5 files changed, 19 insertions, 9 deletions

diff --git a/drivers/net/wireless/b43legacy/Kconfig b/drivers/net/wireless/b43legacy/Kconfig
index 94a463478053..1ffa28835c58 100644
--- a/drivers/net/wireless/b43legacy/Kconfig
+++ b/drivers/net/wireless/b43legacy/Kconfig
@@ -1,6 +1,6 @@
 config B43LEGACY
         tristate "Broadcom 43xx-legacy wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && WLAN_80211 && HAS_DMA
+        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
         select SSB
         select FW_LOADER
         ---help---
diff --git a/drivers/net/wireless/b43legacy/b43legacy.h b/drivers/net/wireless/b43legacy/b43legacy.h
index 038baa8869e2..89fe2f972c72 100644
--- a/drivers/net/wireless/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/b43legacy/b43legacy.h
@@ -29,8 +29,6 @@
 
 #define B43legacy_IRQWAIT_MAX_RETRIES   20
 
-#define B43legacy_RX_MAX_SSI            60 /* best guess at max ssi */
-
 /* MMIO offsets */
 #define B43legacy_MMIO_DMA0_REASON      0x20
 #define B43legacy_MMIO_DMA0_IRQ_MASK    0x24
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index 866403415811..0a86bdf53154 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1240,8 +1240,9 @@ struct b43legacy_dmaring *parse_cookie(struct b43legacy_wldev *dev,
 }
 
 static int dma_tx_fragment(struct b43legacy_dmaring *ring,
-                            struct sk_buff *skb)
+                            struct sk_buff **in_skb)
 {
+        struct sk_buff *skb = *in_skb;
         const struct b43legacy_dma_ops *ops = ring->ops;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u8 *header;
@@ -1305,8 +1306,14 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
                 }
 
                 memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+                bounce_skb->dev = skb->dev;
+                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+                info = IEEE80211_SKB_CB(bounce_skb);
+
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
+                *in_skb = bounce_skb;
                 meta->skb = skb;
                 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
                 if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1360,8 +1367,10 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb)
 {
         struct b43legacy_dmaring *ring;
+        struct ieee80211_hdr *hdr;
         int err = 0;
         unsigned long flags;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         ring = priority_to_txring(dev, skb_get_queue_mapping(skb));
         spin_lock_irqsave(&ring->lock, flags);
@@ -1386,7 +1395,11 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 goto out_unlock;
         }
 
-        err = dma_tx_fragment(ring, skb);
+        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+         * into the skb data or cb now. */
+        hdr = NULL;
+        info = NULL;
+        err = dma_tx_fragment(ring, &skb);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
                  * anymore and must not transmit it unencrypted. */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 4b60148a5e61..ab6a18c2e9d9 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2677,7 +2677,7 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         if (conf->channel->hw_value != phy->channel)
                 b43legacy_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
-        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
+        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
 
         /* Adjust the desired TX power level. */
         if (conf->power_level != 0) {
@@ -3593,7 +3593,7 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
 {
         struct b43legacy_wl *wl = dev->wl;
         struct ssb_bus *bus = dev->dev->bus;
-        struct pci_dev *pdev = bus->host_pci;
+        struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
         int err;
         int have_bphy = 0;
         int have_gphy = 0;
@@ -3707,7 +3707,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
 
         if (!list_empty(&wl->devlist)) {
                 /* We are not the first core on this chip. */
-                pdev = dev->bus->host_pci;
+                pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
                 /* Only special chips support more than one wireless
                  * core, although some of the other chips have more than
                  * one wireless core as well. Check for this and
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index 103f3c9e7f58..9c8882d9275e 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -549,7 +549,6 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
                                       (phystat0 & B43legacy_RX_PHYST0_GAINCTL),
                                       (phystat3 & B43legacy_RX_PHYST3_TRSTATE));
         status.noise = dev->stats.link_noise;
-        status.qual = (jssi * 100) / B43legacy_RX_MAX_SSI;
         /* change to support A PHY */
         if (phystat0 & B43legacy_RX_PHYST0_OFDM)
                 status.rate_idx = b43legacy_plcp_get_bitrate_idx_ofdm(plcp, false);