Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

47 files changed, 418 insertions, 182 deletions

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index abb520dec032..e361afed99ff 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -342,7 +342,7 @@ static int at76_dfu_get_status(struct usb_device *udev,
         return ret;
 }
 
-static u8 at76_dfu_get_state(struct usb_device *udev, u8 *state)
+static int at76_dfu_get_state(struct usb_device *udev, u8 *state)
 {
         int ret;
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 9d48f9a461e1..a0a202de1109 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2057,9 +2057,7 @@ ath5k_beacon_update_timers(struct ath5k_hw *ah, u64 bc_tsf)
 void
 ath5k_beacon_config(struct ath5k_hw *ah)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&ah->block, flags);
+        spin_lock_bh(&ah->block);
         ah->bmisscount = 0;
         ah->imask &= ~(AR5K_INT_BMISS | AR5K_INT_SWBA);
 
@@ -2086,7 +2084,7 @@ ath5k_beacon_config(struct ath5k_hw *ah)
 
         ath5k_hw_set_imr(ah, ah->imask);
         mmiowb();
-        spin_unlock_irqrestore(&ah->block, flags);
+        spin_unlock_bh(&ah->block);
 }
 
 static void ath5k_tasklet_beacon(unsigned long data)
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 4026c906cc7b..b7e0258887e7 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -1482,7 +1482,7 @@ ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
         case AR5K_EEPROM_MODE_11A:
                 offset += AR5K_EEPROM_TARGET_PWR_OFF_11A(ee->ee_version);
                 rate_pcal_info = ee->ee_rate_tpwr_a;
-                ee->ee_rate_target_pwr_num[mode] = AR5K_EEPROM_N_5GHZ_CHAN;
+                ee->ee_rate_target_pwr_num[mode] = AR5K_EEPROM_N_5GHZ_RATE_CHAN;
                 break;
         case AR5K_EEPROM_MODE_11B:
                 offset += AR5K_EEPROM_TARGET_PWR_OFF_11B(ee->ee_version);
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index dc2bcfeadeb4..94a9bbea6874 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -182,6 +182,7 @@
 #define AR5K_EEPROM_EEP_DELTA           10
 #define AR5K_EEPROM_N_MODES             3
 #define AR5K_EEPROM_N_5GHZ_CHAN         10
+#define AR5K_EEPROM_N_5GHZ_RATE_CHAN    8
 #define AR5K_EEPROM_N_2GHZ_CHAN         3
 #define AR5K_EEPROM_N_2GHZ_CHAN_2413    4
 #define AR5K_EEPROM_N_2GHZ_CHAN_MAX     4
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index c89fa6ead615..df61a09adb6d 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -255,7 +255,6 @@ ath5k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         struct ath5k_vif *avf = (void *)vif->drv_priv;
         struct ath5k_hw *ah = hw->priv;
         struct ath_common *common = ath5k_hw_common(ah);
-        unsigned long flags;
 
         mutex_lock(&ah->lock);
 
@@ -301,9 +300,9 @@ ath5k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         }
 
         if (changes & BSS_CHANGED_BEACON) {
-                spin_lock_irqsave(&ah->block, flags);
+                spin_lock_bh(&ah->block);
                 ath5k_beacon_update(hw, vif);
-                spin_unlock_irqrestore(&ah->block, flags);
+                spin_unlock_bh(&ah->block);
         }
 
         if (changes & BSS_CHANGED_BEACON_ENABLED)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 2c9f7d7ed4cc..0ed3846f9cbb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -142,6 +142,7 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         };
         int training_power;
         int i, val;
+        u32 am2pm_mask = ah->paprd_ratemask;
 
         if (IS_CHAN_2GHZ(ah->curchan))
                 training_power = ar9003_get_training_power_2g(ah);
@@ -158,10 +159,13 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         }
         ah->paprd_training_power = training_power;
 
+        if (AR_SREV_9330(ah))
+                am2pm_mask = 0;
+
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2AM, AR_PHY_PAPRD_AM2AM_MASK,
                       ah->paprd_ratemask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2PM, AR_PHY_PAPRD_AM2PM_MASK,
-                      ah->paprd_ratemask);
+                      am2pm_mask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_HT40, AR_PHY_PAPRD_HT40_MASK,
                       ah->paprd_ratemask_ht40);
 
@@ -782,6 +786,102 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
 }
 EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
 
+static bool ar9003_paprd_retrain_pa_in(struct ath_hw *ah,
+                                       struct ath9k_hw_cal_data *caldata,
+                                       int chain)
+{
+        u32 *pa_in = caldata->pa_table[chain];
+        int capdiv_offset, quick_drop_offset;
+        int capdiv2g, quick_drop;
+        int count = 0;
+        int i;
+
+        if (!AR_SREV_9485(ah) && !AR_SREV_9330(ah))
+                return false;
+
+        capdiv2g = REG_READ_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                                  AR_PHY_65NM_CH0_TXRF3_CAPDIV2G);
+
+        quick_drop = REG_READ_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                                    AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP);
+
+        if (quick_drop)
+                quick_drop -= 0x40;
+
+        for (i = 0; i < NUM_BIN + 1; i++) {
+                if (pa_in[i] == 1400)
+                        count++;
+        }
+
+        if (AR_SREV_9485(ah)) {
+                if (pa_in[23] < 800) {
+                        capdiv_offset = (int)((1000 - pa_in[23] + 75) / 150);
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 7) {
+                                capdiv2g = 7;
+                                if (pa_in[23] < 600) {
+                                        quick_drop++;
+                                        if (quick_drop > 0)
+                                                quick_drop = 0;
+                                }
+                        }
+                } else if (pa_in[23] == 1400) {
+                        quick_drop_offset = min_t(int, count / 3, 2);
+                        quick_drop += quick_drop_offset;
+                        capdiv2g += quick_drop_offset / 2;
+
+                        if (capdiv2g > 7)
+                                capdiv2g = 7;
+
+                        if (quick_drop > 0) {
+                                quick_drop = 0;
+                                capdiv2g -= quick_drop_offset;
+                                if (capdiv2g < 0)
+                                        capdiv2g = 0;
+                        }
+                } else {
+                        return false;
+                }
+        } else if (AR_SREV_9330(ah)) {
+                if (pa_in[23] < 1000) {
+                        capdiv_offset = (1000 - pa_in[23]) / 100;
+                        capdiv2g += capdiv_offset;
+                        if (capdiv_offset > 3) {
+                                capdiv_offset = 1;
+                                quick_drop--;
+                        }
+
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 6)
+                                capdiv2g = 6;
+                        if (quick_drop < -4)
+                                quick_drop = -4;
+                } else if (pa_in[23] == 1400) {
+                        if (count > 3) {
+                                quick_drop++;
+                                capdiv2g -= count / 4;
+                                if (quick_drop > -2)
+                                        quick_drop = -2;
+                        } else {
+                                capdiv2g--;
+                        }
+
+                        if (capdiv2g < 0)
+                                capdiv2g = 0;
+                } else {
+                        return false;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                      AR_PHY_65NM_CH0_TXRF3_CAPDIV2G, capdiv2g);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP,
+                      quick_drop);
+
+        return true;
+}
+
 int ar9003_paprd_create_curve(struct ath_hw *ah,
                               struct ath9k_hw_cal_data *caldata, int chain)
 {
@@ -817,6 +917,9 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
         if (!create_pa_curve(data_L, data_U, pa_table, small_signal_gain))
                 status = -2;
 
+        if (ar9003_paprd_retrain_pa_in(ah, caldata, chain))
+                status = -EINPROGRESS;
+
         REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
                     AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 7bfbaf065a43..84d3d4956861 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -625,6 +625,10 @@
 #define AR_PHY_AIC_CTRL_4_B0    (AR_SM_BASE + 0x4c0)
 #define AR_PHY_AIC_STAT_2_B0    (AR_SM_BASE + 0x4cc)
 
+#define AR_PHY_65NM_CH0_TXRF3       0x16048
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G          0x0000001e
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G_S        1
+
 #define AR_PHY_65NM_CH0_SYNTH4      0x1608c
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   (AR_SREV_9462(ah) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S (AR_SREV_9462(ah) ? 0 : 1)
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index bacdb8fb4ef4..9f83f71742a5 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -341,7 +341,8 @@ void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
 
-        ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
 }
 
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index cfa91ab7acf8..48af40151d23 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -463,9 +463,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                 ah->config.spurchans[i][1] = AR_NO_SPUR;
         }
 
-        /* PAPRD needs some more work to be enabled */
-        ah->config.paprd_disable = 1;
-
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -730,6 +727,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9300_DEVID_QCA955X:
         case AR9300_DEVID_AR9580:
         case AR9300_DEVID_AR9462:
+        case AR9485_DEVID_AR1111:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -977,9 +975,6 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
         else
                 imr_reg |= AR_IMR_TXOK;
 
-        if (opmode == NL80211_IFTYPE_AP)
-                imr_reg |= AR_IMR_MIB;
-
         ENABLE_REGWRITE_BUFFER(ah);
 
         REG_WRITE(ah, AR_IMR, imr_reg);
@@ -1777,6 +1772,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
+        } else if (caldata) {
+                caldata->paprd_packet_sent = false;
         }
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
 
@@ -2501,7 +2498,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
                 if (!ah->config.paprd_disable &&
-                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD) &&
+                    !AR_SREV_9462(ah))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index dd0c146d81dc..6599a75f01fe 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -49,6 +49,7 @@
 #define AR9300_DEVID_AR9462     0x0034
 #define AR9300_DEVID_AR9330     0x0035
 #define AR9300_DEVID_QCA955X    0x0038
+#define AR9485_DEVID_AR1111     0x0037
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -404,6 +405,7 @@ struct ath9k_hw_cal_data {
         int8_t iCoff;
         int8_t qCoff;
         bool rtt_done;
+        bool paprd_packet_sent;
         bool paprd_done;
         bool nfcal_pending;
         bool nfcal_interference;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index d4549e9aac5c..825a29cc9313 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -254,8 +254,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int chain_ok = 0;
         int chain;
         int len = 1800;
+        int ret;
 
-        if (!caldata)
+        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done)
                 return;
 
         ath9k_ps_wakeup(sc);
@@ -282,13 +283,6 @@ void ath_paprd_calibrate(struct work_struct *work)
                         continue;
 
                 chain_ok = 0;
-
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD frame for thermal measurement on chain %d\n",
-                        chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
-
                 ar9003_paprd_setup_gain_table(ah, chain);
 
                 ath_dbg(common, CALIBRATE,
@@ -302,7 +296,13 @@ void ath_paprd_calibrate(struct work_struct *work)
                         break;
                 }
 
-                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
+                ret = ar9003_paprd_create_curve(ah, caldata, chain);
+                if (ret == -EINPROGRESS) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD curve on chain %d needs to be re-trained\n",
+                                chain);
+                        break;
+                } else if (ret) {
                         ath_dbg(common, CALIBRATE,
                                 "PAPRD create curve failed on chain %d\n",
                                 chain);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 7990cd55599c..b42be910a83d 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -773,15 +773,10 @@ bool ath9k_hw_intrpend(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_intrpend);
 
-void ath9k_hw_disable_interrupts(struct ath_hw *ah)
+void ath9k_hw_kill_interrupts(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
 
-        if (!(ah->imask & ATH9K_INT_GLOBAL))
-                atomic_set(&ah->intr_ref_cnt, -1);
-        else
-                atomic_dec(&ah->intr_ref_cnt);
-
         ath_dbg(common, INTERRUPT, "disable IER\n");
         REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
         (void) REG_READ(ah, AR_IER);
@@ -793,6 +788,17 @@ void ath9k_hw_disable_interrupts(struct ath_hw *ah)
                 (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
         }
 }
+EXPORT_SYMBOL(ath9k_hw_kill_interrupts);
+
+void ath9k_hw_disable_interrupts(struct ath_hw *ah)
+{
+        if (!(ah->imask & ATH9K_INT_GLOBAL))
+                atomic_set(&ah->intr_ref_cnt, -1);
+        else
+                atomic_dec(&ah->intr_ref_cnt);
+
+        ath9k_hw_kill_interrupts(ah);
+}
 EXPORT_SYMBOL(ath9k_hw_disable_interrupts);
 
 void ath9k_hw_enable_interrupts(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 0eba36dca6f8..4a745e68dd94 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -738,6 +738,7 @@ bool ath9k_hw_intrpend(struct ath_hw *ah);
 void ath9k_hw_set_interrupts(struct ath_hw *ah);
 void ath9k_hw_enable_interrupts(struct ath_hw *ah);
 void ath9k_hw_disable_interrupts(struct ath_hw *ah);
+void ath9k_hw_kill_interrupts(struct ath_hw *ah);
 
 void ar9002_hw_attach_mac_ops(struct ath_hw *ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 4d8dc9ff5a75..8a2b04d5922f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -462,8 +462,10 @@ irqreturn_t ath_isr(int irq, void *dev)
         if (!ath9k_hw_intrpend(ah))
                 return IRQ_NONE;
 
-        if(test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags)) {
+                ath9k_hw_kill_interrupts(ah);
                 return IRQ_HANDLED;
+        }
 
         /*
          * Figure out the reason(s) for the interrupt.  Note
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 87b89d55e637..a978984d78a5 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -37,6 +37,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
+        { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
         { 0 }
 };
 
@@ -320,6 +321,7 @@ static int ath_pci_suspend(struct device *device)
          * Otherwise the chip never moved to full sleep,
          * when no interface is up.
          */
+        ath9k_stop_btcoex(sc);
         ath9k_hw_disable(sc->sc_ah);
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 12aca02228c2..4480c0cc655f 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1044,7 +1044,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_hdr *hdr;
         int retval;
-        bool decrypt_error = false;
         struct ath_rx_status rs;
         enum ath9k_rx_qtype qtype;
         bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
@@ -1066,6 +1065,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         tsf_lower = tsf & 0xffffffff;
 
         do {
+                bool decrypt_error = false;
                 /* If handling rx interrupt and flush is in progress => exit */
                 if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
                         break;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b074c3a2cde1..b088fa0eb022 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2019,6 +2019,9 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
+        if (sc->sc_ah->caldata)
+                sc->sc_ah->caldata->paprd_packet_sent = true;
+
         if (!(tx_flags & ATH_TX_ERROR))
                 /* Frame was ACKed */
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index e9a8f00e195c..73730e94e0ac 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2719,32 +2719,37 @@ static int b43_gpio_init(struct b43_wldev *dev)
         if (dev->dev->chip_id == 0x4301) {
                 mask |= 0x0060;
                 set |= 0x0060;
+        } else if (dev->dev->chip_id == 0x5354) {
+                /* Don't allow overtaking buttons GPIOs */
+                set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
         }
-        if (dev->dev->chip_id == 0x5354)
-                set &= 0xff02;
+
         if (0 /* FIXME: conditional unknown */ ) {
                 b43_write16(dev, B43_MMIO_GPIO_MASK,
                             b43_read16(dev, B43_MMIO_GPIO_MASK)
                             | 0x0100);
-                mask |= 0x0180;
-                set |= 0x0180;
+                /* BT Coexistance Input */
+                mask |= 0x0080;
+                set |= 0x0080;
+                /* BT Coexistance Out */
+                mask |= 0x0100;
+                set |= 0x0100;
         }
         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
+                /* PA is controlled by gpio 9, let ucode handle it */
                 b43_write16(dev, B43_MMIO_GPIO_MASK,
                             b43_read16(dev, B43_MMIO_GPIO_MASK)
                             | 0x0200);
                 mask |= 0x0200;
                 set |= 0x0200;
         }
-        if (dev->dev->core_rev >= 2)
-                mask |= 0x0010; /* FIXME: This is redundant. */
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
-                                        BCMA_CC_GPIOCTL) & mask) | set);
+                                        BCMA_CC_GPIOCTL) & ~mask) | set);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
@@ -2753,7 +2758,7 @@ static int b43_gpio_init(struct b43_wldev *dev)
                 if (gpiodev)
                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
-                                    & mask) | set);
+                                    & ~mask) | set);
                 break;
 #endif
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index dcfeb1a4ef8b..7f9ba82a586a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -1196,7 +1196,7 @@ exit:
         kfree(buf);
         /* close file before return */
         if (fp)
-                filp_close(fp, current->files);
+                filp_close(fp, NULL);
         /* restore previous address limit */
         set_fs(old_fs);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 78fb17e63eb7..7fe68aa69dfd 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -521,7 +521,7 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         else
                 devinfo->bus_pub.bus->dstats.tx_errors++;
 
-        dev_kfree_skb(req->skb);
+        brcmu_pkt_buf_free_skb(req->skb);
         req->skb = NULL;
         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 
@@ -542,7 +542,7 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 devinfo->bus_pub.bus->dstats.rx_packets++;
         } else {
                 devinfo->bus_pub.bus->dstats.rx_errors++;
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                 return;
         }
@@ -552,13 +552,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
                         brcmf_dbg(ERROR, "rx protocol error\n");
                         brcmu_pkt_buf_free_skb(skb);
+                        brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                         devinfo->bus_pub.bus->dstats.rx_errors++;
                 } else {
                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
                         brcmf_usb_rx_refill(devinfo, req);
                 }
         } else {
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
+                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
         return;
 
@@ -583,14 +585,13 @@ static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
                           req);
-        req->urb->transfer_flags |= URB_ZERO_PACKET;
         req->devinfo = devinfo;
+        brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
 
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (ret == 0) {
-                brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
-        } else {
-                dev_kfree_skb(req->skb);
+        if (ret) {
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
@@ -685,23 +686,22 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 
         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
         if (!req) {
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_dbg(ERROR, "no req to send\n");
                 return -ENOMEM;
         }
-        if (!req->urb) {
-                brcmf_dbg(ERROR, "no urb for req %p\n", req);
-                return -ENOBUFS;
-        }
 
         req->skb = skb;
         req->devinfo = devinfo;
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
                           skb->data, skb->len, brcmf_usb_tx_complete, req);
         req->urb->transfer_flags |= URB_ZERO_PACKET;
+        brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (!ret) {
-                brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
-        } else {
+        if (ret) {
+                brcmf_dbg(ERROR, "brcmf_usb_tx usb_submit_urb FAILED\n");
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index c7230f531e49..a6b382bfabd6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1877,16 +1877,17 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
-                scb_val.val = cpu_to_le32(0);
+                memset(&scb_val, 0, sizeof(scb_val));
                 err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_RSSI, &scb_val,
                                       sizeof(struct brcmf_scb_val_le));
-                if (err)
+                if (err) {
                         WL_ERR("Could not get rssi (%d)\n", err);
-
-                rssi = le32_to_cpu(scb_val.val);
-                sinfo->filled |= STATION_INFO_SIGNAL;
-                sinfo->signal = rssi;
-                WL_CONN("RSSI %d dBm\n", rssi);
+                } else {
+                        rssi = le32_to_cpu(scb_val.val);
+                        sinfo->filled |= STATION_INFO_SIGNAL;
+                        sinfo->signal = rssi;
+                        WL_CONN("RSSI %d dBm\n", rssi);
+                }
         }
 
 done:
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 9a4c63f927cb..7ed7d7577024 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -382,9 +382,7 @@ brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
 {
         struct brcms_c_info *wlc = wlc_cm->wlc;
         struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.channel;
-        const struct ieee80211_reg_rule *reg_rule;
         struct txpwr_limits txpwr;
-        int ret;
 
         brcms_c_channel_reg_limits(wlc_cm, chanspec, &txpwr);
 
@@ -393,8 +391,7 @@ brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
         );
 
         /* set or restore gmode as required by regulatory */
-        ret = freq_reg_info(wlc->wiphy, ch->center_freq, 0, &reg_rule);
-        if (!ret && (reg_rule->flags & NL80211_RRF_NO_OFDM))
+        if (ch->flags & IEEE80211_CHAN_NO_OFDM)
                 brcms_c_set_gmode(wlc, GMODE_LEGACY_B, false);
         else
                 brcms_c_set_gmode(wlc, wlc->protection->gmode_user, false);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 04ecf03fc8cb..718da8d6d658 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -123,7 +123,8 @@ static struct ieee80211_channel brcms_2ghz_chantable[] = {
                  IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(14, 2484,
                  IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
+                 IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS |
+                 IEEE80211_CHAN_NO_OFDM)
 };
 
 static struct ieee80211_channel brcms_5ghz_nphy_chantable[] = {
@@ -1236,6 +1237,9 @@ uint brcms_reset(struct brcms_info *wl)
         /* dpc will not be rescheduled */
         wl->resched = false;
 
+        /* inform publicly that interface is down */
+        wl->pub->up = false;
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index c3e14b2104ef..4d30cd18c3b0 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -2042,7 +2042,8 @@ static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
                 return;
         }
         len = ETH_ALEN;
-        ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, &bssid, &len);
+        ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, bssid,
+                                  &len);
         if (ret) {
                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
                                __LINE__);
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index ce826bc5f111..1a98fa3ab06d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -124,6 +124,9 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
         const struct fw_img *img;
         size_t bufsz;
 
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
+
         /* default is to dump the entire data segment */
         if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
                 priv->dbgfs_sram_offset = 0x800000;
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index 6fddd2785e6e..a82f46c10f5e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -707,11 +707,14 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
  */
 static bool rs_use_green(struct ieee80211_sta *sta)
 {
-        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
-        struct iwl_rxon_context *ctx = sta_priv->ctx;
-
-        return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
-                !(ctx->ht.non_gf_sta_present);
+        /*
+         * There's a bug somewhere in this code that causes the
+         * scaling to get stuck because GF+SGI can't be combined
+         * in SISO rates. Until we find that bug, disable GF, it
+         * has only limited benefit and we still interoperate with
+         * GF APs since we can always receive GF transmissions.
+         */
+        return false;
 }
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 3ef8d5adc991..71c79943e633 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -351,7 +351,7 @@ int iwl_queue_space(const struct iwl_queue *q);
 /*****************************************************
 * Error handling
 ******************************************************/
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);
+int iwl_dump_fh(struct iwl_trans *trans, char **buf);
 void iwl_dump_csr(struct iwl_trans *trans);
 
 /*****************************************************
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index d80604a2bb1a..498372008810 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -565,7 +565,7 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
         }
 
         iwl_dump_csr(trans);
-        iwl_dump_fh(trans, NULL, false);
+        iwl_dump_fh(trans, NULL);
 
         iwl_op_mode_nic_error(trans->op_mode);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 38f51b04217e..848851177e7e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1649,13 +1649,9 @@ static const char *get_fh_string(int cmd)
 #undef IWL_CMD
 }
 
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
+int iwl_dump_fh(struct iwl_trans *trans, char **buf)
 {
         int i;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        int pos = 0;
-        size_t bufsz = 0;
-#endif
         static const u32 fh_tbl[] = {
                 FH_RSCSR_CHNL0_STTS_WPTR_REG,
                 FH_RSCSR_CHNL0_RBDCB_BASE_REG,
@@ -1667,29 +1663,35 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
                 FH_TSSR_TX_STATUS_REG,
                 FH_TSSR_TX_ERROR_REG
         };
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (display) {
-                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (buf) {
+                int pos = 0;
+                size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+
                 *buf = kmalloc(bufsz, GFP_KERNEL);
                 if (!*buf)
                         return -ENOMEM;
+
                 pos += scnprintf(*buf + pos, bufsz - pos,
                                 "FH register values:\n");
-                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+
+                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)
                         pos += scnprintf(*buf + pos, bufsz - pos,
                                 "  %34s: 0X%08x\n",
                                 get_fh_string(fh_tbl[i]),
                                 iwl_read_direct32(trans, fh_tbl[i]));
-                }
+
                 return pos;
         }
 #endif
+
         IWL_ERR(trans, "FH register values:\n");
-        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+        for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)
                 IWL_ERR(trans, "  %34s: 0X%08x\n",
                         get_fh_string(fh_tbl[i]),
                         iwl_read_direct32(trans, fh_tbl[i]));
-        }
+
         return 0;
 }
 
@@ -1982,11 +1984,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
                                      size_t count, loff_t *ppos)
 {
         struct iwl_trans *trans = file->private_data;
-        char *buf;
+        char *buf = NULL;
         int pos = 0;
         ssize_t ret = -EFAULT;
 
-        ret = pos = iwl_dump_fh(trans, &buf, true);
+        ret = pos = iwl_dump_fh(trans, &buf);
         if (buf) {
                 ret = simple_read_from_buffer(user_buf,
                                               count, ppos, buf, pos);
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index eb5de800ed90..1c10b542ab23 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1254,6 +1254,7 @@ static int lbs_associate(struct lbs_private *priv,
                         netif_tx_wake_all_queues(priv->dev);
         }
 
+        kfree(cmd);
 done:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 76caebaa4397..4cb234349fbf 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1314,6 +1314,7 @@ static void if_sdio_remove(struct sdio_func *func)
                 kfree(packet);
         }
 
+        kfree(card);
         lbs_deb_leave(LBS_DEB_SDIO);
 }
 
@@ -1325,6 +1326,11 @@ static int if_sdio_suspend(struct device *dev)
 
         mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
 
+        /* If we're powered off anyway, just let the mmc layer remove the
+         * card. */
+        if (!lbs_iface_active(card->priv))
+                return -ENOSYS;
+
         dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
                  sdio_func_id(func), flags);
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 58048189bd24..fe1ea43c5149 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -571,7 +571,10 @@ static int lbs_thread(void *data)
                         netdev_info(dev, "Timeout submitting command 0x%04x\n",
                                     le16_to_cpu(cmdnode->cmdbuf->command));
                         lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
-                        if (priv->reset_card)
+
+                        /* Reset card, but only when it isn't in the process
+                         * of being shutdown anyway. */
+                        if (!dev->dismantle && priv->reset_card)
                                 priv->reset_card(priv);
                 }
                 priv->cmd_timed_out = 0;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index c229dddcf1c2..225c1a4feeba 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -170,7 +170,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         cmd_code = le16_to_cpu(host_cmd->command);
         cmd_size = le16_to_cpu(host_cmd->size);
 
-        skb_trim(cmd_node->cmd_skb, cmd_size);
+        /* Adjust skb length */
+        if (cmd_node->cmd_skb->len > cmd_size)
+                /*
+                 * cmd_size is less than sizeof(struct host_cmd_ds_command).
+                 * Trim off the unused portion.
+                 */
+                skb_trim(cmd_node->cmd_skb, cmd_size);
+        else if (cmd_node->cmd_skb->len < cmd_size)
+                /*
+                 * cmd_size is larger than sizeof(struct host_cmd_ds_command)
+                 * because we have appended custom IE TLV. Increase skb length
+                 * accordingly.
+                 */
+                skb_put(cmd_node->cmd_skb, cmd_size - cmd_node->cmd_skb->len);
 
         do_gettimeofday(&tstamp);
         dev_dbg(adapter->dev, "cmd: DNLD_CMD: (%lu.%lu): %#x, act %#x, len %d,"
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 241162e8111d..7a4ae9ee1c63 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1803,6 +1803,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
                                                 struct cfg80211_pmksa *pmksa,
                                                 int max_pmkids)
 {
+        struct ndis_80211_pmkid *new_pmkids;
         int i, err, newlen;
         unsigned int count;
 
@@ -1833,11 +1834,12 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
         /* add new pmkid */
         newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
 
-        pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
-        if (!pmkids) {
+        new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
+        if (!new_pmkids) {
                 err = -ENOMEM;
                 goto error;
         }
+        pmkids = new_pmkids;
 
         pmkids->length = cpu_to_le32(newlen);
         pmkids->bssid_info_count = cpu_to_le32(count + 1);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 8b9dbd76a252..64328af496f5 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2400pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index d3a4a68cc439..7564ae992b73 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -670,6 +670,7 @@
 #define GPIOCSR_BIT5                    FIELD32(0x00000020)
 #define GPIOCSR_BIT6                    FIELD32(0x00000040)
 #define GPIOCSR_BIT7                    FIELD32(0x00000080)
+#define GPIOCSR_BIT8                    FIELD32(0x00000100)
 
 /*
  * BBPPCSR: BBP Pin control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index d2cf8a4bc8b5..3de0406735f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 3aae36bb0a9e..89fee311d8fd 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
         u16 reg;
 
         rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-        return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
+        return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
 }
 
 #ifdef CONFIG_RT2X00_LIB_LEDS
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u16 reg;
 
         /*
          * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
+        rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index b493306a7eed..196bd5103e4f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -189,14 +189,15 @@
  * MAC_CSR19: GPIO control register.
  */
 #define MAC_CSR19                       0x0426
-#define MAC_CSR19_BIT0                  FIELD32(0x0001)
-#define MAC_CSR19_BIT1                  FIELD32(0x0002)
-#define MAC_CSR19_BIT2                  FIELD32(0x0004)
-#define MAC_CSR19_BIT3                  FIELD32(0x0008)
-#define MAC_CSR19_BIT4                  FIELD32(0x0010)
-#define MAC_CSR19_BIT5                  FIELD32(0x0020)
-#define MAC_CSR19_BIT6                  FIELD32(0x0040)
-#define MAC_CSR19_BIT7                  FIELD32(0x0080)
+#define MAC_CSR19_BIT0                  FIELD16(0x0001)
+#define MAC_CSR19_BIT1                  FIELD16(0x0002)
+#define MAC_CSR19_BIT2                  FIELD16(0x0004)
+#define MAC_CSR19_BIT3                  FIELD16(0x0008)
+#define MAC_CSR19_BIT4                  FIELD16(0x0010)
+#define MAC_CSR19_BIT5                  FIELD16(0x0020)
+#define MAC_CSR19_BIT6                  FIELD16(0x0040)
+#define MAC_CSR19_BIT7                  FIELD16(0x0080)
+#define MAC_CSR19_BIT8                  FIELD16(0x0100)
 
 /*
  * MAC_CSR20: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 88455b1b9fe0..b93516d832fb 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -221,6 +221,67 @@ static void rt2800_rf_write(struct rt2x00_dev *rt2x00dev,
         mutex_unlock(&rt2x00dev->csr_mutex);
 }
 
+static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        int i, count;
+
+        rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
+        if (rt2x00_get_field32(reg, WLAN_EN))
+                return 0;
+
+        rt2x00_set_field32(&reg, WLAN_GPIO_OUT_OE_BIT_ALL, 0xff);
+        rt2x00_set_field32(&reg, FRC_WL_ANT_SET, 1);
+        rt2x00_set_field32(&reg, WLAN_CLK_EN, 0);
+        rt2x00_set_field32(&reg, WLAN_EN, 1);
+        rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+
+        udelay(REGISTER_BUSY_DELAY);
+
+        count = 0;
+        do {
+                /*
+                 * Check PLL_LD & XTAL_RDY.
+                 */
+                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                        rt2800_register_read(rt2x00dev, CMB_CTRL, &reg);
+                        if (rt2x00_get_field32(reg, PLL_LD) &&
+                            rt2x00_get_field32(reg, XTAL_RDY))
+                                break;
+                        udelay(REGISTER_BUSY_DELAY);
+                }
+
+                if (i >= REGISTER_BUSY_COUNT) {
+
+                        if (count >= 10)
+                                return -EIO;
+
+                        rt2800_register_write(rt2x00dev, 0x58, 0x018);
+                        udelay(REGISTER_BUSY_DELAY);
+                        rt2800_register_write(rt2x00dev, 0x58, 0x418);
+                        udelay(REGISTER_BUSY_DELAY);
+                        rt2800_register_write(rt2x00dev, 0x58, 0x618);
+                        udelay(REGISTER_BUSY_DELAY);
+                        count++;
+                } else {
+                        count = 0;
+                }
+
+                rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
+                rt2x00_set_field32(&reg, PCIE_APP0_CLK_REQ, 0);
+                rt2x00_set_field32(&reg, WLAN_CLK_EN, 1);
+                rt2x00_set_field32(&reg, WLAN_RESET, 1);
+                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+                udelay(10);
+                rt2x00_set_field32(&reg, WLAN_RESET, 0);
+                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+                udelay(10);
+                rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, 0x7fffffff);
+        } while (count != 0);
+
+        return 0;
+}
+
 void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
                         const u8 command, const u8 token,
                         const u8 arg0, const u8 arg1)
@@ -400,6 +461,13 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
 {
         unsigned int i;
         u32 reg;
+        int retval;
+
+        if (rt2x00_rt(rt2x00dev, RT3290)) {
+                retval = rt2800_enable_wlan_rt3290(rt2x00dev);
+                if (retval)
+                        return -EBUSY;
+        }
 
         /*
          * If driver doesn't wake up firmware here,
@@ -4021,6 +4089,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
                 msleep(1);
                 rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+                rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL, 0);
                 rt2x00_set_field32(&reg, LDO_CFG0_BGSEL, 1);
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
         }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 235376e9cb04..4765bbd654cd 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -980,69 +980,10 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         return rt2800_validate_eeprom(rt2x00dev);
 }
 
-static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-        int i, count;
-
-        rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
-        if (rt2x00_get_field32(reg, WLAN_EN))
-                return 0;
-
-        rt2x00_set_field32(&reg, WLAN_GPIO_OUT_OE_BIT_ALL, 0xff);
-        rt2x00_set_field32(&reg, FRC_WL_ANT_SET, 1);
-        rt2x00_set_field32(&reg, WLAN_CLK_EN, 0);
-        rt2x00_set_field32(&reg, WLAN_EN, 1);
-        rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-
-        udelay(REGISTER_BUSY_DELAY);
-
-        count = 0;
-        do {
-                /*
-                 * Check PLL_LD & XTAL_RDY.
-                 */
-                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                        rt2800_register_read(rt2x00dev, CMB_CTRL, &reg);
-                        if (rt2x00_get_field32(reg, PLL_LD) &&
-                            rt2x00_get_field32(reg, XTAL_RDY))
-                                break;
-                        udelay(REGISTER_BUSY_DELAY);
-                }
-
-                if (i >= REGISTER_BUSY_COUNT) {
-
-                        if (count >= 10)
-                                return -EIO;
-
-                        rt2800_register_write(rt2x00dev, 0x58, 0x018);
-                        udelay(REGISTER_BUSY_DELAY);
-                        rt2800_register_write(rt2x00dev, 0x58, 0x418);
-                        udelay(REGISTER_BUSY_DELAY);
-                        rt2800_register_write(rt2x00dev, 0x58, 0x618);
-                        udelay(REGISTER_BUSY_DELAY);
-                        count++;
-                } else {
-                        count = 0;
-                }
-
-                rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
-                rt2x00_set_field32(&reg, PCIE_APP0_CLK_REQ, 0);
-                rt2x00_set_field32(&reg, WLAN_CLK_EN, 1);
-                rt2x00_set_field32(&reg, WLAN_RESET, 1);
-                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-                udelay(10);
-                rt2x00_set_field32(&reg, WLAN_RESET, 0);
-                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-                udelay(10);
-                rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, 0x7fffffff);
-        } while (count != 0);
-
-        return 0;
-}
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1056,6 +997,14 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
@@ -1063,17 +1012,6 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
-         * In probe phase call rt2800_enable_wlan_rt3290 to enable wlan
-         * clk for rt3290. That avoid the MCU fail in start phase.
-         */
-        if (rt2x00_rt(rt2x00dev, RT3290)) {
-                retval = rt2800_enable_wlan_rt3290(rt2x00dev);
-
-                if (retval)
-                        return retval;
-        }
-
-        /*
          * This device has multiple filters for control frames
          * and has a separate filter for PS Poll frames.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6cf336595e25..6b4226b71618 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
         skb_pull(entry->skb, RXINFO_DESC_SIZE);
 
         /*
-         * FIXME: we need to check for rx_pkt_len validity
+         * Check for rx_pkt_len validity. Return if invalid, leaving
+         * rxdesc->size zeroed out by the upper level.
          */
+        if (unlikely(rx_pkt_len == 0 ||
+                        rx_pkt_len > entry->queue->data_size)) {
+                ERROR(entry->queue->rt2x00dev,
+                        "Bad frame size %d, forcing to 0\n", rx_pkt_len);
+                return;
+        }
+
         rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
 
         /*
@@ -736,6 +744,7 @@ static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -749,6 +758,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
@@ -1157,6 +1174,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1690, 0x0744) },
         { USB_DEVICE(0x1690, 0x0761) },
         { USB_DEVICE(0x1690, 0x0764) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x179d) },
         /* Cisco */
         { USB_DEVICE(0x167b, 0x4001) },
         /* EnGenius */
@@ -1222,7 +1241,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1760) },
         { USB_DEVICE(0x0b05, 0x1761) },
         { USB_DEVICE(0x0b05, 0x1790) },
-        { USB_DEVICE(0x0b05, 0x179d) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262) },
         { USB_DEVICE(0x13d3, 0x3284) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index a59048ffa092..10cf67267775 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
          */
         if (unlikely(rxdesc.size == 0 ||
                      rxdesc.size > entry->queue->data_size)) {
-                WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
+                ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
                         rxdesc.size, entry->queue->data_size);
                 dev_kfree_skb(entry->skb);
                 goto renew_skb;
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f32259686b45..b8ec96163922 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2243,8 +2243,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 
 static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
 {
-        struct ieee80211_conf conf = { .flags = 0 };
-        struct rt2x00lib_conf libconf = { .conf = &conf };
+        struct rt2x00lib_conf libconf = { .conf = &rt2x00dev->hw->conf };
 
         rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
@@ -2833,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Disable power saving.
@@ -2851,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt61pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index e3cd6db76b0e..8f3da5a56766 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
 
 /*
  * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ba6e434b859d..248436c13ce0 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
+        rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt73usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 9f6b470414d3..df1cc116b83b 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
+#define MAC_CSR13_BIT14                 FIELD32(0x00004000)
+#define MAC_CSR13_BIT15                 FIELD32(0x00008000)
 
 /*
  * MAC_CSR14: LED control register.