18 files changed, 154 insertions, 113 deletions

diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 8ef87356e083..a533ed60bb4d 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -1028,6 +1028,8 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
  * it's done by reseting the chip.  To accomplish this we must
  * first cleanup any pending DMA, then restart stuff after a la
  * ath5k_init.
+ *
+ * Called with sc->lock.
  */
 static int
 ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
@@ -2814,11 +2816,17 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath5k_softc *sc = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
+        int ret;
+
+        mutex_lock(&sc->lock);
 
         sc->bintval = conf->beacon_int;
         sc->power_level = conf->power_level;
 
-        return ath5k_chan_set(sc, conf->channel);
+        ret = ath5k_chan_set(sc, conf->channel);
+
+        mutex_unlock(&sc->lock);
+        return ret;
 }
 
 static int
diff --git a/drivers/net/wireless/ath9k/rc.c b/drivers/net/wireless/ath9k/rc.c
index 04ab457a8faa..1b71b934bb5e 100644
--- a/drivers/net/wireless/ath9k/rc.c
+++ b/drivers/net/wireless/ath9k/rc.c
@@ -490,7 +490,7 @@ static inline int ath_rc_get_nextvalid_txrate(struct ath_rate_table *rate_table,
 
 static int ath_rc_valid_phyrate(u32 phy, u32 capflag, int ignore_cw)
 {
-        if (WLAN_RC_PHY_HT(phy) & !(capflag & WLAN_RC_HT_FLAG))
+        if (WLAN_RC_PHY_HT(phy) && !(capflag & WLAN_RC_HT_FLAG))
                 return 0;
         if (WLAN_RC_PHY_DS(phy) && !(capflag & WLAN_RC_DS_FLAG))
                 return 0;
diff --git a/drivers/net/wireless/ath9k/regd_common.h b/drivers/net/wireless/ath9k/regd_common.h
index 9112c030b1e8..6df1b3b77c25 100644
--- a/drivers/net/wireless/ath9k/regd_common.h
+++ b/drivers/net/wireless/ath9k/regd_common.h
@@ -228,7 +228,7 @@ enum {
 };
 
 #define REG_DOMAIN_2GHZ_MASK    (REQ_MASK & \
-        (!(ADHOC_NO_11A | DISALLOW_ADHOC_11A | DISALLOW_ADHOC_11A_TURB)))
+        (~(ADHOC_NO_11A | DISALLOW_ADHOC_11A | DISALLOW_ADHOC_11A_TURB)))
 #define REG_DOMAIN_5GHZ_MASK    REQ_MASK
 
 static struct reg_dmn_pair_mapping regDomainPairs[] = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 9b60a0c5de5f..21c841847d88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -638,12 +638,16 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         s8 scale_action = 0;
         unsigned long flags;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        u16 fc, rate_mask;
+        u16 fc;
+        u16 rate_mask = 0;
         struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         IWL_DEBUG_RATE("enter\n");
 
+        if (sta)
+                rate_mask = sta->supp_rates[sband->band];
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
@@ -651,11 +655,15 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
             is_multicast_ether_addr(hdr->addr1) ||
             !sta || !priv_sta) {
                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!rate_mask)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                 return;
         }
 
-        rate_mask = sta->supp_rates[sband->band];
         index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
 
         if (sband->band == IEEE80211_BAND_5GHZ)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index f3f17929ca0b..27f50471aed8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -944,7 +944,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         }
 
         /* See if there's a better rate or modulation mode to try. */
-        rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+        if (sta && sta->supp_rates[sband->band])
+                rs_rate_scale_perform(priv, hdr, sta, lq_sta);
 out:
         return;
 }
@@ -2101,14 +2102,23 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = priv_sta;
         int rate_idx;
+        u64 mask_bit = 0;
 
         IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
 
+        if (sta)
+                mask_bit = sta->supp_rates[sband->band];
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         if (!ieee80211_is_data(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1) || !sta || !lq_sta) {
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!mask_bit)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 5da6b35cd26d..b35c8813bef4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1719,6 +1719,10 @@ static int iwl_read_ucode(struct iwl_priv *priv)
         priv->ucode_data_backup.len = data_size;
         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
 
+        if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
+            !priv->ucode_data_backup.v_addr)
+                goto err_pci_alloc;
+
         /* Initialization instructions and data */
         if (init_size && init_data_size) {
                 priv->ucode_init.len = init_size;
@@ -2482,7 +2486,7 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MACDUMP("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int iwl_mac_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 8c71ad4f88c5..4b35b30e493e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -224,7 +224,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 IWL_ERROR("Error: Response NULL in '%s'\n",
                           get_cmd_string(cmd->id));
                 ret = -EIO;
-                goto out;
+                goto cancel;
         }
 
         ret = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d64580805d6e..95d01984c80e 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -745,7 +745,7 @@ static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_
                 IWL_ERROR("Error: Response NULL in '%s'\n",
                           get_cmd_string(cmd->id));
                 ret = -EIO;
-                goto out;
+                goto cancel;
         }
 
         ret = 0;
@@ -6538,7 +6538,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MAC80211("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int iwl3945_mac_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index e173b1b46c23..f6a79a653b7b 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -32,7 +32,7 @@ struct txpd {
         u8 pktdelay_2ms;
         /* reserved */
         u8 reserved1;
-};
+} __attribute__ ((packed));
 
 /* RxPD Descriptor */
 struct rxpd {
@@ -63,7 +63,7 @@ struct rxpd {
         /* Pkt Priority */
         u8 priority;
         u8 reserved[3];
-};
+} __attribute__ ((packed));
 
 struct cmd_header {
         __le16 command;
@@ -97,7 +97,7 @@ struct enc_key {
 struct lbs_offset_value {
         u32 offset;
         u32 value;
-};
+} __attribute__ ((packed));
 
 /* Define general data structure */
 /* cmd_DS_GEN */
@@ -107,7 +107,7 @@ struct cmd_ds_gen {
         __le16 seqnum;
         __le16 result;
         void *cmdresp[0];
-};
+} __attribute__ ((packed));
 
 #define S_DS_GEN sizeof(struct cmd_ds_gen)
 
@@ -163,7 +163,7 @@ struct cmd_ds_802_11_subscribe_event {
          * bump this up a bit.
          */
         uint8_t tlv[128];
-};
+} __attribute__ ((packed));
 
 /*
  * This scan handle Country Information IE(802.11d compliant)
@@ -180,7 +180,7 @@ struct cmd_ds_802_11_scan {
         mrvlietypes_chanlistparamset_t ChanListParamSet;
         mrvlietypes_ratesparamset_t OpRateSet;
 #endif
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_scan_rsp {
         struct cmd_header hdr;
@@ -188,7 +188,7 @@ struct cmd_ds_802_11_scan_rsp {
         __le16 bssdescriptsize;
         uint8_t nr_sets;
         uint8_t bssdesc_and_tlvbuffer[0];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_get_log {
         struct cmd_header hdr;
@@ -206,33 +206,33 @@ struct cmd_ds_802_11_get_log {
         __le32 fcserror;
         __le32 txframe;
         __le32 wepundecryptable;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_mac_control {
         struct cmd_header hdr;
         __le16 action;
         u16 reserved;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_mac_multicast_adr {
         struct cmd_header hdr;
         __le16 action;
         __le16 nr_of_adrs;
         u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_authenticate {
         u8 macaddr[ETH_ALEN];
         u8 authtype;
         u8 reserved[10];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_deauthenticate {
         struct cmd_header hdr;
 
         u8 macaddr[ETH_ALEN];
         __le16 reasoncode;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_associate {
         u8 peerstaaddr[6];
@@ -251,7 +251,7 @@ struct cmd_ds_802_11_associate {
 
 struct cmd_ds_802_11_associate_rsp {
         struct ieeetypes_assocrsp assocRsp;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_set_wep {
         struct cmd_header hdr;
@@ -265,7 +265,7 @@ struct cmd_ds_802_11_set_wep {
         /* 40, 128bit or TXWEP */
         uint8_t keytype[4];
         uint8_t keymaterial[4][16];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_3_get_stat {
         __le32 xmitok;
@@ -274,7 +274,7 @@ struct cmd_ds_802_3_get_stat {
         __le32 rcverror;
         __le32 rcvnobuffer;
         __le32 rcvcrcerror;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_get_stat {
         __le32 txfragmentcnt;
@@ -294,7 +294,7 @@ struct cmd_ds_802_11_get_stat {
         __le32 txbeacon;
         __le32 rxbeacon;
         __le32 wepundecryptable;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_snmp_mib {
         struct cmd_header hdr;
@@ -303,58 +303,58 @@ struct cmd_ds_802_11_snmp_mib {
         __le16 oid;
         __le16 bufsize;
         u8 value[128];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_mac_reg_map {
         __le16 buffersize;
         u8 regmap[128];
         __le16 reserved;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_bbp_reg_map {
         __le16 buffersize;
         u8 regmap[128];
         __le16 reserved;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_rf_reg_map {
         __le16 buffersize;
         u8 regmap[64];
         __le16 reserved;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_mac_reg_access {
         __le16 action;
         __le16 offset;
         __le32 value;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_bbp_reg_access {
         __le16 action;
         __le16 offset;
         u8 value;
         u8 reserved[3];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_rf_reg_access {
         __le16 action;
         __le16 offset;
         u8 value;
         u8 reserved[3];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_radio_control {
         struct cmd_header hdr;
 
         __le16 action;
         __le16 control;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_beacon_control {
         __le16 action;
         __le16 beacon_enable;
         __le16 beacon_period;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_sleep_params {
         struct cmd_header hdr;
@@ -379,7 +379,7 @@ struct cmd_ds_802_11_sleep_params {
 
         /* reserved field, should be set to zero */
         __le16 reserved;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_inactivity_timeout {
         struct cmd_header hdr;
@@ -389,7 +389,7 @@ struct cmd_ds_802_11_inactivity_timeout {
 
         /* Inactivity timeout in msec */
         __le16 timeout;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rf_channel {
         struct cmd_header hdr;
@@ -399,7 +399,7 @@ struct cmd_ds_802_11_rf_channel {
         __le16 rftype;      /* unused */
         __le16 reserved;    /* unused */
         u8 channellist[32]; /* unused */
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rssi {
         /* weighting factor */
@@ -408,21 +408,21 @@ struct cmd_ds_802_11_rssi {
         __le16 reserved_0;
         __le16 reserved_1;
         __le16 reserved_2;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rssi_rsp {
         __le16 SNR;
         __le16 noisefloor;
         __le16 avgSNR;
         __le16 avgnoisefloor;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_mac_address {
         struct cmd_header hdr;
 
         __le16 action;
         u8 macadd[ETH_ALEN];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rf_tx_power {
         struct cmd_header hdr;
@@ -431,7 +431,7 @@ struct cmd_ds_802_11_rf_tx_power {
         __le16 curlevel;
         s8 maxlevel;
         s8 minlevel;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rf_antenna {
         __le16 action;
@@ -439,33 +439,33 @@ struct cmd_ds_802_11_rf_antenna {
         /* Number of antennas or 0xffff(diversity) */
         __le16 antennamode;
 
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_monitor_mode {
         __le16 action;
         __le16 mode;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_set_boot2_ver {
         struct cmd_header hdr;
 
         __le16 action;
         __le16 version;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_fw_wake_method {
         struct cmd_header hdr;
 
         __le16 action;
         __le16 method;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_sleep_period {
         struct cmd_header hdr;
 
         __le16 action;
         __le16 period;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_ps_mode {
         __le16 action;
@@ -473,7 +473,7 @@ struct cmd_ds_802_11_ps_mode {
         __le16 multipledtim;
         __le16 reserved;
         __le16 locallisteninterval;
-};
+} __attribute__ ((packed));
 
 struct cmd_confirm_sleep {
         struct cmd_header hdr;
@@ -483,7 +483,7 @@ struct cmd_confirm_sleep {
         __le16 multipledtim;
         __le16 reserved;
         __le16 locallisteninterval;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_data_rate {
         struct cmd_header hdr;
@@ -491,14 +491,14 @@ struct cmd_ds_802_11_data_rate {
         __le16 action;
         __le16 reserved;
         u8 rates[MAX_RATES];
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_rate_adapt_rateset {
         struct cmd_header hdr;
         __le16 action;
         __le16 enablehwauto;
         __le16 bitmap;
-};
+} __attribute__ ((packed));
 
 struct cmd_ds_802_11_ad_hoc_start {
         struct cmd_header hdr;
@@ -520,7 +520,7 @@ struct cmd_ds_802_11_ad_hoc_result {
 
         u8 pad[3];
         u8 bssid[ETH_ALEN];
-};
+} __attribute__ ((packed));
 
 struct adhoc_bssdesc {
         u8 bssid[ETH_ALEN];
@@ -578,7 +578,7 @@ struct MrvlIEtype_keyParamSet {
 
         /* key material of size keylen */
         u8 key[32];
-};
+} __attribute__ ((packed));
 
 #define MAX_WOL_RULES           16
 
@@ -590,7 +590,7 @@ struct host_wol_rule {
         __le16 reserve;
         __be32 sig_mask;
         __be32 signature;
-};
+} __attribute__ ((packed));
 
 struct wol_config {
         uint8_t action;
@@ -598,8 +598,7 @@ struct wol_config {
         uint8_t no_rules_in_cmd;
         uint8_t result;
         struct host_wol_rule rule[MAX_WOL_RULES];
-};
-
+} __attribute__ ((packed));
 
 struct cmd_ds_host_sleep {
         struct cmd_header hdr;
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index c3bb85e0251e..45a04faa7818 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -1673,7 +1673,7 @@ static void print_linkstatus(struct net_device *dev, u16 status)
                 s = "UNKNOWN";
         }
         
-        printk(KERN_INFO "%s: New link status: %s (%04x)\n",
+        printk(KERN_DEBUG "%s: New link status: %s (%04x)\n",
                dev->name, s, status);
 }
 
@@ -5068,33 +5068,30 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
         struct orinoco_private *priv = netdev_priv(dev);
         u8 *buf;
         unsigned long flags;
-        int err = 0;
 
         /* cut off at IEEE80211_MAX_DATA_LEN */
         if ((wrqu->data.length > IEEE80211_MAX_DATA_LEN) ||
             (wrqu->data.length && (extra == NULL)))
                 return -EINVAL;
 
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
         if (wrqu->data.length) {
                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
-                if (buf == NULL) {
-                        err = -ENOMEM;
-                        goto out;
-                }
+                if (buf == NULL)
+                        return -ENOMEM;
 
                 memcpy(buf, extra, wrqu->data.length);
-                kfree(priv->wpa_ie);
-                priv->wpa_ie = buf;
-                priv->wpa_ie_len = wrqu->data.length;
-        } else {
-                kfree(priv->wpa_ie);
-                priv->wpa_ie = NULL;
-                priv->wpa_ie_len = 0;
+        } else
+                buf = NULL;
+
+        if (orinoco_lock(priv, &flags) != 0) {
+                kfree(buf);
+                return -EBUSY;
         }
 
+        kfree(priv->wpa_ie);
+        priv->wpa_ie = buf;
+        priv->wpa_ie_len = wrqu->data.length;
+
         if (priv->wpa_ie) {
                 /* Looks like wl_lkm wants to check the auth alg, and
                  * somehow pass it to the firmware.
@@ -5103,9 +5100,8 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
                  */
         }
 
-out:
         orinoco_unlock(priv, &flags);
-        return err;
+        return 0;
 }
 
 static int orinoco_ioctl_get_genie(struct net_device *dev,
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index c6a370fa9bcb..34561e6e816b 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -451,8 +451,8 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         }
                         if (err)
                                 goto err;
-
-                }
+                        }
+                        break;
                 case PDR_PRISM_ZIF_TX_IQ_CALIBRATION:
                         priv->iq_autocal = kmalloc(data_len, GFP_KERNEL);
                         if (!priv->iq_autocal) {
@@ -745,7 +745,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
                 struct p54_tx_data *entry_data;
-                int pad = 0;
+                unsigned int pad = 0, frame_len;
 
                 range = (void *)info->rate_driver_data;
                 if (range->start_addr != addr) {
@@ -768,6 +768,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 __skb_unlink(entry, &priv->tx_queue);
                 spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
+                frame_len = entry->len;
                 entry_hdr = (struct p54_hdr *) entry->data;
                 entry_data = (struct p54_tx_data *) entry_hdr->data;
                 priv->tx_stats[entry_data->hw_queue].len--;
@@ -814,15 +815,28 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 info->status.ack_signal = p54_rssi_to_dbm(dev,
                                 (int)payload->ack_rssi);
 
-                if (entry_data->key_type == P54_CRYPTO_TKIPMICHAEL) {
+                /* Undo all changes to the frame. */
+                switch (entry_data->key_type) {
+                case P54_CRYPTO_TKIPMICHAEL: {
                         u8 *iv = (u8 *)(entry_data->align + pad +
-                                        entry_data->crypt_offset);
+                                        entry_data->crypt_offset);
 
                         /* Restore the original TKIP IV. */
                         iv[2] = iv[0];
                         iv[0] = iv[1];
                         iv[1] = (iv[0] | 0x20) & 0x7f;  /* WEPSeed - 8.3.2.2 */
+
+                        frame_len -= 12; /* remove TKIP_MMIC + TKIP_ICV */
+                        break;
+                        }
+                case P54_CRYPTO_AESCCMP:
+                        frame_len -= 8; /* remove CCMP_MIC */
+                        break;
+                case P54_CRYPTO_WEP:
+                        frame_len -= 4; /* remove WEP_ICV */
+                        break;
                 }
+                skb_trim(entry, frame_len);
                 skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
                 ieee80211_tx_status_irqsafe(dev, entry);
                 goto out;
@@ -1147,7 +1161,7 @@ static int p54_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
 
         skb = p54_alloc_skb(dev, P54_HDR_FLAG_CONTROL_OPSET,
                       sizeof(struct p54_hdr) + sizeof(*tim),
-                      P54_CONTROL_TYPE_TIM, GFP_KERNEL);
+                      P54_CONTROL_TYPE_TIM, GFP_ATOMIC);
         if (!skb)
                 return -ENOMEM;
 
@@ -1610,7 +1624,7 @@ static int p54_scan(struct ieee80211_hw *dev, u16 mode, u16 dwell)
 
  err:
         printk(KERN_ERR "%s: frequency change failed\n", wiphy_name(dev->wiphy));
-        kfree_skb(skb);
+        p54_free_skb(dev, skb);
         return -EINVAL;
 }
 
@@ -2077,7 +2091,7 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                         algo = P54_CRYPTO_AESCCMP;
                         break;
                 default:
-                        return -EINVAL;
+                        return -EOPNOTSUPP;
                 }
         }
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 6a6a72f6f82c..5de2ebfb28c7 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -144,11 +144,8 @@ static void p54u_tx_cb(struct urb *urb)
         struct sk_buff *skb = urb->context;
         struct ieee80211_hw *dev = (struct ieee80211_hw *)
                 usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
-        struct p54u_priv *priv = dev->priv;
 
-        skb_pull(skb, priv->common.tx_hdr_len);
-        if (FREE_AFTER_TX(skb))
-                p54_free_skb(dev, skb);
+        p54_free_skb(dev, skb);
 }
 
 static void p54u_tx_dummy_cb(struct urb *urb) { }
@@ -230,7 +227,10 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                           p54u_tx_dummy_cb, dev);
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          skb->data, skb->len, FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        addr_urb->transfer_flags |= URB_ZERO_PACKET;
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(addr_urb, &priv->submitted);
         err = usb_submit_urb(addr_urb, GFP_ATOMIC);
@@ -239,7 +239,7 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                 goto out;
         }
 
-        usb_anchor_urb(addr_urb, &priv->submitted);
+        usb_anchor_urb(data_urb, &priv->submitted);
         err = usb_submit_urb(data_urb, GFP_ATOMIC);
         if (err)
                 usb_unanchor_urb(data_urb);
@@ -269,28 +269,24 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
         struct p54u_priv *priv = dev->priv;
         struct urb *data_urb;
-        struct lm87_tx_hdr *hdr;
-        __le32 checksum;
-        __le32 addr = ((struct p54_hdr *)skb->data)->req_id;
+        struct lm87_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
 
         data_urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!data_urb)
                 return;
 
-        checksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
-        hdr = (struct lm87_tx_hdr *)skb_push(skb, sizeof(*hdr));
-        hdr->chksum = checksum;
-        hdr->device_addr = addr;
+        hdr->chksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
+        hdr->device_addr = ((struct p54_hdr *)skb->data)->req_id;
 
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr),  FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
         data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(data_urb, &priv->submitted);
         if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
                 usb_unanchor_urb(data_urb);
-                skb_pull(skb, sizeof(*hdr));
                 p54_free_skb(dev, skb);
         }
         usb_free_urb(data_urb);
@@ -300,11 +296,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
         struct p54u_priv *priv = dev->priv;
         struct urb *int_urb, *data_urb;
-        struct net2280_tx_hdr *hdr;
+        struct net2280_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
         struct net2280_reg_write *reg;
         int err = 0;
-        __le32 addr = ((struct p54_hdr *) skb->data)->req_id;
-        __le16 len = cpu_to_le16(skb->len);
 
         reg = kmalloc(sizeof(*reg), GFP_ATOMIC);
         if (!reg)
@@ -327,10 +321,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
         reg->addr = cpu_to_le32(P54U_DEV_BASE);
         reg->val = cpu_to_le32(ISL38XX_DEV_INT_DATA);
 
-        hdr = (void *)skb_push(skb, sizeof(*hdr));
         memset(hdr, 0, sizeof(*hdr));
-        hdr->len = len;
-        hdr->device_addr = addr;
+        hdr->len = cpu_to_le16(skb->len);
+        hdr->device_addr = ((struct p54_hdr *) skb->data)->req_id;
 
         usb_fill_bulk_urb(int_urb, priv->udev,
                 usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
@@ -341,11 +334,13 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
          * free what's inside the transfer_buffer after the callback routine
          * has completed.
          */
-        int_urb->transfer_flags |= URB_FREE_BUFFER;
+        int_urb->transfer_flags |= URB_FREE_BUFFER | URB_ZERO_PACKET;
 
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr), FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(int_urb, &priv->submitted);
         err = usb_submit_urb(int_urb, GFP_ATOMIC);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 607ce9f61b54..ed93ac41297f 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1649,9 +1649,7 @@ static char *rndis_translate_scan(struct net_device *dev,
                                   char *end_buf,
                                   struct ndis_80211_bssid_ex *bssid)
 {
-#ifdef DEBUG
         struct usbnet *usbdev = netdev_priv(dev);
-#endif
         u8 *ie;
         char *current_val;
         int bssid_len, ie_len, i;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 746a8f36b931..0709decec9c2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -154,6 +154,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
+        struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
         struct ieee80211_rate *rate =
             ieee80211_get_tx_rate(rt2x00dev->hw, tx_info);
         const struct rt2x00_rate *hwrate;
@@ -313,7 +314,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
                  * When preamble is enabled we should set the
                  * preamble bit for the signal.
                  */
-                if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
                         txdesc->signal |= 0x08;
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00rfkill.c b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
index c3f53a92180a..3298cae1e12d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00rfkill.c
+++ b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
@@ -162,7 +162,7 @@ void rt2x00rfkill_allocate(struct rt2x00_dev *rt2x00dev)
 
 void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
 {
-        if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->flags))
+        if (!test_bit(RFKILL_STATE_ALLOCATED, &rt2x00dev->rfkill_state))
                 return;
 
         cancel_delayed_work_sync(&rt2x00dev->rfkill_work);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 6ad6bac37706..22bc07ef2f37 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -273,6 +273,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 
         usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
                           buf, skb->len, rtl8187_tx_cb, skb);
+        urb->transfer_flags |= URB_ZERO_PACKET;
         usb_anchor_urb(urb, &priv->anchored);
         rc = usb_submit_urb(urb, GFP_ATOMIC);
         if (rc < 0) {
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 4e75e8e7fa90..78df281b297a 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -285,7 +285,10 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         ofdm_power = priv->channels[channel - 1].hw_value >> 4;
 
         cck_power = min(cck_power, (u8)11);
-        ofdm_power = min(ofdm_power, (u8)35);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
 
         rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
                          rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
@@ -536,7 +539,10 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         cck_power += priv->txpwr_base & 0xF;
         cck_power = min(cck_power, (u8)35);
 
-        ofdm_power = min(ofdm_power, (u8)15);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
         ofdm_power += priv->txpwr_base >> 4;
         ofdm_power = min(ofdm_power, (u8)35);
 
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index b5db57d2fcf5..17527f765b39 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -84,6 +84,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0df6, 0x0036), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },