17 files changed, 192 insertions, 162 deletions

diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 9b95c4049b3..cfd4d052d66 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -340,9 +340,9 @@ static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
 }
 
 /* Interrupt handling */
-static int      ath5k_init(struct ath5k_softc *sc);
+static int      ath5k_init(struct ath5k_softc *sc, bool is_resume);
 static int      ath5k_stop_locked(struct ath5k_softc *sc);
-static int      ath5k_stop_hw(struct ath5k_softc *sc);
+static int      ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend);
 static irqreturn_t ath5k_intr(int irq, void *dev_id);
 static void     ath5k_tasklet_reset(unsigned long data);
 
@@ -646,7 +646,7 @@ ath5k_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         ath5k_led_off(sc);
 
-        ath5k_stop_hw(sc);
+        ath5k_stop_hw(sc, true);
 
         free_irq(pdev->irq, sc);
         pci_save_state(pdev);
@@ -661,8 +661,7 @@ ath5k_pci_resume(struct pci_dev *pdev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
-        int i, err;
+        int err;
 
         pci_restore_state(pdev);
 
@@ -683,21 +682,11 @@ ath5k_pci_resume(struct pci_dev *pdev)
                 goto err_no_irq;
         }
 
-        err = ath5k_init(sc);
+        err = ath5k_init(sc, true);
         if (err)
                 goto err_irq;
         ath5k_led_enable(sc);
 
-        /*
-         * Reset the key cache since some parts do not
-         * reset the contents on initial power up or resume.
-         *
-         * FIXME: This may need to be revisited when mac80211 becomes
-         *        aware of suspend/resume.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
         return 0;
 err_irq:
         free_irq(pdev->irq, sc);
@@ -718,7 +707,6 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
         u8 mac[ETH_ALEN];
-        unsigned int i;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
@@ -737,13 +725,6 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
                 __set_bit(ATH_STAT_MRRETRY, sc->status);
 
         /*
-         * Reset the key cache since some parts do not
-         * reset the contents on initial power up.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
-        /*
          * Collect the channel list.  The 802.11 layer
          * is resposible for filtering this list based
          * on settings like the phy mode and regulatory
@@ -2200,12 +2181,18 @@ ath5k_beacon_config(struct ath5k_softc *sc)
 \********************/
 
 static int
-ath5k_init(struct ath5k_softc *sc)
+ath5k_init(struct ath5k_softc *sc, bool is_resume)
 {
-        int ret;
+        struct ath5k_hw *ah = sc->ah;
+        int ret, i;
 
         mutex_lock(&sc->lock);
 
+        if (is_resume && !test_bit(ATH_STAT_STARTED, sc->status))
+                goto out_ok;
+
+        __clear_bit(ATH_STAT_STARTED, sc->status);
+
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);
 
         /*
@@ -2230,12 +2217,22 @@ ath5k_init(struct ath5k_softc *sc)
         if (ret)
                 goto done;
 
+        /*
+         * Reset the key cache since some parts do not reset the
+         * contents on initial power up or resume from suspend.
+         */
+        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
+                ath5k_hw_reset_key(ah, i);
+
+        __set_bit(ATH_STAT_STARTED, sc->status);
+
         /* Set ack to be sent at low bit-rates */
-        ath5k_hw_set_ack_bitrate_high(sc->ah, false);
+        ath5k_hw_set_ack_bitrate_high(ah, false);
 
         mod_timer(&sc->calib_tim, round_jiffies(jiffies +
                         msecs_to_jiffies(ath5k_calinterval * 1000)));
 
+out_ok:
         ret = 0;
 done:
         mmiowb();
@@ -2290,7 +2287,7 @@ ath5k_stop_locked(struct ath5k_softc *sc)
  * stop is preempted).
  */
 static int
-ath5k_stop_hw(struct ath5k_softc *sc)
+ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend)
 {
         int ret;
 
@@ -2321,6 +2318,9 @@ ath5k_stop_hw(struct ath5k_softc *sc)
                 }
         }
         ath5k_txbuf_free(sc, sc->bbuf);
+        if (!is_suspend)
+                __clear_bit(ATH_STAT_STARTED, sc->status);
+
         mmiowb();
         mutex_unlock(&sc->lock);
 
@@ -2718,12 +2718,12 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 
 static int ath5k_start(struct ieee80211_hw *hw)
 {
-        return ath5k_init(hw->priv);
+        return ath5k_init(hw->priv, false);
 }
 
 static void ath5k_stop(struct ieee80211_hw *hw)
 {
-        ath5k_stop_hw(hw->priv);
+        ath5k_stop_hw(hw->priv, false);
 }
 
 static int ath5k_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index 9d0b728928e..06d1054ca94 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -128,11 +128,12 @@ struct ath5k_softc {
         size_t                  desc_len;       /* size of TX/RX descriptors */
         u16                     cachelsz;       /* cache line size */
 
-        DECLARE_BITMAP(status, 4);
+        DECLARE_BITMAP(status, 5);
 #define ATH_STAT_INVALID        0               /* disable hardware accesses */
 #define ATH_STAT_MRRETRY        1               /* multi-rate retry support */
 #define ATH_STAT_PROMISC        2
 #define ATH_STAT_LEDSOFT        3               /* enable LED gpio status */
+#define ATH_STAT_STARTED        4               /* opened & irqs enabled */
 
         unsigned int            filter_flags;   /* HW flags, AR5K_RX_FILTER_* */
         unsigned int            curmode;        /* current phy mode */
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 8f92d670f61..19980cbd5d5 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -339,7 +339,7 @@ static struct {
         { ATH5K_DEBUG_BEACON,   "beacon",       "beacon handling" },
         { ATH5K_DEBUG_CALIBRATE, "calib",       "periodic calibration" },
         { ATH5K_DEBUG_TXPOWER,  "txpower",      "transmit power setting" },
-        { ATH5K_DEBUG_LED,      "led",          "LED mamagement" },
+        { ATH5K_DEBUG_LED,      "led",          "LED management" },
         { ATH5K_DEBUG_DUMP_RX,  "dumprx",       "print received skb content" },
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
         { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
diff --git a/drivers/net/wireless/ath5k/desc.c b/drivers/net/wireless/ath5k/desc.c
index dd1374052ba..5e362a7a362 100644
--- a/drivers/net/wireless/ath5k/desc.c
+++ b/drivers/net/wireless/ath5k/desc.c
@@ -531,10 +531,10 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL);
         rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = rx_status->rx_status_0 &
-                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        rs->rs_more = rx_status->rx_status_0 &
-                AR5K_5210_RX_DESC_STATUS0_MORE;
+        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA);
+        rs->rs_more = !!(rx_status->rx_status_0 &
+                AR5K_5210_RX_DESC_STATUS0_MORE);
         /* TODO: this timestamp is 13 bit, later on we assume 15 bit */
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
@@ -607,10 +607,10 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL);
         rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        rs->rs_more = rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_MORE;
+        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA);
+        rs->rs_more = !!(rx_status->rx_status_0 &
+                AR5K_5212_RX_DESC_STATUS0_MORE);
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
         rs->rs_status = 0;
diff --git a/drivers/net/wireless/ath5k/initvals.c b/drivers/net/wireless/ath5k/initvals.c
index ea2e1a20b49..ceaa6c475c0 100644
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -806,6 +806,8 @@ static const struct ath5k_ini_mode ar5212_rf5111_ini_mode_end[] = {
                 { 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 } },
         { AR5K_PHY(642),
                 { 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788 } },
+        { 0xa228,
+                { 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5 } },
         { 0xa23c,
                 { 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af } },
 };
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 8f1886834e6..1b6d45b6772 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -537,9 +537,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 mdelay(1);
 
                 /*
-                 * Write some more initial register settings
+                 * Write some more initial register settings for revised chips
                  */
-                if (ah->ah_version == AR5K_AR5212) {
+                if (ah->ah_version == AR5K_AR5212 &&
+                    ah->ah_phy_revision > 0x41) {
                         ath5k_hw_reg_write(ah, 0x0002a002, 0x982c);
 
