Merge commit 'v2.6.28-rc9' into next

26 files changed, 252 insertions, 159 deletions

diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 0f1d6bdd51a2..2d14255eb103 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -240,6 +240,10 @@ static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
 static void ath5k_reset_tsf(struct ieee80211_hw *hw);
 static int ath5k_beacon_update(struct ieee80211_hw *hw,
                 struct sk_buff *skb);
+static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
+                struct ieee80211_vif *vif,
+                struct ieee80211_bss_conf *bss_conf,
+                u32 changes);
 
 static struct ieee80211_ops ath5k_hw_ops = {
         .tx             = ath5k_tx,
@@ -256,6 +260,7 @@ static struct ieee80211_ops ath5k_hw_ops = {
         .get_tx_stats   = ath5k_get_tx_stats,
         .get_tsf        = ath5k_get_tsf,
         .reset_tsf      = ath5k_reset_tsf,
+        .bss_info_changed = ath5k_bss_info_changed,
 };
 
 /*
@@ -661,8 +666,7 @@ ath5k_pci_resume(struct pci_dev *pdev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
-        int i, err;
+        int err;
 
         pci_restore_state(pdev);
 
@@ -688,16 +692,6 @@ ath5k_pci_resume(struct pci_dev *pdev)
                 goto err_irq;
         ath5k_led_enable(sc);
 
-        /*
-         * Reset the key cache since some parts do not
-         * reset the contents on initial power up or resume.
-         *
-         * FIXME: This may need to be revisited when mac80211 becomes
-         *        aware of suspend/resume.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
         return 0;
 err_irq:
         free_irq(pdev->irq, sc);
@@ -718,7 +712,6 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
         u8 mac[ETH_ALEN];
-        unsigned int i;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
@@ -737,13 +730,6 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
                 __set_bit(ATH_STAT_MRRETRY, sc->status);
 
         /*
-         * Reset the key cache since some parts do not
-         * reset the contents on initial power up.
-         */
-        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
-                ath5k_hw_reset_key(ah, i);
-
-        /*
          * Collect the channel list.  The 802.11 layer
          * is resposible for filtering this list based
          * on settings like the phy mode and regulatory
@@ -2202,7 +2188,8 @@ ath5k_beacon_config(struct ath5k_softc *sc)
 static int
 ath5k_init(struct ath5k_softc *sc, bool is_resume)
 {
-        int ret;
+        struct ath5k_hw *ah = sc->ah;
+        int ret, i;
 
         mutex_lock(&sc->lock);
 
@@ -2235,10 +2222,17 @@ ath5k_init(struct ath5k_softc *sc, bool is_resume)
         if (ret)
                 goto done;
 
+        /*
+         * Reset the key cache since some parts do not reset the
+         * contents on initial power up or resume from suspend.
+         */
+        for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
+                ath5k_hw_reset_key(ah, i);
+
         __set_bit(ATH_STAT_STARTED, sc->status);
 
         /* Set ack to be sent at low bit-rates */
-        ath5k_hw_set_ack_bitrate_high(sc->ah, false);
+        ath5k_hw_set_ack_bitrate_high(ah, false);
 
         mod_timer(&sc->calib_tim, round_jiffies(jiffies +
                         msecs_to_jiffies(ath5k_calinterval * 1000)));
@@ -2953,7 +2947,7 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
                 sc->opmode != NL80211_IFTYPE_MESH_POINT &&
                 test_bit(ATH_STAT_PROMISC, sc->status))
                 rfilt |= AR5K_RX_FILTER_PROM;
-        if (sc->opmode == NL80211_IFTYPE_STATION ||
+        if ((sc->opmode == NL80211_IFTYPE_STATION && sc->assoc) ||
                 sc->opmode == NL80211_IFTYPE_ADHOC) {
                 rfilt |= AR5K_RX_FILTER_BEACON;
         }
@@ -3094,4 +3088,32 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
 end:
         return ret;
 }
+static void
+set_beacon_filter(struct ieee80211_hw *hw, bool enable)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ath5k_hw *ah = sc->ah;
+        u32 rfilt;
+        rfilt = ath5k_hw_get_rx_filter(ah);
+        if (enable)
+                rfilt |= AR5K_RX_FILTER_BEACON;
+        else
+                rfilt &= ~AR5K_RX_FILTER_BEACON;
+        ath5k_hw_set_rx_filter(ah, rfilt);
+        sc->filter_flags = rfilt;
+}
 
