37 files changed, 806 insertions, 579 deletions

diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 0c07b8b7250d..10bcb48e80d0 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -595,7 +595,7 @@ static void atmel_join_bss(struct atmel_private *priv, int bss_index);
 static void atmel_smooth_qual(struct atmel_private *priv);
 static void atmel_writeAR(struct net_device *dev, u16 data);
 static int probe_atmel_card(struct net_device *dev);
-static int reset_atmel_card(struct net_device *dev );
+static int reset_atmel_card(struct net_device *dev);
 static void atmel_enter_state(struct atmel_private *priv, int new_state);
 int atmel_open (struct net_device *dev);
 
@@ -784,11 +784,11 @@ static void tx_update_descriptor(struct atmel_private *priv, int is_bcast,
 
 static int start_tx(struct sk_buff *skb, struct net_device *dev)
 {
+        static const u8 SNAP_RFC1024[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
         struct atmel_private *priv = netdev_priv(dev);
         struct ieee80211_hdr_4addr header;
         unsigned long flags;
         u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
-        u8 SNAP_RFC1024[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 
         if (priv->card && priv->present_callback &&
             !(*priv->present_callback)(priv->card)) {
@@ -1193,7 +1193,7 @@ static irqreturn_t service_interrupt(int irq, void *dev_id)
 
                 atmel_set_gcr(dev, GCR_ACKINT); /* acknowledge interrupt */
 
-                for (i = 0; i < sizeof(irq_order)/sizeof(u8); i++)
+                for (i = 0; i < ARRAY_SIZE(irq_order); i++)
                         if (isr & irq_order[i])
                                 break;
 
@@ -1345,10 +1345,10 @@ int atmel_open(struct net_device *dev)
                 atmel_set_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS, priv->reg_domain);
         } else {
                 priv->reg_domain = atmel_get_mib8(priv, Phy_Mib_Type, PHY_MIB_REG_DOMAIN_POS);
-                for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+                for (i = 0; i < ARRAY_SIZE(channel_table); i++)
                         if (priv->reg_domain == channel_table[i].reg_domain)
                                 break;
-                if (i == sizeof(channel_table)/sizeof(channel_table[0])) {
+                if (i == ARRAY_SIZE(channel_table)) {
                         priv->reg_domain = REG_DOMAIN_MKK1;
                         printk(KERN_ALERT "%s: failed to get regulatory domain: assuming MKK1.\n", dev->name);
                 }
@@ -1393,7 +1393,7 @@ static int atmel_validate_channel(struct atmel_private *priv, int channel)
            else return suitable default channel */
         int i;
 
-        for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+        for (i = 0; i < ARRAY_SIZE(channel_table); i++)
                 if (priv->reg_domain == channel_table[i].reg_domain) {
                         if (channel >= channel_table[i].min &&
                             channel <= channel_table[i].max)
@@ -1437,7 +1437,7 @@ static int atmel_proc_output (char *buf, struct atmel_private *priv)
                 }
 
                 r = "<unknown>";
-                for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++)
+                for (i = 0; i < ARRAY_SIZE(channel_table); i++)
                         if (priv->reg_domain == channel_table[i].reg_domain)
                                 r = channel_table[i].name;
 
@@ -1736,7 +1736,7 @@ static int atmel_set_encode(struct net_device *dev,
                                 /* Disable the key */
                                 priv->wep_key_len[index] = 0;
                 /* Check if the key is not marked as invalid */
-                if(!(dwrq->flags & IW_ENCODE_NOKEY)) {
+                if (!(dwrq->flags & IW_ENCODE_NOKEY)) {
                         /* Cleanup */
                         memset(priv->wep_keys[index], 0, 13);
                         /* Copy the key in the driver */
@@ -1907,7 +1907,7 @@ static int atmel_get_encodeext(struct net_device *dev,
 
         encoding->flags = idx + 1;
         memset(ext, 0, sizeof(*ext));
-        
+
         if (!priv->wep_is_on) {
                 ext->alg = IW_ENCODE_ALG_NONE;
                 ext->key_len = 0;
@@ -2343,6 +2343,14 @@ static int atmel_get_scan(struct net_device *dev,
                 iwe.u.freq.e = 0;
                 current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA, &iwe, IW_EV_FREQ_LEN);
 
+                /* Add quality statistics */
+                iwe.cmd = IWEVQUAL;
+                iwe.u.qual.level = priv->BSSinfo[i].RSSI;
+                iwe.u.qual.qual  = iwe.u.qual.level;
+                /* iwe.u.qual.noise  = SOMETHING */
+                current_ev = iwe_stream_add_event(current_ev, extra + IW_SCAN_MAX_DATA , &iwe, IW_EV_QUAL_LEN);
+
+
                 iwe.cmd = SIOCGIWENCODE;
                 if (priv->BSSinfo[i].UsingWEP)
                         iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
@@ -2373,7 +2381,7 @@ static int atmel_get_range(struct net_device *dev,
         range->min_nwid = 0x0000;
         range->max_nwid = 0x0000;
         range->num_channels = 0;
-        for (j = 0; j < sizeof(channel_table)/sizeof(channel_table[0]); j++)
+        for (j = 0; j < ARRAY_SIZE(channel_table); j++)
                 if (priv->reg_domain == channel_table[j].reg_domain) {
                         range->num_channels = channel_table[j].max - channel_table[j].min + 1;
                         break;
@@ -2579,9 +2587,9 @@ static const struct iw_priv_args atmel_private_args[] = {
 
 static const struct iw_handler_def atmel_handler_def =
 {
-        .num_standard   = sizeof(atmel_handler)/sizeof(iw_handler),
-        .num_private    = sizeof(atmel_private_handler)/sizeof(iw_handler),
-        .num_private_args = sizeof(atmel_private_args)/sizeof(struct iw_priv_args),
+        .num_standard   = ARRAY_SIZE(atmel_handler),
+        .num_private    = ARRAY_SIZE(atmel_private_handler),
+        .num_private_args = ARRAY_SIZE(atmel_private_args),
         .standard       = (iw_handler *) atmel_handler,
         .private        = (iw_handler *) atmel_private_handler,
         .private_args   = (struct iw_priv_args *) atmel_private_args,
@@ -2645,7 +2653,7 @@ static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 
                 domain[REGDOMAINSZ] = 0;
                 rc = -EINVAL;
-                for (i = 0; i < sizeof(channel_table)/sizeof(channel_table[0]); i++) {
+                for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
                         /* strcasecmp doesn't exist in the library */
                         char *a = channel_table[i].name;
                         char *b = domain;
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index 785664090bb4..5c410989c4d7 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -5,12 +5,12 @@
         Copyright 2000-2001 ATMEL Corporation.
         Copyright 2003 Simon Kelley.
 
-    This code was developed from version 2.1.1 of the Atmel drivers, 
-    released by Atmel corp. under the GPL in December 2002. It also 
-    includes code from the Linux aironet drivers (C) Benjamin Reed, 
-    and the Linux PCMCIA package, (C) David Hinds. 
+    This code was developed from version 2.1.1 of the Atmel drivers,
+    released by Atmel corp. under the GPL in December 2002. It also
+    includes code from the Linux aironet drivers (C) Benjamin Reed,
+    and the Linux PCMCIA package, (C) David Hinds.
 
-    For all queries about this code, please contact the current author, 
+    For all queries about this code, please contact the current author,
     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
 
     This program is free software; you can redistribute it and/or modify
@@ -87,7 +87,7 @@ MODULE_SUPPORTED_DEVICE("Atmel at76c50x PCMCIA cards");
    event is received.  The config() and release() entry points are
    used to configure or release a socket, in response to card
    insertion and ejection events.  They are invoked from the atmel_cs
-   event handler. 
+   event handler.
 */
 
 static int atmel_config(struct pcmcia_device *link);
@@ -133,22 +133,22 @@ static void atmel_detach(struct pcmcia_device *p_dev);
    device IO routines can use a flag like this to throttle IO to a
    card that is not ready to accept it.
 */
-   
+
 typedef struct local_info_t {
         dev_node_t      node;
         struct net_device *eth_dev;
 } local_info_t;
 
 /*======================================================================
-  
+
   atmel_attach() creates an "instance" of the driver, allocating
   local data structures for one device.  The device is registered
   with Card Services.
-  
+
   The dev_link structure is initialized, but we don't actually
   configure the card at this point -- we wait until we receive a
   card insertion event.
-  
+
   ======================================================================*/
 
 static int atmel_probe(struct pcmcia_device *p_dev)
@@ -184,12 +184,12 @@ static int atmel_probe(struct pcmcia_device *p_dev)
 } /* atmel_attach */
 
 /*======================================================================
-  
+
   This deletes a driver "instance".  The device is de-registered
   with Card Services.  If it has been released, all local data
   structures are freed.  Otherwise, the structures will be freed
   when the device is released.
-  
+
   ======================================================================*/
 
 static void atmel_detach(struct pcmcia_device *link)
@@ -202,11 +202,11 @@ static void atmel_detach(struct pcmcia_device *link)
 }
 
 /*======================================================================
-  
+
   atmel_config() is scheduled to run after a CARD_INSERTION event
   is received, to configure the PCMCIA socket, and to make the
   device available to the system.
-  
+
   ======================================================================*/
 
 #define CS_CHECK(fn, ret) \
@@ -237,12 +237,12 @@ static int atmel_config(struct pcmcia_device *link)
         did = handle_to_dev(link).driver_data;
 
         DEBUG(0, "atmel_config(0x%p)\n", link);
-        
+
         tuple.Attributes = 0;
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        
+
         /*
           This reads the card's CONFIG tuple to find its configuration
           registers.
@@ -258,7 +258,7 @@ static int atmel_config(struct pcmcia_device *link)
           In this loop, we scan the CIS for configuration table entries,
           each of which describes a valid card configuration, including
           voltage, IO window, memory window, and interrupt settings.
-          
+
           We make no assumptions about the card to be configured: we use
           just the information available in the CIS.  In an ideal world,
           this would work for any PCMCIA card, but it requires a complete
@@ -274,17 +274,17 @@ static int atmel_config(struct pcmcia_device *link)
                 if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
                                 pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
-                
+
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
                 if (cfg->index == 0) goto next_entry;
                 link->conf.ConfigIndex = cfg->index;
-                
+
                 /* Does this card need audio output? */
                 if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
                         link->conf.Attributes |= CONF_ENABLE_SPKR;
                         link->conf.Status = CCSR_AUDIO_ENA;
                 }
-                
+
                 /* Use power settings for Vcc and Vpp if present */
                 /*  Note that the CIS values need to be rescaled */
                 if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
@@ -293,11 +293,11 @@ static int atmel_config(struct pcmcia_device *link)
                 else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
                         link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
-                
+
                 /* Do we need to allocate an interrupt? */
                 if (cfg->irq.IRQInfo1 || dflt.irq.IRQInfo1)
                         link->conf.Attributes |= CONF_ENABLE_IRQ;
-                
+
                 /* IO window settings */
                 link->io.NumPorts1 = link->io.NumPorts2 = 0;
                 if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
@@ -315,18 +315,18 @@ static int atmel_config(struct pcmcia_device *link)
                                 link->io.NumPorts2 = io->win[1].len;
                         }
                 }
-                
+
                 /* This reserves IO space but doesn't actually enable it */
                 if (pcmcia_request_io(link, &link->io) != 0)
                         goto next_entry;
 
                 /* If we got this far, we're cool! */
                 break;
-                
+
         next_entry:
                 CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
-        
+
         /*
           Allocate an interrupt line.  Note that this does not assign a
           handler to the interrupt, unless the 'Handler' member of the
@@ -334,31 +334,31 @@ static int atmel_config(struct pcmcia_device *link)
         */
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
                 CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
-        
+
         /*
           This actually configures the PCMCIA socket -- setting up
           the I/O windows and the interrupt mapping, and putting the
           card and host interface into "Memory and IO" mode.
         */
         CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
-        
+
         if (link->irq.AssignedIRQ == 0) {
-                printk(KERN_ALERT 
+                printk(KERN_ALERT
                        "atmel: cannot assign IRQ: check that CONFIG_ISA is set in kernel config.");
                 goto cs_failed;
         }
-       
-        ((local_info_t*)link->priv)->eth_dev = 
+
+        ((local_info_t*)link->priv)->eth_dev =
                 init_atmel_card(link->irq.AssignedIRQ,
                                 link->io.BasePort1,
                                 did ? did->driver_info : ATMEL_FW_TYPE_NONE,
                                 &handle_to_dev(link),
-                                card_present, 
+                                card_present,
                                 link);
-        if (!((local_info_t*)link->priv)->eth_dev) 
+        if (!((local_info_t*)link->priv)->eth_dev)
                         goto cs_failed;
-        
-        
+
+
         /*
           At this point, the dev_node_t structure(s) need to be
           initialized and arranged in a linked list at link->dev_node.
@@ -376,11 +376,11 @@ static int atmel_config(struct pcmcia_device *link)
 }
 
 /*======================================================================
-  
+
   After a card is removed, atmel_release() will unregister the
   device, and release the PCMCIA configuration.  If the device is
   still open, this will be postponed until it is closed.
-  
+
   ======================================================================*/
 
 static void atmel_release(struct pcmcia_device *link)
@@ -517,7 +517,7 @@ static void atmel_cs_cleanup(void)
     HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
     STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
     IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGE.    
+    POSSIBILITY OF SUCH DAMAGE.
 */
 
 module_init(atmel_cs_init);
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index 3bfa791c323d..92f87fbe750f 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -53,18 +53,18 @@ static int __devinit atmel_pci_probe(struct pci_dev *pdev,
                                      const struct pci_device_id *pent)
 {
         struct net_device *dev;
-                
+
         if (pci_enable_device(pdev))
                 return -ENODEV;
-        
+
         pci_set_master(pdev);
-        
-        dev = init_atmel_card(pdev->irq, pdev->resource[1].start, 
+
+        dev = init_atmel_card(pdev->irq, pdev->resource[1].start,
                               ATMEL_FW_TYPE_506,
                               &pdev->dev, NULL, NULL);
         if (!dev)
                 return -ENODEV;
-        
+
         pci_set_drvdata(pdev, dev);
         return 0;
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index fbc0c087f53c..8286678513b9 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -159,6 +159,7 @@
 
 /* Chipcommon registers. */
 #define BCM43xx_CHIPCOMMON_CAPABILITIES         0x04
+#define BCM43xx_CHIPCOMMON_CTL                  0x28
 #define BCM43xx_CHIPCOMMON_PLLONDELAY           0xB0
 #define BCM43xx_CHIPCOMMON_FREFSELDELAY         0xB4
 #define BCM43xx_CHIPCOMMON_SLOWCLKCTL           0xB8
@@ -172,6 +173,33 @@
 /* SBTOPCI2 values. */
 #define BCM43xx_SBTOPCI2_PREFETCH       0x4
 #define BCM43xx_SBTOPCI2_BURST          0x8
+#define BCM43xx_SBTOPCI2_MEMREAD_MULTI  0x20
+
+/* PCI-E core registers. */
+#define BCM43xx_PCIECORE_REG_ADDR      0x0130
+#define BCM43xx_PCIECORE_REG_DATA      0x0134
+#define BCM43xx_PCIECORE_MDIO_CTL      0x0128
+#define BCM43xx_PCIECORE_MDIO_DATA     0x012C
+
+/* PCI-E registers. */
+#define BCM43xx_PCIE_TLP_WORKAROUND    0x0004
+#define BCM43xx_PCIE_DLLP_LINKCTL      0x0100
+
+/* PCI-E MDIO bits. */
+#define BCM43xx_PCIE_MDIO_ST   0x40000000
+#define BCM43xx_PCIE_MDIO_WT   0x10000000
+#define BCM43xx_PCIE_MDIO_DEV  22
+#define BCM43xx_PCIE_MDIO_REG  18
+#define BCM43xx_PCIE_MDIO_TA   0x00020000
+#define BCM43xx_PCIE_MDIO_TC   0x0100
+
+/* MDIO devices. */
+#define BCM43xx_MDIO_SERDES_RX  0x1F
+
+/* SERDES RX registers. */
+#define BCM43xx_SERDES_RXTIMER  0x2
+#define BCM43xx_SERDES_CDR      0x6
+#define BCM43xx_SERDES_CDR_BW   0x7
 
 /* Chipcommon capabilities. */
 #define BCM43xx_CAPABILITIES_PCTL               0x00040000
@@ -221,6 +249,7 @@
 #define BCM43xx_COREID_USB20_HOST       0x819
 #define BCM43xx_COREID_USB20_DEV        0x81a
 #define BCM43xx_COREID_SDIO_HOST        0x81b
+#define BCM43xx_COREID_PCIE             0x820
 
 /* Core Information Registers */
 #define BCM43xx_CIR_BASE                0xf00
@@ -365,6 +394,9 @@
 #define BCM43xx_DEFAULT_SHORT_RETRY_LIMIT       7
 #define BCM43xx_DEFAULT_LONG_RETRY_LIMIT        4
 
+/* FIXME: the next line is a guess as to what the maximum RSSI value might be */
+#define RX_RSSI_MAX                             60
+
 /* Max size of a security key */
 #define BCM43xx_SEC_KEYSIZE                     16
 /* Security algorithms. */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 728a9b789fdf..2ec2e5afce67 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -130,6 +130,10 @@ MODULE_PARM_DESC(fwpostfix, "Postfix for .fw files. Useful for debugging.");
         { PCI_VENDOR_ID_BROADCOM, 0x4301, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         /* Broadcom 4307 802.11b */
         { PCI_VENDOR_ID_BROADCOM, 0x4307, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        /* Broadcom 4311 802.11(a)/b/g */
+        { PCI_VENDOR_ID_BROADCOM, 0x4311, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        /* Broadcom 4312 802.11a/b/g */
+        { PCI_VENDOR_ID_BROADCOM, 0x4312, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         /* Broadcom 4318 802.11b/g */
         { PCI_VENDOR_ID_BROADCOM, 0x4318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         /* Broadcom 4319 802.11a/b/g */
@@ -2600,8 +2604,9 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
         /* fetch sb_id_hi from core information registers */
         sb_id_hi = bcm43xx_read32(bcm, BCM43xx_CIR_SB_ID_HI);
 
-        core_id = (sb_id_hi & 0xFFF0) >> 4;
-        core_rev = (sb_id_hi & 0xF);
+        core_id = (sb_id_hi & 0x8FF0) >> 4;
+        core_rev = (sb_id_hi & 0x7000) >> 8;
+        core_rev |= (sb_id_hi & 0xF);
         core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
 
         /* if present, chipcommon is always core 0; read the chipid from it */
@@ -2679,14 +2684,10 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
                 bcm->chip_id, bcm->chip_rev);
         dprintk(KERN_INFO PFX "Number of cores: %d\n", core_count);
         if (bcm->core_chipcommon.available) {
-                dprintk(KERN_INFO PFX "Core 0: ID 0x%x, rev 0x%x, vendor 0x%x, %s\n",
-                        core_id, core_rev, core_vendor,
-                        bcm43xx_core_enabled(bcm) ? "enabled" : "disabled");
-        }
-
-        if (bcm->core_chipcommon.available)
+                dprintk(KERN_INFO PFX "Core 0: ID 0x%x, rev 0x%x, vendor 0x%x\n",
+                        core_id, core_rev, core_vendor);
                 current_core = 1;
-        else
+        } else
                 current_core = 0;
         for ( ; current_core < core_count; current_core++) {
                 struct bcm43xx_coreinfo *core;
@@ -2704,13 +2705,13 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
                 core_rev = (sb_id_hi & 0xF);
                 core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
 
-                dprintk(KERN_INFO PFX "Core %d: ID 0x%x, rev 0x%x, vendor 0x%x, %s\n",
-                        current_core, core_id, core_rev, core_vendor,
-                        bcm43xx_core_enabled(bcm) ? "enabled" : "disabled" );
+                dprintk(KERN_INFO PFX "Core %d: ID 0x%x, rev 0x%x, vendor 0x%x\n",
+                        current_core, core_id, core_rev, core_vendor);
 
                 core = NULL;
                 switch (core_id) {
                 case BCM43xx_COREID_PCI:
+                case BCM43xx_COREID_PCIE:
                         core = &bcm->core_pci;
                         if (core->available) {
                                 printk(KERN_WARNING PFX "Multiple PCI cores found.\n");
@@ -2749,12 +2750,12 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
                         case 6:
                         case 7:
                         case 9:
+                        case 10:
                                 break;
                         default:
-                                printk(KERN_ERR PFX "Error: Unsupported 80211 core revision %u\n",
+                                printk(KERN_WARNING PFX
+                                       "Unsupported 80211 core revision %u\n",
                                        core_rev);
-                                err = -ENODEV;
-                                goto out;
                         }
                         bcm->nr_80211_available++;
                         core->priv = ext_80211;
@@ -2868,16 +2869,11 @@ static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm,
         u32 sbimconfiglow;
         u8 limit;
 
-        if (bcm->chip_rev < 5) {
+        if (bcm->core_pci.rev <= 5 && bcm->core_pci.id != BCM43xx_COREID_PCIE) {
                 sbimconfiglow = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
-                if (bcm->bustype == BCM43xx_BUSTYPE_PCI)
-                        sbimconfiglow |= 0x32;
-                else if (bcm->bustype == BCM43xx_BUSTYPE_SB)
-                        sbimconfiglow |= 0x53;
-                else
-                        assert(0);
+                sbimconfiglow |= 0x32;
                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, sbimconfiglow);
         }
 
@@ -3004,22 +3000,64 @@ static void bcm43xx_pcicore_broadcast_value(struct bcm43xx_private *bcm,
 
 static int bcm43xx_pcicore_commit_settings(struct bcm43xx_private *bcm)
 {
-        int err;
-        struct bcm43xx_coreinfo *old_core;
+        int err = 0;
 
-        old_core = bcm->current_core;
-        err = bcm43xx_switch_core(bcm, &bcm->core_pci);
-        if (err)
-                goto out;
+        bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
 
-        bcm43xx_pcicore_broadcast_value(bcm, 0xfd8, 0x00000000);
+        if (bcm->core_chipcommon.available) {
+                err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
+                if (err)
+                        goto out;
+
+                bcm43xx_pcicore_broadcast_value(bcm, 0xfd8, 0x00000000);
+
+                /* this function is always called when a PCI core is mapped */
+                err = bcm43xx_switch_core(bcm, &bcm->core_pci);
+                if (err)
+                        goto out;
+        } else
+                bcm43xx_pcicore_broadcast_value(bcm, 0xfd8, 0x00000000);
+
+        bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
 
-        bcm43xx_switch_core(bcm, old_core);
-        assert(err == 0);
 out:
         return err;
 }
 
+static u32 bcm43xx_pcie_reg_read(struct bcm43xx_private *bcm, u32 address)
+{
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_REG_ADDR, address);
+        return bcm43xx_read32(bcm, BCM43xx_PCIECORE_REG_DATA);
+}
+
+static void bcm43xx_pcie_reg_write(struct bcm43xx_private *bcm, u32 address,
+                                    u32 data)
+{
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_REG_ADDR, address);
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_REG_DATA, data);
+}
+
+static void bcm43xx_pcie_mdio_write(struct bcm43xx_private *bcm, u8 dev, u8 reg,
+                                    u16 data)
+{
+        int i;
+
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_MDIO_CTL, 0x0082);
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_MDIO_DATA, BCM43xx_PCIE_MDIO_ST |
+                        BCM43xx_PCIE_MDIO_WT | (dev << BCM43xx_PCIE_MDIO_DEV) |
+                        (reg << BCM43xx_PCIE_MDIO_REG) | BCM43xx_PCIE_MDIO_TA |
+                        data);
+        udelay(10);
+
+        for (i = 0; i < 10; i++) {
+                if (bcm43xx_read32(bcm, BCM43xx_PCIECORE_MDIO_CTL) &
+                    BCM43xx_PCIE_MDIO_TC)
+                        break;
+                msleep(1);
+        }
+        bcm43xx_write32(bcm, BCM43xx_PCIECORE_MDIO_CTL, 0);
+}
+
 /* Make an I/O Core usable. "core_mask" is the bitmask of the cores to enable.
  * To enable core 0, pass a core_mask of 1<<0
  */
@@ -3039,7 +3077,8 @@ static int bcm43xx_setup_backplane_pci_connection(struct bcm43xx_private *bcm,
         if (err)
                 goto out;
 
-        if (bcm->core_pci.rev < 6) {
+        if (bcm->current_core->rev < 6 ||
+                bcm->current_core->id == BCM43xx_COREID_PCI) {
                 value = bcm43xx_read32(bcm, BCM43xx_CIR_SBINTVEC);
                 value |= (1 << backplane_flag_nr);
                 bcm43xx_write32(bcm, BCM43xx_CIR_SBINTVEC, value);
@@ -3057,21 +3096,46 @@ static int bcm43xx_setup_backplane_pci_connection(struct bcm43xx_private *bcm,
                 }
         }
 
-        value = bcm43xx_read32(bcm, BCM43xx_PCICORE_SBTOPCI2);
-        value |= BCM43xx_SBTOPCI2_PREFETCH | BCM43xx_SBTOPCI2_BURST;
-        bcm43xx_write32(bcm, BCM43xx_PCICORE_SBTOPCI2, value);
-
-        if (bcm->core_pci.rev < 5) {
-                value = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
-                value |= (2 << BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_SHIFT)
-                         & BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
-                value |= (3 << BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_SHIFT)
-                         & BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
-                bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, value);
-                err = bcm43xx_pcicore_commit_settings(bcm);
-                assert(err == 0);
+        if (bcm->current_core->id == BCM43xx_COREID_PCI) {
+                value = bcm43xx_read32(bcm, BCM43xx_PCICORE_SBTOPCI2);
+                value |= BCM43xx_SBTOPCI2_PREFETCH | BCM43xx_SBTOPCI2_BURST;
+                bcm43xx_write32(bcm, BCM43xx_PCICORE_SBTOPCI2, value);
+
+                if (bcm->current_core->rev < 5) {
+                        value = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
+                        value |= (2 << BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_SHIFT)
+                                 & BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
+                        value |= (3 << BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_SHIFT)
+                                 & BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
+                        bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, value);
+                        err = bcm43xx_pcicore_commit_settings(bcm);
+                        assert(err == 0);
+                } else if (bcm->current_core->rev >= 11) {
+                        value = bcm43xx_read32(bcm, BCM43xx_PCICORE_SBTOPCI2);
+                        value |= BCM43xx_SBTOPCI2_MEMREAD_MULTI;
+                        bcm43xx_write32(bcm, BCM43xx_PCICORE_SBTOPCI2, value);
+                }
+        } else {
+                if (bcm->current_core->rev == 0 || bcm->current_core->rev == 1) {
+                        value = bcm43xx_pcie_reg_read(bcm, BCM43xx_PCIE_TLP_WORKAROUND);
+                        value |= 0x8;
+                        bcm43xx_pcie_reg_write(bcm, BCM43xx_PCIE_TLP_WORKAROUND,
+                                               value);
+                }
+                if (bcm->current_core->rev == 0) {
+                        bcm43xx_pcie_mdio_write(bcm, BCM43xx_MDIO_SERDES_RX,
+                                                BCM43xx_SERDES_RXTIMER, 0x8128);
+                        bcm43xx_pcie_mdio_write(bcm, BCM43xx_MDIO_SERDES_RX,
+                                                BCM43xx_SERDES_CDR, 0x0100);
+                        bcm43xx_pcie_mdio_write(bcm, BCM43xx_MDIO_SERDES_RX,
+                                                BCM43xx_SERDES_CDR_BW, 0x1466);
+                } else if (bcm->current_core->rev == 1) {
+                        value = bcm43xx_pcie_reg_read(bcm, BCM43xx_PCIE_DLLP_LINKCTL);
+                        value |= 0x40;
+                        bcm43xx_pcie_reg_write(bcm, BCM43xx_PCIE_DLLP_LINKCTL,
+                                               value);
+                }
         }
-
 out_switch_back:
         err = bcm43xx_switch_core(bcm, old_core);
 out:
@@ -3140,43 +3204,17 @@ static void bcm43xx_periodic_every15sec(struct bcm43xx_private *bcm)
 
 static void do_periodic_work(struct bcm43xx_private *bcm)
 {
-        unsigned int state;
-
-        state = bcm->periodic_state;
-        if (state % 8 == 0)
+        if (bcm->periodic_state % 8 == 0)
                 bcm43xx_periodic_every120sec(bcm);
-        if (state % 4 == 0)
+        if (bcm->periodic_state % 4 == 0)
                 bcm43xx_periodic_every60sec(bcm);
-        if (state % 2 == 0)
+        if (bcm->periodic_state % 2 == 0)
                 bcm43xx_periodic_every30sec(bcm);
-        if (state % 1 == 0)
-                bcm43xx_periodic_every15sec(bcm);
-        bcm->periodic_state = state + 1;
+        bcm43xx_periodic_every15sec(bcm);
 
         schedule_delayed_work(&bcm->periodic_work, HZ * 15);
 }
 
-/* Estimate a "Badness" value based on the periodic work
- * state-machine state. "Badness" is worse (bigger), if the
- * periodic work will take longer.
- */
-static int estimate_periodic_work_badness(unsigned int state)
-{
-        int badness = 0;
-
-        if (state % 8 == 0) /* every 120 sec */
-                badness += 10;
-        if (state % 4 == 0) /* every 60 sec */
-                badness += 5;
-        if (state % 2 == 0) /* every 30 sec */
-                badness += 1;
-        if (state % 1 == 0) /* every 15 sec */
-                badness += 1;
-
-#define BADNESS_LIMIT   4
-        return badness;
-}
-
 static void bcm43xx_periodic_work_handler(struct work_struct *work)
 {
         struct bcm43xx_private *bcm =
@@ -3184,12 +3222,10 @@ static void bcm43xx_periodic_work_handler(struct work_struct *work)
         struct net_device *net_dev = bcm->net_dev;
         unsigned long flags;
         u32 savedirqs = 0;
-        int badness;
         unsigned long orig_trans_start = 0;
 
         mutex_lock(&bcm->mutex);
-        badness = estimate_periodic_work_badness(bcm->periodic_state);
-        if (badness > BADNESS_LIMIT) {
+        if (unlikely(bcm->periodic_state % 4 == 0)) {
                 /* Periodic work will take a long time, so we want it to
                  * be preemtible.
                  */
@@ -3221,7 +3257,7 @@ static void bcm43xx_periodic_work_handler(struct work_struct *work)
 
         do_periodic_work(bcm);
 
-        if (badness > BADNESS_LIMIT) {
+        if (unlikely(bcm->periodic_state % 4 == 0)) {
                 spin_lock_irqsave(&bcm->irq_lock, flags);
                 tasklet_enable(&bcm->isr_tasklet);
                 bcm43xx_interrupt_enable(bcm, savedirqs);
@@ -3232,6 +3268,7 @@ static void bcm43xx_periodic_work_handler(struct work_struct *work)
                 net_dev->trans_start = orig_trans_start;
         }
         mmiowb();
+        bcm->periodic_state++;
         spin_unlock_irqrestore(&bcm->irq_lock, flags);
         mutex_unlock(&bcm->mutex);
 }
@@ -3677,7 +3714,7 @@ static int bcm43xx_read_phyinfo(struct bcm43xx_private *bcm)
                 bcm->ieee->freq_band = IEEE80211_24GHZ_BAND;
                 break;
         case BCM43xx_PHYTYPE_G:
-                if (phy_rev > 7)
+                if (phy_rev > 8)
                         phy_rev_ok = 0;
                 bcm->ieee->modulation = IEEE80211_OFDM_MODULATION |
                                         IEEE80211_CCK_MODULATION;
@@ -3689,6 +3726,8 @@ static int bcm43xx_read_phyinfo(struct bcm43xx_private *bcm)
                        phy_type);
                 return -ENODEV;
         };
+        bcm->ieee->perfect_rssi = RX_RSSI_MAX;
+        bcm->ieee->worst_rssi = 0;
         if (!phy_rev_ok) {
                 printk(KERN_WARNING PFX "Invalid PHY Revision %x\n",
                        phy_rev);
@@ -3975,11 +4014,6 @@ static int bcm43xx_ieee80211_hard_start_xmit(struct ieee80211_txb *txb,
         return NETDEV_TX_OK;
 }
 
-static struct net_device_stats * bcm43xx_net_get_stats(struct net_device *net_dev)
-{
-        return &(bcm43xx_priv(net_dev)->ieee->stats);
-}
-
 static void bcm43xx_net_tx_timeout(struct net_device *net_dev)
 {
         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
@@ -4093,7 +4127,6 @@ static int __devinit bcm43xx_init_one(struct pci_dev *pdev,
 
         net_dev->open = bcm43xx_net_open;
         net_dev->stop = bcm43xx_net_stop;
-        net_dev->get_stats = bcm43xx_net_get_stats;
         net_dev->tx_timeout = bcm43xx_net_tx_timeout;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         net_dev->poll_controller = bcm43xx_net_poll_controller;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.c b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
index 6569da3a7a39..7e774f410953 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
@@ -153,8 +153,6 @@ int bcm43xx_pctl_init(struct bcm43xx_private *bcm)
         int err, maxfreq;
         struct bcm43xx_coreinfo *old_core;
 
-        if (!(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL))
-                return 0;
         old_core = bcm->current_core;
         err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
         if (err == -ENODEV)
@@ -162,11 +160,27 @@ int bcm43xx_pctl_init(struct bcm43xx_private *bcm)
         if (err)
                 goto out;
 
-        maxfreq = bcm43xx_pctl_clockfreqlimit(bcm, 1);
-        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_PLLONDELAY,
-                        (maxfreq * 150 + 999999) / 1000000);
-        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_FREFSELDELAY,
-                        (maxfreq * 15 + 999999) / 1000000);
+        if (bcm->chip_id == 0x4321) {
+                if (bcm->chip_rev == 0)
+                        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_CTL, 0x03A4);
+                if (bcm->chip_rev == 1)
+                        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_CTL, 0x00A4);
+        }
+
+        if (bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL) {
+                if (bcm->current_core->rev >= 10) {
+                        /* Set Idle Power clock rate to 1Mhz */
+                        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL,
+                                       (bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL)
+                                       & 0x0000FFFF) | 0x40000);
+                } else {
+                        maxfreq = bcm43xx_pctl_clockfreqlimit(bcm, 1);
+                        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_PLLONDELAY,
+                                       (maxfreq * 150 + 999999) / 1000000);
+                        bcm43xx_write32(bcm, BCM43xx_CHIPCOMMON_FREFSELDELAY,
+                                       (maxfreq * 15 + 999999) / 1000000);
+                }
+        }
 
         err = bcm43xx_switch_core(bcm, old_core);
         assert(err == 0);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index d27016f8c736..a659442b9c15 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -47,9 +47,6 @@
 #define BCM43xx_WX_VERSION      18
 
 #define MAX_WX_STRING           80
-/* FIXME: the next line is a guess as to what the maximum RSSI value might be */
-#define RX_RSSI_MAX             60
-
 
 static int bcm43xx_wx_get_name(struct net_device *net_dev,
                                struct iw_request_info *info,
@@ -693,6 +690,7 @@ static int bcm43xx_wx_set_swencryption(struct net_device *net_dev,
         bcm->ieee->host_encrypt = !!on;
         bcm->ieee->host_decrypt = !!on;
         bcm->ieee->host_build_iv = !on;
+        bcm->ieee->host_strip_iv_icv = !on;
         spin_unlock_irqrestore(&bcm->irq_lock, flags);
         mutex_unlock(&bcm->mutex);
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
index 0159e4e93201..3e2462671690 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c
@@ -544,24 +544,6 @@ int bcm43xx_rx(struct bcm43xx_private *bcm,
         }
 
         frame_ctl = le16_to_cpu(wlhdr->frame_ctl);
-        if ((frame_ctl & IEEE80211_FCTL_PROTECTED) && !bcm->ieee->host_decrypt) {
-                frame_ctl &= ~IEEE80211_FCTL_PROTECTED;
-                wlhdr->frame_ctl = cpu_to_le16(frame_ctl);              
-                /* trim IV and ICV */
-                /* FIXME: this must be done only for WEP encrypted packets */
-                if (skb->len < 32) {
-                        dprintkl(KERN_ERR PFX "RX packet dropped (PROTECTED flag "
-                                              "set and length < 32)\n");
-                        return -EINVAL;
-                } else {                
-                        memmove(skb->data + 4, skb->data, 24);
-                        skb_pull(skb, 4);
-                        skb_trim(skb, skb->len - 4);
-                        stats.len -= 8;
-                }
-                wlhdr = (struct ieee80211_hdr_4addr *)(skb->data);
-        }
-        
         switch (WLAN_FC_GET_TYPE(frame_ctl)) {
         case IEEE80211_FTYPE_MGMT:
                 ieee80211_rx_mgt(bcm->ieee, wlhdr, &stats);
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index c2fa011be291..d1de9766c831 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -425,8 +425,14 @@ static int prism2_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 static int prism2_pci_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
+        int err;
 
-        pci_enable_device(pdev);
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+                       dev->name);
+                return err;
+        }
         pci_restore_state(pdev);
         prism2_hw_config(dev, 0);
         if (netif_running(dev)) {
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index 0f554373a60d..1bcd352a813b 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -5833,19 +5833,6 @@ static void ipw2100_tx_timeout(struct net_device *dev)
         schedule_reset(priv);
 }
 
-/*
- * TODO: reimplement it so that it reads statistics
- *       from the adapter using ordinal tables
- *       instead of/in addition to collecting them
- *       in the driver
- */
-static struct net_device_stats *ipw2100_stats(struct net_device *dev)
-{
-        struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-        return &priv->ieee->stats;
-}
-
 static int ipw2100_wpa_enable(struct ipw2100_priv *priv, int value)
 {
         /* This is called when wpa_supplicant loads and closes the driver
@@ -6030,7 +6017,6 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
         dev->open = ipw2100_open;
         dev->stop = ipw2100_close;
         dev->init = ipw2100_net_init;
-        dev->get_stats = ipw2100_stats;
         dev->ethtool_ops = &ipw2100_ethtool_ops;
         dev->tx_timeout = ipw2100_tx_timeout;
         dev->wireless_handlers = &ipw2100_wx_handler_def;
@@ -6428,6 +6414,7 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
 {
         struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
         struct net_device *dev = priv->net_dev;
+        int err;
         u32 val;
 
         if (IPW2100_PM_DISABLED)
@@ -6438,7 +6425,12 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
         IPW_DEBUG_INFO("%s: Coming out of suspend...\n", dev->name);
 
         pci_set_power_state(pci_dev, PCI_D0);
-        pci_enable_device(pci_dev);
+        err = pci_enable_device(pci_dev);
+        if (err) {
+                printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+                       dev->name);
+                return err;
+        }
         pci_restore_state(pci_dev);
 
         /*
@@ -7573,11 +7565,10 @@ static int ipw2100_wx_set_genie(struct net_device *dev,
                 return -EINVAL;
 
         if (wrqu->data.length) {
-                buf = kmalloc(wrqu->data.length, GFP_KERNEL);
+                buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL);
                 if (buf == NULL)
                         return -ENOMEM;
 
-                memcpy(buf, extra, wrqu->data.length);
                 kfree(ieee->wpa_ie);
                 ieee->wpa_ie = buf;
                 ieee->wpa_ie_len = wrqu->data.length;
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 587a0918fa52..e82e56bb85e1 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -6938,8 +6938,8 @@ static int ipw_qos_association(struct ipw_priv *priv,
 }
 
 /*
-* handling the beaconing responces. if we get different QoS setting
-* of the network from the the associated setting adjust the QoS
+* handling the beaconing responses. if we get different QoS setting
+* off the network from the associated setting, adjust the QoS
 * setting
 */
 static int ipw_qos_association_resp(struct ipw_priv *priv,
@@ -11746,12 +11746,18 @@ static int ipw_pci_resume(struct pci_dev *pdev)
 {
         struct ipw_priv *priv = pci_get_drvdata(pdev);
         struct net_device *dev = priv->net_dev;
+        int err;
         u32 val;
 
         printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
 
         pci_set_power_state(pdev, PCI_D0);
-        pci_enable_device(pdev);
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+                       dev->name);
+                return err;
+        }
         pci_restore_state(pdev);
 
         /*
diff --git a/drivers/net/wireless/orinoco_pci.h b/drivers/net/wireless/orinoco_pci.h
index be1abea4b64f..f4e5e06760c1 100644
--- a/drivers/net/wireless/orinoco_pci.h
+++ b/drivers/net/wireless/orinoco_pci.h
@@ -60,7 +60,12 @@ static int orinoco_pci_resume(struct pci_dev *pdev)
         int err;
 
         pci_set_power_state(pdev, 0);
-        pci_enable_device(pdev);
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+                       dev->name);
+                return err;
+        }
         pci_restore_state(pdev);
 
         err = request_irq(pdev->irq, orinoco_interrupt, IRQF_SHARED,
diff --git a/drivers/net/wireless/prism54/isl_38xx.c b/drivers/net/wireless/prism54/isl_38xx.c
index 23deee69974b..02fc67bccbd0 100644
--- a/drivers/net/wireless/prism54/isl_38xx.c
+++ b/drivers/net/wireless/prism54/isl_38xx.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2003-2004 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>_
  *
@@ -38,7 +37,7 @@
  * isl38xx_disable_interrupts - disable all interrupts
  * @device: pci memory base address
  *
- *  Instructs the device to disable all interrupt reporting by asserting 
+ *  Instructs the device to disable all interrupt reporting by asserting
  *  the IRQ line. New events may still show up in the interrupt identification
  *  register located at offset %ISL38XX_INT_IDENT_REG.
  */
@@ -204,17 +203,19 @@ isl38xx_interface_reset(void __iomem *device_base, dma_addr_t host_address)
         /* enable the interrupt for detecting initialization */
 
         /* Note: Do not enable other interrupts here. We want the
-         * device to have come up first 100% before allowing any other 
+         * device to have come up first 100% before allowing any other
          * interrupts. */
         isl38xx_w32_flush(device_base, ISL38XX_INT_IDENT_INIT, ISL38XX_INT_EN_REG);
         udelay(ISL38XX_WRITEIO_DELAY);  /* allow complete full reset */
 }
 
 void
-isl38xx_enable_common_interrupts(void __iomem *device_base) {
+isl38xx_enable_common_interrupts(void __iomem *device_base)
+{
         u32 reg;
-        reg = ( ISL38XX_INT_IDENT_UPDATE | 
-                        ISL38XX_INT_IDENT_SLEEP | ISL38XX_INT_IDENT_WAKEUP);
+
+        reg = ISL38XX_INT_IDENT_UPDATE | ISL38XX_INT_IDENT_SLEEP |
+              ISL38XX_INT_IDENT_WAKEUP;
         isl38xx_w32_flush(device_base, reg, ISL38XX_INT_EN_REG);
         udelay(ISL38XX_WRITEIO_DELAY);
 }
@@ -234,23 +235,21 @@ isl38xx_in_queue(isl38xx_control_block *cb, int queue)
                 /* send queues */
         case ISL38XX_CB_TX_MGMTQ:
                 BUG_ON(delta > ISL38XX_CB_MGMT_QSIZE);
+
         case ISL38XX_CB_TX_DATA_LQ:
         case ISL38XX_CB_TX_DATA_HQ:
                 BUG_ON(delta > ISL38XX_CB_TX_QSIZE);
                 return delta;
-                break;
 
                 /* receive queues */
         case ISL38XX_CB_RX_MGMTQ:
                 BUG_ON(delta > ISL38XX_CB_MGMT_QSIZE);
                 return ISL38XX_CB_MGMT_QSIZE - delta;
-                break;
 
         case ISL38XX_CB_RX_DATA_LQ:
         case ISL38XX_CB_RX_DATA_HQ:
                 BUG_ON(delta > ISL38XX_CB_RX_QSIZE);
                 return ISL38XX_CB_RX_QSIZE - delta;
-                break;
         }
         BUG();
         return 0;
diff --git a/drivers/net/wireless/prism54/isl_38xx.h b/drivers/net/wireless/prism54/isl_38xx.h
index 8af20980af8d..3fadcb6f5297 100644
--- a/drivers/net/wireless/prism54/isl_38xx.h
+++ b/drivers/net/wireless/prism54/isl_38xx.h
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -67,10 +66,10 @@
  * @base: (host) memory base address of the device
  * @val: 32bit value (host order) to write
  * @offset: byte offset into @base to write value to
- * 
+ *
  *  This helper takes care of writing a 32bit datum to the
- *  specified offset into the device's pci memory space, and making sure 
- *  the pci memory buffers get flushed by performing one harmless read 
+ *  specified offset into the device's pci memory space, and making sure
+ *  the pci memory buffers get flushed by performing one harmless read
  *  from the %ISL38XX_PCI_POSTING_FLUSH offset.
  */
 static inline void
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index e7700b4257eb..a87eb51886c8 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *            (C) 2003,2004 Aurelien Alleaume <slts@free.fr>
  *            (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
@@ -55,12 +54,12 @@ static const unsigned char scan_rate_list[] = { 2, 4, 11, 22,
  * prism54_mib_mode_helper - MIB change mode helper function
  * @mib: the &struct islpci_mib object to modify
  * @iw_mode: new mode (%IW_MODE_*)
- * 
+ *
  *  This is a helper function, hence it does not lock. Make sure
- *  caller deals with locking *if* necessary. This function sets the 
- *  mode-dependent mib values and does the mapping of the Linux 
- *  Wireless API modes to Device firmware modes. It also checks for 
- *  correct valid Linux wireless modes. 
+ *  caller deals with locking *if* necessary. This function sets the
+ *  mode-dependent mib values and does the mapping of the Linux
+ *  Wireless API modes to Device firmware modes. It also checks for
+ *  correct valid Linux wireless modes.
  */
 static int
 prism54_mib_mode_helper(islpci_private *priv, u32 iw_mode)
@@ -118,7 +117,7 @@ prism54_mib_mode_helper(islpci_private *priv, u32 iw_mode)
  *
  *  this function initializes the struct given as @mib with defaults,
  *  of which many are retrieved from the global module parameter
- *  variables.  
+ *  variables.
  */
 
 void
@@ -134,7 +133,7 @@ prism54_mib_init(islpci_private *priv)
         authen = CARD_DEFAULT_AUTHEN;
         wep = CARD_DEFAULT_WEP;
         filter = CARD_DEFAULT_FILTER; /* (0) Do not filter un-encrypted data */
-        dot1x = CARD_DEFAULT_DOT1X; 
+        dot1x = CARD_DEFAULT_DOT1X;
         mlme = CARD_DEFAULT_MLME_MODE;
         conformance = CARD_DEFAULT_CONFORMANCE;
         power = 127;
@@ -229,7 +228,7 @@ prism54_get_wireless_stats(struct net_device *ndev)
         } else
                 priv->iwstatistics.qual.updated = 0;
 
-        /* Update our wireless stats, but do not schedule to often 
+        /* Update our wireless stats, but do not schedule to often
          * (max 1 HZ) */
         if ((priv->stats_timestamp == 0) ||
             time_after(jiffies, priv->stats_timestamp + 1 * HZ)) {
@@ -706,7 +705,7 @@ prism54_get_scan(struct net_device *ndev, struct iw_request_info *info,
         * Starting with WE-17, the buffer can be as big as needed.
         * But the device won't repport anything if you change the value
         * of IWMAX_BSS=24. */
-        
+
         rvalue |= mgt_get_request(priv, DOT11_OID_BSSLIST, 0, NULL, &r);
         bsslist = r.ptr;
 
@@ -786,7 +785,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
         return rvalue;
 }
 
-/* Provides no functionality, just completes the ioctl. In essence this is a 
+/* Provides no functionality, just completes the ioctl. In essence this is a
  * just a cosmetic ioctl.
  */
 static int
@@ -1105,7 +1104,7 @@ prism54_set_encode(struct net_device *ndev, struct iw_request_info *info,
                                             &key);
                 }
                 /*
-                 * If a valid key is set, encryption should be enabled 
+                 * If a valid key is set, encryption should be enabled
                  * (user may turn it off later).
                  * This is also how "iwconfig ethX key on" works
                  */
@@ -1127,7 +1126,7 @@ prism54_set_encode(struct net_device *ndev, struct iw_request_info *info,
         }
         /* now read the flags */
         if (dwrq->flags & IW_ENCODE_DISABLED) {
-                /* Encoding disabled, 
+                /* Encoding disabled,
                  * authen = DOT11_AUTH_OS;
                  * invoke = 0;
                  * exunencrypt = 0; */
@@ -1215,7 +1214,7 @@ prism54_get_txpower(struct net_device *ndev, struct iw_request_info *info,
         vwrq->value = (s32) r.u / 4;
         vwrq->fixed = 1;
         /* radio is not turned of
-         * btw: how is possible to turn off only the radio 
+         * btw: how is possible to turn off only the radio
          */
         vwrq->disabled = 0;
 
@@ -2355,17 +2354,17 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
                 handle_request(priv, mlme, oid);
                 send_formatted_event(priv, "Authenticate request (ex)", mlme, 1);
 
-                if (priv->iw_mode != IW_MODE_MASTER 
+                if (priv->iw_mode != IW_MODE_MASTER
                                 && mlmeex->state != DOT11_STATE_AUTHING)
                         break;
 
                 confirm = kmalloc(sizeof(struct obj_mlmeex) + 6, GFP_ATOMIC);
 
-                if (!confirm) 
+                if (!confirm)
                         break;
 
                 memcpy(&confirm->address, mlmeex->address, ETH_ALEN);
-                printk(KERN_DEBUG "Authenticate from: address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+                printk(KERN_DEBUG "Authenticate from: address:\t%02x:%02x:%02x:%02x:%02x:%02x\n",
                                 mlmeex->address[0],
                                 mlmeex->address[1],
                                 mlmeex->address[2],
@@ -2399,10 +2398,10 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
                 handle_request(priv, mlme, oid);
                 send_formatted_event(priv, "Associate request (ex)", mlme, 1);
 
-                if (priv->iw_mode != IW_MODE_MASTER 
+                if (priv->iw_mode != IW_MODE_MASTER
                                 && mlmeex->state != DOT11_STATE_ASSOCING)
                         break;
-                
+
                 confirm = kmalloc(sizeof(struct obj_mlmeex), GFP_ATOMIC);
 
                 if (!confirm)
@@ -2418,7 +2417,7 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
 
                 if (!wpa_ie_len) {
                         printk(KERN_DEBUG "No WPA IE found from "
-                                        "address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+                                        "address:\t%02x:%02x:%02x:%02x:%02x:%02x\n",
                                 mlmeex->address[0],
                                 mlmeex->address[1],
                                 mlmeex->address[2],
@@ -2436,14 +2435,14 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
                 mgt_set_varlen(priv, oid, confirm, wpa_ie_len);
 
                 kfree(confirm);
-                
+
                 break;
 
         case DOT11_OID_REASSOCIATEEX:
                 handle_request(priv, mlme, oid);
                 send_formatted_event(priv, "Reassociate request (ex)", mlme, 1);
 
-                if (priv->iw_mode != IW_MODE_MASTER 
+                if (priv->iw_mode != IW_MODE_MASTER
                                 && mlmeex->state != DOT11_STATE_ASSOCING)
                         break;
 
@@ -2462,7 +2461,7 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
 
                 if (!wpa_ie_len) {
                         printk(KERN_DEBUG "No WPA IE found from "
-                                        "address:\t%02x:%02x:%02x:%02x:%02x:%02x\n", 
+                                        "address:\t%02x:%02x:%02x:%02x:%02x:%02x\n",
                                 mlmeex->address[0],
                                 mlmeex->address[1],
                                 mlmeex->address[2],
@@ -2474,13 +2473,13 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
                         break;
                 }
 
-                confirm->size = wpa_ie_len; 
+                confirm->size = wpa_ie_len;
                 memcpy(&confirm->data, wpa_ie, wpa_ie_len);
 
                 mgt_set_varlen(priv, oid, confirm, wpa_ie_len);
 
                 kfree(confirm);
-                
+
                 break;
 
         default:
@@ -2547,10 +2546,10 @@ enum {
 #define PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN \
 ((int) (&((struct prism2_hostapd_param *) 0)->u.generic_elem.data))
 
-/* Maximum length for algorithm names (-1 for nul termination) 
+/* Maximum length for algorithm names (-1 for nul termination)
  * used in ioctl() */
 #define HOSTAP_CRYPT_ALG_NAME_LEN 16
-        
+
 struct prism2_hostapd_param {
         u32 cmd;
         u8 sta_addr[ETH_ALEN];
@@ -2623,7 +2622,7 @@ prism2_ioctl_set_encryption(struct net_device *dev,
                                             &key);
                 }
                 /*
-                 * If a valid key is set, encryption should be enabled 
+                 * If a valid key is set, encryption should be enabled
                  * (user may turn it off later).
                  * This is also how "iwconfig ethX key on" works
                  */
@@ -2645,7 +2644,7 @@ prism2_ioctl_set_encryption(struct net_device *dev,
         }
         /* now read the flags */
         if (param->u.crypt.flags & IW_ENCODE_DISABLED) {
-                /* Encoding disabled, 
+                /* Encoding disabled,
                  * authen = DOT11_AUTH_OS;
                  * invoke = 0;
                  * exunencrypt = 0; */
@@ -2712,7 +2711,7 @@ prism2_ioctl_set_generic_element(struct net_device *ndev,
 
                ret = mgt_set_varlen(priv, DOT11_OID_ATTACHMENT, attach, len);
 
-               if (ret == 0) 
+               if (ret == 0)
                        printk(KERN_DEBUG "%s: WPA IE Attachment was set\n",
                                        ndev->name);
        }
@@ -2872,7 +2871,7 @@ prism54_set_wpa(struct net_device *ndev, struct iw_request_info *info,
                         mlme = DOT11_MLME_AUTO;
                         printk("%s: Disabling WPA\n", ndev->name);
                         break;
-                case 2: 
+                case 2:
                 case 1: /* WPA */
                         printk("%s: Enabling WPA\n", ndev->name);
                         break;
diff --git a/drivers/net/wireless/prism54/isl_ioctl.h b/drivers/net/wireless/prism54/isl_ioctl.h
index 0802fa64996f..bcfbfb9281d2 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.h
+++ b/drivers/net/wireless/prism54/isl_ioctl.h
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *            (C) 2003 Aurelien Alleaume <slts@free.fr>
  *            (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
diff --git a/drivers/net/wireless/prism54/isl_oid.h b/drivers/net/wireless/prism54/isl_oid.h
index 419edf7ccf1a..b7534c2869c8 100644
--- a/drivers/net/wireless/prism54/isl_oid.h
+++ b/drivers/net/wireless/prism54/isl_oid.h
@@ -1,6 +1,4 @@
 /*
- *
- *  
  *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
  *  Copyright (C) 2004 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
  *  Copyright (C) 2004 Aurelien Alleaume <slts@free.fr>
@@ -23,7 +21,7 @@
 #if !defined(_ISL_OID_H)
 #define _ISL_OID_H
 
-/* 
+/*
  * MIB related constant and structure definitions for communicating
  * with the device firmware
  */
@@ -99,21 +97,21 @@ struct obj_attachment {
         char data[0];
 } __attribute__((packed));
 
-/* 
+/*
  * in case everything's ok, the inlined function below will be
  * optimized away by the compiler...
  */
 static inline void
 __bug_on_wrong_struct_sizes(void)
 {
-        BUG_ON(sizeof (struct obj_ssid) != 34);
-        BUG_ON(sizeof (struct obj_key) != 34);
-        BUG_ON(sizeof (struct obj_mlme) != 12);
-        BUG_ON(sizeof (struct obj_mlmeex) != 14);
-        BUG_ON(sizeof (struct obj_buffer) != 8);
-        BUG_ON(sizeof (struct obj_bss) != 60);
-        BUG_ON(sizeof (struct obj_bsslist) != 4);
-        BUG_ON(sizeof (struct obj_frequencies) != 2);
+        BUILD_BUG_ON(sizeof (struct obj_ssid) != 34);
+        BUILD_BUG_ON(sizeof (struct obj_key) != 34);
+        BUILD_BUG_ON(sizeof (struct obj_mlme) != 12);
+        BUILD_BUG_ON(sizeof (struct obj_mlmeex) != 14);
+        BUILD_BUG_ON(sizeof (struct obj_buffer) != 8);
+        BUILD_BUG_ON(sizeof (struct obj_bss) != 60);
+        BUILD_BUG_ON(sizeof (struct obj_bsslist) != 4);
+        BUILD_BUG_ON(sizeof (struct obj_frequencies) != 2);
 }
 
 enum dot11_state_t {
@@ -154,13 +152,13 @@ enum dot11_priv_t {
 
 /* Prism "Nitro" / Frameburst / "Packet Frame Grouping"
  * Value is in microseconds. Represents the # microseconds
- * the firmware will take to group frames before sending out then out 
+ * the firmware will take to group frames before sending out then out
  * together with a CSMA contention. Without this all frames are
- * sent with a CSMA contention. 
- * Bibliography: 
+ * sent with a CSMA contention.
+ * Bibliography:
  * http://www.hpl.hp.com/personal/Jean_Tourrilhes/Papers/Packet.Frame.Grouping.html
  */
-enum dot11_maxframeburst_t { 
+enum dot11_maxframeburst_t {
         /* Values for DOT11_OID_MAXFRAMEBURST */
         DOT11_MAXFRAMEBURST_OFF = 0, /* Card firmware default */
         DOT11_MAXFRAMEBURST_MIXED_SAFE = 650, /* 802.11 a,b,g safe */
@@ -176,9 +174,9 @@ enum dot11_maxframeburst_t {
 /* Support for 802.11 long and short frame preambles.
  * Long  preamble uses 128-bit sync field, 8-bit  CRC
  * Short preamble uses 56-bit  sync field, 16-bit CRC
- * 
+ *
  * 802.11a -- not sure, both optionally ?
- * 802.11b supports long and optionally short 
+ * 802.11b supports long and optionally short
  * 802.11g supports both */
 enum dot11_preamblesettings_t {
         DOT11_PREAMBLESETTING_LONG = 0,
@@ -194,7 +192,7 @@ enum dot11_preamblesettings_t {
  * Long uses 802.11a slot timing  (9 usec ?)
  * Short uses 802.11b slot timing (20 use ?) */
 enum dot11_slotsettings_t {
-        DOT11_SLOTSETTINGS_LONG = 0, 
+        DOT11_SLOTSETTINGS_LONG = 0,
                 /* Allows *only* long 802.11b slot timing */
         DOT11_SLOTSETTINGS_SHORT = 1,
                 /* Allows *only* long 802.11a slot timing */
@@ -203,7 +201,7 @@ enum dot11_slotsettings_t {
 };
 
 /* All you need to know, ERP is "Extended Rate PHY".
- * An Extended Rate PHY (ERP) STA or AP shall support three different 
+ * An Extended Rate PHY (ERP) STA or AP shall support three different
  * preamble and header formats:
  * Long  preamble (refer to above)
  * Short preamble (refer to above)
@@ -221,7 +219,7 @@ enum do11_nonerpstatus_t {
 /* (ERP is "Extended Rate PHY") Way to read NONERP is NON-ERP-*
  * The key here is DOT11 NON ERP NEVER protects against
  * NON ERP STA's. You *don't* want this unless
- * you know what you are doing. It means you will only 
+ * you know what you are doing. It means you will only
  * get Extended Rate capabilities */
 enum dot11_nonerpprotection_t {
         DOT11_NONERP_NEVER = 0,
@@ -229,13 +227,13 @@ enum dot11_nonerpprotection_t {
         DOT11_NONERP_DYNAMIC = 2
 };
 
-/* Preset OID configuration for 802.11 modes 
- * Note: DOT11_OID_CW[MIN|MAX] hold the values of the 
+/* Preset OID configuration for 802.11 modes
+ * Note: DOT11_OID_CW[MIN|MAX] hold the values of the
  * DCS MIN|MAX backoff used */
 enum dot11_profile_t { /* And set/allowed values */
         /* Allowed values for DOT11_OID_PROFILES */
         DOT11_PROFILE_B_ONLY = 0,
-                /* DOT11_OID_RATES: 1, 2, 5.5, 11Mbps 
+                /* DOT11_OID_RATES: 1, 2, 5.5, 11Mbps
                  * DOT11_OID_PREAMBLESETTINGS: DOT11_PREAMBLESETTING_DYNAMIC
                  * DOT11_OID_CWMIN: 31
                  * DOT11_OID_NONEPROTECTION: DOT11_NOERP_DYNAMIC
@@ -275,7 +273,7 @@ enum oid_inl_conformance_t {
         OID_INL_CONFORMANCE_NONE = 0,   /* Perform active scanning */
         OID_INL_CONFORMANCE_STRICT = 1, /* Strictly adhere to 802.11d */
         OID_INL_CONFORMANCE_FLEXIBLE = 2,       /* Use passed 802.11d info to
-                * determine channel AND/OR just make assumption that active 
+                * determine channel AND/OR just make assumption that active
                 * channels are valid  channels */
 };
 
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index e35fcb2543c4..f057fd9fcd79 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
  *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
@@ -413,7 +412,7 @@ prism54_bring_down(islpci_private *priv)
         islpci_set_state(priv, PRV_STATE_PREBOOT);
 
         /* disable all device interrupts in case they weren't */
-        isl38xx_disable_interrupts(priv->device_base);  
+        isl38xx_disable_interrupts(priv->device_base);
 
         /* For safety reasons, we may want to ensure that no DMA transfer is
          * currently in progress by emptying the TX and RX queues. */
@@ -480,7 +479,7 @@ islpci_reset_if(islpci_private *priv)
 
         DEFINE_WAIT(wait);
         prepare_to_wait(&priv->reset_done, &wait, TASK_UNINTERRUPTIBLE);
-        
+
         /* now the last step is to reset the interface */
         isl38xx_interface_reset(priv->device_base, priv->device_host_address);
         islpci_set_state(priv, PRV_STATE_PREINIT);
@@ -488,7 +487,7 @@ islpci_reset_if(islpci_private *priv)
         for(count = 0; count < 2 && result; count++) {
                 /* The software reset acknowledge needs about 220 msec here.
                  * Be conservative and wait for up to one second. */
-        
+
                 remaining = schedule_timeout_uninterruptible(HZ);
 
                 if(remaining > 0) {
@@ -496,7 +495,7 @@ islpci_reset_if(islpci_private *priv)
                         break;
                 }
 
-                /* If we're here it's because our IRQ hasn't yet gone through. 
+                /* If we're here it's because our IRQ hasn't yet gone through.
                  * Retry a bit more...
                  */
                 printk(KERN_ERR "%s: no 'reset complete' IRQ seen - retrying\n",
@@ -514,7 +513,7 @@ islpci_reset_if(islpci_private *priv)
 
         /* Now that the device is 100% up, let's allow
          * for the other interrupts --
-         * NOTE: this is not *yet* true since we've only allowed the 
+         * NOTE: this is not *yet* true since we've only allowed the
          * INIT interrupt on the IRQ line. We can perhaps poll
          * the IRQ line until we know for sure the reset went through */
         isl38xx_enable_common_interrupts(priv->device_base);
@@ -716,7 +715,7 @@ islpci_alloc_memory(islpci_private *priv)
 
         prism54_acl_init(&priv->acl);
         prism54_wpa_bss_ie_init(priv);
-        if (mgt_init(priv)) 
+        if (mgt_init(priv))
                 goto out_free;
 
         return 0;
diff --git a/drivers/net/wireless/prism54/islpci_dev.h b/drivers/net/wireless/prism54/islpci_dev.h
index 2f7e525d0cf6..a9aa1662eaa4 100644
--- a/drivers/net/wireless/prism54/islpci_dev.h
+++ b/drivers/net/wireless/prism54/islpci_dev.h
@@ -1,6 +1,5 @@
 /*
- *  
- *  Copyright (C) 2002 Intersil Americas Inc. 
+ *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
  *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
  *  Copyright (C) 2003 Aurelien Alleaume <slts@free.fr>
@@ -72,12 +71,12 @@ struct islpci_bss_wpa_ie {
         u8 bssid[ETH_ALEN];
         u8 wpa_ie[MAX_WPA_IE_LEN];
         size_t wpa_ie_len;
-        
+
 };
 
 typedef struct {
         spinlock_t slock;       /* generic spinlock; */
-        
+
         u32 priv_oid;
 
         /* our mib cache */
@@ -85,7 +84,7 @@ typedef struct {
         struct rw_semaphore mib_sem;
         void **mib;
         char nickname[IW_ESSID_MAX_SIZE+1];
-        
+
         /* Take care of the wireless stats */
         struct work_struct stats_work;
         struct semaphore stats_sem;
@@ -120,7 +119,7 @@ typedef struct {
         struct net_device *ndev;
 
         /* device queue interface members */
-        struct isl38xx_cb *control_block;       /* device control block 
+        struct isl38xx_cb *control_block;       /* device control block
                                                            (== driver_mem_address!) */
 
         /* Each queue has three indexes:
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 103a37877733..b1122912ee2d 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2004 Aurelien Alleaume <slts@free.fr>
  *  This program is free software; you can redistribute it and/or modify
@@ -48,7 +47,7 @@ islpci_eth_cleanup_transmit(islpci_private *priv,
                 /* read the index of the first fragment to be freed */
                 index = priv->free_data_tx % ISL38XX_CB_TX_QSIZE;
 
-                /* check for holes in the arrays caused by multi fragment frames 
+                /* check for holes in the arrays caused by multi fragment frames
                  * searching for the last fragment of a frame */
                 if (priv->pci_map_tx_address[index] != (dma_addr_t) NULL) {
                         /* entry is the last fragment of a frame
@@ -253,6 +252,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
          * header and without the FCS. But there a is a bit that
          * indicates if the packet is corrupted :-) */
         struct rfmon_header *hdr = (struct rfmon_header *) (*skb)->data;
+
         if (hdr->flags & 0x01)
                 /* This one is bad. Drop it ! */
                 return -1;
@@ -284,7 +284,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
                     (struct avs_80211_1_header *) skb_push(*skb,
                                                            sizeof (struct
                                                                    avs_80211_1_header));
-                
+
                 avs->version = cpu_to_be32(P80211CAPTURE_VERSION);
                 avs->length = cpu_to_be32(sizeof (struct avs_80211_1_header));
                 avs->mactime = cpu_to_be64(le64_to_cpu(clock));
@@ -390,7 +390,7 @@ islpci_eth_receive(islpci_private *priv)
                         struct rx_annex_header *annex =
                             (struct rx_annex_header *) skb->data;
                         wstats.level = annex->rfmon.rssi;
-                        /* The noise value can be a bit outdated if nobody's 
+                        /* The noise value can be a bit outdated if nobody's
                          * reading wireless stats... */
                         wstats.noise = priv->local_iwstatistics.qual.noise;
                         wstats.qual = wstats.level - wstats.noise;
@@ -464,10 +464,8 @@ islpci_eth_receive(islpci_private *priv)
                         break;
                 }
                 /* update the fragment address */
-                control_block->rx_data_low[index].address = cpu_to_le32((u32)
-                                                                        priv->
-                                                                        pci_map_rx_address
-                                                                        [index]);
+                control_block->rx_data_low[index].address =
+                        cpu_to_le32((u32)priv->pci_map_rx_address[index]);
                 wmb();
 
                 /* increment the driver read pointer */
@@ -485,9 +483,11 @@ void
 islpci_do_reset_and_wake(struct work_struct *work)
 {
         islpci_private *priv = container_of(work, islpci_private, reset_task);
+
         islpci_reset(priv, 1);
-        netif_wake_queue(priv->ndev);
         priv->reset_task_pending = 0;
+        smp_wmb();
+        netif_wake_queue(priv->ndev);
 }
 
 void
@@ -499,12 +499,14 @@ islpci_eth_tx_timeout(struct net_device *ndev)
         /* increment the transmit error counter */
         statistics->tx_errors++;
 
-        printk(KERN_WARNING "%s: tx_timeout", ndev->name);
         if (!priv->reset_task_pending) {
-                priv->reset_task_pending = 1;
-                printk(", scheduling a reset");
+                printk(KERN_WARNING
+                        "%s: tx_timeout, scheduling reset", ndev->name);
                 netif_stop_queue(ndev);
+                priv->reset_task_pending = 1;
                 schedule_work(&priv->reset_task);
+        } else {
+                printk(KERN_WARNING
+                        "%s: tx_timeout, waiting for reset", ndev->name);
         }
-        printk("\n");
 }
diff --git a/drivers/net/wireless/prism54/islpci_eth.h b/drivers/net/wireless/prism54/islpci_eth.h
index 99d37eda9f01..5bf820defbd0 100644
--- a/drivers/net/wireless/prism54/islpci_eth.h
+++ b/drivers/net/wireless/prism54/islpci_eth.h
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/prism54/islpci_hotplug.c b/drivers/net/wireless/prism54/islpci_hotplug.c
index f692dccf0d07..58257b40c043 100644
--- a/drivers/net/wireless/prism54/islpci_hotplug.c
+++ b/drivers/net/wireless/prism54/islpci_hotplug.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2003 Herbert Valerio Riedel <hvr@gnu.org>
  *
@@ -40,8 +39,8 @@ static int	init_pcitm = 0;
 module_param(init_pcitm, int, 0);
 
 /* In this order: vendor, device, subvendor, subdevice, class, class_mask,
- * driver_data 
- * If you have an update for this please contact prism54-devel@prism54.org 
+ * driver_data
+ * If you have an update for this please contact prism54-devel@prism54.org
  * The latest list can be found at http://prism54.org/supported_cards.php */
 static const struct pci_device_id prism54_id_tbl[] = {
         /* Intersil PRISM Duette/Prism GT Wireless LAN adapter */
@@ -132,15 +131,15 @@ prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         /* 0x40 is the programmable timer to configure the response timeout (TRDY_TIMEOUT)
          * 0x41 is the programmable timer to configure the retry timeout (RETRY_TIMEOUT)
-         *      The RETRY_TIMEOUT is used to set the number of retries that the core, as a
-         *      Master, will perform before abandoning a cycle. The default value for
-         *      RETRY_TIMEOUT is 0x80, which far exceeds the PCI 2.1 requirement for new
-         *      devices. A write of zero to the RETRY_TIMEOUT register disables this
-         *      function to allow use with any non-compliant legacy devices that may
-         *      execute more retries.
+         *      The RETRY_TIMEOUT is used to set the number of retries that the core, as a
+         *      Master, will perform before abandoning a cycle. The default value for
+         *      RETRY_TIMEOUT is 0x80, which far exceeds the PCI 2.1 requirement for new
+         *      devices. A write of zero to the RETRY_TIMEOUT register disables this
+         *      function to allow use with any non-compliant legacy devices that may
+         *      execute more retries.
          *
-         *      Writing zero to both these two registers will disable both timeouts and
-         *      *can* solve problems caused by devices that are slow to respond.
+         *      Writing zero to both these two registers will disable both timeouts and
+         *      *can* solve problems caused by devices that are slow to respond.
          *      Make this configurable - MSW
          */
         if ( init_pcitm >= 0 ) {
@@ -171,14 +170,15 @@ prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         pci_set_master(pdev);
 
         /* enable MWI */
-        pci_set_mwi(pdev);
+        if (!pci_set_mwi(pdev))
+                printk(KERN_INFO "%s: pci_set_mwi(pdev) succeeded\n", DRV_NAME);
 
         /* setup the network device interface and its structure */
         if (!(ndev = islpci_setup(pdev))) {
                 /* error configuring the driver as a network device */
                 printk(KERN_ERR "%s: could not configure network device\n",
                        DRV_NAME);
-                goto do_pci_release_regions;
+                goto do_pci_clear_mwi;
         }
 
         priv = netdev_priv(ndev);
@@ -208,6 +208,8 @@ prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         pci_set_drvdata(pdev, NULL);
         free_netdev(ndev);
         priv = NULL;
+      do_pci_clear_mwi:
+        pci_clear_mwi(pdev);
       do_pci_release_regions:
         pci_release_regions(pdev);
       do_pci_disable_device:
@@ -241,7 +243,7 @@ prism54_remove(struct pci_dev *pdev)
                 isl38xx_disable_interrupts(priv->device_base);
                 islpci_set_state(priv, PRV_STATE_OFF);
                 /* This bellow causes a lockup at rmmod time. It might be
-                 * because some interrupts still linger after rmmod time, 
+                 * because some interrupts still linger after rmmod time,
                  * see bug #17 */
                 /* pci_set_power_state(pdev, 3);*/      /* try to power-off */
         }
@@ -255,6 +257,8 @@ prism54_remove(struct pci_dev *pdev)
         free_netdev(ndev);
         priv = NULL;
 
+        pci_clear_mwi(pdev);
+
         pci_release_regions(pdev);
 
         pci_disable_device(pdev);
@@ -288,12 +292,19 @@ prism54_resume(struct pci_dev *pdev)
 {
         struct net_device *ndev = pci_get_drvdata(pdev);
         islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
-        BUG_ON(!priv);
+        int err;
 
-        pci_enable_device(pdev);
+        BUG_ON(!priv);
 
         printk(KERN_NOTICE "%s: got resume request\n", ndev->name);
 
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
+                       ndev->name);
+                return err;
+        }
+
         pci_restore_state(pdev);
 
         /* alright let's go into the PREBOOT state */
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index 656ec9fa7128..2246f7930b4e 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright 2004 Jens Maurer <Jens.Maurer@gmx.net>
  *
@@ -502,7 +501,7 @@ islpci_mgt_transaction(struct net_device *ndev,
         printk(KERN_WARNING "%s: timeout waiting for mgmt response\n",
                ndev->name);
 
-        /* TODO: we should reset the device here */     
+        /* TODO: we should reset the device here */
  out:
         finish_wait(&priv->mgmt_wqueue, &wait);
         up(&priv->mgmt_sem);
diff --git a/drivers/net/wireless/prism54/islpci_mgt.h b/drivers/net/wireless/prism54/islpci_mgt.h
index 2982be3363ef..fc53b587b722 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.h
+++ b/drivers/net/wireless/prism54/islpci_mgt.h
@@ -1,5 +1,4 @@
 /*
- *  
  *  Copyright (C) 2002 Intersil Americas Inc.
  *  Copyright (C) 2003 Luis R. Rodriguez <mcgrof@ruslug.rutgers.edu>
  *
@@ -36,8 +35,8 @@ extern int pc_debug;
 
 
 /* General driver definitions */
-#define PCIDEVICE_LATENCY_TIMER_MIN             0x40
-#define PCIDEVICE_LATENCY_TIMER_VAL             0x50
+#define PCIDEVICE_LATENCY_TIMER_MIN             0x40
+#define PCIDEVICE_LATENCY_TIMER_VAL             0x50
 
 /* Debugging verbose definitions */
 #define SHOW_NOTHING                            0x00    /* overrules everything */
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index ebb238785839..fbc52b6a3024 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -1,4 +1,4 @@
-/*   
+/*
  *  Copyright (C) 2003,2004 Aurelien Alleaume <slts@free.fr>
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -503,7 +503,7 @@ mgt_set_varlen(islpci_private *priv, enum oid_num_t n, void *data, int extra_len
                 }
                 if (ret || response_op == PIMFOR_OP_ERROR)
                         ret = -EIO;
-        } else 
+        } else
                 ret = -EIO;
 
         /* re-set given data to what it was */
@@ -727,7 +727,7 @@ mgt_commit(islpci_private *priv)
  * MEDIUMLIMIT,BEACONPERIOD,DTIMPERIOD,ATIMWINDOW,LISTENINTERVAL
  * FREQUENCY,EXTENDEDRATES.
  *
- * The way to do this is to set ESSID. Note though that they may get 
+ * The way to do this is to set ESSID. Note though that they may get
  * unlatch before though by setting another OID. */
 #if 0
 void
diff --git a/drivers/net/wireless/prism54/prismcompat.h b/drivers/net/wireless/prism54/prismcompat.h
index d71eca55a302..aa1d1747784f 100644
--- a/drivers/net/wireless/prism54/prismcompat.h
+++ b/drivers/net/wireless/prism54/prismcompat.h
@@ -1,4 +1,4 @@
-/*  
+/*
  *  (C) 2004 Margit Schubert-While <margitsw@t-online.de>
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -16,7 +16,7 @@
  *
  */
 
-/*  
+/*
  *      Compatibility header file to aid support of different kernel versions
  */
 
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 36b29ff05814..6cb66a356c96 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -1828,10 +1828,8 @@ err_start:
         /* Leave the device in reset state */
         zd1201_docmd(zd, ZD1201_CMDCODE_INIT, 0, 0, 0);
 err_zd:
-        if (zd->tx_urb)
-                usb_free_urb(zd->tx_urb);
-        if (zd->rx_urb)
-                usb_free_urb(zd->rx_urb);
+        usb_free_urb(zd->tx_urb);
+        usb_free_urb(zd->rx_urb);
         kfree(zd);
         return err;
 }
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index aa661b2b76c7..8be99ebbe1cd 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -1076,6 +1076,31 @@ static int set_mandatory_rates(struct zd_chip *chip, enum ieee80211_std std)
         return zd_iowrite32_locked(chip, rates, CR_MANDATORY_RATE_TBL);
 }
 
+int zd_chip_set_rts_cts_rate_locked(struct zd_chip *chip,
+        u8 rts_rate, int preamble)
+{
+        int rts_mod = ZD_RX_CCK;
+        u32 value = 0;
+
+        /* Modulation bit */
+        if (ZD_CS_TYPE(rts_rate) == ZD_CS_OFDM)
+                rts_mod = ZD_RX_OFDM;
+
+        dev_dbg_f(zd_chip_dev(chip), "rts_rate=%x preamble=%x\n",
+                rts_rate, preamble);
+
+        value |= rts_rate << RTSCTS_SH_RTS_RATE;
+        value |= rts_mod << RTSCTS_SH_RTS_MOD_TYPE;
+        value |= preamble << RTSCTS_SH_RTS_PMB_TYPE;
+        value |= preamble << RTSCTS_SH_CTS_PMB_TYPE;
+
+        /* We always send 11M self-CTS messages, like the vendor driver. */
+        value |= ZD_CCK_RATE_11M << RTSCTS_SH_CTS_RATE;
+        value |= ZD_RX_CCK << RTSCTS_SH_CTS_MOD_TYPE;
+
+        return zd_iowrite32_locked(chip, value, CR_RTS_CTS_RATE);
+}
+
 int zd_chip_enable_hwint(struct zd_chip *chip)
 {
         int r;
@@ -1355,17 +1380,12 @@ out:
         return r;
 }
 
-int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
+int zd_chip_set_basic_rates_locked(struct zd_chip *chip, u16 cr_rates)
 {
-        int r;
-
-        if (cr_rates & ~(CR_RATES_80211B|CR_RATES_80211G))
-                return -EINVAL;
+        ZD_ASSERT((cr_rates & ~(CR_RATES_80211B | CR_RATES_80211G)) == 0);
+        dev_dbg_f(zd_chip_dev(chip), "%x\n", cr_rates);
 
-        mutex_lock(&chip->mutex);
-        r = zd_iowrite32_locked(chip, cr_rates, CR_BASIC_RATE_TBL);
-        mutex_unlock(&chip->mutex);
-        return r;
+        return zd_iowrite32_locked(chip, cr_rates, CR_BASIC_RATE_TBL);
 }
 
 static int ofdm_qual_db(u8 status_quality, u8 rate, unsigned int size)
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index ae59597ce4e1..ca892b9a6448 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -337,24 +337,24 @@
 #define CR_MAC_PS_STATE                 CTL_REG(0x050C)
 
 #define CR_INTERRUPT                    CTL_REG(0x0510)
-#define INT_TX_COMPLETE                 0x00000001
-#define INT_RX_COMPLETE                 0x00000002
-#define INT_RETRY_FAIL                  0x00000004
-#define INT_WAKEUP                      0x00000008
-#define INT_DTIM_NOTIFY                 0x00000020
-#define INT_CFG_NEXT_BCN                0x00000040
-#define INT_BUS_ABORT                   0x00000080
-#define INT_TX_FIFO_READY               0x00000100
-#define INT_UART                        0x00000200
-#define INT_TX_COMPLETE_EN              0x00010000
-#define INT_RX_COMPLETE_EN              0x00020000
-#define INT_RETRY_FAIL_EN               0x00040000
-#define INT_WAKEUP_EN                   0x00080000
-#define INT_DTIM_NOTIFY_EN              0x00200000
-#define INT_CFG_NEXT_BCN_EN             0x00400000
-#define INT_BUS_ABORT_EN                0x00800000
-#define INT_TX_FIFO_READY_EN            0x01000000
-#define INT_UART_EN                     0x02000000
+#define INT_TX_COMPLETE                 (1 <<  0)
+#define INT_RX_COMPLETE                 (1 <<  1)
+#define INT_RETRY_FAIL                  (1 <<  2)
+#define INT_WAKEUP                      (1 <<  3)
+#define INT_DTIM_NOTIFY                 (1 <<  5)
+#define INT_CFG_NEXT_BCN                (1 <<  6)
+#define INT_BUS_ABORT                   (1 <<  7)
+#define INT_TX_FIFO_READY               (1 <<  8)
+#define INT_UART                        (1 <<  9)
+#define INT_TX_COMPLETE_EN              (1 << 16)
+#define INT_RX_COMPLETE_EN              (1 << 17)
+#define INT_RETRY_FAIL_EN               (1 << 18)
+#define INT_WAKEUP_EN                   (1 << 19)
+#define INT_DTIM_NOTIFY_EN              (1 << 21)
+#define INT_CFG_NEXT_BCN_EN             (1 << 22)
+#define INT_BUS_ABORT_EN                (1 << 23)
+#define INT_TX_FIFO_READY_EN            (1 << 24)
+#define INT_UART_EN                     (1 << 25)
 
 #define CR_TSF_LOW_PART                 CTL_REG(0x0514)
 #define CR_TSF_HIGH_PART                CTL_REG(0x0518)
@@ -398,18 +398,18 @@
  * device will use a rate in this table that is less than or equal to the rate
  * of the incoming frame which prompted the response */
 #define CR_BASIC_RATE_TBL               CTL_REG(0x0630)
-#define CR_RATE_1M      0x0001  /* 802.11b */
-#define CR_RATE_2M      0x0002  /* 802.11b */
-#define CR_RATE_5_5M    0x0004  /* 802.11b */
-#define CR_RATE_11M     0x0008  /* 802.11b */
-#define CR_RATE_6M      0x0100  /* 802.11g */
-#define CR_RATE_9M      0x0200  /* 802.11g */
-#define CR_RATE_12M     0x0400  /* 802.11g */
-#define CR_RATE_18M     0x0800  /* 802.11g */
-#define CR_RATE_24M     0x1000  /* 802.11g */
-#define CR_RATE_36M     0x2000  /* 802.11g */
-#define CR_RATE_48M     0x4000  /* 802.11g */
-#define CR_RATE_54M     0x8000  /* 802.11g */
+#define CR_RATE_1M      (1 <<  0)       /* 802.11b */
+#define CR_RATE_2M      (1 <<  1)       /* 802.11b */
+#define CR_RATE_5_5M    (1 <<  2)       /* 802.11b */
+#define CR_RATE_11M     (1 <<  3)       /* 802.11b */
+#define CR_RATE_6M      (1 <<  8)       /* 802.11g */
+#define CR_RATE_9M      (1 <<  9)       /* 802.11g */
+#define CR_RATE_12M     (1 << 10)       /* 802.11g */
+#define CR_RATE_18M     (1 << 11)       /* 802.11g */
+#define CR_RATE_24M     (1 << 12)       /* 802.11g */
+#define CR_RATE_36M     (1 << 13)       /* 802.11g */
+#define CR_RATE_48M     (1 << 14)       /* 802.11g */
+#define CR_RATE_54M     (1 << 15)       /* 802.11g */
 #define CR_RATES_80211G 0xff00
 #define CR_RATES_80211B 0x000f
 
@@ -420,15 +420,24 @@
 #define CR_MANDATORY_RATE_TBL           CTL_REG(0x0634)
 #define CR_RTS_CTS_RATE                 CTL_REG(0x0638)
 
+/* These are all bit indexes in CR_RTS_CTS_RATE, so remember to shift. */
+#define RTSCTS_SH_RTS_RATE              0
+#define RTSCTS_SH_EXP_CTS_RATE          4
+#define RTSCTS_SH_RTS_MOD_TYPE          8
+#define RTSCTS_SH_RTS_PMB_TYPE          9
+#define RTSCTS_SH_CTS_RATE              16
+#define RTSCTS_SH_CTS_MOD_TYPE          24
+#define RTSCTS_SH_CTS_PMB_TYPE          25
+
 #define CR_WEP_PROTECT                  CTL_REG(0x063C)
 #define CR_RX_THRESHOLD                 CTL_REG(0x0640)
 
 /* register for controlling the LEDS */
 #define CR_LED                          CTL_REG(0x0644)
 /* masks for controlling LEDs */
-#define LED1                            0x0100
-#define LED2                            0x0200
-#define LED_SW                          0x0400
+#define LED1                            (1 <<  8)
+#define LED2                            (1 <<  9)
+#define LED_SW                          (1 << 10)
 
 /* Seems to indicate that the configuration is over.
  */
@@ -455,18 +464,18 @@
  * registers, so one could argue it is a LOCK bit. But calling it
  * LOCK_PHY_REGS makes it confusing.
  */
-#define UNLOCK_PHY_REGS                 0x0080
+#define UNLOCK_PHY_REGS                 (1 << 7)
 
 #define CR_DEVICE_STATE                 CTL_REG(0x0684)
 #define CR_UNDERRUN_CNT                 CTL_REG(0x0688)
 
 #define CR_RX_FILTER                    CTL_REG(0x068c)
-#define RX_FILTER_ASSOC_RESPONSE        0x0002
-#define RX_FILTER_REASSOC_RESPONSE      0x0008
-#define RX_FILTER_PROBE_RESPONSE        0x0020
-#define RX_FILTER_BEACON                0x0100
-#define RX_FILTER_DISASSOC              0x0400
-#define RX_FILTER_AUTH                  0x0800
+#define RX_FILTER_ASSOC_RESPONSE        (1 <<  1)
+#define RX_FILTER_REASSOC_RESPONSE      (1 <<  3)
+#define RX_FILTER_PROBE_RESPONSE        (1 <<  5)
+#define RX_FILTER_BEACON                (1 <<  8)
+#define RX_FILTER_DISASSOC              (1 << 10)
+#define RX_FILTER_AUTH                  (1 << 11)
 #define AP_RX_FILTER                    0x0400feff
 #define STA_RX_FILTER                   0x0000ffff
 
@@ -794,6 +803,9 @@ void zd_chip_disable_rx(struct zd_chip *chip);
 int zd_chip_enable_hwint(struct zd_chip *chip);
 int zd_chip_disable_hwint(struct zd_chip *chip);
 
+int zd_chip_set_rts_cts_rate_locked(struct zd_chip *chip,
+        u8 rts_rate, int preamble);
+
 static inline int zd_get_encryption_type(struct zd_chip *chip, u32 *type)
 {
         return zd_ioread32(chip, CR_ENCRYPTION_TYPE, type);
@@ -809,7 +821,17 @@ static inline int zd_chip_get_basic_rates(struct zd_chip *chip, u16 *cr_rates)
         return zd_ioread16(chip, CR_BASIC_RATE_TBL, cr_rates);
 }
 
-int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates);
+int zd_chip_set_basic_rates_locked(struct zd_chip *chip, u16 cr_rates);
+
+static inline int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
+{
+        int r;
+
+        mutex_lock(&chip->mutex);
+        r = zd_chip_set_basic_rates_locked(chip, cr_rates);
+        mutex_unlock(&chip->mutex);
+        return r;
+}
 
 static inline int zd_chip_set_rx_filter(struct zd_chip *chip, u32 filter)
 {
diff --git a/drivers/net/wireless/zd1211rw/zd_def.h b/drivers/net/wireless/zd1211rw/zd_def.h
index a13ec72eb304..fb22f62cf1f3 100644
--- a/drivers/net/wireless/zd1211rw/zd_def.h
+++ b/drivers/net/wireless/zd1211rw/zd_def.h
@@ -39,6 +39,7 @@ do { \
         if (!(x)) { \
                 pr_debug("%s:%d ASSERT %s VIOLATED!\n", \
                         __FILE__, __LINE__, __stringify(x)); \
+                dump_stack(); \
         } \
 } while (0)
 #else
diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.c b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
index 66905f7b61ff..189160efd2ae 100644
--- a/drivers/net/wireless/zd1211rw/zd_ieee80211.c
+++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
@@ -37,7 +37,12 @@ static const struct channel_range channel_ranges[] = {
         [ZD_REGDOMAIN_JAPAN]     = { 1, 14},
         [ZD_REGDOMAIN_SPAIN]     = { 1, 14},
         [ZD_REGDOMAIN_FRANCE]    = { 1, 14},
-        [ZD_REGDOMAIN_JAPAN_ADD] = {14, 15},
+
+        /* Japan originally only had channel 14 available (see CHNL_ID 0x40 in
+         * 802.11). However, in 2001 the range was extended to include channels
+         * 1-13. The ZyDAS devices still use the old region code but are
+         * designed to allow the extra channel access in Japan. */
+        [ZD_REGDOMAIN_JAPAN_ADD] = { 1, 15},
 };
 
 const struct channel_range *zd_channel_range(u8 regdomain)
@@ -133,9 +138,6 @@ int zd_find_channel(u8 *channel, const struct iw_freq *freq)
         int i, r;
         u32 mhz;
 
-        if (!(freq->flags & IW_FREQ_FIXED))
-                return 0;
-
         if (freq->m < 1000) {
                 if (freq->m  > NUM_CHANNELS || freq->m == 0)
                         return -EINVAL;
diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.h b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
index f63245b0d966..26b8298dff8c 100644
--- a/drivers/net/wireless/zd1211rw/zd_ieee80211.h
+++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.h
@@ -50,6 +50,7 @@ static inline u8 zd_ofdm_plcp_header_rate(
         return header->prefix[0] & 0xf;
 }
 
+/* These are referred to as zd_rates */
 #define ZD_OFDM_RATE_6M         0xb
 #define ZD_OFDM_RATE_9M         0xf
 #define ZD_OFDM_RATE_12M        0xa
@@ -64,7 +65,7 @@ struct cck_plcp_header {
         u8 service;
         __le16 length;
         __le16 crc16;
-};
+} __attribute__((packed));
 
 static inline u8 zd_cck_plcp_header_rate(const struct cck_plcp_header *header)
 {
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 5e4f4b707375..44f3cfd4cc1d 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -32,6 +32,8 @@
 
 static void ieee_init(struct ieee80211_device *ieee);
 static void softmac_init(struct ieee80211softmac_device *sm);
+static void set_rts_cts_work(void *d);
+static void set_basic_rates_work(void *d);
 
 static void housekeeping_init(struct zd_mac *mac);
 static void housekeeping_enable(struct zd_mac *mac);
@@ -46,6 +48,8 @@ int zd_mac_init(struct zd_mac *mac,
         memset(mac, 0, sizeof(*mac));
         spin_lock_init(&mac->lock);
         mac->netdev = netdev;
+        INIT_WORK(&mac->set_rts_cts_work, set_rts_cts_work, mac);
+        INIT_WORK(&mac->set_basic_rates_work, set_basic_rates_work, mac);
 
         ieee_init(ieee);
         softmac_init(ieee80211_priv(netdev));
@@ -213,6 +217,13 @@ int zd_mac_stop(struct net_device *netdev)
         housekeeping_disable(mac);
         ieee80211softmac_stop(netdev);
 
+        /* Ensure no work items are running or queued from this point */
+        cancel_delayed_work(&mac->set_rts_cts_work);
+        cancel_delayed_work(&mac->set_basic_rates_work);
+        flush_workqueue(zd_workqueue);
+        mac->updating_rts_rate = 0;
+        mac->updating_basic_rates = 0;
+
         zd_chip_disable_hwint(chip);
         zd_chip_switch_radio_off(chip);
         zd_chip_disable_int(chip);
@@ -286,6 +297,186 @@ u8 zd_mac_get_regdomain(struct zd_mac *mac)
         return regdomain;
 }
 
+/* Fallback to lowest rate, if rate is unknown. */
+static u8 rate_to_zd_rate(u8 rate)
+{
+        switch (rate) {
+        case IEEE80211_CCK_RATE_2MB:
+                return ZD_CCK_RATE_2M;
+        case IEEE80211_CCK_RATE_5MB:
+                return ZD_CCK_RATE_5_5M;
+        case IEEE80211_CCK_RATE_11MB:
+                return ZD_CCK_RATE_11M;
+        case IEEE80211_OFDM_RATE_6MB:
+                return ZD_OFDM_RATE_6M;
+        case IEEE80211_OFDM_RATE_9MB:
+                return ZD_OFDM_RATE_9M;
+        case IEEE80211_OFDM_RATE_12MB:
+                return ZD_OFDM_RATE_12M;
+        case IEEE80211_OFDM_RATE_18MB:
+                return ZD_OFDM_RATE_18M;
+        case IEEE80211_OFDM_RATE_24MB:
+                return ZD_OFDM_RATE_24M;
+        case IEEE80211_OFDM_RATE_36MB:
+                return ZD_OFDM_RATE_36M;
+        case IEEE80211_OFDM_RATE_48MB:
+                return ZD_OFDM_RATE_48M;
+        case IEEE80211_OFDM_RATE_54MB:
+                return ZD_OFDM_RATE_54M;
+        }
+        return ZD_CCK_RATE_1M;
+}
+
+static u16 rate_to_cr_rate(u8 rate)
+{
+        switch (rate) {
+        case IEEE80211_CCK_RATE_2MB:
+                return CR_RATE_1M;
+        case IEEE80211_CCK_RATE_5MB:
+                return CR_RATE_5_5M;
+        case IEEE80211_CCK_RATE_11MB:
+                return CR_RATE_11M;
+        case IEEE80211_OFDM_RATE_6MB:
+                return CR_RATE_6M;
+        case IEEE80211_OFDM_RATE_9MB:
+                return CR_RATE_9M;
+        case IEEE80211_OFDM_RATE_12MB:
+                return CR_RATE_12M;
+        case IEEE80211_OFDM_RATE_18MB:
+                return CR_RATE_18M;
+        case IEEE80211_OFDM_RATE_24MB:
+                return CR_RATE_24M;
+        case IEEE80211_OFDM_RATE_36MB:
+                return CR_RATE_36M;
+        case IEEE80211_OFDM_RATE_48MB:
+                return CR_RATE_48M;
+        case IEEE80211_OFDM_RATE_54MB:
+                return CR_RATE_54M;
+        }
+        return CR_RATE_1M;
+}
+
+static void try_enable_tx(struct zd_mac *mac)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        if (mac->updating_rts_rate == 0 && mac->updating_basic_rates == 0)
+                netif_wake_queue(mac->netdev);
+        spin_unlock_irqrestore(&mac->lock, flags);
+}
+
+static void set_rts_cts_work(void *d)
+{
+        struct zd_mac *mac = d;
+        unsigned long flags;
+        u8 rts_rate;
+        unsigned int short_preamble;
+
+        mutex_lock(&mac->chip.mutex);
+
+        spin_lock_irqsave(&mac->lock, flags);
+        mac->updating_rts_rate = 0;
+        rts_rate = mac->rts_rate;
+        short_preamble = mac->short_preamble;
+        spin_unlock_irqrestore(&mac->lock, flags);
+
+        zd_chip_set_rts_cts_rate_locked(&mac->chip, rts_rate, short_preamble);
+        mutex_unlock(&mac->chip.mutex);
+
+        try_enable_tx(mac);
+}
+
+static void set_basic_rates_work(void *d)
+{
+        struct zd_mac *mac = d;
+        unsigned long flags;
+        u16 basic_rates;
+
+        mutex_lock(&mac->chip.mutex);
+
+        spin_lock_irqsave(&mac->lock, flags);
+        mac->updating_basic_rates = 0;
+        basic_rates = mac->basic_rates;
+        spin_unlock_irqrestore(&mac->lock, flags);
+
+        zd_chip_set_basic_rates_locked(&mac->chip, basic_rates);
+        mutex_unlock(&mac->chip.mutex);
+
+        try_enable_tx(mac);
+}
+
+static void bssinfo_change(struct net_device *netdev, u32 changes)
+{
+        struct zd_mac *mac = zd_netdev_mac(netdev);
+        struct ieee80211softmac_device *softmac = ieee80211_priv(netdev);
+        struct ieee80211softmac_bss_info *bssinfo = &softmac->bssinfo;
+        int need_set_rts_cts = 0;
+        int need_set_rates = 0;
+        u16 basic_rates;
+        unsigned long flags;
+
+        dev_dbg_f(zd_mac_dev(mac), "changes: %x\n", changes);
+
+        if (changes & IEEE80211SOFTMAC_BSSINFOCHG_SHORT_PREAMBLE) {
+                spin_lock_irqsave(&mac->lock, flags);
+                mac->short_preamble = bssinfo->short_preamble;
+                spin_unlock_irqrestore(&mac->lock, flags);
+                need_set_rts_cts = 1;
+        }
+
+        if (changes & IEEE80211SOFTMAC_BSSINFOCHG_RATES) {
+                /* Set RTS rate to highest available basic rate */
+                u8 rate = ieee80211softmac_highest_supported_rate(softmac,
+                        &bssinfo->supported_rates, 1);
+                rate = rate_to_zd_rate(rate);
+
+                spin_lock_irqsave(&mac->lock, flags);
+                if (rate != mac->rts_rate) {
+                        mac->rts_rate = rate;
+                        need_set_rts_cts = 1;
+                }
+                spin_unlock_irqrestore(&mac->lock, flags);
+
+                /* Set basic rates */
+                need_set_rates = 1;
+                if (bssinfo->supported_rates.count == 0) {
+                        /* Allow the device to be flexible */
+                        basic_rates = CR_RATES_80211B | CR_RATES_80211G;
+                } else {
+                        int i = 0;
+                        basic_rates = 0;
+
+                        for (i = 0; i < bssinfo->supported_rates.count; i++) {
+                                u16 rate = bssinfo->supported_rates.rates[i];
+                                if ((rate & IEEE80211_BASIC_RATE_MASK) == 0)
+                                        continue;
+
+                                rate &= ~IEEE80211_BASIC_RATE_MASK;
+                                basic_rates |= rate_to_cr_rate(rate);
+                        }
+                }
+                spin_lock_irqsave(&mac->lock, flags);
+                mac->basic_rates = basic_rates;
+                spin_unlock_irqrestore(&mac->lock, flags);
+        }
+
+        /* Schedule any changes we made above */
+
+        spin_lock_irqsave(&mac->lock, flags);
+        if (need_set_rts_cts && !mac->updating_rts_rate) {
+                mac->updating_rts_rate = 1;
+                netif_stop_queue(mac->netdev);
+                queue_work(zd_workqueue, &mac->set_rts_cts_work);
+        }
+        if (need_set_rates && !mac->updating_basic_rates) {
+                mac->updating_basic_rates = 1;
+                netif_stop_queue(mac->netdev);
+                queue_work(zd_workqueue, &mac->set_basic_rates_work);
+        }
+        spin_unlock_irqrestore(&mac->lock, flags);
+}
+
 static void set_channel(struct net_device *netdev, u8 channel)
 {
         struct zd_mac *mac = zd_netdev_mac(netdev);
@@ -295,7 +486,6 @@ static void set_channel(struct net_device *netdev, u8 channel)
         zd_chip_set_channel(&mac->chip, channel);
 }
 
-/* TODO: Should not work in Managed mode. */
 int zd_mac_request_channel(struct zd_mac *mac, u8 channel)
 {
         unsigned long lock_flags;
@@ -317,31 +507,22 @@ int zd_mac_request_channel(struct zd_mac *mac, u8 channel)
                 return 0;
 }
 
-int zd_mac_get_channel(struct zd_mac *mac, u8 *channel, u8 *flags)
+u8 zd_mac_get_channel(struct zd_mac *mac)
 {
-        struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
+        u8 channel = zd_chip_get_channel(&mac->chip);
 
-        *channel = zd_chip_get_channel(&mac->chip);
-        if (ieee->iw_mode != IW_MODE_INFRA) {
-                spin_lock_irq(&mac->lock);
-                *flags = *channel == mac->requested_channel ?
-                        MAC_FIXED_CHANNEL : 0;
-                spin_unlock(&mac->lock);
-        } else {
-                *flags = 0;
-        }
-        dev_dbg_f(zd_mac_dev(mac), "channel %u flags %u\n", *channel, *flags);
-        return 0;
+        dev_dbg_f(zd_mac_dev(mac), "channel %u\n", channel);
+        return channel;
 }
 
 /* If wrong rate is given, we are falling back to the slowest rate: 1MBit/s */
-static u8 cs_typed_rate(u8 cs_rate)
+static u8 zd_rate_typed(u8 zd_rate)
 {
         static const u8 typed_rates[16] = {
-                [ZD_CS_CCK_RATE_1M]     = ZD_CS_CCK|ZD_CS_CCK_RATE_1M,
-                [ZD_CS_CCK_RATE_2M]     = ZD_CS_CCK|ZD_CS_CCK_RATE_2M,
-                [ZD_CS_CCK_RATE_5_5M]   = ZD_CS_CCK|ZD_CS_CCK_RATE_5_5M,
-                [ZD_CS_CCK_RATE_11M]    = ZD_CS_CCK|ZD_CS_CCK_RATE_11M,
+                [ZD_CCK_RATE_1M]        = ZD_CS_CCK|ZD_CCK_RATE_1M,
+                [ZD_CCK_RATE_2M]        = ZD_CS_CCK|ZD_CCK_RATE_2M,
+                [ZD_CCK_RATE_5_5M]      = ZD_CS_CCK|ZD_CCK_RATE_5_5M,
+                [ZD_CCK_RATE_11M]       = ZD_CS_CCK|ZD_CCK_RATE_11M,
                 [ZD_OFDM_RATE_6M]       = ZD_CS_OFDM|ZD_OFDM_RATE_6M,
                 [ZD_OFDM_RATE_9M]       = ZD_CS_OFDM|ZD_OFDM_RATE_9M,
                 [ZD_OFDM_RATE_12M]      = ZD_CS_OFDM|ZD_OFDM_RATE_12M,
@@ -353,37 +534,7 @@ static u8 cs_typed_rate(u8 cs_rate)
         };
 
         ZD_ASSERT(ZD_CS_RATE_MASK == 0x0f);
-        return typed_rates[cs_rate & ZD_CS_RATE_MASK];
-}
-
-/* Fallback to lowest rate, if rate is unknown. */
-static u8 rate_to_cs_rate(u8 rate)
-{
-        switch (rate) {
-        case IEEE80211_CCK_RATE_2MB:
-                return ZD_CS_CCK_RATE_2M;
-        case IEEE80211_CCK_RATE_5MB:
-                return ZD_CS_CCK_RATE_5_5M;
-        case IEEE80211_CCK_RATE_11MB:
-                return ZD_CS_CCK_RATE_11M;
-        case IEEE80211_OFDM_RATE_6MB:
-                return ZD_OFDM_RATE_6M;
-        case IEEE80211_OFDM_RATE_9MB:
-                return ZD_OFDM_RATE_9M;
-        case IEEE80211_OFDM_RATE_12MB:
-                return ZD_OFDM_RATE_12M;
-        case IEEE80211_OFDM_RATE_18MB:
-                return ZD_OFDM_RATE_18M;
-        case IEEE80211_OFDM_RATE_24MB:
-                return ZD_OFDM_RATE_24M;
-        case IEEE80211_OFDM_RATE_36MB:
-                return ZD_OFDM_RATE_36M;
-        case IEEE80211_OFDM_RATE_48MB:
-                return ZD_OFDM_RATE_48M;
-        case IEEE80211_OFDM_RATE_54MB:
-                return ZD_OFDM_RATE_54M;
-        }
-        return ZD_CS_CCK_RATE_1M;
+        return typed_rates[zd_rate & ZD_CS_RATE_MASK];
 }
 
 int zd_mac_set_mode(struct zd_mac *mac, u32 mode)
@@ -484,13 +635,13 @@ int zd_mac_get_range(struct zd_mac *mac, struct iw_range *range)
         return 0;
 }
 
-static int zd_calc_tx_length_us(u8 *service, u8 cs_rate, u16 tx_length)
+static int zd_calc_tx_length_us(u8 *service, u8 zd_rate, u16 tx_length)
 {
         static const u8 rate_divisor[] = {
-                [ZD_CS_CCK_RATE_1M]     =  1,
-                [ZD_CS_CCK_RATE_2M]     =  2,
-                [ZD_CS_CCK_RATE_5_5M]   = 11, /* bits must be doubled */
-                [ZD_CS_CCK_RATE_11M]    = 11,
+                [ZD_CCK_RATE_1M]        =  1,
+                [ZD_CCK_RATE_2M]        =  2,
+                [ZD_CCK_RATE_5_5M]      = 11, /* bits must be doubled */
+                [ZD_CCK_RATE_11M]       = 11,
                 [ZD_OFDM_RATE_6M]       =  6,
                 [ZD_OFDM_RATE_9M]       =  9,
                 [ZD_OFDM_RATE_12M]      = 12,
@@ -504,15 +655,15 @@ static int zd_calc_tx_length_us(u8 *service, u8 cs_rate, u16 tx_length)
         u32 bits = (u32)tx_length * 8;
         u32 divisor;
 
-        divisor = rate_divisor[cs_rate];
+        divisor = rate_divisor[zd_rate];
         if (divisor == 0)
                 return -EINVAL;
 
-        switch (cs_rate) {
-        case ZD_CS_CCK_RATE_5_5M:
+        switch (zd_rate) {
+        case ZD_CCK_RATE_5_5M:
                 bits = (2*bits) + 10; /* round up to the next integer */
                 break;
-        case ZD_CS_CCK_RATE_11M:
+        case ZD_CCK_RATE_11M:
                 if (service) {
                         u32 t = bits % 11;
                         *service &= ~ZD_PLCP_SERVICE_LENGTH_EXTENSION;
@@ -532,16 +683,16 @@ enum {
         R2M_11A            = 0x02,
 };
 
-static u8 cs_rate_to_modulation(u8 cs_rate, int flags)
+static u8 zd_rate_to_modulation(u8 zd_rate, int flags)
 {
         u8 modulation;
 
-        modulation = cs_typed_rate(cs_rate);
+        modulation = zd_rate_typed(zd_rate);
         if (flags & R2M_SHORT_PREAMBLE) {
                 switch (ZD_CS_RATE(modulation)) {
-                case ZD_CS_CCK_RATE_2M:
-                case ZD_CS_CCK_RATE_5_5M:
-                case ZD_CS_CCK_RATE_11M:
+                case ZD_CCK_RATE_2M:
+                case ZD_CCK_RATE_5_5M:
+                case ZD_CCK_RATE_11M:
                         modulation |= ZD_CS_CCK_PREA_SHORT;
                         return modulation;
                 }
@@ -558,39 +709,36 @@ static void cs_set_modulation(struct zd_mac *mac, struct zd_ctrlset *cs,
 {
         struct ieee80211softmac_device *softmac = ieee80211_priv(mac->netdev);
         u16 ftype = WLAN_FC_GET_TYPE(le16_to_cpu(hdr->frame_ctl));
-        u8 rate, cs_rate;
+        u8 rate, zd_rate;
         int is_mgt = (ftype == IEEE80211_FTYPE_MGMT) != 0;
+        int is_multicast = is_multicast_ether_addr(hdr->addr1);
+        int short_preamble = ieee80211softmac_short_preamble_ok(softmac,
+                is_multicast, is_mgt);
+        int flags = 0;
+
+        /* FIXME: 802.11a? */
+        rate = ieee80211softmac_suggest_txrate(softmac, is_multicast, is_mgt);
 
-        /* FIXME: 802.11a? short preamble? */
-        rate = ieee80211softmac_suggest_txrate(softmac,
-                is_multicast_ether_addr(hdr->addr1), is_mgt);
+        if (short_preamble)
+                flags |= R2M_SHORT_PREAMBLE;
 
-        cs_rate = rate_to_cs_rate(rate);
-        cs->modulation = cs_rate_to_modulation(cs_rate, 0);
+        zd_rate = rate_to_zd_rate(rate);
+        cs->modulation = zd_rate_to_modulation(zd_rate, flags);
 }
 
 static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
                            struct ieee80211_hdr_4addr *header)
 {
+        struct ieee80211softmac_device *softmac = ieee80211_priv(mac->netdev);
         unsigned int tx_length = le16_to_cpu(cs->tx_length);
         u16 fctl = le16_to_cpu(header->frame_ctl);
         u16 ftype = WLAN_FC_GET_TYPE(fctl);
         u16 stype = WLAN_FC_GET_STYPE(fctl);
 
         /*
-         * CONTROL:
-         * - start at 0x00
-         * - if fragment 0, enable bit 0
+         * CONTROL TODO:
          * - if backoff needed, enable bit 0
          * - if burst (backoff not needed) disable bit 0
-         * - if multicast, enable bit 1
-         * - if PS-POLL frame, enable bit 2
-         * - if in INDEPENDENT_BSS mode and zd1205_DestPowerSave, then enable
-         *   bit 4 (FIXME: wtf)
-         * - if frag_len > RTS threshold, set bit 5 as long if it isnt
-         *   multicast or mgt
-         * - if bit 5 is set, and we are in OFDM mode, unset bit 5 and set bit
-         *   7
          */
 
         cs->control = 0;
@@ -607,17 +755,18 @@ static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
         if (stype == IEEE80211_STYPE_PSPOLL)
                 cs->control |= ZD_CS_PS_POLL_FRAME;
 
+        /* Unicast data frames over the threshold should have RTS */
         if (!is_multicast_ether_addr(header->addr1) &&
-            ftype != IEEE80211_FTYPE_MGMT &&
-            tx_length > zd_netdev_ieee80211(mac->netdev)->rts)
-        {
-                /* FIXME: check the logic */
-                if (ZD_CS_TYPE(cs->modulation) == ZD_CS_OFDM) {
-                        /* 802.11g */
-                        cs->control |= ZD_CS_SELF_CTS;
-                } else { /* 802.11b */
-                        cs->control |= ZD_CS_RTS;
-                }
+                ftype != IEEE80211_FTYPE_MGMT &&
+                    tx_length > zd_netdev_ieee80211(mac->netdev)->rts)
+                cs->control |= ZD_CS_RTS;
+
+        /* Use CTS-to-self protection if required */
+        if (ZD_CS_TYPE(cs->modulation) == ZD_CS_OFDM &&
+                        ieee80211softmac_protection_needed(softmac)) {
+                /* FIXME: avoid sending RTS *and* self-CTS, is that correct? */
+                cs->control &= ~ZD_CS_RTS;
+                cs->control |= ZD_CS_SELF_CTS;
         }
 
         /* FIXME: Management frame? */
@@ -721,7 +870,7 @@ struct zd_rt_hdr {
         u8  rt_rate;
         u16 rt_channel;
         u16 rt_chbitmask;
-};
+} __attribute__((packed));
 
 static void fill_rt_header(void *buffer, struct zd_mac *mac,
                            const struct ieee80211_rx_stats *stats,
@@ -782,9 +931,11 @@ static int is_data_packet_for_us(struct ieee80211_device *ieee,
                (netdev->flags & IFF_PROMISC);
 }
 
-/* Filters receiving packets. If it returns 1 send it to ieee80211_rx, if 0
- * return. If an error is detected -EINVAL is returned. ieee80211_rx_mgt() is
- * called here.
+/* Filters received packets. The function returns 1 if the packet should be
+ * forwarded to ieee80211_rx(). If the packet should be ignored the function
+ * returns 0. If an invalid packet is found the function returns -EINVAL.
+ *
+ * The function calls ieee80211_rx_mgt() directly.
  *
  * It has been based on ieee80211_rx_any.
  */
@@ -810,9 +961,9 @@ static int filter_rx(struct ieee80211_device *ieee,
                 ieee80211_rx_mgt(ieee, hdr, stats);
                 return 0;
         case IEEE80211_FTYPE_CTL:
-                /* Ignore invalid short buffers */
                 return 0;
         case IEEE80211_FTYPE_DATA:
+                /* Ignore invalid short buffers */
                 if (length < sizeof(struct ieee80211_hdr_3addr))
                         return -EINVAL;
                 return is_data_packet_for_us(ieee, hdr);
@@ -993,6 +1144,7 @@ static void ieee_init(struct ieee80211_device *ieee)
 static void softmac_init(struct ieee80211softmac_device *sm)
 {
         sm->set_channel = set_channel;
+        sm->bssinfo_change = bssinfo_change;
 }
 
 struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev)
@@ -1028,66 +1180,6 @@ struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev)
         return iw_stats;
 }
 
-#ifdef DEBUG
-static const char* decryption_types[] = {
-        [ZD_RX_NO_WEP] = "none",
-        [ZD_RX_WEP64] = "WEP64",
-        [ZD_RX_TKIP] = "TKIP",
-        [ZD_RX_AES] = "AES",
-        [ZD_RX_WEP128] = "WEP128",
-        [ZD_RX_WEP256] = "WEP256",
-};
-
-static const char *decryption_type_string(u8 type)
-{
-        const char *s;
-
-        if (type < ARRAY_SIZE(decryption_types)) {
-                s = decryption_types[type];
-        } else {
-                s = NULL;
-        }
-        return s ? s : "unknown";
-}
-
-static int is_ofdm(u8 frame_status)
-{
-        return (frame_status & ZD_RX_OFDM);
-}
-
-void zd_dump_rx_status(const struct rx_status *status)
-{
-        const char* modulation;
-        u8 quality;
-
-        if (is_ofdm(status->frame_status)) {
-                modulation = "ofdm";
-                quality = status->signal_quality_ofdm;
-        } else {
-                modulation = "cck";
-                quality = status->signal_quality_cck;
-        }
-        pr_debug("rx status %s strength %#04x qual %#04x decryption %s\n",
-                modulation, status->signal_strength, quality,
-                decryption_type_string(status->decryption_type));
-        if (status->frame_status & ZD_RX_ERROR) {
-                pr_debug("rx error %s%s%s%s%s%s\n",
-                        (status->frame_status & ZD_RX_TIMEOUT_ERROR) ?
-                                "timeout " : "",
-                        (status->frame_status & ZD_RX_FIFO_OVERRUN_ERROR) ?
-                                "fifo " : "",
-                        (status->frame_status & ZD_RX_DECRYPTION_ERROR) ?
-                                "decryption " : "",
-                        (status->frame_status & ZD_RX_CRC32_ERROR) ?
-                                "crc32 " : "",
-                        (status->frame_status & ZD_RX_NO_ADDR1_MATCH_ERROR) ?
-                                "addr1 " : "",
-                        (status->frame_status & ZD_RX_CRC16_ERROR) ?
-                                "crc16" : "");
-        }
-}
-#endif /* DEBUG */
-
 #define LINK_LED_WORK_DELAY HZ
 
 static void link_led_handler(struct work_struct *work)
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 7957cac3de25..08d6b8c08e75 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -20,6 +20,7 @@
 
 #include <linux/wireless.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <net/ieee80211.h>
 #include <net/ieee80211softmac.h>
 
@@ -48,10 +49,11 @@ struct zd_ctrlset {
 #define ZD_CS_CCK               0x00
 #define ZD_CS_OFDM              0x10
 
-#define ZD_CS_CCK_RATE_1M       0x00
-#define ZD_CS_CCK_RATE_2M       0x01
-#define ZD_CS_CCK_RATE_5_5M     0x02
-#define ZD_CS_CCK_RATE_11M      0x03
+/* These are referred to as zd_rates */
+#define ZD_CCK_RATE_1M  0x00
+#define ZD_CCK_RATE_2M  0x01
+#define ZD_CCK_RATE_5_5M        0x02
+#define ZD_CCK_RATE_11M 0x03
 /* The rates for OFDM are encoded as in the PLCP header. Use ZD_OFDM_RATE_*.
  */
 
@@ -82,7 +84,7 @@ struct zd_ctrlset {
 struct rx_length_info {
         __le16 length[3];
         __le16 tag;
-};
+} __attribute__((packed));
 
 #define RX_LENGTH_INFO_TAG              0x697e
 
@@ -93,7 +95,7 @@ struct rx_status {
         u8 signal_quality_ofdm;
         u8 decryption_type;
         u8 frame_status;
-};
+} __attribute__((packed));
 
 /* rx_status field decryption_type */
 #define ZD_RX_NO_WEP    0
@@ -116,10 +118,6 @@ struct rx_status {
 #define ZD_RX_CRC16_ERROR               0x40
 #define ZD_RX_ERROR                     0x80
 
-enum mac_flags {
-        MAC_FIXED_CHANNEL = 0x01,
-};
-
 struct housekeeping {
         struct delayed_work link_led_work;
 };
@@ -130,15 +128,33 @@ struct zd_mac {
         struct zd_chip chip;
         spinlock_t lock;
         struct net_device *netdev;
+
         /* Unlocked reading possible */
         struct iw_statistics iw_stats;
+
         struct housekeeping housekeeping;
+        struct work_struct set_rts_cts_work;
+        struct work_struct set_basic_rates_work;
+
         unsigned int stats_count;
         u8 qual_buffer[ZD_MAC_STATS_BUFFER_SIZE];
         u8 rssi_buffer[ZD_MAC_STATS_BUFFER_SIZE];
         u8 regdomain;
         u8 default_regdomain;
         u8 requested_channel;
+
+        /* A bitpattern of cr_rates */
+        u16 basic_rates;
+
+        /* A zd_rate */
+        u8 rts_rate;
+
+        /* Short preamble (used for RTS/CTS) */
+        unsigned int short_preamble:1;
+
+        /* flags to indicate update in progress */
+        unsigned int updating_rts_rate:1;
+        unsigned int updating_basic_rates:1;
 };
 
 static inline struct ieee80211_device *zd_mac_to_ieee80211(struct zd_mac *mac)
@@ -180,7 +196,7 @@ int zd_mac_set_regdomain(struct zd_mac *zd_mac, u8 regdomain);
 u8 zd_mac_get_regdomain(struct zd_mac *zd_mac);
 
 int zd_mac_request_channel(struct zd_mac *mac, u8 channel);
-int zd_mac_get_channel(struct zd_mac *mac, u8 *channel, u8 *flags);
+u8 zd_mac_get_channel(struct zd_mac *mac);
 
 int zd_mac_set_mode(struct zd_mac *mac, u32 mode);
 int zd_mac_get_mode(struct zd_mac *mac, u32 *mode);
diff --git a/drivers/net/wireless/zd1211rw/zd_netdev.c b/drivers/net/wireless/zd1211rw/zd_netdev.c
index af3a7b36d078..60f1b0f6d45b 100644
--- a/drivers/net/wireless/zd1211rw/zd_netdev.c
+++ b/drivers/net/wireless/zd1211rw/zd_netdev.c
@@ -107,21 +107,10 @@ static int iw_get_freq(struct net_device *netdev,
                    struct iw_request_info *info,
                    union iwreq_data *req, char *extra)
 {
-        int r;
         struct zd_mac *mac = zd_netdev_mac(netdev);
         struct iw_freq *freq = &req->freq;
-        u8 channel;
-        u8 flags;
-
-        r = zd_mac_get_channel(mac, &channel, &flags);
-        if (r)
-                return r;
 
-        freq->flags = (flags & MAC_FIXED_CHANNEL) ?
-                      IW_FREQ_FIXED : IW_FREQ_AUTO;
-        dev_dbg_f(zd_mac_dev(mac), "channel %s\n",
-                  (flags & MAC_FIXED_CHANNEL) ? "fixed" : "auto");
-        return zd_channel_to_freq(freq, channel);
+        return zd_channel_to_freq(freq, zd_mac_get_channel(mac));
 }
 
 static int iw_set_mode(struct net_device *netdev,
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 3faaeb2b7c89..aa782e88754b 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -47,11 +47,17 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0586, 0x3402), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x0b3b, 0x5630), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x0b05, 0x170c), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x1435, 0x0711), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0586, 0x3409), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0b3b, 0x1630), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0586, 0x3401), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x14ea, 0xab13), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x050d, 0x705c), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         {}
@@ -366,15 +372,6 @@ error:
         return r;
 }
 
-static void disable_read_regs_int(struct zd_usb *usb)
-{
-        struct zd_usb_interrupt *intr = &usb->intr;
-
-        spin_lock(&intr->lock);
-        intr->read_regs_enabled = 0;
-        spin_unlock(&intr->lock);
-}
-
 #define urb_dev(urb) (&(urb)->dev->dev)
 
 static inline void handle_regs_int(struct urb *urb)
@@ -596,6 +593,8 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
                 unsigned int l, k, n;
                 for (i = 0, l = 0;; i++) {
                         k = le16_to_cpu(get_unaligned(&length_info->length[i]));
+                        if (k == 0)
+                                return;
                         n = l+k;
                         if (n > length)
                                 return;
@@ -1119,27 +1118,28 @@ static int __init usb_init(void)
 {
         int r;
 
-        pr_debug("usb_init()\n");
+        pr_debug("%s usb_init()\n", driver.name);
 
         zd_workqueue = create_singlethread_workqueue(driver.name);
         if (zd_workqueue == NULL) {
-                printk(KERN_ERR "%s: couldn't create workqueue\n", driver.name);
+                printk(KERN_ERR "%s couldn't create workqueue\n", driver.name);
                 return -ENOMEM;
         }
 
         r = usb_register(&driver);
         if (r) {
-                printk(KERN_ERR "usb_register() failed. Error number %d\n", r);
+                printk(KERN_ERR "%s usb_register() failed. Error number %d\n",
+                       driver.name, r);
                 return r;
         }
 
-        pr_debug("zd1211rw initialized\n");
+        pr_debug("%s initialized\n", driver.name);
         return 0;
 }
 
 static void __exit usb_exit(void)
 {
-        pr_debug("usb_exit()\n");
+        pr_debug("%s usb_exit()\n", driver.name);
         usb_deregister(&driver);
         destroy_workqueue(zd_workqueue);
 }
@@ -1156,10 +1156,19 @@ static void prepare_read_regs_int(struct zd_usb *usb)
 {
         struct zd_usb_interrupt *intr = &usb->intr;
 
-        spin_lock(&intr->lock);
+        spin_lock_irq(&intr->lock);
         intr->read_regs_enabled = 1;
         INIT_COMPLETION(intr->read_regs.completion);
-        spin_unlock(&intr->lock);
+        spin_unlock_irq(&intr->lock);
+}
+
+static void disable_read_regs_int(struct zd_usb *usb)
+{
+        struct zd_usb_interrupt *intr = &usb->intr;
+
+        spin_lock_irq(&intr->lock);
+        intr->read_regs_enabled = 0;
+        spin_unlock_irq(&intr->lock);
 }
 
 static int get_results(struct zd_usb *usb, u16 *values,
@@ -1171,7 +1180,7 @@ static int get_results(struct zd_usb *usb, u16 *values,
         struct read_regs_int *rr = &intr->read_regs;
         struct usb_int_regs *regs = (struct usb_int_regs *)rr->buffer;
 
-        spin_lock(&intr->lock);
+        spin_lock_irq(&intr->lock);
 
         r = -EIO;
         /* The created block size seems to be larger than expected.
@@ -1204,7 +1213,7 @@ static int get_results(struct zd_usb *usb, u16 *values,
 
         r = 0;
 error_unlock:
-        spin_unlock(&intr->lock);
+        spin_unlock_irq(&intr->lock);
         return r;
 }
 
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
index e81a2d3cfffd..317d37c36679 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.h
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -74,17 +74,17 @@ enum control_requests {
 struct usb_req_read_regs {
         __le16 id;
         __le16 addr[0];
-};
+} __attribute__((packed));
 
 struct reg_data {
         __le16 addr;
         __le16 value;
-};
+} __attribute__((packed));
 
 struct usb_req_write_regs {
         __le16 id;
         struct reg_data reg_writes[0];
-};
+} __attribute__((packed));
 
 enum {
         RF_IF_LE = 0x02,
@@ -101,7 +101,7 @@ struct usb_req_rfwrite {
         /* RF2595: 24 */
         __le16 bit_values[0];
         /* (CR203 & ~(RF_IF_LE | RF_CLK | RF_DATA)) | (bit ? RF_DATA : 0) */
-};
+} __attribute__((packed));
 
 /* USB interrupt */
 
@@ -118,12 +118,12 @@ enum usb_int_flags {
 struct usb_int_header {
         u8 type;        /* must always be 1 */
         u8 id;
-};
+} __attribute__((packed));
 
 struct usb_int_regs {
         struct usb_int_header hdr;
         struct reg_data regs[0];
-};
+} __attribute__((packed));
 
 struct usb_int_retry_fail {
         struct usb_int_header hdr;
@@ -131,7 +131,7 @@ struct usb_int_retry_fail {
         u8 _dummy;
         u8 addr[ETH_ALEN];
         u8 ibss_wakeup_dest;
-};
+} __attribute__((packed));
 
 struct read_regs_int {
         struct completion completion;