32 files changed, 333 insertions, 154 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 2b733c582915..2c08c0a5a0df 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -68,7 +68,7 @@ config WAVELAN
           <http://www.tldp.org/docs.html#howto>. Some more specific
           information is contained in
           <file:Documentation/networking/wavelan.txt> and in the source code
-          <file:drivers/net/wavelan.p.h>.
+          <file:drivers/net/wireless/wavelan.p.h>.
 
           You will also need the wireless tools package available from
           <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
@@ -264,6 +264,7 @@ config IPW2200_DEBUG
 config LIBERTAS
         tristate "Marvell 8xxx Libertas WLAN driver support"
         depends on WLAN_80211
+        select WIRELESS_EXT
         select IEEE80211
         select FW_LOADER
         ---help---
@@ -586,15 +587,66 @@ config ADM8211
 config P54_COMMON
         tristate "Softmac Prism54 support"
         depends on MAC80211 && WLAN_80211 && FW_LOADER && EXPERIMENTAL
+        ---help---
+          This is common code for isl38xx based cards.
+          This module does nothing by itself - the USB/PCI frontends
+          also need to be enabled in order to support any devices.
+
+          These devices require softmac firmware which can be found at
+          http://prism54.org/
+
+          If you choose to build a module, it'll be called p54common.
 
 config P54_USB
         tristate "Prism54 USB support"
         depends on P54_COMMON && USB
         select CRC32
+        ---help---
+          This driver is for USB isl38xx based wireless cards.
+          These are USB based adapters found in devices such as:
+
+          3COM 3CRWE254G72
+          SMC 2862W-G
+          Accton 802.11g WN4501 USB
+          Siemens Gigaset USB
+          Netgear WG121
+          Netgear WG111
+          Medion 40900, Roper Europe
+          Shuttle PN15, Airvast WM168g, IOGear GWU513
+          Linksys WUSB54G
+          Linksys WUSB54G Portable
+          DLink DWL-G120 Spinnaker
+          DLink DWL-G122
+          Belkin F5D7050 ver 1000
+          Cohiba Proto board
+          SMC 2862W-G version 2
+          U.S. Robotics U5 802.11g Adapter
+          FUJITSU E-5400 USB D1700
+          Sagem XG703A
+          DLink DWL-G120 Cohiba
+          Spinnaker Proto board
+          Linksys WUSB54AG
+          Inventel UR054G
+          Spinnaker DUT
+
+          These devices require softmac firmware which can be found at
+          http://prism54.org/
+
+          If you choose to build a module, it'll be called p54usb.
 
 config P54_PCI
         tristate "Prism54 PCI support"
         depends on P54_COMMON && PCI
+        ---help---
+          This driver is for PCI isl38xx based wireless cards.
+          This driver supports most devices that are supported by the
+          fullmac prism54 driver plus many devices which are not
+          supported by the fullmac driver/firmware.
+
+          This driver requires softmac firmware which can be found at
+          http://prism54.org/
+
+          If you choose to build a module, it'll be called p54pci.
 
 source "drivers/net/wireless/iwlwifi/Kconfig"
 source "drivers/net/wireless/hostap/Kconfig"
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index a28ad230d63e..7b6fc1ab2b90 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -273,6 +273,8 @@ enum {
 #define B43_PHYTYPE_A                   0x00
 #define B43_PHYTYPE_B                   0x01
 #define B43_PHYTYPE_G                   0x02
+#define B43_PHYTYPE_N                   0x04
+#define B43_PHYTYPE_LP                  0x05
 
 /* PHYRegisters */
 #define B43_PHY_ILT_A_CTRL              0x0072
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index 19e588582c7c..6c0e2b9f7760 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -163,6 +163,9 @@ static void b43_map_led(struct b43_wldev *dev,
                 b43_register_led(dev, &dev->led_radio, name,
                                  b43_rfkill_led_name(dev),
                                  led_index, activelow);
+                /* Sync the RF-kill LED state with the switch state. */
+                if (dev->radio_hw_enable)
+                        b43_led_turn_on(dev, led_index, activelow);
                 break;
         case B43_LED_WEIRD:
         case B43_LED_ASSOC:
@@ -232,4 +235,5 @@ void b43_leds_exit(struct b43_wldev *dev)
         b43_unregister_led(&dev->led_tx);
         b43_unregister_led(&dev->led_rx);
         b43_unregister_led(&dev->led_assoc);
+        b43_unregister_led(&dev->led_radio);
 }
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 2b17c1dc46f1..1c93b4f4bfe3 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1566,7 +1566,7 @@ static void b43_release_firmware(struct b43_wldev *dev)
 static void b43_print_fw_helptext(struct b43_wl *wl)
 {
         b43err(wl, "You must go to "
-               "http://linuxwireless.org/en/users/Drivers/bcm43xx#devicefirmware "
+               "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
                "and download the correct firmware (version 4).\n");
 }
 
@@ -2163,7 +2163,6 @@ static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
 static void b43_chip_exit(struct b43_wldev *dev)
 {
         b43_radio_turn_off(dev, 1);
-        b43_leds_exit(dev);
         b43_gpio_cleanup(dev);
         /* firmware is released later */
 }
@@ -2191,11 +2190,10 @@ static int b43_chip_init(struct b43_wldev *dev)
         err = b43_gpio_init(dev);
         if (err)
                 goto out;       /* firmware is released later */
-        b43_leds_init(dev);
 
         err = b43_upload_initvals(dev);
         if (err)
-                goto err_leds_exit;
+                goto err_gpio_clean;
         b43_radio_turn_on(dev);
 
         b43_write16(dev, 0x03E6, 0x0000);
@@ -2271,8 +2269,7 @@ out:
 
 err_radio_off:
         b43_radio_turn_off(dev, 1);
-err_leds_exit:
-        b43_leds_exit(dev);
+err_gpio_clean:
         b43_gpio_cleanup(dev);
         return err;
 }
@@ -3273,10 +3270,7 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
                 return;
         b43_set_status(dev, B43_STAT_UNINIT);
 
-        mutex_unlock(&dev->wl->mutex);
-        b43_rfkill_exit(dev);
-        mutex_lock(&dev->wl->mutex);
-
+        b43_leds_exit(dev);
         b43_rng_exit(dev->wl);
         b43_pio_free(dev);
         b43_dma_free(dev);
@@ -3405,12 +3399,12 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         memset(wl->mac_addr, 0, ETH_ALEN);
         b43_upload_card_macaddress(dev);
         b43_security_init(dev);
-        b43_rfkill_init(dev);
         b43_rng_init(wl);
 
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
-      out:
+        b43_leds_init(dev);
+out:
         return err;
 
       err_chip_exit:
@@ -3499,6 +3493,10 @@ static int b43_start(struct ieee80211_hw *hw)
         int did_init = 0;
         int err = 0;
 
+        /* First register RFkill.
+         * LEDs that are registered later depend on it. */
+        b43_rfkill_init(dev);
+
         mutex_lock(&wl->mutex);
 
         if (b43_status(dev) < B43_STAT_INITIALIZED) {
@@ -3528,6 +3526,8 @@ static void b43_stop(struct ieee80211_hw *hw)
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev = wl->current_dev;
 
+        b43_rfkill_exit(dev);
+
         mutex_lock(&wl->mutex);
         if (b43_status(dev) >= B43_STAT_STARTED)
                 b43_wireless_core_stop(dev);
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 284d17da17d1..08e2e56e48f4 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -39,11 +39,11 @@
 #define PAD_BYTES(nr_bytes)             P4D_BYTES( __LINE__ , (nr_bytes))
 
 /* Lightweight function to convert a frequency (in Mhz) to a channel number. */
-static inline u8 b43_freq_to_channel_a(int freq)
+static inline u8 b43_freq_to_channel_5ghz(int freq)
 {
         return ((freq - 5000) / 5);
 }
-static inline u8 b43_freq_to_channel_bg(int freq)
+static inline u8 b43_freq_to_channel_2ghz(int freq)
 {
         u8 channel;
 
@@ -54,19 +54,13 @@ static inline u8 b43_freq_to_channel_bg(int freq)
 
         return channel;
 }
-static inline u8 b43_freq_to_channel(struct b43_wldev *dev, int freq)
-{
-        if (dev->phy.type == B43_PHYTYPE_A)
-                return b43_freq_to_channel_a(freq);
-        return b43_freq_to_channel_bg(freq);
-}
 
 /* Lightweight function to convert a channel number to a frequency (in Mhz). */
-static inline int b43_channel_to_freq_a(u8 channel)
+static inline int b43_channel_to_freq_5ghz(u8 channel)
 {
         return (5000 + (5 * channel));
 }
-static inline int b43_channel_to_freq_bg(u8 channel)
+static inline int b43_channel_to_freq_2ghz(u8 channel)
 {
         int freq;
 
@@ -77,12 +71,6 @@ static inline int b43_channel_to_freq_bg(u8 channel)
 
         return freq;
 }
-static inline int b43_channel_to_freq(struct b43_wldev *dev, u8 channel)
-{
-        if (dev->phy.type == B43_PHYTYPE_A)
-                return b43_channel_to_freq_a(channel);
-        return b43_channel_to_freq_bg(channel);
-}
 
 static inline int b43_is_cck_rate(int rate)
 {
diff --git a/drivers/net/wireless/b43/phy.c b/drivers/net/wireless/b43/phy.c
index 3d4ed647c311..7ff091e69f05 100644
--- a/drivers/net/wireless/b43/phy.c
+++ b/drivers/net/wireless/b43/phy.c
@@ -2214,7 +2214,7 @@ int b43_phy_init_tssi2dbm_table(struct b43_wldev *dev)
                 }
                 dyn_tssi2dbm = kmalloc(64, GFP_KERNEL);
                 if (dyn_tssi2dbm == NULL) {
-                        b43err(dev->wl, "Could not allocate memory"
+                        b43err(dev->wl, "Could not allocate memory "
                                "for tssi2dbm table\n");
                         return -ENOMEM;
                 }
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 9b1f905ffbf4..11f53cb1139e 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -25,6 +25,8 @@
 #include "rfkill.h"
 #include "b43.h"
 
+#include <linux/kmod.h>
+
 
 /* Returns TRUE, if the radio is enabled in hardware. */
 static bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
@@ -50,7 +52,10 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
         bool report_change = 0;
 
         mutex_lock(&wl->mutex);
-        B43_WARN_ON(b43_status(dev) < B43_STAT_INITIALIZED);
+        if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED)) {
+                mutex_unlock(&wl->mutex);
+                return;
+        }
         enabled = b43_is_hw_radio_enabled(dev);
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
@@ -60,8 +65,12 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
         }
         mutex_unlock(&wl->mutex);
 
-        if (unlikely(report_change))
-                input_report_key(poll_dev->input, KEY_WLAN, enabled);
+        /* send the radio switch event to the system - note both a key press
+         * and a release are required */
+        if (unlikely(report_change)) {
+                input_report_key(poll_dev->input, KEY_WLAN, 1);
+                input_report_key(poll_dev->input, KEY_WLAN, 0);
+        }
 }
 
 /* Called when the RFKILL toggled in software. */
@@ -69,13 +78,15 @@ static int b43_rfkill_soft_toggle(void *data, enum rfkill_state state)
 {
         struct b43_wldev *dev = data;
         struct b43_wl *wl = dev->wl;
-        int err = 0;
+        int err = -EBUSY;
 
         if (!wl->rfkill.registered)
                 return 0;
 
         mutex_lock(&wl->mutex);
-        B43_WARN_ON(b43_status(dev) < B43_STAT_INITIALIZED);
+        if (b43_status(dev) < B43_STAT_INITIALIZED)
+                goto out_unlock;
+        err = 0;
         switch (state) {
         case RFKILL_STATE_ON:
                 if (!dev->radio_hw_enable) {
@@ -127,15 +138,34 @@ void b43_rfkill_init(struct b43_wldev *dev)
         rfk->rfkill->user_claim_unsupported = 1;
 
         rfk->poll_dev = input_allocate_polled_device();
-        if (!rfk->poll_dev)
-                goto err_free_rfk;
+        if (!rfk->poll_dev) {
+                rfkill_free(rfk->rfkill);
+                goto err_freed_rfk;
+        }
+
         rfk->poll_dev->private = dev;
         rfk->poll_dev->poll = b43_rfkill_poll;
         rfk->poll_dev->poll_interval = 1000; /* msecs */
 
+        rfk->poll_dev->input->name = rfk->name;
+        rfk->poll_dev->input->id.bustype = BUS_HOST;
+        rfk->poll_dev->input->id.vendor = dev->dev->bus->boardinfo.vendor;
+        rfk->poll_dev->input->evbit[0] = BIT(EV_KEY);
+        set_bit(KEY_WLAN, rfk->poll_dev->input->keybit);
+
         err = rfkill_register(rfk->rfkill);
         if (err)
                 goto err_free_polldev;
+
+#ifdef CONFIG_RFKILL_INPUT_MODULE
+        /* B43 RF-kill isn't useful without the rfkill-input subsystem.
+         * Try to load the module. */
+        err = request_module("rfkill-input");
+        if (err)
+                b43warn(wl, "Failed to load the rfkill-input module. "
+                        "The built-in radio LED will not work.\n");
+#endif /* CONFIG_RFKILL_INPUT */
+
         err = input_register_polled_device(rfk->poll_dev);
         if (err)
                 goto err_unreg_rfk;
@@ -148,8 +178,7 @@ err_unreg_rfk:
 err_free_polldev:
         input_free_polled_device(rfk->poll_dev);
         rfk->poll_dev = NULL;
-err_free_rfk:
-        rfkill_free(rfk->rfkill);
+err_freed_rfk:
         rfk->rfkill = NULL;
 out_error:
         rfk->registered = 0;
@@ -168,6 +197,5 @@ void b43_rfkill_exit(struct b43_wldev *dev)
         rfkill_unregister(rfk->rfkill);
         input_free_polled_device(rfk->poll_dev);
         rfk->poll_dev = NULL;
-        rfkill_free(rfk->rfkill);
         rfk->rfkill = NULL;
 }
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 0bd6f8a348a8..3307ba1856b1 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -531,21 +531,32 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         switch (chanstat & B43_RX_CHAN_PHYTYPE) {
         case B43_PHYTYPE_A:
                 status.phymode = MODE_IEEE80211A;
-                status.freq = chanid;
-                status.channel = b43_freq_to_channel_a(chanid);
-                break;
-        case B43_PHYTYPE_B:
-                status.phymode = MODE_IEEE80211B;
-                status.freq = chanid + 2400;
-                status.channel = b43_freq_to_channel_bg(chanid + 2400);
+                B43_WARN_ON(1);
+                /* FIXME: We don't really know which value the "chanid" contains.
+                 *        So the following assignment might be wrong. */
+                status.channel = chanid;
+                status.freq = b43_channel_to_freq_5ghz(status.channel);
                 break;
         case B43_PHYTYPE_G:
                 status.phymode = MODE_IEEE80211G;
+                /* chanid is the radio channel cookie value as used
+                 * to tune the radio. */
                 status.freq = chanid + 2400;
-                status.channel = b43_freq_to_channel_bg(chanid + 2400);
+                status.channel = b43_freq_to_channel_2ghz(status.freq);
+                break;
+        case B43_PHYTYPE_N:
+                status.phymode = 0xDEAD /*FIXME MODE_IEEE80211N*/;
+                /* chanid is the SHM channel cookie. Which is the plain
+                 * channel number in b43. */
+                status.channel = chanid;
+                if (chanstat & B43_RX_CHAN_5GHZ)
+                        status.freq = b43_freq_to_channel_5ghz(status.freq);
+                else
+                        status.freq = b43_freq_to_channel_2ghz(status.freq);
                 break;
         default:
                 B43_WARN_ON(1);
+                goto drop;
         }
 
         dev->stats.last_rx = jiffies;
diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
index 03bddd251618..6dc079382f7f 100644
--- a/drivers/net/wireless/b43/xmit.h
+++ b/drivers/net/wireless/b43/xmit.h
@@ -142,49 +142,56 @@ struct b43_rxhdr_fw4 {
 } __attribute__ ((__packed__));
 
 /* PHY RX Status 0 */
-#define B43_RX_PHYST0_GAINCTL   0x4000  /* Gain Control */
-#define B43_RX_PHYST0_PLCPHCF   0x0200
-#define B43_RX_PHYST0_PLCPFV    0x0100
-#define B43_RX_PHYST0_SHORTPRMBL        0x0080  /* Received with Short Preamble */
+#define B43_RX_PHYST0_GAINCTL           0x4000 /* Gain Control */
+#define B43_RX_PHYST0_PLCPHCF           0x0200
+#define B43_RX_PHYST0_PLCPFV            0x0100
+#define B43_RX_PHYST0_SHORTPRMBL        0x0080 /* Received with Short Preamble */
 #define B43_RX_PHYST0_LCRS              0x0040
-#define B43_RX_PHYST0_ANT               0x0020  /* Antenna */
-#define B43_RX_PHYST0_UNSRATE   0x0010
+#define B43_RX_PHYST0_ANT               0x0020 /* Antenna */
+#define B43_RX_PHYST0_UNSRATE           0x0010
 #define B43_RX_PHYST0_CLIP              0x000C
 #define B43_RX_PHYST0_CLIP_SHIFT        2
-#define B43_RX_PHYST0_FTYPE             0x0003  /* Frame type */
-#define  B43_RX_PHYST0_CCK              0x0000  /* Frame type: CCK */
-#define  B43_RX_PHYST0_OFDM             0x0001  /* Frame type: OFDM */
-#define  B43_RX_PHYST0_PRE_N    0x0002  /* Pre-standard N-PHY frame */
-#define  B43_RX_PHYST0_STD_N    0x0003  /* Standard N-PHY frame */
+#define B43_RX_PHYST0_FTYPE             0x0003 /* Frame type */
+#define  B43_RX_PHYST0_CCK              0x0000 /* Frame type: CCK */
+#define  B43_RX_PHYST0_OFDM             0x0001 /* Frame type: OFDM */
+#define  B43_RX_PHYST0_PRE_N            0x0002 /* Pre-standard N-PHY frame */
+#define  B43_RX_PHYST0_STD_N            0x0003 /* Standard N-PHY frame */
 
 /* PHY RX Status 2 */
-#define B43_RX_PHYST2_LNAG              0xC000  /* LNA Gain */
+#define B43_RX_PHYST2_LNAG              0xC000 /* LNA Gain */
 #define B43_RX_PHYST2_LNAG_SHIFT        14
-#define B43_RX_PHYST2_PNAG              0x3C00  /* PNA Gain */
+#define B43_RX_PHYST2_PNAG              0x3C00 /* PNA Gain */
 #define B43_RX_PHYST2_PNAG_SHIFT        10
-#define B43_RX_PHYST2_FOFF              0x03FF  /* F offset */
+#define B43_RX_PHYST2_FOFF              0x03FF /* F offset */
 
 /* PHY RX Status 3 */
-#define B43_RX_PHYST3_DIGG              0x1800  /* DIG Gain */
+#define B43_RX_PHYST3_DIGG              0x1800 /* DIG Gain */
 #define B43_RX_PHYST3_DIGG_SHIFT        11
-#define B43_RX_PHYST3_TRSTATE   0x0400  /* TR state */
+#define B43_RX_PHYST3_TRSTATE           0x0400 /* TR state */
 
 /* MAC RX Status */
-#define B43_RX_MAC_BEACONSENT   0x00008000      /* Beacon send flag */
-#define B43_RX_MAC_KEYIDX               0x000007E0      /* Key index */
-#define B43_RX_MAC_KEYIDX_SHIFT 5
-#define B43_RX_MAC_DECERR               0x00000010      /* Decrypt error */
-#define B43_RX_MAC_DEC          0x00000008      /* Decryption attempted */
-#define B43_RX_MAC_PADDING              0x00000004      /* Pad bytes present */
-#define B43_RX_MAC_RESP         0x00000002      /* Response frame transmitted */
-#define B43_RX_MAC_FCSERR               0x00000001      /* FCS error */
+#define B43_RX_MAC_RXST_VALID           0x01000000 /* PHY RXST valid */
+#define B43_RX_MAC_TKIP_MICERR          0x00100000 /* TKIP MIC error */
+#define B43_RX_MAC_TKIP_MICATT          0x00080000 /* TKIP MIC attempted */
+#define B43_RX_MAC_AGGTYPE              0x00060000 /* Aggregation type */
+#define B43_RX_MAC_AGGTYPE_SHIFT        17
+#define B43_RX_MAC_AMSDU                0x00010000 /* A-MSDU mask */
+#define B43_RX_MAC_BEACONSENT           0x00008000 /* Beacon sent flag */
+#define B43_RX_MAC_KEYIDX               0x000007E0 /* Key index */
+#define B43_RX_MAC_KEYIDX_SHIFT         5
+#define B43_RX_MAC_DECERR               0x00000010 /* Decrypt error */
+#define B43_RX_MAC_DEC                  0x00000008 /* Decryption attempted */
+#define B43_RX_MAC_PADDING              0x00000004 /* Pad bytes present */
+#define B43_RX_MAC_RESP                 0x00000002 /* Response frame transmitted */
+#define B43_RX_MAC_FCSERR               0x00000001 /* FCS error */
 
 /* RX channel */
-#define B43_RX_CHAN_GAIN                0xFC00  /* Gain */
-#define B43_RX_CHAN_GAIN_SHIFT  10
-#define B43_RX_CHAN_ID          0x03FC  /* Channel ID */
-#define B43_RX_CHAN_ID_SHIFT    2
-#define B43_RX_CHAN_PHYTYPE             0x0003  /* PHY type */
+#define B43_RX_CHAN_40MHZ               0x1000 /* 40 Mhz channel width */
+#define B43_RX_CHAN_5GHZ                0x0800 /* 5 Ghz band */
+#define B43_RX_CHAN_ID                  0x07F8 /* Channel ID */
+#define B43_RX_CHAN_ID_SHIFT            3
+#define B43_RX_CHAN_PHYTYPE             0x0007 /* PHY type */
+
 
 u8 b43_plcp_get_ratecode_cck(const u8 bitrate);
 u8 b43_plcp_get_ratecode_ofdm(const u8 bitrate);
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index 8cb3dc4c4745..83161d9af813 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -996,7 +996,7 @@ int b43legacy_dma_init(struct b43legacy_wldev *dev)
 
         err = ssb_dma_set_mask(dev->dev, dmamask);
         if (err) {
-#ifdef BCM43XX_PIO
+#ifdef CONFIG_B43LEGACY_PIO
                 b43legacywarn(dev->wl, "DMA for this device not supported. "
                         "Falling back to PIO\n");
                 dev->__using_pio = 1;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 3bde1e9ab428..32d5e1785bda 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -1419,7 +1419,7 @@ static void b43legacy_release_firmware(struct b43legacy_wldev *dev)
 static void b43legacy_print_fw_helptext(struct b43legacy_wl *wl)
 {
         b43legacyerr(wl, "You must go to http://linuxwireless.org/en/users/"
-                     "Drivers/bcm43xx#devicefirmware "
+                     "Drivers/b43#devicefirmware "
                      "and download the correct firmware (version 3).\n");
 }
 
diff --git a/drivers/net/wireless/b43legacy/phy.c b/drivers/net/wireless/b43legacy/phy.c
index 22a4b3d0186d..491e518e4aeb 100644
--- a/drivers/net/wireless/b43legacy/phy.c
+++ b/drivers/net/wireless/b43legacy/phy.c
@@ -2020,7 +2020,7 @@ int b43legacy_phy_init_tssi2dbm_table(struct b43legacy_wldev *dev)
                         phy->idle_tssi = 62;
                 dyn_tssi2dbm = kmalloc(64, GFP_KERNEL);
                 if (dyn_tssi2dbm == NULL) {
-                        b43legacyerr(dev->wl, "Could not allocate memory"
+                        b43legacyerr(dev->wl, "Could not allocate memory "
                                "for tssi2dbm table\n");
                         return -ENOMEM;
                 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index 35dbe4554513..76e9dd843faa 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -219,7 +219,7 @@ static ssize_t tsf_write_file(struct file *file, const char __user *user_buf,
         ssize_t buf_size;
         ssize_t res;
         unsigned long flags;
-        u64 tsf;
+        unsigned long long tsf;
 
         buf_size = min(count, sizeof (really_big_buffer) - 1);
         down(&big_buffer_sem);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index b37f1e348700..af3de3343650 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -2149,7 +2149,7 @@ int bcm43xx_phy_init_tssi2dbm_table(struct bcm43xx_private *bcm)
                 }
                 dyn_tssi2dbm = kmalloc(64, GFP_KERNEL);
                 if (dyn_tssi2dbm == NULL) {
-                        printk(KERN_ERR PFX "Could not allocate memory"
+                        printk(KERN_ERR PFX "Could not allocate memory "
                                             "for tssi2dbm table\n");
                         return -ENOMEM;
                 }
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 040dc3e36410..cbf15d703201 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -608,7 +608,7 @@ static void prism2_plx_remove(struct pci_dev *pdev)
 
 MODULE_DEVICE_TABLE(pci, prism2_plx_id_table);
 
-static struct pci_driver prism2_plx_drv_id = {
+static struct pci_driver prism2_plx_driver = {
         .name           = "hostap_plx",
         .id_table       = prism2_plx_id_table,
         .probe          = prism2_plx_probe,
@@ -618,13 +618,13 @@ static struct pci_driver prism2_plx_drv_id = {
 
 static int __init init_prism2_plx(void)
 {
-        return pci_register_driver(&prism2_plx_drv_id);
+        return pci_register_driver(&prism2_plx_driver);
 }
 
 
 static void __exit exit_prism2_plx(void)
 {
-        pci_unregister_driver(&prism2_plx_drv_id);
+        pci_unregister_driver(&prism2_plx_driver);
 }
 
 
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 54f44e5473c0..003f73f89efa 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1233,9 +1233,19 @@ static ssize_t show_event_log(struct device *d,
 {
         struct ipw_priv *priv = dev_get_drvdata(d);
         u32 log_len = ipw_get_event_log_len(priv);
-        struct ipw_event log[log_len];
+        u32 log_size;
+        struct ipw_event *log;
         u32 len = 0, i;
 
+        /* not using min() because of its strict type checking */
+        log_size = PAGE_SIZE / sizeof(*log) > log_len ?
+                        sizeof(*log) * log_len : PAGE_SIZE;
+        log = kzalloc(log_size, GFP_KERNEL);
+        if (!log) {
+                IPW_ERROR("Unable to allocate memory for log\n");
+                return 0;
+        }
+        log_len = log_size / sizeof(*log);
         ipw_capture_event_log(priv, log_len, log);
 
         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
@@ -1244,6 +1254,7 @@ static ssize_t show_event_log(struct device *d,
                                 "\n%08X%08X%08X",
                                 log[i].time, log[i].event, log[i].data);
         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
+        kfree(log);
         return len;
 }
 
@@ -4924,7 +4935,7 @@ static int ipw_queue_reset(struct ipw_priv *priv)
 /**
  * Reclaim Tx queue entries no more used by NIC.
  *
- * When FW adwances 'R' index, all entries between old and
+ * When FW advances 'R' index, all entries between old and
  * new 'R' index need to be reclaimed. As result, some free space
  * forms. If there is enough free space (> low mark), wake Tx queue.
  *
@@ -10751,7 +10762,7 @@ static void ipw_bg_link_down(struct work_struct *work)
         mutex_unlock(&priv->mutex);
 }
 
-static int ipw_setup_deferred_work(struct ipw_priv *priv)
+static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
 {
         int ret = 0;
 
@@ -11600,7 +11611,8 @@ static void ipw_prom_free(struct ipw_priv *priv)
 #endif
 
 
-static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+static int __devinit ipw_pci_probe(struct pci_dev *pdev,
+                                   const struct pci_device_id *ent)
 {
         int err = 0;
         struct net_device *net_dev;
@@ -11767,7 +11779,7 @@ static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return err;
 }
 
-static void ipw_pci_remove(struct pci_dev *pdev)
+static void __devexit ipw_pci_remove(struct pci_dev *pdev)
 {
         struct ipw_priv *priv = pci_get_drvdata(pdev);
         struct list_head *p, *q;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 465da4f67ce7..0b3ec7e4d93b 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2915,6 +2915,10 @@ static void iwl_set_rate(struct iwl_priv *priv)
         int i;
 
         hw = iwl_get_hw_mode(priv, priv->phymode);
+        if (!hw) {
+                IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+                return;
+        }
 
         priv->active_rate = 0;
         priv->active_rate_basic = 0;
@@ -4739,8 +4743,10 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                  *   when we loaded driver, and is now set to "enable".
                  * After we're Alive, RF_KILL gets handled by
                  *   iwl_rx_card_state_notif() */
-                if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status))
+                if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status)) {
+                        clear_bit(STATUS_RF_KILL_HW, &priv->status);
                         queue_work(priv->workqueue, &priv->restart);
+                }
 
                 handled |= CSR_INT_BIT_RF_KILL;
         }
@@ -6167,6 +6173,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 mutex_lock(&priv->mutex);
 
                 if (rc) {
+                        iwl_rate_control_unregister(priv->hw);
                         IWL_ERROR("Failed to register network "
                                   "device (error %d)\n", rc);
                         return;
@@ -6239,8 +6246,6 @@ static void __iwl_down(struct iwl_priv *priv)
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
 
-        iwl_cancel_deferred_work(priv);
-
         /* Wipe out the EXIT_PENDING status bit if we are not actually
          * exiting the module */
         if (!exit_pending)
@@ -6315,6 +6320,8 @@ static void iwl_down(struct iwl_priv *priv)
         mutex_lock(&priv->mutex);
         __iwl_down(priv);
         mutex_unlock(&priv->mutex);
+
+        iwl_cancel_deferred_work(priv);
 }
 
 #define MAX_HW_RESTARTS 5
@@ -6335,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv)
                 return 0;
         }
 
+        if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+                IWL_ERROR("ucode not available for device bringup\n");
+                return -EIO;
+        }
+
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
         rc = iwl_hw_nic_init(priv);
@@ -6936,13 +6948,10 @@ static int iwl_mac_add_interface(struct ieee80211_hw *hw,
         DECLARE_MAC_BUF(mac);
 
         IWL_DEBUG_MAC80211("enter: id %d, type %d\n", conf->if_id, conf->type);
-        if (conf->mac_addr)
-                IWL_DEBUG_MAC80211("enter: MAC %s\n",
-                                   print_mac(mac, conf->mac_addr));
 
         if (priv->interface_id) {
                 IWL_DEBUG_MAC80211("leave - interface_id != 0\n");
-                return 0;
+                return -EOPNOTSUPP;
         }
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -6951,6 +6960,12 @@ static int iwl_mac_add_interface(struct ieee80211_hw *hw,
         spin_unlock_irqrestore(&priv->lock, flags);
 
         mutex_lock(&priv->mutex);
+
+        if (conf->mac_addr) {
+                IWL_DEBUG_MAC80211("Set: %s\n", print_mac(mac, conf->mac_addr));
+                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        }
+
         iwl_set_mode(priv, conf->type);
 
         IWL_DEBUG_MAC80211("leave\n");
@@ -8270,6 +8285,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 {
         iwl_hw_cancel_deferred_work(priv);
 
+        cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
         cancel_delayed_work(&priv->post_associate);
@@ -8569,10 +8585,9 @@ static void iwl_pci_remove(struct pci_dev *pdev)
 
         IWL_DEBUG_INFO("*** UNLOAD DRIVER ***\n");
 
-        mutex_lock(&priv->mutex);
         set_bit(STATUS_EXIT_PENDING, &priv->status);
-        __iwl_down(priv);
-        mutex_unlock(&priv->mutex);
+
+        iwl_down(priv);
 
         /* Free MAC hash list for ADHOC */
         for (i = 0; i < IWL_IBSS_MAC_HASH_SIZE; i++) {
@@ -8631,12 +8646,10 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct iwl_priv *priv = pci_get_drvdata(pdev);
 
-        mutex_lock(&priv->mutex);
-
         set_bit(STATUS_IN_SUSPEND, &priv->status);
 
         /* Take down the device; powers it off, etc. */
-        __iwl_down(priv);
+        iwl_down(priv);
 
         if (priv->mac80211_registered)
                 ieee80211_stop_queues(priv->hw);
@@ -8645,8 +8658,6 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         pci_disable_device(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
-        mutex_unlock(&priv->mutex);
-
         return 0;
 }
 
@@ -8704,8 +8715,6 @@ static int iwl_pci_resume(struct pci_dev *pdev)
 
         printk(KERN_INFO "Coming out of suspend...\n");
 
-        mutex_lock(&priv->mutex);
-
         pci_set_power_state(pdev, PCI_D0);
         err = pci_enable_device(pdev);
         pci_restore_state(pdev);
@@ -8719,7 +8728,6 @@ static int iwl_pci_resume(struct pci_dev *pdev)
         pci_write_config_byte(pdev, 0x41, 0x00);
 
         iwl_resume(priv);
-        mutex_unlock(&priv->mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 9918780f5e86..15a45f471710 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -3003,6 +3003,10 @@ static void iwl_set_rate(struct iwl_priv *priv)
         int i;
 
         hw = iwl_get_hw_mode(priv, priv->phymode);
+        if (!hw) {
+                IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+                return;
+        }
 
         priv->active_rate = 0;
         priv->active_rate_basic = 0;
@@ -5055,8 +5059,10 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                  *   when we loaded driver, and is now set to "enable".
                  * After we're Alive, RF_KILL gets handled by
                  *   iwl_rx_card_state_notif() */
-                if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status))
+                if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status)) {
+                        clear_bit(STATUS_RF_KILL_HW, &priv->status);
                         queue_work(priv->workqueue, &priv->restart);
+                }
 
                 handled |= CSR_INT_BIT_RF_KILL;
         }
@@ -6523,6 +6529,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 mutex_lock(&priv->mutex);
 
                 if (rc) {
+                        iwl_rate_control_unregister(priv->hw);
                         IWL_ERROR("Failed to register network "
                                   "device (error %d)\n", rc);
                         return;
@@ -6594,8 +6601,6 @@ static void __iwl_down(struct iwl_priv *priv)
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
 
-        iwl_cancel_deferred_work(priv);
-
         /* Wipe out the EXIT_PENDING status bit if we are not actually
          * exiting the module */
         if (!exit_pending)
@@ -6670,6 +6675,8 @@ static void iwl_down(struct iwl_priv *priv)
         mutex_lock(&priv->mutex);
         __iwl_down(priv);
         mutex_unlock(&priv->mutex);
+
+        iwl_cancel_deferred_work(priv);
 }
 
 #define MAX_HW_RESTARTS 5
@@ -6691,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv)
                 return 0;
         }
 
+        if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+                IWL_ERROR("ucode not available for device bringup\n");
+                return -EIO;
+        }
+
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
         rc = iwl_hw_nic_init(priv);
@@ -7326,9 +7338,6 @@ static int iwl_mac_add_interface(struct ieee80211_hw *hw,
         DECLARE_MAC_BUF(mac);
 
         IWL_DEBUG_MAC80211("enter: id %d, type %d\n", conf->if_id, conf->type);
-        if (conf->mac_addr)
-                IWL_DEBUG_MAC80211("enter: MAC %s\n",
-                                   print_mac(mac, conf->mac_addr));
 
         if (priv->interface_id) {
                 IWL_DEBUG_MAC80211("leave - interface_id != 0\n");
@@ -7341,6 +7350,11 @@ static int iwl_mac_add_interface(struct ieee80211_hw *hw,
         spin_unlock_irqrestore(&priv->lock, flags);
 
         mutex_lock(&priv->mutex);
+
+        if (conf->mac_addr) {
+                IWL_DEBUG_MAC80211("Set %s\n", print_mac(mac, conf->mac_addr));
+                memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
+        }
         iwl_set_mode(priv, conf->type);
 
         IWL_DEBUG_MAC80211("leave\n");
@@ -8864,6 +8878,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 {
         iwl_hw_cancel_deferred_work(priv);
 
+        cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
         cancel_delayed_work(&priv->post_associate);
@@ -9164,10 +9179,9 @@ static void iwl_pci_remove(struct pci_dev *pdev)
 
         IWL_DEBUG_INFO("*** UNLOAD DRIVER ***\n");
 
-        mutex_lock(&priv->mutex);
         set_bit(STATUS_EXIT_PENDING, &priv->status);
-        __iwl_down(priv);
-        mutex_unlock(&priv->mutex);
+
+        iwl_down(priv);
 
         /* Free MAC hash list for ADHOC */
         for (i = 0; i < IWL_IBSS_MAC_HASH_SIZE; i++) {
@@ -9226,12 +9240,10 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct iwl_priv *priv = pci_get_drvdata(pdev);
 
-        mutex_lock(&priv->mutex);
-
         set_bit(STATUS_IN_SUSPEND, &priv->status);
 
         /* Take down the device; powers it off, etc. */
-        __iwl_down(priv);
+        iwl_down(priv);
 
         if (priv->mac80211_registered)
                 ieee80211_stop_queues(priv->hw);
@@ -9240,8 +9252,6 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         pci_disable_device(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
-        mutex_unlock(&priv->mutex);
-
         return 0;
 }
 
@@ -9299,8 +9309,6 @@ static int iwl_pci_resume(struct pci_dev *pdev)
 
         printk(KERN_INFO "Coming out of suspend...\n");
 
-        mutex_lock(&priv->mutex);
-
         pci_set_power_state(pdev, PCI_D0);
         err = pci_enable_device(pdev);
         pci_restore_state(pdev);
@@ -9314,7 +9322,6 @@ static int iwl_pci_resume(struct pci_dev *pdev)
         pci_write_config_byte(pdev, 0x41, 0x00);
 
         iwl_resume(priv);
-        mutex_unlock(&priv->mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index ec89dabc412c..ba4fc2b3bf0a 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -170,7 +170,8 @@ static int if_cs_poll_while_fw_download(struct if_cs_card *card, uint addr, u8 r
 #define IF_CS_H_IC_TX_OVER              0x0001
 #define IF_CS_H_IC_RX_OVER              0x0002
 #define IF_CS_H_IC_DNLD_OVER            0x0004
-#define IF_CS_H_IC_HOST_EVENT           0x0008
+#define IF_CS_H_IC_POWER_DOWN           0x0008
+#define IF_CS_H_IC_HOST_EVENT           0x0010
 #define IF_CS_H_IC_MASK                 0x001f
 
 #define IF_CS_H_INT_MASK                0x00000004
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index b24425f74883..4f1efb108c28 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -871,6 +871,10 @@ static int if_sdio_probe(struct sdio_func *func,
                 if (sscanf(func->card->info[i],
                                 "ID: %x", &model) == 1)
                         break;
+               if (!strcmp(func->card->info[i], "IBIS Wireless SDIO Card")) {
+                       model = 4;
+                       break;
+               }
         }
 
         if (i == func->card->num_info) {
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 5ead08312e1e..1823b48a8ba7 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1165,8 +1165,6 @@ wlan_private *libertas_add_card(void *card, struct device *dmdev)
 #ifdef  WIRELESS_EXT
         dev->wireless_handlers = (struct iw_handler_def *)&libertas_handler_def;
 #endif
-#define NETIF_F_DYNALLOC 16
-        dev->features |= NETIF_F_DYNALLOC;
         dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
         dev->set_multicast_list = libertas_set_multicast_list;
 
@@ -1348,8 +1346,6 @@ int libertas_add_mesh(wlan_private *priv, struct device *dev)
 #ifdef  WIRELESS_EXT
         mesh_dev->wireless_handlers = (struct iw_handler_def *)&mesh_handler_def;
 #endif
-#define NETIF_F_DYNALLOC 16
-
         /* Register virtual mesh interface */
         ret = register_netdev(mesh_dev);
         if (ret) {
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index c6f5aa3cb465..395b7882d4d6 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -1528,7 +1528,7 @@ static int wlan_set_encodeext(struct net_device *dev,
                         && (ext->key_len != KEY_LEN_WPA_TKIP))
                     || ((alg == IW_ENCODE_ALG_CCMP)
                         && (ext->key_len != KEY_LEN_WPA_AES))) {
-                                lbs_deb_wext("invalid size %d for key of alg"
+                                lbs_deb_wext("invalid size %d for key of alg "
                                        "type %d\n",
                                        ext->key_len,
                                        alg);
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
index 2402cb8dd328..d2fa079fbc4c 100644
--- a/drivers/net/wireless/netwave_cs.c
+++ b/drivers/net/wireless/netwave_cs.c
@@ -806,7 +806,7 @@ static int netwave_pcmcia_config(struct pcmcia_device *link) {
     for (i = 0; i < 6; i++) 
         dev->dev_addr[i] = readb(ramBase + NETWAVE_EREG_PA + i);
 
-    printk(KERN_INFO "%s: Netwave: port %#3lx, irq %d, mem %lx"
+    printk(KERN_INFO "%s: Netwave: port %#3lx, irq %d, mem %lx, "
            "id %c%c, hw_addr %s\n",
            dev->name, dev->base_addr, dev->irq,
            (u_long) ramBase,
diff --git a/drivers/net/wireless/p54usb.c b/drivers/net/wireless/p54usb.c
index 755482a5a938..60d286eb0b8b 100644
--- a/drivers/net/wireless/p54usb.c
+++ b/drivers/net/wireless/p54usb.c
@@ -308,7 +308,7 @@ static int p54u_read_eeprom(struct ieee80211_hw *dev)
 
         buf = kmalloc(0x2020, GFP_KERNEL);
         if (!buf) {
-                printk(KERN_ERR "prism54usb: cannot allocate memory for"
+                printk(KERN_ERR "prism54usb: cannot allocate memory for "
                        "eeprom readback!\n");
                 return -ENOMEM;
         }
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 277a020b35e9..18b1f9145389 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -257,7 +257,7 @@ static const struct rt2x00debug rt2500usb_rt2x00debug = {
 static void rt2500usb_config_mac_addr(struct rt2x00_dev *rt2x00dev,
                                       __le32 *mac)
 {
-        rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, &mac,
+        rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, mac,
                                       (3 * sizeof(__le16)));
 }
 
@@ -1032,7 +1032,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 }
 
 static int rt2500usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
-                                     int maxpacket, struct sk_buff *skb)
+                                     struct sk_buff *skb)
 {
         int length;
 
@@ -1041,7 +1041,7 @@ static int rt2500usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
          * but it must _not_ be a multiple of the USB packet size.
          */
         length = roundup(skb->len, 2);
-        length += (2 * !(length % maxpacket));
+        length += (2 * !(length % rt2x00dev->usb_maxpacket));
 
         return length;
 }
@@ -1643,7 +1643,6 @@ static int rt2500usb_beacon_update(struct ieee80211_hw *hw,
         struct data_entry *beacon;
         struct data_entry *guardian;
         int pipe = usb_sndbulkpipe(usb_dev, 1);
-        int max_packet = usb_maxpacket(usb_dev, pipe, 1);
         int length;
 
         /*
@@ -1672,7 +1671,7 @@ static int rt2500usb_beacon_update(struct ieee80211_hw *hw,
                                                          ring->desc_size),
                                 skb->len - ring->desc_size, control);
 
-        length = rt2500usb_get_tx_data_len(rt2x00dev, max_packet, skb);
+        length = rt2500usb_get_tx_data_len(rt2x00dev, skb);
 
         usb_fill_bulk_urb(beacon->priv, usb_dev, pipe,
                           skb->data, length, rt2500usb_beacondone, beacon);
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index d1ad5251a77a..c8f16f161c28 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -418,7 +418,7 @@ struct rt2x00lib_ops {
         int (*write_tx_data) (struct rt2x00_dev *rt2x00dev,
                               struct data_ring *ring, struct sk_buff *skb,
                               struct ieee80211_tx_control *control);
-        int (*get_tx_data_len) (struct rt2x00_dev *rt2x00dev, int maxpacket,
+        int (*get_tx_data_len) (struct rt2x00_dev *rt2x00dev,
                                 struct sk_buff *skb);
         void (*kick_tx_queue) (struct rt2x00_dev *rt2x00dev,
                                unsigned int queue);
@@ -599,6 +599,11 @@ struct rt2x00_dev {
         u32 *rf;
 
         /*
+         * USB Max frame size (for rt2500usb & rt73usb).
+         */
+        u16 usb_maxpacket;
+
+        /*
          * Current TX power value.
          */
         u16 tx_power;
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 2780df00623c..04663eb31950 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -124,7 +124,10 @@ void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
         struct data_entry *entry;
         struct data_desc *rxd;
         struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
         struct rxdata_entry_desc desc;
+        int header_size;
+        int align;
         u32 word;
 
         while (1) {
@@ -138,17 +141,26 @@ void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
                 memset(&desc, 0x00, sizeof(desc));
                 rt2x00dev->ops->lib->fill_rxdone(entry, &desc);
 
+                hdr = (struct ieee80211_hdr *)entry->data_addr;
+                header_size =
+                    ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
+
+                /*
+                 * The data behind the ieee80211 header must be
+                 * aligned on a 4 byte boundary.
+                 */
+                align = header_size % 4;
+
                 /*
                  * Allocate the sk_buffer, initialize it and copy
                  * all data into it.
                  */
-                skb = dev_alloc_skb(desc.size + NET_IP_ALIGN);
+                skb = dev_alloc_skb(desc.size + align);
                 if (!skb)
                         return;
 
-                skb_reserve(skb, NET_IP_ALIGN);
-                skb_put(skb, desc.size);
-                memcpy(skb->data, entry->data_addr, desc.size);
+                skb_reserve(skb, align);
+                memcpy(skb_put(skb, desc.size), entry->data_addr, desc.size);
 
                 /*
                  * Send the frame to rt2x00lib for further processing.
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 73cc726c4046..568d73847dca 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -159,7 +159,6 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
             interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
         struct data_entry *entry = rt2x00_get_data_entry(ring);
         int pipe = usb_sndbulkpipe(usb_dev, 1);
-        int max_packet = usb_maxpacket(usb_dev, pipe, 1);
         u32 length;
 
         if (rt2x00_ring_full(ring)) {
@@ -194,8 +193,7 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
          * length of the data to usb_fill_bulk_urb. Pass the skb
          * to the driver to determine what the length should be.
          */
-        length = rt2x00dev->ops->lib->get_tx_data_len(rt2x00dev,
-                                                      max_packet, skb);
+        length = rt2x00dev->ops->lib->get_tx_data_len(rt2x00dev, skb);
 
         /*
          * Initialize URB and send the frame to the device.
@@ -223,7 +221,9 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         struct data_ring *ring = entry->ring;
         struct rt2x00_dev *rt2x00dev = ring->rt2x00dev;
         struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
         struct rxdata_entry_desc desc;
+        int header_size;
         int frame_size;
 
         if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags) ||
@@ -245,19 +245,37 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
          * Allocate a new sk buffer to replace the current one.
          * If allocation fails, we should drop the current frame
          * so we can recycle the existing sk buffer for the new frame.
+         * As alignment we use 2 and not NET_IP_ALIGN because we need
+         * to be sure we have 2 bytes room in the head. (NET_IP_ALIGN
+         * can be 0 on some hardware). We use these 2 bytes for frame
+         * alignment later, we assume that the chance that
+         * header_size % 4 == 2 is bigger then header_size % 2 == 0
+         * and thus optimize alignment by reserving the 2 bytes in
+         * advance.
          */
         frame_size = entry->ring->data_size + entry->ring->desc_size;
-        skb = dev_alloc_skb(frame_size + NET_IP_ALIGN);
+        skb = dev_alloc_skb(frame_size + 2);
         if (!skb)
                 goto skip_entry;
 
-        skb_reserve(skb, NET_IP_ALIGN);
+        skb_reserve(skb, 2);
         skb_put(skb, frame_size);
 
         /*
-         * Trim the skb_buffer to only contain the valid
-         * frame data (so ignore the device's descriptor).
+         * The data behind the ieee80211 header must be
+         * aligned on a 4 byte boundary.
+         * After that trim the entire buffer down to only
+         * contain the valid frame data excluding the device
+         * descriptor.
          */
+        hdr = (struct ieee80211_hdr *)entry->skb->data;
+        header_size =
+            ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
+
+        if (header_size % 4 == 0) {
+                skb_push(entry->skb, 2);
+                memmove(entry->skb->data, entry->skb->data + 2, skb->len - 2);
+        }
         skb_trim(entry->skb, desc.size);
 
         /*
@@ -490,6 +508,11 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
 
+        rt2x00dev->usb_maxpacket =
+            usb_maxpacket(usb_dev, usb_sndbulkpipe(usb_dev, 1), 1);
+        if (!rt2x00dev->usb_maxpacket)
+                rt2x00dev->usb_maxpacket = 1;
+
         retval = rt2x00usb_alloc_reg(rt2x00dev);
         if (retval)
                 goto exit_free_device;
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 01dbef19d651..ecae968ce091 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1738,6 +1738,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_ring *ring;
         struct data_entry *entry;
+        struct data_entry *entry_done;
         struct data_desc *txd;
         u32 word;
         u32 reg;
@@ -1791,6 +1792,17 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                     !rt2x00_get_field32(word, TXD_W0_VALID))
                         return;
 
+                entry_done = rt2x00_get_data_entry_done(ring);
+                while (entry != entry_done) {
+                        /* Catch up. Just report any entries we missed as
+                         * failed. */
+                        WARNING(rt2x00dev,
+                                "TX status report missed for entry %p\n",
+                                entry_done);
+                        rt2x00lib_txdone(entry_done, TX_FAIL_OTHER, 0);
+                        entry_done = rt2x00_get_data_entry_done(ring);
+                }
+
                 /*
                  * Obtain the status about this packet.
                  */
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index dc640bf6b5eb..c0671c2e6e73 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1251,7 +1251,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 }
 
 static int rt73usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
-                                   int maxpacket, struct sk_buff *skb)
+                                   struct sk_buff *skb)
 {
         int length;
 
@@ -1260,7 +1260,7 @@ static int rt73usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
          * but it must _not_ be a multiple of the USB packet size.
          */
         length = roundup(skb->len, 4);
-        length += (4 * !(length % maxpacket));
+        length += (4 * !(length % rt2x00dev->usb_maxpacket));
 
         return length;
 }
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index e454ae83e97a..bd1ab3b3afc0 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -38,6 +38,8 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x0846, 0x6a00)},
         /* HP */
         {USB_DEVICE(0x03f0, 0xca02)},
+        /* Sitecom */
+        {USB_DEVICE(0x0df6, 0x000d)},
         {}
 };
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index a903645e157a..5298a8bf1129 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -1130,6 +1130,8 @@ static void zd_mac_rx(struct zd_mac *mac, struct sk_buff *skb)
         __skb_trim(skb, skb->len -
                         (IEEE80211_FCS_LEN + sizeof(struct rx_status)));
 
+        ZD_ASSERT(IS_ALIGNED((unsigned long)skb->data, 4));
+
         update_qual_rssi(mac, skb->data, skb->len, stats.signal,
                          status->signal_strength);
 
@@ -1166,15 +1168,19 @@ static void do_rx(unsigned long mac_ptr)
 int zd_mac_rx_irq(struct zd_mac *mac, const u8 *buffer, unsigned int length)
 {
         struct sk_buff *skb;
+        unsigned int reserved =
+                ALIGN(max_t(unsigned int,
+                            sizeof(struct zd_rt_hdr), ZD_PLCP_HEADER_SIZE), 4) -
+                ZD_PLCP_HEADER_SIZE;
 
-        skb = dev_alloc_skb(sizeof(struct zd_rt_hdr) + length);
+        skb = dev_alloc_skb(reserved + length);
         if (!skb) {
                 struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
                 dev_warn(zd_mac_dev(mac), "Could not allocate skb.\n");
                 ieee->stats.rx_dropped++;
                 return -ENOMEM;
         }
-        skb_reserve(skb, sizeof(struct zd_rt_hdr));
+        skb_reserve(skb, reserved);
         memcpy(__skb_put(skb, length), buffer, length);
         skb_queue_tail(&mac->rx_queue, skb);
         tasklet_schedule(&mac->rx_tasklet);