32 files changed, 232 insertions, 219 deletions
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 0064be7ce5c9..21091c26a9a5 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -838,9 +838,9 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah)
        for (i = 0; i < qmax; i++) {
                err = ath5k_hw_stop_tx_dma(ah, i);
                /* -EINVAL -> queue inactive */
-                if (err != -EINVAL)
+                if (err && err != -EINVAL)
                        return err;
        }
-        return err;
+        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index e5f2b96a4c63..a702817daf72 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -86,7 +86,7 @@ int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
        if (!ah->ah_bwmode) {
                dur = ieee80211_generic_frame_duration(sc->hw,
                                                NULL, len, rate);
-                return dur;
+                return le16_to_cpu(dur);
        }
        bitrate = rate->bitrate;
@@ -265,8 +265,6 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah)
                 * what rate we should choose to TX ACKs. */
                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate);
-                tx_time = le16_to_cpu(tx_time);
                ath5k_hw_reg_write(ah, tx_time, reg);
                if (!(rate->flags & IEEE80211_RATE_SHORT_PREAMBLE))
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 78c26fdccad1..62ce2f4e8605 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -282,6 +282,34 @@ int ath5k_hw_phy_disable(struct ath5k_hw *ah)
        return 0;
 }
+/*
+ * Wait for synth to settle
+ */
+static void ath5k_hw_wait_for_synth(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel)
+{
+        /*
+         * On 5211+ read activation -> rx delay
+         * and use it (100ns steps).
+         */
+        if (ah->ah_version != AR5K_AR5210) {
+                u32 delay;
+                delay = ath5k_hw_reg_read(ah, AR5K_PHY_RX_DELAY) &
+                        AR5K_PHY_RX_DELAY_M;
+                delay = (channel->hw_value & CHANNEL_CCK) ?
+                        ((delay << 2) / 22) : (delay / 10);
+                if (ah->ah_bwmode == AR5K_BWMODE_10MHZ)
+                        delay = delay << 1;
+                if (ah->ah_bwmode == AR5K_BWMODE_5MHZ)
+                        delay = delay << 2;
+                /* XXX: /2 on turbo ? Let's be safe
+                 * for now */
+                udelay(100 + delay);
+        } else {
+                mdelay(1);
+        }
+}
 /**********************\
 * RF Gain optimization *
@@ -1253,6 +1281,7 @@ static int ath5k_hw_channel(struct ath5k_hw *ah,
        case AR5K_RF5111:
                ret = ath5k_hw_rf5111_channel(ah, channel);
                break;
+        case AR5K_RF2317:
        case AR5K_RF2425:
                ret = ath5k_hw_rf2425_channel(ah, channel);
                break;
@@ -3237,6 +3266,13 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                /* Failed */
                if (i >= 100)
                        return -EIO;
+                /* Set channel and wait for synth */
+                ret = ath5k_hw_channel(ah, channel);
+                if (ret)
+                        return ret;
+                ath5k_hw_wait_for_synth(ah, channel);
        }
        /*
@@ -3251,13 +3287,53 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
        if (ret)
                return ret;
+        /* Write OFDM timings on 5212*/
+        if (ah->ah_version == AR5K_AR5212 &&
+                channel->hw_value & CHANNEL_OFDM) {
+                ret = ath5k_hw_write_ofdm_timings(ah, channel);
+                if (ret)
+                        return ret;
+                /* Spur info is available only from EEPROM versions
+                 * greater than 5.3, but the EEPROM routines will use
+                 * static values for older versions */
+                if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
+                        ath5k_hw_set_spur_mitigation_filter(ah,
+                                                            channel);
+        }
+        /* If we used fast channel switching
+         * we are done, release RF bus and
+         * fire up NF calibration.
+         *
+         * Note: Only NF calibration due to
+         * channel change, not AGC calibration
+         * since AGC is still running !
+         */
+        if (fast) {
+                /*
+                 * Release RF Bus grant
+                 */
+                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_RFBUS_REQ,
+                                    AR5K_PHY_RFBUS_REQ_REQUEST);
+                /*
+                 * Start NF calibration
+                 */
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                                        AR5K_PHY_AGCCTL_NF);
+                return ret;
+        }
        /*
         * For 5210 we do all initialization using
         * initvals, so we don't have to modify
         * any settings (5210 also only supports
         * a/aturbo modes)
         */
-        if ((ah->ah_version != AR5K_AR5210) && !fast) {
+        if (ah->ah_version != AR5K_AR5210) {
                /*
                 * Write initial RF gain settings
@@ -3276,22 +3352,6 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                if (ret)
                        return ret;
-                /* Write OFDM timings on 5212*/
-                if (ah->ah_version == AR5K_AR5212 &&
-                        channel->hw_value & CHANNEL_OFDM) {
-                        ret = ath5k_hw_write_ofdm_timings(ah, channel);
-                        if (ret)
-                                return ret;
-                        /* Spur info is available only from EEPROM versions
-                         * greater than 5.3, but the EEPROM routines will use
-                         * static values for older versions */
-                        if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
-                                ath5k_hw_set_spur_mitigation_filter(ah,
-                                                                    channel);
-                }
                /*Enable/disable 802.11b mode on 5111
                (enable 2111 frequency converter + CCK)*/
                if (ah->ah_radio == AR5K_RF5111) {
@@ -3322,47 +3382,20 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
         */
        ath5k_hw_reg_write(ah, AR5K_PHY_ACT_ENABLE, AR5K_PHY_ACT);
+        ath5k_hw_wait_for_synth(ah, channel);
        /*
-         * On 5211+ read activation -> rx delay
+         * Perform ADC test to see if baseband is ready
-         * and use it.
+         * Set tx hold and check adc test register
         */
-        if (ah->ah_version != AR5K_AR5210) {
+        phy_tst1 = ath5k_hw_reg_read(ah, AR5K_PHY_TST1);
-                u32 delay;
+        ath5k_hw_reg_write(ah, AR5K_PHY_TST1_TXHOLD, AR5K_PHY_TST1);
-                delay = ath5k_hw_reg_read(ah, AR5K_PHY_RX_DELAY) &
+        for (i = 0; i <= 20; i++) {
-                        AR5K_PHY_RX_DELAY_M;
+                if (!(ath5k_hw_reg_read(ah, AR5K_PHY_ADC_TEST) & 0x10))
-                delay = (channel->hw_value & CHANNEL_CCK) ?
+                        break;
-                        ((delay << 2) / 22) : (delay / 10);
+                udelay(200);
-                if (ah->ah_bwmode == AR5K_BWMODE_10MHZ)
-                        delay = delay << 1;
-                if (ah->ah_bwmode == AR5K_BWMODE_5MHZ)
-                        delay = delay << 2;
-                /* XXX: /2 on turbo ? Let's be safe
-                 * for now */
-                udelay(100 + delay);
-        } else {
-                mdelay(1);
-        }
-        if (fast)
-                /*
-                 * Release RF Bus grant
-                 */
-                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_RFBUS_REQ,
-                                    AR5K_PHY_RFBUS_REQ_REQUEST);
-        else {
-                /*
-                 * Perform ADC test to see if baseband is ready
-                 * Set tx hold and check adc test register
-                 */
-                phy_tst1 = ath5k_hw_reg_read(ah, AR5K_PHY_TST1);
-                ath5k_hw_reg_write(ah, AR5K_PHY_TST1_TXHOLD, AR5K_PHY_TST1);
-                for (i = 0; i <= 20; i++) {
-                        if (!(ath5k_hw_reg_read(ah, AR5K_PHY_ADC_TEST) & 0x10))
-                                break;
-                        udelay(200);
-                }
-                ath5k_hw_reg_write(ah, phy_tst1, AR5K_PHY_TST1);
        }
+        ath5k_hw_reg_write(ah, phy_tst1, AR5K_PHY_TST1);
        /*
         * Start automatic gain control calibration
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index f8a7771faee2..f44c84ab5dce 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -426,9 +426,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                }
                /* WAR for ASPM system hang */
-                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
                        val |= (AR_WA_BIT6 | AR_WA_BIT7);
-                }
                if (AR_SREV_9285E_20(ah))
                        val |= AR_WA_BIT23;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 3681caf54282..1a7fa6ea4cf5 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -21,7 +21,6 @@
 #include <linux/device.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
-#include <linux/pm_qos_params.h>
 #include "debug.h"
 #include "common.h"
@@ -57,8 +56,6 @@ struct ath_node;
 #define A_MAX(a, b) ((a) > (b) ? (a) : (b))
-#define ATH9K_PM_QOS_DEFAULT_VALUE      55
 #define TSF_TO_TU(_h,_l) \
        ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
@@ -218,6 +215,7 @@ struct ath_frame_info {
 struct ath_buf_state {
        u8 bf_type;
        u8 bfs_paprd;
+        unsigned long bfs_paprd_timestamp;
        enum ath9k_internal_frame_type bfs_ftype;
 };
@@ -593,7 +591,6 @@ struct ath_softc {
        struct work_struct paprd_work;
        struct work_struct hw_check_work;
        struct completion paprd_complete;
-        bool paprd_pending;
        u32 intrstatus;
        u32 sc_flags; /* SC_OP_* */
@@ -633,8 +630,6 @@ struct ath_softc {
        struct ath_descdma txsdma;
        struct ath_ant_comb ant_comb;
-        struct pm_qos_request_list pm_qos_req;
 };
 struct ath_wiphy {
@@ -666,7 +661,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
 extern int led_blink;
-extern int ath9k_pm_qos_value;
 extern bool is_ath9k_unloaded;
 irqreturn_t ath_isr(int irq, void *dev);
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 5ab3084eb9cb..07b1633b7f3f 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -219,8 +219,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
        struct tx_buf *tx_buf = NULL;
        struct sk_buff *nskb = NULL;
        int ret = 0, i;
-        u16 *hdr, tx_skb_cnt = 0;
+        u16 tx_skb_cnt = 0;
        u8 *buf;
+        __le16 *hdr;
        if (hif_dev->tx.tx_skb_cnt == 0)
                return 0;
@@ -245,9 +246,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
                buf = tx_buf->buf;
                buf += tx_buf->offset;
-                hdr = (u16 *)buf;
+                hdr = (__le16 *)buf;
-                *hdr++ = nskb->len;
+                *hdr++ = cpu_to_le16(nskb->len);
-                *hdr++ = ATH_USB_TX_STREAM_MODE_TAG;
+                *hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
                buf += 4;
                memcpy(buf, nskb->data, nskb->len);
                tx_buf->len = nskb->len + 4;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 38433f9bfe59..0352f0994caa 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -142,9 +142,6 @@ static void ath9k_deinit_priv(struct ath9k_htc_priv *priv)
 {
        ath9k_htc_exit_debug(priv->ah);
        ath9k_hw_deinit(priv->ah);
-        tasklet_kill(&priv->swba_tasklet);
-        tasklet_kill(&priv->rx_tasklet);
-        tasklet_kill(&priv->tx_tasklet);
        kfree(priv->ah);
        priv->ah = NULL;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index f4d576bc3ccd..6bb59958f71e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1025,12 +1025,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
        int ret = 0;
        u8 cmd_rsp;
-        /* Cancel all the running timers/work .. */
-        cancel_work_sync(&priv->fatal_work);
-        cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
-        ath9k_led_stop_brightness(priv);
        mutex_lock(&priv->mutex);
        if (priv->op_flags & OP_INVALID) {
@@ -1044,8 +1038,23 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
        WMI_CMD(WMI_DISABLE_INTR_CMDID);
        WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
        WMI_CMD(WMI_STOP_RECV_CMDID);
+        tasklet_kill(&priv->swba_tasklet);
+        tasklet_kill(&priv->rx_tasklet);
+        tasklet_kill(&priv->tx_tasklet);
        skb_queue_purge(&priv->tx_queue);
+        mutex_unlock(&priv->mutex);
+        /* Cancel all the running timers/work .. */
+        cancel_work_sync(&priv->fatal_work);
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_led_stop_brightness(priv);
+        mutex_lock(&priv->mutex);
        /* Remove monitor interface here */
        if (ah->opmode == NL80211_IFTYPE_MONITOR) {
                if (ath9k_htc_remove_monitor_interface(priv))
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1afb8bb85756..9f01e50d5cda 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -369,6 +369,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
        else
                ah->config.ht_enable = 0;
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
        ah->config.rx_intr_mitigation = true;
        ah->config.pcieSerDesWrite = true;
@@ -1933,7 +1936,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                pCap->rx_status_len = sizeof(struct ar9003_rxs);
                pCap->tx_desc_len = sizeof(struct ar9003_txc);
                pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
        } else {
                pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 5a3dfec45e96..ea9fde670646 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -225,6 +225,7 @@ struct ath9k_ops_config {
        u32 pcie_waen;
        u8 analog_shiftreg;
        u8 ht_enable;
+        u8 paprd_disable;
        u32 ofdm_trig_low;
        u32 ofdm_trig_high;
        u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 767d8b86f1e1..a033d01bf8a0 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -41,10 +41,6 @@ static int ath9k_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
-int ath9k_pm_qos_value = ATH9K_PM_QOS_DEFAULT_VALUE;
-module_param_named(pmqos, ath9k_pm_qos_value, int, S_IRUSR | S_IRGRP | S_IROTH);
-MODULE_PARM_DESC(pmqos, "User specified PM-QOS value");
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
@@ -598,8 +594,6 @@ err_btcoex:
 err_queues:
        ath9k_hw_deinit(ah);
 err_hw:
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
        kfree(ah);
        sc->sc_ah = NULL;
@@ -764,9 +758,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
        ath_init_leds(sc);
        ath_start_rfkill_poll(sc);
-        pm_qos_add_request(&sc->pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
-                           PM_QOS_DEFAULT_VALUE);
        return 0;
 error_world:
@@ -807,9 +798,6 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
        ath9k_hw_deinit(sc->sc_ah);
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
        kfree(sc->sc_ah);
        sc->sc_ah = NULL;
 }
@@ -824,6 +812,8 @@ void ath9k_deinit_device(struct ath_softc *sc)
        wiphy_rfkill_stop_polling(sc->hw->wiphy);
        ath_deinit_leds(sc);
+        ath9k_ps_restore(sc);
        for (i = 0; i < sc->num_sec_wiphy; i++) {
                struct ath_wiphy *aphy = sc->sec_wiphy[i];
                if (aphy == NULL)
@@ -834,7 +824,6 @@ void ath9k_deinit_device(struct ath_softc *sc)
        }
        ieee80211_unregister_hw(hw);
-        pm_qos_remove_request(&sc->pm_qos_req);
        ath_rx_cleanup(sc);
        ath_tx_cleanup(sc);
        ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 180170d3ce25..2915b11edefb 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -885,7 +885,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
        struct ath_common *common = ath9k_hw_common(ah);
        if (!(ints & ATH9K_INT_GLOBAL))
-                ath9k_hw_enable_interrupts(ah);
+                ath9k_hw_disable_interrupts(ah);
        ath_dbg(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
@@ -963,7 +963,8 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                        REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
        }
-        ath9k_hw_enable_interrupts(ah);
+        if (ints & ATH9K_INT_GLOBAL)
+                ath9k_hw_enable_interrupts(ah);
        return;
 }
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f90a6ca94a76..a09d15f7aa6e 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -325,6 +325,8 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
 {
        struct ieee80211_hw *hw = sc->hw;
        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
        struct ath_tx_control txctl;
        int time_left;
@@ -340,14 +342,16 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
        tx_info->control.rates[1].idx = -1;
        init_completion(&sc->paprd_complete);
-        sc->paprd_pending = true;
        txctl.paprd = BIT(chain);
-        if (ath_tx_start(hw, skb, &txctl) != 0)
+        if (ath_tx_start(hw, skb, &txctl) != 0) {
+                ath_dbg(common, ATH_DBG_XMIT, "PAPRD TX failed\n");
+                dev_kfree_skb_any(skb);
                return false;
+        }
        time_left = wait_for_completion_timeout(&sc->paprd_complete,
                        msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
-        sc->paprd_pending = false;
        if (!time_left)
                ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_CALIBRATE,
@@ -592,14 +596,12 @@ void ath9k_tasklet(unsigned long data)
        u32 status = sc->intrstatus;
        u32 rxmask;
-        ath9k_ps_wakeup(sc);
        if (status & ATH9K_INT_FATAL) {
                ath_reset(sc, true);
-                ath9k_ps_restore(sc);
                return;
        }
+        ath9k_ps_wakeup(sc);
        spin_lock(&sc->sc_pcu_lock);
        if (!ath9k_hw_check_alive(ah))
@@ -955,8 +957,6 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
        spin_unlock_bh(&sc->sc_pcu_lock);
        ath9k_ps_restore(sc);
-        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 }
 int ath_reset(struct ath_softc *sc, bool retry_tx)
@@ -969,6 +969,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
        /* Stop ANI */
        del_timer_sync(&common->ani.timer);
+        ath9k_ps_wakeup(sc);
        spin_lock_bh(&sc->sc_pcu_lock);
        ieee80211_stop_queues(hw);
@@ -1015,6 +1016,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
        /* Start ANI */
        ath_start_ani(common);
+        ath9k_ps_restore(sc);
        return r;
 }
@@ -1171,12 +1173,6 @@ static int ath9k_start(struct ieee80211_hw *hw)
                        ath9k_btcoex_timer_resume(sc);
        }
-        /* User has the option to provide pm-qos value as a module
-         * parameter rather than using the default value of
-         * 'ATH9K_PM_QOS_DEFAULT_VALUE'.
-         */
-        pm_qos_update_request(&sc->pm_qos_req, ath9k_pm_qos_value);
        if (ah->caps.pcie_lcr_extsync_en && common->bus_ops->extn_synch_en)
                common->bus_ops->extn_synch_en(common);
@@ -1309,6 +1305,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        spin_lock_bh(&sc->sc_pcu_lock);
+        /* prevent tasklets to enable interrupts once we disable them */
+        ah->imask &= ~ATH9K_INT_GLOBAL;
        /* make sure h/w will not generate any interrupt
         * before setting the invalid flag. */
        ath9k_hw_disable_interrupts(ah);
@@ -1326,6 +1325,12 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        spin_unlock_bh(&sc->sc_pcu_lock);
+        /* we can now sync irq and kill any running tasklets, since we already
+         * disabled interrupts and not holding a spin lock */
+        synchronize_irq(sc->irq);
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
        ath9k_ps_restore(sc);
        sc->ps_idle = true;
@@ -1334,8 +1339,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        sc->sc_flags |= SC_OP_INVALID;
-        pm_qos_update_request(&sc->pm_qos_req, PM_QOS_DEFAULT_VALUE);
        mutex_unlock(&sc->mutex);
        ath_dbg(common, ATH_DBG_CONFIG, "Driver halt\n");
@@ -1701,7 +1704,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 skip_chan_change:
        if (changed & IEEE80211_CONF_CHANGE_POWER) {
                sc->config.txpowlimit = 2 * conf->power_level;
+                ath9k_ps_wakeup(sc);
                ath_update_txpow(sc);
+                ath9k_ps_restore(sc);
        }
        spin_lock_bh(&sc->wiphy_lock);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 332d1feb5c18..07b7804aec5b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1725,6 +1725,9 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                        ar9003_hw_set_paprd_txdesc(sc->sc_ah, bf->bf_desc,
                                                   bf->bf_state.bfs_paprd);
+                if (txctl->paprd)
+                        bf->bf_state.bfs_paprd_timestamp = jiffies;
                ath_tx_send_normal(sc, txctl->txq, tid, &bf_head);
        }
@@ -1886,7 +1889,9 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
        bf->bf_buf_addr = 0;
        if (bf->bf_state.bfs_paprd) {
-                if (!sc->paprd_pending)
+                if (time_after(jiffies,
+                                bf->bf_state.bfs_paprd_timestamp +
+                                msecs_to_jiffies(ATH_PAPRD_TIMEOUT)))
                        dev_kfree_skb_any(skb);
                else
                        complete(&sc->paprd_complete);
@@ -2113,9 +2118,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
        if (needreset) {
                ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                        "tx hung, resetting the chip\n");
-                ath9k_ps_wakeup(sc);
                ath_reset(sc, true);
-                ath9k_ps_restore(sc);
        }
        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 939a0e96ed1f..84866a4b8350 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
        cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
        /* 2. Maybe the AP wants to send multicast/broadcast data? */
-        cam = !!(tim_ie->bitmap_ctrl & 0x01);
+        cam |= !!(tim_ie->bitmap_ctrl & 0x01);
        if (!cam) {
                /* back to low-power land. */
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 537732e5964f..f82c400be288 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -118,6 +118,8 @@ static struct usb_device_id carl9170_usb_ids[] = {
        { USB_DEVICE(0x057c, 0x8402) },
        /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
        { USB_DEVICE(0x1668, 0x1200) },
+        /* Airlive X.USB a/b/g/n */
+        { USB_DEVICE(0x1b75, 0x9170) },
        /* terminate */
        {}
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index a9b852be4509..39b6f16c87fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -402,72 +402,6 @@ static void iwl3945_accumulative_statistics(struct iwl_priv *priv,
 }
 #endif
-/**
- * iwl3945_good_plcp_health - checks for plcp error.
- *
- * When the plcp error is exceeding the thresholds, reset the radio
- * to improve the throughput.
- */
-static bool iwl3945_good_plcp_health(struct iwl_priv *priv,
-                                struct iwl_rx_packet *pkt)
-{
-        bool rc = true;
-        struct iwl3945_notif_statistics current_stat;
-        int combined_plcp_delta;
-        unsigned int plcp_msec;
-        unsigned long plcp_received_jiffies;
-        if (priv->cfg->base_params->plcp_delta_threshold ==
-            IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE) {
-                IWL_DEBUG_RADIO(priv, "plcp_err check disabled\n");
-                return rc;
-        }
-        memcpy(&current_stat, pkt->u.raw, sizeof(struct
-                        iwl3945_notif_statistics));
-        /*
-         * check for plcp_err and trigger radio reset if it exceeds
-         * the plcp error threshold plcp_delta.
-         */
-        plcp_received_jiffies = jiffies;
-        plcp_msec = jiffies_to_msecs((long) plcp_received_jiffies -
-                                        (long) priv->plcp_jiffies);
-        priv->plcp_jiffies = plcp_received_jiffies;
-        /*
-         * check to make sure plcp_msec is not 0 to prevent division
-         * by zero.
-         */
-        if (plcp_msec) {
-                combined_plcp_delta =
-                        (le32_to_cpu(current_stat.rx.ofdm.plcp_err) -
-                        le32_to_cpu(priv->_3945.statistics.rx.ofdm.plcp_err));
-                if ((combined_plcp_delta > 0) &&
-                        ((combined_plcp_delta * 100) / plcp_msec) >
-                        priv->cfg->base_params->plcp_delta_threshold) {
-                        /*
-                         * if plcp_err exceed the threshold, the following
-                         * data is printed in csv format:
-                         *    Text: plcp_err exceeded %d,
-                         *    Received ofdm.plcp_err,
-                         *    Current ofdm.plcp_err,
-                         *    combined_plcp_delta,
-                         *    plcp_msec
-                         */
-                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
-                                "%u, %d, %u mSecs\n",
-                                priv->cfg->base_params->plcp_delta_threshold,
-                                le32_to_cpu(current_stat.rx.ofdm.plcp_err),
-                                combined_plcp_delta, plcp_msec);
-                        /*
-                         * Reset the RF radio due to the high plcp
-                         * error rate
-                         */
-                        rc = false;
-                }
-        }
-        return rc;
-}
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                struct iwl_rx_mem_buffer *rxb)
 {
@@ -2734,7 +2668,6 @@ static struct iwl_lib_ops iwl3945_lib = {
        .isr_ops = {
                .isr = iwl_isr_legacy,
        },
-        .check_plcp_health = iwl3945_good_plcp_health,
        .debugfs_ops = {
                .rx_stats_read = iwl3945_ucode_rx_stats_read,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 3f1e5f1bf847..91a9f5253469 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2624,6 +2624,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
        .fw_name_pre = IWL4965_FW_PRE,
        .ucode_api_max = IWL4965_UCODE_API_MAX,
        .ucode_api_min = IWL4965_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
        .valid_tx_ant = ANT_AB,
        .valid_rx_ant = ANT_ABC,
        .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 79ab0a6b1386..537fb8c84e3a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -51,7 +51,7 @@
 #include "iwl-agn-debugfs.h"
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index af505bcd7ae0..ef36aff1bb43 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -681,6 +681,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
        .fw_name_pre = IWL6050_FW_PRE,                          \
        .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
        .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .valid_tx_ant = ANT_AB,         /* .cfg overwrite */    \
+        .valid_rx_ant = ANT_AB,         /* .cfg overwrite */    \
        .ops = &iwl6050_ops,                                    \
        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,               \
        .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
index 14ceb4df72f6..27b5a3eec9dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -152,11 +152,14 @@ int iwl_eeprom_check_sku(struct iwl_priv *priv)
        eeprom_sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
-        priv->cfg->sku = ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
+        if (!priv->cfg->sku) {
+                /* not using sku overwrite */
+                priv->cfg->sku =
+                        ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
                        EEPROM_SKU_CAP_BAND_POS);
-        if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
+                if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
-                priv->cfg->sku |= IWL_SKU_N;
+                        priv->cfg->sku |= IWL_SKU_N;
+        }
        if (!priv->cfg->sku) {
                IWL_ERR(priv, "Invalid device sku\n");
                return -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36335b1b54d4..c1cfd9952e52 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1157,6 +1157,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
        /* only Re-enable if disabled by irq */
        if (test_bit(STATUS_INT_ENABLED, &priv->status))
                iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 #ifdef CONFIG_IWLWIFI_DEBUG
        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1371,6 +1374,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
        /* only Re-enable if disabled by irq */
        if (test_bit(STATUS_INT_ENABLED, &priv->status))
                iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 }
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 1eacba4daa5b..0494d7b102d4 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -199,6 +199,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
        while (i != idx) {
                u16 len;
                struct sk_buff *skb;
+                dma_addr_t dma_addr;
                desc = &ring[i];
                len = le16_to_cpu(desc->len);
                skb = rx_buf[i];
@@ -216,17 +217,20 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
                        len = priv->common.rx_mtu;
                }
+                dma_addr = le32_to_cpu(desc->host_addr);
+                pci_dma_sync_single_for_cpu(priv->pdev, dma_addr,
+                        priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
                skb_put(skb, len);
                if (p54_rx(dev, skb)) {
-                        pci_unmap_single(priv->pdev,
+                        pci_unmap_single(priv->pdev, dma_addr,
-                                         le32_to_cpu(desc->host_addr),
+                                priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
-                                         priv->common.rx_mtu + 32,
-                                         PCI_DMA_FROMDEVICE);
                        rx_buf[i] = NULL;
-                        desc->host_addr = 0;
+                        desc->host_addr = cpu_to_le32(0);
                } else {
                        skb_trim(skb, 0);
+                        pci_dma_sync_single_for_device(priv->pdev, dma_addr,
+                                priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
                        desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
                }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 21713a7638c4..9b344a921e74 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -98,6 +98,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
        {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
        {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
+        {USB_DEVICE(0x1740, 0x1000)},   /* Senao NUB-350 */
        {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
        {USB_DEVICE(0x2001, 0x3705)},   /* D-Link DWL-G120 rev C1 */
        {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 848cc2cce247..518542b4bf9e 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2597,6 +2597,9 @@ static int rndis_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
        __le32 mode;
        int ret;
+        if (priv->device_type != RNDIS_BCM4320B)
+                return -ENOTSUPP;
        netdev_dbg(usbdev->net, "%s(): %s, %d\n", __func__,
                                enabled ? "enabled" : "disabled",
                                timeout);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index aa97971a38af..3b3f1e45ab3e 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -652,6 +652,12 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                 */
                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+                /*
+                 * The hardware has already checked the Michael Mic and has
+                 * stripped it from the frame. Signal this to mac80211.
+                 */
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                        rxdesc->flags |= RX_FLAG_DECRYPTED;
                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
@@ -1065,6 +1071,8 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
        { PCI_DEVICE(0x1814, 0x3390), PCI_DEVICE_DATA(&rt2800pci_ops) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT35XX
+        { PCI_DEVICE(0x1432, 0x7711), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7722), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index b97a4a54ff4c..197a36c05fda 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -486,6 +486,12 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
                 */
                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+                /*
+                 * The hardware has already checked the Michael Mic and has
+                 * stripped it from the frame. Signal this to mac80211.
+                 */
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                        rxdesc->flags |= RX_FLAG_DECRYPTED;
                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 0b4e8590cbb7..029be3c6c030 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2446,6 +2446,7 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Qcom */
        { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index b8433f3a9bc2..62876cd5c41a 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -726,9 +726,9 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data)
 }
 static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
-                                u8 efuse_data, u8 offset, int *bcontinual,
+                        u8 efuse_data, u8 offset, int *bcontinual,
-                                u8 *write_state, struct pgpkt_struct target_pkt,
+                        u8 *write_state, struct pgpkt_struct *target_pkt,
-                                int *repeat_times, int *bresult, u8 word_en)
+                        int *repeat_times, int *bresult, u8 word_en)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct pgpkt_struct tmp_pkt;
@@ -744,8 +744,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
        tmp_pkt.word_en = tmp_header & 0x0F;
        tmp_word_cnts = efuse_calculate_word_cnts(tmp_pkt.word_en);
-        if (tmp_pkt.offset != target_pkt.offset) {
+        if (tmp_pkt.offset != target_pkt->offset) {
-                efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+                *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                *write_state = PG_STATE_HEADER;
        } else {
                for (tmpindex = 0; tmpindex < (tmp_word_cnts * 2); tmpindex++) {
@@ -756,23 +756,23 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                }
                if (bdataempty == false) {
-                        efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+                        *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                        *write_state = PG_STATE_HEADER;
                } else {
                        match_word_en = 0x0F;
-                        if (!((target_pkt.word_en & BIT(0)) |
+                        if (!((target_pkt->word_en & BIT(0)) |
                             (tmp_pkt.word_en & BIT(0))))
                                match_word_en &= (~BIT(0));
-                        if (!((target_pkt.word_en & BIT(1)) |
+                        if (!((target_pkt->word_en & BIT(1)) |
                             (tmp_pkt.word_en & BIT(1))))
                                match_word_en &= (~BIT(1));
-                        if (!((target_pkt.word_en & BIT(2)) |
+                        if (!((target_pkt->word_en & BIT(2)) |
                             (tmp_pkt.word_en & BIT(2))))
                                match_word_en &= (~BIT(2));
-                        if (!((target_pkt.word_en & BIT(3)) |
+                        if (!((target_pkt->word_en & BIT(3)) |
                             (tmp_pkt.word_en & BIT(3))))
                                match_word_en &= (~BIT(3));
@@ -780,7 +780,7 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                badworden = efuse_word_enable_data_write(
                                                            hw, *efuse_addr + 1,
                                                            tmp_pkt.word_en,
-                                                            target_pkt.data);
+                                                            target_pkt->data);
                                if (0x0F != (badworden & 0x0F)) {
                                        u8 reorg_offset = offset;
@@ -791,26 +791,26 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                }
                                tmp_word_en = 0x0F;
-                                if ((target_pkt.word_en & BIT(0)) ^
+                                if ((target_pkt->word_en & BIT(0)) ^
                                    (match_word_en & BIT(0)))
                                        tmp_word_en &= (~BIT(0));
-                                if ((target_pkt.word_en & BIT(1)) ^
+                                if ((target_pkt->word_en & BIT(1)) ^
                                    (match_word_en & BIT(1)))
                                        tmp_word_en &= (~BIT(1));
-                                if ((target_pkt.word_en & BIT(2)) ^
+                                if ((target_pkt->word_en & BIT(2)) ^
                                        (match_word_en & BIT(2)))
                                        tmp_word_en &= (~BIT(2));
-                                if ((target_pkt.word_en & BIT(3)) ^
+                                if ((target_pkt->word_en & BIT(3)) ^
                                    (match_word_en & BIT(3)))
                                        tmp_word_en &= (~BIT(3));
                                if ((tmp_word_en & 0x0F) != 0x0F) {
                                        *efuse_addr = efuse_get_current_size(hw);
-                                        target_pkt.offset = offset;
+                                        target_pkt->offset = offset;
-                                        target_pkt.word_en = tmp_word_en;
+                                        target_pkt->word_en = tmp_word_en;
                                } else
                                        *bcontinual = false;
                                *write_state = PG_STATE_HEADER;
@@ -821,8 +821,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                }
                        } else {
                                *efuse_addr += (2 * tmp_word_cnts) + 1;
-                                target_pkt.offset = offset;
+                                target_pkt->offset = offset;
-                                target_pkt.word_en = word_en;
+                                target_pkt->word_en = word_en;
                                *write_state = PG_STATE_HEADER;
                        }
                }
@@ -938,7 +938,7 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
                                efuse_write_data_case1(hw, &efuse_addr,
                                                       efuse_data, offset,
                                                       &bcontinual,
-                                                       &write_state, target_pkt,
+                                                       &write_state, &target_pkt,
                                                       &repeat_times, &bresult,
                                                       word_en);
                        else
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0fa36aa6701a..1758d4463247 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -619,6 +619,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                        struct sk_buff *uskb = NULL;
                                        u8 *pdata;
                                        uskb = dev_alloc_skb(skb->len + 128);
+                                        if (!uskb) {
+                                                RT_TRACE(rtlpriv,
+                                                        (COMP_INTR | COMP_RECV),
+                                                        DBG_EMERG,
+                                                        ("can't alloc rx skb\n"));
+                                                goto done;
+                                        }
                                        memcpy(IEEE80211_SKB_RXCB(uskb),
                                                        &rx_status,
                                                        sizeof(rx_status));
@@ -641,7 +648,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                        new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
                        if (unlikely(!new_skb)) {
                                RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
+                                         DBG_EMERG,
                                         ("can't alloc skb for rx\n"));
                                goto done;
                        }
@@ -1066,9 +1073,9 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                        struct sk_buff *skb =
                            dev_alloc_skb(rtlpci->rxbuffersize);
                        u32 bufferaddress;
-                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
                        if (!skb)
                                return 0;
+                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
                        /*skb->dev = dev; */
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 012e1a4016fe..40372bac9482 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -1039,6 +1039,9 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
        if (changed & BSS_CHANGED_BEACON) {
                beacon = ieee80211_beacon_get(hw, vif);
+                if (!beacon)
+                        goto out_sleep;
                ret = wl1251_cmd_template_set(wl, CMD_BEACON, beacon->data,
                                              beacon->len);
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 46714910f98c..7145ea543783 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl)
        spi_message_add_tail(&t, &m);
        spi_sync(wl_to_spi(wl), &m);
-        kfree(cmd);
        wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 static void wl1271_spi_init(struct wl1271 *wl)