                         if (channel->hw_value == CHANNEL_G)
@@ -558,19 +559,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                         else
                                 ath5k_hw_reg_write(ah, 0x00000000, 0x994c);
 
-                        /* Some bits are disabled here, we know nothing about
-                         * register 0xa228 yet, most of the times this ends up
-                         * with a value 0x9b5 -haven't seen any dump with
-                         * a different value- */
-                        /* Got this from decompiling binary HAL */
-                        data = ath5k_hw_reg_read(ah, 0xa228);
-                        data &= 0xfffffdff;
-                        ath5k_hw_reg_write(ah, data, 0xa228);
-
-                        data = ath5k_hw_reg_read(ah, 0xa228);
-                        data &= 0xfffe03ff;
-                        ath5k_hw_reg_write(ah, data, 0xa228);
-                        data = 0;
+                        /* Got this from legacy-hal */
+                        AR5K_REG_DISABLE_BITS(ah, 0xa228, 0x200);
+
+                        AR5K_REG_MASKED_BITS(ah, 0xa228, 0x800, 0xfffe03ff);
 
                         /* Just write 0x9b5 ? */
                         /* ath5k_hw_reg_write(ah, 0x000009b5, 0xa228); */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 24a1aeb6448..8d690a0eb1a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2090,7 +2090,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 iwl4965_error_recovery(priv);
 
         iwl_power_update_mode(priv, 1);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 
         if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
                 iwl4965_set_mode(priv, priv->iw_mode);
@@ -2342,6 +2341,7 @@ static void iwl_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
         mutex_unlock(&priv->mutex);
+        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl4965_bg_rf_kill(struct work_struct *work)
@@ -3252,7 +3252,11 @@ static void iwl4965_mac_update_tkip_key(struct ieee80211_hw *hw,
                 return;
         }
 
-        iwl_scan_cancel_timeout(priv, 100);
+        if (iwl_scan_cancel(priv)) {
+                /* cancel scan failed, just live w/ bad key and rely
+                   briefly on SW decryption */
+                return;
+        }
 
         key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 3b0bee331a3..c89365e2ca5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -896,6 +896,13 @@ static void iwl_bg_request_scan(struct work_struct *data)
         return;
 
  done:
+        /* Cannot perform scan. Make sure we clear scanning
+        * bits from status so next scan request can be performed.
+        * If we don't clear scanning status bit here all next scan
+        * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d15a2c99795..285b53e7e26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -5768,7 +5768,6 @@ static void iwl3945_alive_start(struct iwl3945_priv *priv)
         if (priv->error_recovering)
                 iwl3945_error_recovery(priv);
 
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
         return;
 
  restart:
@@ -6013,6 +6012,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl3945_alive_start(priv);
         mutex_unlock(&priv->mutex);
+        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl3945_bg_rf_kill(struct work_struct *work)
@@ -6256,6 +6256,11 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                                               n_probes,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
+        if (scan->channel_count == 0) {
+                IWL_DEBUG_SCAN("channel count %d\n", scan->channel_count);
+                goto done;
+        }
+
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
             scan->channel_count * sizeof(struct iwl3945_scan_channel);
         cmd.data = scan;
@@ -6273,6 +6278,14 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         return;
 
  done:
+        /* can not perform scan make sure we clear scanning
+         * bits from status so next scan request can be performed.
+         * if we dont clear scanning status bit here all next scan
+         * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
+
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 297696de2da..8265c7d25ed 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -605,9 +605,9 @@ int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
         if (ret == 0) {
                 *curlevel = le16_to_cpu(cmd.curlevel);
                 if (minlevel)
-                        *minlevel = le16_to_cpu(cmd.minlevel);
+                        *minlevel = cmd.minlevel;
                 if (maxlevel)
-                        *maxlevel = le16_to_cpu(cmd.maxlevel);
+                        *maxlevel = cmd.maxlevel;
         }
 
