13 files changed, 69 insertions, 31 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index c5fd905206e7..3075a2a29511 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1800,6 +1800,9 @@ F:	include/linux/cfag12864b.h
 CFG80211 and NL80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      include/linux/nl80211.h
 F:      include/net/cfg80211.h
@@ -4340,7 +4343,8 @@ MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/networking/mac80211-injection.txt
 F:      include/net/mac80211.h
@@ -4351,7 +4355,8 @@ M:	Stefano Brivio <stefano.brivio@polimi.it>
 M:      Mattias Nissler <mattias.nissler@gmx.de>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/developers/Documentation/mac80211/RateControl/PID
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      net/mac80211/rc80211_pid*
 
@@ -5695,6 +5700,9 @@ F:	include/linux/remoteproc.h
 RFKILL
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/rfkill.txt
 F:      net/rfkill/
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index 9a96f14c8f47..c32ebd537abe 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -232,17 +232,19 @@ void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                           bool enable)
 {
-        struct pci_dev *pdev = pc->core->bus->host_pci;
+        struct pci_dev *pdev;
         u32 coremask, tmp;
         int err = 0;
 
-        if (core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
+        if (!pc || core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
                 /* This bcma device is not on a PCI host-bus. So the IRQs are
                  * not routed through the PCI core.
                  * So we must not enable routing through the PCI core. */
                 goto out;
         }
 
+        pdev = pc->core->bus->host_pci;
+
         err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
         if (err)
                 goto out;
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 67c13af6f206..c06b6cb5c91e 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -877,6 +877,10 @@ struct b43_wl {
          * from the mac80211 subsystem. */
         u16 mac80211_initially_registered_queues;
 
+        /* Set this if we call ieee80211_register_hw() and check if we call
+         * ieee80211_unregister_hw(). */
+        bool hw_registred;
+
         /* We can only have one operating interface (802.11 core)
          * at a time. General information about this interface follows.
          */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 5a39b226b2e3..acd03a4f9730 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2437,6 +2437,7 @@ start_ieee80211:
         err = ieee80211_register_hw(wl->hw);
         if (err)
                 goto err_one_core_detach;
+        wl->hw_registred = true;
         b43_leds_register(wl->current_dev);
         goto out;
 
@@ -5299,6 +5300,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 
         hw->queues = modparam_qos ? B43_QOS_QUEUE_NUM : 1;
         wl->mac80211_initially_registered_queues = hw->queues;
+        wl->hw_registred = false;
         hw->max_rates = 2;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
@@ -5370,12 +5372,15 @@ static void b43_bcma_remove(struct bcma_device *core)
          * as the ieee80211 unreg will destroy the workqueue. */
         cancel_work_sync(&wldev->restart_work);
 
-        /* Restore the queues count before unregistering, because firmware detect
-         * might have modified it. Restoring is important, so the networking
-         * stack can properly free resources. */
-        wl->hw->queues = wl->mac80211_initially_registered_queues;
-        b43_leds_stop(wldev);
-        ieee80211_unregister_hw(wl->hw);
+        B43_WARN_ON(!wl);
+        if (wl->current_dev == wldev && wl->hw_registred) {
+                /* Restore the queues count before unregistering, because firmware detect
+                 * might have modified it. Restoring is important, so the networking
+                 * stack can properly free resources. */
+                wl->hw->queues = wl->mac80211_initially_registered_queues;
+                b43_leds_stop(wldev);
+                ieee80211_unregister_hw(wl->hw);
+        }
 
         b43_one_core_detach(wldev->dev);
 
@@ -5446,7 +5451,7 @@ static void b43_ssb_remove(struct ssb_device *sdev)
         cancel_work_sync(&wldev->restart_work);
 
         B43_WARN_ON(!wl);
-        if (wl->current_dev == wldev) {
+        if (wl->current_dev == wldev && wl->hw_registred) {
                 /* Restore the queues count before unregistering, because firmware detect
                  * might have modified it. Restoring is important, so the networking
                  * stack can properly free resources. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9cfae0c08707..95aa8e1683ec 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,14 +1903,6 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         netif_stop_queue(priv->net_dev);
 }
 
-/* Called by register_netdev() */
-static int ipw2100_net_init(struct net_device *dev)
-{
-        struct ipw2100_priv *priv = libipw_priv(dev);
-
-        return ipw2100_up(priv, 1);
-}
-
 static int ipw2100_wdev_init(struct net_device *dev)
 {
         struct ipw2100_priv *priv = libipw_priv(dev);
@@ -6087,7 +6079,6 @@ static const struct net_device_ops ipw2100_netdev_ops = {
         .ndo_stop               = ipw2100_close,
         .ndo_start_xmit         = libipw_xmit,
         .ndo_change_mtu         = libipw_change_mtu,
-        .ndo_init               = ipw2100_net_init,
         .ndo_tx_timeout         = ipw2100_tx_timeout,
         .ndo_set_mac_address    = ipw2100_set_address,
         .ndo_validate_addr      = eth_validate_addr,
@@ -6329,6 +6320,10 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
         printk(KERN_INFO DRV_NAME
                ": Detected Intel PRO/Wireless 2100 Network Connection\n");
 
+        err = ipw2100_up(priv, 1);
+        if (err)
+                goto fail;
+
         err = ipw2100_wdev_init(dev);
         if (err)
                 goto fail;
@@ -6338,12 +6333,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
          * network device we would call ipw2100_up.  This introduced a race
          * condition with newer hotplug configurations (network was coming
          * up and making calls before the device was initialized).
-         *
-         * If we called ipw2100_up before we registered the device, then the
-         * device name wasn't registered.  So, we instead use the net_dev->init
-         * member to call a function that then just turns and calls ipw2100_up.
-         * net_dev->init is called after name allocation but before the
-         * notifier chain is called */
+         */
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_WARNING DRV_NAME
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 286ce4e18068..b29b798f7550 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -1251,7 +1251,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         sta_cmd.key.key_flags = key_flags;
-        sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
+        sta_cmd.key.key_offset = keyconf->hw_key_idx;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index a9f0415916c7..9253ef1dba72 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -224,6 +224,7 @@
 #define SCD_TXFACT              (SCD_BASE + 0x10)
 #define SCD_ACTIVE              (SCD_BASE + 0x14)
 #define SCD_QUEUECHAIN_SEL      (SCD_BASE + 0xe8)
+#define SCD_CHAINEXT_EN         (SCD_BASE + 0x244)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/6000.c b/drivers/net/wireless/iwlwifi/pcie/6000.c
index 8dd8a6fe61e8..cb08ba03aae7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/6000.c
+++ b/drivers/net/wireless/iwlwifi/pcie/6000.c
@@ -35,17 +35,20 @@
 #define IWL6000_UCODE_API_MAX 6
 #define IWL6050_UCODE_API_MAX 5
 #define IWL6000G2_UCODE_API_MAX 6
+#define IWL6035_UCODE_API_MAX 6
 
 /* Oldest version we won't warn about */
 #define IWL6000_UCODE_API_OK 4
 #define IWL6000G2_UCODE_API_OK 5
 #define IWL6050_UCODE_API_OK 5
 #define IWL6000G2B_UCODE_API_OK 6
+#define IWL6035_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
-#define IWL6000G2_UCODE_API_MIN 4
+#define IWL6000G2_UCODE_API_MIN 5
+#define IWL6035_UCODE_API_MIN 6
 
 /* EEPROM versions */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
@@ -243,9 +246,25 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         IWL_DEVICE_6030,
 };
 
+#define IWL_DEVICE_6035                                         \
+        .fw_name_pre = IWL6030_FW_PRE,                          \
+        .ucode_api_max = IWL6035_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL6035_UCODE_API_OK,                   \
+        .ucode_api_min = IWL6035_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6030,                \
+        .max_inst_size = IWL60_RTC_INST_SIZE,                   \
+        .max_data_size = IWL60_RTC_DATA_SIZE,                   \
+        .eeprom_ver = EEPROM_6030_EEPROM_VERSION,               \
+        .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
+        .base_params = &iwl6000_g2_base_params,                 \
+        .bt_params = &iwl6000_bt_params,                        \
+        .need_temp_offset_calib = true,                         \
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .adv_pm = true
+
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
-        IWL_DEVICE_6030,
+        IWL_DEVICE_6035,
         .ht_params = &iwl6000_ht_params,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1eabb834e32a..69dece5abb2f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1054,6 +1054,11 @@ static void iwl_tx_start(struct iwl_trans *trans)
         iwl_write_prph(trans, SCD_DRAM_BASE_ADDR,
                        trans_pcie->scd_bc_tbls.dma >> 10);
 
+        /* The chain extension of the SCD doesn't work well. This feature is
+         * enabled by default by the HW, so we need to disable it manually.
+         */
+        iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
+
         for (i = 0; i < trans_pcie->n_q_to_fifo; i++) {
                 int fifo = trans_pcie->setup_q_to_fifo[i];
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4c9336cee817..a0b7cfd34685 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1555,6 +1555,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
                         hdr = (struct ieee80211_hdr *) skb->data;
                         mac80211_hwsim_monitor_ack(data2->hw, hdr->addr2);
                 }
+                txi->flags |= IEEE80211_TX_STAT_ACK;
         }
         ieee80211_tx_status_irqsafe(data2->hw, skb);
         return 0;
diff --git a/drivers/net/wireless/rtl818x/rtl8187/leds.c b/drivers/net/wireless/rtl818x/rtl8187/leds.c
index 2e0de2f5f0f9..c2d5b495c179 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/leds.c
@@ -117,7 +117,7 @@ static void rtl8187_led_brightness_set(struct led_classdev *led_dev,
                         radio_on = true;
                 } else if (radio_on) {
                         radio_on = false;
-                        cancel_delayed_work_sync(&priv->led_on);
+                        cancel_delayed_work(&priv->led_on);
                         ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
                 }
         } else if (radio_on) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0f45d02e0ba7..d7134c170336 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3100,7 +3100,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         }
 
         local->oper_channel = cbss->channel;
-        ieee80211_hw_config(local, 0);
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         if (!have_sta) {
                 u32 rates = 0, basic_rates = 0;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 30e3cc71be7a..2c0b317344b7 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,6 +292,9 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         pr_debug("%p\n", sk);
 
+        if (llcp_sock == NULL)
+                return -EBADFD;
+
         addr->sa_family = AF_NFC;
         *len = sizeof(struct sockaddr_nfc_llcp);