Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

4 files changed, 354 insertions, 366 deletions

diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index eb79198ac45..72335c8eb97 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
+  Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms of version 2 of the GNU General Public License as
@@ -167,12 +167,12 @@ that only one external action is invoked at a time.
 
 #include "ipw2100.h"
 
-#define IPW2100_VERSION "git-1.1.4"
+#define IPW2100_VERSION "git-1.2.2"
 
 #define DRV_NAME	"ipw2100"
 #define DRV_VERSION	IPW2100_VERSION
 #define DRV_DESCRIPTION	"Intel(R) PRO/Wireless 2100 Network Driver"
-#define DRV_COPYRIGHT	"Copyright(c) 2003-2005 Intel Corporation"
+#define DRV_COPYRIGHT	"Copyright(c) 2003-2006 Intel Corporation"
 
 /* Debugging stuff */
 #ifdef CONFIG_IPW2100_DEBUG
@@ -1418,7 +1418,7 @@ static int ipw2100_enable_adapter(struct ipw2100_priv *priv)
 	if (priv->status & STATUS_ENABLED)
 		return 0;
 
-	down(&priv->adapter_sem);
+	mutex_lock(&priv->adapter_mutex);
 
 	if (rf_kill_active(priv)) {
 		IPW_DEBUG_HC("Command aborted due to RF kill active.\n");
@@ -1444,7 +1444,7 @@ static int ipw2100_enable_adapter(struct ipw2100_priv *priv)
 	}
 
       fail_up:
-	up(&priv->adapter_sem);
+	mutex_unlock(&priv->adapter_mutex);
 	return err;
 }
 
@@ -1576,7 +1576,7 @@ static int ipw2100_disable_adapter(struct ipw2100_priv *priv)
 		cancel_delayed_work(&priv->hang_check);
 	}
 
-	down(&priv->adapter_sem);
+	mutex_lock(&priv->adapter_mutex);
 
 	err = ipw2100_hw_send_command(priv, &cmd);
 	if (err) {
@@ -1595,7 +1595,7 @@ static int ipw2100_disable_adapter(struct ipw2100_priv *priv)
 	IPW_DEBUG_INFO("TODO: implement scan state machine\n");
 
       fail_up:
-	up(&priv->adapter_sem);
+	mutex_unlock(&priv->adapter_mutex);
 	return err;
 }
 
@@ -1888,7 +1888,7 @@ static void ipw2100_reset_adapter(struct ipw2100_priv *priv)
 	priv->status |= STATUS_RESET_PENDING;
 	spin_unlock_irqrestore(&priv->low_lock, flags);
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	/* stop timed checks so that they don't interfere with reset */
 	priv->stop_hang_check = 1;
 	cancel_delayed_work(&priv->hang_check);
@@ -1898,7 +1898,7 @@ static void ipw2100_reset_adapter(struct ipw2100_priv *priv)
 		wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
 
 	ipw2100_up(priv, 0);
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
 }
 
@@ -2390,15 +2390,6 @@ static void isr_rx(struct ipw2100_priv *priv, int i,
 		IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
 		return;
 	}
-#ifdef CONFIG_IPW2100_MONITOR
-	if (unlikely(priv->ieee->iw_mode == IW_MODE_MONITOR &&
-		     priv->config & CFG_CRC_CHECK &&
-		     status->flags & IPW_STATUS_FLAG_CRC_ERROR)) {
-		IPW_DEBUG_RX("CRC error in packet.  Dropping.\n");
-		priv->ieee->stats.rx_errors++;
-		return;
-	}
-#endif
 
 	if (unlikely(priv->ieee->iw_mode != IW_MODE_MONITOR &&
 		     !(priv->status & STATUS_ASSOCIATED))) {
@@ -2446,6 +2437,89 @@ static void isr_rx(struct ipw2100_priv *priv, int i,
 	priv->rx_queue.drv[i].host_addr = packet->dma_addr;
 }
 
+#ifdef CONFIG_IPW2100_MONITOR
+
+static void isr_rx_monitor(struct ipw2100_priv *priv, int i,
+		   struct ieee80211_rx_stats *stats)
+{
+	struct ipw2100_status *status = &priv->status_queue.drv[i];
+	struct ipw2100_rx_packet *packet = &priv->rx_buffers[i];
+
+	/* Magic struct that slots into the radiotap header -- no reason
+	 * to build this manually element by element, we can write it much
+	 * more efficiently than we can parse it. ORDER MATTERS HERE */
+	struct ipw_rt_hdr {
+		struct ieee80211_radiotap_header rt_hdr;
+		s8 rt_dbmsignal; /* signal in dbM, kluged to signed */
+	} *ipw_rt;
+
+	IPW_DEBUG_RX("Handler...\n");
+
+	if (unlikely(status->frame_size > skb_tailroom(packet->skb) -
+				sizeof(struct ipw_rt_hdr))) {
+		IPW_DEBUG_INFO("%s: frame_size (%u) > skb_tailroom (%u)!"
+			       "  Dropping.\n",
+			       priv->net_dev->name,
+			       status->frame_size,
+			       skb_tailroom(packet->skb));
+		priv->ieee->stats.rx_errors++;
+		return;
+	}
+
+	if (unlikely(!netif_running(priv->net_dev))) {
+		priv->ieee->stats.rx_errors++;
+		priv->wstats.discard.misc++;
+		IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
+		return;
+	}
+
+	if (unlikely(priv->config & CFG_CRC_CHECK &&
+		     status->flags & IPW_STATUS_FLAG_CRC_ERROR)) {
+		IPW_DEBUG_RX("CRC error in packet.  Dropping.\n");
+		priv->ieee->stats.rx_errors++;
+		return;
+	}
+
+	pci_unmap_single(priv->pci_dev, packet->dma_addr,
+			 sizeof(struct ipw2100_rx), PCI_DMA_FROMDEVICE);
+	memmove(packet->skb->data + sizeof(struct ipw_rt_hdr),
+		packet->skb->data, status->frame_size);
+
+	ipw_rt = (struct ipw_rt_hdr *) packet->skb->data;
+
+	ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
+	ipw_rt->rt_hdr.it_pad = 0; /* always good to zero */
+	ipw_rt->rt_hdr.it_len = sizeof(struct ipw_rt_hdr); /* total hdr+data */
+
+	ipw_rt->rt_hdr.it_present = 1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL;
+
+	ipw_rt->rt_dbmsignal = status->rssi + IPW2100_RSSI_TO_DBM;
+
+	skb_put(packet->skb, status->frame_size + sizeof(struct ipw_rt_hdr));
+
+	if (!ieee80211_rx(priv->ieee, packet->skb, stats)) {
+		priv->ieee->stats.rx_errors++;
+
+		/* ieee80211_rx failed, so it didn't free the SKB */
+		dev_kfree_skb_any(packet->skb);
+		packet->skb = NULL;
+	}
+
+	/* We need to allocate a new SKB and attach it to the RDB. */
+	if (unlikely(ipw2100_alloc_skb(priv, packet))) {
+		IPW_DEBUG_WARNING(
+			"%s: Unable to allocate SKB onto RBD ring - disabling "
+			"adapter.\n", priv->net_dev->name);
+		/* TODO: schedule adapter shutdown */
+		IPW_DEBUG_INFO("TODO: Shutdown adapter...\n");
+	}
+
+	/* Update the RDB entry */
+	priv->rx_queue.drv[i].host_addr = packet->dma_addr;
+}
+
+#endif
+
 static int ipw2100_corruption_check(struct ipw2100_priv *priv, int i)
 {
 	struct ipw2100_status *status = &priv->status_queue.drv[i];
@@ -2577,7 +2651,7 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)
 		case P8023_DATA_VAL:
 #ifdef CONFIG_IPW2100_MONITOR
 			if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-				isr_rx(priv, i, &stats);
+				isr_rx_monitor(priv, i, &stats);
 				break;
 			}
 #endif
@@ -3882,7 +3956,7 @@ static int ipw2100_switch_mode(struct ipw2100_priv *priv, u32 mode)
 #ifdef CONFIG_IPW2100_MONITOR
 	case IW_MODE_MONITOR:
 		priv->last_mode = priv->ieee->iw_mode;
-		priv->net_dev->type = ARPHRD_IEEE80211;
+		priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
 		break;
 #endif				/* CONFIG_IPW2100_MONITOR */
 	}
@@ -4138,7 +4212,7 @@ static int ipw_radio_kill_sw(struct ipw2100_priv *priv, int disable_radio)
 	IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
 			  disable_radio ? "OFF" : "ON");
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 
 	if (disable_radio) {
 		priv->status |= STATUS_RF_KILL_SW;
@@ -4156,7 +4230,7 @@ static int ipw_radio_kill_sw(struct ipw2100_priv *priv, int disable_radio)
 			schedule_reset(priv);
 	}
 
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return 1;
 }
 
@@ -5460,7 +5534,7 @@ static void shim__set_security(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int i, force_update = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED))
 		goto done;
 
@@ -5533,7 +5607,7 @@ static void shim__set_security(struct net_device *dev,
 	if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
 		ipw2100_configure_security(priv, 0);
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 }
 
 static int ipw2100_adapter_setup(struct ipw2100_priv *priv)
@@ -5657,7 +5731,7 @@ static int ipw2100_set_address(struct net_device *dev, void *p)
 	if (!is_valid_ether_addr(addr->sa_data))
 		return -EADDRNOTAVAIL;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 
 	priv->config |= CFG_CUSTOM_MAC;
 	memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
@@ -5667,12 +5741,12 @@ static int ipw2100_set_address(struct net_device *dev, void *p)
 		goto done;
 
 	priv->reset_backoff = 0;
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	ipw2100_reset_adapter(priv);
 	return 0;
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -6015,8 +6089,8 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
 	strcpy(priv->nick, "ipw2100");
 
 	spin_lock_init(&priv->low_lock);
-	sema_init(&priv->action_sem, 1);
-	sema_init(&priv->adapter_sem, 1);
+	mutex_init(&priv->action_mutex);
+	mutex_init(&priv->adapter_mutex);
 
 	init_waitqueue_head(&priv->wait_command_queue);
 
@@ -6181,7 +6255,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 	 * member to call a function that then just turns and calls ipw2100_up.
 	 * net_dev->init is called after name allocation but before the
 	 * notifier chain is called */
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	err = register_netdev(dev);
 	if (err) {
 		printk(KERN_WARNING DRV_NAME
@@ -6217,12 +6291,12 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
 	priv->status |= STATUS_INITIALIZED;
 
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
 	return 0;
 
       fail_unlock:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
       fail:
 	if (dev) {
@@ -6262,7 +6336,7 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 	struct net_device *dev;
 
 	if (priv) {
-		down(&priv->action_sem);
+		mutex_lock(&priv->action_mutex);
 
 		priv->status &= ~STATUS_INITIALIZED;
 
@@ -6277,9 +6351,9 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 		/* Take down the hardware */
 		ipw2100_down(priv);
 
-		/* Release the semaphore so that the network subsystem can
+		/* Release the mutex so that the network subsystem can
 		 * complete any needed calls into the driver... */
-		up(&priv->action_sem);
+		mutex_unlock(&priv->action_mutex);
 
 		/* Unregister the device first - this results in close()
 		 * being called if the device is open.  If we free storage
@@ -6318,7 +6392,7 @@ static int ipw2100_suspend(struct pci_dev *pci_dev, pm_message_t state)
 
 	IPW_DEBUG_INFO("%s: Going into suspend...\n", dev->name);
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (priv->status & STATUS_INITIALIZED) {
 		/* Take down the device; powers it off, etc. */
 		ipw2100_down(priv);
@@ -6331,7 +6405,7 @@ static int ipw2100_suspend(struct pci_dev *pci_dev, pm_message_t state)
 	pci_disable_device(pci_dev);
 	pci_set_power_state(pci_dev, PCI_D3hot);
 
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
 	return 0;
 }
@@ -6345,7 +6419,7 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
 	if (IPW2100_PM_DISABLED)
 		return 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 
 	IPW_DEBUG_INFO("%s: Coming out of suspend...\n", dev->name);
 
@@ -6371,7 +6445,7 @@ static int ipw2100_resume(struct pci_dev *pci_dev)
 	if (!(priv->status & STATUS_RF_KILL_SW))
 		ipw2100_up(priv, 0);
 
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
 	return 0;
 }
@@ -6535,7 +6609,7 @@ static int ipw2100_wx_set_freq(struct net_device *dev,
 	if (priv->ieee->iw_mode == IW_MODE_INFRA)
 		return -EOPNOTSUPP;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -6566,7 +6640,7 @@ static int ipw2100_wx_set_freq(struct net_device *dev,
 	}
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -6607,7 +6681,7 @@ static int ipw2100_wx_set_mode(struct net_device *dev,
 	if (wrqu->mode == priv->ieee->iw_mode)
 		return 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -6630,7 +6704,7 @@ static int ipw2100_wx_set_mode(struct net_device *dev,
 	}
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -6812,7 +6886,7 @@ static int ipw2100_wx_set_wap(struct net_device *dev,
 	if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
 		return -EINVAL;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -6841,7 +6915,7 @@ static int ipw2100_wx_set_wap(struct net_device *dev,
 		     wrqu->ap_addr.sa_data[5] & 0xff);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -6877,7 +6951,7 @@ static int ipw2100_wx_set_essid(struct net_device *dev,
 	int length = 0;
 	int err = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -6914,7 +6988,7 @@ static int ipw2100_wx_set_essid(struct net_device *dev,
 	err = ipw2100_set_essid(priv, essid, length, 0);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -6995,7 +7069,7 @@ static int ipw2100_wx_set_rate(struct net_device *dev,
 	u32 rate;
 	int err = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7022,7 +7096,7 @@ static int ipw2100_wx_set_rate(struct net_device *dev,
 
 	IPW_DEBUG_WX("SET Rate -> %04X \n", rate);
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7042,7 +7116,7 @@ static int ipw2100_wx_get_rate(struct net_device *dev,
 		return 0;
 	}
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7074,7 +7148,7 @@ static int ipw2100_wx_get_rate(struct net_device *dev,
 	IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7089,7 +7163,7 @@ static int ipw2100_wx_set_rts(struct net_device *dev,
 	if (wrqu->rts.fixed == 0)
 		return -EINVAL;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7109,7 +7183,7 @@ static int ipw2100_wx_set_rts(struct net_device *dev,
 
 	IPW_DEBUG_WX("SET RTS Threshold -> 0x%08X \n", value);
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7160,7 +7234,7 @@ static int ipw2100_wx_set_txpow(struct net_device *dev,
 		value = wrqu->txpower.value;
 	}
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7171,7 +7245,7 @@ static int ipw2100_wx_set_txpow(struct net_device *dev,
 	IPW_DEBUG_WX("SET TX Power -> %d \n", value);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7263,7 +7337,7 @@ static int ipw2100_wx_set_retry(struct net_device *dev,
 	if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
 		return 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7290,7 +7364,7 @@ static int ipw2100_wx_set_retry(struct net_device *dev,
 	IPW_DEBUG_WX("SET Both Retry Limits -> %d \n", wrqu->retry.value);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7333,7 +7407,7 @@ static int ipw2100_wx_set_scan(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int err = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7348,7 +7422,7 @@ static int ipw2100_wx_set_scan(struct net_device *dev,
 	}
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7398,7 +7472,7 @@ static int ipw2100_wx_set_power(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int err = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7431,7 +7505,7 @@ static int ipw2100_wx_set_power(struct net_device *dev,
 	IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n", priv->power_mode);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 
 }
@@ -7735,7 +7809,7 @@ static int ipw2100_wx_set_promisc(struct net_device *dev,
 	int enable = (parms[0] > 0);
 	int err = 0;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7753,7 +7827,7 @@ static int ipw2100_wx_set_promisc(struct net_device *dev,
 			err = ipw2100_switch_mode(priv, priv->last_mode);
 	}
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7776,7 +7850,7 @@ static int ipw2100_wx_set_powermode(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int err = 0, mode = *(int *)extra;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7788,7 +7862,7 @@ static int ipw2100_wx_set_powermode(struct net_device *dev,
 	if (priv->power_mode != mode)
 		err = ipw2100_set_power_mode(priv, mode);
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7840,7 +7914,7 @@ static int ipw2100_wx_set_preamble(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int err, mode = *(int *)extra;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7858,7 +7932,7 @@ static int ipw2100_wx_set_preamble(struct net_device *dev,
 	err = ipw2100_system_config(priv, 0);
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -7888,7 +7962,7 @@ static int ipw2100_wx_set_crc_check(struct net_device *dev,
 	struct ipw2100_priv *priv = ieee80211_priv(dev);
 	int err, mode = *(int *)extra;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 	if (!(priv->status & STATUS_INITIALIZED)) {
 		err = -EIO;
 		goto done;
@@ -7905,7 +7979,7 @@ static int ipw2100_wx_set_crc_check(struct net_device *dev,
 	err = 0;
 
       done:
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 	return err;
 }
 
@@ -8210,11 +8284,11 @@ static void ipw2100_wx_event_work(struct ipw2100_priv *priv)
 	if (priv->status & STATUS_STOPPING)
 		return;
 
-	down(&priv->action_sem);
+	mutex_lock(&priv->action_mutex);
 
 	IPW_DEBUG_WX("enter\n");
 
-	up(&priv->action_sem);
+	mutex_unlock(&priv->action_mutex);
 
 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 
@@ -8237,7 +8311,7 @@ static void ipw2100_wx_event_work(struct ipw2100_priv *priv)
 
 	if (!(priv->status & STATUS_ASSOCIATED)) {
 		IPW_DEBUG_WX("Configuring ESSID\n");
-		down(&priv->action_sem);
+		mutex_lock(&priv->action_mutex);
 		/* This is a disassociation event, so kick the firmware to
 		 * look for another AP */
 		if (priv->config & CFG_STATIC_ESSID)
@@ -8245,7 +8319,7 @@ static void ipw2100_wx_event_work(struct ipw2100_priv *priv)
 					  0);
 		else
 			ipw2100_set_essid(priv, NULL, 0, 0);
-		up(&priv->action_sem);
+		mutex_unlock(&priv->action_mutex);
 	}
 
 	wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
diff --git a/drivers/net/wireless/ipw2100.h b/drivers/net/wireless/ipw2100.h
index 51360910d22..55b7227198d 100644
--- a/drivers/net/wireless/ipw2100.h
+++ b/drivers/net/wireless/ipw2100.h
@@ -1,6 +1,6 @@
 /******************************************************************************
 
-  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
+  Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms of version 2 of the GNU General Public License as
@@ -41,7 +41,12 @@
 
 #include <net/ieee80211.h>
 
+#ifdef CONFIG_IPW2100_MONITOR
+#include <net/ieee80211_radiotap.h>
+#endif
+
 #include <linux/workqueue.h>
+#include <linux/mutex.h>
 
 struct ipw2100_priv;
 struct ipw2100_tx_packet;
@@ -590,8 +595,8 @@ struct ipw2100_priv {
 	int inta_other;
 
 	spinlock_t low_lock;
-	struct semaphore action_sem;
-	struct semaphore adapter_sem;
+	struct mutex action_mutex;
+	struct mutex adapter_mutex;
 
 	wait_queue_head_t wait_command_queue;
 };
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index ed37141319e..9dce522526c 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1,6 +1,6 @@
 /******************************************************************************
 
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
+  Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
 
   802.11 status code portion of this file from ethereal-0.10.6:
     Copyright 2000, Axis Communications AB
@@ -33,9 +33,9 @@
 #include "ipw2200.h"
 #include <linux/version.h>
 
-#define IPW2200_VERSION "git-1.0.10"
+#define IPW2200_VERSION "git-1.1.1"
 #define DRV_DESCRIPTION	"Intel(R) PRO/Wireless 2200/2915 Network Driver"
-#define DRV_COPYRIGHT	"Copyright(c) 2003-2005 Intel Corporation"
+#define DRV_COPYRIGHT	"Copyright(c) 2003-2006 Intel Corporation"
 #define DRV_VERSION     IPW2200_VERSION
 
 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
@@ -153,12 +153,6 @@ static int init_supported_rates(struct ipw_priv *priv,
 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
 static void ipw_send_wep_keys(struct ipw_priv *, int);
 
-static int ipw_is_valid_channel(struct ieee80211_device *, u8);
-static int ipw_channel_to_index(struct ieee80211_device *, u8);
-static u8 ipw_freq_to_channel(struct ieee80211_device *, u32);
-static int ipw_set_geo(struct ieee80211_device *, const struct ieee80211_geo *);
-static const struct ieee80211_geo *ipw_get_geo(struct ieee80211_device *);
-
 static int snprint_line(char *buf, size_t count,
 			const u8 * data, u32 len, u32 ofs)
 {
@@ -1654,7 +1648,7 @@ static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
 			break;
 		}
 
-		if (ipw_is_valid_channel(priv->ieee, channel))
+		if (ieee80211_is_valid_channel(priv->ieee, channel))
 			priv->speed_scan[pos++] = channel;
 		else
 			IPW_WARNING("Skipping invalid channel request: %d\n",
@@ -1802,9 +1796,9 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
 	}
 
 	if (inta & IPW_INTA_BIT_FATAL_ERROR) {
-		IPW_ERROR("Firmware error detected.  Restarting.\n");
+		IPW_WARNING("Firmware error detected.  Restarting.\n");
 		if (priv->error) {
-			IPW_ERROR("Sysfs 'error' log already exists.\n");
+			IPW_DEBUG_FW("Sysfs 'error' log already exists.\n");
 #ifdef CONFIG_IPW2200_DEBUG
 			if (ipw_debug_level & IPW_DL_FW_ERRORS) {
 				struct ipw_fw_error *error =
@@ -1817,10 +1811,10 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
 		} else {
 			priv->error = ipw_alloc_error_log(priv);
 			if (priv->error)
-				IPW_ERROR("Sysfs 'error' log captured.\n");
+				IPW_DEBUG_FW("Sysfs 'error' log captured.\n");
 			else
-				IPW_ERROR("Error allocating sysfs 'error' "
-					  "log.\n");
+				IPW_DEBUG_FW("Error allocating sysfs 'error' "
+					     "log.\n");
 #ifdef CONFIG_IPW2200_DEBUG
 			if (ipw_debug_level & IPW_DL_FW_ERRORS)
 				ipw_dump_error_log(priv, priv->error);
@@ -2222,7 +2216,7 @@ static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
 
 static int ipw_set_tx_power(struct ipw_priv *priv)
 {
-	const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
+	const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
 	struct ipw_tx_power tx_power;
 	s8 max_power;
 	int i;
@@ -2835,33 +2829,11 @@ static void ipw_arc_release(struct ipw_priv *priv)
 	mdelay(5);
 }
 
-struct fw_header {
-	u32 version;
-	u32 mode;
-};
-
 struct fw_chunk {
 	u32 address;
 	u32 length;
 };
 
-#define IPW_FW_MAJOR_VERSION 2
-#define IPW_FW_MINOR_VERSION 4
-
-#define IPW_FW_MINOR(x) ((x & 0xff) >> 8)
-#define IPW_FW_MAJOR(x) (x & 0xff)
-
-#define IPW_FW_VERSION ((IPW_FW_MINOR_VERSION << 8) | IPW_FW_MAJOR_VERSION)
-
-#define IPW_FW_PREFIX "ipw-" __stringify(IPW_FW_MAJOR_VERSION) \
-"." __stringify(IPW_FW_MINOR_VERSION) "-"
-
-#if IPW_FW_MAJOR_VERSION >= 2 && IPW_FW_MINOR_VERSION > 0
-#define IPW_FW_NAME(x) IPW_FW_PREFIX "" x ".fw"
-#else
-#define IPW_FW_NAME(x) "ipw2200_" x ".fw"
-#endif
-
 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 {
 	int rc = 0, i, addr;
@@ -3130,33 +3102,47 @@ static int ipw_reset_nic(struct ipw_priv *priv)
 	return rc;
 }
 
+
+struct ipw_fw {
+	u32 ver;
+	u32 boot_size;
+	u32 ucode_size;
+	u32 fw_size;
+	u8 data[0];
+};
+
 static int ipw_get_fw(struct ipw_priv *priv,
-		      const struct firmware **fw, const char *name)
+		      const struct firmware **raw, const char *name)
 {
-	struct fw_header *header;
+	struct ipw_fw *fw;
 	int rc;
 
 	/* ask firmware_class module to get the boot firmware off disk */
-	rc = request_firmware(fw, name, &priv->pci_dev->dev);
+	rc = request_firmware(raw, name, &priv->pci_dev->dev);
 	if (rc < 0) {
-		IPW_ERROR("%s load failed: Reason %d\n", name, rc);
+		IPW_ERROR("%s request_firmware failed: Reason %d\n", name, rc);
 		return rc;
 	}
 