         lbs_deb_leave(LBS_DEB_CMD);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 5749f22b296..079e6aa874d 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -328,7 +328,7 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
                 lbs_deb_rx("rx err: frame received with bad length\n");
                 priv->stats.rx_length_errors++;
                 ret = -EINVAL;
-                kfree(skb);
+                kfree_skb(skb);
                 goto done;
         }
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 8f66903641b..22c4c611052 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_descriptor *bss,
 
                 switch (elem->id) {
                 case MFIE_TYPE_SSID:
-                        bss->ssid_len = elem->len;
-                        memcpy(bss->ssid, elem->data, elem->len);
+                        bss->ssid_len = min_t(int, 32, elem->len);
+                        memcpy(bss->ssid, elem->data, bss->ssid_len);
                         lbs_deb_scan("got SSID IE: '%s', len %u\n",
                                      escape_essid(bss->ssid, bss->ssid_len),
                                      bss->ssid_len);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 50904771f29..e0512e49d6d 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -433,7 +433,7 @@ struct fw_info {
 const static struct fw_info orinoco_fw[] = {
         { "", "agere_sta_fw.bin", "agere_ap_fw.bin", 0x00390000, 1000 },
         { "", "prism_sta_fw.bin", "prism_ap_fw.bin", 0, 1024 },
-        { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", "", 0x00003100, 0x100 }
+        { "symbol_sp24t_prim_fw", "symbol_sp24t_sec_fw", "", 0x00003100, 512 }
 };
 
 /* Structure used to access fields in FW
@@ -458,7 +458,7 @@ orinoco_dl_firmware(struct orinoco_private *priv,
                     int ap)
 {
         /* Plug Data Area (PDA) */
-        __le16 pda[512] = { 0 };
+        __le16 *pda;
 
         hermes_t *hw = &priv->hw;
         const struct firmware *fw_entry;
@@ -467,7 +467,11 @@ orinoco_dl_firmware(struct orinoco_private *priv,
         const unsigned char *end;
         const char *firmware;
         struct net_device *dev = priv->ndev;
-        int err;
+        int err = 0;
+
+        pda = kzalloc(fw->pda_size, GFP_KERNEL);
+        if (!pda)
+                return -ENOMEM;
 
         if (ap)
                 firmware = fw->ap_fw;
@@ -478,17 +482,17 @@ orinoco_dl_firmware(struct orinoco_private *priv,
                dev->name, firmware);
 
         /* Read current plug data */
-        err = hermes_read_pda(hw, pda, fw->pda_addr,
-                              min_t(u16, fw->pda_size, sizeof(pda)), 0);
+        err = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 0);
         printk(KERN_DEBUG "%s: Read PDA returned %d\n", dev->name, err);
         if (err)
-                return err;
+                goto free;
 
         err = request_firmware(&fw_entry, firmware, priv->dev);
         if (err) {
                 printk(KERN_ERR "%s: Cannot find firmware %s\n",
                        dev->name, firmware);
-                return -ENOENT;
+                err = -ENOENT;
+                goto free;
         }
 
         hdr = (const struct orinoco_fw_header *) fw_entry->data;
@@ -532,6 +536,9 @@ orinoco_dl_firmware(struct orinoco_private *priv,
 
 abort:
         release_firmware(fw_entry);
+
+free:
+        kfree(pda);
         return err;
 }
 
@@ -549,12 +556,12 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
                 int secondary)
 {
         hermes_t *hw = &priv->hw;
-        int ret;
+        int ret = 0;
         const unsigned char *ptr;
         const unsigned char *first_block;
 
         /* Plug Data Area (PDA) */
-        __le16 pda[256];
+        __le16 *pda = NULL;
 
         /* Binary block begins after the 0x1A marker */
         ptr = image;
@@ -563,28 +570,33 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
 
         /* Read the PDA from EEPROM */
         if (secondary) {
-                ret = hermes_read_pda(hw, pda, fw->pda_addr, sizeof(pda), 1);
+                pda = kzalloc(fw->pda_size, GFP_KERNEL);
+                if (!pda)
+                        return -ENOMEM;
+
+                ret = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 1);
                 if (ret)
-                        return ret;
+                        goto free;
         }
 
         /* Stop the firmware, so that it can be safely rewritten */
         if (priv->stop_fw) {
                 ret = priv->stop_fw(priv, 1);
                 if (ret)
-                        return ret;
+                        goto free;
         }
 
         /* Program the adapter with new firmware */
         ret = hermes_program(hw, first_block, end);
         if (ret)
-                return ret;
+                goto free;
 
         /* Write the PDA to the adapter */
         if (secondary) {
                 size_t len = hermes_blocks_length(first_block);
                 ptr = first_block + len;
                 ret = hermes_apply_pda(hw, ptr, pda);
+                kfree(pda);
                 if (ret)
                         return ret;
         }
@@ -608,6 +620,10 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
                 return -ENODEV;
 
         return 0;
+
+free:
+        kfree(pda);
+        return ret;
 }
 
 
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 117c7d3a52b..827ca0384a4 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -306,8 +306,8 @@ static int p54_convert_rev1(struct ieee80211_hw *dev,
         return 0;
 }
 
-static const char *p54_rf_chips[] = { "NULL", "Indigo?", "Duette",
-                              "Frisbee", "Xbow", "Longbow" };
+static const char *p54_rf_chips[] = { "NULL", "Duette3", "Duette2",
+                              "Frisbee", "Xbow", "Longbow", "NULL", "NULL" };
 static int p54_init_xbow_synth(struct ieee80211_hw *dev);
 
 static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
@@ -319,6 +319,7 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         void *tmp;
         int err;
         u8 *end = (u8 *)eeprom + len;
+        u16 synth = 0;
         DECLARE_MAC_BUF(mac);
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
@@ -400,8 +401,8 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         tmp = entry->data;
                         while ((u8 *)tmp < entry->data + data_len) {
                                 struct bootrec_exp_if *exp_if = tmp;
-                                if (le16_to_cpu(exp_if->if_id) == 0xF)
-                                        priv->rxhw = le16_to_cpu(exp_if->variant) & 0x07;
+                                if (le16_to_cpu(exp_if->if_id) == 0xf)
+                                        synth = le16_to_cpu(exp_if->variant);
                                 tmp += sizeof(struct bootrec_exp_if);
                         }
                         break;
@@ -421,28 +422,20 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                 entry = (void *)entry + (entry_len + 1)*2;
         }
 
-        if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
+        if (!synth || !priv->iq_autocal || !priv->output_limit ||
+            !priv->curve_data) {
                 printk(KERN_ERR "p54: not all required entries found in eeprom!\n");
                 err = -EINVAL;
                 goto err;
         }
 
-        switch (priv->rxhw) {
-        case 4: /* XBow */
+        priv->rxhw = synth & 0x07;
+        if (priv->rxhw == 4)
                 p54_init_xbow_synth(dev);
-        case 1: /* Indigo? */
-        case 2: /* Duette */
-                dev->wiphy->bands[IEEE80211_BAND_5GHZ] = &band_5GHz;
-        case 3: /* Frisbee */
-        case 5: /* Longbow */
+        if (!(synth & 0x40))
                 dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &band_2GHz;
-                break;
-        default:
-                printk(KERN_ERR "%s: unsupported RF-Chip\n",
-                        wiphy_name(dev->wiphy));
-                err = -EINVAL;
-                goto err;
-        }
+        if (!(synth & 0x80))
+                dev->wiphy->bands[IEEE80211_BAND_5GHZ] = &band_5GHz;
 
         if (!is_valid_ether_addr(dev->wiphy->perm_addr)) {
                 u8 perm_addr[ETH_ALEN];
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 1c2a02a741a..88b3cad8b65 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -346,68 +346,6 @@ static void p54p_tx(struct ieee80211_hw *dev, struct p54_control_hdr *data,
                 printk(KERN_INFO "%s: tx overflow.\n", wiphy_name(dev->wiphy));
 }
 
-static int p54p_open(struct ieee80211_hw *dev)
-{
-        struct p54p_priv *priv = dev->priv;
-        int err;
-
-        init_completion(&priv->boot_comp);
-        err = request_irq(priv->pdev->irq, &p54p_interrupt,
-                          IRQF_SHARED, "p54pci", dev);
-        if (err) {
-                printk(KERN_ERR "%s: failed to register IRQ handler\n",
-                       wiphy_name(dev->wiphy));
-                return err;
-        }
-
-        memset(priv->ring_control, 0, sizeof(*priv->ring_control));
-        err = p54p_upload_firmware(dev);
-        if (err) {
-                free_irq(priv->pdev->irq, dev);
-                return err;
-        }
-        priv->rx_idx_data = priv->tx_idx_data = 0;
-        priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
-
-        p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
-                ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
-
-        p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
-                ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
-
-        P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
-        P54P_READ(ring_control_base);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_INIT));
-        P54P_READ(int_enable);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
-        P54P_READ(dev_int);
-
-        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
-                printk(KERN_ERR "%s: Cannot boot firmware!\n",
-                       wiphy_name(dev->wiphy));
-                free_irq(priv->pdev->irq, dev);
-                return -ETIMEDOUT;
-        }
-
-        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
-        P54P_READ(int_enable);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
-        P54P_READ(dev_int);
-        wmb();
-        udelay(10);
-
-        return 0;
-}
-
 static void p54p_stop(struct ieee80211_hw *dev)
 {
         struct p54p_priv *priv = dev->priv;
@@ -474,6 +412,68 @@ static void p54p_stop(struct ieee80211_hw *dev)
         memset(ring_control, 0, sizeof(*ring_control));
 }
 
+static int p54p_open(struct ieee80211_hw *dev)
+{
+        struct p54p_priv *priv = dev->priv;
+        int err;
+
+        init_completion(&priv->boot_comp);
+        err = request_irq(priv->pdev->irq, &p54p_interrupt,
+                          IRQF_SHARED, "p54pci", dev);
+        if (err) {
+                printk(KERN_ERR "%s: failed to register IRQ handler\n",
+                       wiphy_name(dev->wiphy));
+                return err;
+        }
+
+        memset(priv->ring_control, 0, sizeof(*priv->ring_control));
+        err = p54p_upload_firmware(dev);
+        if (err) {
+                free_irq(priv->pdev->irq, dev);
+                return err;
+        }
+        priv->rx_idx_data = priv->tx_idx_data = 0;
+        priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
+
+        p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
+                ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
+
+        p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
+                ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
+
+        P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
+        P54P_READ(ring_control_base);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_INIT));
+        P54P_READ(int_enable);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
+        P54P_READ(dev_int);
+
+        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
+                printk(KERN_ERR "%s: Cannot boot firmware!\n",
+                       wiphy_name(dev->wiphy));
+                p54p_stop(dev);
+                return -ETIMEDOUT;
+        }
+
+        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
+        P54P_READ(int_enable);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+        P54P_READ(dev_int);
+        wmb();
+        udelay(10);
+
+        return 0;
+}
+
 static int __devinit p54p_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *id)
 {
@@ -556,11 +556,13 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
         spin_lock_init(&priv->lock);
         tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
 
-        p54p_open(dev);
+        err = p54p_open(dev);
+        if (err)
+                goto err_free_common;
         err = p54_read_eeprom(dev);
         p54p_stop(dev);
         if (err)
-                goto err_free_desc;
+                goto err_free_common;
 
         err = ieee80211_register_hw(dev);
         if (err) {
@@ -573,8 +575,6 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
 
  err_free_common:
         p54_free_common(dev);
-
- err_free_desc:
         pci_free_consistent(pdev, sizeof(*priv->ring_control),
                             priv->ring_control, priv->ring_control_dma);
 
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index f839ce044af..95511ac2247 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,5 +1,5 @@
 menuconfig RT2X00
-        bool "Ralink driver support"
+        tristate "Ralink driver support"
         depends on MAC80211 && WLAN_80211 && EXPERIMENTAL
         ---help---
           This will enable the experimental support for the Ralink drivers,
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index a60ae86bd5c..a3ccd8c1c71 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -61,6 +61,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0ace, 0xb215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B },
@@ -82,6 +83,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0cde, 0x001a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },