19 files changed, 161 insertions, 282 deletions

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index be35a2f99b1c..11fd1c735589 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -15,8 +15,6 @@
  */
 /* ****************** SDIO CARD Interface Functions **************************/
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/export.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index d33e5598611b..d92d373733d7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/sdio.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index fd672bf53867..a2f32fb990fa 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -39,6 +39,7 @@
 #define BRCMF_C_GET_BSSID                       23
 #define BRCMF_C_GET_SSID                        25
 #define BRCMF_C_SET_SSID                        26
+#define BRCMF_C_TERMINATED                      28
 #define BRCMF_C_GET_CHANNEL                     29
 #define BRCMF_C_SET_CHANNEL                     30
 #define BRCMF_C_GET_SRL                         31
@@ -480,36 +481,14 @@ struct brcmf_pub {
         unsigned long drv_version;      /* Version of dongle-resident driver */
         u8 mac[ETH_ALEN];               /* MAC address obtained from dongle */
 
-        /* Additional stats for the bus level */
-
         /* Multicast data packets sent to dongle */
         unsigned long tx_multicast;
-        /* Packets flushed due to unscheduled sendup thread */
-        unsigned long rx_flushed;
-        /* Number of times dpc scheduled by watchdog timer */
-        unsigned long wd_dpc_sched;
-
-        /* Number of flow control pkts recvd */
-        unsigned long fc_packets;
-
-        /* Last error return */
-        int bcmerror;
-
-        /* Last error from dongle */
-        int dongle_error;
-
-        /* Suspend disable flag  flag */
-        int suspend_disable_flag;       /* "1" to disable all extra powersaving
-                                         during suspend */
-        int in_suspend;         /* flag set to 1 when early suspend called */
-        int dtim_skip;          /* dtim skip , default 0 means wake each dtim */
 
         struct brcmf_if *iflist[BRCMF_MAX_IFS];
 
         struct mutex proto_block;
         unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 
-        u8 macvalue[ETH_ALEN];
         atomic_t pend_8021x_cnt;
         wait_queue_head_t pend_8021x_wait;
 
@@ -519,11 +498,6 @@ struct brcmf_pub {
 #endif
 };
 
-struct bcmevent_name {
-        uint event;
-        const char *name;
-};
-
 struct brcmf_if_event {
         u8 ifidx;
         u8 action;
@@ -557,13 +531,6 @@ struct brcmf_if {
         u8 mac_addr[ETH_ALEN];
 };
 
-static inline s32 brcmf_ndev_bssidx(struct net_device *ndev)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        return ifp->bssidx;
-}
-
-extern const struct bcmevent_name bcmevent_names[];
 
 extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 
@@ -576,6 +543,10 @@ extern int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
                                     void *buf, uint len);
 
+/* Remove any protocol-specific data header. */
+extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+                               struct sk_buff *rxp);
+
 extern int brcmf_net_attach(struct brcmf_if *ifp);
 extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx,
                                      s32 bssidx, char *name, u8 *mac_addr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index dd38b78a9726..64c38f4226a3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -130,31 +130,18 @@ int brcmf_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint len)
  * interface functions from common layer
  */
 
-/* Remove any protocol-specific data header. */
-extern int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
-                               struct sk_buff *rxp);
-
 extern bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                          struct sk_buff *pkt, int prec);
 
 /* Receive frame for delivery to OS.  Callee disposes of rxp. */
-extern void brcmf_rx_frame(struct device *dev, u8 ifidx,
-                           struct sk_buff_head *rxlist);
-static inline void brcmf_rx_packet(struct device *dev, int ifidx,
-                                   struct sk_buff *pkt)
-{
-        struct sk_buff_head q;
-
-        skb_queue_head_init(&q);
-        skb_queue_tail(&q, pkt);
-        brcmf_rx_frame(dev, ifidx, &q);
-}
+extern void brcmf_rx_frames(struct device *dev, struct sk_buff_head *rxlist);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
 extern int brcmf_attach(uint bus_hdrlen, struct device *dev);
 /* Indication from bus module regarding removal/absence of dongle */
 extern void brcmf_detach(struct device *dev);
-
+/* Indication from bus module that dongle should be reset */
+extern void brcmf_dev_reset(struct device *dev);
 /* Indication from bus module to change flow-control state */
 extern void brcmf_txflowblock(struct device *dev, bool state);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index 83923553f1ac..bb454cdab29d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -19,8 +19,6 @@
  * For certain dcmd codes, the dongle interprets string data from the host.
  ******************************************************************************/
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 
@@ -94,8 +92,6 @@ struct brcmf_proto_bdc_header {
 
 struct brcmf_proto {
         u16 reqid;
-        u8 pending;
-        u32 lastcmd;
         u8 bus_header[BUS_HEADER_LEN];
         struct brcmf_proto_cdc_dcmd msg;
         unsigned char buf[BRCMF_DCMD_MAXLEN + ROUND_UP_MARGIN];
@@ -107,7 +103,7 @@ static int brcmf_proto_cdc_msg(struct brcmf_pub *drvr)
         int len = le32_to_cpu(prot->msg.len) +
                         sizeof(struct brcmf_proto_cdc_dcmd);
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* NOTE : cdc->msg.len holds the desired length of the buffer to be
          *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
@@ -125,7 +121,7 @@ static int brcmf_proto_cdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
         int ret;
         struct brcmf_proto *prot = drvr->prot;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
         len += sizeof(struct brcmf_proto_cdc_dcmd);
         do {
                 ret = brcmf_bus_rxctl(drvr->bus_if, (unsigned char *)&prot->msg,
@@ -147,20 +143,7 @@ brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         int ret = 0, retries = 0;
         u32 id, flags;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
-
-        /* Respond "bcmerror" and "bcmerrorstr" with local cache */
-        if (cmd == BRCMF_C_GET_VAR && buf) {
-                if (!strcmp((char *)buf, "bcmerrorstr")) {
-                        strncpy((char *)buf, "bcm_error",
-                                BCME_STRLEN);
-                        goto done;
-                } else if (!strcmp((char *)buf, "bcmerror")) {
-                        *(int *)buf = drvr->dongle_error;
-                        goto done;
-                }
-        }
+        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
 
         memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
 
@@ -210,11 +193,8 @@ retry:
         }
 
         /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR) {
+        if (flags & CDC_DCMD_ERROR)
                 ret = le32_to_cpu(msg->status);
-                /* Cache error from dongle */
-                drvr->dongle_error = ret;
-        }
 
 done:
         return ret;
@@ -228,8 +208,7 @@ int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         int ret = 0;
         u32 flags, id;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
+        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
 
         memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
 
@@ -262,11 +241,8 @@ int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         }
 
         /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR) {
+        if (flags & CDC_DCMD_ERROR)
                 ret = le32_to_cpu(msg->status);
-                /* Cache error from dongle */
-                drvr->dongle_error = ret;
-        }
 
 done:
         return ret;
@@ -287,7 +263,7 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
 {
         struct brcmf_proto_bdc_header *h;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* Push BDC header used to convey priority for buses that don't */
 
@@ -305,14 +281,12 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
         BDC_SET_IF_IDX(h, ifidx);
 }
 
-int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
                         struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_pub *drvr = bus_if->drvr;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* Pop BDC header used to convey priority for buses that don't */
 
@@ -338,7 +312,7 @@ int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
         }
 
         if (h->flags & BDC_FLAG_SUM_GOOD) {
-                brcmf_dbg(INFO, "%s: BDC packet received with good rx-csum, flags 0x%x\n",
+                brcmf_dbg(CDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
                           brcmf_ifname(drvr, *ifidx), h->flags);
                 pkt_set_sum_good(pktbuf, true);
         }
@@ -348,6 +322,8 @@ int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
         skb_pull(pktbuf, BDC_HEADER_LEN);
         skb_pull(pktbuf, h->data_offset << 2);
 
+        if (pktbuf->len == 0)
+                return -ENODATA;
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index f8b52e5b941a..4544342a0428 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index f2ab01cd7966..bc013cbe06f6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -18,21 +18,26 @@
 #define _BRCMF_DBG_H_
 
 /* message levels */
-#define BRCMF_TRACE_VAL 0x0002
-#define BRCMF_INFO_VAL  0x0004
-#define BRCMF_DATA_VAL  0x0008
-#define BRCMF_CTL_VAL   0x0010
-#define BRCMF_TIMER_VAL 0x0020
-#define BRCMF_HDRS_VAL  0x0040
-#define BRCMF_BYTES_VAL 0x0080
-#define BRCMF_INTR_VAL  0x0100
-#define BRCMF_GLOM_VAL  0x0200
-#define BRCMF_EVENT_VAL 0x0400
-#define BRCMF_BTA_VAL   0x0800
-#define BRCMF_FIL_VAL   0x1000
-#define BRCMF_USB_VAL   0x2000
-#define BRCMF_SCAN_VAL  0x4000
-#define BRCMF_CONN_VAL  0x8000
+#define BRCMF_TRACE_VAL 0x00000002
+#define BRCMF_INFO_VAL  0x00000004
+#define BRCMF_DATA_VAL  0x00000008
+#define BRCMF_CTL_VAL   0x00000010
+#define BRCMF_TIMER_VAL 0x00000020
+#define BRCMF_HDRS_VAL  0x00000040
+#define BRCMF_BYTES_VAL 0x00000080
+#define BRCMF_INTR_VAL  0x00000100
+#define BRCMF_GLOM_VAL  0x00000200
+#define BRCMF_EVENT_VAL 0x00000400
+#define BRCMF_BTA_VAL   0x00000800
+#define BRCMF_FIL_VAL   0x00001000
+#define BRCMF_USB_VAL   0x00002000
+#define BRCMF_SCAN_VAL  0x00004000
+#define BRCMF_CONN_VAL  0x00008000
+#define BRCMF_CDC_VAL   0x00010000
+
+/* set default print format */
+#undef pr_fmt
+#define pr_fmt(fmt)             KBUILD_MODNAME ": " fmt
 
 /* Macro for error messages. net_ratelimit() is used when driver
  * debugging is not selected. When debugging the driver error
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 74a616b4de8e..e3326a58bdb1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/module.h>
@@ -162,28 +160,31 @@ static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
         schedule_work(&ifp->multicast_work);
 }
 
-static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+                                           struct net_device *ndev)
 {
         int ret;
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
+        struct ethhdr *eh;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* Reject if down */
-        if (!drvr->bus_if->drvr_up ||
-            (drvr->bus_if->state != BRCMF_BUS_DATA)) {
-                brcmf_err("xmit rejected drvup=%d state=%d\n",
-                          drvr->bus_if->drvr_up,
-                          drvr->bus_if->state);
+        /* Can the device send data? */
+        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+                brcmf_err("xmit rejected state=%d\n", drvr->bus_if->state);
                 netif_stop_queue(ndev);
-                return -ENODEV;
+                dev_kfree_skb(skb);
+                ret = -ENODEV;
+                goto done;
         }
 
         if (!drvr->iflist[ifp->idx]) {
                 brcmf_err("bad ifidx %d\n", ifp->idx);
                 netif_stop_queue(ndev);
-                return -ENODEV;
+                dev_kfree_skb(skb);
+                ret = -ENODEV;
+                goto done;
         }
 
         /* Make sure there's enough room for any header */
@@ -204,17 +205,20 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 }
         }
 
-        /* Update multicast statistic */
-        if (skb->len >= ETH_ALEN) {
-                u8 *pktdata = (u8 *)(skb->data);
-                struct ethhdr *eh = (struct ethhdr *)pktdata;
-
-                if (is_multicast_ether_addr(eh->h_dest))
-                        drvr->tx_multicast++;
-                if (ntohs(eh->h_proto) == ETH_P_PAE)
-                        atomic_inc(&drvr->pend_8021x_cnt);
+        /* validate length for ether packet */
+        if (skb->len < sizeof(*eh)) {
+                ret = -EINVAL;
+                dev_kfree_skb(skb);
+                goto done;
         }
 
+        /* handle ethernet header */
+        eh = (struct ethhdr *)(skb->data);
+        if (is_multicast_ether_addr(eh->h_dest))
+                drvr->tx_multicast++;
+        if (ntohs(eh->h_proto) == ETH_P_PAE)
+                atomic_inc(&drvr->pend_8021x_cnt);
+
         /* If the protocol uses a data header, apply it */
         brcmf_proto_hdrpush(drvr, ifp->idx, skb);
 
@@ -228,7 +232,7 @@ done:
                 drvr->bus_if->dstats.tx_packets++;
 
         /* Return ok: we always eat the packet */
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 void brcmf_txflowblock(struct device *dev, bool state)
@@ -250,8 +254,7 @@ void brcmf_txflowblock(struct device *dev, bool state)
                 }
 }
 
-void brcmf_rx_frame(struct device *dev, u8 ifidx,
-                    struct sk_buff_head *skb_list)
+void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
 {
         unsigned char *eth;
         uint len;
@@ -259,12 +262,24 @@ void brcmf_rx_frame(struct device *dev, u8 ifidx,
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        u8 ifidx;
+        int ret;
 
         brcmf_dbg(TRACE, "Enter\n");
 
         skb_queue_walk_safe(skb_list, skb, pnext) {
                 skb_unlink(skb, skb_list);
 
+                /* process and remove protocol-specific header
+                 */
+                ret = brcmf_proto_hdrpull(drvr, &ifidx, skb);
+                if (ret < 0) {
+                        if (ret != -ENODATA)
+                                bus_if->dstats.rx_errors++;
+                        brcmu_pkt_buf_free_skb(skb);
+                        continue;
+                }
+
                 /* Get the protocol, maintain skb around eth_type_trans()
                  * The main reason for this hack is for the limitation of
                  * Linux 2.4 where 'eth_type_trans' uses the
@@ -328,13 +343,13 @@ void brcmf_rx_frame(struct device *dev, u8 ifidx,
 
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
 {
-        uint ifidx;
+        u8 ifidx;
         struct ethhdr *eh;
         u16 type;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
 
-        brcmf_proto_hdrpull(dev, &ifidx, txp);
+        brcmf_proto_hdrpull(drvr, &ifidx, txp);
 
         eh = (struct ethhdr *)(txp->data);
         type = ntohs(eh->h_proto);
@@ -450,7 +465,7 @@ static int brcmf_ethtool(struct brcmf_if *ifp, void __user *uaddr)
                 sprintf(info.version, "%lu", drvr->drv_version);
                 if (copy_to_user(uaddr, &info, sizeof(info)))
                         return -EFAULT;
-                brcmf_dbg(CTL, "given %*s, returning %s\n",
+                brcmf_dbg(TRACE, "given %*s, returning %s\n",
                           (int)sizeof(drvname), drvname, info.driver);
                 break;
 
@@ -570,14 +585,9 @@ static int brcmf_netdev_open(struct net_device *ndev)
         /* Get current TOE mode from dongle */
         if (brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_ol) >= 0
             && (toe_ol & TOE_TX_CSUM_OL) != 0)
-                drvr->iflist[ifp->idx]->ndev->features |=
-                        NETIF_F_IP_CSUM;
+                ndev->features |= NETIF_F_IP_CSUM;
         else
-                drvr->iflist[ifp->idx]->ndev->features &=
-                        ~NETIF_F_IP_CSUM;
-
-        /* make sure RF is ready for work */
-        brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
+                ndev->features &= ~NETIF_F_IP_CSUM;
 
         /* Allow transmit calls */
         netif_start_queue(ndev);
@@ -845,6 +855,17 @@ static void brcmf_bus_detach(struct brcmf_pub *drvr)
         }
 }
 
+void brcmf_dev_reset(struct device *dev)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_pub *drvr = bus_if->drvr;
+
+        if (drvr == NULL)
+                return;
+
+        brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
+}
+
 void brcmf_detach(struct device *dev)
 {
         int i;
@@ -866,9 +887,8 @@ void brcmf_detach(struct device *dev)
 
         brcmf_bus_detach(drvr);
 
-        if (drvr->prot) {
+        if (drvr->prot)
                 brcmf_proto_detach(drvr);
-        }
 
         brcmf_debugfs_detach(drvr);
         bus_if->drvr = NULL;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index cf857f1edf8c..7fef9b5ba003 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
@@ -1169,7 +1167,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         int errcode;
         u8 doff, sfdoff;
 
-        int ifidx = 0;
         bool usechain = bus->use_rxchain;
 
         struct brcmf_sdio_read rd_new;
@@ -1388,13 +1385,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                 skb_unlink(pfirst, &bus->glom);
                                 brcmu_pkt_buf_free_skb(pfirst);
                                 continue;
-                        } else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
-                                                       &ifidx, pfirst) != 0) {
-                                brcmf_err("rx protocol error\n");
-                                bus->sdiodev->bus_if->dstats.rx_errors++;
-                                skb_unlink(pfirst, &bus->glom);
-                                brcmu_pkt_buf_free_skb(pfirst);
-                                continue;
                         }
 
                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
@@ -1407,7 +1397,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 }
                 /* sent any remaining packets up */
                 if (bus->glom.qlen)
-                        brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
+                        brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
 
                 bus->sdcnt.rxglomframes++;
                 bus->sdcnt.rxglompkts += bus->glom.qlen;
@@ -1558,10 +1548,10 @@ static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 {
         struct sk_buff *pkt;            /* Packet for event or data frames */
+        struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
         int sdret;              /* Return code from calls */
-        int ifidx = 0;
         uint rxcount = 0;       /* Total frames read */
         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
         u8 head_read = 0;
@@ -1760,15 +1750,11 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 if (pkt->len == 0) {
                         brcmu_pkt_buf_free_skb(pkt);
                         continue;
-                } else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
-                           pkt) != 0) {
-                        brcmf_err("rx protocol error\n");
-                        brcmu_pkt_buf_free_skb(pkt);
-                        bus->sdiodev->bus_if->dstats.rx_errors++;
-                        continue;
                 }
 
-                brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
+                skb_queue_head_init(&pktlist);
+                skb_queue_tail(&pktlist, pkt);
+                brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
         }
 
         rxcount = maxframes - rxleft;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index b1bb46c49799..14be2d5530ce 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -15,8 +15,6 @@
  */
 /* ***** SDIO interface chip backplane handle functions ***** */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 914c56fe6c5f..e15630cc3889 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -443,14 +443,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
         struct brcmf_usbdev_info *devinfo = req->devinfo;
         struct sk_buff *skb;
-        int ifidx = 0;
+        struct sk_buff_head skbq;
 
         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
         brcmf_usb_del_fromq(devinfo, req);
         skb = req->skb;
         req->skb = NULL;
 
-        if (urb->status == 0) {
+        /* zero lenght packets indicate usb "failure". Do not refill */
+        if (urb->status == 0 && urb->actual_length) {
                 devinfo->bus_pub.bus->dstats.rx_packets++;
         } else {
                 devinfo->bus_pub.bus->dstats.rx_errors++;
@@ -460,13 +461,10 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         }
 
         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
+                skb_queue_head_init(&skbq);
+                skb_queue_tail(&skbq, skb);
                 skb_put(skb, urb->actual_length);
-                if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
-                        brcmf_err("rx protocol error\n");
-                        brcmu_pkt_buf_free_skb(skb);
-                        devinfo->bus_pub.bus->dstats.rx_errors++;
-                } else
-                        brcmf_rx_packet(devinfo->dev, ifidx, skb);
+                brcmf_rx_frames(devinfo->dev, &skbq);
                 brcmf_usb_rx_refill(devinfo, req);
         } else {
                 brcmu_pkt_buf_free_skb(skb);
@@ -1520,10 +1518,23 @@ static void brcmf_release_fw(struct list_head *q)
         }
 }
 
+static int brcmf_usb_reset_device(struct device *dev, void *notused)
+{
+        /* device past is the usb interface so we
+         * need to use parent here.
+         */
+        brcmf_dev_reset(dev->parent);
+        return 0;
+}
 
 void brcmf_usb_exit(void)
 {
+        struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
+        int ret;
+
         brcmf_dbg(USB, "Enter\n");
+        ret = driver_for_each_device(drv, NULL, NULL,
+                                     brcmf_usb_reset_device);
         usb_deregister(&brcmf_usbdrvr);
         brcmf_release_fw(&fw_image_list);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 1261a9b84e04..62a528e8b958 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -16,8 +16,6 @@
 
 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
@@ -2011,67 +2009,6 @@ done:
         return err;
 }
 
-static s32
-brcmf_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *ndev,
-                             const u8 *addr,
-                             const struct cfg80211_bitrate_mask *mask)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcm_rateset_le rateset_le;
-        s32 rate;
-        s32 val;
-        s32 err_bg;
-        s32 err_a;
-        u32 legacy;
-        s32 err = 0;
-
-        brcmf_dbg(TRACE, "Enter\n");
-        if (!check_vif_up(ifp->vif))
-                return -EIO;
-
-        /* addr param is always NULL. ignore it */
-        /* Get current rateset */
-        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_CURR_RATESET,
-                                     &rateset_le, sizeof(rateset_le));
-        if (err) {
-                brcmf_err("could not get current rateset (%d)\n", err);
-                goto done;
-        }
-
-        legacy = ffs(mask->control[IEEE80211_BAND_2GHZ].legacy & 0xFFFF);
-        if (!legacy)
-                legacy = ffs(mask->control[IEEE80211_BAND_5GHZ].legacy &
-                             0xFFFF);
-
-        val = wl_g_rates[legacy - 1].bitrate * 100000;
-
-        if (val < le32_to_cpu(rateset_le.count))
-                /* Select rate by rateset index */
-                rate = rateset_le.rates[val] & 0x7f;
-        else
-                /* Specified rate in bps */
-                rate = val / 500000;
-
-        brcmf_dbg(CONN, "rate %d mbps\n", rate / 2);
-
-        /*
-         *
-         *      Set rate override,
-         *      Since the is a/b/g-blind, both a/bg_rate are enforced.
-         */
-        err_bg = brcmf_fil_iovar_int_set(ifp, "bg_rate", rate);
-        err_a = brcmf_fil_iovar_int_set(ifp, "a_rate", rate);
-        if (err_bg && err_a) {
-                brcmf_err("could not set fixed rate (%d) (%d)\n", err_bg,
-                          err_a);
-                err = err_bg | err_a;
-        }
-
-done:
-        brcmf_dbg(TRACE, "Exit\n");
-        return err;
-}
-
 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
                                    struct brcmf_bss_info_le *bi)
 {
@@ -3091,10 +3028,11 @@ brcmf_configure_wpaie(struct net_device *ndev, struct brcmf_vs_tlv *wpa_ie,
 
         len = wpa_ie->len + TLV_HDR_LEN;
         data = (u8 *)wpa_ie;
-        offset = 0;
+        offset = TLV_HDR_LEN;
         if (!is_rsn_ie)
                 offset += VS_IE_FIXED_HDR_LEN;
-        offset += WPA_IE_VERSION_LEN;
+        else
+                offset += WPA_IE_VERSION_LEN;
 
         /* check for multicast cipher suite */
         if (offset + WPA_IE_MIN_OUI_LEN > len) {
@@ -3703,7 +3641,6 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .set_default_key = brcmf_cfg80211_config_default_key,
         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
-        .set_bitrate_mask = brcmf_cfg80211_set_bitrate_mask,
         .connect = brcmf_cfg80211_connect,
         .disconnect = brcmf_cfg80211_disconnect,
         .suspend = brcmf_cfg80211_suspend,
@@ -4329,9 +4266,8 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 }
 
 static s32
-brcmf_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
+brcmf_dongle_roam(struct brcmf_if *ifp, u32 roamvar, u32 bcn_timeout)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = 0;
         __le32 roamtrigger[2];
         __le32 roam_delta[2];
@@ -4382,10 +4318,9 @@ dongle_rom_out:
 }
 
 static s32
-brcmf_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+brcmf_dongle_scantime(struct brcmf_if *ifp, s32 scan_assoc_time,
                       s32 scan_unassoc_time, s32 scan_passive_time)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = 0;
 
         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
@@ -4455,6 +4390,7 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
 {
         struct net_device *ndev;
         struct wireless_dev *wdev;
+        struct brcmf_if *ifp;
         s32 power_mode;
         s32 err = 0;
 
@@ -4463,35 +4399,34 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
 
         ndev = cfg_to_ndev(cfg);
         wdev = ndev->ieee80211_ptr;
+        ifp = netdev_priv(ndev);
 
-        brcmf_dongle_scantime(ndev, WL_SCAN_CHANNEL_TIME,
-                        WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
+        /* make sure RF is ready for work */
+        brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
+
+        brcmf_dongle_scantime(ifp, WL_SCAN_CHANNEL_TIME,
+                              WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
 
         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
-        err = brcmf_fil_cmd_int_set(netdev_priv(ndev), BRCMF_C_SET_PM,
-                                    power_mode);
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
         if (err)
                 goto default_conf_out;
         brcmf_dbg(INFO, "power save set to %s\n",
                   (power_mode ? "enabled" : "disabled"));
 
-        err = brcmf_dongle_roam(ndev, (cfg->roam_on ? 0 : 1),
-                                WL_BEACON_TIMEOUT);
+        err = brcmf_dongle_roam(ifp, (cfg->roam_on ? 0 : 1), WL_BEACON_TIMEOUT);
         if (err)
                 goto default_conf_out;
         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
                                           NULL, NULL);
-        if (err && err != -EINPROGRESS)
+        if (err)
                 goto default_conf_out;
         err = brcmf_dongle_probecap(cfg);
         if (err)
                 goto default_conf_out;
 
-        /* -EINPROGRESS: Call commit handler */
-
-default_conf_out:
-
         cfg->dongle_up = true;
+default_conf_out:
 
         return err;
 
@@ -4500,8 +4435,6 @@ default_conf_out:
 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
 {
         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
-        if (ifp->idx)
-                return 0;
 
         return brcmf_config_dongle(ifp->drvr->config);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 1de94f30564f..1585cc5bf866 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -961,7 +961,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                         /* if acked then clear bit and free packet */
                         if ((bindex < AMPDU_TX_BA_MAX_WSIZE)
                             && isset(bitmap, bindex)) {
-                                ini->tx_in_transit--;
                                 ini->txretry[index] = 0;
 
                                 /*
@@ -990,7 +989,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                         if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 int ret;
                                 ini->txretry[index]++;
-                                ini->tx_in_transit--;
                                 ret = brcms_c_txfifo(wlc, queue, p);
                                 /*
                                  * We shouldn't be out of space in the DMA
@@ -1000,7 +998,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                 WARN_ONCE(ret, "queue %d out of txds\n", queue);
                         } else {
                                 /* Retry timeout */
-                                ini->tx_in_transit--;
                                 ieee80211_tx_info_clear_status(tx_info);
                                 tx_info->status.ampdu_ack_len = 0;
                                 tx_info->status.ampdu_len = 1;
@@ -1009,8 +1006,8 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
                                 brcms_dbg_ht(wlc->hw->d11core,
-                                             "BA Timeout, seq %d, in_transit %d\n",
-                                             seq, ini->tx_in_transit);
+                                             "BA Timeout, seq %d\n",
+                                             seq);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index a90b72202ec5..cdb62b8ccc79 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -670,7 +670,7 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *ch;
         const struct ieee80211_reg_rule *rule;
-        int band, i, ret;
+        int band, i;
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 sband = wiphy->bands[band];
@@ -685,9 +685,8 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                 continue;
 
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                ret = freq_reg_info(wiphy, ch->center_freq,
-                                                    0, &rule);
-                                if (ret)
+                                rule = freq_reg_info(wiphy, ch->center_freq);
+                                if (IS_ERR(rule))
                                         continue;
 
                                 if (!(rule->flags & NL80211_RRF_NO_IBSS))
@@ -703,8 +702,8 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
         }
 }
 
-static int brcms_reg_notifier(struct wiphy *wiphy,
-                              struct regulatory_request *request)
+static void brcms_reg_notifier(struct wiphy *wiphy,
+                               struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct brcms_info *wl = hw->priv;
@@ -745,8 +744,6 @@ static int brcms_reg_notifier(struct wiphy *wiphy,
         if (wlc->pub->_nbands > 1 || wlc->band->bandtype == BRCM_BAND_2G)
                 wlc_phy_chanspec_ch14_widefilter_set(wlc->band->pi,
                                         brcms_c_japan_ccode(request->alpha2));
-
-        return 0;
 }
 
 void brcms_c_regd_init(struct brcms_c_info *wlc)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.h b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
index 796836b0f469..822781cf15d4 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012 Broadcom Corporation
+ * Copyright (c) 2012 Canonical Ltd.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1fbd8ecbe2ea..b1dd5600fd02 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -362,8 +362,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
                 return -EOPNOTSUPP;
         }
 
+        spin_lock_bh(&wl->lock);
+        memcpy(wl->pub->cur_etheraddr, vif->addr, sizeof(vif->addr));
         wl->mute_tx = false;
         brcms_c_mute(wl->wlc, false);
+        spin_unlock_bh(&wl->lock);
 
         return 0;
 }
@@ -539,9 +542,8 @@ brcms_ops_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ARP_FILTER) {
                 /* Hardware ARP filter address list or state changed */
-                brcms_err(core, "%s: arp filtering: enabled %s, count %d"
-                          " (implement)\n", __func__, info->arp_filter_enabled ?
-                          "true" : "false", info->arp_addr_cnt);
+                brcms_err(core, "%s: arp filtering: %d addresses"
+                          " (implement)\n", __func__, info->arp_addr_cnt);
         }
 
         if (changed & BSS_CHANGED_QOS) {
@@ -668,7 +670,9 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw,
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
 
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 spin_lock_bh(&wl->lock);
                 brcms_c_ampdu_flush(wl->wlc, sta, tid);
                 spin_unlock_bh(&wl->lock);
@@ -1407,9 +1411,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
 #endif
         t->ms = ms;
         t->periodic = (bool) periodic;
-        t->set = true;
-
-        atomic_inc(&t->wl->callbacks);
+        if (!t->set) {
+                t->set = true;
+                atomic_inc(&t->wl->callbacks);
+        }
 
         ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..c26992a60e6c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -2473,6 +2473,7 @@ static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
 {
         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
+        u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
 
         if (mute_tx) {
                 /* suspend tx fifos */
@@ -2482,8 +2483,7 @@ static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
 
                 /* zero the address match register so we do not send ACKs */
-                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
-                                       null_ether_addr);
+                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
         } else {
                 /* resume tx fifos */
                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
@@ -2492,8 +2492,7 @@ static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
 
                 /* Restore address */
-                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
-                                       wlc_hw->etheraddr);
+                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
         }
 
         wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
@@ -7633,7 +7632,7 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
 
         uint n = 0;
         uint bound_limit = bound ? RXBND : -1;
-        bool morepending;
+        bool morepending = false;
 
         skb_queue_head_init(&recv_frames);
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 606b534347bc..21a824232478 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1343,13 +1343,13 @@ static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
 
         wlc_lcnphy_rx_gain_override_enable(pi, true);
         wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-        usleep_range(500, 500);
+        udelay(500);
         write_radio_reg(pi, RADIO_2064_REG112, 0);
         if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
                 return false;
 
         wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-        usleep_range(500, 500);
+        udelay(500);
         write_radio_reg(pi, RADIO_2064_REG112, 0);
         if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
                 return false;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/scb.h b/drivers/net/wireless/brcm80211/brcmsmac/scb.h
index 51c79c7239b7..3a3d73699f83 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/scb.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/scb.h
@@ -36,7 +36,6 @@
 
 /* structure to store per-tid state for the ampdu initiator */
 struct scb_ampdu_tid_ini {
-        u8 tx_in_transit; /* number of pending mpdus in transit in driver */
         u8 tid;           /* initiator tid for easy lookup */
         /* tx retry count; indexed by seq modulo */
         u8 txretry[AMPDU_TX_BA_MAX_WSIZE];