Merge remote-tracking branch 'wireless-next/master' into iwlwifi-next

66 files changed, 510 insertions, 432 deletions

diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 16c1dddfda00..9cb929dc3397 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -97,11 +97,16 @@ void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 #ifdef CONFIG_BCMA_DRIVER_GPIO
 /* driver_gpio.c */
 int bcma_gpio_init(struct bcma_drv_cc *cc);
+int bcma_gpio_unregister(struct bcma_drv_cc *cc);
 #else
 static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
 {
         return -ENOTSUPP;
 }
+static inline int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return 0;
+}
 #endif /* CONFIG_BCMA_DRIVER_GPIO */
 
 #endif
diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index 19fafcf78840..d4f699aef8c4 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
         struct bcma_bus *bus = cc->core->bus;
 
         if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
-            cc->core->id.rev != 0x38) {
+            cc->core->id.rev != 38) {
                 bcma_err(bus, "NAND flash on unsupported board!\n");
                 return -ENOTSUPP;
         }
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 0b5df538dfd9..45f0996a3752 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -107,3 +107,8 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
 
         return gpiochip_add(chip);
 }
+
+int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return gpiochip_remove(&cc->gpio);
+}
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 95ba5756c67e..360c41f2b509 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -276,6 +276,13 @@ int __devinit bcma_bus_register(struct bcma_bus *bus)
 void bcma_bus_unregister(struct bcma_bus *bus)
 {
         struct bcma_device *cores[3];
+        int err;
+
+        err = bcma_gpio_unregister(&bus->drv_cc);
+        if (err == -EBUSY)
+                bcma_err(bus, "Some GPIOs are still in use.\n");
+        else if (err)
+                bcma_err(bus, "Can not unregister GPIO driver: %i\n", err);
 
         cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
         cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 259c43332fb8..752ffc4f4166 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -427,6 +427,30 @@ static bool ath6kl_is_tx_pending(struct ath6kl *ar)
         return ar->tx_pending[ath6kl_wmi_get_control_ep(ar->wmi)] == 0;
 }
 
+static void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif,
+                                              bool enable)
+{
+        int err;
+
+        if (WARN_ON(!test_bit(WMI_READY, &vif->ar->flag)))
+                return;
+
+        if (vif->nw_type != INFRA_NETWORK)
+                return;
+
+        if (!test_bit(ATH6KL_FW_CAPABILITY_BMISS_ENHANCE,
+                      vif->ar->fw_capabilities))
+                return;
+
+        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s fw bmiss enhance\n",
+                   enable ? "enable" : "disable");
+
+        err = ath6kl_wmi_sta_bmiss_enhance_cmd(vif->ar->wmi,
+                                               vif->fw_vif_idx, enable);
+        if (err)
+                ath6kl_err("failed to %s enhanced bmiss detection: %d\n",
+                           enable ? "enable" : "disable", err);
+}
 
 static int ath6kl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                                    struct cfg80211_connect_params *sme)
@@ -616,13 +640,13 @@ static int ath6kl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                                         vif->req_bssid, vif->ch_hint,
                                         ar->connect_ctrl_flags, nw_subtype);
 
-        /* disable background scan if period is 0 */
-        if (sme->bg_scan_period == 0)
+        if (sme->bg_scan_period == 0) {
+                /* disable background scan if period is 0 */
                 sme->bg_scan_period = 0xffff;
-
-        /* configure default value if not specified */
-        if (sme->bg_scan_period == -1)
+        } else if (sme->bg_scan_period == -1) {
+                /* configure default value if not specified */
                 sme->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
+        }
 
         ath6kl_wmi_scanparams_cmd(ar->wmi, vif->fw_vif_idx, 0, 0,
                                   sme->bg_scan_period, 0, 0, 0, 3, 0, 0, 0);
@@ -767,7 +791,7 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "ad-hoc %s selected\n",
                            nw_type & ADHOC_CREATOR ? "creator" : "joiner");
                 cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(ar->wiphy, bss);
                 return;
         }
 
@@ -778,7 +802,7 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
                                         assoc_req_ie, assoc_req_len,
                                         assoc_resp_ie, assoc_resp_len,
                                         WLAN_STATUS_SUCCESS, GFP_KERNEL);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(ar->wiphy, bss);
         } else if (vif->sme_state == SME_CONNECTED) {
                 /* inform roam event to cfg80211 */
                 cfg80211_roamed_bss(vif->ndev, bss, assoc_req_ie, assoc_req_len,
@@ -1454,10 +1478,10 @@ static int ath6kl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
                 return -EIO;
 
         if (pmgmt) {
-                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: max perf\n", __func__);
+                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: rec power\n", __func__);
                 mode.pwr_mode = REC_POWER;
         } else {
-                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: rec power\n", __func__);
+                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: max perf\n", __func__);
                 mode.pwr_mode = MAX_PERF_POWER;
         }
 
@@ -1509,7 +1533,7 @@ static int ath6kl_cfg80211_del_iface(struct wiphy *wiphy,
         list_del(&vif->list);
         spin_unlock_bh(&ar->list_lock);
 
-        ath6kl_cleanup_vif(vif, test_bit(WMI_READY, &ar->flag));
+        ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
 
         ath6kl_cfg80211_vif_cleanup(vif);
 
@@ -1559,17 +1583,13 @@ static int ath6kl_cfg80211_change_iface(struct wiphy *wiphy,
 set_iface_type:
         switch (type) {
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
                 vif->next_mode = INFRA_NETWORK;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 vif->next_mode = ADHOC_NETWORK;
                 break;
         case NL80211_IFTYPE_AP:
-                vif->next_mode = AP_NETWORK;
-                break;
-        case NL80211_IFTYPE_P2P_CLIENT:
-                vif->next_mode = INFRA_NETWORK;
-                break;
         case NL80211_IFTYPE_P2P_GO:
                 vif->next_mode = AP_NETWORK;
                 break;
@@ -2673,30 +2693,6 @@ static int ath6kl_set_ies(struct ath6kl_vif *vif,
         return 0;
 }
 
-void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif, bool enable)
-{
-        int err;
-
-        if (WARN_ON(!test_bit(WMI_READY, &vif->ar->flag)))
-                return;
-
-        if (vif->nw_type != INFRA_NETWORK)
-                return;
-
-        if (!test_bit(ATH6KL_FW_CAPABILITY_BMISS_ENHANCE,
-                      vif->ar->fw_capabilities))
-                return;
-
-        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s fw bmiss enhance\n",
-                   enable ? "enable" : "disable");
-
-        err = ath6kl_wmi_sta_bmiss_enhance_cmd(vif->ar->wmi,
-                                               vif->fw_vif_idx, enable);
-        if (err)
-                ath6kl_err("failed to %s enhanced bmiss detection: %d\n",
-                           enable ? "enable" : "disable", err);
-}
-
 static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
                                 u8 *rsn_capab)
 {
@@ -2776,9 +2772,11 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         ar->ap_mode_bkey.valid = false;
 
-        /* TODO:
-         * info->interval
-         */
+        ret = ath6kl_wmi_ap_set_beacon_intvl_cmd(ar->wmi, vif->fw_vif_idx,
+                                                 info->beacon_interval);
+
+        if (ret)
+                ath6kl_warn("Failed to set beacon interval: %d\n", ret);
 
         ret = ath6kl_wmi_ap_set_dtim_cmd(ar->wmi, vif->fw_vif_idx,
                                          info->dtim_period);
@@ -3557,6 +3555,37 @@ static int ath6kl_cfg80211_vif_init(struct ath6kl_vif *vif)
         return 0;
 }
 
+void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready)
+{
+        static u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+        bool discon_issued;
+
+        netif_stop_queue(vif->ndev);
+
+        clear_bit(WLAN_ENABLED, &vif->flags);
+
+        if (wmi_ready) {
+                discon_issued = test_bit(CONNECTED, &vif->flags) ||
+                                test_bit(CONNECT_PEND, &vif->flags);
+                ath6kl_disconnect(vif);
+                del_timer(&vif->disconnect_timer);
+
+                if (discon_issued)
+                        ath6kl_disconnect_event(vif, DISCONNECT_CMD,
+                                                (vif->nw_type & AP_NETWORK) ?
+                                                bcast_mac : vif->bssid,
+                                                0, NULL, 0);
+        }
+
+        if (vif->scan_req) {
+                cfg80211_scan_done(vif->scan_req, true);
+                vif->scan_req = NULL;
+        }
+
+        /* need to clean up enhanced bmiss detection fw state */
+        ath6kl_cfg80211_sta_bmiss_enhance(vif, false);
+}
+
 void ath6kl_cfg80211_vif_cleanup(struct ath6kl_vif *vif)
 {
         struct ath6kl *ar = vif->ar;
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.h b/drivers/net/wireless/ath/ath6kl/cfg80211.h
index e5e70f3a8ca8..b59becd91aea 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.h
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.h
@@ -61,7 +61,5 @@ void ath6kl_cfg80211_cleanup(struct ath6kl *ar);
 
 struct ath6kl *ath6kl_cfg80211_create(void);
 void ath6kl_cfg80211_destroy(struct ath6kl *ar);
-/* TODO: remove this once ath6kl_vif_cleanup() is moved to cfg80211.c */
-void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif, bool enable);
 
 #endif /* ATH6KL_CFG80211_H */
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 189d8faf8c87..61b2f98b4e77 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -940,7 +940,7 @@ void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
                          bool wait_fot_compltn, bool cold_reset);
 void ath6kl_init_control_info(struct ath6kl_vif *vif);
 struct ath6kl_vif *ath6kl_vif_first(struct ath6kl *ar);
-void ath6kl_cleanup_vif(struct ath6kl_vif *vif, bool wmi_ready);
+void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready);
 int ath6kl_init_hw_start(struct ath6kl *ar);
 int ath6kl_init_hw_stop(struct ath6kl *ar);
 int ath6kl_init_fetch_firmwares(struct ath6kl *ar);
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index ba6bd497b787..281390178e3d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -509,9 +509,7 @@ static void destroy_htc_txctrl_packet(struct htc_packet *packet)
 {
         struct sk_buff *skb;
         skb = packet->skb;
-        if (skb != NULL)
-                dev_kfree_skb(skb);
-
+        dev_kfree_skb(skb);
         kfree(packet);
 }
 
@@ -969,6 +967,22 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
         u16 payload_len;
         int status = 0;
 
+        /*
+         * ar->htc_target can be NULL due to a race condition that can occur
+         * during driver initialization(we do 'ath6kl_hif_power_on' before
+         * initializing 'ar->htc_target' via 'ath6kl_htc_create').
+         * 'ath6kl_hif_power_on' assigns 'ath6kl_recv_complete' as
+         * usb_complete_t/callback function for 'usb_fill_bulk_urb'.
+         * Thus the possibility of ar->htc_target being NULL
+         * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+         */
+        if (WARN_ON_ONCE(!target)) {
+                ath6kl_err("Target not yet initialized\n");
+                status = -EINVAL;
+                goto free_skb;
+        }
+
+
         netdata = skb->data;
         netlen = skb->len;
 
@@ -1054,6 +1068,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
 
                 dev_kfree_skb(skb);
                 skb = NULL;
+
                 goto free_skb;
         }
 
@@ -1089,8 +1104,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
         skb = NULL;
 
 free_skb:
-        if (skb != NULL)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 
         return status;
 
@@ -1184,7 +1198,7 @@ static void reset_endpoint_states(struct htc_target *target)
                 INIT_LIST_HEAD(&ep->pipe.tx_lookup_queue);
                 INIT_LIST_HEAD(&ep->rx_bufq);
                 ep->target = target;
-                ep->pipe.tx_credit_flow_enabled = (bool) 1; /* FIXME */
+                ep->pipe.tx_credit_flow_enabled = true;
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index f21fa322e5ca..5d434cf88f35 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -1715,38 +1715,6 @@ void ath6kl_init_hw_restart(struct ath6kl *ar)
         }
 }
 
-/* FIXME: move this to cfg80211.c and rename to ath6kl_cfg80211_vif_stop() */
-void ath6kl_cleanup_vif(struct ath6kl_vif *vif, bool wmi_ready)
-{
-        static u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        bool discon_issued;
-
-        netif_stop_queue(vif->ndev);
-
-        clear_bit(WLAN_ENABLED, &vif->flags);
-
-        if (wmi_ready) {
-                discon_issued = test_bit(CONNECTED, &vif->flags) ||
-                                test_bit(CONNECT_PEND, &vif->flags);
-                ath6kl_disconnect(vif);
-                del_timer(&vif->disconnect_timer);
-
-                if (discon_issued)
-                        ath6kl_disconnect_event(vif, DISCONNECT_CMD,
-                                                (vif->nw_type & AP_NETWORK) ?
-                                                bcast_mac : vif->bssid,
-                                                0, NULL, 0);
-        }
-
-        if (vif->scan_req) {
-                cfg80211_scan_done(vif->scan_req, true);
-                vif->scan_req = NULL;
-        }
-
-        /* need to clean up enhanced bmiss detection fw state */
-        ath6kl_cfg80211_sta_bmiss_enhance(vif, false);
-}
-
 void ath6kl_stop_txrx(struct ath6kl *ar)
 {
         struct ath6kl_vif *vif, *tmp_vif;
@@ -1766,7 +1734,7 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
         list_for_each_entry_safe(vif, tmp_vif, &ar->vif_list, list) {
                 list_del(&vif->list);
                 spin_unlock_bh(&ar->list_lock);
-                ath6kl_cleanup_vif(vif, test_bit(WMI_READY, &ar->flag));
+                ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
                 rtnl_lock();
                 ath6kl_cfg80211_vif_cleanup(vif);
                 rtnl_unlock();
@@ -1801,8 +1769,6 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
                    "attempting to reset target on instance destroy\n");
         ath6kl_reset_device(ar, ar->target_type, true, true);
 
-        clear_bit(WLAN_ENABLED, &ar->flag);
-
         up(&ar->sem);
 }
 EXPORT_SYMBOL(ath6kl_stop_txrx);
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 62bcc0d5bc23..5fcd342762de 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -159,10 +159,8 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,
 
 static void ath6kl_usb_cleanup_recv_urb(struct ath6kl_urb_context *urb_context)
 {
-        if (urb_context->skb != NULL) {
-                dev_kfree_skb(urb_context->skb);
-                urb_context->skb = NULL;
-        }
+        dev_kfree_skb(urb_context->skb);
+        urb_context->skb = NULL;
 
         ath6kl_usb_free_urb_to_pipe(urb_context->pipe, urb_context);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 998f8b0f62fd..d76b5bd81a0d 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -751,6 +751,23 @@ int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid)
                                    NO_SYNC_WMIFLAG);
 }
 
+int ath6kl_wmi_ap_set_beacon_intvl_cmd(struct wmi *wmi, u8 if_idx,
+                                       u32 beacon_intvl)
+{
+        struct sk_buff *skb;
+        struct set_beacon_int_cmd *cmd;
+
+        skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct set_beacon_int_cmd *) skb->data;
+
+        cmd->beacon_intvl = cpu_to_le32(beacon_intvl);
+        return ath6kl_wmi_cmd_send(wmi, if_idx, skb,
+                                   WMI_SET_BEACON_INT_CMDID, NO_SYNC_WMIFLAG);
+}
+
 int ath6kl_wmi_ap_set_dtim_cmd(struct wmi *wmi, u8 if_idx, u32 dtim_period)
 {
         struct sk_buff *skb;
@@ -1108,7 +1125,7 @@ static int ath6kl_wmi_bssinfo_event_rx(struct wmi *wmi, u8 *datap, int len,
         kfree(mgmt);
         if (bss == NULL)
                 return -ENOMEM;
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(ar->wiphy, bss);
 
         /*
          * Firmware doesn't return any event when scheduled scan has
@@ -2480,16 +2497,11 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
 
 free_cmd_skb:
         /* free up any resources left over (possibly due to an error) */
-        if (skb)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 
 free_data_skb:
-        for (index = 0; index < num_pri_streams; index++) {
-                if (data_sync_bufs[index].skb != NULL) {
-                        dev_kfree_skb((struct sk_buff *)data_sync_bufs[index].
-                                      skb);
-                }
-        }
+        for (index = 0; index < num_pri_streams; index++)
+                dev_kfree_skb((struct sk_buff *)data_sync_bufs[index].skb);
 
         return ret;
 }
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 98b1755e67f4..b5f226503baf 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -1660,6 +1660,10 @@ struct roam_ctrl_cmd {
         u8 roam_ctrl;
 } __packed;
 
+struct set_beacon_int_cmd {
+        __le32 beacon_intvl;
+} __packed;
+
 struct set_dtim_cmd {
         __le32 dtim_period;
 } __packed;
@@ -2649,6 +2653,8 @@ int ath6kl_wmi_del_wow_pattern_cmd(struct wmi *wmi, u8 if_idx,
 int ath6kl_wmi_set_rssi_filter_cmd(struct wmi *wmi, u8 if_idx, s8 rssi);
 int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi);
 int ath6kl_wmi_ap_set_dtim_cmd(struct wmi *wmi, u8 if_idx, u32 dtim_period);
+int ath6kl_wmi_ap_set_beacon_intvl_cmd(struct wmi *wmi, u8 if_idx,
+                                       u32 beacon_interval);
 int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid);
 int ath6kl_wmi_set_roam_mode_cmd(struct wmi *wmi, enum wmi_roam_mode mode);
 int ath6kl_wmi_mcast_filter_cmd(struct wmi *wmi, u8 if_idx, bool mc_all_on);
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 714558d1ba78..54150b6a39ae 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1204,7 +1204,7 @@ static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta)
                         caps |= WLAN_RC_TS_FLAG | WLAN_RC_DS_FLAG;
                 else if (sta->ht_cap.mcs.rx_mask[1])
                         caps |= WLAN_RC_DS_FLAG;
-                if (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
                         caps |= WLAN_RC_40_FLAG;
                         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
                                 caps |= WLAN_RC_SGI_FLAG;
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 002851fceb2f..9ecc1968262c 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -341,7 +341,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         }
 
  out:
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
         return rc;
 }
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 0b70e17cd1fb..79d608caa903 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -338,7 +338,7 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
                 if (bss) {
                         wil_dbg_wmi(wil, "Added BSS %pM\n",
                                     rx_mgmt_frame->bssid);
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(wiphy, bss);
                 } else {
                         wil_err(wil, "cfg80211_inform_bss() failed\n");
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 481f41ad7989..cecc3eff72e9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -2323,7 +2323,7 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
         if (!bss)
                 return -ENOMEM;
 
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
         return err;
 }
@@ -2429,7 +2429,7 @@ static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
                 goto CleanUp;
         }
 
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
 CleanUp:
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index cdb62b8ccc79..10ee314c4229 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -183,8 +183,7 @@ static bool brcms_c_country_valid(const char *ccode)
          * chars.
          */
         if (!((0x80 & ccode[0]) == 0 && ccode[0] >= 0x41 && ccode[0] <= 0x5A &&
-              (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A &&
-              ccode[2] == '\0'))
+              (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A))
                 return false;
 
         /*
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index b1dd5600fd02..c6451c61407a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
 #include "debug.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
+#define BRCMS_FLUSH_TIMEOUT     500 /* msec */
 
 /* Flags we support */
 #define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -712,16 +713,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
         wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 }
 
+static bool brcms_tx_flush_completed(struct brcms_info *wl)
+{
+        bool result;
+
+        spin_lock_bh(&wl->lock);
+        result = brcms_c_tx_flush_completed(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+        return result;
+}
+
 static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct brcms_info *wl = hw->priv;
+        int ret;
 
         no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
 
-        /* wait for packet queue and dma fifos to run empty */
-        spin_lock_bh(&wl->lock);
-        brcms_c_wait_for_tx_completion(wl->wlc, drop);
-        spin_unlock_bh(&wl->lock);
+        ret = wait_event_timeout(wl->tx_flush_wq,
+                                 brcms_tx_flush_completed(wl),
+                                 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
+
+        brcms_dbg_mac80211(wl->wlc->hw->d11core,
+                           "ret=%d\n", jiffies_to_msecs(ret));
 }
 
 static const struct ieee80211_ops brcms_ops = {
@@ -776,6 +790,7 @@ void brcms_dpc(unsigned long data)
 
  done:
         spin_unlock_bh(&wl->lock);
+        wake_up(&wl->tx_flush_wq);
 }
 
 /*
@@ -1024,6 +1039,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
 
         atomic_set(&wl->callbacks, 0);
 
+        init_waitqueue_head(&wl->tx_flush_wq);
+
         /* setup the bottom half handler */
         tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
 
@@ -1613,13 +1630,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
         spin_lock_bh(&wl->lock);
         return blocked;
 }
-
-/*
- * precondition: perimeter lock has been acquired
- */
-void brcms_msleep(struct brcms_info *wl, uint ms)
-{
-        spin_unlock_bh(&wl->lock);
-        msleep(ms);
-        spin_lock_bh(&wl->lock);
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
         spinlock_t lock;        /* per-device perimeter lock */
         spinlock_t isr_lock;    /* per-device ISR synchronization lock */
 
+        /* tx flush */
+        wait_queue_head_t tx_flush_wq;
 
         /* timer related fields */
         atomic_t callbacks;     /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
 extern void brcms_free_timer(struct brcms_timer *timer);
 extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
 extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_msleep(struct brcms_info *wl, uint ms);
 extern void brcms_dpc(unsigned long data);
 extern void brcms_timer(struct brcms_timer *t);
 extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 0985925cd3f4..8ef02dca8f8c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1025,7 +1025,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 static bool
 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 {
-        bool morepending = false;
         struct bcma_device *core;
         struct tx_status txstatus, *txs;
         u32 s1, s2;
@@ -1039,23 +1038,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
         txs = &txstatus;
         core = wlc_hw->d11core;
         *fatal = false;
-        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
-        while (!(*fatal)
-               && (s1 & TXS_V)) {
-                /* !give others some time to run! */
-                if (n >= max_tx_num) {
-                        morepending = true;
-                        break;
-                }
 
+        while (n < max_tx_num) {
+                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
                 if (s1 == 0xffffffff) {
                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                   __func__);
                         *fatal = true;
                         return false;
                 }
-                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
+                /* only process when valid */
+                if (!(s1 & TXS_V))
+                        break;
 
+                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
                 txs->status = s1 & TXS_STATUS_MASK;
                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
                 txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1063,15 +1059,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                 txs->lasttxtime = 0;
 
                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
-
-                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                if (*fatal == true)
+                        return false;
                 n++;
         }
 
-        if (*fatal)
-                return false;
-
-        return morepending;
+        return n >= max_tx_num;
 }
 
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
@@ -3145,8 +3138,7 @@ void brcms_c_reset(struct brcms_c_info *wlc)
         brcms_c_statsupd(wlc);
 
         /* reset our snapshot of macstat counters */
-        memset((char *)wlc->core->macstat_snapshot, 0,
-                sizeof(struct macstat));
+        memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
 
         brcms_b_reset(wlc->hw);
 }
@@ -4059,7 +4051,7 @@ void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
                 return;
         }
 
-        memset((char *)&acp_shm, 0, sizeof(struct shm_acparams));
+        memset(&acp_shm, 0, sizeof(struct shm_acparams));
         /* fill in shm ac params struct */
         acp_shm.txop = params->txop;
         /* convert from units of 32us to us for ucode */
@@ -4775,7 +4767,7 @@ static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
         struct brcms_bss_info *bi = wlc->default_bss;
 
         /* init default and target BSS with some sane initial values */
-        memset((char *)(bi), 0, sizeof(struct brcms_bss_info));
+        memset(bi, 0, sizeof(*bi));
         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
 
         /* fill the default channel as the first valid channel
@@ -5304,7 +5296,7 @@ int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
 