-	header = (struct fw_header *)(*fw)->data;
-	if (IPW_FW_MAJOR(le32_to_cpu(header->version)) != IPW_FW_MAJOR_VERSION) {
-		IPW_ERROR("'%s' firmware version not compatible (%d != %d)\n",
-			  name,
-			  IPW_FW_MAJOR(le32_to_cpu(header->version)),
-			  IPW_FW_MAJOR_VERSION);
+	if ((*raw)->size < sizeof(*fw)) {
+		IPW_ERROR("%s is too small (%zd)\n", name, (*raw)->size);
 		return -EINVAL;
 	}
 
-	IPW_DEBUG_INFO("Loading firmware '%s' file v%d.%d (%zd bytes)\n",
+	fw = (void *)(*raw)->data;
+
+	if ((*raw)->size < sizeof(*fw) +
+	    fw->boot_size + fw->ucode_size + fw->fw_size) {
+		IPW_ERROR("%s is too small or corrupt (%zd)\n",
+			  name, (*raw)->size);
+		return -EINVAL;
+	}
+
+	IPW_DEBUG_INFO("Read firmware '%s' image v%d.%d (%zd bytes)\n",
 		       name,
-		       IPW_FW_MAJOR(le32_to_cpu(header->version)),
-		       IPW_FW_MINOR(le32_to_cpu(header->version)),
-		       (*fw)->size - sizeof(struct fw_header));
+		       le32_to_cpu(fw->ver) >> 16,
+		       le32_to_cpu(fw->ver) & 0xff,
+		       (*raw)->size - sizeof(*fw));
 	return 0;
 }
 
@@ -3196,17 +3182,13 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,
 
 #ifdef CONFIG_PM
 static int fw_loaded = 0;
-static const struct firmware *bootfw = NULL;
-static const struct firmware *firmware = NULL;
-static const struct firmware *ucode = NULL;
+static const struct firmware *raw = NULL;
 
 static void free_firmware(void)
 {
 	if (fw_loaded) {
-		release_firmware(bootfw);
-		release_firmware(ucode);
-		release_firmware(firmware);
-		bootfw = ucode = firmware = NULL;
+		release_firmware(raw);
+		raw = NULL;
 		fw_loaded = 0;
 	}
 }
@@ -3217,32 +3199,46 @@ static void free_firmware(void)
 static int ipw_load(struct ipw_priv *priv)
 {
 #ifndef CONFIG_PM
-	const struct firmware *bootfw = NULL;
-	const struct firmware *firmware = NULL;
-	const struct firmware *ucode = NULL;
+	const struct firmware *raw = NULL;
 #endif
-	char *ucode_name;
-	char *fw_name;
+	struct ipw_fw *fw;
+	u8 *boot_img, *ucode_img, *fw_img;
+	u8 *name = NULL;
 	int rc = 0, retries = 3;
 
 	switch (priv->ieee->iw_mode) {
 	case IW_MODE_ADHOC:
-		ucode_name = IPW_FW_NAME("ibss_ucode");
-		fw_name = IPW_FW_NAME("ibss");
+		name = "ipw2200-ibss.fw";
 		break;
 #ifdef CONFIG_IPW2200_MONITOR
 	case IW_MODE_MONITOR:
-		ucode_name = IPW_FW_NAME("sniffer_ucode");
-		fw_name = IPW_FW_NAME("sniffer");
+		name = "ipw2200-sniffer.fw";
 		break;
 #endif
 	case IW_MODE_INFRA:
-		ucode_name = IPW_FW_NAME("bss_ucode");
-		fw_name = IPW_FW_NAME("bss");
+		name = "ipw2200-bss.fw";
 		break;
-	default:
+	}
+
+	if (!name) {
 		rc = -EINVAL;
+		goto error;
+	}
+
+#ifdef CONFIG_PM
+	if (!fw_loaded) {
+#endif
+		rc = ipw_get_fw(priv, &raw, name);
+		if (rc < 0)
+			goto error;
+#ifdef CONFIG_PM
 	}
+#endif
+
+	fw = (void *)raw->data;
+	boot_img = &fw->data[0];
+	ucode_img = &fw->data[fw->boot_size];
+	fw_img = &fw->data[fw->boot_size + fw->ucode_size];
 
 	if (rc < 0)
 		goto error;
@@ -3275,18 +3271,8 @@ static int ipw_load(struct ipw_priv *priv)
 	ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
 			IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
 
-#ifdef CONFIG_PM
-	if (!fw_loaded) {
-#endif
-		rc = ipw_get_fw(priv, &bootfw, IPW_FW_NAME("boot"));
-		if (rc < 0)
-			goto error;
-#ifdef CONFIG_PM
-	}
-#endif
 	/* DMA the initial boot firmware into the device */
-	rc = ipw_load_firmware(priv, bootfw->data + sizeof(struct fw_header),
-			       bootfw->size - sizeof(struct fw_header));
+	rc = ipw_load_firmware(priv, boot_img, fw->boot_size);
 	if (rc < 0) {
 		IPW_ERROR("Unable to load boot firmware: %d\n", rc);
 		goto error;
@@ -3307,19 +3293,8 @@ static int ipw_load(struct ipw_priv *priv)
 	/* ack fw init done interrupt */
 	ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
 
-#ifdef CONFIG_PM
-	if (!fw_loaded) {
-#endif
-		rc = ipw_get_fw(priv, &ucode, ucode_name);
-		if (rc < 0)
-			goto error;
-#ifdef CONFIG_PM
-	}
-#endif
-
 	/* DMA the ucode into the device */
-	rc = ipw_load_ucode(priv, ucode->data + sizeof(struct fw_header),
-			    ucode->size - sizeof(struct fw_header));
+	rc = ipw_load_ucode(priv, ucode_img, fw->ucode_size);
 	if (rc < 0) {
 		IPW_ERROR("Unable to load ucode: %d\n", rc);
 		goto error;
@@ -3328,20 +3303,8 @@ static int ipw_load(struct ipw_priv *priv)
 	/* stop nic */
 	ipw_stop_nic(priv);
 
-#ifdef CONFIG_PM
-	if (!fw_loaded) {
-#endif
-		rc = ipw_get_fw(priv, &firmware, fw_name);
-		if (rc < 0)
-			goto error;
-#ifdef CONFIG_PM
-	}
-#endif
-
 	/* DMA bss firmware into the device */
-	rc = ipw_load_firmware(priv, firmware->data +
-			       sizeof(struct fw_header),
-			       firmware->size - sizeof(struct fw_header));
+	rc = ipw_load_firmware(priv, fw_img, fw->fw_size);
 	if (rc < 0) {
 		IPW_ERROR("Unable to load firmware: %d\n", rc);
 		goto error;
@@ -3406,9 +3369,7 @@ static int ipw_load(struct ipw_priv *priv)
 	ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
 
 #ifndef CONFIG_PM
-	release_firmware(bootfw);
-	release_firmware(ucode);
-	release_firmware(firmware);
+	release_firmware(raw);
 #endif
 	return 0;
 
@@ -3418,15 +3379,11 @@ static int ipw_load(struct ipw_priv *priv)
 		priv->rxq = NULL;
 	}
 	ipw_tx_queue_free(priv);
-	if (bootfw)
-		release_firmware(bootfw);
-	if (ucode)
-		release_firmware(ucode);
-	if (firmware)
-		release_firmware(firmware);
+	if (raw)
+		release_firmware(raw);
 #ifdef CONFIG_PM
 	fw_loaded = 0;
-	bootfw = ucode = firmware = NULL;
+	raw = NULL;
 #endif
 
 	return rc;
@@ -4547,10 +4504,9 @@ static void ipw_rx_notification(struct ipw_priv *priv,
 
 			if (notif->size == sizeof(*x)) {
 				IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-					  "link deterioration: '%s' " MAC_FMT
-					  " \n", escape_essid(priv->essid,
-							      priv->essid_len),
-					  MAC_ARG(priv->bssid));
+					"link deterioration: type %d, cnt %d\n",
+					x->silence_notification_type,
+					x->silence_count);
 				memcpy(&priv->last_link_deterioration, x,
 				       sizeof(*x));
 			} else {
@@ -5533,15 +5489,6 @@ static int ipw_best_network(struct ipw_priv *priv,
 		return 0;
 	}
 
-	if (priv->ieee->wpa_enabled &&
-	    network-