return -ENOMEM;
                }
 
-               skb->dev = (void *) data->hdev;
                bt_cb(skb)->pkt_type = pkt_type;
 
                data->reassembly = skb;
                memcpy(skb_put(data->reassembly, len), buf, len);
 
        if (hdr & 0x08) {
-               hci_recv_frame(data->reassembly);
+               hci_recv_frame(data->hdev, data->reassembly);
                data->reassembly = NULL;
        }
 
 
 
                if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
-                       info->rx_skb->dev = (void *) info->hdev;
                        bt_cb(info->rx_skb)->pkt_type = buf[i];
 
                        switch (bt_cb(info->rx_skb)->pkt_type) {
                                        break;
 
                                case RECV_WAIT_DATA:
-                                       hci_recv_frame(info->rx_skb);
+                                       hci_recv_frame(info->hdev, info->rx_skb);
                                        info->rx_skb = NULL;
                                        break;
 
 
                                return -ENOMEM;
                        }
 
-                       skb->dev = (void *) hdev;
-
                        data->rx_skb[queue] = skb;
 
                        scb = (void *) skb->cb;
                        data->rx_skb[queue] = NULL;
 
                        bt_cb(skb)->pkt_type = scb->type;
-                       hci_recv_frame(skb);
+                       hci_recv_frame(hdev, skb);
                }
 
                count -= len; buf += len;
 
 
                if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
-                       info->rx_skb->dev = (void *) info->hdev;
                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L);
                        inb(iobase + DATA_H);
                        //printk("bt3c: PACKET_TYPE=%02x\n", bt_cb(info->rx_skb)->pkt_type);
                                        break;
 
                                case RECV_WAIT_DATA:
-                                       hci_recv_frame(info->rx_skb);
+                                       hci_recv_frame(info->hdev, info->rx_skb);
                                        info->rx_skb = NULL;
                                        break;
 
 
        case HCI_SCODATA_PKT:
        case HCI_EVENT_PKT:
                bt_cb(skb)->pkt_type = type;
-               skb->dev = (void *)hdev;
                skb_put(skb, buf_len);
                skb_pull(skb, SDIO_HEADER_LEN);
 
                if (type == HCI_EVENT_PKT) {
                        if (btmrvl_check_evtpkt(priv, skb))
-                               hci_recv_frame(skb);
+                               hci_recv_frame(hdev, skb);
                } else {
-                       hci_recv_frame(skb);
+                       hci_recv_frame(hdev, skb);
                }
 
                hdev->stat.byte_rx += buf_len;
 
        case MRVL_VENDOR_PKT:
                bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
-               skb->dev = (void *)hdev;
                skb_put(skb, buf_len);
                skb_pull(skb, SDIO_HEADER_LEN);
 
                if (btmrvl_process_event(priv, skb))
-                       hci_recv_frame(skb);
+                       hci_recv_frame(hdev, skb);
 
                hdev->stat.byte_rx += buf_len;
                break;
 
 
        data->hdev->stat.byte_rx += len;
 
-       skb->dev = (void *) data->hdev;
        bt_cb(skb)->pkt_type = hdr[3];
 
-       err = hci_recv_frame(skb);
+       err = hci_recv_frame(data->hdev, skb);
        if (err < 0)
                return err;
 
 
 
                if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
-                       info->rx_skb->dev = (void *) info->hdev;
                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + UART_RX);
 
                        switch (bt_cb(info->rx_skb)->pkt_type) {
                                        break;
 
                                case RECV_WAIT_DATA:
-                                       hci_recv_frame(info->rx_skb);
+                                       hci_recv_frame(info->hdev, info->rx_skb);
                                        info->rx_skb = NULL;
                                        break;
 
 
                return -EFAULT;
        }
 
-       skb->dev = (void *) lhst->hdev;
-
        /* Forward skb to HCI core layer */
-       err = hci_recv_frame(skb);
+       err = hci_recv_frame(lhst->hdev, skb);
        if (err < 0) {
                BT_ERR("Unable to push skb to HCI core(%d)", err);
                return err;
 
                                case 0x83:
                                case 0x84:
                                        /* send frame to the HCI layer */
-                                       info->rx_skb->dev = (void *) info->hdev;
                                        bt_cb(info->rx_skb)->pkt_type &= 0x0f;
-                                       hci_recv_frame(info->rx_skb);
+                                       hci_recv_frame(info->hdev, info->rx_skb);
                                        break;
                                default:
                                        /* unknown packet */
 
                                memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
                                bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
 
-                               hci_recv_frame(bcsp->rx_skb);
+                               hci_recv_frame(hu->hdev, bcsp->rx_skb);
                        } else {
                                BT_ERR ("Packet for unknown channel (%u %s)",
                                        bcsp->rx_skb->data[1] & 0x0f,
                /* Pull out BCSP hdr */
                skb_pull(bcsp->rx_skb, 4);
 
-               hci_recv_frame(bcsp->rx_skb);
+               hci_recv_frame(hu->hdev, bcsp->rx_skb);
        }
 
        bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
                                        bcsp->rx_count = 0;
                                        return 0;
                                }
-                               bcsp->rx_skb->dev = (void *) hu->hdev;
                                break;
                        }
                        break;
 
                /* Remove Three-wire header */
                skb_pull(h5->rx_skb, 4);
 
-               hci_recv_frame(h5->rx_skb);
+               hci_recv_frame(hu->hdev, h5->rx_skb);
                h5->rx_skb = NULL;
 
                break;
 
        return 0;
 }
 
-static inline int ll_check_data_len(struct ll_struct *ll, int len)
+static inline int ll_check_data_len(struct hci_dev *hdev, struct ll_struct *ll, int len)
 {
        int room = skb_tailroom(ll->rx_skb);
 
        BT_DBG("len %d room %d", len, room);
 
        if (!len) {
-               hci_recv_frame(ll->rx_skb);
+               hci_recv_frame(hdev, ll->rx_skb);
        } else if (len > room) {
                BT_ERR("Data length is too large");
                kfree_skb(ll->rx_skb);
                        switch (ll->rx_state) {
                        case HCILL_W4_DATA:
                                BT_DBG("Complete data");
-                               hci_recv_frame(ll->rx_skb);
+                               hci_recv_frame(hu->hdev, ll->rx_skb);
 
                                ll->rx_state = HCILL_W4_PACKET_TYPE;
                                ll->rx_skb = NULL;
 
                                BT_DBG("Event header: evt 0x%2.2x plen %d", eh->evt, eh->plen);
 
-                               ll_check_data_len(ll, eh->plen);
+                               ll_check_data_len(hu->hdev, ll, eh->plen);
                                continue;
 
                        case HCILL_W4_ACL_HDR:
 
                                BT_DBG("ACL header: dlen %d", dlen);
 
-                               ll_check_data_len(ll, dlen);
+                               ll_check_data_len(hu->hdev, ll, dlen);
                                continue;
 
                        case HCILL_W4_SCO_HDR:
 
                                BT_DBG("SCO header: dlen %d", sh->dlen);
 
-                               ll_check_data_len(ll, sh->dlen);
+                               ll_check_data_len(hu->hdev, ll, sh->dlen);
                                continue;
                        }
                }
                        return -ENOMEM;
                }
 
-               ll->rx_skb->dev = (void *) hu->hdev;
                bt_cb(ll->rx_skb)->pkt_type = type;
        }
 
 
                        return -ENODEV;
                }
 
-               skb->dev = (void *) data->hdev;
                bt_cb(skb)->pkt_type = pkt_type;
 
-               ret = hci_recv_frame(skb);
+               ret = hci_recv_frame(data->hdev, skb);
                break;
 
        case HCI_VENDOR_PKT:
 
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
-int hci_recv_frame(struct sk_buff *skb);
+int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb);
 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count);
 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count);
 
 
 EXPORT_SYMBOL(hci_resume_dev);
 
 /* Receive frame from HCI drivers */
-int hci_recv_frame(struct sk_buff *skb)
+int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
 {
-       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
        if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
                      && !test_bit(HCI_INIT, &hdev->flags))) {
                kfree_skb(skb);
                scb->expect = hlen;
                scb->pkt_type = type;
 
-               skb->dev = (void *) hdev;
                hdev->reassembly[index] = skb;
        }
 
                        /* Complete frame */
 
                        bt_cb(skb)->pkt_type = type;
-                       hci_recv_frame(skb);
+                       hci_recv_frame(hdev, skb);
 
                        hdev->reassembly[index] = NULL;
                        return remain;