         /* Clear rateset override */
-        memset(&rs, 0, sizeof(struct brcms_c_rateset));
+        memset(&rs, 0, sizeof(rs));
 
         switch (gmode) {
         case GMODE_LEGACY_B:
@@ -5527,7 +5519,7 @@ int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
         if (rs->count > BRCMS_NUMRATES)
                 return -ENOBUFS;
 
-        memset(&internal_rs, 0, sizeof(struct brcms_c_rateset));
+        memset(&internal_rs, 0, sizeof(internal_rs));
 
         /* Copy only legacy rateset section */
         internal_rs.count = rs->count;
@@ -5630,7 +5622,7 @@ int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
         for (i = 0; i < BRCMS_MAXMODULES; i++) {
                 if (!strcmp(wlc->modulecb[i].name, name) &&
                     (wlc->modulecb[i].hdl == hdl)) {
-                        memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
+                        memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
                         return 0;
                 }
         }
@@ -6450,10 +6442,9 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
 
                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
                             && (!is_mcs_rate(rspec[k]))) {
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s: IEEE80211_TX_"
-                                          "RC_MCS != is_mcs_rate(rspec)\n",
-                                          wlc->pub->unit, __func__);
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
+                                           wlc->pub->unit, __func__);
                         }
 
                         if (is_mcs_rate(rspec[k])) {
@@ -6686,11 +6677,9 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
                                         (struct ofdm_phy_hdr *) rts_plcp) :
                                 rts_plcp[0]) << 8;
         } else {
-                memset((char *)txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
-                memset((char *)&txh->rts_frame, 0,
-                        sizeof(struct ieee80211_rts));
-                memset((char *)txh->RTSPLCPFallback, 0,
-                      sizeof(txh->RTSPLCPFallback));
+                memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
+                memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
+                memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
                 txh->RTSDurFallback = 0;
         }
 
@@ -6845,21 +6834,19 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
                                         wlc->fragthresh[queue] =
                                             (u16) newfragthresh;
                         } else {
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s txop invalid "
-                                          "for rate %d\n",
-                                          wlc->pub->unit, fifo_names[queue],
-                                          rspec2rate(rspec[0]));
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s txop invalid for rate %d\n",
+                                           wlc->pub->unit, fifo_names[queue],
+                                           rspec2rate(rspec[0]));
                         }
 
                         if (dur > wlc->edcf_txop[ac])
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s: %s txop "
-                                          "exceeded phylen %d/%d dur %d/%d\n",
-                                          wlc->pub->unit, __func__,
-                                          fifo_names[queue],
-                                          phylen, wlc->fragthresh[queue],
-                                          dur, wlc->edcf_txop[ac]);
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
+                                           wlc->pub->unit, __func__,
+                                           fifo_names[queue],
+                                           phylen, wlc->fragthresh[queue],
+                                           dur, wlc->edcf_txop[ac]);
                 }
         }
 
@@ -7334,7 +7321,7 @@ brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
         *len = hdr_len + body_len;
 
         /* format PHY and MAC headers */
-        memset((char *)buf, 0, hdr_len);
+        memset(buf, 0, hdr_len);
 
         plcp = (struct cck_phy_hdr *) buf;
 
@@ -7520,25 +7507,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
         return wlc->band->bandunit;
 }
 
-void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
 {
-        int timeout = 20;
         int i;
 
         /* Kick DMA to send any pending AMPDU */
         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
                 if (wlc->hw->di[i])
-                        dma_txflush(wlc->hw->di[i]);
-
-        /* wait for queue and DMA fifos to run dry */
-        while (brcms_txpktpendtot(wlc) > 0) {
-                brcms_msleep(wlc->wl, 1);
-
-                if (--timeout == 0)
-                        break;
-        }
+                        dma_kick_tx(wlc->hw->di[i]);
 
-        WARN_ON_ONCE(timeout == 0);
+        return !brcms_txpktpendtot(wlc);
 }
 
 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
 extern void brcms_c_scan_start(struct brcms_c_info *wlc);
 extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
 extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
-                                           bool drop);
 extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
 extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
 extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 83856d1a6101..3630a41df50d 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -572,26 +572,11 @@ il3945_tx_skb(struct il_priv *il,
         il3945_hw_build_tx_cmd_rate(il, out_cmd, info, hdr, sta_id);
 
         /* Total # bytes to be transmitted */
-        len = (u16) skb->len;
-        tx_cmd->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16((u16) skb->len);
 
-        il_update_stats(il, true, fc, len);
         tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
         tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
 
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
-        D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
-        D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
-        il_print_hex_dump(il, IL_DL_TX, tx_cmd, sizeof(*tx_cmd));
-        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr,
-                          ieee80211_hdrlen(fc));
-
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -610,14 +595,8 @@ il3945_tx_skb(struct il_priv *il,
          * within command buffer array. */
         txcmd_phys =
             pci_map_single(il->pci_dev, &out_cmd->hdr, len, PCI_DMA_TODEVICE);
-        /* we do not map meta data ... so we can safely access address to
-         * provide to unmap command*/
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
-
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
+                goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -626,10 +605,34 @@ il3945_tx_skb(struct il_priv *il,
                 phys_addr =
                     pci_map_single(il->pci_dev, skb->data + hdr_len, len,
                                    PCI_DMA_TODEVICE);
+                if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
+                        goto drop_unlock;
+        }
+
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, len);
+        if (len)
                 il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, len, 0,
                                                U32_PAD(len));
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
         }
 
+        il_update_stats(il, true, fc, skb->len);
+
+        D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
+        D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
+        il_print_hex_dump(il, IL_DL_TX, tx_cmd, sizeof(*tx_cmd));
+        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr,
+                          ieee80211_hdrlen(fc));
+
         /* Tell device the write idx *just past* this latest filled TFD */
         q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
         il_txq_update_write_ptr(il, txq);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 835662a449da..7941eb3a0166 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -1793,8 +1793,7 @@ il4965_tx_skb(struct il_priv *il,
         memcpy(tx_cmd->hdr, hdr, hdr_len);
 
         /* Total # bytes to be transmitted */
-        len = (u16) skb->len;
-        tx_cmd->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16((u16) skb->len);
 
         if (info->control.hw_key)
                 il4965_tx_cmd_build_hwcrypto(il, info, tx_cmd, skb, sta_id);
@@ -1804,7 +1803,6 @@ il4965_tx_skb(struct il_priv *il,
 
         il4965_tx_cmd_build_rate(il, tx_cmd, info, sta, fc);
 
-        il_update_stats(il, true, fc, len);
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -1826,18 +1824,8 @@ il4965_tx_skb(struct il_priv *il,
         txcmd_phys =
             pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
                            PCI_DMA_BIDIRECTIONAL);
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, firstlen);
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
-
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
+                goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -1846,8 +1834,24 @@ il4965_tx_skb(struct il_priv *il,
                 phys_addr =
                     pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
                                    PCI_DMA_TODEVICE);
+                if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
+                        goto drop_unlock;
+        }
+
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, firstlen);
+        if (secondlen)
                 il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen,
                                                0, 0);
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
         }
 
         scratch_phys =
@@ -1860,6 +1864,8 @@ il4965_tx_skb(struct il_priv *il,
         tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
         tx_cmd->dram_msb_ptr = il_get_dma_hi_addr(scratch_phys);
 
+        il_update_stats(il, true, fc, skb->len);
+
         D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
         D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
         il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd, sizeof(*tx_cmd));
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index f3b8e91aa3dc..e8324b5e5bfe 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -1183,8 +1183,7 @@ il4965_rs_switch_to_mimo2(struct il_priv *il, struct il_lq_sta *lq_sta,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2) ==
-            WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 1f598604a79c..e006ea831320 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -1830,32 +1830,30 @@ il_set_ht_add_station(struct il_priv *il, u8 idx, struct ieee80211_sta *sta)
 {
         struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
         __le32 sta_flags;
-        u8 mimo_ps_mode;
 
         if (!sta || !sta_ht_inf->ht_supported)
                 goto done;
 
-        mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
         D_ASSOC("spatial multiplexing power save mode: %s\n",
-                (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ? "static" :
-                (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ? "dynamic" :
+                (sta->smps_mode == IEEE80211_SMPS_STATIC) ? "static" :
+                (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) ? "dynamic" :
                 "disabled");
 
         sta_flags = il->stations[idx].sta.station_flags;
 
         sta_flags &= ~(STA_FLG_RTS_MIMO_PROT_MSK | STA_FLG_MIMO_DIS_MSK);
 
-        switch (mimo_ps_mode) {
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        switch (sta->smps_mode) {
+        case IEEE80211_SMPS_STATIC:
                 sta_flags |= STA_FLG_MIMO_DIS_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+        case IEEE80211_SMPS_DYNAMIC:
                 sta_flags |= STA_FLG_RTS_MIMO_PROT_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
+        case IEEE80211_SMPS_OFF:
                 break;
         default:
-                IL_WARN("Invalid MIMO PS mode %d\n", mimo_ps_mode);
+                IL_WARN("Invalid MIMO PS mode %d\n", sta->smps_mode);
                 break;
         }
 
@@ -3162,18 +3160,23 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
                      idx, il->cmd_queue);
         }
 #endif
-        txq->need_update = 1;
-
-        if (il->ops->txq_update_byte_cnt_tbl)
-                /* Set up entry in queue's byte count circular buffer */
-                il->ops->txq_update_byte_cnt_tbl(il, txq, 0);
 
         phys_addr =
             pci_map_single(il->pci_dev, &out_cmd->hdr, fix_size,
                            PCI_DMA_BIDIRECTIONAL);
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr))) {
+                idx = -ENOMEM;
+                goto out;
+        }
         dma_unmap_addr_set(out_meta, mapping, phys_addr);
         dma_unmap_len_set(out_meta, len, fix_size);
 
+        txq->need_update = 1;
+
+        if (il->ops->txq_update_byte_cnt_tbl)
+                /* Set up entry in queue's byte count circular buffer */
+                il->ops->txq_update_byte_cnt_tbl(il, txq, 0);
+
         il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, fix_size, 1,
                                             U32_PAD(cmd->len));
 
@@ -3181,6 +3184,7 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
         q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
         il_txq_update_write_ptr(il, txq);
 
+out:
         spin_unlock_irqrestore(&il->hcmd_lock, flags);
         return idx;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index f41ae79e6bc0..41ec27cb6efe 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -338,7 +338,7 @@ int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 
 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap);
+                            struct ieee80211_sta *sta);
 
 static inline int iwl_sta_id(struct ieee80211_sta *sta)
 {
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index ebbfcf47c732..323e4a33fcac 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -151,8 +151,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                     IEEE80211_HW_QUEUE_CONTROL |
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                    IEEE80211_HW_WANT_MONITOR_VIF |
-                    IEEE80211_HW_SCAN_WHILE_IDLE;
+                    IEEE80211_HW_WANT_MONITOR_VIF;
 
         hw->offchannel_tx_hw_queue = IWL_AUX_QUEUE;
         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index a131227c49e9..abe304267261 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1289,8 +1289,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1305,7 +1304,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1345,8 +1344,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1361,7 +1359,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1410,7 +1408,7 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 2d33760a9dc2..94ef33838bc6 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -173,7 +173,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
 
 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap)
+                            struct ieee80211_sta *sta)
 {
         if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
                 return false;
@@ -183,20 +183,11 @@ bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                 return false;
 #endif
 
-        /*
-         * Remainder of this function checks ht_cap, but if it's
-         * NULL then we can do HT40 (special case for RXON)
-         */
-        if (!ht_cap)
+        /* special case for RXON */
+        if (!sta)
                 return true;
 
-        if (!ht_cap->ht_supported)
-                return false;
-
-        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
-                return false;
-
-        return true;
+        return sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 }
 
 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
@@ -205,7 +196,6 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
                                   __le32 *flags, __le32 *mask)
 {
         struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
-        u8 mimo_ps_mode;
 
         *mask = STA_FLG_RTS_MIMO_PROT_MSK |
                 STA_FLG_MIMO_DIS_MSK |
@@ -217,26 +207,24 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
         if (!sta || !sta_ht_inf->ht_supported)
                 return;
 
-        mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
-
         IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
                         sta->addr,
-                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ?
+                        (sta->smps_mode == IEEE80211_SMPS_STATIC) ?
                         "static" :
-                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ?
+                        (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) ?
                         "dynamic" : "disabled");
 
-        switch (mimo_ps_mode) {
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        switch (sta->smps_mode) {
+        case IEEE80211_SMPS_STATIC:
                 *flags |= STA_FLG_MIMO_DIS_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+        case IEEE80211_SMPS_DYNAMIC:
                 *flags |= STA_FLG_RTS_MIMO_PROT_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
+        case IEEE80211_SMPS_OFF:
                 break;
         default:
-                IWL_WARN(priv, "Invalid MIMO PS mode %d\n", mimo_ps_mode);
+                IWL_WARN(priv, "Invalid MIMO PS mode %d\n", sta->smps_mode);
                 break;
         }
 
@@ -246,7 +234,7 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
         *flags |= cpu_to_le32(
                 (u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 *flags |= STA_FLG_HT40_EN_MSK;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 4ece5ea81b86..d1dccb361391 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1145,6 +1145,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         next_reclaimed = ssn;
                 }
 
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                                  next_reclaimed);
+                }
+
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1195,16 +1202,6 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
-                        /*
-                         * W/A for FW bug - the seq_ctl isn't updated when the
-                         * queues are flushed. Fetch it from the packet itself
-                         */
-                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
-                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
-                                next_reclaimed =
-                                        SEQ_TO_SN(next_reclaimed + 0x10);
-                        }
-
                         is_offchannel_skb =
                                 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 5bdcbcfee0c5..e27eb9724112 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -113,7 +113,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                     IEEE80211_HW_QUEUE_CONTROL |
                     IEEE80211_HW_WANT_MONITOR_VIF |
-                    IEEE80211_HW_SCAN_WHILE_IDLE |
+                    IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 60a4291ca221..56b636d9ab30 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -1209,23 +1209,9 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         return new_rate;
 }
 
-static bool iwl_is_ht40_tx_allowed(struct iwl_mvm *mvm,
-                            struct ieee80211_sta_ht_cap *ht_cap)
+static bool iwl_is_ht40_tx_allowed(struct ieee80211_sta *sta)
 {
-        /*
-         * Remainder of this function checks ht_cap, but if it's
-         * NULL then we can do HT40 (special case for RXON)
-         */
-        if (!ht_cap)
-                return true;
-
-        if (!ht_cap->ht_supported)
-                return false;
-
-        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
-                return false;
-
-        return true;
+        return sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 }
 
 /*
@@ -1243,8 +1229,7 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
         if (!sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1258,7 +1243,7 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1296,8 +1281,7 @@ static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
         if (!sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1311,7 +1295,7 @@ static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1356,7 +1340,7 @@ static int rs_switch_to_siso(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 230f8ebbe289..61735db3b051 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -657,7 +657,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                                         capa, intvl, ie, ielen,
                                         LBS_SCAN_RSSI_TO_MBM(rssi),
                                         GFP_KERNEL);
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(wiphy, bss);
                         }
                 } else
                         lbs_deb_scan("scan response: missing BSS channel IE\n");
@@ -1444,7 +1444,7 @@ static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
 
  done:
         if (bss)
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
 }
@@ -1766,7 +1766,7 @@ static void lbs_join_post(struct lbs_private *priv,
                                   params->beacon_interval,
                                   fake_ie, fake - fake_ie,
                                   0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev->wiphy, bss);
 
         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
         priv->wdev->ssid_len = params->ssid_len;
@@ -2011,7 +2011,7 @@ static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
         if (bss) {
                 ret = lbs_ibss_join_existing(priv, params, bss);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         } else
                 ret = lbs_ibss_start_new(priv, params);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index b73e497fe770..cffdf4fbf161 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2247,6 +2247,7 @@ static int __init init_mac80211_hwsim(void)
                 /* ask mac80211 to reserve space for magic */
                 hw->vif_data_size = sizeof(struct hwsim_vif_priv);
                 hw->sta_data_size = sizeof(struct hwsim_sta_priv);
+                hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
 
                 memcpy(data->channels_2ghz, hwsim_channels_2ghz,
                         sizeof(hwsim_channels_2ghz));
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 3a004b85b99f..81c84a29308f 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1430,7 +1430,7 @@ static int mwifiex_cfg80211_inform_ibss_bss(struct mwifiex_private *priv)
         bss = cfg80211_inform_bss(priv->wdev->wiphy, chan,
                                   bss_info.bssid, 0, WLAN_CAPABILITY_IBSS,
                                   0, ie_buf, ie_len, 0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev->wiphy, bss);
         memcpy(priv->cfg_bssid, bss_info.bssid, ETH_ALEN);
 
         return 0;
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 3b9be7c185cb..492655c048d1 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -62,6 +62,10 @@ static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
 {
         u32 *cookie_addr;
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        if (!reg->sleep_cookie)
+                return true;
 
         if (card->sleep_cookie_vbase) {
                 cookie_addr = (u32 *)card->sleep_cookie_vbase;
@@ -299,8 +303,10 @@ static int mwifiex_read_reg(struct mwifiex_adapter *adapter, int reg, u32 *data)
 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
         int i = 0;
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        while (mwifiex_pcie_ok_to_access_hw(adapter)) {
+        while (reg->sleep_cookie && mwifiex_pcie_ok_to_access_hw(adapter)) {
                 i++;
                 usleep_range(10, 20);
                 /* 50ms max wait */
@@ -1513,8 +1519,8 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
-                        while (mwifiex_pcie_ok_to_access_hw(adapter) &&
-                                                        (count++ < 10))
+                        while (reg->sleep_cookie && (count++ < 10) &&
+                               mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
                 } else {
                         dev_err(adapter->dev,
@@ -2172,6 +2178,7 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         int ret;
         struct pci_dev *pdev = card->dev;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         pci_set_drvdata(pdev, card);
 
@@ -2234,10 +2241,13 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         ret = mwifiex_pcie_alloc_cmdrsp_buf(adapter);
         if (ret)
                 goto err_alloc_cmdbuf;
-        ret = mwifiex_pcie_alloc_sleep_cookie_buf(adapter);
-        if (ret)
-                goto err_alloc_cookie;
-
+        if (reg->sleep_cookie) {
+                ret = mwifiex_pcie_alloc_sleep_cookie_buf(adapter);
+                if (ret)
+                        goto err_alloc_cookie;
+        } else {
+                card->sleep_cookie_vbase = NULL;
+        }
         return ret;
 
 err_alloc_cookie:
@@ -2334,12 +2344,16 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg;
 
         if (card) {
                 dev_dbg(adapter->dev, "%s(): calling free_irq()\n", __func__);
                 free_irq(card->dev->irq, card->dev);
 
-                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+                reg = card->pcie.reg;
+                if (reg->sleep_cookie)
+                        mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+
                 mwifiex_pcie_delete_cmdrsp_buf(adapter);
                 mwifiex_pcie_delete_evtbd_ring(adapter);
                 mwifiex_pcie_delete_rxbd_ring(adapter);
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 608061578b37..d322ab8604ea 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -126,6 +126,7 @@ struct mwifiex_pcie_card_reg {
         u8 ring_flag_xs_eop;
         u32 ring_tx_start_ptr;
         u8 pfu_enabled;
+        u8 sleep_cookie;
 };
 
 static const struct mwifiex_pcie_card_reg mwifiex_reg_8766 = {
@@ -156,6 +157,7 @@ static const struct mwifiex_pcie_card_reg mwifiex_reg_8766 = {
         .ring_flag_xs_eop = 0,
         .ring_tx_start_ptr = 0,
         .pfu_enabled = 0,
+        .sleep_cookie = 1,
 };
 
 static const struct mwifiex_pcie_card_reg mwifiex_reg_8897 = {
@@ -186,6 +188,7 @@ static const struct mwifiex_pcie_card_reg mwifiex_reg_8897 = {
         .ring_flag_xs_eop = MWIFIEX_BD_FLAG_XS_EOP,
         .ring_tx_start_ptr = MWIFIEX_BD_FLAG_TX_START_PTR,
         .pfu_enabled = 1,
+        .sleep_cookie = 0,
 };
 
 struct mwifiex_pcie_device {
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..949234fcf8c6 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
                         scan_rsp->number_of_sets);
                 ret = -1;
-                goto done;
+                goto check_next_scan;
         }
 
         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 if (!beacon_size || beacon_size > bytes_left) {
                         bss_info += bytes_left;
                         bytes_left = 0;
-                        return -1;
+                        ret = -1;
+                        goto check_next_scan;
                 }
 
                 /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                 dev_err(priv->adapter->dev,
                                         "%s: bytes left < IE length\n",
                                         __func__);
-                                goto done;
+                                goto check_next_scan;
                         }
                         if (element_id == WLAN_EID_DS_PARAMS) {
                                 channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1746,13 +1747,14 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                             .mac_address, ETH_ALEN))
                                         mwifiex_update_curr_bss_params(priv,
                                                                        bss);
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(priv->wdev->wiphy, bss);
                         }
                 } else {
                         dev_dbg(adapter->dev, "missing BSS channel IE\n");
                 }
         }
 
+check_next_scan:
         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         if (list_empty(&adapter->scan_pending_q)) {
                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index f542bb8ccbc8..0d018460daf9 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -162,13 +162,9 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
 
         rcu_read_lock();
         ies = rcu_dereference(bss->ies);
-        if (WARN_ON(!ies)) {
-                /* should never happen */
-                rcu_read_unlock();
-                return -EINVAL;
-        }
         beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
         beacon_ie_len = ies->len;
+        bss_desc->timestamp = ies->tsf;
         rcu_read_unlock();
 
         if (!beacon_ie) {
@@ -184,7 +180,6 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         bss_desc->cap_info_bitmap = bss->capability;
         bss_desc->bss_band = bss_priv->band;
         bss_desc->fw_tsf = bss_priv->fw_tsf;
-        bss_desc->timestamp = bss->tsf;
         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_PRIVACY) {
                 dev_dbg(priv->adapter->dev, "info: InterpretIE: AP WEP enabled\n");
                 bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_8021X_WEP;
@@ -324,7 +319,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 }
 
                 if (bss)
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(priv->adapter->wiphy, bss);
         } else {
                 /* Adhoc mode */
                 /* If the requested SSID matches current SSID, return */
@@ -354,7 +349,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                                                         " list. Joining...\n");
                         ret = mwifiex_adhoc_join(priv, bss_desc);
                         if (bss)
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(priv->adapter->wiphy, bss);
                 } else {
                         dev_dbg(adapter->dev, "info: Network not found in "
                                 "the list, creating adhoc with ssid = %s\n",
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 8186af4ed47b..091d9a64080a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -334,20 +334,20 @@ struct mwl8k_sta {
 #define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
 
 static const struct ieee80211_channel mwl8k_channels_24[] = {
-        { .center_freq = 2412, .hw_value = 1, },
-        { .center_freq = 2417, .hw_value = 2, },
-        { .center_freq = 2422, .hw_value = 3, },
-        { .center_freq = 2427, .hw_value = 4, },
-        { .center_freq = 2432, .hw_value = 5, },
-        { .center_freq = 2437, .hw_value = 6, },
-        { .center_freq = 2442, .hw_value = 7, },
-        { .center_freq = 2447, .hw_value = 8, },
-        { .center_freq = 2452, .hw_value = 9, },
-        { .center_freq = 2457, .hw_value = 10, },
-        { .center_freq = 2462, .hw_value = 11, },
-        { .center_freq = 2467, .hw_value = 12, },
-        { .center_freq = 2472, .hw_value = 13, },
-        { .center_freq = 2484, .hw_value = 14, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2412, .hw_value = 1, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2417, .hw_value = 2, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2422, .hw_value = 3, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2427, .hw_value = 4, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2432, .hw_value = 5, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2437, .hw_value = 6, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2442, .hw_value = 7, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2447, .hw_value = 8, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2452, .hw_value = 9, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2457, .hw_value = 10, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2462, .hw_value = 11, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2467, .hw_value = 12, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2472, .hw_value = 13, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2484, .hw_value = 14, },
 };
 
 static const struct ieee80211_rate mwl8k_rates_24[] = {
@@ -368,10 +368,10 @@ static const struct ieee80211_rate mwl8k_rates_24[] = {
 };
 
 static const struct ieee80211_channel mwl8k_channels_50[] = {
-        { .center_freq = 5180, .hw_value = 36, },
-        { .center_freq = 5200, .hw_value = 40, },
-        { .center_freq = 5220, .hw_value = 44, },
-        { .center_freq = 5240, .hw_value = 48, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5180, .hw_value = 36, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
 };
 
 static const struct ieee80211_rate mwl8k_rates_50[] = {
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index 96e39edfec77..e8c5714bfd11 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -125,7 +125,7 @@ static void orinoco_add_hostscan_result(struct orinoco_private *priv,
         cbss = cfg80211_inform_bss(wiphy, channel, bss->a.bssid, timestamp,
                                    capability, beacon_interval, ie_buf, ie_len,
                                    signal, GFP_KERNEL);
-        cfg80211_put_bss(cbss);
+        cfg80211_put_bss(wiphy, cbss);
 }
 
 void orinoco_add_extscan_result(struct orinoco_private *priv,
@@ -158,7 +158,7 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
         cbss = cfg80211_inform_bss(wiphy, channel, bss->bssid, timestamp,
                                    capability, beacon_interval, ie, ie_len,
                                    signal, GFP_KERNEL);
-        cfg80211_put_bss(cbss);
+        cfg80211_put_bss(wiphy, cbss);
 }
 
 void orinoco_add_hostscan_results(struct orinoco_private *priv,
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index abe1d039be81..fe2f272689aa 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2029,7 +2029,7 @@ static bool rndis_bss_info_update(struct usbnet *usbdev,
         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel, bssid->mac,
                 timestamp, capability, beacon_interval, ie, ie_len, signal,
                 GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
 
         return (bss != NULL);
 }
@@ -2718,7 +2718,7 @@ static void rndis_wlan_craft_connected_bss(struct usbnet *usbdev, u8 *bssid,
         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel, bssid,
                 timestamp, capability, beacon_period, ie_buf, ie_len,
                 signal, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index a2d2bc2c7b3d..221beaaa83f1 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1185,8 +1185,14 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(entry);
-
+        if (rt2x00queue_map_txskb(entry)) {
+                ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
+                goto out;
+        }
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
         /*
          * Write the TX descriptor for the beacon.
          */
@@ -1196,7 +1202,7 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
          * Dump beacon to userspace through debugfs.
          */
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
-
+out:
         /*
          * Enable beaconing again.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 9bea10f53f0a..39edc59e8d03 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1338,7 +1338,10 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(entry);
+        if (rt2x00queue_map_txskb(entry)) {
+                ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
+                goto out;
+        }
 
         /*
          * Write the TX descriptor for the beacon.
@@ -1349,7 +1352,7 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
          * Dump beacon to userspace through debugfs.
          */
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
-
+out:
         /*
          * Enable beaconing again.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 9a3f31a543ce..086abb403a4f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1169,8 +1169,10 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
 /**
  * rt2x00queue_map_txskb - Map a skb into DMA for TX purposes.
  * @entry: Pointer to &struct queue_entry
+ *
+ * Returns -ENOMEM if mapping fail, 0 otherwise.
  */
-void rt2x00queue_map_txskb(struct queue_entry *entry);
+int rt2x00queue_map_txskb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_unmap_skb - Unmap a skb from DMA.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index f35d85a71bbc..4d91795dc6a2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -87,24 +87,35 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
         skbdesc->entry = entry;
 
         if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags)) {
-                skbdesc->skb_dma = dma_map_single(rt2x00dev->dev,
-                                                  skb->data,
-                                                  skb->len,
-                                                  DMA_FROM_DEVICE);
+                dma_addr_t skb_dma;
+
+                skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
+                                         DMA_FROM_DEVICE);
+                if (unlikely(dma_mapping_error(rt2x00dev->dev, skb_dma))) {
+                        dev_kfree_skb_any(skb);
+                        return NULL;
+                }
+
+                skbdesc->skb_dma = skb_dma;
                 skbdesc->flags |= SKBDESC_DMA_MAPPED_RX;
         }
 
         return skb;
 }
 
-void rt2x00queue_map_txskb(struct queue_entry *entry)
+int rt2x00queue_map_txskb(struct queue_entry *entry)
 {
         struct device *dev = entry->queue->rt2x00dev->dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
 
         skbdesc->skb_dma =
             dma_map_single(dev, entry->skb->data, entry->skb->len, DMA_TO_DEVICE);
+
+        if (unlikely(dma_mapping_error(dev, skbdesc->skb_dma)))
+                return -ENOMEM;
+
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
 
@@ -343,10 +354,7 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
                  * when using more then one tx stream (>MCS7).
                  */
                 if (sta && txdesc->u.ht.mcs > 7 &&
-                    ((sta->ht_cap.cap &
-                      IEEE80211_HT_CAP_SM_PS) >>
-                     IEEE80211_HT_CAP_SM_PS_SHIFT) ==
-                    WLAN_HT_CAP_SM_PS_DYNAMIC)
+                    sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
                         __set_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags);
         } else {
                 txdesc->u.ht.mcs = rt2x00_get_rate_mcs(hwrate->mcs);
@@ -545,8 +553,9 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
         /*
          * Map the skb to DMA.
          */
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags))
-                rt2x00queue_map_txskb(entry);
+        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags) &&
+            rt2x00queue_map_txskb(entry))
+                return -ENOMEM;
 
         return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index b80bc4612581..b6aa0c40658f 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,8 +1,26 @@
+config RTLWIFI
+        tristate "Realtek wireless card support"
+        depends on MAC80211
+        select FW_LOADER
+        ---help---
+          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
+          drivers.  This module does nothing by itself - the various front-end
+          drivers need to be enabled to support any desired devices.
+
+          If you choose to build as a module, it'll be called rtlwifi.
+
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
+
 config RTL8192CE
         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
@@ -12,9 +30,7 @@ config RTL8192CE
 
 config RTL8192SE
         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
         wireless network adapters.
@@ -23,9 +39,7 @@ config RTL8192SE
 
 config RTL8192DE
         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
         wireless network adapters.
@@ -34,9 +48,7 @@ config RTL8192DE
 
 config RTL8723AE
         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI && EXPERIMENTAL
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8723AE 802.11n PCIe
         wireless network adapters.
@@ -45,9 +57,7 @@ config RTL8723AE
 
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on MAC80211 && USB
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && USB
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -55,16 +65,6 @@ config RTL8192CU
 
         If you choose to build it as a module, it will be called rtl8192cu
 
-config RTLWIFI
-        tristate
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
-        default m
-
-config RTLWIFI_DEBUG
-        bool "Additional debugging output"
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
-        default y
-
 config RTL8192C_COMMON
         tristate
         depends on RTL8192CE || RTL8192CU
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..99c5cea3fe21 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -523,8 +523,8 @@ static void _rtl_query_shortgi(struct ieee80211_hw *hw,
         if (mac->opmode == NL80211_IFTYPE_STATION)
                 bw_40 = mac->bw_40;
         else if (mac->opmode == NL80211_IFTYPE_AP ||
-                mac->opmode == NL80211_IFTYPE_ADHOC)
-                bw_40 = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                 mac->opmode == NL80211_IFTYPE_ADHOC)
+                bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 
         if (bw_40 && sgi_40)
                 tcb_desc->use_shortgi = true;
@@ -634,8 +634,7 @@ static void _rtl_query_bandwidth_mode(struct ieee80211_hw *hw,
                 return;
         if (mac->opmode == NL80211_IFTYPE_AP ||
             mac->opmode == NL80211_IFTYPE_ADHOC) {
-                if (!(sta->ht_cap.ht_supported) ||
-                    !(sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
                         return;
         } else if (mac->opmode == NL80211_IFTYPE_STATION) {
                 if (!mac->bw_40 || !(sta->ht_cap.ht_supported))
@@ -1004,7 +1003,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                          is_tx ? "Tx" : "Rx");
 
                                 if (is_tx) {
-                                        rtl_lps_leave(hw);
+                                        schedule_work(&rtlpriv->
+                                                      works.lps_leave_work);
                                         ppsc->last_delaylps_stamp_jiffies =
                                             jiffies;
                                 }
@@ -1014,7 +1014,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
         } else if (ETH_P_ARP == ether_type) {
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1024,7 +1024,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
 
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
diff --git a/drivers/net/wireless/rtlwifi/rc.c b/drivers/net/wireless/rtlwifi/rc.c
index 204f46c4510d..f9f059dadb73 100644
--- a/drivers/net/wireless/rtlwifi/rc.c
+++ b/drivers/net/wireless/rtlwifi/rc.c
@@ -116,9 +116,8 @@ static void _rtl_rc_rate_set_series(struct rtl_priv *rtlpriv,
                 if (txrc->short_preamble)
                         rate->flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
                 if (mac->opmode == NL80211_IFTYPE_AP ||
-                        mac->opmode == NL80211_IFTYPE_ADHOC) {
-                        if (sta && (sta->ht_cap.cap &
-                            IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                    mac->opmode == NL80211_IFTYPE_ADHOC) {
+                        if (sta && (sta->bandwidth >= IEEE80211_STA_RX_BW_40))
                                 rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
                 } else {
                         if (mac->bw_40)
@@ -217,6 +216,12 @@ static void rtl_tx_status(void *ppriv,
         }
 }
 
+static void rtl_rate_init(void *ppriv,
+                          struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta, void *priv_sta)
+{
+}
+
 static void *rtl_rate_alloc(struct ieee80211_hw *hw,
                 struct dentry *debugfsdir)
 {
@@ -261,6 +266,7 @@ static struct rate_control_ops rtl_rate_ops = {
         .free = rtl_rate_free,
         .alloc_sta = rtl_rate_alloc_sta,
         .free_sta = rtl_rate_free_sta,
+        .rate_init = rtl_rate_init,
         .tx_status = rtl_tx_status,
         .get_rate = rtl_get_rate,
 };
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index d1f34f6ffbdf..1b65db7fd651 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -1846,9 +1846,9 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
-        u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
+        u8 curshortgi_40mhz = curtxbw_40mhz &&
+                              (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                 1 : 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index da0e9022a99a..b9b1a6e0b16e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -626,8 +626,7 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index f4051f4f0390..aa5b42521bb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1970,8 +1970,7 @@ static void rtl92de_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                                        ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                                         1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index cdb570ffb4b5..941080e03c06 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -574,8 +574,7 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
         rtl_get_tcb_desc(hw, info, sta, skb, ptcb_desc);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 28526a7361f5..084e7773bce2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -2085,8 +2085,7 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index = 0;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index f8431a3c2c9d..7b0a2e75b8b8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -621,8 +621,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                    IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index 149804816ac4..9a0c71c2e15e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -1866,8 +1866,7 @@ static void rtl8723ae_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index b1fd2b328abf..ac081297db50 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -395,8 +395,7 @@ void rtl8723ae_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 80730c72e0d6..476eaef5e4a9 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         WARN_ON(skb_queue_empty(&rx_queue));
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
+                ieee80211_rx_irqsafe(hw, _skb);
         }
 }
 
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 5ec50a476a69..74ae8e1c2e33 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -29,6 +29,8 @@
 static int wl1251_event_scan_complete(struct wl1251 *wl,
                                       struct event_mailbox *mbox)
 {
+        int ret = 0;
+
         wl1251_debug(DEBUG_EVENT, "status: 0x%x, channels: %d",
                      mbox->scheduled_scan_status,
                      mbox->scheduled_scan_channels);
@@ -37,9 +39,11 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
                 ieee80211_scan_completed(wl->hw, false);
                 wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan completed");
                 wl->scanning = false;
+                if (wl->hw->conf.flags & IEEE80211_CONF_IDLE)
+                        ret = wl1251_ps_set_mode(wl, STATION_IDLE);
         }
 
-        return 0;
+        return ret;
 }
 
 static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index f47e8b0482ad..bbbf68cf50a7 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -623,7 +623,7 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+        if (changed & IEEE80211_CONF_CHANGE_IDLE && !wl->scanning) {
                 if (conf->flags & IEEE80211_CONF_IDLE) {
                         ret = wl1251_ps_set_mode(wl, STATION_IDLE);
                         if (ret < 0)
@@ -895,11 +895,21 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (hw->conf.flags & IEEE80211_CONF_IDLE) {
+                ret = wl1251_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                if (ret < 0)
+                        goto out_sleep;
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
                                      req->ie_len);
         if (!skb) {
                 ret = -ENOMEM;
-                goto out;
+                goto out_idle;
         }
         if (req->ie_len)
                 memcpy(skb_put(skb, req->ie_len), req->ie, req->ie_len);
@@ -908,11 +918,11 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                                       skb->len);
         dev_kfree_skb(skb);
         if (ret < 0)
-                goto out_sleep;
+                goto out_idle;
 
         ret = wl1251_cmd_trigger_scan_to(wl, 0);
         if (ret < 0)
-                goto out_sleep;
+                goto out_idle;
 
         wl->scanning = true;
 
@@ -920,9 +930,13 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                               req->n_channels, WL1251_SCAN_NUM_PROBES);
         if (ret < 0) {
                 wl->scanning = false;
-                goto out_sleep;
+                goto out_idle;
         }
+        goto out_sleep;
 
+out_idle:
+        if (hw->conf.flags & IEEE80211_CONF_IDLE)
+                ret = wl1251_ps_set_mode(wl, STATION_IDLE);
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index a10b7a7a215a..da3ef1b10a9c 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -1374,7 +1374,7 @@ static void wl18xx_sta_rc_update(struct wl1271 *wl,
                                  struct ieee80211_sta *sta,
                                  u32 changed)
 {
-        bool wide = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        bool wide = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 28a37576d568..2c2ff3e1f849 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5636,7 +5636,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                 IEEE80211_HW_AP_LINK_PS |
                 IEEE80211_HW_AMPDU_AGGREGATION |
                 IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
-                IEEE80211_HW_SCAN_WHILE_IDLE |
                 IEEE80211_HW_QUEUE_CONTROL;
 
         wl->hw->wiphy->cipher_suites = cipher_suites;
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index accabe39b320..dc109de228c6 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -196,3 +196,15 @@ int ssb_gpio_init(struct ssb_bus *bus)
 
         return -1;
 }
+
+int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        if (ssb_chipco_available(&bus->chipco) ||
+            ssb_extif_available(&bus->extif)) {
+                return gpiochip_remove(&bus->gpio);
+        } else {
+                SSB_WARN_ON(1);
+        }
+
+        return -1;
+}
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index db7705743a8f..4be144a99e03 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -443,6 +443,15 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
 
 void ssb_bus_unregister(struct ssb_bus *bus)
 {
+        int err;
+
+        err = ssb_gpio_unregister(bus);
+        if (err == -EBUSY)
+                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+        else if (err)
+                ssb_dprintk(KERN_ERR PFX
+                            "Can not unregister GPIO driver: %i\n", err);
+
         ssb_buses_lock();
         ssb_devices_unregister(bus);
         list_del(&bus->list);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 53198dcec90e..466171b77f68 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -267,11 +267,16 @@ static inline void ssb_extif_init(struct ssb_extif *extif)
 
 #ifdef CONFIG_SSB_DRIVER_GPIO
 extern int ssb_gpio_init(struct ssb_bus *bus);
+extern int ssb_gpio_unregister(struct ssb_bus *bus);
 #else /* CONFIG_SSB_DRIVER_GPIO */
 static inline int ssb_gpio_init(struct ssb_bus *bus)
 {
         return -ENOTSUPP;
 }
+static inline int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        return 0;
+}
 #endif /* CONFIG_SSB_DRIVER_GPIO */
 
 #endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 18c06a59c091..a233f64ca22f 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -424,7 +424,7 @@ int prism2_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
                         goto exit;
                 }
 
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         }
 
         if (result)