5ae49862..18ff622703be 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2344,6 +2344,7 @@ config GELIC_NET
 
 config GELIC_WIRELESS
         bool "PS3 Wireless support"
+        depends on WLAN
         depends on GELIC_NET
         select WIRELESS_EXT
         help
@@ -2356,6 +2357,7 @@ config GELIC_WIRELESS
 config GELIC_WIRELESS_OLD_PSK_INTERFACE
        bool "PS3 Wireless private PSK interface (OBSOLETE)"
        depends on GELIC_WIRELESS
+       select WEXT_PRIV
        help
           This option retains the obsolete private interface to pass
           the PSK from user space programs to the driver.  The PSK
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index a348a22551d9..efe5435bc3d3 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -479,6 +479,9 @@ struct atl1c_buffer {
 #define ATL1C_PCIMAP_PAGE               0x0008
 #define ATL1C_PCIMAP_TYPE_MASK          0x000C
 
+#define ATL1C_PCIMAP_TODEVICE           0x0010
+#define ATL1C_PCIMAP_FROMDEVICE         0x0020
+#define ATL1C_PCIMAP_DIRECTION_MASK     0x0030
         dma_addr_t dma;
 };
 
@@ -487,9 +490,11 @@ struct atl1c_buffer {
         ((buff)->flags) |= (state);                     \
         } while (0)
 
-#define ATL1C_SET_PCIMAP_TYPE(buff, type) do {          \
-        ((buff)->flags) &= ~ATL1C_PCIMAP_TYPE_MASK;     \
-        ((buff)->flags) |= (type);                      \
+#define ATL1C_SET_PCIMAP_TYPE(buff, type, direction) do {       \
+        ((buff)->flags) &= ~ATL1C_PCIMAP_TYPE_MASK;             \
+        ((buff)->flags) |= (type);                              \
+        ((buff)->flags) &= ~ATL1C_PCIMAP_DIRECTION_MASK;        \
+        ((buff)->flags) |= (direction);                         \
         } while (0)
 
 /* transimit packet descriptor (tpd) ring */
@@ -550,6 +555,9 @@ struct atl1c_adapter {
 #define __AT_TESTING        0x0001
 #define __AT_RESETTING      0x0002
 #define __AT_DOWN           0x0003
+        u8 work_event;
+#define ATL1C_WORK_EVENT_RESET          0x01
+#define ATL1C_WORK_EVENT_LINK_CHANGE    0x02
         u32 msg_enable;
 
         bool have_msi;
@@ -561,8 +569,7 @@ struct atl1c_adapter {
         spinlock_t tx_lock;
         atomic_t irq_sem;
 
-        struct work_struct reset_task;
-        struct work_struct link_chg_task;
+        struct work_struct common_task;
         struct timer_list watchdog_timer;
         struct timer_list phy_config_timer;
 
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index 1e2f57d4c367..666261b5851e 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -198,27 +198,12 @@ static void atl1c_phy_config(unsigned long data)
 
 void atl1c_reinit_locked(struct atl1c_adapter *adapter)
 {
-
         WARN_ON(in_interrupt());
         atl1c_down(adapter);
         atl1c_up(adapter);
         clear_bit(__AT_RESETTING, &adapter->flags);
 }
 
-static void atl1c_reset_task(struct work_struct *work)
-{
-        struct atl1c_adapter *adapter;
-        struct net_device *netdev;
-
-        adapter = container_of(work, struct atl1c_adapter, reset_task);
-        netdev = adapter->netdev;
-
-        netif_device_detach(netdev);
-        atl1c_down(adapter);
-        atl1c_up(adapter);
-        netif_device_attach(netdev);
-}
-
 static void atl1c_check_link_status(struct atl1c_adapter *adapter)
 {
         struct atl1c_hw *hw = &adapter->hw;
@@ -275,18 +260,6 @@ static void atl1c_check_link_status(struct atl1c_adapter *adapter)
         }
 }
 
-/*
- * atl1c_link_chg_task - deal with link change event Out of interrupt context
- * @netdev: network interface device structure
- */
-static void atl1c_link_chg_task(struct work_struct *work)
-{
-        struct atl1c_adapter *adapter;
-
-        adapter = container_of(work, struct atl1c_adapter, link_chg_task);
-        atl1c_check_link_status(adapter);
-}
-
 static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
@@ -311,20 +284,40 @@ static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
                         adapter->link_speed = SPEED_0;
                 }
         }
-        schedule_work(&adapter->link_chg_task);
+
+        adapter->work_event |= ATL1C_WORK_EVENT_LINK_CHANGE;
+        schedule_work(&adapter->common_task);
 }
 
-static void atl1c_del_timer(struct atl1c_adapter *adapter)
+static void atl1c_common_task(struct work_struct *work)
 {
-        del_timer_sync(&adapter->phy_config_timer);
+        struct atl1c_adapter *adapter;
+        struct net_device *netdev;
+
+        adapter = container_of(work, struct atl1c_adapter, common_task);
+        netdev = adapter->netdev;
+
+        if (adapter->work_event & ATL1C_WORK_EVENT_RESET) {
+                netif_device_detach(netdev);
+                atl1c_down(adapter);
+                atl1c_up(adapter);
+                netif_device_attach(netdev);
+                return;
+        }
+
+        if (adapter->work_event & ATL1C_WORK_EVENT_LINK_CHANGE)
+                atl1c_check_link_status(adapter);
+
+        return;
 }
 
-static void atl1c_cancel_work(struct atl1c_adapter *adapter)
+
+static void atl1c_del_timer(struct atl1c_adapter *adapter)
 {
-        cancel_work_sync(&adapter->reset_task);
-        cancel_work_sync(&adapter->link_chg_task);
+        del_timer_sync(&adapter->phy_config_timer);
 }
 
+
 /*
  * atl1c_tx_timeout - Respond to a Tx Hang
  * @netdev: network interface device structure
@@ -334,7 +327,8 @@ static void atl1c_tx_timeout(struct net_device *netdev)
         struct atl1c_adapter *adapter = netdev_priv(netdev);
 
         /* Do the reset outside of interrupt context */
-        schedule_work(&adapter->reset_task);
+        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+        schedule_work(&adapter->common_task);
 }
 
 /*
@@ -713,15 +707,21 @@ static int __devinit atl1c_sw_init(struct atl1c_adapter *adapter)
 static inline void atl1c_clean_buffer(struct pci_dev *pdev,
                                 struct atl1c_buffer *buffer_info, int in_irq)
 {
+        u16 pci_driection;
         if (buffer_info->flags & ATL1C_BUFFER_FREE)
                 return;
         if (buffer_info->dma) {
+                if (buffer_info->flags & ATL1C_PCIMAP_FROMDEVICE)
+                        pci_driection = PCI_DMA_FROMDEVICE;
+                else
+                        pci_driection = PCI_DMA_TODEVICE;
+
                 if (buffer_info->flags & ATL1C_PCIMAP_SINGLE)
                         pci_unmap_single(pdev, buffer_info->dma,
-                                        buffer_info->length, PCI_DMA_TODEVICE);
+                                        buffer_info->length, pci_driection);
                 else if (buffer_info->flags & ATL1C_PCIMAP_PAGE)
                         pci_unmap_page(pdev, buffer_info->dma,
-                                        buffer_info->length, PCI_DMA_TODEVICE);
+                                        buffer_info->length, pci_driection);
         }
         if (buffer_info->skb) {
                 if (in_irq)
@@ -1533,7 +1533,8 @@ static irqreturn_t atl1c_intr(int irq, void *data)
                         /* reset MAC */
                         hw->intr_mask &= ~ISR_ERROR;
                         AT_WRITE_REG(hw, REG_IMR, hw->intr_mask);
-                        schedule_work(&adapter->reset_task);
+                        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+                        schedule_work(&adapter->common_task);
                         break;
                 }
 
@@ -1606,7 +1607,8 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter, const int ringid
                 buffer_info->dma = pci_map_single(pdev, vir_addr,
                                                 buffer_info->length,
                                                 PCI_DMA_FROMDEVICE);
-                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE);
+                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
+                        ATL1C_PCIMAP_FROMDEVICE);
                 rfd_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
                 rfd_next_to_use = next_next;
                 if (++next_next == rfd_ring->count)
@@ -1967,7 +1969,8 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                 buffer_info->dma = pci_map_single(adapter->pdev,
                                         skb->data, hdr_len, PCI_DMA_TODEVICE);
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
-                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE);
+                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
+                        ATL1C_PCIMAP_TODEVICE);
                 mapped_len += map_len;
                 use_tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
                 use_tpd->buffer_len = cpu_to_le16(buffer_info->length);
@@ -1988,7 +1991,8 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                         pci_map_single(adapter->pdev, skb->data + mapped_len,
                                         buffer_info->length, PCI_DMA_TODEVICE);
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
-                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE);
+                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
+                        ATL1C_PCIMAP_TODEVICE);
                 use_tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
                 use_tpd->buffer_len  = cpu_to_le16(buffer_info->length);
         }
@@ -2009,7 +2013,8 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                                         buffer_info->length,
                                         PCI_DMA_TODEVICE);
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
-                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_PAGE);
+                ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_PAGE,
+                        ATL1C_PCIMAP_TODEVICE);
                 use_tpd->buffer_addr = cpu_to_le64(buffer_info->dma);
                 use_tpd->buffer_len  = cpu_to_le16(buffer_info->length);
         }
@@ -2198,8 +2203,7 @@ void atl1c_down(struct atl1c_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
 
         atl1c_del_timer(adapter);
-        atl1c_cancel_work(adapter);
-
+        adapter->work_event = 0; /* clear all event */
         /* signal that we're down so the interrupt handler does not
          * reschedule our watchdog timer */
         set_bit(__AT_DOWN, &adapter->flags);
@@ -2599,8 +2603,8 @@ static int __devinit atl1c_probe(struct pci_dev *pdev,
                         adapter->hw.mac_addr[4], adapter->hw.mac_addr[5]);
 
         atl1c_hw_set_mac_addr(&adapter->hw);
-        INIT_WORK(&adapter->reset_task, atl1c_reset_task);
-        INIT_WORK(&adapter->link_chg_task, atl1c_link_chg_task);
+        INIT_WORK(&adapter->common_task, atl1c_common_task);
+        adapter->work_event = 0;
         err = register_netdev(netdev);
         if (err) {
                 dev_err(&pdev->dev, "register netdevice failed\n");
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 2a9132343b66..4869adb69586 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1505,8 +1505,7 @@ static int b44_magic_pattern(u8 *macaddr, u8 *ppattern, u8 *pmask, int offset)
                 for (k = 0; k< ethaddr_bytes; k++) {
                         ppattern[offset + magicsync +
                                 (j * ETH_ALEN) + k] = macaddr[k];
-                        len++;
-                        set_bit(len, (unsigned long *) pmask);
+                        set_bit(len++, (unsigned long *) pmask);
                 }
         }
         return len - 1;
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index 86d2809763c3..e02e38221ed4 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -74,7 +74,7 @@
 #define E1000_WUS_BC           E1000_WUFC_BC
 
 /* Extended Device Control */
-#define E1000_CTRL_EXT_SDP7_DATA 0x00000080 /* Value of SW Definable Pin 7 */
+#define E1000_CTRL_EXT_SDP3_DATA 0x00000080 /* Value of SW Definable Pin 3 */
 #define E1000_CTRL_EXT_EE_RST    0x00002000 /* Reinitialize from EEPROM */
 #define E1000_CTRL_EXT_SPD_BYPS  0x00008000 /* Speed Select Bypass */
 #define E1000_CTRL_EXT_RO_DIS    0x00020000 /* Relaxed Ordering disable */
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
index d2a104794609..3028f23da891 100644
--- a/drivers/net/e1000e/es2lan.c
+++ b/drivers/net/e1000e/es2lan.c
@@ -46,6 +46,9 @@
 #define E1000_KMRNCTRLSTA_HD_CTRL_1000_DEFAULT   0x0000
 #define E1000_KMRNCTRLSTA_OPMODE_E_IDLE          0x2000
 
+#define E1000_KMRNCTRLSTA_OPMODE_MASK            0x000C
+#define E1000_KMRNCTRLSTA_OPMODE_INBAND_MDIO     0x0004
+
 #define E1000_TCTL_EXT_GCEX_MASK 0x000FFC00 /* Gigabit Carry Extend Padding */
 #define DEFAULT_TCTL_EXT_GCEX_80003ES2LAN        0x00010000
 
@@ -462,28 +465,36 @@ static s32 e1000_read_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
                 return ret_val;
         }
 
-        /*
-         * The "ready" bit in the MDIC register may be incorrectly set
-         * before the device has completed the "Page Select" MDI
-         * transaction.  So we wait 200us after each MDI command...
-         */
-        udelay(200);
+        if (hw->dev_spec.e80003es2lan.mdic_wa_enable == true) {
+                /*
+                 * The "ready" bit in the MDIC register may be incorrectly set
+                 * before the device has completed the "Page Select" MDI
+                 * transaction.  So we wait 200us after each MDI command...
+                 */
+                udelay(200);
 
-        /* ...and verify the command was successful. */
-        ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
+                /* ...and verify the command was successful. */
+                ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
 
-        if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
-                ret_val = -E1000_ERR_PHY;
-                e1000_release_phy_80003es2lan(hw);
-                return ret_val;
-        }
+                if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
+                        ret_val = -E1000_ERR_PHY;
+                        e1000_release_phy_80003es2lan(hw);
+                        return ret_val;
+                }
 
-        udelay(200);
+                udelay(200);
 
-        ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
-                                           data);
+                ret_val = e1000e_read_phy_reg_mdic(hw,
+                                                  MAX_PHY_REG_ADDRESS & offset,
+                                                  data);
+
+                udelay(200);
+        } else {
+                ret_val = e1000e_read_phy_reg_mdic(hw,
+                                                  MAX_PHY_REG_ADDRESS & offset,
+                                                  data);
+        }
 
-        udelay(200);
         e1000_release_phy_80003es2lan(hw);
 
         return ret_val;
@@ -526,28 +537,35 @@ static s32 e1000_write_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
                 return ret_val;
         }
 
+        if (hw->dev_spec.e80003es2lan.mdic_wa_enable == true) {
+                /*
+                 * The "ready" bit in the MDIC register may be incorrectly set
+                 * before the device has completed the "Page Select" MDI
+                 * transaction.  So we wait 200us after each MDI command...
+                 */
+                udelay(200);
 
-        /*
-         * The "ready" bit in the MDIC register may be incorrectly set
-         * before the device has completed the "Page Select" MDI
-         * transaction.  So we wait 200us after each MDI command...
-         */
-        udelay(200);
+                /* ...and verify the command was successful. */
+                ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
 
-        /* ...and verify the command was successful. */
-        ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
+                if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
+                        e1000_release_phy_80003es2lan(hw);
+                        return -E1000_ERR_PHY;
+                }
 
-        if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
-                e1000_release_phy_80003es2lan(hw);
-                return -E1000_ERR_PHY;
-        }
+                udelay(200);
 
-        udelay(200);
+                ret_val = e1000e_write_phy_reg_mdic(hw,
+                                                  MAX_PHY_REG_ADDRESS & offset,
+                                                  data);
 
-        ret_val = e1000e_write_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
-                                            data);
+                udelay(200);
+        } else {
+                ret_val = e1000e_write_phy_reg_mdic(hw,
+                                                  MAX_PHY_REG_ADDRESS & offset,
+                                                  data);
+        }
 
-        udelay(200);
         e1000_release_phy_80003es2lan(hw);
 
         return ret_val;
@@ -866,6 +884,19 @@ static s32 e1000_init_hw_80003es2lan(struct e1000_hw *hw)
         reg_data &= ~0x00100000;
         E1000_WRITE_REG_ARRAY(hw, E1000_FFLT, 0x0001, reg_data);
 
+        /* default to true to enable the MDIC W/A */
+        hw->dev_spec.e80003es2lan.mdic_wa_enable = true;
+
+        ret_val = e1000_read_kmrn_reg_80003es2lan(hw,
+                                      E1000_KMRNCTRLSTA_OFFSET >>
+                                      E1000_KMRNCTRLSTA_OFFSET_SHIFT,
+                                      &i);
+        if (!ret_val) {
+                if ((i & E1000_KMRNCTRLSTA_OPMODE_MASK) ==
+                     E1000_KMRNCTRLSTA_OPMODE_INBAND_MDIO)
+                        hw->dev_spec.e80003es2lan.mdic_wa_enable = false;
+        }
+
         /*
          * Clear all of the statistics registers (clear on read).  It is
          * important that we do this after we have tried to establish link
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index a7d08dae79c4..2784cf44a6f3 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -302,6 +302,8 @@ enum e1e_registers {
 #define E1000_KMRNCTRLSTA_OFFSET_SHIFT  16
 #define E1000_KMRNCTRLSTA_REN           0x00200000
 #define E1000_KMRNCTRLSTA_DIAG_OFFSET   0x3    /* Kumeran Diagnostic */
+#define E1000_KMRNCTRLSTA_TIMEOUTS      0x4    /* Kumeran Timeouts */
+#define E1000_KMRNCTRLSTA_INBAND_PARAM  0x9    /* Kumeran InBand Parameters */
 #define E1000_KMRNCTRLSTA_DIAG_NELPBK   0x1000 /* Nearend Loopback mode */
 #define E1000_KMRNCTRLSTA_K1_CONFIG     0x7
 #define E1000_KMRNCTRLSTA_K1_ENABLE     0x140E
@@ -898,6 +900,10 @@ struct e1000_dev_spec_82571 {
         u32 smb_counter;
 };
 
+struct e1000_dev_spec_80003es2lan {
+        bool  mdic_wa_enable;
+};
+
 struct e1000_shadow_ram {
         u16  value;
         bool modified;
@@ -926,6 +932,7 @@ struct e1000_hw {
 
         union {
                 struct e1000_dev_spec_82571     e82571;
+                struct e1000_dev_spec_80003es2lan e80003es2lan;
                 struct e1000_dev_spec_ich8lan   ich8lan;
         } dev_spec;
 };
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 7b33be98a2ca..9b09246af064 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -2755,14 +2755,16 @@ static s32 e1000_setup_copper_link_ich8lan(struct e1000_hw *hw)
          * and increase the max iterations when polling the phy;
          * this fixes erroneous timeouts at 10Mbps.
          */
-        ret_val = e1000e_write_kmrn_reg(hw, GG82563_REG(0x34, 4), 0xFFFF);
+        ret_val = e1000e_write_kmrn_reg(hw, E1000_KMRNCTRLSTA_TIMEOUTS, 0xFFFF);
         if (ret_val)
                 return ret_val;
-        ret_val = e1000e_read_kmrn_reg(hw, GG82563_REG(0x34, 9), &reg_data);
+        ret_val = e1000e_read_kmrn_reg(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                       &reg_data);
         if (ret_val)
                 return ret_val;
         reg_data |= 0x3F;
-        ret_val = e1000e_write_kmrn_reg(hw, GG82563_REG(0x34, 9), reg_data);
+        ret_val = e1000e_write_kmrn_reg(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                        reg_data);
         if (ret_val)
                 return ret_val;
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index c3105c5087e0..762b697ce731 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4541,7 +4541,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
                     e1000_media_type_internal_serdes) {
                         /* keep the laser running in D3 */
                         ctrl_ext = er32(CTRL_EXT);
-                        ctrl_ext |= E1000_CTRL_EXT_SDP7_DATA;
+                        ctrl_ext |= E1000_CTRL_EXT_SDP3_DATA;
                         ew32(CTRL_EXT, ctrl_ext);
                 }
 
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index 6407672b28e9..848e8407ea8f 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -85,11 +85,15 @@ MODULE_PARM_DESC(debug, "debugging messages level");
 
 static void mpc52xx_fec_tx_timeout(struct net_device *dev)
 {
+        struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+        unsigned long flags;
+
         dev_warn(&dev->dev, "transmit timed out\n");
 
+        spin_lock_irqsave(&priv->lock, flags);
         mpc52xx_fec_reset(dev);
-
         dev->stats.tx_errors++;
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         netif_wake_queue(dev);
 }
@@ -135,28 +139,32 @@ static void mpc52xx_fec_free_rx_buffers(struct net_device *dev, struct bcom_task
         }
 }
 
+static void
+mpc52xx_fec_rx_submit(struct net_device *dev, struct sk_buff *rskb)
+{
+        struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+        struct bcom_fec_bd *bd;
+
+        bd = (struct bcom_fec_bd *) bcom_prepare_next_buffer(priv->rx_dmatsk);
+        bd->status = FEC_RX_BUFFER_SIZE;
+        bd->skb_pa = dma_map_single(dev->dev.parent, rskb->data,
+                                    FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
+        bcom_submit_next_buffer(priv->rx_dmatsk, rskb);
+}
+
 static int mpc52xx_fec_alloc_rx_buffers(struct net_device *dev, struct bcom_task *rxtsk)
 {
-        while (!bcom_queue_full(rxtsk)) {
-                struct sk_buff *skb;
-                struct bcom_fec_bd *bd;
+        struct sk_buff *skb;
 
+        while (!bcom_queue_full(rxtsk)) {
                 skb = dev_alloc_skb(FEC_RX_BUFFER_SIZE);
-                if (skb == NULL)
+                if (!skb)
                         return -EAGAIN;
 
                 /* zero out the initial receive buffers to aid debugging */
                 memset(skb->data, 0, FEC_RX_BUFFER_SIZE);
-
-                bd = (struct bcom_fec_bd *)bcom_prepare_next_buffer(rxtsk);
-
-                bd->status = FEC_RX_BUFFER_SIZE;
-                bd->skb_pa = dma_map_single(dev->dev.parent, skb->data,
-                                FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
-
-                bcom_submit_next_buffer(rxtsk, skb);
+                mpc52xx_fec_rx_submit(dev, skb);
         }
-
         return 0;
 }
 
@@ -328,13 +336,12 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                     DMA_TO_DEVICE);
 
         bcom_submit_next_buffer(priv->tx_dmatsk, skb);
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         if (bcom_queue_full(priv->tx_dmatsk)) {
                 netif_stop_queue(dev);
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         return NETDEV_TX_OK;
 }
 
@@ -359,9 +366,9 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+        unsigned long flags;
 
-        spin_lock(&priv->lock);
-
+        spin_lock_irqsave(&priv->lock, flags);
         while (bcom_buffer_done(priv->tx_dmatsk)) {
                 struct sk_buff *skb;
                 struct bcom_fec_bd *bd;
@@ -372,11 +379,10 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
 
                 dev_kfree_skb_irq(skb);
         }
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         netif_wake_queue(dev);
 
-        spin_unlock(&priv->lock);
-
         return IRQ_HANDLED;
 }
 
@@ -384,67 +390,60 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+        struct sk_buff *rskb; /* received sk_buff */
+        struct sk_buff *skb;  /* new sk_buff to enqueue in its place */
+        struct bcom_fec_bd *bd;
+        u32 status, physaddr;
+        int length;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
 
         while (bcom_buffer_done(priv->rx_dmatsk)) {
-                struct sk_buff *skb;
-                struct sk_buff *rskb;
-                struct bcom_fec_bd *bd;
-                u32 status;
 
                 rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status,
-                                (struct bcom_bd **)&bd);
-                dma_unmap_single(dev->dev.parent, bd->skb_pa, rskb->len,
-                                 DMA_FROM_DEVICE);
+                                            (struct bcom_bd **)&bd);
+                physaddr = bd->skb_pa;
 
                 /* Test for errors in received frame */
                 if (status & BCOM_FEC_RX_BD_ERRORS) {
                         /* Drop packet and reuse the buffer */
-                        bd = (struct bcom_fec_bd *)
-                                bcom_prepare_next_buffer(priv->rx_dmatsk);
-
-                        bd->status = FEC_RX_BUFFER_SIZE;
-                        bd->skb_pa = dma_map_single(dev->dev.parent,
-                                        rskb->data,
-                                        FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
-
-                        bcom_submit_next_buffer(priv->rx_dmatsk, rskb);
-
+                        mpc52xx_fec_rx_submit(dev, rskb);
                         dev->stats.rx_dropped++;
-
                         continue;
                 }
 
                 /* skbs are allocated on open, so now we allocate a new one,
                  * and remove the old (with the packet) */
                 skb = dev_alloc_skb(FEC_RX_BUFFER_SIZE);
-                if (skb) {
-                        /* Process the received skb */
-                        int length = status & BCOM_FEC_RX_BD_LEN_MASK;
-
-                        skb_put(rskb, length - 4);      /* length without CRC32 */
-
-                        rskb->dev = dev;
-                        rskb->protocol = eth_type_trans(rskb, dev);
-
-                        netif_rx(rskb);
-                } else {
+                if (!skb) {
                         /* Can't get a new one : reuse the same & drop pkt */
-                        dev_notice(&dev->dev, "Memory squeeze, dropping packet.\n");
+                        dev_notice(&dev->dev, "Low memory - dropped packet.\n");
+                        mpc52xx_fec_rx_submit(dev, rskb);
                         dev->stats.rx_dropped++;
-
-                        skb = rskb;
+                        continue;
                 }
 
-                bd = (struct bcom_fec_bd *)
-                        bcom_prepare_next_buffer(priv->rx_dmatsk);
+                /* Enqueue the new sk_buff back on the hardware */
+                mpc52xx_fec_rx_submit(dev, skb);
 
-                bd->status = FEC_RX_BUFFER_SIZE;
-                bd->skb_pa = dma_map_single(dev->dev.parent, skb->data,
-                                FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
+                /* Process the received skb - Drop the spin lock while
+                 * calling into the network stack */
+                spin_unlock_irqrestore(&priv->lock, flags);
 
-                bcom_submit_next_buffer(priv->rx_dmatsk, skb);
+                dma_unmap_single(dev->dev.parent, physaddr, rskb->len,
+                                 DMA_FROM_DEVICE);
+                length = status & BCOM_FEC_RX_BD_LEN_MASK;
+                skb_put(rskb, length - 4);      /* length without CRC32 */
+                rskb->dev = dev;
+                rskb->protocol = eth_type_trans(rskb, dev);
+                netif_rx(rskb);
+
+                spin_lock_irqsave(&priv->lock, flags);
         }
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         return IRQ_HANDLED;
 }
 
@@ -454,6 +453,7 @@ static irqreturn_t mpc52xx_fec_interrupt(int irq, void *dev_id)
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
         struct mpc52xx_fec __iomem *fec = priv->fec;
         u32 ievent;
+        unsigned long flags;
 
         ievent = in_be32(&fec->ievent);
 
@@ -471,9 +471,10 @@ static irqreturn_t mpc52xx_fec_interrupt(int irq, void *dev_id)
                 if (net_ratelimit() && (ievent & FEC_IEVENT_XFIFO_ERROR))
                         dev_warn(&dev->dev, "FEC_IEVENT_XFIFO_ERROR\n");
 
+                spin_lock_irqsave(&priv->lock, flags);
                 mpc52xx_fec_reset(dev);
+                spin_unlock_irqrestore(&priv->lock, flags);
 
-                netif_wake_queue(dev);
                 return IRQ_HANDLED;
         }
 
@@ -768,6 +769,8 @@ static void mpc52xx_fec_reset(struct net_device *dev)
         bcom_enable(priv->tx_dmatsk);
 
         mpc52xx_fec_start(dev);
+
+        netif_wake_queue(dev);
 }
 
 
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 16def131c390..6850dc0a7b91 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2644,6 +2644,7 @@ static void gfar_netpoll(struct net_device *dev)
                         gfar_interrupt(priv->gfargrp[i].interruptTransmit,
                                                 &priv->gfargrp[i]);
                         enable_irq(priv->gfargrp[i].interruptTransmit);
+                }
         }
 }
 #endif
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 72106898a5cb..538340527aa6 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -342,6 +342,7 @@ static enum ixgbe_media_type ixgbe_get_media_type_82599(struct ixgbe_hw *hw)
         case IXGBE_DEV_ID_82599_KX4:
         case IXGBE_DEV_ID_82599_KX4_MEZZ:
         case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
+        case IXGBE_DEV_ID_82599_KR:
         case IXGBE_DEV_ID_82599_XAUI_LOM:
                 /* Default device ID is mezzanine card KX/KX4 */
                 media_type = ixgbe_media_type_backplane;
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 06a9d18bbdbc..0bd49d3b9f65 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -990,6 +990,7 @@ static void ixgbe_get_ethtool_stats(struct net_device *netdev,
         char *p = NULL;
 
         ixgbe_update_stats(adapter);
+        dev_get_stats(netdev);
         for (i = 0; i < IXGBE_GLOBAL_STATS_LEN; i++) {
                 switch (ixgbe_gstrings_stats[i].type) {
                 case NETDEV_STATS:
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 247ed2a24769..35ea8c93fd80 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -96,6 +96,8 @@ static struct pci_device_id ixgbe_pci_tbl[] = {
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_XAUI_LOM),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_KR),
+         board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP),
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP_EM),
@@ -435,8 +437,6 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
         tx_ring->total_packets += total_packets;
         tx_ring->stats.packets += total_packets;
         tx_ring->stats.bytes += total_bytes;
-        netdev->stats.tx_bytes += total_bytes;
-        netdev->stats.tx_packets += total_packets;
         return (count < tx_ring->work_limit);
 }
 
@@ -5327,6 +5327,7 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         struct ixgbe_ring *tx_ring;
+        struct netdev_queue *txq;
         unsigned int first;
         unsigned int tx_flags = 0;
         u8 hdr_len = 0;
@@ -5424,6 +5425,9 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
                                 tx_ring->atr_count = 0;
                         }
                 }
+                txq = netdev_get_tx_queue(netdev, tx_ring->queue_index);
+                txq->tx_bytes += skb->len;
+                txq->tx_packets++;
                 ixgbe_tx_queue(adapter, tx_ring, tx_flags, count, skb->len,
                                hdr_len);
                 ixgbe_maybe_stop_tx(netdev, tx_ring, DESC_NEEDED);
@@ -5438,19 +5442,6 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
 }
 
 /**
- * ixgbe_get_stats - Get System Network Statistics
- * @netdev: network interface device structure
- *
- * Returns the address of the device statistics structure.
- * The statistics are actually updated from the timer callback.
- **/
-static struct net_device_stats *ixgbe_get_stats(struct net_device *netdev)
-{
-        /* only return the current stats */
-        return &netdev->stats;
-}
-
-/**
  * ixgbe_set_mac - Change the Ethernet Address of the NIC
  * @netdev: network interface device structure
  * @p: pointer to an address structure
@@ -5580,7 +5571,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_stop               = ixgbe_close,
         .ndo_start_xmit         = ixgbe_xmit_frame,
         .ndo_select_queue       = ixgbe_select_queue,
-        .ndo_get_stats          = ixgbe_get_stats,
         .ndo_set_rx_mode        = ixgbe_set_rx_mode,
         .ndo_set_multicast_list = ixgbe_set_rx_mode,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 21b6633da578..f3e8d52610b7 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -50,6 +50,7 @@
 #define IXGBE_DEV_ID_82598EB_XF_LR       0x10F4
 #define IXGBE_DEV_ID_82599_KX4           0x10F7
 #define IXGBE_DEV_ID_82599_KX4_MEZZ      0x1514
+#define IXGBE_DEV_ID_82599_KR            0x1517
 #define IXGBE_DEV_ID_82599_CX4           0x10F9
 #define IXGBE_DEV_ID_82599_SFP           0x10FB
 #define IXGBE_DEV_ID_82599_SFP_EM        0x1507
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 796a493f95ab..1405a170bb43 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1827,6 +1827,9 @@ static int mv643xx_eth_set_mac_address(struct net_device *dev, void *addr)
 {
         struct sockaddr *sa = addr;
 
+        if (!is_valid_ether_addr(sa->sa_data))
+                return -EINVAL;
+
         memcpy(dev->dev_addr, sa->sa_data, ETH_ALEN);
 
         netif_addr_lock_bh(dev);
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index d38921906bb7..3fcb1c356e0d 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -75,7 +75,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
 
-#define MYRI10GE_VERSION_STR "1.5.1-1.451"
+#define MYRI10GE_VERSION_STR "1.5.1-1.453"
 
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -347,7 +347,7 @@ static int myri10ge_max_slices = 1;
 module_param(myri10ge_max_slices, int, S_IRUGO);
 MODULE_PARM_DESC(myri10ge_max_slices, "Max tx/rx queues");
 
-static int myri10ge_rss_hash = MXGEFW_RSS_HASH_TYPE_SRC_PORT;
+static int myri10ge_rss_hash = MXGEFW_RSS_HASH_TYPE_SRC_DST_PORT;
 module_param(myri10ge_rss_hash, int, S_IRUGO);
 MODULE_PARM_DESC(myri10ge_rss_hash, "Type of RSS hashing to do");
 
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 80a667460514..02f8d4b4db63 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -619,17 +619,20 @@ nx_set_product_offs(struct netxen_adapter *adapter)
         uint32_t i;
         __le32 entries;
 
+        int mn_present = (NX_IS_REVISION_P2(adapter->ahw.revision_id)) ?
+                        1 : netxen_p3_has_mn(adapter);
+
         ptab_descr = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_PRODUCT_TBL);
         if (ptab_descr == NULL)
                 return -1;
 
         entries = cpu_to_le32(ptab_descr->num_entries);
 
+nomn:
         for (i = 0; i < entries; i++) {
 
                 __le32 flags, file_chiprev, offs;
                 u8 chiprev = adapter->ahw.revision_id;
-                int mn_present = netxen_p3_has_mn(adapter);
                 uint32_t flagbit;
 
                 offs = cpu_to_le32(ptab_descr->findex) +
@@ -647,6 +650,11 @@ nx_set_product_offs(struct netxen_adapter *adapter)
                 }
         }
 
+        if (mn_present && NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+                mn_present = 0;
+                goto nomn;
+        }
+
         return -1;
 }
 
@@ -1021,6 +1029,10 @@ netxen_p3_has_mn(struct netxen_adapter *adapter)
         u32 capability, flashed_ver;
         capability = 0;
 
+        /* NX2031 always had MN */
+        if (NX_IS_REVISION_P2(adapter->ahw.revision_id))
+                return 1;
+
         netxen_rom_fast_read(adapter,
                         NX_FW_VERSION_OFFSET, (int *)&flashed_ver);
         flashed_ver = NETXEN_DECODE_VERSION(flashed_ver);
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index e5d187fce51b..f4996846a234 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -946,8 +946,9 @@ netxen_nic_init_coalesce_defaults(struct netxen_adapter *adapter)
                 NETXEN_DEFAULT_INTR_COALESCE_TX_PACKETS;
 }
 
+/* with rtnl_lock */
 static int
-netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
+__netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
 {
         int err;
 
@@ -988,14 +989,32 @@ netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
         return 0;
 }
 
+/* Usage: During resume and firmware recovery module.*/
+
+static inline int
+netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
+{
+        int err = 0;
+
+        rtnl_lock();
+        if (netif_running(netdev))
+                err = __netxen_nic_up(adapter, netdev);
+        rtnl_unlock();
+
+        return err;
+}
+
+/* with rtnl_lock */
 static void
-netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
+__netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
 {
         if (adapter->is_up != NETXEN_ADAPTER_UP_MAGIC)
                 return;
 
-        clear_bit(__NX_DEV_UP, &adapter->state);
+        if (!test_and_clear_bit(__NX_DEV_UP, &adapter->state))
+                return;
 
+        smp_mb();
         spin_lock(&adapter->tx_clean_lock);
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
@@ -1014,6 +1033,17 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
         spin_unlock(&adapter->tx_clean_lock);
 }
 
+/* Usage: During suspend and firmware recovery module */
+
+static inline void
+netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
+{
+        rtnl_lock();
+        if (netif_running(netdev))
+                __netxen_nic_down(adapter, netdev);
+        rtnl_unlock();
+
+}
 
 static int
 netxen_nic_attach(struct netxen_adapter *adapter)
@@ -1122,14 +1152,14 @@ netxen_nic_reset_context(struct netxen_adapter *adapter)
                 netif_device_detach(netdev);
 
                 if (netif_running(netdev))
-                        netxen_nic_down(adapter, netdev);
+                        __netxen_nic_down(adapter, netdev);
 
                 netxen_nic_detach(adapter);
 
                 if (netif_running(netdev)) {
                         err = netxen_nic_attach(adapter);
                         if (!err)
-                                err = netxen_nic_up(adapter, netdev);
+                                err = __netxen_nic_up(adapter, netdev);
 
                         if (err)
                                 goto done;
@@ -1499,7 +1529,7 @@ static int netxen_nic_open(struct net_device *netdev)
         if (err)
                 return err;
 
-        err = netxen_nic_up(adapter, netdev);
+        err = __netxen_nic_up(adapter, netdev);
         if (err)
                 goto err_out;
 
@@ -1519,7 +1549,7 @@ static int netxen_nic_close(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
 
-        netxen_nic_down(adapter, netdev);
+        __netxen_nic_down(adapter, netdev);
         return 0;
 }
 
@@ -2025,7 +2055,7 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
 
         if ((work_done < budget) && tx_complete) {
                 napi_complete(&sds_ring->napi);
-                if (netif_running(adapter->netdev))
+                if (test_bit(__NX_DEV_UP, &adapter->state))
                         netxen_nic_enable_int(sds_ring);
         }
 
@@ -2210,8 +2240,7 @@ netxen_detach_work(struct work_struct *work)
 
         netif_device_detach(netdev);
 
-        if (netif_running(netdev))
-                netxen_nic_down(adapter, netdev);
+        netxen_nic_down(adapter, netdev);
 
         netxen_nic_detach(adapter);
 
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 644962adda97..791885262602 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         int ret;
         u16 val;
+        u32 cksum, offset;
 
         /*
          * Read values from EEPROM and store them in the capability structure
@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
                 return 0;
 
-#ifdef notyet
         /*
          * Validate the checksum of the EEPROM date. There are some
          * devices with invalid EEPROMs.
@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
                 ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
                 return -EIO;
         }
-#endif
 
         AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
             ee_ant_gain);
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index d495890355d9..60f547503d75 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -79,6 +79,8 @@ static const struct pci_device_id ath5k_led_devices[] = {
         { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
         /* IBM-specific AR5212 (all others) */
         { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5212_IBM), ATH_LED(0, 0) },
+        /* Dell Vostro A860 (shahar@shahar-or.co.il) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0112), ATH_LED(3, 0) },
         { }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 71b84d91dcff..efc420cd42bf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -186,7 +186,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
                 wait = wait_time;
                 while (ath9k_hw_numtxpending(ah, q)) {
                         if ((--wait) == 0) {
-                                ath_print(common, ATH_DBG_QUEUE,
+                                ath_print(common, ATH_DBG_FATAL,
                                           "Failed to stop TX DMA in 100 "
                                           "msec after killing last frame\n");
                                 break;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6401b3521049..3f5b887d0fcd 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1963,6 +1963,9 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         struct ieee80211_hw *hw = sc->hw;
         int r;
 
+        /* Stop ANI */
+        del_timer_sync(&common->ani.timer);
+
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, retry_tx);
         ath_stoprecv(sc);
@@ -2004,6 +2007,9 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
                 }
         }
 
+        /* Start ANI */
+        ath_start_ani(common);
+
         return r;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 564c6cb1c2b4..1e813bbf474a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1108,11 +1108,11 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
         if (npend) {
                 int r;
 
-                ath_print(common, ATH_DBG_XMIT,
+                ath_print(common, ATH_DBG_FATAL,
                           "Unable to stop TxDMA. Reset HAL!\n");
 
                 spin_lock_bh(&sc->sc_resetlock);
-                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, true);
+                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
@@ -1414,17 +1414,9 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
          * For HT capable stations, we save tidno for later use.
          * We also override seqno set by upper layer with the one
          * in tx aggregation state.
-         *
-         * If fragmentation is on, the sequence number is
-         * not overridden, since it has been
-         * incremented by the fragmentation routine.
-         *
-         * FIXME: check if the fragmentation threshold exceeds
-         * IEEE80211 max.
          */
         tid = ATH_AN_2_TID(an, bf->bf_tidno);
-        hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
-                        IEEE80211_SEQ_SEQ_SHIFT);
+        hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
         bf->bf_seqno = tid->seq_next;
         INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
@@ -1636,7 +1628,8 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_keyix = ATH9K_TXKEYIX_INVALID;
         }
 
-        if (ieee80211_is_data_qos(fc) && (sc->sc_flags & SC_OP_TXAGGR))
+        if (ieee80211_is_data_qos(fc) && bf_isht(bf) &&
+            (sc->sc_flags & SC_OP_TXAGGR))
                 assign_aggr_tid_seqno(skb, bf);
 
         bf->bf_mpdu = skb;
@@ -1780,7 +1773,8 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int hdrlen, padsize;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        int padpos, padsize;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_tx_control txctl;
 
@@ -1792,7 +1786,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
          * BSSes.
          */
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                         sc->tx.seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
@@ -1800,9 +1793,9 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         /* Add the padding after the header if this is not already done */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        if (hdrlen & 3) {
-                padsize = hdrlen % 4;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos) {
                 if (skb_headroom(skb) < padsize) {
                         ath_print(common, ATH_DBG_XMIT,
                                   "TX CABQ padding failed\n");
@@ -1810,7 +1803,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
                 skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, hdrlen);
+                memmove(skb->data, skb->data + padsize, padpos);
         }
 
         txctl.txq = sc->beacon.cabq;
@@ -1838,7 +1831,8 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int hdrlen, padsize;
+        struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
+        int padpos, padsize;
 
         ath_print(common, ATH_DBG_XMIT, "TX complete: skb: %p\n", skb);
 
@@ -1853,14 +1847,14 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        padsize = hdrlen & 3;
-        if (padsize && hdrlen >= 24) {
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos+padsize) {
                 /*
                  * Remove MAC header padding before giving the frame back to
                  * mac80211.
                  */
-                memmove(skb->data + padsize, skb->data, hdrlen);
+                memmove(skb->data + padsize, skb->data, padpos);
                 skb_pull(skb, padsize);
         }
 
@@ -2078,7 +2072,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                                 &txq->axq_q, lastbf->list.prev);
 
                 txq->axq_depth--;
-                txok = (ds->ds_txstat.ts_status == 0);
+                txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT);
                 txq->axq_tx_inprogress = false;
                 spin_unlock_bh(&txq->axq_lock);
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 077480c4916a..19b4eae47b59 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1784,7 +1784,10 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                                dma_reason[0], dma_reason[1],
                                dma_reason[2], dma_reason[3],
                                dma_reason[4], dma_reason[5]);
-                        b43_controller_restart(dev, "DMA error");
+                        b43err(dev->wl, "This device does not support DMA "
+                               "on your system. Please use PIO instead.\n");
+                        b43err(dev->wl, "CONFIG_B43_FORCE_PIO must be set in "
+                               "your kernel configuration.\n");
                         return;
                 }
                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 3708b5c204e6..d1bab141508a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1835,8 +1835,7 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
                 rc = -EIO;
         }
 
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
@@ -2836,6 +2835,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .led_compensation = 64,
+        .broken_powersave = true,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2852,6 +2852,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .led_compensation = 64,
+        .broken_powersave = true,
 };
 
 struct pci_device_id iwl3945_hw_card_ids[] = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index a5e3384d56b3..78706ce8b7ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1204,7 +1204,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
         iwl4965_interpolate_chan(priv, channel, &ch_eeprom_info);
 
         /* calculate tx gain adjustment based on power supply voltage */
-        voltage = priv->calib_info->voltage;
+        voltage = le16_to_cpu(priv->calib_info->voltage);
         init_voltage = (s32)le32_to_cpu(priv->card_alive_init.voltage);
         voltage_compensation =
             iwl4965_get_voltage_compensation(voltage, init_voltage);
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 4ef6804a455a..bc056e9ab85f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -92,11 +92,15 @@
 
 static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
 {
-        u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
-                                                       EEPROM_5000_TEMPERATURE);
-        /* offset =  temperature -  voltage / coef */
-        s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
-        return offset;
+        u16 temperature, voltage;
+        __le16 *temp_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE);
+
+        temperature = le16_to_cpu(temp_calib[0]);
+        voltage = le16_to_cpu(temp_calib[1]);
+
+        /* offset = temp - volt / coeff */
+        return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
 }
 
 /* Fixed (non-configurable) rx data from phy */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index f2b1915530e7..ec6b27689fa8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -333,14 +333,15 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
 static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
-        u16 *xtal_calib = (u16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+        __le16 *xtal_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
 
         cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
         cmd.hdr.first_group = 0;
         cmd.hdr.groups_num = 1;
         cmd.hdr.data_valid = 1;
-        cmd.cap_pin1 = (u8)xtal_calib[0];
-        cmd.cap_pin2 = (u8)xtal_calib[1];
+        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
+        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
         return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
                              (u8 *)&cmd, sizeof(cmd));
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 904b5d8da860..771b03c1c7c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1995,7 +1995,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS))
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
                 size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
                         ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
 #else
@@ -3349,7 +3349,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         priv->ibss_beacon = NULL;
 
-        spin_lock_init(&priv->lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -3538,10 +3537,11 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 (unsigned long long) pci_resource_len(pdev, 0));
         IWL_DEBUG_INFO(priv, "pci_resource_base = %p\n", priv->hw_base);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
         iwl_hw_detect(priv);
         IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index a7bfae01f19b..1ec8cb4d5eae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -77,8 +77,7 @@
  * The MAC (uCode processor, etc.) does not need to be powered up for accessing
  * the CSR registers.
  *
- * NOTE:  Newer devices using one-time-programmable (OTP) memory
- *        require device to be awake in order to read this memory
+ * NOTE:  Device does need to be awake in order to read this memory
  *        via CSR_EEPROM and CSR_OTP registers
  */
 #define CSR_BASE    (0x000)
@@ -111,9 +110,8 @@
 /*
  * EEPROM and OTP (one-time-programmable) memory reads
  *
- * NOTE:  For (newer) devices using OTP, device must be awake, initialized via
- *        apm_ops.init() in order to read.  Older devices (3945/4965/5000)
- *        use EEPROM and do not require this.
+ * NOTE:  Device must be awake, initialized via apm_ops.init(),
+ *        in order to read.
  */
 #define CSR_EEPROM_REG          (CSR_BASE+0x02c)
 #define CSR_EEPROM_GP           (CSR_BASE+0x030)
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 1e12e7340c90..42f9b17327c3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1195,7 +1195,7 @@ struct iwl_priv {
         u32 last_beacon_time;
         u64 last_tsf;
 
-        /* eeprom */
+        /* eeprom -- this is in the card's little endian byte order */
         u8 *eeprom;
         int    nvm_device_type;
         struct iwl_eeprom_calib_info *calib_info;
@@ -1383,4 +1383,15 @@ static inline int is_channel_ibss(const struct iwl_channel_info *ch)
         return ((ch->flags & EEPROM_CHANNEL_IBSS)) ? 1 : 0;
 }
 
+static inline void __iwl_free_pages(struct iwl_priv *priv, struct page *page)
+{
+        __free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
+
+static inline void iwl_free_pages(struct iwl_priv *priv, unsigned long page)
+{
+        free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
 #endif                          /* __iwl_dev_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 3946e5c03f81..4a30969689ff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -370,7 +370,7 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
         return ret;
 }
 
-static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, __le16 *eeprom_data)
 {
         int ret = 0;
         u32 r;
@@ -404,7 +404,7 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
                                 CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
                 IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
         }
-        *eeprom_data = le16_to_cpu((__force __le16)(r >> 16));
+        *eeprom_data = cpu_to_le16(r >> 16);
         return 0;
 }
 
@@ -413,7 +413,8 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
  */
 static bool iwl_is_otp_empty(struct iwl_priv *priv)
 {
-        u16 next_link_addr = 0, link_value;
+        u16 next_link_addr = 0;
+        __le16 link_value;
         bool is_empty = false;
 
         /* locate the beginning of OTP link list */
@@ -443,7 +444,8 @@ static bool iwl_is_otp_empty(struct iwl_priv *priv)
 static int iwl_find_otp_image(struct iwl_priv *priv,
                                         u16 *validblockaddr)
 {
-        u16 next_link_addr = 0, link_value = 0, valid_addr;
+        u16 next_link_addr = 0, valid_addr;
+        __le16 link_value = 0;
         int usedblocks = 0;
 
         /* set addressing mode to absolute to traverse the link list */
@@ -463,7 +465,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                  * check for more block on the link list
                  */
                 valid_addr = next_link_addr;
-                next_link_addr = link_value * sizeof(u16);
+                next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
                 IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
                                usedblocks, next_link_addr);
                 if (iwl_read_otp_word(priv, next_link_addr, &link_value))
@@ -497,7 +499,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
  */
 int iwl_eeprom_init(struct iwl_priv *priv)
 {
-        u16 *e;
+        __le16 *e;
         u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
         int sz;
         int ret;
@@ -516,12 +518,9 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 ret = -ENOMEM;
                 goto alloc_err;
         }
-        e = (u16 *)priv->eeprom;
+        e = (__le16 *)priv->eeprom;
 
-        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
-                /* OTP reads require powered-up chip */
-                priv->cfg->ops->lib->apm_ops.init(priv);
-        }
+        priv->cfg->ops->lib->apm_ops.init(priv);
 
         ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
         if (ret < 0) {
@@ -562,7 +561,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 }
                 for (addr = validblockaddr; addr < validblockaddr + sz;
                      addr += sizeof(u16)) {
-                        u16 eeprom_data;
+                        __le16 eeprom_data;
 
                         ret = iwl_read_otp_word(priv, addr, &eeprom_data);
                         if (ret)
@@ -570,13 +569,6 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                         e[cache_addr / 2] = eeprom_data;
                         cache_addr += sizeof(u16);
                 }
-
-                /*
-                 * Now that OTP reads are complete, reset chip to save
-                 *   power until we load uCode during "up".
-                 */
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-
         } else {
                 /* eeprom is an array of 16bit values */
                 for (addr = 0; addr < sz; addr += sizeof(u16)) {
@@ -594,7 +586,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                                 goto done;
                         }
                         r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
-                        e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+                        e[addr / 2] = cpu_to_le16(r >> 16);
                 }
         }
         ret = 0;
@@ -603,6 +595,8 @@ done:
 err:
         if (ret)
                 iwl_eeprom_free(priv);
+        /* Reset chip to save power until we load uCode during "up". */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
 alloc_err:
         return ret;
 }
@@ -755,7 +749,8 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
         ch_info->ht40_eeprom = *eeprom_ch;
         ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
         ch_info->ht40_flags = eeprom_ch->flags;
-        ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
+        if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
+                ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 5cd2b66bbe45..0cd9c02ee044 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -137,7 +137,7 @@ struct iwl_eeprom_channel {
  *
  */
 struct iwl_eeprom_enhanced_txpwr {
-        u16 common;
+        __le16 common;
         s8 chain_a_max;
         s8 chain_b_max;
         s8 chain_c_max;
@@ -360,7 +360,7 @@ struct iwl_eeprom_calib_subband_info {
 struct iwl_eeprom_calib_info {
         u8 saturation_power24;  /* half-dBm (e.g. "34" = 17 dBm) */
         u8 saturation_power52;  /* half-dBm */
-        s16 voltage;            /* signed */
+        __le16 voltage;         /* signed */
         struct iwl_eeprom_calib_subband_info
                 band_info[EEPROM_TX_POWER_BANDS];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index a23165948202..30e9ea6d54ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -234,7 +234,7 @@ cancel:
         }
 fail:
         if (cmd->reply_page) {
-                free_pages(cmd->reply_page, priv->hw_params.rx_page_order);
+                iwl_free_pages(priv, cmd->reply_page);
                 cmd->reply_page = 0;
         }
 out:
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 6090bc15a6d5..f5c87e72660a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -345,10 +345,8 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
-                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -416,9 +414,7 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_page--;
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index a2b2b8315ff9..fa1c89ba6459 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -144,8 +144,7 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
                 clear_bit(STATUS_SCAN_HW, &priv->status);
         }
 
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index cd6a6901216e..cde09a890b73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -164,9 +164,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                         break;
                 }
         }
-
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
@@ -391,9 +389,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                         break;
                 }
         }
-
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 58b132f9cf28..87ce2bd292c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -407,13 +407,14 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        if (priv->txq)
+        if (priv->txq) {
                 for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
                      txq_id++)
                         if (txq_id == IWL_CMD_QUEUE_NUM)
                                 iwl_cmd_queue_free(priv);
                         else
                                 iwl_tx_queue_free(priv, txq_id);
+        }
         iwl_free_dma_ptr(priv, &priv->kw);
 
         iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
@@ -1353,7 +1354,7 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
         if (priv->stations[sta_id].tid[tid].agg.state ==
                                 IWL_EMPTYING_HW_QUEUE_ADDBA) {
                 IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
-                ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+                ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
                 priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
                 return 0;
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index f7c7ff4264fb..6533122ed87a 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -548,6 +548,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         txq = &priv->txq[txq_id];
         q = &txq->q;
 
+        if ((iwl_queue_space(q) < q->high_mark))
+                goto drop;
+
         spin_lock_irqsave(&priv->lock, flags);
 
         idx = get_cmd_index(q, q->write_ptr, 0);
@@ -812,7 +815,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                 break;
         }
 
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
@@ -1198,9 +1201,7 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_page--;
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
@@ -1247,10 +1248,8 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
-                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -1716,7 +1715,7 @@ int iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS))
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
                 size = (size > DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES)
                         ? DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES : size;
 #else
@@ -3908,7 +3907,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->retry_rate = 1;
         priv->ibss_beacon = NULL;
 
-        spin_lock_init(&priv->lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -3977,9 +3975,11 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS |
-                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+                    IEEE80211_HW_SPECTRUM_MGMT;
+
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
@@ -4098,10 +4098,11 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, 0x41, 0x00);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
 
         /***********************
          * 4. Read EEPROM
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 5a26bb05a33a..79ffa3b98d73 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -349,7 +349,7 @@ int iwm_up(struct iwm_priv *iwm);
 int iwm_down(struct iwm_priv *iwm);
 
 /* TX API */
-u16 iwm_tid_to_queue(u16 tid);
+int iwm_tid_to_queue(u16 tid);
 void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages);
 void iwm_tx_worker(struct work_struct *work);
 int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index e4f0f8705f65..c4c0d23c63ec 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -76,7 +76,7 @@ static int iwm_stop(struct net_device *ndev)
  */
 static const u16 iwm_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
 
-u16 iwm_tid_to_queue(u16 tid)
+int iwm_tid_to_queue(u16 tid)
 {
         if (tid > IWM_UMAC_TID_NR - 2)
                 return -EINVAL;
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 0619d6a1103c..fd399e6b1930 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1125,7 +1125,7 @@ static int iwm_ntf_stop_resume_tx(struct iwm_priv *iwm, u8 *buf,
 
                 if (!stop) {
                         struct iwm_tx_queue *txq;
-                        u16 queue = iwm_tid_to_queue(bit);
+                        int queue = iwm_tid_to_queue(bit);
 
                         if (queue < 0)
                                 continue;
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index f07ba0b6c5f1..71f88a08e090 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -2031,10 +2031,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
         if (priv->connect_status == LBS_CONNECTED) {
                 memcpy(extra, priv->curbssparams.ssid,
                        priv->curbssparams.ssid_len);
-                extra[priv->curbssparams.ssid_len] = '\0';
         } else {
                 memset(extra, 0, 32);
-                extra[priv->curbssparams.ssid_len] = '\0';
         }
         /*
          * If none, we may want to get the one that was set
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 0cb5ecc822a8..59d49159cf2a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -84,7 +84,8 @@ struct rxd_ops {
         int rxd_size;
         void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
         void (*rxd_refill)(void *rxd, dma_addr_t addr, int len);
-        int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status);
+        int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status,
+                           __le16 *qos);
 };
 
 struct mwl8k_device_info {
@@ -184,7 +185,7 @@ struct mwl8k_priv {
         /* PHY parameters */
         struct ieee80211_supported_band band;
         struct ieee80211_channel channels[14];
-        struct ieee80211_rate rates[13];
+        struct ieee80211_rate rates[14];
 
         bool radio_on;
         bool radio_short_preamble;
@@ -220,15 +221,6 @@ struct mwl8k_vif {
         u8      bssid[ETH_ALEN];
         u8      mac_addr[ETH_ALEN];
 
-        /*
-         * Subset of supported legacy rates.
-         * Intersection of AP and STA supported rates.
-         */
-        struct ieee80211_rate legacy_rates[13];
-
-        /* number of supported legacy rates */
-        u8      legacy_nrates;
-
          /* Index into station database.Returned by update_sta_db call */
         u8      peer_id;
 
@@ -266,6 +258,11 @@ static const struct ieee80211_rate mwl8k_rates[] = {
         { .bitrate = 360, .hw_value = 72, },
         { .bitrate = 480, .hw_value = 96, },
         { .bitrate = 540, .hw_value = 108, },
+        { .bitrate = 720, .hw_value = 144, },
+};
+
+static const u8 mwl8k_rateids[12] = {
+        2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108,
 };
 
 /* Set or get info from Firmware */
@@ -574,7 +571,7 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
                                "helper image\n", pci_name(priv->pdev));
                         return rc;
                 }
-                msleep(1);
+                msleep(5);
 
                 rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
         } else {
@@ -591,9 +588,8 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
                 iowrite32(MWL8K_MODE_AP, priv->regs + MWL8K_HIU_GEN_PTR);
         else
                 iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
-        msleep(1);
 
-        loops = 200000;
+        loops = 500000;
         do {
                 u32 ready_code;
 
@@ -633,9 +629,6 @@ struct ewc_ht_info {
 /* Peer Entry flags - used to define the type of the peer node */
 #define MWL8K_PEER_TYPE_ACCESSPOINT     2
 
-#define MWL8K_IEEE_LEGACY_DATA_RATES    13
-#define MWL8K_MCS_BITMAP_SIZE           16
-
 struct peer_capability_info {
         /* Peer type - AP vs. STA.  */
         __u8    peer_type;
@@ -652,10 +645,10 @@ struct peer_capability_info {
         struct ewc_ht_info      ewc_info;
 
         /* Legacy rate table. Intersection of our rates and peer rates.  */
-        __u8    legacy_rates[MWL8K_IEEE_LEGACY_DATA_RATES];
+        __u8    legacy_rates[12];
 
         /* HT rate table. Intersection of our rates and peer rates.  */
-        __u8    ht_rates[MWL8K_MCS_BITMAP_SIZE];
+        __u8    ht_rates[16];
         __u8    pad[16];
 
         /* If set, interoperability mode, no proprietary extensions.  */
@@ -706,55 +699,64 @@ static inline u16 mwl8k_qos_setbit_qlen(u16 qos, u8 len)
 struct mwl8k_dma_data {
         __le16 fwlen;
         struct ieee80211_hdr wh;
+        char data[0];
 } __attribute__((packed));
 
 /* Routines to add/remove DMA header from skb.  */
-static inline void mwl8k_remove_dma_header(struct sk_buff *skb)
+static inline void mwl8k_remove_dma_header(struct sk_buff *skb, __le16 qos)
 {
-        struct mwl8k_dma_data *tr = (struct mwl8k_dma_data *)skb->data;
-        void *dst, *src = &tr->wh;
-        int hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
-        u16 space = sizeof(struct mwl8k_dma_data) - hdrlen;
+        struct mwl8k_dma_data *tr;
+        int hdrlen;
 
-        dst = (void *)tr + space;
-        if (dst != src) {
-                memmove(dst, src, hdrlen);
-                skb_pull(skb, space);
+        tr = (struct mwl8k_dma_data *)skb->data;
+        hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
+
+        if (hdrlen != sizeof(tr->wh)) {
+                if (ieee80211_is_data_qos(tr->wh.frame_control)) {
+                        memmove(tr->data - hdrlen, &tr->wh, hdrlen - 2);
+                        *((__le16 *)(tr->data - 2)) = qos;
+                } else {
+                        memmove(tr->data - hdrlen, &tr->wh, hdrlen);
+                }
         }
+
+        if (hdrlen != sizeof(*tr))
+                skb_pull(skb, sizeof(*tr) - hdrlen);
 }
 
 static inline void mwl8k_add_dma_header(struct sk_buff *skb)
 {
         struct ieee80211_hdr *wh;
-        u32 hdrlen, pktlen;
+        int hdrlen;
         struct mwl8k_dma_data *tr;
 
+        /*
+         * Add a firmware DMA header; the firmware requires that we
+         * present a 2-byte payload length followed by a 4-address
+         * header (without QoS field), followed (optionally) by any
+         * WEP/ExtIV header (but only filled in for CCMP).
+         */
         wh = (struct ieee80211_hdr *)skb->data;
+
         hdrlen = ieee80211_hdrlen(wh->frame_control);
-        pktlen = skb->len;
+        if (hdrlen != sizeof(*tr))
+                skb_push(skb, sizeof(*tr) - hdrlen);
 
-        /*
-         * Copy up/down the 802.11 header; the firmware requires
-         * we present a 2-byte payload length followed by a
-         * 4-address header (w/o QoS), followed (optionally) by
-         * any WEP/ExtIV header (but only filled in for CCMP).
-         */
-        if (hdrlen != sizeof(struct mwl8k_dma_data))
-                skb_push(skb, sizeof(struct mwl8k_dma_data) - hdrlen);
+        if (ieee80211_is_data_qos(wh->frame_control))
+                hdrlen -= 2;
 
         tr = (struct mwl8k_dma_data *)skb->data;
         if (wh != &tr->wh)
                 memmove(&tr->wh, wh, hdrlen);
-
-        /* Clear addr4 */
-        memset(tr->wh.addr4, 0, ETH_ALEN);
+        if (hdrlen != sizeof(tr->wh))
+                memset(((void *)&tr->wh) + hdrlen, 0, sizeof(tr->wh) - hdrlen);
 
         /*
          * Firmware length is the length of the fully formed "802.11
          * payload".  That is, everything except for the 802.11 header.
          * This includes all crypto material including the MIC.
          */
-        tr->fwlen = cpu_to_le16(pktlen - hdrlen);
+        tr->fwlen = cpu_to_le16(skb->len - sizeof(*tr));
 }
 
 
@@ -779,6 +781,10 @@ struct mwl8k_rxd_8366 {
         __u8 rx_ctrl;
 } __attribute__((packed));
 
+#define MWL8K_8366_RATE_INFO_MCS_FORMAT         0x80
+#define MWL8K_8366_RATE_INFO_40MHZ              0x40
+#define MWL8K_8366_RATE_INFO_RATEID(x)          ((x) & 0x3f)
+
 #define MWL8K_8366_RX_CTRL_OWNED_BY_HOST        0x80
 
 static void mwl8k_rxd_8366_init(void *_rxd, dma_addr_t next_dma_addr)
@@ -800,7 +806,8 @@ static void mwl8k_rxd_8366_refill(void *_rxd, dma_addr_t addr, int len)
 }
 
 static int
-mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status)
+mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status,
+                       __le16 *qos)
 {
         struct mwl8k_rxd_8366 *rxd = _rxd;
 
@@ -813,9 +820,11 @@ mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status)
         status->signal = -rxd->rssi;
         status->noise = -rxd->noise_floor;
 
-        if (rxd->rate & 0x80) {
+        if (rxd->rate & MWL8K_8366_RATE_INFO_MCS_FORMAT) {
                 status->flag |= RX_FLAG_HT;
-                status->rate_idx = rxd->rate & 0x7f;
+                if (rxd->rate & MWL8K_8366_RATE_INFO_40MHZ)
+                        status->flag |= RX_FLAG_40MHZ;
+                status->rate_idx = MWL8K_8366_RATE_INFO_RATEID(rxd->rate);
         } else {
                 int i;
 
@@ -830,6 +839,8 @@ mwl8k_rxd_8366_process(void *_rxd, struct ieee80211_rx_status *status)
         status->band = IEEE80211_BAND_2GHZ;
         status->freq = ieee80211_channel_to_frequency(rxd->channel);
 
+        *qos = rxd->qos_control;
+
         return le16_to_cpu(rxd->pkt_len);
 }
 
@@ -888,7 +899,8 @@ static void mwl8k_rxd_8687_refill(void *_rxd, dma_addr_t addr, int len)
 }
 
 static int
-mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status)
+mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status,
+                       __le16 *qos)
 {
         struct mwl8k_rxd_8687 *rxd = _rxd;
         u16 rate_info;
@@ -903,7 +915,6 @@ mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status)
 
         status->signal = -rxd->rssi;
         status->noise = -rxd->noise_level;
-        status->qual = rxd->link_quality;
         status->antenna = MWL8K_8687_RATE_INFO_ANTSELECT(rate_info);
         status->rate_idx = MWL8K_8687_RATE_INFO_RATEID(rate_info);
 
@@ -919,6 +930,8 @@ mwl8k_rxd_8687_process(void *_rxd, struct ieee80211_rx_status *status)
         status->band = IEEE80211_BAND_2GHZ;
         status->freq = ieee80211_channel_to_frequency(rxd->channel);
 
+        *qos = rxd->qos_control;
+
         return le16_to_cpu(rxd->pkt_len);
 }
 
@@ -1090,6 +1103,7 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                 void *rxd;
                 int pkt_len;
                 struct ieee80211_rx_status status;
+                __le16 qos;
 
                 skb = rxq->buf[rxq->head].skb;
                 if (skb == NULL)
@@ -1097,7 +1111,7 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
 
                 rxd = rxq->rxd + (rxq->head * priv->rxd_ops->rxd_size);
 
-                pkt_len = priv->rxd_ops->rxd_process(rxd, &status);
+                pkt_len = priv->rxd_ops->rxd_process(rxd, &status, &qos);
                 if (pkt_len < 0)
                         break;
 
@@ -1115,7 +1129,7 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                 rxq->rxd_count--;
 
                 skb_put(skb, pkt_len);
-                mwl8k_remove_dma_header(skb);
+                mwl8k_remove_dma_header(skb, qos);
 
                 /*
                  * Check for a pending join operation.  Save a
@@ -1221,99 +1235,106 @@ static inline void mwl8k_tx_start(struct mwl8k_priv *priv)
         ioread32(priv->regs + MWL8K_HIU_INT_CODE);
 }
 
-struct mwl8k_txq_info {
-        u32 fw_owned;
-        u32 drv_owned;
-        u32 unused;
-        u32 len;
-        u32 head;
-        u32 tail;
-};
-
-static int mwl8k_scan_tx_ring(struct mwl8k_priv *priv,
-                                struct mwl8k_txq_info *txinfo)
+static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
 {
-        int count, desc, status;
-        struct mwl8k_tx_queue *txq;
-        struct mwl8k_tx_desc *tx_desc;
-        int ndescs = 0;
+        struct mwl8k_priv *priv = hw->priv;
+        int i;
 
-        memset(txinfo, 0, MWL8K_TX_QUEUES * sizeof(struct mwl8k_txq_info));
+        for (i = 0; i < MWL8K_TX_QUEUES; i++) {
+                struct mwl8k_tx_queue *txq = priv->txq + i;
+                int fw_owned = 0;
+                int drv_owned = 0;
+                int unused = 0;
+                int desc;
 
-        for (count = 0; count < MWL8K_TX_QUEUES; count++) {
-                txq = priv->txq + count;
-                txinfo[count].len = txq->stats.len;
-                txinfo[count].head = txq->head;
-                txinfo[count].tail = txq->tail;
                 for (desc = 0; desc < MWL8K_TX_DESCS; desc++) {
-                        tx_desc = txq->txd + desc;
-                        status = le32_to_cpu(tx_desc->status);
+                        struct mwl8k_tx_desc *tx_desc = txq->txd + desc;
+                        u32 status;
 
+                        status = le32_to_cpu(tx_desc->status);
                         if (status & MWL8K_TXD_STATUS_FW_OWNED)
-                                txinfo[count].fw_owned++;
+                                fw_owned++;
                         else
-                                txinfo[count].drv_owned++;
+                                drv_owned++;
 
                         if (tx_desc->pkt_len == 0)
-                                txinfo[count].unused++;
+                                unused++;
                 }
-        }
 
-        return ndescs;
+                printk(KERN_ERR "%s: txq[%d] len=%d head=%d tail=%d "
+                       "fw_owned=%d drv_owned=%d unused=%d\n",
+                       wiphy_name(hw->wiphy), i,
+                       txq->stats.len, txq->head, txq->tail,
+                       fw_owned, drv_owned, unused);
+        }
 }
 
 /*
  * Must be called with priv->fw_mutex held and tx queues stopped.
  */
+#define MWL8K_TX_WAIT_TIMEOUT_MS        1000
+
 static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
 {
         struct mwl8k_priv *priv = hw->priv;
         DECLARE_COMPLETION_ONSTACK(tx_wait);
-        u32 count;
-        unsigned long timeout;
+        int retry;
+        int rc;
 
         might_sleep();
 
+        /*
+         * The TX queues are stopped at this point, so this test
+         * doesn't need to take ->tx_lock.
+         */
+        if (!priv->pending_tx_pkts)
+                return 0;
+
+        retry = 0;
+        rc = 0;
+
         spin_lock_bh(&priv->tx_lock);
-        count = priv->pending_tx_pkts;
-        if (count)
-                priv->tx_wait = &tx_wait;
-        spin_unlock_bh(&priv->tx_lock);
+        priv->tx_wait = &tx_wait;
+        while (!rc) {
+                int oldcount;
+                unsigned long timeout;
 
-        if (count) {
-                struct mwl8k_txq_info txinfo[MWL8K_TX_QUEUES];
-                int index;
-                int newcount;
+                oldcount = priv->pending_tx_pkts;
 
+                spin_unlock_bh(&priv->tx_lock);
                 timeout = wait_for_completion_timeout(&tx_wait,
-                                        msecs_to_jiffies(5000));
-                if (timeout)
-                        return 0;
-
+                            msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
                 spin_lock_bh(&priv->tx_lock);
-                priv->tx_wait = NULL;
-                newcount = priv->pending_tx_pkts;
-                mwl8k_scan_tx_ring(priv, txinfo);
-                spin_unlock_bh(&priv->tx_lock);
 
-                printk(KERN_ERR "%s(%u) TIMEDOUT:5000ms Pend:%u-->%u\n",
-                       __func__, __LINE__, count, newcount);
+                if (timeout) {
+                        WARN_ON(priv->pending_tx_pkts);
+                        if (retry) {
+                                printk(KERN_NOTICE "%s: tx rings drained\n",
+                                       wiphy_name(hw->wiphy));
+                        }
+                        break;
+                }
 
-                for (index = 0; index < MWL8K_TX_QUEUES; index++)
-                        printk(KERN_ERR "TXQ:%u L:%u H:%u T:%u FW:%u "
-                               "DRV:%u U:%u\n",
-                                        index,
-                                        txinfo[index].len,
-                                        txinfo[index].head,
-                                        txinfo[index].tail,
-                                        txinfo[index].fw_owned,
-                                        txinfo[index].drv_owned,
-                                        txinfo[index].unused);
+                if (priv->pending_tx_pkts < oldcount) {
+                        printk(KERN_NOTICE "%s: timeout waiting for tx "
+                               "rings to drain (%d -> %d pkts), retrying\n",
+                               wiphy_name(hw->wiphy), oldcount,
+                               priv->pending_tx_pkts);
+                        retry = 1;
+                        continue;
+                }
 
-                return -ETIMEDOUT;
+                priv->tx_wait = NULL;
+
+                printk(KERN_ERR "%s: tx rings stuck for %d ms\n",
+                       wiphy_name(hw->wiphy), MWL8K_TX_WAIT_TIMEOUT_MS);
+                mwl8k_dump_tx_rings(hw);
+
+                rc = -ETIMEDOUT;
         }
+        spin_unlock_bh(&priv->tx_lock);
 
-        return 0;
+        return rc;
 }
 
 #define MWL8K_TXD_SUCCESS(status)                               \
@@ -1361,7 +1382,7 @@ static void mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int force)
                 BUG_ON(skb == NULL);
                 pci_unmap_single(priv->pdev, addr, size, PCI_DMA_TODEVICE);
 
-                mwl8k_remove_dma_header(skb);
+                mwl8k_remove_dma_header(skb, tx_desc->qos_control);
 
                 /* Mark descriptor as unused */
                 tx_desc->pkt_phys_addr = 0;
@@ -1563,8 +1584,8 @@ static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
  * Command processing.
  */
 
-/* Timeout firmware commands after 2000ms */
-#define MWL8K_CMD_TIMEOUT_MS    2000
+/* Timeout firmware commands after 10s */
+#define MWL8K_CMD_TIMEOUT_MS    10000
 
 static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
 {
@@ -1615,12 +1636,21 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                        MWL8K_CMD_TIMEOUT_MS);
                 rc = -ETIMEDOUT;
         } else {
+                int ms;
+
+                ms = MWL8K_CMD_TIMEOUT_MS - jiffies_to_msecs(timeout);
+
                 rc = cmd->result ? -EINVAL : 0;
                 if (rc)
                         printk(KERN_ERR "%s: Command %s error 0x%x\n",
                                wiphy_name(hw->wiphy),
                                mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
                                le16_to_cpu(cmd->result));
+                else if (ms > 2000)
+                        printk(KERN_NOTICE "%s: Command %s took %d ms\n",
+                               wiphy_name(hw->wiphy),
+                               mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
+                               ms);
         }
 
         return rc;
@@ -2439,8 +2469,6 @@ mwl8k_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
 /*
  * CMD_FINALIZE_JOIN.
  */
-
-/* FJ beacon buffer size is compiled into the firmware.  */
 #define MWL8K_FJ_BEACON_MAXLEN  128
 
 struct mwl8k_cmd_finalize_join {
@@ -2450,17 +2478,13 @@ struct mwl8k_cmd_finalize_join {
 } __attribute__((packed));
 
 static int mwl8k_finalize_join(struct ieee80211_hw *hw, void *frame,
-                                __u16 framelen, __u16 dtim)
+                               int framelen, int dtim)
 {
         struct mwl8k_cmd_finalize_join *cmd;
         struct ieee80211_mgmt *payload = frame;
-        u16 hdrlen;
-        u32 payload_len;
+        int payload_len;
         int rc;
 
-        if (frame == NULL)
-                return -EINVAL;
-
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
@@ -2469,24 +2493,17 @@ static int mwl8k_finalize_join(struct ieee80211_hw *hw, void *frame,
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
         cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
 
-        hdrlen = ieee80211_hdrlen(payload->frame_control);
-
-        payload_len = framelen > hdrlen ? framelen - hdrlen : 0;
-
-        /* XXX TBD Might just have to abort and return an error */
-        if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
-                printk(KERN_ERR "%s(): WARNING: Incomplete beacon "
-                       "sent to firmware. Sz=%u MAX=%u\n", __func__,
-                       payload_len, MWL8K_FJ_BEACON_MAXLEN);
-
-        if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
+        payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
+        if (payload_len < 0)
+                payload_len = 0;
+        else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
                 payload_len = MWL8K_FJ_BEACON_MAXLEN;
 
-        if (payload && payload_len)
-                memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
+        memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
+
         return rc;
 }
 
@@ -2515,9 +2532,7 @@ static int mwl8k_cmd_update_sta_db(struct ieee80211_hw *hw,
         struct ieee80211_bss_conf *info = &mv_vif->bss_info;
         struct mwl8k_cmd_update_sta_db *cmd;
         struct peer_capability_info *peer_info;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
         int rc;
-        __u8 count, *rates;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
@@ -2536,13 +2551,11 @@ static int mwl8k_cmd_update_sta_db(struct ieee80211_hw *hw,
                 /* Build peer_info block */
                 peer_info->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
                 peer_info->basic_caps = cpu_to_le16(info->assoc_capability);
+                memcpy(peer_info->legacy_rates, mwl8k_rateids,
+                       sizeof(mwl8k_rateids));
                 peer_info->interop = 1;
                 peer_info->amsdu_enabled = 0;
 
-                rates = peer_info->legacy_rates;
-                for (count = 0; count < mv_vif->legacy_nrates; count++)
-                        rates[count] = bitrates[count].hw_value;
-
                 rc = mwl8k_post_cmd(hw, &cmd->header);
                 if (rc == 0)
                         mv_vif->peer_id = peer_info->station_id;
@@ -2565,8 +2578,6 @@ static int mwl8k_cmd_update_sta_db(struct ieee80211_hw *hw,
 /*
  * CMD_SET_AID.
  */
-#define MWL8K_RATE_INDEX_MAX_ARRAY                      14
-
 #define MWL8K_FRAME_PROT_DISABLED                       0x00
 #define MWL8K_FRAME_PROT_11G                            0x07
 #define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
@@ -2579,7 +2590,7 @@ struct mwl8k_cmd_update_set_aid {
          /* AP's MAC address (BSSID) */
         __u8    bssid[ETH_ALEN];
         __le16  protection_mode;
-        __u8    supp_rates[MWL8K_RATE_INDEX_MAX_ARRAY];
+        __u8    supp_rates[14];
 } __attribute__((packed));
 
 static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
@@ -2588,8 +2599,6 @@ static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
         struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
         struct ieee80211_bss_conf *info = &mv_vif->bss_info;
         struct mwl8k_cmd_update_set_aid *cmd;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
-        int count;
         u16 prot_mode;
         int rc;
 
@@ -2621,8 +2630,7 @@ static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
         }
         cmd->protection_mode = cpu_to_le16(prot_mode);
 
-        for (count = 0; count < mv_vif->legacy_nrates; count++)
-                cmd->supp_rates[count] = bitrates[count].hw_value;
+        memcpy(cmd->supp_rates, mwl8k_rateids, sizeof(mwl8k_rateids));
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -2635,20 +2643,17 @@ static int mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
  */
 struct mwl8k_cmd_update_rateset {
         struct  mwl8k_cmd_pkt header;
-        __u8    legacy_rates[MWL8K_RATE_INDEX_MAX_ARRAY];
+        __u8    legacy_rates[14];
 
         /* Bitmap for supported MCS codes.  */
-        __u8    mcs_set[MWL8K_IEEE_LEGACY_DATA_RATES];
-        __u8    reserved[MWL8K_IEEE_LEGACY_DATA_RATES];
+        __u8    mcs_set[16];
+        __u8    reserved[16];
 } __attribute__((packed));
 
 static int mwl8k_update_rateset(struct ieee80211_hw *hw,
                 struct ieee80211_vif *vif)
 {
-        struct mwl8k_vif *mv_vif = MWL8K_VIF(vif);
         struct mwl8k_cmd_update_rateset *cmd;
-        struct ieee80211_rate *bitrates = mv_vif->legacy_rates;
-        int count;
         int rc;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -2657,9 +2662,7 @@ static int mwl8k_update_rateset(struct ieee80211_hw *hw,
 
         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
-
-        for (count = 0; count < mv_vif->legacy_nrates; count++)
-                cmd->legacy_rates[count] = bitrates[count].hw_value;
+        memcpy(cmd->legacy_rates, mwl8k_rateids, sizeof(mwl8k_rateids));
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
         kfree(cmd);
@@ -2932,11 +2935,6 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
         /* Back pointer to parent config block */
         mwl8k_vif->priv = priv;
 
-        /* Setup initial PHY parameters */
-        memcpy(mwl8k_vif->legacy_rates,
-                priv->rates, sizeof(mwl8k_vif->legacy_rates));
-        mwl8k_vif->legacy_nrates = ARRAY_SIZE(priv->rates);
-
         /* Set Initial sequence number to zero */
         mwl8k_vif->seqno = 0;
 
@@ -3014,9 +3012,6 @@ static void mwl8k_bss_info_changed(struct ieee80211_hw *hw,
         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
         int rc;
 
-        if (changed & BSS_CHANGED_BSSID)
-                memcpy(mwl8k_vif->bssid, info->bssid, ETH_ALEN);
-
         if ((changed & BSS_CHANGED_ASSOC) == 0)
                 return;
 
@@ -3030,6 +3025,8 @@ static void mwl8k_bss_info_changed(struct ieee80211_hw *hw,
                 memcpy(&mwl8k_vif->bss_info, info,
                         sizeof(struct ieee80211_bss_conf));
 
+                memcpy(mwl8k_vif->bssid, info->bssid, ETH_ALEN);
+
                 /* Install rates */
                 rc = mwl8k_update_rateset(hw, vif);
                 if (rc)
@@ -3366,7 +3363,7 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
         if (rc) {
                 printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
                        MWL8K_NAME);
-                return rc;
+                goto err_disable_device;
         }
 
         pci_set_master(pdev);
@@ -3597,6 +3594,8 @@ err_iounmap:
 
 err_free_reg:
         pci_release_regions(pdev);
+
+err_disable_device:
         pci_disable_device(pdev);
 
         return rc;
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index a3eefe109df4..6d5660defd87 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -427,7 +427,7 @@ int hermesi_program_init(hermes_t *hw, u32 offset)
         if (err)
                 return err;
 
-        pr_debug(KERN_DEBUG PFX "Enabling volatile, EP 0x%08x\n", offset);
+        pr_debug(PFX "Enabling volatile, EP 0x%08x\n", offset);
         err = hermes_doicmd_wait(hw,
                                  HERMES_PROGRAM_ENABLE_VOLATILE,
                                  offset & 0xFFFFu,
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index c5fe867665e6..1a7eae357fef 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1323,7 +1323,7 @@
 #define PAIRWISE_KEY_ENTRY(__idx) \
         ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
 #define MAC_IVEIV_ENTRY(__idx) \
-        ( MAC_IVEIV_TABLE_BASE + ((__idx) & sizeof(struct mac_iveiv_entry)) )
+        ( MAC_IVEIV_TABLE_BASE + ((__idx) * sizeof(struct mac_iveiv_entry)) )
 #define MAC_WCID_ATTR_ENTRY(__idx) \
         ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
 #define SHARED_KEY_ENTRY(__idx) \
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index eb1e1d00bec3..27bf887f1453 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -37,7 +37,7 @@
 #include <linux/module.h>
 
 #include "rt2x00.h"
-#ifdef CONFIG_RT2800USB
+#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
 #include "rt2x00usb.h"
 #endif
 #include "rt2800lib.h"
@@ -1121,7 +1121,7 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 
         if (rt2x00_intf_is_usb(rt2x00dev)) {
                 rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
-#ifdef CONFIG_RT2800USB
+#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
                 rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
                                             USB_MODE_RESET, REGISTER_TIMEOUT);
 #endif
@@ -2022,6 +2022,12 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         u16 eeprom;
 
         /*
+         * Disable powersaving as default on PCI devices.
+         */
+        if (rt2x00_intf_is_pci(rt2x00dev))
+                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
@@ -2074,8 +2080,7 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HT_CAP_SGI_20 |
             IEEE80211_HT_CAP_SGI_40 |
             IEEE80211_HT_CAP_TX_STBC |
-            IEEE80211_HT_CAP_RX_STBC |
-            IEEE80211_HT_CAP_PSMP_SUPPORT;
+            IEEE80211_HT_CAP_RX_STBC;
         spec->ht.ampdu_factor = 3;
         spec->ht.ampdu_density = 4;
         spec->ht.mcs.tx_params =
@@ -2140,8 +2145,8 @@ static void rt2800_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
         rt2800_register_multiread(rt2x00dev, offset,
                                       &iveiv_entry, sizeof(iveiv_entry));
 
-        memcpy(&iveiv_entry.iv[0], iv16, sizeof(iv16));
-        memcpy(&iveiv_entry.iv[4], iv32, sizeof(iv32));
+        memcpy(iv16, &iveiv_entry.iv[0], sizeof(*iv16));
+        memcpy(iv32, &iveiv_entry.iv[4], sizeof(*iv32));
 }
 
 static int rt2800_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 687e17dc2e9f..0ca589306d71 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2539,6 +2539,11 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
 
         /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index abb4907cf296..6af0f3f71f3a 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -23,6 +23,7 @@
 #define RTL8187_EEPROM_TXPWR_CHAN_1     0x16    /* 3 channels */
 #define RTL8187_EEPROM_TXPWR_CHAN_6     0x1B    /* 2 channels */
 #define RTL8187_EEPROM_TXPWR_CHAN_4     0x3D    /* 2 channels */
+#define RTL8187_EEPROM_SELECT_GPIO      0x3B
 
 #define RTL8187_REQT_READ       0xC0
 #define RTL8187_REQT_WRITE      0x40
@@ -31,6 +32,9 @@
 
 #define RTL8187_MAX_RX          0x9C4
 
+#define RFKILL_MASK_8187_89_97  0x2
+#define RFKILL_MASK_8198        0x4
+
 struct rtl8187_rx_info {
         struct urb *urb;
         struct ieee80211_hw *dev;
@@ -104,6 +108,7 @@ struct rtl8187_priv {
         struct delayed_work work;
         struct ieee80211_hw *dev;
 #ifdef CONFIG_RTL8187_LEDS
+        struct rtl8187_led led_radio;
         struct rtl8187_led led_tx;
         struct rtl8187_led led_rx;
         struct delayed_work led_on;
@@ -122,6 +127,7 @@ struct rtl8187_priv {
         u8 noise;
         u8 slot_time;
         u8 aifsn[4];
+        u8 rfkill_mask;
         struct {
                 __le64 buf;
                 struct sk_buff_head queue;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 76973b8c7099..bc5726dd5fe4 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1322,6 +1322,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         struct ieee80211_channel *channel;
         const char *chip_name;
         u16 txpwr, reg;
+        u16 product_id = le16_to_cpu(udev->descriptor.idProduct);
         int err, i;
 
         dev = ieee80211_alloc_hw(sizeof(*priv), &rtl8187_ops);
@@ -1481,6 +1482,13 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
                 (*channel++).hw_value = txpwr & 0xFF;
                 (*channel++).hw_value = txpwr >> 8;
         }
+        /* Handle the differing rfkill GPIO bit in different models */
+        priv->rfkill_mask = RFKILL_MASK_8187_89_97;
+        if (product_id == 0x8197 || product_id == 0x8198) {
+                eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_SELECT_GPIO, &reg);
+                if (reg & 0xFF00)
+                        priv->rfkill_mask = RFKILL_MASK_8198;
+        }
 
         /*
          * XXX: Once this driver supports anything that requires
@@ -1509,9 +1517,9 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
 
-        printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s\n",
+        printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s, rfkill mask %d\n",
                wiphy_name(dev->wiphy), dev->wiphy->perm_addr,
-               chip_name, priv->asic_rev, priv->rf->name);
+               chip_name, priv->asic_rev, priv->rf->name, priv->rfkill_mask);
 
 #ifdef CONFIG_RTL8187_LEDS
         eeprom_93cx6_read(&eeprom, 0x3F, &reg);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index cf8a4a40fdf6..ded44c045eb2 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -105,19 +105,36 @@ static void rtl8187_led_brightness_set(struct led_classdev *led_dev,
         struct rtl8187_led *led = container_of(led_dev, struct rtl8187_led,
                                                led_dev);
         struct ieee80211_hw *hw = led->dev;
-        struct rtl8187_priv *priv = hw->priv;
+        struct rtl8187_priv *priv;
+        static bool radio_on;
 
-        if (brightness == LED_OFF) {
-                ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
-                /* The LED is off for 1/20 sec so that it just blinks. */
-                ieee80211_queue_delayed_work(hw, &priv->led_on, HZ / 20);
-        } else
-                ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+        if (!hw)
+                return;
+        priv = hw->priv;
+        if (led->is_radio) {
+                if (brightness == LED_FULL) {
+                        ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+                        radio_on = true;
+                } else if (radio_on) {
+                        radio_on = false;
+                        cancel_delayed_work_sync(&priv->led_on);
+                        ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
+                }
+        } else if (radio_on) {
+                if (brightness == LED_OFF) {
+                        ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
+                        /* The LED is off for 1/20 sec - it just blinks. */
+                        ieee80211_queue_delayed_work(hw, &priv->led_on,
+                                                     HZ / 20);
+                } else
+                        ieee80211_queue_delayed_work(hw, &priv->led_on, 0);
+        }
 }
 
 static int rtl8187_register_led(struct ieee80211_hw *dev,
                                 struct rtl8187_led *led, const char *name,
-                                const char *default_trigger, u8 ledpin)
+                                const char *default_trigger, u8 ledpin,
+                                bool is_radio)
 {
         int err;
         struct rtl8187_priv *priv = dev->priv;
@@ -128,6 +145,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
                 return -EINVAL;
         led->dev = dev;
         led->ledpin = ledpin;
+        led->is_radio = is_radio;
         strncpy(led->name, name, sizeof(led->name));
 
         led->led_dev.name = led->name;
@@ -145,7 +163,11 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
 
 static void rtl8187_unregister_led(struct rtl8187_led *led)
 {
+        struct ieee80211_hw *hw = led->dev;
+        struct rtl8187_priv *priv = hw->priv;
+
         led_classdev_unregister(&led->led_dev);
+        flush_delayed_work(&priv->led_off);
         led->dev = NULL;
 }
 
@@ -183,33 +205,37 @@ void rtl8187_leds_init(struct ieee80211_hw *dev, u16 custid)
         INIT_DELAYED_WORK(&priv->led_off, led_turn_off);
 
         snprintf(name, sizeof(name),
+                 "rtl8187-%s::radio", wiphy_name(dev->wiphy));
+        err = rtl8187_register_led(dev, &priv->led_radio, name,
+                         ieee80211_get_radio_led_name(dev), ledpin, true);
+        if (err)
+                return;
+
+        snprintf(name, sizeof(name),
                  "rtl8187-%s::tx", wiphy_name(dev->wiphy));
         err = rtl8187_register_led(dev, &priv->led_tx, name,
-                         ieee80211_get_tx_led_name(dev), ledpin);
+                         ieee80211_get_tx_led_name(dev), ledpin, false);
         if (err)
-                goto error;
+                goto err_tx;
+
         snprintf(name, sizeof(name),
                  "rtl8187-%s::rx", wiphy_name(dev->wiphy));
         err = rtl8187_register_led(dev, &priv->led_rx, name,
-                         ieee80211_get_rx_led_name(dev), ledpin);
-        if (!err) {
-                ieee80211_queue_delayed_work(dev, &priv->led_on, 0);
+                         ieee80211_get_rx_led_name(dev), ledpin, false);
+        if (!err)
                 return;
-        }
-        /* registration of RX LED failed - unregister TX */
+
+        /* registration of RX LED failed - unregister */
         rtl8187_unregister_led(&priv->led_tx);
-error:
-        /* If registration of either failed, cancel delayed work */
-        cancel_delayed_work_sync(&priv->led_off);
-        cancel_delayed_work_sync(&priv->led_on);
+err_tx:
+        rtl8187_unregister_led(&priv->led_radio);
 }
 
 void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
 
-        /* turn the LED off before exiting */
-        ieee80211_queue_delayed_work(dev, &priv->led_off, 0);
+        rtl8187_unregister_led(&priv->led_radio);
         rtl8187_unregister_led(&priv->led_rx);
         rtl8187_unregister_led(&priv->led_tx);
         cancel_delayed_work_sync(&priv->led_off);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.h b/drivers/net/wireless/rtl818x/rtl8187_leds.h
index a0332027aead..efe8041bdda4 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.h
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.h
@@ -47,6 +47,8 @@ struct rtl8187_led {
         u8 ledpin;
         /* The unique name string for this LED device. */
         char name[RTL8187_LED_MAX_NAME_LEN + 1];
+        /* If the LED is radio or tx/rx */
+        bool is_radio;
 };
 
 void rtl8187_leds_init(struct ieee80211_hw *dev, u16 code);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
index cad8037ab2af..03555e1e0cab 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
@@ -25,10 +25,10 @@ static bool rtl8187_is_radio_enabled(struct rtl8187_priv *priv)
         u8 gpio;
 
         gpio = rtl818x_ioread8(priv, &priv->map->GPIO0);
-        rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~0x02);
+        rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~priv->rfkill_mask);
         gpio = rtl818x_ioread8(priv, &priv->map->GPIO1);
 
-        return gpio & 0x02;
+        return gpio & priv->rfkill_mask;
 }
 
 void rtl8187_rfkill_init(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 63511ca131b1..6aeffbe9e401 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -630,10 +630,6 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                         goto out_sleep;
         }
 
-        ret = wl1251_build_null_data(wl);
-        if (ret < 0)
-                goto out_sleep;
-
         if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm enabled");
 
@@ -1116,6 +1112,21 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (changed & BSS_CHANGED_BSSID) {
+                memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+
+                ret = wl1251_build_null_data(wl);
+                if (ret < 0)
+                        goto out;
+
+                if (wl->bss_type != BSS_TYPE_IBSS) {
+                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                          wl->beacon_int, wl->dtim_period);
+                        if (ret < 0)
+                                goto out_sleep;
+                }
+        }
+
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
@@ -1175,23 +1186,6 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
-                memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
-
-                ret = wl1251_build_null_data(wl);
-                if (ret < 0)
-                        goto out;
-
-                if (wl->bss_type != BSS_TYPE_IBSS) {
-                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
-                                          wl->beacon_int, wl->dtim_period);
-                        if (ret < 0)
-                                goto out_sleep;
-                        wl1251_warning("Set ctsprotect failed %d", ret);
-                        goto out_sleep;
-                }
-        }
-
         if (changed & BSS_CHANGED_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
                 ret = wl1251_cmd_template_set(wl, CMD_BEACON, beacon->data,