28 files changed, 370 insertions, 206 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index f21a6171c691..c36d3a3d655f 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6713,11 +6713,11 @@ static int airo_set_auth(struct net_device *dev,
                                 local->config.authType = AUTH_ENCRYPT;
                         } else
                                 return -EINVAL;
-                        break;
 
                         /* Commit the changes to flags if needed */
                         if (local->config.authType != currentAuthType)
                                 set_bit (FLAG_COMMIT, &local->flags);
+                        break;
                 }
 
         case IW_AUTH_WPA_ENABLED:
diff --git a/drivers/net/wireless/ar9170/hw.h b/drivers/net/wireless/ar9170/hw.h
index 13091bd9d815..53e250a4278f 100644
--- a/drivers/net/wireless/ar9170/hw.h
+++ b/drivers/net/wireless/ar9170/hw.h
@@ -310,7 +310,7 @@ struct ar9170_tx_control {
 
 struct ar9170_rx_head {
         u8 plcp[12];
-};
+} __packed;
 
 struct ar9170_rx_tail {
         union {
@@ -318,16 +318,16 @@ struct ar9170_rx_tail {
                         u8 rssi_ant0, rssi_ant1, rssi_ant2,
                            rssi_ant0x, rssi_ant1x, rssi_ant2x,
                            rssi_combined;
-                };
+                } __packed;
                 u8 rssi[7];
-        };
+        } __packed;
 
         u8 evm_stream0[6], evm_stream1[6];
         u8 phy_err;
         u8 SAidx, DAidx;
         u8 error;
         u8 status;
-};
+} __packed;
 
 #define AR9170_ENC_ALG_NONE                     0x0
 #define AR9170_ENC_ALG_WEP64                    0x1
diff --git a/drivers/net/wireless/ar9170/usb.c b/drivers/net/wireless/ar9170/usb.c
index ad296840893e..fddda477095c 100644
--- a/drivers/net/wireless/ar9170/usb.c
+++ b/drivers/net/wireless/ar9170/usb.c
@@ -59,6 +59,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x0cf3, 0x9170) },
         /* Atheros TG121N */
         { USB_DEVICE(0x0cf3, 0x1001) },
+        /* Cace Airpcap NX */
+        { USB_DEVICE(0xcace, 0x0300) },
         /* D-Link DWA 160A */
         { USB_DEVICE(0x07d1, 0x3c10) },
         /* Netgear WNDA3100 */
@@ -67,6 +69,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x0846, 0x9001) },
         /* Zydas ZD1221 */
         { USB_DEVICE(0x0ace, 0x1221) },
+        /* ZyXEL NWD271N */
+        { USB_DEVICE(0x0586, 0x3417) },
         /* Z-Com UB81 BG */
         { USB_DEVICE(0x0cde, 0x0023) },
         /* Z-Com UB82 ABG */
@@ -619,6 +623,39 @@ static int ar9170_usb_open(struct ar9170 *ar)
         return 0;
 }
 
+static int ar9170_usb_init_device(struct ar9170_usb *aru)
+{
+        int err;
+
+        err = ar9170_usb_alloc_rx_irq_urb(aru);
+        if (err)
+                goto err_out;
+
+        err = ar9170_usb_alloc_rx_bulk_urbs(aru);
+        if (err)
+                goto err_unrx;
+
+        err = ar9170_usb_upload_firmware(aru);
+        if (err) {
+                err = ar9170_echo_test(&aru->common, 0x60d43110);
+                if (err) {
+                        /* force user invention, by disabling the device */
+                        err = usb_driver_set_configuration(aru->udev, -1);
+                        dev_err(&aru->udev->dev, "device is in a bad state. "
+                                                 "please reconnect it!\n");
+                        goto err_unrx;
+                }
+        }
+
+        return 0;
+
+err_unrx:
+        ar9170_usb_cancel_urbs(aru);
+
+err_out:
+        return err;
+}
+
 static int ar9170_usb_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
@@ -654,32 +691,16 @@ static int ar9170_usb_probe(struct usb_interface *intf,
 
         err = ar9170_usb_reset(aru);
         if (err)
-                goto err_unlock;
+                goto err_freehw;
 
         err = ar9170_usb_request_firmware(aru);
         if (err)
-                goto err_unlock;
+                goto err_freehw;
 
-        err = ar9170_usb_alloc_rx_irq_urb(aru);
+        err = ar9170_usb_init_device(aru);
         if (err)
                 goto err_freefw;
 
-        err = ar9170_usb_alloc_rx_bulk_urbs(aru);
-        if (err)
-                goto err_unrx;
-
-        err = ar9170_usb_upload_firmware(aru);
-        if (err) {
-                err = ar9170_echo_test(&aru->common, 0x60d43110);
-                if (err) {
-                        /* force user invention, by disabling the device */
-                        err = usb_driver_set_configuration(aru->udev, -1);
-                        dev_err(&aru->udev->dev, "device is in a bad state. "
-                                                 "please reconnect it!\n");
-                        goto err_unrx;
-                }
-        }
-
         err = ar9170_usb_open(ar);
         if (err)
                 goto err_unrx;
@@ -699,7 +720,7 @@ err_freefw:
         release_firmware(aru->init_values);
         release_firmware(aru->firmware);
 
-err_unlock:
+err_freehw:
         usb_set_intfdata(intf, NULL);
         usb_put_dev(udev);
         ieee80211_free_hw(ar->hw);
@@ -726,12 +747,65 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
         ieee80211_free_hw(aru->common.hw);
 }
 
+#ifdef CONFIG_PM
+static int ar9170_suspend(struct usb_interface *intf,
+                          pm_message_t  message)
+{
+        struct ar9170_usb *aru = usb_get_intfdata(intf);
+
+        if (!aru)
+                return -ENODEV;
+
+        aru->common.state = AR9170_IDLE;
+        ar9170_usb_cancel_urbs(aru);
+
+        return 0;
+}
+
+static int ar9170_resume(struct usb_interface *intf)
+{
+        struct ar9170_usb *aru = usb_get_intfdata(intf);
+        int err;
+
+        if (!aru)
+                return -ENODEV;
+
+        usb_unpoison_anchored_urbs(&aru->rx_submitted);
+        usb_unpoison_anchored_urbs(&aru->tx_submitted);
+
+        /*
+         * FIXME: firmware upload will fail on resume.
+         * but this is better than a hang!
+         */
+
+        err = ar9170_usb_init_device(aru);
+        if (err)
+                goto err_unrx;
+
+        err = ar9170_usb_open(&aru->common);
+        if (err)
+                goto err_unrx;
+
+        return 0;
+
+err_unrx:
+        aru->common.state = AR9170_IDLE;
+        ar9170_usb_cancel_urbs(aru);
+
+        return err;
+}
+#endif /* CONFIG_PM */
+
 static struct usb_driver ar9170_driver = {
         .name = "ar9170usb",
         .probe = ar9170_usb_probe,
         .disconnect = ar9170_usb_disconnect,
         .id_table = ar9170_usb_ids,
         .soft_unbind = 1,
+#ifdef CONFIG_PM
+        .suspend = ar9170_suspend,
+        .resume = ar9170_resume,
+#endif /* CONFIG_PM */
 };
 
 static int __init ar9170_init(void)
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 0c02f1c2bd94..744f4f4dd3d1 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -250,6 +250,8 @@ static struct usb_device_id dev_table[] = {
         { USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A) },
         /* Siemens Gigaset USB WLAN Adapter 11 */
         { USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A) },
+        /* OQO Model 01+ Internal Wi-Fi */
+        { USB_DEVICE(0x1557, 0x0002), USB_DEVICE_DATA(BOARD_505A) },
         /*
          * at76c505amx-rfmd
          */
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 71cb18d6757d..dd1f30156740 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -493,6 +493,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
         int hdrlen, padsize, retval;
         bool decrypt_error = false;
         u8 keyix;
+        __le16 fc;
 
         spin_lock_bh(&sc->rx.rxbuflock);
 
@@ -606,6 +607,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 /* see if any padding is done by the hw and remove it */
                 hdr = (struct ieee80211_hdr *)skb->data;
                 hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                fc = hdr->frame_control;
 
                 /* The MAC header is padded to have 32-bit boundary if the
                  * packet payload is non-zero. The general calculation for
@@ -690,7 +692,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                         sc->rx.rxotherant = 0;
                 }
 
-                if (ieee80211_is_beacon(hdr->frame_control) &&
+                if (ieee80211_is_beacon(fc) &&
                                 (sc->sc_flags & SC_OP_WAIT_FOR_BEACON)) {
                         sc->sc_flags &= ~SC_OP_WAIT_FOR_BEACON;
                         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_NETWORK_SLEEP);
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 857d84148b1d..27eef8fb7107 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1502,7 +1502,6 @@ static const struct net_device_ops atmel_netdev_ops = {
         .ndo_set_mac_address    = atmel_set_mac_address,
         .ndo_start_xmit         = start_tx,
         .ndo_do_ioctl           = atmel_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
 };
 
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index e228c1de6e11..eae680b53052 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -555,11 +555,32 @@ address_error:
         return 1;
 }
 
+static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+        unsigned char *f = skb->data + ring->frameoffset;
+
+        return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF);
+}
+
+static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+        struct b43_rxhdr_fw4 *rxhdr;
+        unsigned char *frame;
+
+        /* This poisons the RX buffer to detect DMA failures. */
+
+        rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
+        rxhdr->frame_len = 0;
+
+        B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2);
+        frame = skb->data + ring->frameoffset;
+        memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */);
+}
+
 static int setup_rx_descbuffer(struct b43_dmaring *ring,
                                struct b43_dmadesc_generic *desc,
                                struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
 {
-        struct b43_rxhdr_fw4 *rxhdr;
         dma_addr_t dmaaddr;
         struct sk_buff *skb;
 
@@ -568,6 +589,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
         skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
         if (unlikely(!skb))
                 return -ENOMEM;
+        b43_poison_rx_buffer(ring, skb);
         dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
         if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
                 /* ugh. try to realloc in zone_dma */
@@ -578,6 +600,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
                 skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
                 if (unlikely(!skb))
                         return -ENOMEM;
+                b43_poison_rx_buffer(ring, skb);
                 dmaaddr = map_descbuffer(ring, skb->data,
                                          ring->rx_buffersize, 0);
                 if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
@@ -592,9 +615,6 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
         ring->ops->fill_descriptor(ring, desc, dmaaddr,
                                    ring->rx_buffersize, 0, 0, 0);
 
-        rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
-        rxhdr->frame_len = 0;
-
         return 0;
 }
 
@@ -1483,12 +1503,17 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                         len = le16_to_cpu(rxhdr->frame_len);
                 } while (len == 0 && i++ < 5);
                 if (unlikely(len == 0)) {
-                        /* recycle the descriptor buffer. */
-                        sync_descbuffer_for_device(ring, meta->dmaaddr,
-                                                   ring->rx_buffersize);
-                        goto drop;
+                        dmaaddr = meta->dmaaddr;
+                        goto drop_recycle_buffer;
                 }
         }
+        if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
+                /* Something went wrong with the DMA.
+                 * The device did not touch the buffer and did not overwrite the poison. */
+                b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
+                dmaaddr = meta->dmaaddr;
+                goto drop_recycle_buffer;
+        }
         if (unlikely(len > ring->rx_buffersize)) {
                 /* The data did not fit into one descriptor buffer
                  * and is split over multiple buffers.
@@ -1501,6 +1526,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                 while (1) {
                         desc = ops->idx2desc(ring, *slot, &meta);
                         /* recycle the descriptor buffer. */
+                        b43_poison_rx_buffer(ring, meta->skb);
                         sync_descbuffer_for_device(ring, meta->dmaaddr,
                                                    ring->rx_buffersize);
                         *slot = next_slot(ring, *slot);
@@ -1519,8 +1545,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
         err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC);
         if (unlikely(err)) {
                 b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n");
-                sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
-                goto drop;
+                goto drop_recycle_buffer;
         }
 
         unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
@@ -1530,6 +1555,11 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
         b43_rx(ring->dev, skb, rxhdr);
 drop:
         return;
+
+drop_recycle_buffer:
+        /* Poison and recycle the RX buffer. */
+        b43_poison_rx_buffer(ring, skb);
+        sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
 }
 
 void b43_dma_rx(struct b43_dmaring *ring)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4896e0831114..79b685e300c7 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3974,6 +3974,11 @@ static void setup_struct_phy_for_init(struct b43_wldev *dev,
         phy->next_txpwr_check_time = jiffies;
         /* PHY TX errors counter. */
         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
+
+#if B43_DEBUG
+        phy->phy_locked = 0;
+        phy->radio_locked = 0;
+#endif
 }
 
 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 026b61c03fb9..e176b6e0d9cf 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -131,12 +131,16 @@ void b43_radio_lock(struct b43_wldev *dev)
 {
         u32 macctl;
 
+#if B43_DEBUG
+        B43_WARN_ON(dev->phy.radio_locked);
+        dev->phy.radio_locked = 1;
+#endif
+
         macctl = b43_read32(dev, B43_MMIO_MACCTL);
-        B43_WARN_ON(macctl & B43_MACCTL_RADIOLOCK);
         macctl |= B43_MACCTL_RADIOLOCK;
         b43_write32(dev, B43_MMIO_MACCTL, macctl);
-        /* Commit the write and wait for the device
-         * to exit any radio register access. */
+        /* Commit the write and wait for the firmware
+         * to finish any radio register access. */
         b43_read32(dev, B43_MMIO_MACCTL);
         udelay(10);
 }
@@ -145,11 +149,15 @@ void b43_radio_unlock(struct b43_wldev *dev)
 {
         u32 macctl;
 
+#if B43_DEBUG
+        B43_WARN_ON(!dev->phy.radio_locked);
+        dev->phy.radio_locked = 0;
+#endif
+
         /* Commit any write */
         b43_read16(dev, B43_MMIO_PHY_VER);
         /* unlock */
         macctl = b43_read32(dev, B43_MMIO_MACCTL);
-        B43_WARN_ON(!(macctl & B43_MACCTL_RADIOLOCK));
         macctl &= ~B43_MACCTL_RADIOLOCK;
         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 }
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index c9f5430d1d7d..b2d99101947b 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -245,8 +245,10 @@ struct b43_phy {
         atomic_t txerr_cnt;
 
 #ifdef CONFIG_B43_DEBUG
-        /* PHY registers locked by b43_phy_lock()? */
+        /* PHY registers locked (w.r.t. firmware) */
         bool phy_locked;
+        /* Radio registers locked (w.r.t. firmware) */
+        bool radio_locked;
 #endif /* B43_DEBUG */
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 2399328e8de7..527525cc0919 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1192,7 +1192,7 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
                         return -ENOMEM;
                 }
         } else
-                iwl_rx_queue_reset(priv, rxq);
+                iwl3945_rx_queue_reset(priv, rxq);
 
         iwl3945_rx_replenish(priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index ab7aaf6872c7..55188844657b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -215,6 +215,7 @@ extern int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm);
 extern int iwl3945_tx_queue_init(struct iwl_priv *priv,
                              struct iwl_tx_queue *txq, int count, u32 id);
 extern void iwl3945_rx_replenish(void *data);
+extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 extern void iwl3945_tx_queue_free(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 extern int iwl3945_send_cmd_pdu(struct iwl_priv *priv, u8 id, u16 len,
                             const void *data);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 3889158b359c..1ef4192207a5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -976,11 +976,9 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                dma_sync_single_range_for_cpu(
-                                &priv->pci_dev->dev, rxb->real_dma_addr,
-                                rxb->aligned_dma_addr - rxb->real_dma_addr,
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                                 priv->hw_params.rx_buf_size + 256,
+                                 PCI_DMA_FROMDEVICE);
                 pkt = (struct iwl_rx_packet *)rxb->skb->data;
 
                 /* Reclaim a command buffer only if this packet is a response
@@ -1031,9 +1029,6 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         rxb->skb = NULL;
                 }
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                 priv->hw_params.rx_buf_size + 256,
-                                 PCI_DMA_FROMDEVICE);
                 spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
                 spin_unlock_irqrestore(&rxq->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 2f1242447b3b..6e983149b83b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -223,7 +223,7 @@
 #define CSR_EEPROM_REG_MSK_DATA         (0xFFFF0000)
 
 /* EEPROM GP */
-#define CSR_EEPROM_GP_VALID_MSK         (0x00000006)
+#define CSR_EEPROM_GP_VALID_MSK         (0x00000007)
 #define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
 #define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index ec9a13846edd..cf7f0db58fcf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -360,12 +360,16 @@ struct iwl_host_cmd {
 
 /**
  * struct iwl_rx_queue - Rx queue
+ * @bd: driver's pointer to buffer of receive buffer descriptors (rbd)
+ * @dma_addr: bus address of buffer of receive buffer descriptors (rbd)
  * @read: Shared index to newest available Rx buffer
  * @write: Shared index to oldest written Rx packet
  * @free_count: Number of pre-allocated buffers in rx_free
  * @rx_free: list of free SKBs for use
  * @rx_used: List of Rx buffers with no SKB
  * @need_update: flag to indicate we need to update read/write index
+ * @rb_stts: driver's pointer to receive buffer status
+ * @rb_stts_dma: bus address of receive buffer status
  *
  * NOTE:  rx_free and rx_used are used as a FIFO for iwl_rx_mem_buffers
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 1f117a49c569..71d5b8a1a73e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -799,6 +799,22 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Copy MAC header from skb into command buffer */
         memcpy(tx_cmd->hdr, hdr, hdr_len);
 
+
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx_cmd->len = cpu_to_le16(len);
+
+        if (info->control.hw_key)
+                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+
+        /* TODO need this for burst mode later on */
+        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+
+        /* set is_hcca to 0; it probably will never be implemented */
+        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
+
+        iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
+
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -819,21 +835,30 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         else
                 len_org = 0;
 
+        /* Tell NIC about any 2-byte padding after MAC header */
+        if (len_org)
+                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
+
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev,
-                                    out_cmd, sizeof(struct iwl_cmd),
+                                    &out_cmd->hdr, len,
                                     PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
-        pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
+        pci_unmap_len_set(&out_cmd->meta, len, len);
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
-        txcmd_phys += offsetof(struct iwl_cmd, hdr);
         priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
                                                    txcmd_phys, len, 1, 0);
 
-        if (info->control.hw_key)
-                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -846,41 +871,29 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                                            0, 0);
         }
 
-        /* Tell NIC about any 2-byte padding after MAC header */
-        if (len_org)
-                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
-
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx_cmd->len = cpu_to_le16(len);
-        /* TODO need this for burst mode later on */
-        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
-
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
-
-        iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
-
         scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                offsetof(struct iwl_tx_cmd, scratch);
+                                offsetof(struct iwl_tx_cmd, scratch);
+
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+        /* take back ownership of DMA buffer to enable update */
+        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
+                                    len, PCI_DMA_BIDIRECTIONAL);
         tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
         tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
 
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-                if (qc)
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
+                     le16_to_cpu(out_cmd->hdr.sequence));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
-
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
         /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq, len);
+        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+                                                     le16_to_cpu(tx_cmd->len));
+
+        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
+                                       len, PCI_DMA_BIDIRECTIONAL);
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
@@ -968,18 +981,9 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                         INDEX_TO_SEQ(q->write_ptr));
         if (out_cmd->meta.flags & CMD_SIZE_HUGE)
                 out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
-        len = (idx == TFD_CMD_SLOTS) ?
-                        IWL_MAX_SCAN_SIZE : sizeof(struct iwl_cmd);
-
-        phys_addr = pci_map_single(priv->pci_dev, out_cmd,
-                                   len, PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
-        pci_unmap_len_set(&out_cmd->meta, len, len);
-        phys_addr += offsetof(struct iwl_cmd, hdr);
+        len = sizeof(struct iwl_cmd) - sizeof(struct iwl_cmd_meta);
+        len += (idx == TFD_CMD_SLOTS) ?  IWL_MAX_SCAN_SIZE : 0;
 
-        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                   phys_addr, fix_size, 1,
-                                                   U32_PAD(cmd->len));
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         switch (out_cmd->hdr.cmd) {
@@ -1007,6 +1011,15 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 /* Set up entry in queue's byte count circular buffer */
                 priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq, 0);
 
+        phys_addr = pci_map_single(priv->pci_dev, &out_cmd->hdr,
+                                   fix_size, PCI_DMA_BIDIRECTIONAL);
+        pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
+        pci_unmap_len_set(&out_cmd->meta, len, fix_size);
+
+        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                   phys_addr, fix_size, 1,
+                                                   U32_PAD(cmd->len));
+
         /* Increment and update queue's write index */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         ret = iwl_txq_update_write_ptr(priv, txq);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index ce729281ff62..617c4235d971 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -972,7 +972,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         dma_addr_t phys_addr;
         dma_addr_t txcmd_phys;
         int txq_id = skb_get_queue_mapping(skb);
-        u16 len, idx, len_org, hdr_len;
+        u16 len, idx, len_org, hdr_len; /* TODO: len_org is not used */
         u8 id;
         u8 unicast;
         u8 sta_id;
@@ -1074,6 +1074,40 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Copy MAC header from skb into command buffer */
         memcpy(tx->hdr, hdr, hdr_len);
 
+
+        if (info->control.hw_key)
+                iwl3945_build_tx_cmd_hwcrypto(priv, info, out_cmd, skb, sta_id);
+
+        /* TODO need this for burst mode later on */
+        iwl3945_build_tx_cmd_basic(priv, out_cmd, info, hdr, sta_id);
+
+        /* set is_hcca to 0; it probably will never be implemented */
+        iwl3945_hw_build_tx_cmd_rate(priv, out_cmd, info, hdr, sta_id, 0);
+
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx->len = cpu_to_le16(len);
+
+
+        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
+        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
+
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
+                     le16_to_cpu(out_cmd->hdr.sequence));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
+                           ieee80211_hdrlen(fc));
+
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -1096,22 +1130,18 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
-        txcmd_phys = pci_map_single(priv->pci_dev,
-                                    out_cmd, sizeof(struct iwl_cmd),
-                                    PCI_DMA_TODEVICE);
+        txcmd_phys = pci_map_single(priv->pci_dev, &out_cmd->hdr,
+                                    len, PCI_DMA_TODEVICE);
+        /* we do not map meta data ... so we can safely access address to
+         * provide to unmap command*/
         pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
-        pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        txcmd_phys += offsetof(struct iwl_cmd, hdr);
+        pci_unmap_len_set(&out_cmd->meta, len, len);
 
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
         priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
                                                    txcmd_phys, len, 1, 0);
 
-        if (info->control.hw_key)
-                iwl3945_build_tx_cmd_hwcrypto(priv, info, out_cmd, skb, sta_id);
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -1124,32 +1154,6 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                                            0, U32_PAD(len));
         }
 
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx->len = cpu_to_le16(len);
-
-        /* TODO need this for burst mode later on */
-        iwl3945_build_tx_cmd_basic(priv, out_cmd, info, hdr, sta_id);
-
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl3945_hw_build_tx_cmd_rate(priv, out_cmd, info, hdr, sta_id, 0);
-
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
-
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-                if (qc)
-                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
-        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
-
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
-                           ieee80211_hdrlen(fc));
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
@@ -1661,6 +1665,37 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
+void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        unsigned long flags;
+        int i;
+        spin_lock_irqsave(&rxq->lock, flags);
+        INIT_LIST_HEAD(&rxq->rx_free);
+        INIT_LIST_HEAD(&rxq->rx_used);
+        /* Fill the rx_used queue with _all_ of the Rx buffers */
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
+                /* In the reset function, these buffers may have been allocated
+                 * to an SKB, so we need to unmap and free potential storage */
+                if (rxq->pool[i].skb != NULL) {
+                        pci_unmap_single(priv->pci_dev,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size,
+                                         PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_skb--;
+                        dev_kfree_skb(rxq->pool[i].skb);
+                        rxq->pool[i].skb = NULL;
+                }
+                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+        }
+
+        /* Set us so that we have processed and used all buffers, but have
+         * not restocked the Rx queue with fresh buffers */
+        rxq->read = rxq->write = 0;
+        rxq->free_count = 0;
+        spin_unlock_irqrestore(&rxq->lock, flags);
+}
+EXPORT_SYMBOL(iwl3945_rx_queue_reset);
+
 /*
  * this should be called while priv->lock is locked
  */
@@ -1685,6 +1720,34 @@ void iwl3945_rx_replenish(void *data)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
+/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
+ * If an SKB has been detached, the POOL needs to have its SKB set to NULL
+ * This free routine walks the list of POOL entries and if SKB is set to
+ * non NULL it is unmapped and freed
+ */
+static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        int i;
+        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
+                if (rxq->pool[i].skb != NULL) {
+                        pci_unmap_single(priv->pci_dev,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size,
+                                         PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb(rxq->pool[i].skb);
+                }
+        }
+
+        pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                            rxq->dma_addr);
+        pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+                            rxq->rb_stts, rxq->rb_stts_dma);
+        rxq->bd = NULL;
+        rxq->rb_stts  = NULL;
+}
+EXPORT_SYMBOL(iwl3945_rx_queue_free);
+
+
 /* Convert linear signal-to-noise ratio into dB */
 static u8 ratio2dB[100] = {
 /*       0   1   2   3   4   5   6   7   8   9 */
@@ -1802,9 +1865,9 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->real_dma_addr,
-                                            priv->hw_params.rx_buf_size,
-                                            PCI_DMA_FROMDEVICE);
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                                priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
                 pkt = (struct iwl_rx_packet *)rxb->skb->data;
 
                 /* Reclaim a command buffer only if this packet is a response
@@ -1852,9 +1915,6 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                         rxb->skb = NULL;
                 }
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
                 spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
                 spin_unlock_irqrestore(&rxq->lock, flags);
@@ -4075,7 +4135,7 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (!static_key) {
                 sta_id = iwl3945_hw_find_station(priv, addr);
                 if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_MAC80211(priv, "leave - %pMnot in station map.\n",
+                        IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                             addr);
                         return -EINVAL;
                 }
@@ -4913,6 +4973,8 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         hw->wiphy->custom_regulatory = true;
 
+        hw->wiphy->max_scan_ssids = 1; /* WILL FIX */
+
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 
@@ -5194,12 +5256,12 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 
         iwl_rfkill_unregister(priv);
-        cancel_delayed_work(&priv->rfkill_poll);
+        cancel_delayed_work_sync(&priv->rfkill_poll);
 
         iwl3945_dealloc_ucode_pci(priv);
 
         if (priv->rxq.bd)
-                iwl_rx_queue_free(priv, &priv->rxq);
+                iwl3945_rx_queue_free(priv, &priv->rxq);
         iwl3945_hw_txq_ctx_free(priv);
 
         iwl3945_unset_hw_params(priv);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 63d7e19ce9bd..8e669775cb5d 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -170,6 +170,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                 lbs_deb_rx("rx err: frame received with bad length\n");
                 dev->stats.rx_length_errors++;
                 ret = 0;
+                dev_kfree_skb(skb);
                 goto done;
         }
 
@@ -181,6 +182,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                 lbs_pr_alert("rxpd not ok\n");
                 dev->stats.rx_errors++;
                 ret = 0;
+                dev_kfree_skb(skb);
                 goto done;
         }
 
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 57a0268d1bae..a9a970469c2a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -893,8 +893,7 @@ static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
                 rx_desc->next_rx_desc_phys_addr =
                         cpu_to_le32(rxq->rx_desc_dma
                                                 + nexti * sizeof(*rx_desc));
-                rx_desc->rx_ctrl =
-                        cpu_to_le32(MWL8K_RX_CTRL_OWNED_BY_HOST);
+                rx_desc->rx_ctrl = MWL8K_RX_CTRL_OWNED_BY_HOST;
         }
 
         return 0;
@@ -3720,12 +3719,12 @@ err_free_reg:
         return rc;
 }
 
-static void __devexit mwl8k_remove(struct pci_dev *pdev)
+static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
 {
         printk(KERN_ERR "===>%s(%u)\n", __func__, __LINE__);
 }
 
-static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
+static void __devexit mwl8k_remove(struct pci_dev *pdev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct mwl8k_priv *priv;
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 081428d9409e..632fac86a308 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -372,15 +372,13 @@ int __orinoco_hw_set_tkip_key(hermes_t *hw, int key_idx, int set_tx,
         }
 
         /* Wait upto 100ms for tx queue to empty */
-        k = 100;
-        do {
-                k--;
+        for (k = 100; k > 0; k--) {
                 udelay(1000);
                 ret = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_TXQUEUEEMPTY,
                                           &xmitting);
-                if (ret)
+                if (ret || !xmitting)
                         break;
-        } while ((k > 0) && xmitting);
+        }
 
         if (k == 0)
                 ret = -ETIMEDOUT;
diff --git a/drivers/net/wireless/p54/p54.h b/drivers/net/wireless/p54/p54.h
index 2dda5fe418b6..ecf8b6ed5a47 100644
--- a/drivers/net/wireless/p54/p54.h
+++ b/drivers/net/wireless/p54/p54.h
@@ -14,9 +14,9 @@
  * published by the Free Software Foundation.
  */
 
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 #include <linux/leds.h>
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 
 enum p54_control_frame_types {
         P54_CONTROL_TYPE_SETUP = 0,
@@ -116,7 +116,7 @@ enum fw_state {
         FW_STATE_RESETTING,
 };
 
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 
 #define P54_LED_MAX_NAME_LEN 31
 
@@ -129,7 +129,7 @@ struct p54_led_dev {
         unsigned int registered;
 };
 
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 
 struct p54_common {
         struct ieee80211_hw *hw;
@@ -177,10 +177,10 @@ struct p54_common {
         u8 privacy_caps;
         u8 rx_keycache_size;
         /* LED management */
-        #ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
         struct p54_led_dev assoc_led;
         struct p54_led_dev tx_led;
-        #endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
         u16 softled_state;              /* bit field of glowing LEDs */
 };
 
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 0c1b0577d4ee..c8f0232ee5e0 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -2543,8 +2543,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
         priv->basic_rate_mask = 0x15f;
         skb_queue_head_init(&priv->tx_queue);
         dev->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                     IEEE80211_HW_SUPPORTS_PS |
-                     IEEE80211_HW_PS_NULLFUNC_STACK |
                      IEEE80211_HW_SIGNAL_DBM |
                      IEEE80211_HW_NOISE_DBM;
 
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 2b222aaa6f0a..d1fe577de3d4 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -457,9 +457,10 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
         struct ieee80211_tx_info *info;
         struct p54_tx_info *minfo;
         struct p54s_tx_info *dinfo;
+        unsigned long flags;
         int ret = 0;
 
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
 
         while (!list_empty(&priv->tx_pending)) {
                 entry = list_entry(priv->tx_pending.next,
@@ -467,7 +468,7 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
 
                 list_del_init(&entry->tx_list);
 
-                spin_unlock_bh(&priv->tx_lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
 
                 dinfo = container_of((void *) entry, struct p54s_tx_info,
                                      tx_list);
@@ -479,16 +480,14 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
 
                 ret = p54spi_tx_frame(priv, skb);
 
-                spin_lock_bh(&priv->tx_lock);
-
                 if (ret < 0) {
                         p54_free_skb(priv->hw, skb);
-                        goto out;
+                        return ret;
                 }
-        }
 
-out:
-        spin_unlock_bh(&priv->tx_lock);
+                spin_lock_irqsave(&priv->tx_lock, flags);
+        }
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
         return ret;
 }
 
@@ -498,12 +497,13 @@ static void p54spi_op_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct p54_tx_info *mi = (struct p54_tx_info *) info->rate_driver_data;
         struct p54s_tx_info *di = (struct p54s_tx_info *) mi->data;
+        unsigned long flags;
 
         BUILD_BUG_ON(sizeof(*di) > sizeof((mi->data)));
 
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
         list_add_tail(&di->tx_list, &priv->tx_pending);
-        spin_unlock_bh(&priv->tx_lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
 
         queue_work(priv->hw->workqueue, &priv->work);
 }
@@ -604,6 +604,7 @@ out:
 static void p54spi_op_stop(struct ieee80211_hw *dev)
 {
         struct p54s_priv *priv = dev->priv;
+        unsigned long flags;
 
         if (mutex_lock_interruptible(&priv->mutex)) {
                 /* FIXME: how to handle this error? */
@@ -615,9 +616,9 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
         cancel_work_sync(&priv->work);
 
         p54spi_power_off(priv);
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
         INIT_LIST_HEAD(&priv->tx_pending);
-        spin_unlock_bh(&priv->tx_lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
 
         priv->fw_state = FW_STATE_OFF;
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index da6640afc835..6cc6cbc9234f 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -71,6 +71,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x1260, 0xee22)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x13b1, 0x000a)},   /* Linksys WUSB54G ver 2 */
         {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
+        {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
         {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 05f94e21b423..5752aaae906b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -646,10 +646,8 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
          * Register HW.
          */
         status = ieee80211_register_hw(rt2x00dev->hw);
-        if (status) {
-                rt2x00lib_remove_hw(rt2x00dev);
+        if (status)
                 return status;
-        }
 
         set_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 43fa0f849003..9730b4f8fd26 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -369,8 +369,6 @@ int rt2x00pci_suspend(struct pci_dev *pci_dev, pm_message_t state)
         if (retval)
                 return retval;
 
-        rt2x00pci_free_reg(rt2x00dev);
-
         pci_save_state(pci_dev);
         pci_disable_device(pci_dev);
         return pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
@@ -381,7 +379,6 @@ int rt2x00pci_resume(struct pci_dev *pci_dev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pci_dev);
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
 
         if (pci_set_power_state(pci_dev, PCI_D0) ||
             pci_enable_device(pci_dev) ||
@@ -390,20 +387,7 @@ int rt2x00pci_resume(struct pci_dev *pci_dev)
                 return -EIO;
         }
 
-        retval = rt2x00pci_alloc_reg(rt2x00dev);
-        if (retval)
-                return retval;
-
-        retval = rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                goto exit_free_reg;
-
-        return 0;
-
-exit_free_reg:
-        rt2x00pci_free_reg(rt2x00dev);
-
-        return retval;
+        return rt2x00lib_resume(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_resume);
 #endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 7d50ca82375e..501544882c2c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -702,8 +702,6 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
         if (retval)
                 return retval;
 
-        rt2x00usb_free_reg(rt2x00dev);
-
         /*
          * Decrease usbdev refcount.
          */
@@ -717,24 +715,10 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
 {
         struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
 
         usb_get_dev(interface_to_usbdev(usb_intf));
 
-        retval = rt2x00usb_alloc_reg(rt2x00dev);
-        if (retval)
-                return retval;
-
-        retval = rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                goto exit_free_reg;
-
-        return 0;
-
-exit_free_reg:
-        rt2x00usb_free_reg(rt2x00dev);
-
-        return retval;
+        return rt2x00lib_resume(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_resume);
 #endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 420fff42c0dd..853b2b279b64 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2369,6 +2369,8 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CNet */
         { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x1371, 0x9032), USB_DEVICE_DATA(&rt73usb_ops) },