19 files changed, 111 insertions, 49 deletions

diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 8c381c696a3d..ec05149a9065 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -670,8 +670,7 @@ static int setup_sge_qsets(struct adapter *adap)
                 struct port_info *pi = netdev_priv(dev);
 
                 pi->qs = &adap->sge.qs[pi->first_qset];
-                for (j = pi->first_qset; j < pi->first_qset + pi->nqsets;
-                     ++j, ++qset_idx) {
+                for (j = 0; j < pi->nqsets; ++j, ++qset_idx) {
                         set_qset_lro(dev, qset_idx, pi->rx_offload & T3_LRO);
                         err = t3_sge_alloc_qset(adap, qset_idx, 1,
                                 (adap->flags & USING_MSIX) ? qset_idx + 1 :
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 2df8fb0af701..12fd446f9895 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -1820,11 +1820,19 @@ static int emac_dev_setmac_addr(struct net_device *ndev, void *addr)
         struct device *emac_dev = &priv->ndev->dev;
         struct sockaddr *sa = addr;
 
+        if (!is_valid_ether_addr(sa->sa_data))
+                return -EINVAL;
+
         /* Store mac addr in priv and rx channel and set it in EMAC hw */
         memcpy(priv->mac_addr, sa->sa_data, ndev->addr_len);
-        memcpy(rxch->mac_addr, sa->sa_data, ndev->addr_len);
         memcpy(ndev->dev_addr, sa->sa_data, ndev->addr_len);
-        emac_setmac(priv, EMAC_DEF_RX_CH, rxch->mac_addr);
+
+        /* If the interface is down - rxch is NULL. */
+        /* MAC address is configured only after the interface is enabled. */
+        if (netif_running(ndev)) {
+                memcpy(rxch->mac_addr, sa->sa_data, ndev->addr_len);
+                emac_setmac(priv, EMAC_DEF_RX_CH, rxch->mac_addr);
+        }
 
         if (netif_msg_drv(priv))
                 dev_notice(emac_dev, "DaVinci EMAC: emac_dev_setmac_addr %pM\n",
diff --git a/drivers/net/fec.h b/drivers/net/fec.h
index 30b7dd671336..cc47f3f057c7 100644
--- a/drivers/net/fec.h
+++ b/drivers/net/fec.h
@@ -46,12 +46,12 @@
 
 #else
 
-#define FEC_ECNTRL;             0x000 /* Ethernet control reg */
-#define FEC_IEVENT;             0x004 /* Interrupt even reg */
-#define FEC_IMASK;              0x008 /* Interrupt mask reg */
-#define FEC_IVEC;               0x00c /* Interrupt vec status reg */
-#define FEC_R_DES_ACTIVE;       0x010 /* Receive descriptor reg */
-#define FEC_X_DES_ACTIVE;       0x01c /* Transmit descriptor reg */
+#define FEC_ECNTRL              0x000 /* Ethernet control reg */
+#define FEC_IEVENT              0x004 /* Interrupt even reg */
+#define FEC_IMASK               0x008 /* Interrupt mask reg */
+#define FEC_IVEC                0x00c /* Interrupt vec status reg */
+#define FEC_R_DES_ACTIVE        0x010 /* Receive descriptor reg */
+#define FEC_X_DES_ACTIVE        0x014 /* Transmit descriptor reg */
 #define FEC_MII_DATA            0x040 /* MII manage frame reg */
 #define FEC_MII_SPEED           0x044 /* MII speed control reg */
 #define FEC_R_BOUND             0x08c /* FIFO receive bound reg */
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index efd9be214885..ac28dd5a4fd1 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -190,6 +190,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
                 phy->ops.write_reg          = igb_write_phy_reg_igp;
         }
 
+        /* set lan id */
+        hw->bus.func = (rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) >>
+                       E1000_STATUS_FUNC_SHIFT;
+
         /* Set phy->phy_addr and phy->id. */
         ret_val = igb_get_phy_id_82575(hw);
         if (ret_val)
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index d56890f5c9d5..7c5978ad929a 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -138,6 +138,10 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->hw.fc.requested_mode = ixgbe_fc_none;
                 }
                 adapter->flags &= ~IXGBE_FLAG_RSS_ENABLED;
+                if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+                        adapter->flags &= ~IXGBE_FLAG_FDIR_HASH_CAPABLE;
+                        adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
+                }
                 adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
                 ixgbe_init_interrupt_scheme(adapter);
                 if (netif_running(netdev))
@@ -154,6 +158,8 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->dcb_cfg.pfc_mode_enable = false;
                         adapter->flags &= ~IXGBE_FLAG_DCB_ENABLED;
                         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
+                        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                                adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                         ixgbe_init_interrupt_scheme(adapter);
                         if (netif_running(netdev))
                                 netdev->netdev_ops->ndo_open(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index a3061aacffd8..e3442f47f932 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -3130,7 +3130,11 @@ static inline bool ixgbe_set_fcoe_queues(struct ixgbe_adapter *adapter)
 #endif
                 if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
                         DPRINTK(PROBE, INFO, "FCOE enabled with RSS \n");
-                        ixgbe_set_rss_queues(adapter);
+                        if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) ||
+                            (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE))
+                                ixgbe_set_fdir_queues(adapter);
+                        else
+                                ixgbe_set_rss_queues(adapter);
                 }
                 /* adding FCoE rx rings to the end */
                 f->mask = adapter->num_rx_queues;
@@ -3388,7 +3392,12 @@ static inline bool ixgbe_cache_ring_fcoe(struct ixgbe_adapter *adapter)
                 }
 #endif /* CONFIG_IXGBE_DCB */
                 if (adapter->flags & IXGBE_FLAG_RSS_ENABLED) {
-                        ixgbe_cache_ring_rss(adapter);
+                        if ((adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) ||
+                            (adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE))
+                                ixgbe_cache_ring_fdir(adapter);
+                        else
+                                ixgbe_cache_ring_rss(adapter);
+
                         fcoe_i = f->mask;
                 }
                 for (i = 0; i < f->indices; i++, fcoe_i++)
@@ -5578,12 +5587,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                                 netdev->features |= NETIF_F_FCOE_CRC;
                                 netdev->features |= NETIF_F_FSO;
                                 netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-                                DPRINTK(DRV, INFO, "FCoE enabled, "
-                                        "disabling Flow Director\n");
-                                adapter->flags &= ~IXGBE_FLAG_FDIR_HASH_CAPABLE;
-                                adapter->flags &=
-                                        ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
-                                adapter->atr_sample_rate = 0;
                         } else {
                                 adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
                         }
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index b3197e96f323..840677f5ee82 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -49,8 +49,8 @@
 #include <asm/processor.h>
 
 #define DRV_NAME        "r6040"
-#define DRV_VERSION     "0.23"
-#define DRV_RELDATE     "05May2009"
+#define DRV_VERSION     "0.24"
+#define DRV_RELDATE     "08Jul2009"
 
 /* PHY CHIP Address */
 #define PHY1_ADDR       1       /* For MAC1 */
@@ -704,8 +704,11 @@ static irqreturn_t r6040_interrupt(int irq, void *dev_id)
         /* Read MISR status and clear */
         status = ioread16(ioaddr + MISR);
 
-        if (status == 0x0000 || status == 0xffff)
+        if (status == 0x0000 || status == 0xffff) {
+                /* Restore RDC MAC interrupt */
+                iowrite16(misr, ioaddr + MIER);
                 return IRQ_NONE;
+        }
 
         /* RX interrupt request */
         if (status & RX_INTS) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 92ffd11a7195..dfc1054e4cbd 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -486,12 +486,14 @@ static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
 {
         struct tun_file *tfile = file->private_data;
         struct tun_struct *tun = __tun_get(tfile);
-        struct sock *sk = tun->sk;
+        struct sock *sk;
         unsigned int mask = 0;
 
         if (!tun)
                 return POLLERR;
 
+        sk = tun->sk;
+
         DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name);
 
         poll_wait(file, &tun->socket.wait, wait);
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index d26e7b485315..eb0337c49546 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -1,5 +1,6 @@
 config ATH_COMMON
         tristate "Atheros Wireless Cards"
+        depends on WLAN_80211
         depends on ATH5K || ATH9K || AR9170_USB
 
 source "drivers/net/wireless/ath/ath5k/Kconfig"
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b61a071788a5..4ccf48e396df 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -355,7 +355,14 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 }
 
                 if (bf_next == NULL) {
-                        INIT_LIST_HEAD(&bf_head);
+                        /*
+                         * Make sure the last desc is reclaimed if it
+                         * not a holding desc.
+                         */
+                        if (!bf_last->bf_stale)
+                                list_move_tail(&bf->list, &bf_head);
+                        else
+                                INIT_LIST_HEAD(&bf_head);
                 } else {
                         ASSERT(!list_empty(bf_q));
                         list_move_tail(&bf->list, &bf_head);
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index f580c2812d91..40448067e4cc 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -648,6 +648,7 @@ struct b43_wl {
         u8 nr_devs;
 
         bool radiotap_enabled;
+        bool radio_enabled;
 
         /* The beacon we are currently using (AP or IBSS mode).
          * This beacon stuff is protected by the irq_lock. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 6456afebdba1..e71c8d9cd706 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3497,8 +3497,8 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         if (phy->ops->set_rx_antenna)
                 phy->ops->set_rx_antenna(dev, antenna);
 
-        if (!!conf->radio_enabled != phy->radio_on) {
-                if (conf->radio_enabled) {
+        if (wl->radio_enabled != phy->radio_on) {
+                if (wl->radio_enabled) {
                         b43_software_rfkill(dev, false);
                         b43info(dev->wl, "Radio turned on by software\n");
                         if (!dev->radio_hw_enable) {
@@ -4339,6 +4339,7 @@ static int b43_op_start(struct ieee80211_hw *hw)
         wl->beacon0_uploaded = 0;
         wl->beacon1_uploaded = 0;
         wl->beacon_templates_virgin = 1;
+        wl->radio_enabled = 1;
 
         mutex_lock(&wl->mutex);
 
@@ -4378,6 +4379,7 @@ static void b43_op_stop(struct ieee80211_hw *hw)
         if (b43_status(dev) >= B43_STAT_STARTED)
                 b43_wireless_core_stop(dev);
         b43_wireless_core_exit(dev);
+        wl->radio_enabled = 0;
         mutex_unlock(&wl->mutex);
 
         cancel_work_sync(&(wl->txpower_adjust_work));
@@ -4560,6 +4562,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
                 B43_WARN_ON(1);
 
         dev->phy.gmode = have_2ghz_phy;
+        dev->phy.radio_on = 1;
         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
         b43_wireless_core_reset(dev, tmp);
 
diff --git a/drivers/net/wireless/b43/pcmcia.c b/drivers/net/wireless/b43/pcmcia.c
index 3cfc30307a27..6c3a74964ab8 100644
--- a/drivers/net/wireless/b43/pcmcia.c
+++ b/drivers/net/wireless/b43/pcmcia.c
@@ -35,6 +35,7 @@
 
 static /*const */ struct pcmcia_device_id b43_pcmcia_tbl[] = {
         PCMCIA_DEVICE_MANF_CARD(0x2D0, 0x448),
+        PCMCIA_DEVICE_MANF_CARD(0x2D0, 0x476),
         PCMCIA_DEVICE_NULL,
 };
 
diff --git a/drivers/net/wireless/b43legacy/b43legacy.h b/drivers/net/wireless/b43legacy/b43legacy.h
index 77fda148ac46..038baa8869e2 100644
--- a/drivers/net/wireless/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/b43legacy/b43legacy.h
@@ -607,6 +607,7 @@ struct b43legacy_wl {
         u8 nr_devs;
 
         bool radiotap_enabled;
+        bool radio_enabled;
 
         /* The beacon we are currently using (AP or IBSS mode).
          * This beacon stuff is protected by the irq_lock. */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index e5136fb65ddd..c4973c1942bf 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2689,8 +2689,8 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         /* Antennas for RX and management frame TX. */
         b43legacy_mgmtframe_txantenna(dev, antenna_tx);
 
-        if (!!conf->radio_enabled != phy->radio_on) {
-                if (conf->radio_enabled) {
+        if (wl->radio_enabled != phy->radio_on) {
+                if (wl->radio_enabled) {
                         b43legacy_radio_turn_on(dev);
                         b43legacyinfo(dev->wl, "Radio turned on by software\n");
                         if (!dev->radio_hw_enable)
@@ -3441,6 +3441,7 @@ static int b43legacy_op_start(struct ieee80211_hw *hw)
         wl->beacon0_uploaded = 0;
         wl->beacon1_uploaded = 0;
         wl->beacon_templates_virgin = 1;
+        wl->radio_enabled = 1;
 
         mutex_lock(&wl->mutex);
 
@@ -3479,6 +3480,7 @@ static void b43legacy_op_stop(struct ieee80211_hw *hw)
         if (b43legacy_status(dev) >= B43legacy_STAT_STARTED)
                 b43legacy_wireless_core_stop(dev);
         b43legacy_wireless_core_exit(dev);
+        wl->radio_enabled = 0;
         mutex_unlock(&wl->mutex);
 }
 
@@ -3620,6 +3622,7 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
                 have_bphy = 1;
 
         dev->phy.gmode = (have_gphy || have_bphy);
+        dev->phy.radio_on = 1;
         tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
         b43legacy_wireless_core_reset(dev, tmp);
 
diff --git a/drivers/net/wireless/iwmc3200wifi/Kconfig b/drivers/net/wireless/iwmc3200wifi/Kconfig
index 1eccb6df46dd..030401d367d3 100644
--- a/drivers/net/wireless/iwmc3200wifi/Kconfig
+++ b/drivers/net/wireless/iwmc3200wifi/Kconfig
@@ -4,6 +4,15 @@ config IWM
         depends on CFG80211
         select WIRELESS_EXT
         select FW_LOADER
+        help
+          The Intel Wireless Multicomm 3200 hardware is a combo
+          card with GPS, Bluetooth, WiMax and 802.11 radios. It
+          runs over SDIO and is typically found on Moorestown
+          based platform. This driver takes care of the 802.11
+          part, which is a fullmac one.
+
+          If you choose to build it as a module, it'll be called
+          iwmc3200wifi.ko.
 
 config IWM_DEBUG
         bool "Enable full debugging output in iwmc3200wifi"
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 55f77ad85304..c47ef48f31c5 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -418,6 +418,7 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                         continue;
 
                 if (!data2->started || !hwsim_ps_rx_ok(data2, skb) ||
+                    !data->channel || !data2->channel ||
                     data->channel->center_freq != data2->channel->center_freq ||
                     !(data->group & data2->group))
                         continue;
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index b618bd14583f..22ca122bd798 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -823,30 +823,30 @@ void p54_free_skb(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_tx_info *range;
         unsigned long flags;
 
-        if (unlikely(!skb || !dev || skb_queue_empty(&priv->tx_queue)))
+        if (unlikely(!skb || !dev || !skb_queue_len(&priv->tx_queue)))
                 return;
 
-        /* There used to be a check here to see if the SKB was on the
-         * TX queue or not.  This can never happen because all SKBs we
-         * see here successfully went through p54_assign_address()
-         * which means the SKB is on the ->tx_queue.
+        /*
+         * don't try to free an already unlinked skb
          */
+        if (unlikely((!skb->next) || (!skb->prev)))
+                return;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
         info = IEEE80211_SKB_CB(skb);
         range = (void *)info->rate_driver_data;
-        if (!skb_queue_is_first(&priv->tx_queue, skb)) {
+        if (skb->prev != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *ni;
                 struct p54_tx_info *mr;
 
-                ni = IEEE80211_SKB_CB(skb_queue_prev(&priv->tx_queue, skb));
+                ni = IEEE80211_SKB_CB(skb->prev);
                 mr = (struct p54_tx_info *)ni->rate_driver_data;
         }
-        if (!skb_queue_is_last(&priv->tx_queue, skb)) {
+        if (skb->next != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *ni;
                 struct p54_tx_info *mr;
 
-                ni = IEEE80211_SKB_CB(skb_queue_next(&priv->tx_queue, skb));
+                ni = IEEE80211_SKB_CB(skb->next);
                 mr = (struct p54_tx_info *)ni->rate_driver_data;
         }
         __skb_unlink(skb, &priv->tx_queue);
@@ -864,13 +864,15 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
         unsigned long flags;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
-        skb_queue_walk(&priv->tx_queue, entry) {
+        entry = priv->tx_queue.next;
+        while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
 
                 if (hdr->req_id == req_id) {
                         spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
                         return entry;
                 }
+                entry = entry->next;
         }
         spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
         return NULL;
@@ -888,33 +890,36 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         int count, idx;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
-        skb_queue_walk(&priv->tx_queue, entry) {
+        entry = (struct sk_buff *) priv->tx_queue.next;
+        while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
                 struct p54_tx_data *entry_data;
                 unsigned int pad = 0, frame_len;
 
                 range = (void *)info->rate_driver_data;
-                if (range->start_addr != addr)
+                if (range->start_addr != addr) {
+                        entry = entry->next;
                         continue;
+                }
 
-                if (!skb_queue_is_last(&priv->tx_queue, entry)) {
+                if (entry->next != (struct sk_buff *)&priv->tx_queue) {
                         struct ieee80211_tx_info *ni;
                         struct p54_tx_info *mr;
 
-                        ni = IEEE80211_SKB_CB(skb_queue_next(&priv->tx_queue,
-                                                             entry));
+                        ni = IEEE80211_SKB_CB(entry->next);
                         mr = (struct p54_tx_info *)ni->rate_driver_data;
                 }
 
                 __skb_unlink(entry, &priv->tx_queue);
-                spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
                 frame_len = entry->len;
                 entry_hdr = (struct p54_hdr *) entry->data;
                 entry_data = (struct p54_tx_data *) entry_hdr->data;
-                priv->tx_stats[entry_data->hw_queue].len--;
+                if (priv->tx_stats[entry_data->hw_queue].len)
+                        priv->tx_stats[entry_data->hw_queue].len--;
                 priv->stats.dot11ACKFailureCount += payload->tries - 1;
+                spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
                 /*
                  * Frames in P54_QUEUE_FWSCAN and P54_QUEUE_BEACON are
@@ -1164,21 +1169,23 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                 }
         }
 
-        skb_queue_walk(&priv->tx_queue, entry) {
+        entry = priv->tx_queue.next;
+        while (left--) {
                 u32 hole_size;
                 info = IEEE80211_SKB_CB(entry);
                 range = (void *)info->rate_driver_data;
                 hole_size = range->start_addr - last_addr;
                 if (!target_skb && hole_size >= len) {
-                        target_skb = skb_queue_prev(&priv->tx_queue, entry);
+                        target_skb = entry->prev;
                         hole_size -= len;
                         target_addr = last_addr;
                 }
                 largest_hole = max(largest_hole, hole_size);
                 last_addr = range->end_addr;
+                entry = entry->next;
         }
         if (!target_skb && priv->rx_end - last_addr >= len) {
-                target_skb = skb_peek_tail(&priv->tx_queue);
+                target_skb = priv->tx_queue.prev;
                 largest_hole = max(largest_hole, priv->rx_end - last_addr - len);
                 if (!skb_queue_empty(&priv->tx_queue)) {
                         info = IEEE80211_SKB_CB(target_skb);
@@ -2084,6 +2091,7 @@ out:
 static void p54_stop(struct ieee80211_hw *dev)
 {
         struct p54_common *priv = dev->priv;
+        struct sk_buff *skb;
 
         mutex_lock(&priv->conf_mutex);
         priv->mode = NL80211_IFTYPE_UNSPECIFIED;
@@ -2098,7 +2106,8 @@ static void p54_stop(struct ieee80211_hw *dev)
                 p54_tx_cancel(dev, priv->cached_beacon);
 
         priv->stop(dev);
-        skb_queue_purge(&priv->tx_queue);
+        while ((skb = skb_dequeue(&priv->tx_queue)))
+                kfree_skb(skb);
         priv->cached_beacon = NULL;
         priv->tsf_high32 = priv->tsf_low32 = 0;
         mutex_unlock(&priv->conf_mutex);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 14a19baff214..0e6e44689cc6 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -38,7 +38,6 @@ static struct usb_device_id usb_ids[] = {
         /* ZD1211 */
         { USB_DEVICE(0x0ace, 0x1211), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x0ace, 0xa211), .driver_info = DEVICE_ZD1211 },
-        { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x126f, 0xa006), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x0df6, 0x9071), .driver_info = DEVICE_ZD1211 },
@@ -61,6 +60,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x157e, 0x300a), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
+        { USB_DEVICE(0x054c, 0x0257), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0ace, 0xb215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
@@ -87,6 +87,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0df6, 0x0036), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },