7 files changed, 260 insertions, 190 deletions

diff --git a/drivers/net/wireless/zd1211rw/Kconfig b/drivers/net/wireless/zd1211rw/Kconfig
index 74b31eafe72d..5f809695f71a 100644
--- a/drivers/net/wireless/zd1211rw/Kconfig
+++ b/drivers/net/wireless/zd1211rw/Kconfig
@@ -1,6 +1,6 @@
 config ZD1211RW
         tristate "ZyDAS ZD1211/ZD1211B USB-wireless support"
-        depends on USB && MAC80211 && WLAN_80211 && EXPERIMENTAL
+        depends on USB && MAC80211 && EXPERIMENTAL
         select FW_LOADER
         ---help---
           This is an experimental driver for the ZyDAS ZD1211/ZD1211B wireless
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 4e79a9800134..b2af3c549bb3 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -25,6 +25,7 @@
 
 #include <linux/kernel.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 
 #include "zd_def.h"
 #include "zd_chip.h"
@@ -755,7 +756,7 @@ static int hw_reset_phy(struct zd_chip *chip)
 static int zd1211_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211_RETRY_MAX,          0x2 },
+                { CR_ZD1211_RETRY_MAX,          ZD1211_RETRY_COUNT },
                 { CR_RX_THRESHOLD,              0x000c0640 },
         };
 
@@ -767,7 +768,7 @@ static int zd1211_hw_init_hmac(struct zd_chip *chip)
 static int zd1211b_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211B_RETRY_MAX,         0x02020202 },
+                { CR_ZD1211B_RETRY_MAX,         ZD1211B_RETRY_COUNT },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC0,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC1,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC2,  0x003f001f },
@@ -1325,151 +1326,11 @@ int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
         return r;
 }
 
-static int ofdm_qual_db(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        static const u16 constants[] = {
-                715, 655, 585, 540, 470, 410, 360, 315,
-                270, 235, 205, 175, 150, 125, 105,  85,
-                 65,  50,  40,  25,  15
-        };
-
-        int i;
-        u32 x;
-
-        /* It seems that their quality parameter is somehow per signal
-         * and is now transferred per bit.
-         */
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_24M:
-                size *= 2;
-                break;
-        case ZD_OFDM_RATE_9M:
-        case ZD_OFDM_RATE_18M:
-        case ZD_OFDM_RATE_36M:
-        case ZD_OFDM_RATE_54M:
-                size *= 4;
-                size /= 3;
-                break;
-        case ZD_OFDM_RATE_48M:
-                size *= 3;
-                size /= 2;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        x = (10000 * status_quality)/size;
-        for (i = 0; i < ARRAY_SIZE(constants); i++) {
-                if (x > constants[i])
-                        break;
-        }
-
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_9M:
-                i += 3;
-                break;
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_18M:
-                i += 5;
-                break;
-        case ZD_OFDM_RATE_24M:
-        case ZD_OFDM_RATE_36M:
-                i += 9;
-                break;
-        case ZD_OFDM_RATE_48M:
-        case ZD_OFDM_RATE_54M:
-                i += 15;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return i;
-}
-
-static int ofdm_qual_percent(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        int r;
-
-        r = ofdm_qual_db(status_quality, zd_rate, size);
-        ZD_ASSERT(r >= 0);
-        if (r < 0)
-                r = 0;
-
-        r = (r * 100)/29;
-        return r <= 100 ? r : 100;
-}
-
-static unsigned int log10times100(unsigned int x)
-{
-        static const u8 log10[] = {
-                  0,
-                  0,   30,   47,   60,   69,   77,   84,   90,   95,  100,
-                104,  107,  111,  114,  117,  120,  123,  125,  127,  130,
-                132,  134,  136,  138,  139,  141,  143,  144,  146,  147,
-                149,  150,  151,  153,  154,  155,  156,  157,  159,  160,
-                161,  162,  163,  164,  165,  166,  167,  168,  169,  169,
-                170,  171,  172,  173,  174,  174,  175,  176,  177,  177,
-                178,  179,  179,  180,  181,  181,  182,  183,  183,  184,
-                185,  185,  186,  186,  187,  188,  188,  189,  189,  190,
-                190,  191,  191,  192,  192,  193,  193,  194,  194,  195,
-                195,  196,  196,  197,  197,  198,  198,  199,  199,  200,
-                200,  200,  201,  201,  202,  202,  202,  203,  203,  204,
-                204,  204,  205,  205,  206,  206,  206,  207,  207,  207,
-                208,  208,  208,  209,  209,  210,  210,  210,  211,  211,
-                211,  212,  212,  212,  213,  213,  213,  213,  214,  214,
-                214,  215,  215,  215,  216,  216,  216,  217,  217,  217,
-                217,  218,  218,  218,  219,  219,  219,  219,  220,  220,
-                220,  220,  221,  221,  221,  222,  222,  222,  222,  223,
-                223,  223,  223,  224,  224,  224,  224,
-        };
-
-        return x < ARRAY_SIZE(log10) ? log10[x] : 225;
-}
-
-enum {
-        MAX_CCK_EVM_DB = 45,
-};
-
-static int cck_evm_db(u8 status_quality)
-{
-        return (20 * log10times100(status_quality)) / 100;
-}
-
-static int cck_snr_db(u8 status_quality)
-{
-        int r = MAX_CCK_EVM_DB - cck_evm_db(status_quality);
-        ZD_ASSERT(r >= 0);
-        return r;
-}
-
-static int cck_qual_percent(u8 status_quality)
-{
-        int r;
-
-        r = cck_snr_db(status_quality);
-        r = (100*r)/17;
-        return r <= 100 ? r : 100;
-}
-
 static inline u8 zd_rate_from_ofdm_plcp_header(const void *rx_frame)
 {
         return ZD_OFDM | zd_ofdm_plcp_header_rate(rx_frame);
 }
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                      const struct rx_status *status)
-{
-        return (status->frame_status&ZD_RX_OFDM) ?
-                ofdm_qual_percent(status->signal_quality_ofdm,
-                                  zd_rate_from_ofdm_plcp_header(rx_frame),
-                                  size) :
-                cck_qual_percent(status->signal_quality_cck);
-}
-
 /**
  * zd_rx_rate - report zd-rate
  * @rx_frame - received frame
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 678c139a840c..f8bbf7d302ae 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -642,13 +642,29 @@ enum {
 #define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
 #define CR_ZD1211B_RETRY_MAX            CTL_REG(0x0b28)
 
+/* Value for CR_ZD1211_RETRY_MAX & CR_ZD1211B_RETRY_MAX. Vendor driver uses 2,
+ * we use 0. The first rate is tried (count+2), then all next rates are tried
+ * twice, until 1 Mbits is tried. */
+#define ZD1211_RETRY_COUNT              0
+#define ZD1211B_RETRY_COUNT     \
+        (ZD1211_RETRY_COUNT <<  0)|     \
+        (ZD1211_RETRY_COUNT <<  8)|     \
+        (ZD1211_RETRY_COUNT << 16)|     \
+        (ZD1211_RETRY_COUNT << 24)
+
 /* Used to detect PLL lock */
 #define UW2453_INTR_REG                 ((zd_addr_t)0x85c1)
 
 #define CWIN_SIZE                       0x007f043f
 
 
-#define HWINT_ENABLED                   0x004f0000
+#define HWINT_ENABLED                   \
+        (INT_TX_COMPLETE_EN|            \
+         INT_RX_COMPLETE_EN|            \
+         INT_RETRY_FAIL_EN|             \
+         INT_WAKEUP_EN|                 \
+         INT_CFG_NEXT_BCN_EN)
+
 #define HWINT_DISABLED                  0
 
 #define E2P_PWR_INT_GUARD               8
@@ -913,9 +929,6 @@ static inline int zd_get_beacon_interval(struct zd_chip *chip, u32 *interval)
 
 struct rx_status;
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                       const struct rx_status *status);
-
 u8 zd_rx_rate(const void *rx_frame, const struct rx_status *status);
 
 struct zd_mc_hash {
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6d666359a42f..16fa289ad77b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -22,6 +22,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/jiffies.h>
 #include <net/ieee80211_radiotap.h>
@@ -88,6 +89,34 @@ static const struct ieee80211_rate zd_rates[] = {
           .flags = 0 },
 };
 
+/*
+ * Zydas retry rates table. Each line is listed in the same order as
+ * in zd_rates[] and contains all the rate used when a packet is sent
+ * starting with a given rates. Let's consider an example :
+ *
+ * "11 Mbits : 4, 3, 2, 1, 0" means :
+ * - packet is sent using 4 different rates
+ * - 1st rate is index 3 (ie 11 Mbits)
+ * - 2nd rate is index 2 (ie 5.5 Mbits)
+ * - 3rd rate is index 1 (ie 2 Mbits)
+ * - 4th rate is index 0 (ie 1 Mbits)
+ */
+
+static const struct tx_retry_rate zd_retry_rates[] = {
+        { /*  1 Mbits */        1, { 0 }},
+        { /*  2 Mbits */        2, { 1,  0 }},
+        { /*  5.5 Mbits */      3, { 2,  1, 0 }},
+        { /* 11 Mbits */        4, { 3,  2, 1, 0 }},
+        { /*  6 Mbits */        5, { 4,  3, 2, 1, 0 }},
+        { /*  9 Mbits */        6, { 5,  4, 3, 2, 1, 0}},
+        { /* 12 Mbits */        5, { 6,  3, 2, 1, 0 }},
+        { /* 18 Mbits */        6, { 7,  6, 3, 2, 1, 0 }},
+        { /* 24 Mbits */        6, { 8,  6, 3, 2, 1, 0 }},
+        { /* 36 Mbits */        7, { 9,  8, 6, 3, 2, 1, 0 }},
+        { /* 48 Mbits */        8, {10,  9, 8, 6, 3, 2, 1, 0 }},
+        { /* 54 Mbits */        9, {11, 10, 9, 8, 6, 3, 2, 1, 0 }}
+};
+
 static const struct ieee80211_channel zd_channels[] = {
         { .center_freq = 2412, .hw_value = 1 },
         { .center_freq = 2417, .hw_value = 2 },
@@ -282,7 +311,7 @@ static void zd_op_stop(struct ieee80211_hw *hw)
 }
 
 /**
- * tx_status - reports tx status of a packet if required
+ * zd_mac_tx_status - reports tx status of a packet if required
  * @hw - a &struct ieee80211_hw pointer
  * @skb - a sk-buffer
  * @flags: extra flags to set in the TX status info
@@ -295,15 +324,49 @@ static void zd_op_stop(struct ieee80211_hw *hw)
  *
  * If no status information has been requested, the skb is freed.
  */
-static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      int ackssi, bool success)
+static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+                      int ackssi, struct tx_status *tx_status)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int i;
+        int success = 1, retry = 1;
+        int first_idx;
+        const struct tx_retry_rate *retries;
 
         ieee80211_tx_info_clear_status(info);
 
-        if (success)
+        if (tx_status) {
+                success = !tx_status->failure;
+                retry = tx_status->retry + success;
+        }
+
+        if (success) {
+                /* success */
                 info->flags |= IEEE80211_TX_STAT_ACK;
+        } else {
+                /* failure */
+                info->flags &= ~IEEE80211_TX_STAT_ACK;
+        }
+
+        first_idx = info->status.rates[0].idx;
+        ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+        retries = &zd_retry_rates[first_idx];
+        ZD_ASSERT(1 <= retry && retry <= retries->count);
+
+        info->status.rates[0].idx = retries->rate[0];
+        info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
+
+        for (i=1; i<IEEE80211_TX_MAX_RATES-1 && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[i];
+                info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
+        }
+        for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[retry - 1];
+                info->status.rates[i].count = 1; // (success ? 1:2);
+        }
+        if (i<IEEE80211_TX_MAX_RATES)
+                info->status.rates[i].idx = -1; /* terminate */
+
         info->status.ack_signal = ackssi;
         ieee80211_tx_status_irqsafe(hw, skb);
 }
@@ -312,20 +375,81 @@ static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
  * zd_mac_tx_failed - callback for failed frames
  * @dev: the mac80211 wireless device
  *
- * This function is called if a frame couldn't be succesfully be
+ * This function is called if a frame couldn't be successfully
  * transferred. The first frame from the tx queue, will be selected and
  * reported as error to the upper layers.
  */
-void zd_mac_tx_failed(struct ieee80211_hw *hw)
+void zd_mac_tx_failed(struct urb *urb)
 {
-        struct sk_buff_head *q = &zd_hw_mac(hw)->ack_wait_queue;
+        struct ieee80211_hw * hw = zd_usb_to_hw(urb->context);
+        struct zd_mac *mac = zd_hw_mac(hw);
+        struct sk_buff_head *q = &mac->ack_wait_queue;
         struct sk_buff *skb;
+        struct tx_status *tx_status = (struct tx_status *)urb->transfer_buffer;
+        unsigned long flags;
+        int success = !tx_status->failure;
+        int retry = tx_status->retry + success;
+        int found = 0;
+        int i, position = 0;
 
-        skb = skb_dequeue(q);
-        if (skb == NULL)
-                return;
+        q = &mac->ack_wait_queue;
+        spin_lock_irqsave(&q->lock, flags);
+
+        skb_queue_walk(q, skb) {
+                struct ieee80211_hdr *tx_hdr;
+                struct ieee80211_tx_info *info;
+                int first_idx, final_idx;
+                const struct tx_retry_rate *retries;
+                u8 final_rate;
+
+                position ++;
+
+                /* if the hardware reports a failure and we had a 802.11 ACK
+                 * pending, then we skip the first skb when searching for a
+                 * matching frame */
+                if (tx_status->failure && mac->ack_pending &&
+                    skb_queue_is_first(q, skb)) {
+                        continue;
+                }
+
+                tx_hdr = (struct ieee80211_hdr *)skb->data;
+
+                /* we skip all frames not matching the reported destination */
+                if (unlikely(memcmp(tx_hdr->addr1, tx_status->mac, ETH_ALEN))) {
+                        continue;
+                }
+
+                /* we skip all frames not matching the reported final rate */
+
+                info = IEEE80211_SKB_CB(skb);
+                first_idx = info->status.rates[0].idx;
+                ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+                retries = &zd_retry_rates[first_idx];
+                if (retry <= 0 || retry > retries->count)
+                        continue;
+
+                final_idx = retries->rate[retry - 1];
+                final_rate = zd_rates[final_idx].hw_value;
 
-        tx_status(hw, skb, 0, 0);
+                if (final_rate != tx_status->rate) {
+                        continue;
+                }
+
+                found = 1;
+                break;
+        }
+
+        if (found) {
+                for (i=1; i<=position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         i == position ? tx_status : NULL);
+                        mac->ack_pending = 0;
+                }
+        }
+
+        spin_unlock_irqrestore(&q->lock, flags);
 }
 
 /**
@@ -342,18 +466,27 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hw *hw = info->rate_driver_data[0];
+        struct zd_mac *mac = zd_hw_mac(hw);
+
+        ieee80211_tx_info_clear_status(info);
 
         skb_pull(skb, sizeof(struct zd_ctrlset));
         if (unlikely(error ||
             (info->flags & IEEE80211_TX_CTL_NO_ACK))) {
-                tx_status(hw, skb, 0, !error);
+                /*
+                 * FIXME : do we need to fill in anything ?
+                 */
+                ieee80211_tx_status_irqsafe(hw, skb);
         } else {
-                struct sk_buff_head *q =
-                        &zd_hw_mac(hw)->ack_wait_queue;
+                struct sk_buff_head *q = &mac->ack_wait_queue;
 
                 skb_queue_tail(q, skb);
-                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS)
-                        zd_mac_tx_failed(hw);
+                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
+                        zd_mac_tx_status(hw, skb_dequeue(q),
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
         }
 }
 
@@ -606,27 +739,47 @@ fail:
 static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                       struct ieee80211_rx_status *stats)
 {
+        struct zd_mac *mac = zd_hw_mac(hw);
         struct sk_buff *skb;
         struct sk_buff_head *q;
         unsigned long flags;
+        int found = 0;
+        int i, position = 0;
 
         if (!ieee80211_is_ack(rx_hdr->frame_control))
                 return 0;
 
-        q = &zd_hw_mac(hw)->ack_wait_queue;
+        q = &mac->ack_wait_queue;
         spin_lock_irqsave(&q->lock, flags);
         skb_queue_walk(q, skb) {
                 struct ieee80211_hdr *tx_hdr;
 
+                position ++;
+
+                if (mac->ack_pending && skb_queue_is_first(q, skb))
+                    continue;
+
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
                 if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                 {
-                        __skb_unlink(skb, q);
-                        tx_status(hw, skb, stats->signal, 1);
-                        goto out;
+                        found = 1;
+                        break;
                 }
         }
-out:
+
+        if (found) {
+                for (i=1; i<position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
+
+                mac->ack_pending = 1;
+                mac->ack_signal = stats->signal;
+        }
+
         spin_unlock_irqrestore(&q->lock, flags);
         return 1;
 }
@@ -674,9 +827,6 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = status->signal_strength;
-        stats.qual = zd_rx_qual_percent(buffer,
-                                          length - sizeof(struct rx_status),
-                                          status);
 
         rate = zd_rx_rate(buffer, status);
 
@@ -709,6 +859,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                 skb_reserve(skb, 2);
         }
 
+        /* FIXME : could we avoid this big memcpy ? */
         memcpy(skb_put(skb, length), buffer, length);
 
         memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
@@ -717,7 +868,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
 }
 
 static int zd_op_add_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+                                struct ieee80211_vif *vif)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
 
@@ -725,22 +876,22 @@ static int zd_op_add_interface(struct ieee80211_hw *hw,
         if (mac->type != NL80211_IFTYPE_UNSPECIFIED)
                 return -EOPNOTSUPP;
 
-        switch (conf->type) {
+        switch (vif->type) {
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                mac->type = conf->type;
+                mac->type = vif->type;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
-        return zd_write_mac_addr(&mac->chip, conf->mac_addr);
+        return zd_write_mac_addr(&mac->chip, vif->addr);
 }
 
 static void zd_op_remove_interface(struct ieee80211_hw *hw,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
         mac->type = NL80211_IFTYPE_UNSPECIFIED;
@@ -835,12 +986,13 @@ static void zd_op_configure_filter(struct ieee80211_hw *hw,
         changed_flags &= SUPPORTED_FIF_FLAGS;
         *new_flags &= SUPPORTED_FIF_FLAGS;
 
-        /* changed_flags is always populated but this driver
-         * doesn't support all FIF flags so its possible we don't
-         * need to do anything */
-        if (!changed_flags)
-                return;
-
+        /*
+         * If multicast parameter (as returned by zd_op_prepare_multicast)
+         * has changed, no bit in changed_flags is set. To handle this
+         * situation, we do not return if changed_flags is 0. If we do so,
+         * we will have some issue with IPv6 which uses multicast for link
+         * layer address resolution.
+         */
         if (*new_flags & (FIF_PROMISC_IN_BSS | FIF_ALLMULTI))
                 zd_mc_add_all(&hash);
 
@@ -999,7 +1151,14 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
         hw->queues = 1;
         hw->extra_tx_headroom = sizeof(struct zd_ctrlset);
 
+        /*
+         * Tell mac80211 that we support multi rate retries
+         */
+        hw->max_rates = IEEE80211_TX_MAX_RATES;
+        hw->max_rate_tries = 18;        /* 9 rates * 2 retries/rate */
+
         skb_queue_head_init(&mac->ack_wait_queue);
+        mac->ack_pending = 0;
 
         zd_chip_init(&mac->chip, hw, intf);
         housekeeping_init(mac);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 7c2759118d13..630c298a730e 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -140,6 +140,21 @@ struct rx_status {
 #define ZD_RX_CRC16_ERROR               0x40
 #define ZD_RX_ERROR                     0x80
 
+struct tx_retry_rate {
+        int count;      /* number of valid element in rate[] array */
+        int rate[10];   /* retry rates, described by an index in zd_rates[] */
+};
+
+struct tx_status {
+        u8 type;        /* must always be 0x01 : USB_INT_TYPE */
+        u8 id;          /* must always be 0xa0 : USB_INT_ID_RETRY_FAILED */
+        u8 rate;
+        u8 pad;
+        u8 mac[ETH_ALEN];
+        u8 retry;
+        u8 failure;
+} __attribute__((packed));
+
 enum mac_flags {
         MAC_FIXED_CHANNEL = 0x01,
 };
@@ -150,7 +165,7 @@ struct housekeeping {
 
 #define ZD_MAC_STATS_BUFFER_SIZE 16
 
-#define ZD_MAC_MAX_ACK_WAITERS 10
+#define ZD_MAC_MAX_ACK_WAITERS 50
 
 struct zd_mac {
         struct zd_chip chip;
@@ -184,6 +199,12 @@ struct zd_mac {
 
         /* whether to pass control frames to stack */
         unsigned int pass_ctrl:1;
+
+        /* whether we have received a 802.11 ACK that is pending */
+        unsigned int ack_pending:1;
+
+        /* signal strength of the last 802.11 ACK received */
+        int ack_signal;
 };
 
 #define ZD_REGDOMAIN_FCC        0x10
@@ -279,7 +300,7 @@ int zd_mac_preinit_hw(struct ieee80211_hw *hw);
 int zd_mac_init_hw(struct ieee80211_hw *hw);
 
 int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length);
-void zd_mac_tx_failed(struct ieee80211_hw *hw);
+void zd_mac_tx_failed(struct urb *urb);
 void zd_mac_tx_to_dev(struct sk_buff *skb, int error);
 
 #ifdef DEBUG
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
index 439799b84876..9e74eb1b67d5 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "zd_rf.h"
 #include "zd_usb.h"
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 23a6a6d4863b..d91ad1a612af 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -24,6 +24,7 @@
 #include <linux/firmware.h>
 #include <linux/device.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/usb.h>
 #include <linux/workqueue.h>
@@ -62,6 +63,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0053, 0x5301), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0409, 0x0248), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0411, 0x00da), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
@@ -318,6 +320,13 @@ error:
         return r;
 }
 
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "ur");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "ur");
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "ub");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "ub");
+MODULE_FIRMWARE(FW_ZD1211B_PREFIX "uphr");
+MODULE_FIRMWARE(FW_ZD1211_PREFIX "uphr");
+
 /* Read data from device address space using "firmware interface" which does
  * not require firmware to be loaded. */
 int zd_usb_read_fw(struct zd_usb *usb, zd_addr_t addr, u8 *data, u16 len)
@@ -419,7 +428,7 @@ static void int_urb_complete(struct urb *urb)
                 handle_regs_int(urb);
                 break;
         case USB_INT_ID_RETRY_FAILED:
-                zd_mac_tx_failed(zd_usb_to_hw(urb->context));
+                zd_mac_tx_failed(urb);
                 break;
         default:
                 dev_dbg_f(urb_dev(urb), "error: urb %p unknown id %x\n", urb,
@@ -553,6 +562,8 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
 
         if (length < sizeof(struct rx_length_info)) {
                 /* It's not a complete packet anyhow. */
+                printk("%s: invalid, small RX packet : %d\n",
+                       __func__, length);
                 return;
         }
         length_info = (struct rx_length_info *)
@@ -1069,11 +1080,15 @@ static int eject_installer(struct usb_interface *intf)
         int r;
 
         /* Find bulk out endpoint */
-        endpoint = &iface_desc->endpoint[1].desc;
-        if (usb_endpoint_dir_out(endpoint) &&
-            usb_endpoint_xfer_bulk(endpoint)) {
-                bulk_out_ep = endpoint->bEndpointAddress;
-        } else {
+        for (r = 1; r >= 0; r--) {
+                endpoint = &iface_desc->endpoint[r].desc;
+                if (usb_endpoint_dir_out(endpoint) &&
+                    usb_endpoint_xfer_bulk(endpoint)) {
+                        bulk_out_ep = endpoint->bEndpointAddress;
+                        break;
+                }
+        }
+        if (r == -1) {
                 dev_err(&udev->dev,
                         "zd1211rw: Could not find bulk out endpoint\n");
                 return -ENODEV;