+static void ath5k_bss_info_changed(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_bss_conf *bss_conf,
+                                    u32 changes)
+{
+        struct ath5k_softc *sc = hw->priv;
+        if (changes & BSS_CHANGED_ASSOC) {
+                mutex_lock(&sc->lock);
+                sc->assoc = bss_conf->assoc;
+                if (sc->opmode == NL80211_IFTYPE_STATION)
+                        set_beacon_filter(hw, sc->assoc);
+                mutex_unlock(&sc->lock);
+        }
+}
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index 06d1054ca94b..facc60ddada2 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -179,6 +179,7 @@ struct ath5k_softc {
 
         struct timer_list       calib_tim;      /* calibration timer */
         int                     power_level;    /* Requested tx power in dbm */
+        bool                    assoc;          /* assocate state */
 };
 
 #define ath5k_hw_hasbssidmask(_ah) \
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 8f92d670f614..ccaeb5c219d2 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -339,7 +339,7 @@ static struct {
         { ATH5K_DEBUG_BEACON,   "beacon",       "beacon handling" },
         { ATH5K_DEBUG_CALIBRATE, "calib",       "periodic calibration" },
         { ATH5K_DEBUG_TXPOWER,  "txpower",      "transmit power setting" },
-        { ATH5K_DEBUG_LED,      "led",          "LED mamagement" },
+        { ATH5K_DEBUG_LED,      "led",          "LED management" },
         { ATH5K_DEBUG_DUMP_RX,  "dumprx",       "print received skb content" },
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
         { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
@@ -417,19 +417,19 @@ ath5k_debug_init_device(struct ath5k_softc *sc)
         sc->debug.debugfs_phydir = debugfs_create_dir(wiphy_name(sc->hw->wiphy),
                                 ath5k_global_debugfs);
 
-        sc->debug.debugfs_debug = debugfs_create_file("debug", 0666,
+        sc->debug.debugfs_debug = debugfs_create_file("debug", S_IWUSR | S_IRUGO,
                                 sc->debug.debugfs_phydir, sc, &fops_debug);
 
-        sc->debug.debugfs_registers = debugfs_create_file("registers", 0444,
+        sc->debug.debugfs_registers = debugfs_create_file("registers", S_IRUGO,
                                 sc->debug.debugfs_phydir, sc, &fops_registers);
 
-        sc->debug.debugfs_tsf = debugfs_create_file("tsf", 0666,
+        sc->debug.debugfs_tsf = debugfs_create_file("tsf", S_IWUSR | S_IRUGO,
                                 sc->debug.debugfs_phydir, sc, &fops_tsf);
 
-        sc->debug.debugfs_beacon = debugfs_create_file("beacon", 0666,
+        sc->debug.debugfs_beacon = debugfs_create_file("beacon", S_IWUSR | S_IRUGO,
                                 sc->debug.debugfs_phydir, sc, &fops_beacon);
 
-        sc->debug.debugfs_reset = debugfs_create_file("reset", 0222,
+        sc->debug.debugfs_reset = debugfs_create_file("reset", S_IWUSR,
                                 sc->debug.debugfs_phydir, sc, &fops_reset);
 }
 
diff --git a/drivers/net/wireless/ath5k/desc.c b/drivers/net/wireless/ath5k/desc.c
index dd1374052ba9..5e362a7a3620 100644
--- a/drivers/net/wireless/ath5k/desc.c
+++ b/drivers/net/wireless/ath5k/desc.c
@@ -531,10 +531,10 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL);
         rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
                 AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = rx_status->rx_status_0 &
-                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        rs->rs_more = rx_status->rx_status_0 &
-                AR5K_5210_RX_DESC_STATUS0_MORE;
+        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA);
+        rs->rs_more = !!(rx_status->rx_status_0 &
+                AR5K_5210_RX_DESC_STATUS0_MORE);
         /* TODO: this timestamp is 13 bit, later on we assume 15 bit */
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
@@ -607,10 +607,10 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL);
         rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        rs->rs_more = rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_MORE;
+        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA);
+        rs->rs_more = !!(rx_status->rx_status_0 &
+                AR5K_5212_RX_DESC_STATUS0_MORE);
         rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
                 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
         rs->rs_status = 0;
diff --git a/drivers/net/wireless/ath5k/initvals.c b/drivers/net/wireless/ath5k/initvals.c
index ea2e1a20b499..ceaa6c475c06 100644
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -806,6 +806,8 @@ static const struct ath5k_ini_mode ar5212_rf5111_ini_mode_end[] = {
                 { 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 } },
         { AR5K_PHY(642),
                 { 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788 } },
+        { 0xa228,
+                { 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5 } },
         { 0xa23c,
                 { 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af } },
 };
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 8f1886834e61..1b6d45b6772d 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -537,9 +537,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                 mdelay(1);
 
                 /*
-                 * Write some more initial register settings
+                 * Write some more initial register settings for revised chips
                  */
-                if (ah->ah_version == AR5K_AR5212) {
+                if (ah->ah_version == AR5K_AR5212 &&
+                    ah->ah_phy_revision > 0x41) {
                         ath5k_hw_reg_write(ah, 0x0002a002, 0x982c);
 
                         if (channel->hw_value == CHANNEL_G)
@@ -558,19 +559,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                         else
                                 ath5k_hw_reg_write(ah, 0x00000000, 0x994c);
 
-                        /* Some bits are disabled here, we know nothing about
-                         * register 0xa228 yet, most of the times this ends up
-                         * with a value 0x9b5 -haven't seen any dump with
-                         * a different value- */
-                        /* Got this from decompiling binary HAL */
-                        data = ath5k_hw_reg_read(ah, 0xa228);
-                        data &= 0xfffffdff;
-                        ath5k_hw_reg_write(ah, data, 0xa228);
-
-                        data = ath5k_hw_reg_read(ah, 0xa228);
-                        data &= 0xfffe03ff;
-                        ath5k_hw_reg_write(ah, data, 0xa228);
-                        data = 0;
+                        /* Got this from legacy-hal */
+                        AR5K_REG_DISABLE_BITS(ah, 0xa228, 0x200);
+
+                        AR5K_REG_MASKED_BITS(ah, 0xa228, 0x800, 0xfffe03ff);
 
                         /* Just write 0x9b5 ? */
                         /* ath5k_hw_reg_write(ah, 0x000009b5, 0xa228); */
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index 9e15c30bbc06..4dd1c1bda0fb 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -170,7 +170,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
         skb = (struct sk_buff *)bf->bf_mpdu;
         if (skb) {
                 pci_unmap_single(sc->pdev, bf->bf_dmacontext,
-                                 skb_end_pointer(skb) - skb->head,
+                                 skb->len,
                                  PCI_DMA_TODEVICE);
         }
 
@@ -193,7 +193,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
 
         bf->bf_buf_addr = bf->bf_dmacontext =
                 pci_map_single(sc->pdev, skb->data,
-                               skb_end_pointer(skb) - skb->head,
+                               skb->len,
                                PCI_DMA_TODEVICE);
 
         skb = ieee80211_get_buffered_bc(sc->hw, avp->av_if_data);
@@ -352,7 +352,7 @@ int ath_beacon_alloc(struct ath_softc *sc, int if_id)
         if (bf->bf_mpdu != NULL) {
                 skb = (struct sk_buff *)bf->bf_mpdu;
                 pci_unmap_single(sc->pdev, bf->bf_dmacontext,
-                                 skb_end_pointer(skb) - skb->head,
+                                 skb->len,
                                  PCI_DMA_TODEVICE);
                 dev_kfree_skb_any(skb);
                 bf->bf_mpdu = NULL;
@@ -412,7 +412,7 @@ int ath_beacon_alloc(struct ath_softc *sc, int if_id)
 
         bf->bf_buf_addr = bf->bf_dmacontext =
                 pci_map_single(sc->pdev, skb->data,
-                               skb_end_pointer(skb) - skb->head,
+                               skb->len,
                                PCI_DMA_TODEVICE);
         bf->bf_mpdu = skb;
 
@@ -439,7 +439,7 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vap *avp)
                 if (bf->bf_mpdu != NULL) {
                         struct sk_buff *skb = (struct sk_buff *)bf->bf_mpdu;
                         pci_unmap_single(sc->pdev, bf->bf_dmacontext,
-                                         skb_end_pointer(skb) - skb->head,
+                                         skb->len,
                                          PCI_DMA_TODEVICE);
                         dev_kfree_skb_any(skb);
                         bf->bf_mpdu = NULL;
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 4983402af559..504a0444d89f 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -49,10 +49,12 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
         ASSERT(skb != NULL);
         ds->ds_vdata = skb->data;
 
-        /* setup rx descriptors */
+        /* setup rx descriptors. The sc_rxbufsize here tells the harware
+         * how much data it can DMA to us and that we are prepared
+         * to process */
         ath9k_hw_setuprxdesc(ah,
                              ds,
-                             skb_tailroom(skb),   /* buffer size */
+                             sc->sc_rxbufsize,
                              0);
 
         if (sc->sc_rxlink == NULL)
@@ -398,6 +400,13 @@ static struct sk_buff *ath_rxbuf_alloc(struct ath_softc *sc,
          * in rx'd frames.
          */
 
+        /* Note: the kernel can allocate a value greater than
+         * what we ask it to give us. We really only need 4 KB as that
+         * is this hardware supports and in fact we need at least 3849
+         * as that is the MAX AMSDU size this hardware supports.
+         * Unfortunately this means we may get 8 KB here from the
+         * kernel... and that is actually what is observed on some
+         * systems :( */
         skb = dev_alloc_skb(len + sc->sc_cachelsz - 1);
         if (skb != NULL) {
                 off = ((unsigned long) skb->data) % sc->sc_cachelsz;
@@ -456,7 +465,7 @@ static int ath_rx_indicate(struct ath_softc *sc,
         if (nskb != NULL) {
                 bf->bf_mpdu = nskb;
                 bf->bf_buf_addr = pci_map_single(sc->pdev, nskb->data,
-                                         skb_end_pointer(nskb) - nskb->head,
+                                         sc->sc_rxbufsize,
                                          PCI_DMA_FROMDEVICE);
                 bf->bf_dmacontext = bf->bf_buf_addr;
                 ATH_RX_CONTEXT(nskb)->ctx_rxbuf = bf;
@@ -542,7 +551,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
 
                         bf->bf_mpdu = skb;
                         bf->bf_buf_addr = pci_map_single(sc->pdev, skb->data,
-                                         skb_end_pointer(skb) - skb->head,
+                                         sc->sc_rxbufsize,
                                          PCI_DMA_FROMDEVICE);
                         bf->bf_dmacontext = bf->bf_buf_addr;
                         ATH_RX_CONTEXT(skb)->ctx_rxbuf = bf;
@@ -1007,7 +1016,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
                 pci_dma_sync_single_for_cpu(sc->pdev,
                                             bf->bf_buf_addr,
-                                            skb_tailroom(skb),
+                                            sc->sc_rxbufsize,
                                             PCI_DMA_FROMDEVICE);
                 pci_unmap_single(sc->pdev,
                                  bf->bf_buf_addr,
diff --git a/drivers/net/wireless/hostap/hostap_wlan.h b/drivers/net/wireless/hostap/hostap_wlan.h
index ffdf4876121b..a68f97c39359 100644
--- a/drivers/net/wireless/hostap/hostap_wlan.h
+++ b/drivers/net/wireless/hostap/hostap_wlan.h
@@ -918,9 +918,12 @@ struct hostap_interface {
 
 /*
  * TX meta data - stored in skb->cb buffer, so this must not be increased over
- * the 40-byte limit
+ * the 48-byte limit.
+ * THE PADDING THIS STARTS WITH IS A HORRIBLE HACK THAT SHOULD NOT LIVE
+ * TO SEE THE DAY.
  */
 struct hostap_skb_tx_data {
+        unsigned int __padding_for_default_qdiscs;
         u32 magic; /* HOSTAP_SKB_TX_DATA_MAGIC */
         u8 rate; /* transmit rate */
 #define HOSTAP_TX_FLAGS_WDS BIT(0)
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index dcce3542d5a7..7a9f901d4ff6 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -3897,6 +3897,7 @@ static int ipw_disassociate(void *data)
         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
                 return 0;
         ipw_send_disassociate(data, 0);
+        netif_carrier_off(priv->net_dev);
         return 1;
 }
 
@@ -10190,6 +10191,9 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
         u16 remaining_bytes;
         int fc;
 
+        if (!(priv->status & STATUS_ASSOCIATED))
+                goto drop;
+
         hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
         switch (priv->ieee->iw_mode) {
         case IW_MODE_ADHOC:
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 24a1aeb6448f..c4c0371c763b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1384,9 +1384,11 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
-                                            priv->hw_params.rx_buf_size,
-                                            PCI_DMA_FROMDEVICE);
+                dma_sync_single_range_for_cpu(
+                                &priv->pci_dev->dev, rxb->real_dma_addr,
+                                rxb->aligned_dma_addr - rxb->real_dma_addr,
+                                priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
                 pkt = (struct iwl_rx_packet *)rxb->skb->data;
 
                 /* Reclaim a command buffer only if this packet is a response
@@ -1436,8 +1438,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         rxb->skb = NULL;
                 }
 
-                pci_unmap_single(priv->pci_dev, rxb->dma_addr,
-                                 priv->hw_params.rx_buf_size,
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                                 priv->hw_params.rx_buf_size + 256,
                                  PCI_DMA_FROMDEVICE);
                 spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
@@ -2090,7 +2092,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 iwl4965_error_recovery(priv);
 
         iwl_power_update_mode(priv, 1);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 
         if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
                 iwl4965_set_mode(priv, priv->iw_mode);
@@ -3252,7 +3253,11 @@ static void iwl4965_mac_update_tkip_key(struct ieee80211_hw *hw,
                 return;
         }
 
-        iwl_scan_cancel_timeout(priv, 100);
+        if (iwl_scan_cancel(priv)) {
+                /* cancel scan failed, just live w/ bad key and rely
+                   briefly on SW decryption */
+                return;
+        }
 
         key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 4c312c55f90c..01a845851338 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -290,6 +290,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         priv->num_stations = 0;
         memset(priv->stations, 0, sizeof(priv->stations));
 
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c018121085e9..9966d4e384ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -89,7 +89,8 @@ extern struct iwl_cfg iwl5100_abg_cfg;
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
 struct iwl_rx_mem_buffer {
-        dma_addr_t dma_addr;
+        dma_addr_t real_dma_addr;
+        dma_addr_t aligned_dma_addr;
         struct sk_buff *skb;
         struct list_head list;
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 7cde9d76ff5d..0509c16dbe75 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -204,7 +204,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -251,7 +251,7 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
 
                 /* Alloc a new receive buffer */
-                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size,
+                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
                                 __GFP_NOWARN | GFP_ATOMIC);
                 if (!rxb->skb) {
                         if (net_ratelimit())
@@ -266,9 +266,17 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Get physical address of RB/SKB */
-                rxb->dma_addr =
-                    pci_map_single(priv->pci_dev, rxb->skb->data,
-                           priv->hw_params.rx_buf_size, PCI_DMA_FROMDEVICE);
+                rxb->real_dma_addr = pci_map_single(
+                                        priv->pci_dev,
+                                        rxb->skb->data,
+                                        priv->hw_params.rx_buf_size + 256,
+                                        PCI_DMA_FROMDEVICE);
+                /* dma address must be no more than 36 bits */
+                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                /* and also 256 byte aligned! */
+                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
+                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
+
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
         }
@@ -300,8 +308,8 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         dev_kfree_skb(rxq->pool[i].skb);
                 }
@@ -354,8 +362,8 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                  * to an SKB, so we need to unmap and free potential storage */
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         priv->alloc_rxb_skb--;
                         dev_kfree_skb(rxq->pool[i].skb);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 3b0bee331a33..c89365e2ca58 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -896,6 +896,13 @@ static void iwl_bg_request_scan(struct work_struct *data)
         return;
 
  done:
+        /* Cannot perform scan. Make sure we clear scanning
+        * bits from status so next scan request can be performed.
+        * If we don't clear scanning status bit here all next scan
+        * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 61797f3f8d5c..26f7084d3011 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -475,7 +475,7 @@ static int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
                 if (!test_and_set_bit(i, &priv->ucode_key_table))
                         return i;
 
-        return -1;
+        return WEP_INVALID_OFFSET;
 }
 
 int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
@@ -620,6 +620,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
@@ -637,6 +640,7 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         __le16 key_flags = 0;
+        int ret;
 
         key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -664,14 +668,18 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        return ret;
 }
 
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -696,6 +704,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -734,6 +745,13 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 return 0;
         }
 
+        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+                IWL_WARNING("Removing wrong key %d 0x%x\n",
+                            keyconf->keyidx, key_flags);
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+
         if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
                 &priv->ucode_key_table))
                 IWL_ERROR("index %d not used in uCode key table.\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d15a2c997954..45a6b0c35695 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -5768,7 +5768,6 @@ static void iwl3945_alive_start(struct iwl3945_priv *priv)
         if (priv->error_recovering)
                 iwl3945_error_recovery(priv);
 
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
         return;
 
  restart:
@@ -6256,6 +6255,11 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                                               n_probes,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
+        if (scan->channel_count == 0) {
+                IWL_DEBUG_SCAN("channel count %d\n", scan->channel_count);
+                goto done;
+        }
+
         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
             scan->channel_count * sizeof(struct iwl3945_scan_channel);
         cmd.data = scan;
@@ -6273,6 +6277,14 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         return;
 
  done:
+        /* can not perform scan make sure we clear scanning
+         * bits from status so next scan request can be performed.
+         * if we dont clear scanning status bit here all next scan
+         * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
+
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 297696de2da0..8265c7d25edc 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -605,9 +605,9 @@ int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
         if (ret == 0) {
                 *curlevel = le16_to_cpu(cmd.curlevel);
                 if (minlevel)
-                        *minlevel = le16_to_cpu(cmd.minlevel);
+                        *minlevel = cmd.minlevel;
                 if (maxlevel)
-                        *maxlevel = le16_to_cpu(cmd.maxlevel);
+                        *maxlevel = cmd.maxlevel;
         }
 
         lbs_deb_leave(LBS_DEB_CMD);
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 8f66903641b9..22c4c6110521 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_descriptor *bss,
 
                 switch (elem->id) {
                 case MFIE_TYPE_SSID:
-                        bss->ssid_len = elem->len;
-                        memcpy(bss->ssid, elem->data, elem->len);
+                        bss->ssid_len = min_t(int, 32, elem->len);
+                        memcpy(bss->ssid, elem->data, bss->ssid_len);
                         lbs_deb_scan("got SSID IE: '%s', len %u\n",
                                      escape_essid(bss->ssid, bss->ssid_len),
                                      bss->ssid_len);
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 1cc03a8dd67a..59634c33b1f9 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -331,7 +331,7 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
         /* Fill the receive configuration URB and initialise the Rx call back */
         usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
                           usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
-                          (void *) (skb->tail),
+                          skb_tail_pointer(skb),
                           MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp);
 
         cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 2d022f83774c..827ca0384a4c 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -319,7 +319,7 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         void *tmp;
         int err;
         u8 *end = (u8 *)eeprom + len;
-        u16 synth;
+        u16 synth = 0;
         DECLARE_MAC_BUF(mac);
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
@@ -422,7 +422,8 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                 entry = (void *)entry + (entry_len + 1)*2;
         }
 
-        if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
+        if (!synth || !priv->iq_autocal || !priv->output_limit ||
+            !priv->curve_data) {
                 printk(KERN_ERR "p54: not all required entries found in eeprom!\n");
                 err = -EINVAL;
                 goto err;
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 1c2a02a741af..88b3cad8b65e 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -346,68 +346,6 @@ static void p54p_tx(struct ieee80211_hw *dev, struct p54_control_hdr *data,
                 printk(KERN_INFO "%s: tx overflow.\n", wiphy_name(dev->wiphy));
 }
 
-static int p54p_open(struct ieee80211_hw *dev)
-{
-        struct p54p_priv *priv = dev->priv;
-        int err;
-
-        init_completion(&priv->boot_comp);
-        err = request_irq(priv->pdev->irq, &p54p_interrupt,
-                          IRQF_SHARED, "p54pci", dev);
-        if (err) {
-                printk(KERN_ERR "%s: failed to register IRQ handler\n",
-                       wiphy_name(dev->wiphy));
-                return err;
-        }
-
-        memset(priv->ring_control, 0, sizeof(*priv->ring_control));
-        err = p54p_upload_firmware(dev);
-        if (err) {
-                free_irq(priv->pdev->irq, dev);
-                return err;
-        }
-        priv->rx_idx_data = priv->tx_idx_data = 0;
-        priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
-
-        p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
-                ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
-
-        p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
-                ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
-
-        P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
-        P54P_READ(ring_control_base);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_INIT));
-        P54P_READ(int_enable);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
-        P54P_READ(dev_int);
-
-        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
-                printk(KERN_ERR "%s: Cannot boot firmware!\n",
-                       wiphy_name(dev->wiphy));
-                free_irq(priv->pdev->irq, dev);
-                return -ETIMEDOUT;
-        }
-
-        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
-        P54P_READ(int_enable);
-        wmb();
-        udelay(10);
-
-        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
-        P54P_READ(dev_int);
-        wmb();
-        udelay(10);
-
-        return 0;
-}
-
 static void p54p_stop(struct ieee80211_hw *dev)
 {
         struct p54p_priv *priv = dev->priv;
@@ -474,6 +412,68 @@ static void p54p_stop(struct ieee80211_hw *dev)
         memset(ring_control, 0, sizeof(*ring_control));
 }
 
+static int p54p_open(struct ieee80211_hw *dev)
+{
+        struct p54p_priv *priv = dev->priv;
+        int err;
+
+        init_completion(&priv->boot_comp);
+        err = request_irq(priv->pdev->irq, &p54p_interrupt,
+                          IRQF_SHARED, "p54pci", dev);
+        if (err) {
+                printk(KERN_ERR "%s: failed to register IRQ handler\n",
+                       wiphy_name(dev->wiphy));
+                return err;
+        }
+
+        memset(priv->ring_control, 0, sizeof(*priv->ring_control));
+        err = p54p_upload_firmware(dev);
+        if (err) {
+                free_irq(priv->pdev->irq, dev);
+                return err;
+        }
+        priv->rx_idx_data = priv->tx_idx_data = 0;
+        priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
+
+        p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
+                ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
+
+        p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
+                ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
+
+        P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
+        P54P_READ(ring_control_base);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_INIT));
+        P54P_READ(int_enable);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
+        P54P_READ(dev_int);
+
+        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
+                printk(KERN_ERR "%s: Cannot boot firmware!\n",
+                       wiphy_name(dev->wiphy));
+                p54p_stop(dev);
+                return -ETIMEDOUT;
+        }
+
+        P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
+        P54P_READ(int_enable);
+        wmb();
+        udelay(10);
+
+        P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+        P54P_READ(dev_int);
+        wmb();
+        udelay(10);
+
+        return 0;
+}
+
 static int __devinit p54p_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *id)
 {
@@ -556,11 +556,13 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
         spin_lock_init(&priv->lock);
         tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
 
-        p54p_open(dev);
+        err = p54p_open(dev);
+        if (err)
+                goto err_free_common;
         err = p54_read_eeprom(dev);
         p54p_stop(dev);
         if (err)
-                goto err_free_desc;
+                goto err_free_common;
 
         err = ieee80211_register_hw(dev);
         if (err) {
@@ -573,8 +575,6 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
 
  err_free_common:
         p54_free_common(dev);
-
- err_free_desc:
         pci_free_consistent(pdev, sizeof(*priv->ring_control),
                             priv->ring_control, priv->ring_control_dma);
 
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index f839ce044afd..95511ac22470 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,5 +1,5 @@
 menuconfig RT2X00
-        bool "Ralink driver support"
+        tristate "Ralink driver support"
         depends on MAC80211 && WLAN_80211 && EXPERIMENTAL
         ---help---
           This will enable the experimental support for the Ralink drivers,
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index 431e3c78bf27..69eb0132593b 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -48,6 +48,9 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
+        {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        /* Abocom */
+        {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
         {}
 };
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index fe1867b25ff7..cac732f4047f 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -615,7 +615,7 @@ static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                 struct ieee80211_hdr *tx_hdr;
 
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
-                if (likely(!compare_ether_addr(tx_hdr->addr2, rx_hdr->addr1)))
+                if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                 {
                         __skb_unlink(skb, q);
                         tx_status(hw, skb, IEEE80211_TX_STAT_ACK, stats->signal, 1);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index a60ae86bd5c9..a3ccd8c1c716 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -61,6 +61,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0ace, 0xb215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B },
@@ -82,6 +83,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0cde, 0x001a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },