libertas update

index 4fce0ba..c27ffcf 100644
@@ -460,6 +460,8 @@ static int __if_usb_submit_rx_urb(struct usb_card_rec *cardp,
 	if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
 		/* handle failure conditions */
 		lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed\n");
+		kfree_skb(skb);
+		rinfo->skb = NULL;
 		ret = -1;
 	} else {
 		/* lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB success\n"); */

@@ -667,8 +669,10 @@ static void if_usb_receive(struct urb *urb)
 		lbs_deb_usbd(&cardp->udev->dev,
 			    "Recv length = 0x%x, Recv type = 0x%X\n",
 			    recvlength, recvtype);
-	} else if (urb->status)
+	} else if (urb->status) {
+		kfree_skb(skb);
 		goto rx_exit;
+	}
 
 	switch (recvtype) {
 	case CMD_TYPE_DATA:

index d98bec9..6658590 100644
@@ -1231,7 +1231,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 		goto done;
 	}
 
-	lbs_set_cmd_ctrl_node(priv, cmdnode, cmd_oid, wait_option, pdata_buf);
+	lbs_set_cmd_ctrl_node(priv, cmdnode, wait_option, pdata_buf);
 
 	cmdptr = (struct cmd_ds_command *)cmdnode->bufvirtualaddr;
 

@@ -1404,7 +1404,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 	case CMD_802_11_INACTIVITY_TIMEOUT:
 		ret = lbs_cmd_802_11_inactivity_timeout(priv, cmdptr,
 							 cmd_action, pdata_buf);
-		lbs_set_cmd_ctrl_node(priv, cmdnode, 0, 0, pdata_buf);
+		lbs_set_cmd_ctrl_node(priv, cmdnode, 0, pdata_buf);
 		break;
 
 	case CMD_802_11_TPC_CFG:

@@ -1668,7 +1668,6 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
 	ptempnode->cmdwaitqwoken = 1;
 	wake_up_interruptible(&ptempnode->cmdwait_q);
 	ptempnode->status = 0;
-	ptempnode->cmd_oid = (u32) 0;
 	ptempnode->wait_option = 0;
 	ptempnode->pdata_buf = NULL;
 

@@ -1683,21 +1682,19 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
  *
  *  @param priv		A pointer to struct lbs_private structure
  *  @param ptempnode	A pointer to cmd_ctrl_node structure
- *  @param cmd_oid	cmd oid: treated as sub command
  *  @param wait_option	wait option: wait response or not
  *  @param pdata_buf	A pointer to informaion buffer
  *  @return 		0 or -1
  */
 void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
 		    struct cmd_ctrl_node *ptempnode,
-		    u32 cmd_oid, u16 wait_option, void *pdata_buf)
+		    u16 wait_option, void *pdata_buf)
 {
 	lbs_deb_enter(LBS_DEB_HOST);
 
 	if (!ptempnode)
 		return;
 
-	ptempnode->cmd_oid = cmd_oid;
 	ptempnode->wait_option = wait_option;
 	ptempnode->pdata_buf = pdata_buf;
 

index 74187f3..447297a 100644
@@ -26,7 +26,7 @@ struct cmd_ctrl_node *lbs_get_free_cmd_ctrl_node(struct lbs_private *priv);
 
 void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
 	struct cmd_ctrl_node *ptempnode,
-	u32 cmd_oid, u16 wait_option, void *pdata_buf);
+	u16 wait_option, void *pdata_buf);
 
 int lbs_prepare_and_send_command(struct lbs_private *priv,
 	u16 cmd_no,

index 614db6c..c029149 100644
@@ -69,8 +69,6 @@ struct cmd_ctrl_node {
 	/* CMD link list */
 	struct list_head list;
 	u32 status;
-	/* CMD ID */
-	u32 cmd_oid;
 	/*CMD wait option: wait for finish or no wait */
 	u16 wait_option;
 	/* command parameter */

index 447297a..201ec60 100644
@@ -86,5 +86,6 @@ int lbs_stop_card(struct lbs_private *priv);
 int lbs_add_mesh(struct lbs_private *priv, struct device *dev);
 void lbs_remove_mesh(struct lbs_private *priv);
 int lbs_reset_device(struct lbs_private *priv);
+void lbs_host_to_card_done(struct lbs_private *priv);
 
 #endif

index 5fadcc0..54b1ba3 100644
@@ -253,19 +253,13 @@ static irqreturn_t if_cs_interrupt(int irq, void *data)
 		/* Not for us */
 		return IRQ_NONE;
 
-	} else if(int_cause == 0xffff) {
+	} else if (int_cause == 0xffff) {
 		/* Read in junk, the card has probably been removed */
 		card->priv->adapter->surpriseremoved = 1;
 
 	} else {
-		if(int_cause & IF_CS_H_IC_TX_OVER) {
-			card->priv->dnld_sent = DNLD_RES_RECEIVED;
-			if (!card->priv->adapter->cur_cmd)
-				wake_up_interruptible(&card->priv->waitq);
-
-			if (card->priv->adapter->connect_status == LBS_CONNECTED)
-				netif_wake_queue(card->priv->dev);
-		}
+		if (int_cause & IF_CS_H_IC_TX_OVER)
+			lbs_host_to_card_done(card->priv);
 
 		/* clear interrupt */
 		if_cs_write16(card, IF_CS_C_INT_CAUSE, int_cause & IF_CS_C_IC_MASK);

index 437f3dd..0f0296b 100644
@@ -835,12 +835,9 @@ static void if_sdio_interrupt(struct sdio_func *func)
 	 * Ignore the define name, this really means the card has
 	 * successfully received the command.
 	 */
-	if (cause & IF_SDIO_H_INT_DNLD) {
-		if ((card->priv->dnld_sent == DNLD_DATA_SENT) &&
-			(card->priv->adapter->connect_status == LBS_CONNECTED))
-			netif_wake_queue(card->priv->dev);
-		card->priv->dnld_sent = DNLD_RES_RECEIVED;
-	}
+	if (cause & IF_SDIO_H_INT_DNLD)
+		lbs_host_to_card_done(card->priv);
+
 
 	if (cause & IF_SDIO_H_INT_UPLD) {
 		ret = if_sdio_card_to_host(card);

index c27ffcf..418dcab 100644
@@ -66,22 +66,8 @@ static void if_usb_write_bulk_callback(struct urb *urb)
 		/* Used for both firmware TX and regular TX.  priv isn't
 		 * valid at firmware load time.
 		 */
-		if (priv) {
-			struct lbs_adapter *adapter = priv->adapter;
-			struct net_device *dev = priv->dev;
-
-			priv->dnld_sent = DNLD_RES_RECEIVED;
-
-			/* Wake main thread if commands are pending */
-			if (!adapter->cur_cmd)
-				wake_up_interruptible(&priv->waitq);
-
-			if (adapter->connect_status == LBS_CONNECTED)
-				netif_wake_queue(dev);
-
-			if (priv->mesh_dev && (adapter->mesh_connect_status == LBS_CONNECTED))
-				netif_wake_queue(priv->mesh_dev);
-		}
+		if (priv)
+			lbs_host_to_card_done(priv);
 	} else {
 		/* print the failure status number for debug */
 		lbs_pr_info("URB in failure status: %d\n", urb->status);

index 67b6d79..ed02c02 100644
@@ -616,6 +616,24 @@ static void lbs_tx_timeout(struct net_device *dev)
 	lbs_deb_leave(LBS_DEB_TX);
 }
 
+void lbs_host_to_card_done(struct lbs_private *priv)
+{
+	struct lbs_adapter *adapter = priv->adapter;
+
+	priv->dnld_sent = DNLD_RES_RECEIVED;
+
+	/* Wake main thread if commands are pending */
+	if (!adapter->cur_cmd)
+		wake_up_interruptible(&priv->waitq);
+
+	if (priv->dev && adapter->connect_status == LBS_CONNECTED)
+		netif_wake_queue(priv->dev);
+
+	if (priv->mesh_dev && adapter->mesh_connect_status == LBS_CONNECTED)
+		netif_wake_queue(priv->mesh_dev);
+}
+EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
+
 /**
  *  @brief This function returns the network statistics
  *

index 90f1c49..cbd28ee 100644
@@ -856,13 +856,6 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		goto done;
 	}
 
-	if (adapter->cur_cmd->cmdflags & CMD_F_HOSTCMD) {
-		/* Copy the response back to response buffer */
-		memcpy(adapter->cur_cmd->pdata_buf, resp,
-		       le16_to_cpu(resp->size));
-		adapter->cur_cmd->cmdflags &= ~CMD_F_HOSTCMD;
-	}
-
 	/* If the command is not successful, cleanup and return failure */
 	if ((result != 0 || !(respcmd & 0x8000))) {
 		lbs_deb_host("CMD_RESP: error 0x%04x in command reply 0x%04x\n",

index c029149..217ae12 100644
@@ -75,7 +75,6 @@ struct cmd_ctrl_node {
 	void *pdata_buf;
 	/*command data */
 	u8 *bufvirtualaddr;
-	u16 cmdflags;
 	/* wait queue */
 	u16 cmdwaitqwoken;
 	wait_queue_head_t cmdwait_q;

index 6658590..43dde7e 100644
@@ -1667,7 +1667,6 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
 		return;
 	ptempnode->cmdwaitqwoken = 1;
 	wake_up_interruptible(&ptempnode->cmdwait_q);
-	ptempnode->status = 0;
 	ptempnode->wait_option = 0;
 	ptempnode->pdata_buf = NULL;
 

index 217ae12..f096d99 100644
@@ -68,7 +68,6 @@ struct rxpd {
 struct cmd_ctrl_node {
 	/* CMD link list */
 	struct list_head list;
-	u32 status;
 	/*CMD wait option: wait for finish or no wait */
 	u16 wait_option;
 	/* command parameter */

index 43dde7e..54ef990 100644
@@ -13,6 +13,11 @@
 #include "wext.h"
 
 static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode);
+struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv);
+void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
+		    struct cmd_ctrl_node *ptempnode,
+		    u16 wait_option, void *pdata_buf);
+
 
 static u16 commands_allowed_in_ps[] = {
 	CMD_802_11_RSSI,

@@ -1220,7 +1225,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 		goto done;
 	}
 
-	cmdnode = lbs_get_free_cmd_ctrl_node(priv);
+	cmdnode = lbs_get_cmd_ctrl_node(priv);
 
 	if (cmdnode == NULL) {
 		lbs_deb_host("PREP_CMD: cmdnode is NULL\n");

@@ -1623,7 +1628,7 @@ done:
  *  @param priv		A pointer to struct lbs_private structure
  *  @return cmd_ctrl_node A pointer to cmd_ctrl_node structure or NULL
  */
-struct cmd_ctrl_node *lbs_get_free_cmd_ctrl_node(struct lbs_private *priv)
+struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv)
 {
 	struct cmd_ctrl_node *tempnode;
 	struct lbs_adapter *adapter = priv->adapter;

index 201ec60..0856cc9 100644
@@ -15,18 +15,13 @@ struct lbs_private;
 struct lbs_adapter;
 struct sk_buff;
 struct net_device;
+struct cmd_ctrl_node;
 
 int lbs_set_mac_packet_filter(struct lbs_private *priv);
 
 void lbs_send_tx_feedback(struct lbs_private *priv);
 
 int lbs_free_cmd_buffer(struct lbs_private *priv);
-struct cmd_ctrl_node;
-struct cmd_ctrl_node *lbs_get_free_cmd_ctrl_node(struct lbs_private *priv);
-
-void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
-	struct cmd_ctrl_node *ptempnode,
-	u16 wait_option, void *pdata_buf);
 
 int lbs_prepare_and_send_command(struct lbs_private *priv,
 	u16 cmd_no,

index 54ef990..9064513 100644
@@ -2007,3 +2007,99 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv, u16 psmode)
 
 	lbs_deb_leave(LBS_DEB_HOST);
 }
+
+
+/**
+ *  @brief Simple way to call firmware functions
+ *
+ *  @param priv    	A pointer to struct lbs_private structure
+ *  @param psmode  	one of the many CMD_802_11_xxxx
+ *  @param cmd          pointer to the parameters structure for above command
+ *                      (this should not include the command, size, sequence
+ *                      and result fields from struct cmd_ds_gen)
+ *  @param cmd_size     size structure pointed to by cmd
+ *  @param rsp          pointer to an area where the result should be placed
+ *  @param rsp_size     pointer to the size of the rsp area. If the firmware
+ *                      returns fewer bytes, then this *rsp_size will be
+ *                      changed to the actual size.
+ *  @return 	   	-1 in case of a higher level error, otherwise
+ *                      the result code from the firmware
+ */
+int lbs_cmd(struct lbs_private *priv,
+	u16 command,
+	void *cmd, int cmd_size,
+	void *rsp, int *rsp_size)
+{
+	struct lbs_adapter *adapter = priv->adapter;
+	struct cmd_ctrl_node *cmdnode;
+	struct cmd_ds_gen *cmdptr;
+	unsigned long flags;
+	int ret = 0;
+
+	lbs_deb_enter(LBS_DEB_HOST);
+	lbs_deb_host("rsp at %p, rsp_size at %p\n", rsp, rsp_size);
+
+	if (!adapter || !rsp_size) {
+		lbs_deb_host("PREP_CMD: adapter is NULL\n");
+		ret = -1;
+		goto done;
+	}
+
+	if (adapter->surpriseremoved) {
+		lbs_deb_host("PREP_CMD: card removed\n");
+		ret = -1;
+		goto done;
+	}
+
+	cmdnode = lbs_get_cmd_ctrl_node(priv);
+
+	if (cmdnode == NULL) {
+		lbs_deb_host("PREP_CMD: cmdnode is NULL\n");
+
+		/* Wake up main thread to execute next command */
+		wake_up_interruptible(&priv->waitq);
+		ret = -1;
+		goto done;
+	}
+
+	cmdptr = (struct cmd_ds_gen *)cmdnode->bufvirtualaddr;
+	cmdnode->wait_option = CMD_OPTION_WAITFORRSP;
+	cmdnode->pdata_buf = rsp;
+	cmdnode->pdata_size = rsp_size;
+
+	/* Set sequence number, clean result, move to buffer */
+	adapter->seqnum++;
+	cmdptr->command = cpu_to_le16(command);
+	cmdptr->size    = cmd_size + S_DS_GEN;
+	cmdptr->seqnum = cpu_to_le16(adapter->seqnum);
+	cmdptr->result = 0;
+	memcpy(cmdptr->cmdresp, cmd, cmd_size);
+
+	lbs_deb_host("PREP_CMD: command 0x%04x\n", command);
+
+	/* here was the big old switch() statement, which is now obsolete,
+	 * because the caller of lbs_cmd() sets up all of *cmd for us. */
+
+	cmdnode->cmdwaitqwoken = 0;
+	lbs_queue_cmd(adapter, cmdnode, 1);
+	wake_up_interruptible(&priv->waitq);
+
+	might_sleep();
+	wait_event_interruptible(cmdnode->cmdwait_q, cmdnode->cmdwaitqwoken);
+
+	spin_lock_irqsave(&adapter->driver_lock, flags);
+	if (adapter->cur_cmd_retcode) {
+		lbs_deb_host("PREP_CMD: command failed with return code %d\n",
+		       adapter->cur_cmd_retcode);
+		adapter->cur_cmd_retcode = 0;
+		ret = -1;
+	}
+	spin_unlock_irqrestore(&adapter->driver_lock, flags);
+
+done:
+	lbs_deb_leave_args(LBS_DEB_HOST, "ret %d", ret);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(lbs_cmd);
+
+

index cbd28ee..6a43de7 100644
@@ -799,7 +799,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
 	}
 
 	/* Store the response code to cur_cmd_retcode. */
-	adapter->cur_cmd_retcode = result;;
+	adapter->cur_cmd_retcode = result;
 
 	if (respcmd == CMD_RET(CMD_802_11_PS_MODE)) {
 		struct cmd_ds_802_11_ps_mode *psmode = &resp->params.psmode;

@@ -880,11 +880,22 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		goto done;
 	}
 
-	spin_unlock_irqrestore(&adapter->driver_lock, flags);
-
-	ret = handle_cmd_response(respcmd, resp, priv);
-
-	spin_lock_irqsave(&adapter->driver_lock, flags);
+	if (adapter->cur_cmd->pdata_size) {
+		struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
+		u16 sz = cpu_to_le16(resp->size);
+		if (sz > *adapter->cur_cmd->pdata_size) {
+			lbs_pr_err("response 0x%04x doesn't fit into "
+				"buffer (%d > %d)\n", respcmd,
+				sz, *adapter->cur_cmd->pdata_size);
+			sz = *adapter->cur_cmd->pdata_size;
+		}
+		memcpy(adapter->cur_cmd->pdata_buf, r->cmdresp, sz);
+		*adapter->cur_cmd->pdata_size = sz;
+	} else {
+		spin_unlock_irqrestore(&adapter->driver_lock, flags);
+		ret = handle_cmd_response(respcmd, resp, priv);
+		spin_lock_irqsave(&adapter->driver_lock, flags);
+	}
 	if (adapter->cur_cmd) {
 		/* Clean up and Put current command back to cmdfreeq */
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);

index 0856cc9..6f47ff0 100644
@@ -16,6 +16,7 @@ struct lbs_adapter;
 struct sk_buff;
 struct net_device;
 struct cmd_ctrl_node;
+struct cmd_ds_command;
 
 int lbs_set_mac_packet_filter(struct lbs_private *priv);
 

@@ -23,6 +24,11 @@ void lbs_send_tx_feedback(struct lbs_private *priv);
 
 int lbs_free_cmd_buffer(struct lbs_private *priv);
 
+int lbs_cmd(struct lbs_private *priv,
+	u16 command,
+	void *cmd, int cmd_size,
+	void *resp, int *resp_size);
+
 int lbs_prepare_and_send_command(struct lbs_private *priv,
 	u16 cmd_no,
 	u16 cmd_action,

index f096d99..be69ae6 100644
@@ -66,13 +66,13 @@ struct rxpd {
 };
 
 struct cmd_ctrl_node {
-	/* CMD link list */
 	struct list_head list;
-	/*CMD wait option: wait for finish or no wait */
+	/* wait for finish or not */
 	u16 wait_option;
-	/* command parameter */
+	/* command response */
 	void *pdata_buf;
-	/*command data */
+	int *pdata_size;
+	/* command data */
 	u8 *bufvirtualaddr;
 	/* wait queue */
 	u16 cmdwaitqwoken;

@@ -100,9 +100,12 @@ struct cmd_ds_gen {
 	__le16 size;
 	__le16 seqnum;
 	__le16 result;
+	void *cmdresp[0];
 };
 
 #define S_DS_GEN sizeof(struct cmd_ds_gen)
+
+
 /*
  * Define data structure for CMD_GET_HW_SPEC
  * This structure defines the response for the GET_HW_SPEC command

index fa467df..a252a8f 100644
@@ -147,7 +147,7 @@ void lbs_upload_rx_packet(struct lbs_private *priv, struct sk_buff *skb)
 		else
 			skb->protocol = eth_type_trans(skb, priv->dev);
 	}
-	skb->ip_summed = CHECKSUM_UNNECESSARY;
+	skb->ip_summed = CHECKSUM_NONE;
 	netif_rx(skb);
 }
 

index 418dcab..f858928 100644
@@ -222,6 +222,11 @@ static int if_usb_probe(struct usb_interface *intf,
 	if (lbs_start_card(priv))
 		goto err_start_card;
 
+	/* Set the boot2 version in firmware, ignoring errors. */
+	(void)lbs_prepare_and_send_command(priv, CMD_SET_BOOT2_VER,
+					   0, CMD_OPTION_WAITFORRSP, 0, NULL);
+
+
 	usb_get_dev(udev);
 	usb_set_intfdata(intf, cardp);
 

index ed02c02..a5b573c 100644
@@ -999,10 +999,6 @@ static int lbs_setup_firmware(struct lbs_private *priv)
 		priv->mesh_autostart_enabled = 0;
 	}
 
-       /* Set the boot2 version in firmware */
-       ret = lbs_prepare_and_send_command(priv, CMD_SET_BOOT2_VER,
-                                   0, CMD_OPTION_WAITFORRSP, 0, NULL);
-
 	ret = 0;
 done:
 	lbs_deb_leave_args(LBS_DEB_FW, "ret %d", ret);

index 9064513..4fc3e4b 100644
@@ -1674,6 +1674,7 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
 	wake_up_interruptible(&ptempnode->cmdwait_q);
 	ptempnode->wait_option = 0;
 	ptempnode->pdata_buf = NULL;
+	ptempnode->pdata_size = 0;
 
 	if (ptempnode->bufvirtualaddr != NULL)
 		memset(ptempnode->bufvirtualaddr, 0, MRVDRV_SIZE_OF_CMD_BUFFER);

@@ -1701,6 +1702,7 @@ void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
 
 	ptempnode->wait_option = wait_option;
 	ptempnode->pdata_buf = pdata_buf;
+	ptempnode->pdata_size = 0;
 
 	lbs_deb_leave(LBS_DEB_HOST);
 }

index 4fc3e4b..7097dcf 100644
@@ -2072,7 +2072,7 @@ int lbs_cmd(struct lbs_private *priv,
 	/* Set sequence number, clean result, move to buffer */
 	adapter->seqnum++;
 	cmdptr->command = cpu_to_le16(command);
-	cmdptr->size    = cmd_size + S_DS_GEN;
+	cmdptr->size    = cpu_to_le16(cmd_size + S_DS_GEN);
 	cmdptr->seqnum = cpu_to_le16(adapter->seqnum);
 	cmdptr->result = 0;
 	memcpy(cmdptr->cmdresp, cmd, cmd_size);

index 7097dcf..851eb3c 100644
@@ -1021,11 +1021,10 @@ void lbs_queue_cmd(struct lbs_adapter *adapter,
 	spin_lock_irqsave(&adapter->driver_lock, flags);
 
 	if (addtail) {
-		list_add_tail((struct list_head *)cmdnode,
-			      &adapter->cmdpendingq);
+		list_add_tail(&cmdnode->list, &adapter->cmdpendingq);
 		adapter->nr_cmd_pending++;
 	} else
-		list_add((struct list_head *)cmdnode, &adapter->cmdpendingq);
+		list_add(&cmdnode->list, &adapter->cmdpendingq);
 
 	spin_unlock_irqrestore(&adapter->driver_lock, flags);
 

@@ -1144,7 +1143,7 @@ void __lbs_cleanup_and_insert_cmd(struct lbs_private *priv,
 		return;
 
 	cleanup_cmdnode(ptempcmd);
-	list_add_tail((struct list_head *)ptempcmd, &adapter->cmdfreeq);
+	list_add_tail(&ptempcmd->list, &adapter->cmdfreeq);
 }
 
 static void lbs_cleanup_and_insert_cmd(struct lbs_private *priv,

@@ -1642,8 +1641,9 @@ struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv)
 	spin_lock_irqsave(&adapter->driver_lock, flags);
 
 	if (!list_empty(&adapter->cmdfreeq)) {
-		tempnode = (struct cmd_ctrl_node *)adapter->cmdfreeq.next;
-		list_del((struct list_head *)tempnode);
+		tempnode = list_first_entry(&adapter->cmdfreeq,
+					    struct cmd_ctrl_node, list);
+		list_del(&tempnode->list);
 	} else {
 		lbs_deb_host("GET_CMD_NODE: cmd_ctrl_node is not available\n");
 		tempnode = NULL;

@@ -1738,8 +1738,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
 	}
 
 	if (!list_empty(&adapter->cmdpendingq)) {
-		cmdnode = (struct cmd_ctrl_node *)
-		    adapter->cmdpendingq.next;
+		cmdnode = list_first_entry(&adapter->cmdpendingq,
+					   struct cmd_ctrl_node, list);
 	}
 
 	spin_unlock_irqrestore(&adapter->driver_lock, flags);

@@ -1803,7 +1803,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
 				    cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
 					lbs_deb_host(
 					       "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
-					list_del((struct list_head *)cmdnode);
+					list_del(&cmdnode->list);
 					lbs_cleanup_and_insert_cmd(priv, cmdnode);
 
 					ret = 0;

@@ -1814,7 +1814,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
 				    (adapter->psstate == PS_STATE_PRE_SLEEP)) {
 					lbs_deb_host(
 					       "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
-					list_del((struct list_head *)cmdnode);
+					list_del(&cmdnode->list);
 					lbs_cleanup_and_insert_cmd(priv, cmdnode);
 					adapter->needtowakeup = 1;
 

@@ -1826,7 +1826,7 @@ int lbs_execute_next_command(struct lbs_private *priv)
 				       "EXEC_NEXT_CMD: sending EXIT_PS\n");
 			}
 		}
-		list_del((struct list_head *)cmdnode);
+		list_del(&cmdnode->list);
 		lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
 			    le16_to_cpu(cmdptr->command));
 		DownloadcommandToStation(priv, cmdnode);

index 6a43de7..22a6973 100644
@@ -882,7 +882,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
 
 	if (adapter->cur_cmd->pdata_size) {
 		struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
-		u16 sz = cpu_to_le16(resp->size);
+		u16 sz = cpu_to_le16(resp->size) - S_DS_GEN;
 		if (sz > *adapter->cur_cmd->pdata_size) {
 			lbs_pr_err("response 0x%04x doesn't fit into "
 				"buffer (%d > %d)\n", respcmd,

index 54b1ba3..8508260 100644
@@ -373,6 +373,9 @@ static int if_cs_receive_cmdres(struct lbs_private *priv, u8 *data, u32 *len)
 	if (*len & 1)
 		data[*len-1] = if_cs_read8(priv->card, IF_CS_C_CMD);
 
+	/* This is a workaround for a firmware that reports too much
+	 * bytes */
+	*len -= 8;
 	ret = 0;
 out:
 	lbs_deb_leave_args(LBS_DEB_CS, "ret %d, len %d", ret, *len);

index f858928..4d89fd0 100644
@@ -101,6 +101,21 @@ static void if_usb_free(struct usb_card_rec *cardp)
 	lbs_deb_leave(LBS_DEB_USB);
 }
 
+static void if_usb_set_boot2_ver(struct lbs_private *priv)
+{
+	struct cmd_ds_set_boot2_ver b2_cmd;
+	int rsp_len = sizeof(b2_cmd);
+
+	b2_cmd.action = 0;
+	b2_cmd.version = cpu_to_le16(priv->boot2_version);
+
+	if (lbs_cmd(priv, CMD_SET_BOOT2_VER, &b2_cmd, sizeof(b2_cmd),
+		    &b2_cmd, &rsp_len)) {
+		lbs_deb_usb("Setting boot2 version failed\n");
+	}
+}
+
+
 /**
  *  @brief sets the configuration values
  *  @param ifnum	interface number

@@ -222,10 +237,7 @@ static int if_usb_probe(struct usb_interface *intf,
 	if (lbs_start_card(priv))
 		goto err_start_card;
 
-	/* Set the boot2 version in firmware, ignoring errors. */
-	(void)lbs_prepare_and_send_command(priv, CMD_SET_BOOT2_VER,
-					   0, CMD_OPTION_WAITFORRSP, 0, NULL);
-
+	if_usb_set_boot2_ver(priv);
 
 	usb_get_dev(udev);
 	usb_set_intfdata(intf, cardp);

index 851eb3c..b1ea878 100644
@@ -974,17 +974,6 @@ static int lbs_cmd_bcn_ctrl(struct lbs_private * priv,
 	return 0;
 }
 
-static int lbs_cmd_set_boot2_ver(struct lbs_private *priv,
-				struct cmd_ds_command *cmd,
-				u16 cmd_action, void *pdata_buf)
-{
-	struct cmd_ds_set_boot2_ver *boot2_ver = &cmd->params.boot2_ver;
-	cmd->command = cpu_to_le16(CMD_SET_BOOT2_VER);
-	cmd->size = cpu_to_le16(sizeof(struct cmd_ds_set_boot2_ver) + S_DS_GEN);
-	boot2_ver->version = priv->boot2_version;
-	return 0;
-}
-
 /*
  * Note: NEVER use lbs_queue_cmd() with addtail==0 other than for
  * the command timer, because it does not account for queued commands.

@@ -1470,10 +1459,6 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 		ret = lbs_cmd_mesh_access(priv, cmdptr, cmd_action, pdata_buf);
 		break;
 
-	case CMD_SET_BOOT2_VER:
-		ret = lbs_cmd_set_boot2_ver(priv, cmdptr, cmd_action, pdata_buf);
-		break;
-
 	case CMD_GET_TSF:
 		cmdptr->command = cpu_to_le16(CMD_GET_TSF);
 		cmdptr->size = cpu_to_le16(sizeof(struct cmd_ds_get_tsf) +

index 4d89fd0..d5fc7d7 100644
@@ -227,7 +227,7 @@ static int if_usb_probe(struct usb_interface *intf,
 	priv->hw_host_to_card = if_usb_host_to_card;
 	priv->hw_get_int_status = if_usb_get_int_status;
 	priv->hw_read_event_cause = if_usb_read_event_cause;
-	priv->boot2_version = udev->descriptor.bcdDevice;
+	priv->boot2_version = le16_to_cpu(udev->descriptor.bcdDevice);
 
 	/* Delay 200 ms to waiting for the FW ready */
 	if_usb_submit_rx_urb(cardp);

index 1efea63..96a34c5 100644
@@ -366,9 +366,8 @@ struct lbs_adapter {
 	struct cmd_ds_802_11_get_log logmsg;
 
 	u32 monitormode;
+	int last_scanned_channel;
 	u8 fw_ready;
-
-	u8 last_scanned_channel;
 };
 
 #endif

1,206 lines not on this page · raw message

index d5fc7d7..e9190a6 100644
@@ -424,7 +424,7 @@ static int usb_tx_block(struct usb_card_rec *cardp, u8 * payload, u16 nb)
 
 	if ((ret = usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) {
 		/*  transfer failed */
-		lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed\n");
+		lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
 		ret = -1;
 	} else {
 		/* lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb success\n"); */

@@ -462,7 +462,7 @@ static int __if_usb_submit_rx_urb(struct usb_card_rec *cardp,
 	/* lbs_deb_usbd(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb); */
 	if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
 		/* handle failure conditions */
-		lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed\n");
+		lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
 		kfree_skb(skb);
 		rinfo->skb = NULL;
 		ret = -1;

index b1ea878..ebfcb7b 100644
@@ -1659,7 +1659,8 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
 	wake_up_interruptible(&ptempnode->cmdwait_q);
 	ptempnode->wait_option = 0;
 	ptempnode->pdata_buf = NULL;
-	ptempnode->pdata_size = 0;
+	ptempnode->pdata_size = NULL;
+	ptempnode->callback = NULL;
 
 	if (ptempnode->bufvirtualaddr != NULL)
 		memset(ptempnode->bufvirtualaddr, 0, MRVDRV_SIZE_OF_CMD_BUFFER);

@@ -1687,7 +1688,8 @@ void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
 
 	ptempnode->wait_option = wait_option;
 	ptempnode->pdata_buf = pdata_buf;
-	ptempnode->pdata_size = 0;
+	ptempnode->pdata_size = NULL;
+	ptempnode->callback = NULL;
 
 	lbs_deb_leave(LBS_DEB_HOST);
 }

@@ -2012,10 +2014,26 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv, u16 psmode)
  *  @return 	   	-1 in case of a higher level error, otherwise
  *                      the result code from the firmware
  */
-int lbs_cmd(struct lbs_private *priv,
-	u16 command,
-	void *cmd, int cmd_size,
-	void *rsp, int *rsp_size)
+
+static int lbs_cmd_callback(uint16_t respcmd, struct cmd_ds_command *resp, struct lbs_private *priv)
+{ 
+	struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
+	struct lbs_adapter *adapter = priv->adapter;
+	u16 sz = cpu_to_le16(resp->size) - S_DS_GEN;
+
+	if (sz > *adapter->cur_cmd->pdata_size) {
+		lbs_pr_err("response 0x%04x doesn't fit into buffer (%d > %d)\n",
+			   respcmd, sz, *adapter->cur_cmd->pdata_size);
+		sz = *adapter->cur_cmd->pdata_size;
+	}
+	memcpy(adapter->cur_cmd->pdata_buf, r->cmdresp, sz);
+	*adapter->cur_cmd->pdata_size = sz;
+
+	return 0;
+}
+
+int lbs_cmd(struct lbs_private *priv, u16 command, void *cmd, int cmd_size,
+	    void *rsp, int *rsp_size)
 {
 	struct lbs_adapter *adapter = priv->adapter;
 	struct cmd_ctrl_node *cmdnode;

@@ -2053,6 +2071,7 @@ int lbs_cmd(struct lbs_private *priv,
 	cmdnode->wait_option = CMD_OPTION_WAITFORRSP;
 	cmdnode->pdata_buf = rsp;
 	cmdnode->pdata_size = rsp_size;
+	cmdnode->callback = lbs_cmd_callback;
 
 	/* Set sequence number, clean result, move to buffer */
 	adapter->seqnum++;

index 22a6973..20ca38c 100644
@@ -880,22 +880,15 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		goto done;
 	}
 
-	if (adapter->cur_cmd->pdata_size) {
-		struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
-		u16 sz = cpu_to_le16(resp->size) - S_DS_GEN;
-		if (sz > *adapter->cur_cmd->pdata_size) {
-			lbs_pr_err("response 0x%04x doesn't fit into "
-				"buffer (%d > %d)\n", respcmd,
-				sz, *adapter->cur_cmd->pdata_size);
-			sz = *adapter->cur_cmd->pdata_size;
-		}
-		memcpy(adapter->cur_cmd->pdata_buf, r->cmdresp, sz);
-		*adapter->cur_cmd->pdata_size = sz;
-	} else {
-		spin_unlock_irqrestore(&adapter->driver_lock, flags);
+	spin_unlock_irqrestore(&adapter->driver_lock, flags);
+
+	if (adapter->cur_cmd && adapter->cur_cmd->callback)
+		ret = adapter->cur_cmd->callback(respcmd, resp, priv);
+	else
 		ret = handle_cmd_response(respcmd, resp, priv);
-		spin_lock_irqsave(&adapter->driver_lock, flags);
-	}
+
+	spin_lock_irqsave(&adapter->driver_lock, flags);
+
 	if (adapter->cur_cmd) {
 		/* Clean up and Put current command back to cmdfreeq */
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);

index be69ae6..5ef65ae 100644
@@ -72,6 +72,7 @@ struct cmd_ctrl_node {
 	/* command response */
 	void *pdata_buf;
 	int *pdata_size;
+	int (*callback)(uint16_t respcmd, struct cmd_ds_command *resp, struct lbs_private *priv);
 	/* command data */
 	u8 *bufvirtualaddr;
 	/* wait queue */

index 377dcb5..013965d 100644
@@ -518,7 +518,7 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
 		cmd->size =
 		    cpu_to_le16(sizeof(pdomaininfo->action) + S_DS_GEN);
 		lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd,
-			(int)(cmd->size));
+			le16_to_cpu(cmd->size));
 		goto done;
 	}
 

index ebfcb7b..cf1ab8a 100644
@@ -431,7 +431,7 @@ static int lbs_cmd_802_11_snmp_mib(struct lbs_private *priv,
 		u8 mode = (u8) (size_t) pdata_buf;
 		pSNMPMIB->querytype = cpu_to_le16(CMD_ACT_SET);
 		pSNMPMIB->oid = cpu_to_le16((u16) DESIRED_BSSTYPE_I);
-		pSNMPMIB->bufsize = sizeof(u8);
+		pSNMPMIB->bufsize = cpu_to_le16(sizeof(u8));
 		if (mode == IW_MODE_ADHOC) {
 			ucTemp = SNMP_MIB_VALUE_ADHOC;
 		} else {

@@ -451,8 +451,8 @@ static int lbs_cmd_802_11_snmp_mib(struct lbs_private *priv,
 			pSNMPMIB->oid = cpu_to_le16((u16) DOT11D_I);
 
 			if (cmd_action == CMD_ACT_SET) {
-				pSNMPMIB->querytype = CMD_ACT_SET;
-				pSNMPMIB->bufsize = sizeof(u16);
+				pSNMPMIB->querytype = cpu_to_le16(CMD_ACT_SET);
+				pSNMPMIB->bufsize = cpu_to_le16(sizeof(u16));
 				ulTemp = *(u32 *)pdata_buf;
 				*((__le16 *)(pSNMPMIB->value)) =
 				    cpu_to_le16((u16) ulTemp);

@@ -484,7 +484,7 @@ static int lbs_cmd_802_11_snmp_mib(struct lbs_private *priv,
 		{
 
 			u32 ulTemp;
-			pSNMPMIB->oid = le16_to_cpu((u16) RTSTHRESH_I);
+			pSNMPMIB->oid = cpu_to_le16(RTSTHRESH_I);
 
 			if (cmd_action == CMD_ACT_GET) {
 				pSNMPMIB->querytype = cpu_to_le16(CMD_ACT_GET);

@@ -759,7 +759,7 @@ static int lbs_cmd_reg_access(struct lbs_private *priv,
 
 	offval = (struct lbs_offset_value *)pdata_buf;
 
-	switch (cmdptr->command) {
+	switch (le16_to_cpu(cmdptr->command)) {
 	case CMD_MAC_REG_ACCESS:
 		{
 			struct cmd_ds_mac_reg_access *macreg;

@@ -999,7 +999,7 @@ void lbs_queue_cmd(struct lbs_adapter *adapter,
 	}
 
 	/* Exit_PS command needs to be queued in the header always. */
-	if (cmdptr->command == CMD_802_11_PS_MODE) {
+	if (le16_to_cpu(cmdptr->command) == CMD_802_11_PS_MODE) {
 		struct cmd_ds_802_11_ps_mode *psm = &cmdptr->params.psmode;
 		if (psm->action == cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
 			if (adapter->psstate != PS_STATE_FULL_POWER)

@@ -1062,15 +1062,14 @@ static int DownloadcommandToStation(struct lbs_private *priv,
 	adapter->cur_cmd_retcode = 0;
 	spin_unlock_irqrestore(&adapter->driver_lock, flags);
 
-	cmdsize = cmdptr->size;
-	command = cpu_to_le16(cmdptr->command);
+	cmdsize = le16_to_cpu(cmdptr->size);
+	command = le16_to_cpu(cmdptr->command);
 
 	lbs_deb_host("DNLD_CMD: command 0x%04x, size %d, jiffies %lu\n",
-		    command, le16_to_cpu(cmdptr->size), jiffies);
+		    command, cmdsize, jiffies);
 	lbs_deb_hex(LBS_DEB_HOST, "DNLD_CMD", cmdnode->bufvirtualaddr, cmdsize);
 
 	cmdnode->cmdwaitqwoken = 0;
-	cmdsize = cpu_to_le16(cmdsize);
 
 	ret = priv->hw_host_to_card(priv, MVMS_CMD, (u8 *) cmdptr, cmdsize);
 

@@ -1426,9 +1425,10 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 
 #define ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN 8
 			cmdptr->size =
-			    cpu_to_le16(gpio->header.len + S_DS_GEN +
-					     ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN);
-			gpio->header.len = cpu_to_le16(gpio->header.len);
+			    cpu_to_le16(le16_to_cpu(gpio->header.len)
+				+ S_DS_GEN
+				+ ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN);
+			gpio->header.len = gpio->header.len;
 
 			ret = 0;
 			break;

@@ -2019,7 +2019,7 @@ static int lbs_cmd_callback(uint16_t respcmd, struct cmd_ds_command *resp, struc
 { 
 	struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
 	struct lbs_adapter *adapter = priv->adapter;
-	u16 sz = cpu_to_le16(resp->size) - S_DS_GEN;
+	u16 sz = le16_to_cpu(resp->size) - S_DS_GEN;
 
 	if (sz > *adapter->cur_cmd->pdata_size) {
 		lbs_pr_err("response 0x%04x doesn't fit into buffer (%d > %d)\n",

index 20ca38c..f6c1016 100644
@@ -561,7 +561,7 @@ static int lbs_ret_802_11_subscribe_event(struct lbs_private *priv,
 	lbs_deb_enter(LBS_DEB_CMD);
 
 	if (dst_event->action == cpu_to_le16(CMD_ACT_GET)) {
-		dst_event->events = le16_to_cpu(cmd_event->events);
+		dst_event->events = cmd_event->events;
 		memcpy(dst_event->tlv, cmd_event->tlv, sizeof(dst_event->tlv));
 	}
 

index 5ef65ae..efdb720 100644
@@ -419,13 +419,13 @@ struct cmd_ds_802_11_rf_antenna {
 };
 
 struct cmd_ds_802_11_monitor_mode {
-	u16 action;
-	u16 mode;
+	__le16 action;
+	__le16 mode;
 };
 
 struct cmd_ds_set_boot2_ver {
-	u16 action;
-	u16 version;
+	__le16 action;
+	__le16 version;
 };
 
 struct cmd_ds_802_11_ps_mode {

index 0f0296b..6f5a517 100644
@@ -454,7 +454,7 @@ static int if_sdio_prog_helper(struct if_sdio_card *card)
 
 		chunk_size = min(size, (size_t)60);
 
-		*((u32*)chunk_buffer) = cpu_to_le32(chunk_size);
+		*((__le32*)chunk_buffer) = cpu_to_le32(chunk_size);
 		memcpy(chunk_buffer + 4, firmware, chunk_size);
 /*
 		lbs_deb_sdio("sending %d bytes chunk\n", chunk_size);

index e9190a6..a17371f 100644
@@ -107,7 +107,7 @@ static void if_usb_set_boot2_ver(struct lbs_private *priv)
 	int rsp_len = sizeof(b2_cmd);
 
 	b2_cmd.action = 0;
-	b2_cmd.version = cpu_to_le16(priv->boot2_version);
+	b2_cmd.version = priv->boot2_version;
 
 	if (lbs_cmd(priv, CMD_SET_BOOT2_VER, &b2_cmd, sizeof(b2_cmd),
 		    &b2_cmd, &rsp_len)) {

@@ -227,7 +227,7 @@ static int if_usb_probe(struct usb_interface *intf,
 	priv->hw_host_to_card = if_usb_host_to_card;
 	priv->hw_get_int_status = if_usb_get_int_status;
 	priv->hw_read_event_cause = if_usb_read_event_cause;
-	priv->boot2_version = le16_to_cpu(udev->descriptor.bcdDevice);
+	priv->boot2_version = udev->descriptor.bcdDevice;
 
 	/* Delay 200 ms to waiting for the FW ready */
 	if_usb_submit_rx_urb(cardp);

index b8c93c0..1af140b 100644
@@ -1122,14 +1122,6 @@ static int lbs_get_encode(struct net_device *dev,
 		break;
 	}
 
-	if (   adapter->secinfo.wep_enabled
-	    || adapter->secinfo.WPAenabled
-	    || adapter->secinfo.WPA2enabled) {
-		dwrq->flags &= ~IW_ENCODE_DISABLED;
-	} else {
-		dwrq->flags |= IW_ENCODE_DISABLED;
-	}
-
 	memset(extra, 0, 16);
 
 	mutex_lock(&adapter->lock);

@@ -1150,14 +1142,13 @@ static int lbs_get_encode(struct net_device *dev,
 		   || (adapter->secinfo.WPA2enabled)) {
 		/* return WPA enabled */
 		dwrq->flags &= ~IW_ENCODE_DISABLED;
+		dwrq->flags |= IW_ENCODE_NOKEY;
 	} else {
 		dwrq->flags |= IW_ENCODE_DISABLED;
 	}
 
 	mutex_unlock(&adapter->lock);
 
-	dwrq->flags |= IW_ENCODE_NOKEY;
-
 	lbs_deb_wext("key: %02x:%02x:%02x:%02x:%02x:%02x, keylen %d\n",
 	       extra[0], extra[1], extra[2],
 	       extra[3], extra[4], extra[5], dwrq->length);

index 1d881ae..dde0c37 100644
@@ -292,18 +292,23 @@ static ssize_t lbs_setuserscan(struct file *file,
 	struct lbs_ioctl_user_scan_cfg *scan_cfg;
 	union iwreq_data wrqu;
 	int dur;
-	unsigned long addr = get_zeroed_page(GFP_KERNEL);
-	char *buf = (char *)addr;
+	char *buf = (char *)get_zeroed_page(GFP_KERNEL);
 
-	scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL);
-	if (!scan_cfg)
+	if (!buf)
 		return -ENOMEM;
-
+		
 	buf_size = min(count, len - 1);
 	if (copy_from_user(buf, userbuf, buf_size)) {
 		res = -EFAULT;
-		goto out_unlock;
+		goto out_buf;
+	}
+
+	scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL);
+	if (!scan_cfg) {
+		res = -ENOMEM;
+		goto out_buf;
 	}
+	res = count;
 
 	scan_cfg->bsstype = LBS_SCAN_BSS_TYPE_ANY;
 

@@ -316,15 +321,19 @@ static ssize_t lbs_setuserscan(struct file *file,
 
 	lbs_scan_networks(priv, scan_cfg, 1);
 	wait_event_interruptible(priv->adapter->cmd_pending,
-				 !priv->adapter->nr_cmd_pending);
+				 priv->adapter->surpriseremoved || !priv->adapter->nr_cmd_pending);
+
+	if (priv->adapter->surpriseremoved)
+		goto out_scan_cfg;
 
 	memset(&wrqu, 0x00, sizeof(union iwreq_data));
 	wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
 
-out_unlock:
-	free_page(addr);
+ out_scan_cfg:
 	kfree(scan_cfg);
-	return count;
+ out_buf:
+	free_page((unsigned long)buf);
+	return res;
 }
 
 

index cf1ab8a..092c295 100644
@@ -1009,10 +1009,9 @@ void lbs_queue_cmd(struct lbs_adapter *adapter,
 
 	spin_lock_irqsave(&adapter->driver_lock, flags);
 
-	if (addtail) {
+	if (addtail)
 		list_add_tail(&cmdnode->list, &adapter->cmdpendingq);
-		adapter->nr_cmd_pending++;
-	} else
+	else
 		list_add(&cmdnode->list, &adapter->cmdpendingq);
 
 	spin_unlock_irqrestore(&adapter->driver_lock, flags);

@@ -1078,7 +1077,6 @@ static int DownloadcommandToStation(struct lbs_private *priv,
 		spin_lock_irqsave(&adapter->driver_lock, flags);
 		adapter->cur_cmd_retcode = ret;
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
-		adapter->nr_cmd_pending--;
 		adapter->cur_cmd = NULL;
 		spin_unlock_irqrestore(&adapter->driver_lock, flags);
 		goto done;

index f6c1016..44865bf 100644
@@ -791,7 +791,6 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		lbs_deb_host("invalid response!\n");
 		adapter->cur_cmd_retcode = -1;
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
-		adapter->nr_cmd_pending--;
 		adapter->cur_cmd = NULL;
 		spin_unlock_irqrestore(&adapter->driver_lock, flags);
 		ret = -1;

@@ -848,7 +847,6 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		}
 
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
-		adapter->nr_cmd_pending--;
 		adapter->cur_cmd = NULL;
 		spin_unlock_irqrestore(&adapter->driver_lock, flags);
 

@@ -872,7 +870,6 @@ int lbs_process_rx_command(struct lbs_private *priv)
 		}
 
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
-		adapter->nr_cmd_pending--;
 		adapter->cur_cmd = NULL;
 		spin_unlock_irqrestore(&adapter->driver_lock, flags);
 

@@ -892,8 +889,6 @@ int lbs_process_rx_command(struct lbs_private *priv)
 	if (adapter->cur_cmd) {
 		/* Clean up and Put current command back to cmdfreeq */
 		__lbs_cleanup_and_insert_cmd(priv, adapter->cur_cmd);
-		adapter->nr_cmd_pending--;
-		WARN_ON(adapter->nr_cmd_pending > 128);
 		adapter->cur_cmd = NULL;
 	}
 	spin_unlock_irqrestore(&adapter->driver_lock, flags);

index dde0c37..341ef67 100644
@@ -321,7 +321,8 @@ static ssize_t lbs_setuserscan(struct file *file,
 
 	lbs_scan_networks(priv, scan_cfg, 1);
 	wait_event_interruptible(priv->adapter->cmd_pending,
-				 priv->adapter->surpriseremoved || !priv->adapter->nr_cmd_pending);
+				 priv->adapter->surpriseremoved || 
+				 (!priv->adapter->cur_cmd && list_empty(&priv->adapter->cmdpendingq)));
 
 	if (priv->adapter->surpriseremoved)
 		goto out_scan_cfg;

index 96a34c5..fb26f18 100644
@@ -231,7 +231,6 @@ struct lbs_adapter {
 	struct list_head cmdpendingq;
 
 	wait_queue_head_t cmd_pending;
-	u8 nr_cmd_pending;
 	/* command related variables protected by adapter->driver_lock */
 
 	/** Async and Sync Event variables */

index a5b573c..500357b 100644
@@ -929,14 +929,13 @@ static int lbs_thread(void *data)
 		/* Wake-up command waiters which can't sleep in
 		 * lbs_prepare_and_send_command
 		 */
-		if (!adapter->nr_cmd_pending)
+		if (!list_empty(&adapter->cmdpendingq))
 			wake_up_all(&adapter->cmd_pending);
 
 		lbs_tx_runqueue(priv);
 	}
 
 	del_timer(&adapter->command_timer);
-	adapter->nr_cmd_pending = 0;
 	wake_up_all(&adapter->cmd_pending);
 
 	lbs_deb_leave(LBS_DEB_THREAD);

@@ -1105,7 +1104,6 @@ static int lbs_init_adapter(struct lbs_private *priv)
 
 	spin_lock_init(&adapter->driver_lock);
 	init_waitqueue_head(&adapter->cmd_pending);
-	adapter->nr_cmd_pending = 0;
 
 	/* Allocate the command buffers */
 	if (lbs_allocate_cmd_buffer(priv)) {

index 092c295..6838c9c 100644
@@ -1657,7 +1657,6 @@ static void cleanup_cmdnode(struct cmd_ctrl_node *ptempnode)
 	wake_up_interruptible(&ptempnode->cmdwait_q);
 	ptempnode->wait_option = 0;
 	ptempnode->pdata_buf = NULL;
-	ptempnode->pdata_size = NULL;
 	ptempnode->callback = NULL;
 
 	if (ptempnode->bufvirtualaddr != NULL)

@@ -1686,7 +1685,6 @@ void lbs_set_cmd_ctrl_node(struct lbs_private *priv,
 
 	ptempnode->wait_option = wait_option;
 	ptempnode->pdata_buf = pdata_buf;
-	ptempnode->pdata_size = NULL;
 	ptempnode->callback = NULL;
 
 	lbs_deb_leave(LBS_DEB_HOST);

@@ -2013,25 +2011,8 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv, u16 psmode)
  *                      the result code from the firmware
  */
 
-static int lbs_cmd_callback(uint16_t respcmd, struct cmd_ds_command *resp, struct lbs_private *priv)
-{ 
-	struct cmd_ds_gen *r = (struct cmd_ds_gen *)resp;
-	struct lbs_adapter *adapter = priv->adapter;
-	u16 sz = le16_to_cpu(resp->size) - S_DS_GEN;
-
-	if (sz > *adapter->cur_cmd->pdata_size) {
-		lbs_pr_err("response 0x%04x doesn't fit into buffer (%d > %d)\n",
-			   respcmd, sz, *adapter->cur_cmd->pdata_size);
-		sz = *adapter->cur_cmd->pdata_size;
-	}
-	memcpy(adapter->cur_cmd->pdata_buf, r->cmdresp, sz);
-	*adapter->cur_cmd->pdata_size = sz;
-
-	return 0;
-}
-
-int lbs_cmd(struct lbs_private *priv, u16 command, void *cmd, int cmd_size,
-	    void *rsp, int *rsp_size)
+int lbs_cmd(struct lbs_private *priv, uint16_t command, void *cmd, int cmd_size,
+	    int (*callback)(uint16_t, struct cmd_ds_command *, struct lbs_private *))
 {
 	struct lbs_adapter *adapter = priv->adapter;
 	struct cmd_ctrl_node *cmdnode;

@@ -2040,9 +2021,8 @@ int lbs_cmd(struct lbs_private *priv, u16 command, void *cmd, int cmd_size,
 	int ret = 0;
 
 	lbs_deb_enter(LBS_DEB_HOST);
-	lbs_deb_host("rsp at %p, rsp_size at %p\n", rsp, rsp_size);
 
-	if (!adapter || !rsp_size) {
+	if (!adapter) {
 		lbs_deb_host("PREP_CMD: adapter is NULL\n");
 		ret = -1;
 		goto done;

@@ -2067,9 +2047,7 @@ int lbs_cmd(struct lbs_private *priv, u16 command, void *cmd, int cmd_size,
 
 	cmdptr = (struct cmd_ds_gen *)cmdnode->bufvirtualaddr;
 	cmdnode->wait_option = CMD_OPTION_WAITFORRSP;
-	cmdnode->pdata_buf = rsp;
-	cmdnode->pdata_size = rsp_size;
-	cmdnode->callback = lbs_cmd_callback;
+	cmdnode->callback = callback;
 
 	/* Set sequence number, clean result, move to buffer */
 	adapter->seqnum++;

index 6f47ff0..1a8fdaa 100644
@@ -24,10 +24,8 @@ void lbs_send_tx_feedback(struct lbs_private *priv);
 
 int lbs_free_cmd_buffer(struct lbs_private *priv);
 
-int lbs_cmd(struct lbs_private *priv,
-	u16 command,
-	void *cmd, int cmd_size,
-	void *resp, int *resp_size);
+int lbs_cmd(struct lbs_private *priv, uint16_t command, void *cmd, int cmd_size, 
+	    int (*callback)(uint16_t, struct cmd_ds_command *, struct lbs_private *));
 
 int lbs_prepare_and_send_command(struct lbs_private *priv,
 	u16 cmd_no,

index efdb720..f1c1d3f 100644
@@ -71,7 +71,6 @@ struct cmd_ctrl_node {
 	u16 wait_option;
 	/* command response */
 	void *pdata_buf;
-	int *pdata_size;
 	int (*callback)(uint16_t respcmd, struct cmd_ds_command *resp, struct lbs_private *priv);
 	/* command data */
 	u8 *bufvirtualaddr;

index a17371f..7c4bd8d 100644
@@ -104,15 +104,12 @@ static void if_usb_free(struct usb_card_rec *cardp)
 static void if_usb_set_boot2_ver(struct lbs_private *priv)
 {
 	struct cmd_ds_set_boot2_ver b2_cmd;
-	int rsp_len = sizeof(b2_cmd);
 
 	b2_cmd.action = 0;
 	b2_cmd.version = priv->boot2_version;
 
-	if (lbs_cmd(priv, CMD_SET_BOOT2_VER, &b2_cmd, sizeof(b2_cmd),
-		    &b2_cmd, &rsp_len)) {
+	if (lbs_cmd(priv, CMD_SET_BOOT2_VER, &b2_cmd, sizeof(b2_cmd), NULL))
 		lbs_deb_usb("Setting boot2 version failed\n");
-	}
 }
 
 

index 500357b..f595664 100644
@@ -795,70 +795,60 @@ static int lbs_thread(void *data)
 	init_waitqueue_entry(&wait, current);
 
 	set_freezable();
+
 	for (;;) {
-		lbs_deb_thread( "main-thread 111: intcounter=%d "
-		       "currenttxskb=%p dnld_sent=%d\n",
-		       adapter->intcounter,
-		       adapter->currenttxskb, priv->dnld_sent);
+		lbs_deb_thread( "main-thread 111: intcounter=%d currenttxskb=%p dnld_sent=%d\n",
+				adapter->intcounter, adapter->currenttxskb, priv->dnld_sent);
 
 		add_wait_queue(&priv->waitq, &wait);
 		set_current_state(TASK_INTERRUPTIBLE);
 		spin_lock_irq(&adapter->driver_lock);
+
 		if ((adapter->psstate == PS_STATE_SLEEP) ||
-		    (!adapter->intcounter
-		     && (priv->dnld_sent || adapter->cur_cmd ||
-			 list_empty(&adapter->cmdpendingq)))) {
-			lbs_deb_thread(
-			       "main-thread sleeping... Conn=%d IntC=%d PS_mode=%d PS_State=%d\n",
-			       adapter->connect_status, adapter->intcounter,
-			       adapter->psmode, adapter->psstate);
+		    (!adapter->intcounter && (priv->dnld_sent || adapter->cur_cmd || list_empty(&adapter->cmdpendingq)))) {
+			lbs_deb_thread("main-thread sleeping... Conn=%d IntC=%d PS_mode=%d PS_State=%d\n",
+				       adapter->connect_status, adapter->intcounter,
+				       adapter->psmode, adapter->psstate);
 			spin_unlock_irq(&adapter->driver_lock);
 			schedule();
 		} else
 			spin_unlock_irq(&adapter->driver_lock);
 
-		lbs_deb_thread(
-		       "main-thread 222 (waking up): intcounter=%d currenttxskb=%p "
-		       "dnld_sent=%d\n", adapter->intcounter,
-		       adapter->currenttxskb, priv->dnld_sent);
+		lbs_deb_thread("main-thread 222 (waking up): intcounter=%d currenttxskb=%p dnld_sent=%d\n",
+			       adapter->intcounter, adapter->currenttxskb, priv->dnld_sent);
 
 		set_current_state(TASK_RUNNING);
 		remove_wait_queue(&priv->waitq, &wait);
 		try_to_freeze();
 
-		lbs_deb_thread("main-thread 333: intcounter=%d currenttxskb=%p "
-		       "dnld_sent=%d\n",
-		       adapter->intcounter,
-		       adapter->currenttxskb, priv->dnld_sent);
+		lbs_deb_thread("main-thread 333: intcounter=%d currenttxskb=%p dnld_sent=%d\n",
+			       adapter->intcounter, adapter->currenttxskb, priv->dnld_sent);
 
-		if (kthread_should_stop()
-		    || adapter->surpriseremoved) {
-			lbs_deb_thread(
-			       "main-thread: break from main thread: surpriseremoved=0x%x\n",
-			       adapter->surpriseremoved);
+		if (kthread_should_stop() || adapter->surpriseremoved) {
+			lbs_deb_thread("main-thread: break from main thread: surpriseremoved=0x%x\n",
+				       adapter->surpriseremoved);
 			break;
 		}
 
 
 		spin_lock_irq(&adapter->driver_lock);
+
 		if (adapter->intcounter) {
 			u8 int_status;
+
 			adapter->intcounter = 0;
 			int_status = priv->hw_get_int_status(priv, &ireg);
 
 			if (int_status) {
-				lbs_deb_thread(
-				       "main-thread: reading HOST_INT_STATUS_REG failed\n");
+				lbs_deb_thread("main-thread: reading HOST_INT_STATUS_REG failed\n");
 				spin_unlock_irq(&adapter->driver_lock);
 				continue;
 			}
 			adapter->hisregcpy |= ireg;
 		}
 
-		lbs_deb_thread("main-thread 444: intcounter=%d currenttxskb=%p "
-		       "dnld_sent=%d\n",
-		       adapter->intcounter,
-		       adapter->currenttxskb, priv->dnld_sent);
+		lbs_deb_thread("main-thread 444: intcounter=%d currenttxskb=%p dnld_sent=%d\n",
+			       adapter->intcounter, adapter->currenttxskb, priv->dnld_sent);
 
 		/* command response? */
 		if (adapter->hisregcpy & MRVDRV_CMD_UPLD_RDY) {

@@ -877,8 +867,7 @@ static int lbs_thread(void *data)
 			adapter->hisregcpy &= ~MRVDRV_CARDEVENT;
 
 			if (priv->hw_read_event_cause(priv)) {
-				lbs_pr_alert(
-				       "main-thread: hw_read_event_cause failed\n");
+				lbs_pr_alert("main-thread: hw_read_event_cause failed\n");
 				spin_unlock_irq(&adapter->driver_lock);
 				continue;
 			}

@@ -888,30 +877,21 @@ static int lbs_thread(void *data)
 			spin_unlock_irq(&adapter->driver_lock);
 
 		/* Check if we need to confirm Sleep Request received previously */
-		if (adapter->psstate == PS_STATE_PRE_SLEEP) {
-			if (!priv->dnld_sent && !adapter->cur_cmd) {
-				if (adapter->connect_status ==
-				    LBS_CONNECTED) {
-					lbs_deb_thread(
-					       "main_thread: PRE_SLEEP--intcounter=%d currenttxskb=%p "
-					       "dnld_sent=%d cur_cmd=%p, confirm now\n",
-					       adapter->intcounter,
-					       adapter->currenttxskb,
-					       priv->dnld_sent,
-					       adapter->cur_cmd);
-
-					lbs_ps_confirm_sleep(priv,
-						       (u16) adapter->psmode);
-				} else {
-					/* workaround for firmware sending
-					 * deauth/linkloss event immediately
-					 * after sleep request, remove this
-					 * after firmware fixes it
-					 */
-					adapter->psstate = PS_STATE_AWAKE;
-					lbs_pr_alert(
-					       "main-thread: ignore PS_SleepConfirm in non-connected state\n");
-				}
+		if (adapter->psstate == PS_STATE_PRE_SLEEP &&
+		    !priv->dnld_sent && !adapter->cur_cmd) {
+			if (adapter->connect_status == LBS_CONNECTED) {
+				lbs_deb_thread("main_thread: PRE_SLEEP--intcounter=%d currenttxskb=%p dnld_sent=%d cur_cmd=%p, confirm now\n",
+					       adapter->intcounter, adapter->currenttxskb, priv->dnld_sent, adapter->cur_cmd);
+
+				lbs_ps_confirm_sleep(priv, (u16) adapter->psmode);
+			} else {
+				/* workaround for firmware sending
+				 * deauth/linkloss event immediately
+				 * after sleep request; remove this
+				 * after firmware fixes it
+				 */
+				adapter->psstate = PS_STATE_AWAKE;
+				lbs_pr_alert("main-thread: ignore PS_SleepConfirm in non-connected state\n");
 			}
 		}
 

index fb26f18..5cb2923 100644
@@ -143,8 +143,6 @@ struct lbs_private {
 	   all other bits reserved 0 */
 	u8 dnld_sent;
 
-	struct device *hotplug_device;
-
 	/** thread to service interrupts */
 	struct task_struct *main_thread;
 	wait_queue_head_t waitq;

index f595664..d03a2f8 100644
@@ -256,8 +256,7 @@ void lbs_remove_rtap(struct lbs_private *priv);
 static ssize_t lbs_rtap_get(struct device *dev,
 		struct device_attribute *attr, char * buf)
 {
-	struct lbs_private *priv = (struct lbs_private *)
-		(to_net_dev(dev))->priv;
+	struct lbs_private *priv = to_net_dev(dev)->priv;
 	struct lbs_adapter *adapter = priv->adapter;
 	return snprintf(buf, 5, "0x%X\n", adapter->monitormode);
 }

@@ -269,8 +268,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
 		struct device_attribute *attr, const char * buf, size_t count)
 {
 	int monitor_mode;
-	struct lbs_private *priv = (struct lbs_private *)
-		(to_net_dev(dev))->priv;
+	struct lbs_private *priv = to_net_dev(dev)->priv;
 	struct lbs_adapter *adapter = priv->adapter;
 
 	sscanf(buf, "%x", &monitor_mode);

@@ -1158,7 +1156,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
 	priv->card = card;
 	priv->mesh_open = 0;
 	priv->infra_open = 0;
-	priv->hotplug_device = dmdev;
 
 	/* Setup the OS Interface to our functions */
 	dev->open = lbs_open;

@@ -1178,15 +1175,13 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
 	SET_NETDEV_DEV(dev, dmdev);
 
 	priv->rtap_net_dev = NULL;
-	if (device_create_file(dmdev, &dev_attr_lbs_rtap))
-		goto err_init_adapter;
 
 	lbs_deb_thread("Starting main thread...\n");
 	init_waitqueue_head(&priv->waitq);
 	priv->main_thread = kthread_run(lbs_thread, dev, "lbs_main");
 	if (IS_ERR(priv->main_thread)) {
 		lbs_deb_thread("Error creating main thread.\n");
-		goto err_kthread_run;
+		goto err_init_adapter;
 	}
 
 	priv->work_thread = create_singlethread_workqueue("lbs_worker");

@@ -1196,9 +1191,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
 
 	goto done;
 
-err_kthread_run:
-	device_remove_file(dmdev, &dev_attr_lbs_rtap);
-
 err_init_adapter:
 	lbs_free_adapter(priv);
 

@@ -1224,7 +1216,7 @@ int lbs_remove_card(struct lbs_private *priv)
 	lbs_remove_rtap(priv);
 
 	dev = priv->dev;
-	device_remove_file(priv->hotplug_device, &dev_attr_lbs_rtap);
+	device_remove_file(&dev->dev, &dev_attr_lbs_rtap);
 
 	cancel_delayed_work(&priv->scan_work);
 	cancel_delayed_work(&priv->assoc_work);

@@ -1273,6 +1265,8 @@ int lbs_start_card(struct lbs_private *priv)
 		lbs_pr_err("cannot register ethX device\n");
 		goto done;
 	}
+	if (device_create_file(&dev->dev, &dev_attr_lbs_rtap))
+		lbs_pr_err("cannot register lbs_rtap attribute\n");
 
 	lbs_debugfs_init_one(priv, dev);
 

index 5cb2923..eaa45d4 100644
@@ -285,7 +285,6 @@ struct lbs_adapter {
 
 	/** Tx-related variables (for single packet tx) */
 	struct sk_buff *currenttxskb;
-	u16 TxLockFlag;
 
 	/** NIC Operation characteristics */
 	u16 currentpacketfilter;

index d03a2f8..7155f48 100644
@@ -290,8 +290,14 @@ static ssize_t lbs_rtap_set(struct device *dev,
 			return strlen(buf);
 		adapter->monitormode = LBS_MONITOR_OFF;
 		lbs_remove_rtap(priv);
-		netif_wake_queue(priv->dev);
-		netif_wake_queue(priv->mesh_dev);
+
+		if (adapter->currenttxskb) {
+			dev_kfree_skb_any(adapter->currenttxskb);
+			adapter->currenttxskb = NULL;
+		}
+
+		/* Wake queues, command thread, etc. */
+		lbs_host_to_card_done(priv);
 	}
 
 	lbs_prepare_and_send_command(priv,

@@ -521,7 +527,15 @@ static int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	lbs_deb_enter(LBS_DEB_TX);
 
-	if (priv->dnld_sent || priv->adapter->TxLockFlag) {
+	/* We could return NETDEV_TX_BUSY here, but I'd actually 
+	   like to get the point where we can BUG() */
+	if (priv->dnld_sent) {
+		lbs_pr_err("%s while dnld_sent\n", __func__);
+		priv->stats.tx_dropped++;
+		goto done;
+	}
+	if (priv->adapter->currenttxskb) {
+		lbs_pr_err("%s while TX skb pending\n", __func__);
 		priv->stats.tx_dropped++;
 		goto done;
 	}

@@ -624,6 +638,11 @@ void lbs_host_to_card_done(struct lbs_private *priv)
 	if (!adapter->cur_cmd)
 		wake_up_interruptible(&priv->waitq);
 
+	/* Don't wake netif queues if we're in monitor mode and
+	   a TX packet is already pending. */
+	if (priv->adapter->currenttxskb)
+		return;
+
 	if (priv->dev && adapter->connect_status == LBS_CONNECTED)
 		netif_wake_queue(priv->dev);
 

index b423ce1..131ef3f 100644
@@ -152,11 +152,11 @@ done:
 		netif_stop_queue(priv->dev);
 		if (priv->mesh_dev)
 			netif_stop_queue(priv->mesh_dev);
-		/* freeze any packets already in our queues */
-		priv->adapter->TxLockFlag = 1;
+
+		/* Keep the skb around for when we get feedback */
+		priv->adapter->currenttxskb = skb;
 	} else {
 		dev_kfree_skb_any(skb);
-		priv->adapter->currenttxskb = NULL;
 	}
 
 	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);

@@ -227,8 +227,6 @@ int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
 		return ret;
 	}
 
-	priv->adapter->currenttxskb = skb;
-
 	ret = SendSinglePacket(priv, skb);
 done:
 	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);

@@ -272,7 +270,6 @@ void lbs_send_tx_feedback(struct lbs_private *priv)
 	    (1 + adapter->txretrycount - try_count) : 0;
 	lbs_upload_rx_packet(priv, adapter->currenttxskb);
 	adapter->currenttxskb = NULL;
-	priv->adapter->TxLockFlag = 0;
 
 	if (adapter->connect_status == LBS_CONNECTED)
 		netif_wake_queue(priv->dev);

index 013965d..5e10ce0 100644
@@ -432,8 +432,8 @@ u8 lbs_get_scan_type_11d(u8 chan,
 
 void lbs_init_11d(struct lbs_private *priv)
 {
-	priv->adapter->enable11d = 0;
-	memset(&(priv->adapter->parsed_region_chan), 0,
+	priv->enable11d = 0;
+	memset(&(priv->parsed_region_chan), 0,
 	       sizeof(struct parsed_region_chan_11d));
 	return;
 }

@@ -447,7 +447,7 @@ static int set_domain_info_11d(struct lbs_private *priv)
 {
 	int ret;
 
-	if (!priv->adapter->enable11d) {
+	if (!priv->enable11d) {
 		lbs_deb_11d("dnld domain Info with 11d disabled\n");
 		return 0;
 	}

@@ -469,22 +469,21 @@ static int set_domain_info_11d(struct lbs_private *priv)
 */
 int lbs_set_universaltable(struct lbs_private *priv, u8 band)
 {
-	struct lbs_adapter *adapter = priv->adapter;
 	u16 size = sizeof(struct chan_freq_power);
 	u16 i = 0;
 
-	memset(adapter->universal_channel, 0,
-	       sizeof(adapter->universal_channel));
+	memset(priv->universal_channel, 0,
+	       sizeof(priv->universal_channel));
 
-	adapter->universal_channel[i].nrcfp =
+	priv->universal_channel[i].nrcfp =
 	    sizeof(channel_freq_power_UN_BG) / size;
 	lbs_deb_11d("BG-band nrcfp %d\n",
-	       adapter->universal_channel[i].nrcfp);
+	       priv->universal_channel[i].nrcfp);
 
-	adapter->universal_channel[i].CFP = channel_freq_power_UN_BG;
-	adapter->universal_channel[i].valid = 1;
-	adapter->universal_channel[i].region = UNIVERSAL_REGION_CODE;
-	adapter->universal_channel[i].band = band;
+	priv->universal_channel[i].CFP = channel_freq_power_UN_BG;
+	priv->universal_channel[i].valid = 1;
+	priv->universal_channel[i].region = UNIVERSAL_REGION_CODE;
+	priv->universal_channel[i].band = band;
 	i++;
 
 	return 0;

@@ -505,8 +504,7 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
 	struct cmd_ds_802_11d_domain_info *pdomaininfo =
 	    &cmd->params.domaininfo;
 	struct mrvlietypes_domainparamset *domain = &pdomaininfo->domain;
-	struct lbs_adapter *adapter = priv->adapter;
-	u8 nr_subband = adapter->domainreg.nr_subband;
+	u8 nr_subband = priv->domainreg.nr_subband;
 
 	lbs_deb_enter(LBS_DEB_11D);
 

@@ -523,7 +521,7 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
 	}
 
 	domain->header.type = cpu_to_le16(TLV_TYPE_DOMAIN);
-	memcpy(domain->countrycode, adapter->domainreg.countrycode,
+	memcpy(domain->countrycode, priv->domainreg.countrycode,
 	       sizeof(domain->countrycode));
 
 	domain->header.len =

@@ -531,7 +529,7 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
 			     sizeof(domain->countrycode));
 
 	if (nr_subband) {
-		memcpy(domain->subband, adapter->domainreg.subband,
+		memcpy(domain->subband, priv->domainreg.subband,
 		       nr_subband * sizeof(struct ieeetypes_subbandset));
 
 		cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +

@@ -605,24 +603,23 @@ int lbs_parse_dnld_countryinfo_11d(struct lbs_private *priv,
                                         struct bss_descriptor * bss)
 {
 	int ret;
-	struct lbs_adapter *adapter = priv->adapter;
 
 	lbs_deb_enter(LBS_DEB_11D);
-	if (priv->adapter->enable11d) {
-		memset(&adapter->parsed_region_chan, 0,
+	if (priv->enable11d) {
+		memset(&priv->parsed_region_chan, 0,
 		       sizeof(struct parsed_region_chan_11d));
 		ret = parse_domain_info_11d(&bss->countryinfo, 0,
-					       &adapter->parsed_region_chan);
+					       &priv->parsed_region_chan);
 
 		if (ret == -1) {
 			lbs_deb_11d("error parsing domain_info from AP\n");
 			goto done;
 		}
 
-		memset(&adapter->domainreg, 0,
+		memset(&priv->domainreg, 0,
 		       sizeof(struct lbs_802_11d_domain_reg));
-		generate_domain_info_11d(&adapter->parsed_region_chan,
-				      &adapter->domainreg);
+		generate_domain_info_11d(&priv->parsed_region_chan,
+				      &priv->domainreg);
 
 		ret = set_domain_info_11d(priv);
 

@@ -646,18 +643,17 @@ done:
 int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv)
 {
 	int ret;
-	struct lbs_adapter *adapter = priv->adapter;
 	struct region_channel *region_chan;
 	u8 j;
 
 	lbs_deb_enter(LBS_DEB_11D);
-	lbs_deb_11d("curbssparams.band %d\n", adapter->curbssparams.band);
+	lbs_deb_11d("curbssparams.band %d\n", priv->curbssparams.band);
 
-	if (priv->adapter->enable11d) {
+	if (priv->enable11d) {
 		/* update parsed_region_chan_11; dnld domaininf to FW */
 
-		for (j = 0; j < ARRAY_SIZE(adapter->region_channel); j++) {
-			region_chan = &adapter->region_channel[j];
+		for (j = 0; j < ARRAY_SIZE(priv->region_channel); j++) {
+			region_chan = &priv->region_channel[j];
 
 			lbs_deb_11d("%d region_chan->band %d\n", j,
 			       region_chan->band);

@@ -665,28 +661,28 @@ int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv)
 			if (!region_chan || !region_chan->valid
 			    || !region_chan->CFP)
 				continue;
-			if (region_chan->band != adapter->curbssparams.band)
+			if (region_chan->band != priv->curbssparams.band)
 				continue;
 			break;
 		}
 
-		if (j >= ARRAY_SIZE(adapter->region_channel)) {
+		if (j >= ARRAY_SIZE(priv->region_channel)) {
 			lbs_deb_11d("region_chan not found, band %d\n",
-			       adapter->curbssparams.band);
+			       priv->curbssparams.band);
 			ret = -1;
 			goto done;
 		}
 
-		memset(&adapter->parsed_region_chan, 0,
+		memset(&priv->parsed_region_chan, 0,
 		       sizeof(struct parsed_region_chan_11d));
 		lbs_generate_parsed_region_chan_11d(region_chan,
-						     &adapter->
+						     &priv->
 						     parsed_region_chan);
 
-		memset(&adapter->domainreg, 0,
+		memset(&priv->domainreg, 0,
 		       sizeof(struct lbs_802_11d_domain_reg));
-		generate_domain_info_11d(&adapter->parsed_region_chan,
-					 &adapter->domainreg);
+		generate_domain_info_11d(&priv->parsed_region_chan,
+					 &priv->domainreg);
 
 		ret = set_domain_info_11d(priv);
 

381 lines not on this page · raw message

index fad00ae..08372bb 100644
@@ -6,7 +6,7 @@
 #include "dev.h"
 
 void lbs_association_worker(struct work_struct *work);
-struct assoc_request *lbs_get_association_request(struct lbs_adapter *adapter);
+struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
 void lbs_sync_channel(struct work_struct *work);
 
 #endif /* _LBS_ASSOC_H */

734 lines not on this page · raw message

760 lines not on this page · raw message

154 lines not on this page · raw message

index 1a8fdaa..e255b19 100644
@@ -12,7 +12,6 @@
 
 /** Function Prototype Declaration */
 struct lbs_private;
-struct lbs_adapter;
 struct sk_buff;
 struct net_device;
 struct cmd_ctrl_node;

@@ -32,7 +31,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 	u16 cmd_action,
 	u16 wait_option, u32 cmd_oid, void *pdata_buf);
 
-void lbs_queue_cmd(struct lbs_adapter *adapter,
+void lbs_queue_cmd(struct lbs_private *priv,
 	struct cmd_ctrl_node *cmdnode,
 	u8 addtail);
 

@@ -43,7 +42,7 @@ void lbs_interrupt(struct net_device *);
 int lbs_set_radio_control(struct lbs_private *priv);
 u32 lbs_fw_index_to_data_rate(u8 index);
 u8 lbs_data_rate_to_fw_index(u32 rate);
-void lbs_get_fwversion(struct lbs_adapter *adapter,
+void lbs_get_fwversion(struct lbs_private *priv,
 	char *fwversion,
 	int maxlen);
 

@@ -66,7 +65,7 @@ void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
 void lbs_tx_runqueue(struct lbs_private *priv);
 
 struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
-	struct lbs_adapter *adapter,
+	struct lbs_private *priv,
 	u8 band,
 	u16 channel);
 

127 lines not on this page · raw message

index f32fb00..a54b4f4 100644
@@ -25,7 +25,7 @@ static void lbs_ethtool_get_drvinfo(struct net_device *dev,
 	struct lbs_private *priv = (struct lbs_private *) dev->priv;
 	char fwver[32];
 
-	lbs_get_fwversion(priv->adapter, fwver, sizeof(fwver) - 1);
+	lbs_get_fwversion(priv, fwver, sizeof(fwver) - 1);
 
 	strcpy(info->driver, "libertas");
 	strcpy(info->version, lbs_driver_version);

@@ -46,7 +46,6 @@ static int lbs_ethtool_get_eeprom(struct net_device *dev,
                                   struct ethtool_eeprom *eeprom, u8 * bytes)
 {
 	struct lbs_private *priv = (struct lbs_private *) dev->priv;
-	struct lbs_adapter *adapter = priv->adapter;
 	struct lbs_ioctl_regrdwr regctrl;
 	char *ptr;
 	int ret;

@@ -60,10 +59,10 @@ static int lbs_ethtool_get_eeprom(struct net_device *dev,
 
 //      mutex_lock(&priv->mutex);
 
-	adapter->prdeeprom = kmalloc(eeprom->len+sizeof(regctrl), GFP_KERNEL);
-	if (!adapter->prdeeprom)
+	priv->prdeeprom = kmalloc(eeprom->len+sizeof(regctrl), GFP_KERNEL);
+	if (!priv->prdeeprom)
 		return -ENOMEM;
-	memcpy(adapter->prdeeprom, &regctrl, sizeof(regctrl));
+	memcpy(priv->prdeeprom, &regctrl, sizeof(regctrl));
 
 	/* +14 is for action, offset, and NOB in
 	 * response */

@@ -77,14 +76,14 @@ static int lbs_ethtool_get_eeprom(struct net_device *dev,
 				    &regctrl);
 
 	if (ret) {
-		if (adapter->prdeeprom)
-			kfree(adapter->prdeeprom);
+		if (priv->prdeeprom)
+			kfree(priv->prdeeprom);
 		goto done;
 	}
 
 	mdelay(10);
 
-	ptr = (char *)adapter->prdeeprom;
+	ptr = (char *)priv->prdeeprom;
 
 	/* skip the command header, but include the "value" u32 variable */
 	ptr = ptr + sizeof(struct lbs_ioctl_regrdwr) - 4;

@@ -94,8 +93,8 @@ static int lbs_ethtool_get_eeprom(struct net_device *dev,
 	 */
 	memcpy(bytes, ptr, eeprom->len);
 
-	if (adapter->prdeeprom)
-		kfree(adapter->prdeeprom);
+	if (priv->prdeeprom)
+		kfree(priv->prdeeprom);
 //	mutex_unlock(&priv->mutex);
 
 	ret = 0;

index 8508260..49a0178 100644
@@ -255,7 +255,7 @@ static irqreturn_t if_cs_interrupt(int irq, void *data)
 
 	} else if (int_cause == 0xffff) {
 		/* Read in junk, the card has probably been removed */
-		card->priv->adapter->surpriseremoved = 1;
+		card->priv->surpriseremoved = 1;
 
 	} else {
 		if (int_cause & IF_CS_H_IC_TX_OVER)

@@ -644,7 +644,6 @@ static int if_cs_host_to_card(struct lbs_private *priv,
 static int if_cs_get_int_status(struct lbs_private *priv, u8 *ireg)
 {
 	struct if_cs_card *card = (struct if_cs_card *)priv->card;
-	/* struct lbs_adapter *adapter = priv->adapter; */
 	int ret = 0;
 	u16 int_cause;
 	u8 *cmdbuf;

@@ -652,7 +651,7 @@ static int if_cs_get_int_status(struct lbs_private *priv, u8 *ireg)
 
 	lbs_deb_enter(LBS_DEB_CS);
 
-	if (priv->adapter->surpriseremoved)
+	if (priv->surpriseremoved)
 		goto out;
 
 	int_cause = if_cs_read16(card, IF_CS_C_INT_CAUSE) & IF_CS_C_IC_MASK;

@@ -678,22 +677,22 @@ sbi_get_int_status_exit:
 
 	/* Card has a command result for us */
 	if (*ireg & IF_CS_C_S_CMD_UPLD_RDY) {
-		spin_lock(&priv->adapter->driver_lock);
-		if (!priv->adapter->cur_cmd) {
+		spin_lock(&priv->driver_lock);
+		if (!priv->cur_cmd) {
 			cmdbuf = priv->upld_buf;
-			priv->adapter->hisregcpy &= ~IF_CS_C_S_RX_UPLD_RDY;
+			priv->hisregcpy &= ~IF_CS_C_S_RX_UPLD_RDY;
 		} else {
-			cmdbuf = priv->adapter->cur_cmd->bufvirtualaddr;
+			cmdbuf = priv->cur_cmd->bufvirtualaddr;
 		}
 
 		ret = if_cs_receive_cmdres(priv, cmdbuf, &priv->upld_len);
-		spin_unlock(&priv->adapter->driver_lock);
+		spin_unlock(&priv->driver_lock);
 		if (ret < 0)
 			lbs_pr_err("could not receive cmd from card\n");
 	}
 
 out:
-	lbs_deb_leave_args(LBS_DEB_CS, "ret %d, ireg 0x%x, hisregcpy 0x%x", ret, *ireg, priv->adapter->hisregcpy);
+	lbs_deb_leave_args(LBS_DEB_CS, "ret %d, ireg 0x%x, hisregcpy 0x%x", ret, *ireg, priv->hisregcpy);
 	return ret;
 }
 

@@ -702,7 +701,7 @@ static int if_cs_read_event_cause(struct lbs_private *priv)
 {
 	lbs_deb_enter(LBS_DEB_CS);
 
-	priv->adapter->eventcause = (if_cs_read16(priv->card, IF_CS_C_STATUS) & IF_CS_C_S_STATUS_MASK) >> 5;
+	priv->eventcause = (if_cs_read16(priv->card, IF_CS_C_STATUS) & IF_CS_C_S_STATUS_MASK) >> 5;
 	if_cs_write16(priv->card, IF_CS_H_INT_CAUSE, IF_CS_H_IC_HOST_EVENT);
 
 	return 0;

@@ -869,7 +868,7 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
 	priv->hw_get_int_status   = if_cs_get_int_status;
 	priv->hw_read_event_cause = if_cs_read_event_cause;
 
-	priv->adapter->fw_ready = 1;
+	priv->fw_ready = 1;
 
 	/* Now actually get the IRQ */
 	ret = request_irq(p_dev->irq.AssignedIRQ, if_cs_interrupt,

index 6f5a517..6456613 100644
@@ -134,9 +134,9 @@ static int if_sdio_handle_cmd(struct if_sdio_card *card,
 
 	lbs_deb_enter(LBS_DEB_SDIO);
 
-	spin_lock_irqsave(&card->priv->adapter->driver_lock, flags);
+	spin_lock_irqsave(&card->priv->driver_lock, flags);
 
-	if (!card->priv->adapter->cur_cmd) {
+	if (!card->priv->cur_cmd) {
 		lbs_deb_sdio("discarding spurious response\n");
 		ret = 0;
 		goto out;

@@ -149,7 +149,7 @@ static int if_sdio_handle_cmd(struct if_sdio_card *card,
 		goto out;
 	}
 
-	memcpy(card->priv->adapter->cur_cmd->bufvirtualaddr, buffer, size);
+	memcpy(card->priv->cur_cmd->bufvirtualaddr, buffer, size);
 	card->priv->upld_len = size;
 
 	card->int_cause |= MRVDRV_CMD_UPLD_RDY;

@@ -159,7 +159,7 @@ static int if_sdio_handle_cmd(struct if_sdio_card *card,
 	ret = 0;
 
 out:
-	spin_unlock_irqrestore(&card->priv->adapter->driver_lock, flags);
+	spin_unlock_irqrestore(&card->priv->driver_lock, flags);
 
 	lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
 

@@ -231,14 +231,14 @@ static int if_sdio_handle_event(struct if_sdio_card *card,
 		event <<= SBI_EVENT_CAUSE_SHIFT;
 	}
 
-	spin_lock_irqsave(&card->priv->adapter->driver_lock, flags);
+	spin_lock_irqsave(&card->priv->driver_lock, flags);
 
 	card->event = event;
 	card->int_cause |= MRVDRV_CARDEVENT;
 
 	lbs_interrupt(card->priv->dev);
 
-	spin_unlock_irqrestore(&card->priv->adapter->driver_lock, flags);
+	spin_unlock_irqrestore(&card->priv->driver_lock, flags);
 
 	ret = 0;
 

@@ -800,7 +800,7 @@ static int if_sdio_read_event_cause(struct lbs_private *priv)
 
 	card = priv->card;
 
-	priv->adapter->eventcause = card->event;
+	priv->eventcause = card->event;
 
 	lbs_deb_leave(LBS_DEB_SDIO);
 

@@ -958,7 +958,7 @@ static int if_sdio_probe(struct sdio_func *func,
 	priv->hw_get_int_status = if_sdio_get_int_status;
 	priv->hw_read_event_cause = if_sdio_read_event_cause;
 
-	priv->adapter->fw_ready = 1;
+	priv->fw_ready = 1;
 
 	/*
 	 * Enable interrupts now that everything is set up

@@ -981,7 +981,7 @@ out:
 err_activate_card:
 	flush_scheduled_work();
 	free_netdev(priv->dev);
-	kfree(priv->adapter);
+	kfree(priv);
 reclaim:
 	sdio_claim_host(func);
 release_int:

@@ -1011,7 +1011,7 @@ static void if_sdio_remove(struct sdio_func *func)
 
 	card = sdio_get_drvdata(func);
 
-	card->priv->adapter->surpriseremoved = 1;
+	card->priv->surpriseremoved = 1;
 
 	lbs_deb_sdio("call remove card\n");
 	lbs_stop_card(card->priv);

index 7c4bd8d..87bed4a 100644
@@ -229,7 +229,7 @@ static int if_usb_probe(struct usb_interface *intf,
 	/* Delay 200 ms to waiting for the FW ready */
 	if_usb_submit_rx_urb(cardp);
 	msleep_interruptible(200);
-	priv->adapter->fw_ready = 1;
+	priv->fw_ready = 1;
 
 	if (lbs_start_card(priv))
 		goto err_start_card;

@@ -270,9 +270,8 @@ static void if_usb_disconnect(struct usb_interface *intf)
 	cardp->surprise_removed = 1;
 
 	if (priv) {
-		struct lbs_adapter *adapter = priv->adapter;
 
-		adapter->surpriseremoved = 1;
+		priv->surpriseremoved = 1;
 		lbs_stop_card(priv);
 		lbs_remove_mesh(priv);
 		lbs_remove_card(priv);

@@ -609,14 +608,14 @@ static inline void process_cmdrequest(int recvlength, u8 *recvbuff,
 	if (!in_interrupt())
 		BUG();
 
-	spin_lock(&priv->adapter->driver_lock);
+	spin_lock(&priv->driver_lock);
 	/* take care of cur_cmd = NULL case by reading the
 	 * data to clear the interrupt */
-	if (!priv->adapter->cur_cmd) {
+	if (!priv->cur_cmd) {
 		cmdbuf = priv->upld_buf;
-		priv->adapter->hisregcpy &= ~MRVDRV_CMD_UPLD_RDY;
+		priv->hisregcpy &= ~MRVDRV_CMD_UPLD_RDY;
 	} else
-		cmdbuf = priv->adapter->cur_cmd->bufvirtualaddr;
+		cmdbuf = priv->cur_cmd->bufvirtualaddr;
 
 	cardp->usb_int_cause |= MRVDRV_CMD_UPLD_RDY;
 	priv->upld_len = (recvlength - MESSAGE_HEADER_LEN);

@@ -625,7 +624,7 @@ static inline void process_cmdrequest(int recvlength, u8 *recvbuff,
 
 	kfree_skb(skb);
 	lbs_interrupt(priv->dev);
-	spin_unlock(&priv->adapter->driver_lock);
+	spin_unlock(&priv->driver_lock);
 
 	lbs_deb_usbd(&cardp->udev->dev,
 		    "Wake up main thread to handle cmd response\n");

@@ -685,20 +684,20 @@ static void if_usb_receive(struct urb *urb)
 
 	case CMD_TYPE_INDICATION:
 		/* Event cause handling */
-		spin_lock(&priv->adapter->driver_lock);
+		spin_lock(&priv->driver_lock);
 		cardp->usb_event_cause = le32_to_cpu(*(__le32 *) (recvbuff + MESSAGE_HEADER_LEN));
 		lbs_deb_usbd(&cardp->udev->dev,"**EVENT** 0x%X\n",
 			    cardp->usb_event_cause);
 		if (cardp->usb_event_cause & 0xffff0000) {
 			lbs_send_tx_feedback(priv);
-			spin_unlock(&priv->adapter->driver_lock);
+			spin_unlock(&priv->driver_lock);
 			break;
 		}
 		cardp->usb_event_cause <<= 3;
 		cardp->usb_int_cause |= MRVDRV_CARDEVENT;
 		kfree_skb(skb);
 		lbs_interrupt(priv->dev);
-		spin_unlock(&priv->adapter->driver_lock);
+		spin_unlock(&priv->driver_lock);
 		goto rx_exit;
 	default:
 		lbs_deb_usbd(&cardp->udev->dev, "Unknown command type 0x%X\n",

@@ -750,7 +749,7 @@ static int if_usb_host_to_card(struct lbs_private *priv,
 	                    nb + MESSAGE_HEADER_LEN);
 }
 
-/* called with adapter->driver_lock held */
+/* called with priv->driver_lock held */
 static int if_usb_get_int_status(struct lbs_private *priv, u8 *ireg)
 {
 	struct usb_card_rec *cardp = priv->card;

@@ -767,7 +766,7 @@ static int if_usb_read_event_cause(struct lbs_private *priv)
 {
 	struct usb_card_rec *cardp = priv->card;
 
-	priv->adapter->eventcause = cardp->usb_event_cause;
+	priv->eventcause = cardp->usb_event_cause;
 	/* Re-submit rx urb here to avoid event lost issue */
 	if_usb_submit_rx_urb(cardp);
 	return 0;

@@ -942,7 +941,7 @@ static int if_usb_suspend(struct usb_interface *intf, pm_message_t message)
 
 	lbs_deb_enter(LBS_DEB_USB);
 
-	if (priv->adapter->psstate != PS_STATE_FULL_POWER)
+	if (priv->psstate != PS_STATE_FULL_POWER)
 		return -1;
 
 	if (priv->mesh_dev && !priv->mesh_autostart_enabled) {

356 lines not on this page · raw message

326 lines not on this page · raw message

78 lines not on this page · raw message

188 lines not on this page · raw message

index 9b62e2b..319f70d 100644

Lines of this file are not shown. View the raw message.

63 lines not on this page · raw message

372 lines not on this page · raw message

index 243cdea..2ff5f1b 100644
@@ -601,31 +601,24 @@ static void lbs_tx_timeout(struct net_device *dev)
 
 	lbs_pr_err("tx watch dog timeout\n");
 
-	priv->dnld_sent = DNLD_RES_RECEIVED;
 	dev->trans_start = jiffies;
 
 	if (priv->currenttxskb) {
-		if (priv->monitormode != LBS_MONITOR_OFF) {
-			/* If we are here, we have not received feedback from
-			   the previous packet.  Assume TX_FAIL and move on. */
-			priv->eventcause = 0x01000000;
-			lbs_send_tx_feedback(priv);
-		} else
-			wake_up_interruptible(&priv->waitq);
-	} else if (dev == priv->dev) {
-		if (priv->connect_status == LBS_CONNECTED)
-			netif_wake_queue(priv->dev);
-
-	} else if (dev == priv->mesh_dev) {
-		if (priv->mesh_connect_status == LBS_CONNECTED)
-			netif_wake_queue(priv->mesh_dev);
+		priv->eventcause = 0x01000000;
+		lbs_send_tx_feedback(priv);
 	}
+	/* XX: Shouldn't we also call into the hw-specific driver
+	   to kick it somehow? */
+	lbs_host_to_card_done(priv);
 
 	lbs_deb_leave(LBS_DEB_TX);
 }
 
 void lbs_host_to_card_done(struct lbs_private *priv)
 {
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->driver_lock, flags);
 
 	priv->dnld_sent = DNLD_RES_RECEIVED;
 

@@ -634,15 +627,16 @@ void lbs_host_to_card_done(struct lbs_private *priv)
 		wake_up_interruptible(&priv->waitq);
 
 	/* Don't wake netif queues if we're in monitor mode and
-	   a TX packet is already pending. */
-	if (priv->currenttxskb)
-		return;
-
-	if (priv->dev && priv->connect_status == LBS_CONNECTED)
-		netif_wake_queue(priv->dev);
+	   a TX packet is already pending, or if there are commands
+	   queued to be sent. */
+	if (!priv->currenttxskb && list_empty(&priv->cmdpendingq)) {
+		if (priv->dev && priv->connect_status == LBS_CONNECTED)
+			netif_wake_queue(priv->dev);
 
-	if (priv->mesh_dev && priv->mesh_connect_status == LBS_CONNECTED)
-		netif_wake_queue(priv->mesh_dev);
+		if (priv->mesh_dev && priv->mesh_connect_status == LBS_CONNECTED)
+			netif_wake_queue(priv->mesh_dev);
+	}
+	spin_unlock_irqrestore(&priv->driver_lock, flags);
 }
 EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
 

index 87bed4a..141d185 100644
@@ -374,20 +374,23 @@ static int if_prog_firmware(struct usb_card_rec *cardp)
 
 static int if_usb_reset_device(struct usb_card_rec *cardp)
 {
+	struct cmd_ds_command *cmd = (void *)&cardp->bulk_out_buffer[4];
 	int ret;
-	struct lbs_private *priv = cardp->priv;
 
 	lbs_deb_enter(LBS_DEB_USB);
 
-	/* Try a USB port reset first, if that fails send the reset
-	 * command to the firmware.
-	 */
+	*(__le32 *)cardp->bulk_out_buffer = cpu_to_le32(CMD_TYPE_REQUEST);
+
+	cmd->command = cpu_to_le16(CMD_802_11_RESET);
+	cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_reset) + S_DS_GEN);
+	cmd->result = cpu_to_le16(0);
+	cmd->seqnum = cpu_to_le16(0x5a5a);
+	cmd->params.reset.action = cpu_to_le16(CMD_ACT_HALT);
+	usb_tx_block(cardp, cardp->bulk_out_buffer, 4 + S_DS_GEN + sizeof(struct cmd_ds_802_11_reset));
+
+	msleep(10);
 	ret = usb_reset_device(cardp->udev);
-	if (!ret && priv) {
-		msleep(10);
-		ret = lbs_reset_device(priv);
-		msleep(10);
-	}
+	msleep(10);
 
 	lbs_deb_leave_args(LBS_DEB_USB, "ret %d", ret);
 

@@ -508,9 +511,15 @@ static void if_usb_receive_fwload(struct urb *urb)
 			return;
 		}
 		if (bootcmdresp.u32magicnumber != cpu_to_le32(BOOT_CMD_MAGIC_NUMBER)) {
-			lbs_pr_info(
-				"boot cmd response wrong magic number (0x%x)\n",
-				le32_to_cpu(bootcmdresp.u32magicnumber));
+			if (bootcmdresp.u32magicnumber == cpu_to_le32(CMD_TYPE_REQUEST) ||
+			    bootcmdresp.u32magicnumber == cpu_to_le32(CMD_TYPE_DATA) ||
+			    bootcmdresp.u32magicnumber == cpu_to_le32(CMD_TYPE_INDICATION)) {
+				lbs_pr_info("Firmware already seems alive; resetting\n");
+				cardp->bootcmdresp = -1;
+			} else {
+				lbs_pr_info("boot cmd response wrong magic number (0x%x)\n",
+					    le32_to_cpu(bootcmdresp.u32magicnumber));
+			}
 		} else if (bootcmdresp.u8cmd_tag != BOOT_CMD_FW_BY_USB) {
 			lbs_pr_info(
 				"boot cmd response cmd_tag error (%d)\n",

@@ -883,7 +892,7 @@ restart:
 		} while (cardp->bootcmdresp == 0 && j < 10);
 	} while (cardp->bootcmdresp == 0 && i < 5);
 
-	if (cardp->bootcmdresp == 0) {
+	if (cardp->bootcmdresp <= 0) {
 		if (--reset_count >= 0) {
 			if_usb_reset_device(cardp);
 			goto restart;

index f53ddb2..940a369 100644
@@ -70,7 +70,7 @@ struct usb_card_rec {
 
 	u8 rx_urb_recall;
 
-	u8 bootcmdresp;
+	s8 bootcmdresp;
 };
 
 /** fwheader */

index 9917a18..e8a24d7 100644
@@ -320,8 +320,7 @@ static ssize_t lbs_setuserscan(struct file *file,
 
 	lbs_scan_networks(priv, scan_cfg, 1);
 	wait_event_interruptible(priv->cmd_pending,
-				 priv->surpriseremoved || 
-				 (!priv->cur_cmd && list_empty(&priv->cmdpendingq)));
+				 priv->surpriseremoved || !priv->last_scanned_channel);
 
 	if (priv->surpriseremoved)
 		goto out_scan_cfg;

index e255b19..b094514 100644
@@ -62,8 +62,6 @@ void lbs_ps_sleep(struct lbs_private *priv, int wait_option);
 void lbs_ps_confirm_sleep(struct lbs_private *priv, u16 psmode);
 void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
 
-void lbs_tx_runqueue(struct lbs_private *priv);
-
 struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
 	struct lbs_private *priv,
 	u8 band,

index 21b0d38..a9c3adc 100644
@@ -197,11 +197,6 @@ struct lbs_private {
 	/** Timers */
 	struct timer_list command_timer;
 
-	/* TX queue used in PS mode */
-	spinlock_t txqueue_lock;
-	struct sk_buff *tx_queue_ps[NR_TX_QUEUE];
-	unsigned int tx_queue_idx;
-
 	u8 hisregcpy;
 
 	/** current ssid/bssid related parameters*/

index 2ff5f1b..c638995 100644
@@ -914,8 +914,6 @@ static int lbs_thread(void *data)
 		 */
 		if (!list_empty(&priv->cmdpendingq))
 			wake_up_all(&priv->cmd_pending);
-
-		lbs_tx_runqueue(priv);
 	}
 
 	del_timer(&priv->command_timer);

@@ -1072,10 +1070,6 @@ static int lbs_init_adapter(struct lbs_private *priv)
 
 	mutex_init(&priv->lock);
 
-	memset(&priv->tx_queue_ps, 0, NR_TX_QUEUE*sizeof(struct sk_buff*));
-	priv->tx_queue_idx = 0;
-	spin_lock_init(&priv->txqueue_lock);
-
 	setup_timer(&priv->command_timer, command_timer_fn,
 	            (unsigned long)priv);
 

index 4cb39d3..749535e 100644
@@ -164,41 +164,6 @@ done:
 }
 
 
-void lbs_tx_runqueue(struct lbs_private *priv)
-{
-	int i;
-
-	spin_lock(&priv->txqueue_lock);
-	for (i = 0; i < priv->tx_queue_idx; i++) {
-		struct sk_buff *skb = priv->tx_queue_ps[i];
-		spin_unlock(&priv->txqueue_lock);
-		SendSinglePacket(priv, skb);
-		spin_lock(&priv->txqueue_lock);
-	}
-	priv->tx_queue_idx = 0;
-	spin_unlock(&priv->txqueue_lock);
-}
-
-static void lbs_tx_queue(struct lbs_private *priv, struct sk_buff *skb)
-{
-
-	spin_lock(&priv->txqueue_lock);
-
-	WARN_ON(priv->tx_queue_idx >= NR_TX_QUEUE);
-	priv->tx_queue_ps[priv->tx_queue_idx++] = skb;
-	if (priv->tx_queue_idx == NR_TX_QUEUE) {
-		netif_stop_queue(priv->dev);
-		if (priv->mesh_dev)
-			netif_stop_queue(priv->mesh_dev);
-	} else {
-		netif_start_queue(priv->dev);
-		if (priv->mesh_dev)
-			netif_start_queue(priv->mesh_dev);
-	}
-
-	spin_unlock(&priv->txqueue_lock);
-}
-
 /**
  *  @brief This function checks the conditions and sends packet to IF
  *  layer if everything is ok.

@@ -221,8 +186,9 @@ int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
 
 	if ((priv->psstate == PS_STATE_SLEEP) ||
 	    (priv->psstate == PS_STATE_PRE_SLEEP)) {
-		lbs_tx_queue(priv, skb);
-		return ret;
+		lbs_pr_alert("TX error: packet xmit in %ssleep mode\n",
+			     priv->psstate == PS_STATE_SLEEP?"":"pre-");
+		goto done;
 	}
 
 	ret = SendSinglePacket(priv, skb);

index 749535e..10596f3 100644
@@ -49,16 +49,16 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
 }
 
 /**
- *  @brief This function processes a single packet and sends
- *  to IF layer
+ *  @brief This function checks the conditions and sends packet to IF
+ *  layer if everything is ok.
  *
  *  @param priv    A pointer to struct lbs_private structure
  *  @param skb     A pointer to skb which includes TX packet
  *  @return 	   0 or -1
  */
-static int SendSinglePacket(struct lbs_private *priv, struct sk_buff *skb)
+int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
 {
-	int ret = 0;
+	int ret = -1;
 	struct txpd localtxpd;
 	struct txpd *plocaltxpd = &localtxpd;
 	u8 *p802x_hdr;

@@ -68,16 +68,31 @@ static int SendSinglePacket(struct lbs_private *priv, struct sk_buff *skb)
 
 	lbs_deb_enter(LBS_DEB_TX);
 
+	lbs_deb_hex(LBS_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
+
+	if (priv->dnld_sent) {
+		lbs_pr_alert( "TX error: dnld_sent = %d, not sending\n",
+		       priv->dnld_sent);
+		goto done;
+	}
+
+	if ((priv->psstate == PS_STATE_SLEEP) ||
+	    (priv->psstate == PS_STATE_PRE_SLEEP)) {
+		lbs_pr_alert("TX error: packet xmit in %ssleep mode\n",
+			     priv->psstate == PS_STATE_SLEEP?"":"pre-");
+		goto done;
+	}
+
 	if (priv->surpriseremoved)
 		return -1;
 
 	if (!skb->len || (skb->len > MRVDRV_ETH_TX_PACKET_BUFFER_SIZE)) {
 		lbs_deb_tx("tx err: skb length %d 0 or > %zd\n",
 		       skb->len, MRVDRV_ETH_TX_PACKET_BUFFER_SIZE);
-		ret = -1;
-		goto done;
+		goto done_tx;
 	}
 
+	ret = 0;
 	memset(plocaltxpd, 0, sizeof(struct txpd));
 
 	plocaltxpd->tx_packet_length = cpu_to_le16(skb->len);

@@ -130,12 +145,12 @@ static int SendSinglePacket(struct lbs_private *priv, struct sk_buff *skb)
 
 	if (ret) {
 		lbs_deb_tx("tx err: hw_host_to_card returned 0x%X\n", ret);
-		goto done;
+		goto done_tx;
 	}
 
-	lbs_deb_tx("SendSinglePacket succeeds\n");
+	lbs_deb_tx("%s succeeds\n", __func__);
 
-done:
+done_tx:
 	if (!ret) {
 		priv->stats.tx_packets++;
 		priv->stats.tx_bytes += skb->len;

@@ -159,39 +174,6 @@ done:
 		dev_kfree_skb_any(skb);
 	}
 
-	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
-	return ret;
-}
-
-
-/**
- *  @brief This function checks the conditions and sends packet to IF
- *  layer if everything is ok.
- *
- *  @param priv    A pointer to struct lbs_private structure
- *  @return 	   n/a
- */
-int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
-{
-	int ret = -1;
-
-	lbs_deb_enter(LBS_DEB_TX);
-	lbs_deb_hex(LBS_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
-
-	if (priv->dnld_sent) {
-		lbs_pr_alert( "TX error: dnld_sent = %d, not sending\n",
-		       priv->dnld_sent);
-		goto done;
-	}
-
-	if ((priv->psstate == PS_STATE_SLEEP) ||
-	    (priv->psstate == PS_STATE_PRE_SLEEP)) {
-		lbs_pr_alert("TX error: packet xmit in %ssleep mode\n",
-			     priv->psstate == PS_STATE_SLEEP?"":"pre-");
-		goto done;
-	}
-
-	ret = SendSinglePacket(priv, skb);
 done:
 	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
 	return ret;

index b094514..fcb5a85 100644
@@ -50,10 +50,10 @@ void lbs_upload_rx_packet(struct lbs_private *priv, struct sk_buff *skb);
 
 /** The proc fs interface */
 int lbs_process_rx_command(struct lbs_private *priv);
-int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb);
 void __lbs_cleanup_and_insert_cmd(struct lbs_private *priv,
 	struct cmd_ctrl_node *ptempcmd);
 
+int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
 
 int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *);

index c638995..d311d57 100644
@@ -515,38 +515,6 @@ static int lbs_close(struct net_device *dev)
 		return 0;
 }
 
-
-static int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	int ret = 0;
-	struct lbs_private *priv = dev->priv;
-
-	lbs_deb_enter(LBS_DEB_TX);
-
-	/* We could return NETDEV_TX_BUSY here, but I'd actually 
-	   like to get the point where we can BUG() */
-	if (priv->dnld_sent) {
-		lbs_pr_err("%s while dnld_sent\n", __func__);
-		priv->stats.tx_dropped++;
-		goto done;
-	}
-	if (priv->currenttxskb) {
-		lbs_pr_err("%s while TX skb pending\n", __func__);
-		priv->stats.tx_dropped++;
-		goto done;
-	}
-
-	netif_stop_queue(priv->dev);
-	if (priv->mesh_dev)
-		netif_stop_queue(priv->mesh_dev);
-
-	if (lbs_process_tx(priv, skb) == 0)
-		dev->trans_start = jiffies;
-done:
-	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
-	return ret;
-}
-
 /**
  * @brief Mark mesh packets and handover them to lbs_hard_start_xmit
  *

index 10596f3..336544c 100644
@@ -56,7 +56,7 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
  *  @param skb     A pointer to skb which includes TX packet
  *  @return 	   0 or -1
  */
-int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
+static int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
 {
 	int ret = -1;
 	struct txpd localtxpd;

@@ -179,6 +179,37 @@ done:
 	return ret;
 }
 
+int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	int ret = 0;
+	struct lbs_private *priv = dev->priv;
+
+	lbs_deb_enter(LBS_DEB_TX);
+
+	/* We could return NETDEV_TX_BUSY here, but I'd actually 
+	   like to get the point where we can BUG() */
+	if (priv->dnld_sent) {
+		lbs_pr_err("%s while dnld_sent\n", __func__);
+		priv->stats.tx_dropped++;
+		goto done;
+	}
+	if (priv->currenttxskb) {
+		lbs_pr_err("%s while TX skb pending\n", __func__);
+		priv->stats.tx_dropped++;
+		goto done;
+	}
+
+	netif_stop_queue(priv->dev);
+	if (priv->mesh_dev)
+		netif_stop_queue(priv->mesh_dev);
+
+	if (lbs_process_tx(priv, skb) == 0)
+		dev->trans_start = jiffies;
+done:
+	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
+	return ret;
+}
+
 /**
  *  @brief This function sends to the host the last transmitted packet,
  *  filling the radiotap headers with transmission information.

index 336544c..7bc2124 100644
@@ -56,8 +56,9 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
  *  @param skb     A pointer to skb which includes TX packet
  *  @return 	   0 or -1
  */
-static int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
+int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+	struct lbs_private *priv = dev->priv;
 	int ret = -1;
 	struct txpd localtxpd;
 	struct txpd *plocaltxpd = &localtxpd;

@@ -70,12 +71,21 @@ static int lbs_process_tx(struct lbs_private *priv, struct sk_buff *skb)
 
 	lbs_deb_hex(LBS_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
 
+	netif_stop_queue(priv->dev);
+	if (priv->mesh_dev)
+		netif_stop_queue(priv->mesh_dev);
+
 	if (priv->dnld_sent) {
 		lbs_pr_alert( "TX error: dnld_sent = %d, not sending\n",
 		       priv->dnld_sent);
 		goto done;
 	}
 
+	if (priv->currenttxskb) {
+		lbs_pr_err("%s while TX skb pending\n", __func__);
+		goto done;
+	}
+
 	if ((priv->psstate == PS_STATE_SLEEP) ||
 	    (priv->psstate == PS_STATE_PRE_SLEEP)) {
 		lbs_pr_alert("TX error: packet xmit in %ssleep mode\n",

@@ -154,6 +164,8 @@ done_tx:
 	if (!ret) {
 		priv->stats.tx_packets++;
 		priv->stats.tx_bytes += skb->len;
+
+ 		dev->trans_start = jiffies;
 	} else {
 		priv->stats.tx_dropped++;
 		priv->stats.tx_errors++;

@@ -179,37 +191,6 @@ done:
 	return ret;
 }
 
-int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	int ret = 0;
-	struct lbs_private *priv = dev->priv;
-
-	lbs_deb_enter(LBS_DEB_TX);
-
-	/* We could return NETDEV_TX_BUSY here, but I'd actually 
-	   like to get the point where we can BUG() */
-	if (priv->dnld_sent) {
-		lbs_pr_err("%s while dnld_sent\n", __func__);
-		priv->stats.tx_dropped++;
-		goto done;
-	}
-	if (priv->currenttxskb) {
-		lbs_pr_err("%s while TX skb pending\n", __func__);
-		priv->stats.tx_dropped++;
-		goto done;
-	}
-
-	netif_stop_queue(priv->dev);
-	if (priv->mesh_dev)
-		netif_stop_queue(priv->mesh_dev);
-
-	if (lbs_process_tx(priv, skb) == 0)
-		dev->trans_start = jiffies;
-done:
-	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
-	return ret;
-}
-
 /**
  *  @brief This function sends to the host the last transmitted packet,
  *  filling the radiotap headers with transmission information.

index 7bc2124..aefe524 100644
@@ -58,22 +58,16 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
  */
 int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+	unsigned long flags;
 	struct lbs_private *priv = dev->priv;
-	int ret = -1;
-	struct txpd localtxpd;
-	struct txpd *plocaltxpd = &localtxpd;
-	u8 *p802x_hdr;
-	struct tx_radiotap_hdr *pradiotap_hdr;
-	u32 new_rate;
-	u8 *ptr = priv->tmptxbuf;
+	struct txpd *txpd;
+	char *p802x_hdr;
+	uint16_t pkt_len;
+	int ret;
 
 	lbs_deb_enter(LBS_DEB_TX);
 
-	lbs_deb_hex(LBS_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
-
-	netif_stop_queue(priv->dev);
-	if (priv->mesh_dev)
-		netif_stop_queue(priv->mesh_dev);
+	ret = NETDEV_TX_BUSY;
 
 	if (priv->dnld_sent) {
 		lbs_pr_alert( "TX error: dnld_sent = %d, not sending\n",

@@ -94,98 +88,97 @@ int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	if (priv->surpriseremoved)
-		return -1;
+		goto drop;
 
 	if (!skb->len || (skb->len > MRVDRV_ETH_TX_PACKET_BUFFER_SIZE)) {
 		lbs_deb_tx("tx err: skb length %d 0 or > %zd\n",
 		       skb->len, MRVDRV_ETH_TX_PACKET_BUFFER_SIZE);
-		goto done_tx;
+		/* We'll never manage to send this one; drop it and return 'OK' */
+		goto drop;
 	}
 
-	ret = 0;
-	memset(plocaltxpd, 0, sizeof(struct txpd));
-
-	plocaltxpd->tx_packet_length = cpu_to_le16(skb->len);
+	lbs_deb_hex(LBS_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
 
-	/* offset of actual data */
-	plocaltxpd->tx_packet_location = cpu_to_le32(sizeof(struct txpd));
+	txpd = (void *)priv->tmptxbuf;
+	memset(txpd, 0, sizeof(struct txpd));
 
 	p802x_hdr = skb->data;
-	if (priv->monitormode != LBS_MONITOR_OFF) {
+	pkt_len = skb->len;
 
-		/* locate radiotap header */
-		pradiotap_hdr = (struct tx_radiotap_hdr *)skb->data;
+	if (priv->monitormode != LBS_MONITOR_OFF) {
+		struct tx_radiotap_hdr *rtap_hdr = (void *)skb->data;
 
 		/* set txpd fields from the radiotap header */
-		new_rate = convert_radiotap_rate_to_mv(pradiotap_hdr->rate);
-		if (new_rate != 0) {
-			/* use new tx_control[4:0] */
-			plocaltxpd->tx_control = cpu_to_le32(new_rate);
-		}
+		txpd->tx_control = cpu_to_le32(convert_radiotap_rate_to_mv(rtap_hdr->rate));
 
 		/* skip the radiotap header */
-		p802x_hdr += sizeof(struct tx_radiotap_hdr);
-		plocaltxpd->tx_packet_length =
-			cpu_to_le16(le16_to_cpu(plocaltxpd->tx_packet_length)
-				    - sizeof(struct tx_radiotap_hdr));
+		p802x_hdr += sizeof(*rtap_hdr);
+		pkt_len -= sizeof(*rtap_hdr);
 
+		/* copy destination address from 802.11 header */
+		memcpy(txpd->tx_dest_addr_high, p802x_hdr + 4, ETH_ALEN);
+	} else {
+		/* copy destination address from 802.3 header */
+		memcpy(txpd->tx_dest_addr_high, p802x_hdr, ETH_ALEN);
 	}
-	/* copy destination address from 802.3 or 802.11 header */
-	if (priv->monitormode != LBS_MONITOR_OFF)
-		memcpy(plocaltxpd->tx_dest_addr_high, p802x_hdr + 4, ETH_ALEN);
-	else
-		memcpy(plocaltxpd->tx_dest_addr_high, p802x_hdr, ETH_ALEN);
 
-	lbs_deb_hex(LBS_DEB_TX, "txpd", (u8 *) plocaltxpd, sizeof(struct txpd));
+	txpd->tx_packet_length = cpu_to_le16(pkt_len);
+	txpd->tx_packet_location = cpu_to_le32(sizeof(struct txpd));
 
-	if (IS_MESH_FRAME(skb)) {
-		plocaltxpd->tx_control |= cpu_to_le32(TxPD_MESH_FRAME);
-	}
+	if (dev == priv->mesh_dev)
+		txpd->tx_control |= cpu_to_le32(TxPD_MESH_FRAME);
 
-	memcpy(ptr, plocaltxpd, sizeof(struct txpd));
+	lbs_deb_hex(LBS_DEB_TX, "txpd", (u8 *) &txpd, sizeof(struct txpd));
 
-	ptr += sizeof(struct txpd);
+	lbs_deb_hex(LBS_DEB_TX, "Tx Data", (u8 *) p802x_hdr, le16_to_cpu(txpd->tx_packet_length));
 
-	lbs_deb_hex(LBS_DEB_TX, "Tx Data", (u8 *) p802x_hdr, le16_to_cpu(plocaltxpd->tx_packet_length));
-	memcpy(ptr, p802x_hdr, le16_to_cpu(plocaltxpd->tx_packet_length));
-	ret = priv->hw_host_to_card(priv, MVMS_DAT,
-				    priv->tmptxbuf,
-				    le16_to_cpu(plocaltxpd->tx_packet_length) +
-				    sizeof(struct txpd));
+	memcpy(&txpd[1], p802x_hdr, le16_to_cpu(txpd->tx_packet_length));
 
-	if (ret) {
-		lbs_deb_tx("tx err: hw_host_to_card returned 0x%X\n", ret);
-		goto done_tx;
-	}
+	/* We need to protect against the queues being restarted before
+	   we get round to stopping them */
+	spin_lock_irqsave(&priv->driver_lock, flags);
 
-	lbs_deb_tx("%s succeeds\n", __func__);
+	ret = priv->hw_host_to_card(priv, MVMS_DAT, priv->tmptxbuf,
+				    pkt_len + sizeof(struct txpd));
 
-done_tx:
 	if (!ret) {
+		lbs_deb_tx("%s succeeds\n", __func__);
+
+		/* Stop processing outgoing pkts before submitting */
+		netif_stop_queue(priv->dev);
+		if (priv->mesh_dev)
+			netif_stop_queue(priv->mesh_dev);
+
 		priv->stats.tx_packets++;
 		priv->stats.tx_bytes += skb->len;
 
- 		dev->trans_start = jiffies;
-	} else {
-		priv->stats.tx_dropped++;
-		priv->stats.tx_errors++;
+		dev->trans_start = jiffies;
+
+		if (priv->monitormode != LBS_MONITOR_OFF) {
+			/* Keep the skb to echo it back once Tx feedback is
+			   received from FW */
+			skb_orphan(skb);
+
+			/* Keep the skb around for when we get feedback */
+			priv->currenttxskb = skb;
+		}
 	}
+	
+	spin_unlock_irqrestore(&priv->driver_lock, flags);
 
-	if (!ret && priv->monitormode != LBS_MONITOR_OFF) {
-		/* Keep the skb to echo it back once Tx feedback is
-		   received from FW */
-		skb_orphan(skb);
-		/* stop processing outgoing pkts */
-		netif_stop_queue(priv->dev);
-		if (priv->mesh_dev)
-			netif_stop_queue(priv->mesh_dev);
+	if (ret) {
+		lbs_deb_tx("tx err: hw_host_to_card returned 0x%X\n", ret);
+drop:
+		priv->stats.tx_dropped++;
+		priv->stats.tx_errors++;
 
-		/* Keep the skb around for when we get feedback */
-		priv->currenttxskb = skb;
-	} else {
 		dev_kfree_skb_any(skb);
 	}
 
+	/* Even if we dropped the packet, return OK. Otherwise the
+	   packet gets requeued. */
+	ret = NETDEV_TX_OK;
+
 done:
 	lbs_deb_leave_args(LBS_DEB_TX, "ret %d", ret);
 	return ret;