29 files changed, 134 insertions, 202 deletions
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7116a1aa20ce..abf896a7390e 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -4790,9 +4790,8 @@ static int proc_stats_rid_open( struct inode *inode,
 static int get_dec_u16( char *buffer, int *start, int limit ) {
        u16 value;
        int valid = 0;
-        for( value = 0; buffer[*start] >= '0' &&
+        for (value = 0; *start < limit && buffer[*start] >= '0' &&
-                     buffer[*start] <= '9' &&
+                        buffer[*start] <= '9'; (*start)++) {
-                     *start < limit; (*start)++ ) {
                valid = 1;
                value *= 10;
                value += buffer[*start] - '0';
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 9c6ab5378f6e..95a8e232b58f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1125,7 +1125,6 @@ ath5k_mode_setup(struct ath5k_softc *sc)
        /* configure operational mode */
        ath5k_hw_set_opmode(ah);
-        ath5k_hw_set_mcast_filter(ah, 0, 0);
        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "RX filter 0x%x\n", rfilt);
 }
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index b767c3b67b24..b548c8eaaae1 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -63,12 +63,16 @@ static const struct pci_device_id ath5k_led_devices[] = {
        { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0422), ATH_LED(1, 1) },
        /* E-machines E510 (tuliom@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0428), ATH_LED(3, 0) },
+        /* BenQ Joybook R55v (nowymarluk@wp.pl) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0100), ATH_LED(1, 0) },
        /* Acer Extensa 5620z (nekoreeve@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0105), ATH_LED(3, 0) },
        /* Fukato Datacask Jupiter 1014a (mrb74@gmx.at) */
        { ATH_SDEVICE(PCI_VENDOR_ID_AZWAVE, 0x1026), ATH_LED(3, 0) },
        /* IBM ThinkPad AR5BXB6 (legovini@spiro.fisica.unipd.it) */
        { ATH_SDEVICE(PCI_VENDOR_ID_IBM, 0x058a), ATH_LED(1, 0) },
+        /* HP Compaq CQ60-206US (ddreggors@jumptv.com) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) },
        /* HP Compaq C700 (nitrousnrg@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
        /* IBM-specific AR5212 (all others) */
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 16a271787b85..1895d63aad0a 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -679,7 +679,7 @@ static u8 ath_rc_get_highest_rix(struct ath_softc *sc,
                return rate;
        if (rate_table->info[rate].valid_single_stream &&
-            !(ath_rc_priv->ht_cap & WLAN_RC_DS_FLAG));
+            !(ath_rc_priv->ht_cap & WLAN_RC_DS_FLAG))
                return rate;
        /* This should not happen */
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 8701034569fa..de4e804bedf0 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1157,8 +1157,9 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
 }
 static int dma_tx_fragment(struct b43_dmaring *ring,
-                           struct sk_buff *skb)
+                           struct sk_buff **in_skb)
 {
+        struct sk_buff *skb = *in_skb;
        const struct b43_dma_ops *ops = ring->ops;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        u8 *header;
@@ -1224,8 +1225,14 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
                }
                memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+                bounce_skb->dev = skb->dev;
+                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+                info = IEEE80211_SKB_CB(bounce_skb);
                dev_kfree_skb_any(skb);
                skb = bounce_skb;
+                *in_skb = bounce_skb;
                meta->skb = skb;
                meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
                if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1355,7 +1362,11 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
         * static, so we don't need to store it per frame. */
        ring->queue_prio = skb_get_queue_mapping(skb);
-        err = dma_tx_fragment(ring, skb);
+        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+         * into the skb data or cb now. */
+        hdr = NULL;
+        info = NULL;
+        err = dma_tx_fragment(ring, &skb);
        if (unlikely(err == -ENOKEY)) {
                /* Drop this packet, as we don't have the encryption key
                 * anymore and must not transmit it unencrypted. */
diff --git a/drivers/net/wireless/b43/leds.h b/drivers/net/wireless/b43/leds.h
index 4c56187810fc..32b66d53cdac 100644
--- a/drivers/net/wireless/b43/leds.h
+++ b/drivers/net/wireless/b43/leds.h
@@ -1,6 +1,7 @@
 #ifndef B43_LEDS_H_
 #define B43_LEDS_H_
+struct b43_wl;
 struct b43_wldev;
 #ifdef CONFIG_B43_LEDS
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index df6b26a0c05e..098dda1a67c1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4501,7 +4501,6 @@ static void b43_op_stop(struct ieee80211_hw *hw)
        cancel_work_sync(&(wl->beacon_update_trigger));
-        wiphy_rfkill_stop_polling(hw->wiphy);
        mutex_lock(&wl->mutex);
        if (b43_status(dev) >= B43_STAT_STARTED) {
                dev = b43_wireless_core_stop(dev);
@@ -4522,9 +4521,8 @@ static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
-        mutex_lock(&wl->mutex);
+        /* FIXME: add locking */
        b43_update_templates(wl);
-        mutex_unlock(&wl->mutex);
        return 0;
 }
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 7a3218c5ba7d..ffdce6f3c909 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -33,7 +33,8 @@ bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
                      & B43_MMIO_RADIO_HWENABLED_HI_MASK))
                        return 1;
        } else {
-                if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+                if (b43_status(dev) >= B43_STAT_STARTED &&
+                    b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
                    & B43_MMIO_RADIO_HWENABLED_LO_MASK)
                        return 1;
        }
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 240cff1e6979..6e2fc0cb6f8a 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6029,7 +6029,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
        struct ipw2100_priv *priv;
        struct net_device *dev;
-        dev = alloc_ieee80211(sizeof(struct ipw2100_priv), 0);
+        dev = alloc_ieee80211(sizeof(struct ipw2100_priv));
        if (!dev)
                return NULL;
        priv = libipw_priv(dev);
@@ -6342,7 +6342,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                sysfs_remove_group(&pci_dev->dev.kobj,
                                   &ipw2100_attribute_group);
-                free_ieee80211(dev, 0);
+                free_ieee80211(dev);
                pci_set_drvdata(pci_dev, NULL);
        }
@@ -6400,7 +6400,7 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
                if (dev->base_addr)
                        iounmap((void __iomem *)dev->base_addr);
-                free_ieee80211(dev, 0);
+                free_ieee80211(dev);
        }
        pci_release_regions(pci_dev);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 827824d45de9..a6ca536e44f8 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -104,25 +104,6 @@ static int antenna = CFG_SYS_ANTENNA_BOTH;
 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
 #endif
-static struct ieee80211_rate ipw2200_rates[] = {
-        { .bitrate = 10 },
-        { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 60 },
-        { .bitrate = 90 },
-        { .bitrate = 120 },
-        { .bitrate = 180 },
-        { .bitrate = 240 },
-        { .bitrate = 360 },
-        { .bitrate = 480 },
-        { .bitrate = 540 }
-};
-#define ipw2200_a_rates         (ipw2200_rates + 4)
-#define ipw2200_num_a_rates     8
-#define ipw2200_bg_rates        (ipw2200_rates + 0)
-#define ipw2200_num_bg_rates    12
 #ifdef CONFIG_IPW2200_QOS
 static int qos_enable = 0;
@@ -8674,6 +8655,24 @@ static int ipw_sw_reset(struct ipw_priv *priv, int option)
 *
 */
+static int ipw_wx_get_name(struct net_device *dev,
+                           struct iw_request_info *info,
+                           union iwreq_data *wrqu, char *extra)
+{
+        struct ipw_priv *priv = libipw_priv(dev);
+        mutex_lock(&priv->mutex);
+        if (priv->status & STATUS_RF_KILL_MASK)
+                strcpy(wrqu->name, "radio off");
+        else if (!(priv->status & STATUS_ASSOCIATED))
+                strcpy(wrqu->name, "unassociated");
+        else
+                snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
+                         ipw_modes[priv->assoc_request.ieee_mode]);
+        IPW_DEBUG_WX("Name: %s\n", wrqu->name);
+        mutex_unlock(&priv->mutex);
+        return 0;
+}
 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
 {
        if (channel == 0) {
@@ -9973,7 +9972,7 @@ static int ipw_wx_sw_reset(struct net_device *dev,
 /* Rebase the WE IOCTLs to zero for the handler array */
 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
 static iw_handler ipw_wx_handlers[] = {
-        IW_IOCTL(SIOCGIWNAME) = (iw_handler) cfg80211_wext_giwname,
+        IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
        IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
        IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
        IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
@@ -11417,100 +11416,16 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
-        int i, rc = 0;
        struct ipw_priv *priv = libipw_priv(dev);
-        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
-        struct wireless_dev *wdev = &priv->ieee->wdev;
        mutex_lock(&priv->mutex);
        if (ipw_up(priv)) {
-                rc = -EIO;
+                mutex_unlock(&priv->mutex);
-                goto out;
+                return -EIO;
-        }
-        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
-        /* fill-out priv->ieee->bg_band */
-        if (geo->bg_channels) {
-                struct ieee80211_supported_band *bg_band = &priv->ieee->bg_band;
-                bg_band->band = IEEE80211_BAND_2GHZ;
-                bg_band->n_channels = geo->bg_channels;
-                bg_band->channels =
-                        kzalloc(geo->bg_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
-                /* translate geo->bg to bg_band.channels */
-                for (i = 0; i < geo->bg_channels; i++) {
-                        bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
-                        bg_band->channels[i].center_freq = geo->bg[i].freq;
-                        bg_band->channels[i].hw_value = geo->bg[i].channel;
-                        bg_band->channels[i].max_power = geo->bg[i].max_power;
-                        if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
-                        if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
-                        if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_RADAR;
-                        /* No equivalent for LIBIPW_CH_80211H_RULES,
-                           LIBIPW_CH_UNIFORM_SPREADING, or
-                           LIBIPW_CH_B_ONLY... */
-                }
-                /* point at bitrate info */
-                bg_band->bitrates = ipw2200_bg_rates;
-                bg_band->n_bitrates = ipw2200_num_bg_rates;
-                wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
-        }
-        /* fill-out priv->ieee->a_band */
-        if (geo->a_channels) {
-                struct ieee80211_supported_band *a_band = &priv->ieee->a_band;
-                a_band->band = IEEE80211_BAND_5GHZ;
-                a_band->n_channels = geo->a_channels;
-                a_band->channels =
-                        kzalloc(geo->a_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
-                /* translate geo->bg to a_band.channels */
-                for (i = 0; i < geo->a_channels; i++) {
-                        a_band->channels[i].band = IEEE80211_BAND_2GHZ;
-                        a_band->channels[i].center_freq = geo->a[i].freq;
-                        a_band->channels[i].hw_value = geo->a[i].channel;
-                        a_band->channels[i].max_power = geo->a[i].max_power;
-                        if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
-                        if (geo->a[i].flags & LIBIPW_CH_NO_IBSS)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
-                        if (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_RADAR;
-                        /* No equivalent for LIBIPW_CH_80211H_RULES,
-                           LIBIPW_CH_UNIFORM_SPREADING, or
-                           LIBIPW_CH_B_ONLY... */
-                }
-                /* point at bitrate info */
-                a_band->bitrates = ipw2200_a_rates;
-                a_band->n_bitrates = ipw2200_num_a_rates;
-                wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
-        }
-        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
-        /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
-                rc = -EIO;
-                goto out;
        }
-out:
        mutex_unlock(&priv->mutex);
-        return rc;
+        return 0;
 }
 /* PCI driver stuff */
@@ -11641,7 +11556,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
        if (priv->prom_net_dev)
                return -EPERM;
-        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv), 1);
+        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
        if (priv->prom_net_dev == NULL)
                return -ENOMEM;
@@ -11660,7 +11575,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
        rc = register_netdev(priv->prom_net_dev);
        if (rc) {
-                free_ieee80211(priv->prom_net_dev, 1);
+                free_ieee80211(priv->prom_net_dev);
                priv->prom_net_dev = NULL;
                return rc;
        }
@@ -11674,7 +11589,7 @@ static void ipw_prom_free(struct ipw_priv *priv)
                return;
        unregister_netdev(priv->prom_net_dev);
-        free_ieee80211(priv->prom_net_dev, 1);
+        free_ieee80211(priv->prom_net_dev);
        priv->prom_net_dev = NULL;
 }
@@ -11702,7 +11617,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        struct ipw_priv *priv;
        int i;
-        net_dev = alloc_ieee80211(sizeof(struct ipw_priv), 0);
+        net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
        if (net_dev == NULL) {
                err = -ENOMEM;
                goto out;
@@ -11850,7 +11765,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
      out_free_ieee80211:
-        free_ieee80211(priv->net_dev, 0);
+        free_ieee80211(priv->net_dev);
      out:
        return err;
 }
@@ -11917,7 +11832,7 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
        pci_release_regions(pdev);
        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
-        free_ieee80211(priv->net_dev, 0);
+        free_ieee80211(priv->net_dev);
        free_firmware();
 }
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index bf45391172f3..1e334ff6bd52 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -31,7 +31,6 @@
 #include <linux/ieee80211.h>
 #include <net/lib80211.h>
-#include <net/cfg80211.h>
 #define LIBIPW_VERSION "git-1.1.13"
@@ -784,15 +783,12 @@ struct libipw_geo {
 struct libipw_device {
        struct net_device *dev;
-        struct wireless_dev wdev;
        struct libipw_security sec;
        /* Bookkeeping structures */
        struct libipw_stats ieee_stats;
        struct libipw_geo geo;
-        struct ieee80211_supported_band bg_band;
-        struct ieee80211_supported_band a_band;
        /* Probe / Beacon management */
        struct list_head network_free_list;
@@ -1018,8 +1014,8 @@ static inline int libipw_is_cck_rate(u8 rate)
 }
 /* ieee80211.c */
-extern void free_ieee80211(struct net_device *dev, int monitor);
+extern void free_ieee80211(struct net_device *dev);
-extern struct net_device *alloc_ieee80211(int sizeof_priv, int monitor);
+extern struct net_device *alloc_ieee80211(int sizeof_priv);
 extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
 extern void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index a0e9f6aed7da..eb2b60834c17 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -62,9 +62,6 @@ MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_AUTHOR(DRV_COPYRIGHT);
 MODULE_LICENSE("GPL");
-struct cfg80211_ops libipw_config_ops = { };
-void *libipw_wiphy_privid = &libipw_wiphy_privid;
 static int libipw_networks_allocate(struct libipw_device *ieee)
 {
        if (ieee->networks)
@@ -143,7 +140,7 @@ int libipw_change_mtu(struct net_device *dev, int new_mtu)
 }
 EXPORT_SYMBOL(libipw_change_mtu);
-struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
+struct net_device *alloc_ieee80211(int sizeof_priv)
 {
        struct libipw_device *ieee;
        struct net_device *dev;
@@ -160,31 +157,10 @@ struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
        ieee->dev = dev;
-        if (!monitor) {
-                ieee->wdev.wiphy = wiphy_new(&libipw_config_ops, 0);
-                if (!ieee->wdev.wiphy) {
-                        LIBIPW_ERROR("Unable to allocate wiphy.\n");
-                        goto failed_free_netdev;
-                }
-                ieee->dev->ieee80211_ptr = &ieee->wdev;
-                ieee->wdev.iftype = NL80211_IFTYPE_STATION;
-                /* Fill-out wiphy structure bits we know...  Not enough info
-                   here to call set_wiphy_dev or set MAC address or channel info
-                   -- have to do that in ->ndo_init... */
-                ieee->wdev.wiphy->privid = libipw_wiphy_privid;
-                ieee->wdev.wiphy->max_scan_ssids = 1;
-                ieee->wdev.wiphy->max_scan_ie_len = 0;
-                ieee->wdev.wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION)
-                                                | BIT(NL80211_IFTYPE_ADHOC);
-        }
        err = libipw_networks_allocate(ieee);
        if (err) {
                LIBIPW_ERROR("Unable to allocate beacon storage: %d\n", err);
-                goto failed_free_wiphy;
+                goto failed_free_netdev;
        }
        libipw_networks_initialize(ieee);
@@ -217,31 +193,19 @@ struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
        return dev;
-failed_free_wiphy:
-        if (!monitor)
-                wiphy_free(ieee->wdev.wiphy);
 failed_free_netdev:
        free_netdev(dev);
 failed:
        return NULL;
 }
-void free_ieee80211(struct net_device *dev, int monitor)
+void free_ieee80211(struct net_device *dev)
 {
        struct libipw_device *ieee = netdev_priv(dev);
        lib80211_crypt_info_free(&ieee->crypt_info);
        libipw_networks_free(ieee);
-        /* free cfg80211 resources */
-        if (!monitor) {
-                wiphy_unregister(ieee->wdev.wiphy);
-                kfree(ieee->a_band.channels);
-                kfree(ieee->bg_band.channels);
-                wiphy_free(ieee->wdev.wiphy);
-        }
        free_netdev(dev);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 2716b91ba9fa..950267ab556a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -161,5 +161,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
        .shadow_ram_support = false,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c295b8ee9228..1473452ba22f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -175,6 +175,7 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 /*
@@ -198,6 +199,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -218,6 +220,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -238,6 +241,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6050_3agn_cfg = {
@@ -258,6 +262,7 @@ struct iwl_cfg iwl6050_3agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 346dc06fa7b7..81726ee32858 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -418,6 +418,15 @@ static void rs_tl_turn_on_agg(struct iwl_priv *priv, u8 tid,
        else if (tid == IWL_AGG_ALL_TID)
                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
                        rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
+        if (priv->cfg->use_rts_for_ht) {
+                /*
+                 * switch to RTS/CTS if it is the prefer protection method
+                 * for HT traffic
+                 */
+                IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
+                priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+                iwlcore_commit_rxon(priv);
+        }
 }
 static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index eaafae091f5b..921dc4a26fe2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -116,9 +116,6 @@ int iwl_commit_rxon(struct iwl_priv *priv)
        /* always get timestamp with Rx frame */
        priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
-        /* allow CTS-to-self if possible. this is relevant only for
-         * 5000, but will not damage 4965 */
-        priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
        ret = iwl_check_rxon_cmd(priv);
        if (ret) {
@@ -218,6 +215,13 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                                        "Could not send WEP static key.\n");
                }
+                /*
+                 * allow CTS-to-self if possible for new association.
+                 * this is relevant only for 5000 series and up,
+                 * but will not damage 4965
+                 */
+                priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
                /* Apply the new configuration
                 * RXON assoc doesn't clear the station table in uCode,
                 */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index e50103a956b1..7754538c2194 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -213,6 +213,7 @@ struct iwl_mod_params {
 * @pa_type: used by 6000 series only to identify the type of Power Amplifier
 * @max_ll_items: max number of OTP blocks
 * @shadow_ram_support: shadow support for OTP memory
+ * @use_rts_for_ht: use rts/cts protection for HT traffic
 *
 * We enable the driver to be backward compatible wrt API version. The
 * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -255,6 +256,7 @@ struct iwl_cfg {
        const bool shadow_ram_support;
        const bool ht_greenfield_support;
        const bool broken_powersave;
+        bool use_rts_for_ht;
 };
 /***************************
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 039b555e4d76..53d56ab83c03 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -169,16 +169,19 @@ static int lbs_ethtool_set_wol(struct net_device *dev,
        struct lbs_private *priv = dev->ml_priv;
        uint32_t criteria = 0;
-        if (priv->wol_criteria == 0xffffffff && wol->wolopts)
-                return -EOPNOTSUPP;
        if (wol->wolopts & ~(WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY))
                return -EOPNOTSUPP;
-        if (wol->wolopts & WAKE_UCAST) criteria |= EHS_WAKE_ON_UNICAST_DATA;
+        if (wol->wolopts & WAKE_UCAST)
-        if (wol->wolopts & WAKE_MCAST) criteria |= EHS_WAKE_ON_MULTICAST_DATA;
+                criteria |= EHS_WAKE_ON_UNICAST_DATA;
-        if (wol->wolopts & WAKE_BCAST) criteria |= EHS_WAKE_ON_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_MCAST)
-        if (wol->wolopts & WAKE_PHY)   criteria |= EHS_WAKE_ON_MAC_EVENT;
+                criteria |= EHS_WAKE_ON_MULTICAST_DATA;
+        if (wol->wolopts & WAKE_BCAST)
+                criteria |= EHS_WAKE_ON_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_PHY)
+                criteria |= EHS_WAKE_ON_MAC_EVENT;
+        if (wol->wolopts == 0)
+                criteria |= EHS_REMOVE_WAKEUP;
        return lbs_host_sleep_cfg(priv, criteria, (struct wol_config *)NULL);
 }
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index cb8be8d7abc1..5b3672c4d0cc 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -134,7 +134,7 @@ static void spu_transaction_finish(struct if_spi_card *card)
 static int spu_write(struct if_spi_card *card, u16 reg, const u8 *buf, int len)
 {
        int err = 0;
-        u16 reg_out = cpu_to_le16(reg | IF_SPI_WRITE_OPERATION_MASK);
+        __le16 reg_out = cpu_to_le16(reg | IF_SPI_WRITE_OPERATION_MASK);
        struct spi_message m;
        struct spi_transfer reg_trans;
        struct spi_transfer data_trans;
@@ -166,7 +166,7 @@ static int spu_write(struct if_spi_card *card, u16 reg, const u8 *buf, int len)
 static inline int spu_write_u16(struct if_spi_card *card, u16 reg, u16 val)
 {
-        u16 buff;
+        __le16 buff;
        buff = cpu_to_le16(val);
        return spu_write(card, reg, (u8 *)&buff, sizeof(u16));
@@ -188,7 +188,7 @@ static int spu_read(struct if_spi_card *card, u16 reg, u8 *buf, int len)
 {
        unsigned int delay;
        int err = 0;
-        u16 reg_out = cpu_to_le16(reg | IF_SPI_READ_OPERATION_MASK);
+        __le16 reg_out = cpu_to_le16(reg | IF_SPI_READ_OPERATION_MASK);
        struct spi_message m;
        struct spi_transfer reg_trans;
        struct spi_transfer dummy_trans;
@@ -235,7 +235,7 @@ static int spu_read(struct if_spi_card *card, u16 reg, u8 *buf, int len)
 /* Read 16 bits from an SPI register */
 static inline int spu_read_u16(struct if_spi_card *card, u16 reg, u16 *val)
 {
-        u16 buf;
+        __le16 buf;
        int ret;
        ret = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
@@ -248,7 +248,7 @@ static inline int spu_read_u16(struct if_spi_card *card, u16 reg, u16 *val)
 * The low 16 bits are read first. */
 static int spu_read_u32(struct if_spi_card *card, u16 reg, u32 *val)
 {
-        u32 buf;
+        __le32 buf;
        int err;
        err = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 92bc8c5f1ca2..3fac4efa5ac8 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -508,7 +508,7 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
        /* Fill the receive configuration URB and initialise the Rx call back */
        usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
                          usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
-                          (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET),
+                          skb->data + IPFIELD_ALIGN_OFFSET,
                          MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
                          cardp);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 17e199546eeb..92af9b96bb7a 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -426,12 +426,16 @@ static const char p54u_romboot_3887[] = "~~~~";
 static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
 {
        struct p54u_priv *priv = dev->priv;
-        u8 buf[4];
+        u8 *buf;
        int ret;
-        memcpy(&buf, p54u_romboot_3887, sizeof(buf));
+        buf = kmalloc(4, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        memcpy(buf, p54u_romboot_3887, 4);
        ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
-                            buf, sizeof(buf));
+                            buf, 4);
+        kfree(buf);
        if (ret)
                dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
                        "boot ROM (%d)!\n", ret);
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 88cd58eb3b9f..1c88c2ea59aa 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -2879,7 +2879,7 @@ static int write_essid(struct file *file, const char __user *buffer,
                       unsigned long count, void *data)
 {
        static char proc_essid[33];
-        int len = count;
+        unsigned int len = count;
        if (len > 32)
                len = 32;
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a084077a1c61..9fe770f7d7bb 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1994,7 +1994,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
-                               (skbdesc->entry->entry_idx + 1) : 0xff);
+                           txdesc->key_idx : 0xff);
        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
                           skb->len - txdesc->l2pad);
        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 71761b343839..73bbec58341e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -815,6 +815,8 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        mutex_init(&rt2x00dev->csr_mutex);
+        set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
        /*
         * Make room for rt2x00_intf inside the per-interface
         * structure ieee80211_vif.
@@ -871,8 +873,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00leds_register(rt2x00dev);
        rt2x00debug_register(rt2x00dev);
-        set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
        return 0;
 exit:
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index c64db0ba7f40..c708d0be9155 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -362,8 +362,9 @@ void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
        rt2x00link_reset_tuner(rt2x00dev, false);
-        ieee80211_queue_delayed_work(rt2x00dev->hw,
+        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                                     &link->work, LINK_TUNE_INTERVAL);
+                ieee80211_queue_delayed_work(rt2x00dev->hw,
+                                             &link->work, LINK_TUNE_INTERVAL);
 }
 void rt2x00link_stop_tuner(struct rt2x00_dev *rt2x00dev)
@@ -469,8 +470,10 @@ static void rt2x00link_tuner(struct work_struct *work)
         * Increase tuner counter, and reschedule the next link tuner run.
         */
        link->count++;
-        ieee80211_queue_delayed_work(rt2x00dev->hw,
-                                     &link->work, LINK_TUNE_INTERVAL);
+        if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                ieee80211_queue_delayed_work(rt2x00dev->hw,
+                                             &link->work, LINK_TUNE_INTERVAL);
 }
 void rt2x00link_register(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 501544882c2c..f02b48a90593 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -47,6 +47,8 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
            (requesttype == USB_VENDOR_REQUEST_IN) ?
            usb_rcvctrlpipe(usb_dev, 0) : usb_sndctrlpipe(usb_dev, 0);
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return -ENODEV;
        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                status = usb_control_msg(usb_dev, pipe, request, requesttype,
@@ -60,8 +62,10 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
                 * -ENODEV: Device has disappeared, no point continuing.
                 * All other errors: Try again.
                 */
-                else if (status == -ENODEV)
+                else if (status == -ENODEV) {
+                        clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
                        break;
+                }
        }
        ERROR(rt2x00dev,
@@ -161,6 +165,9 @@ int rt2x00usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
 {
        unsigned int i;
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return -ENODEV;
        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
                rt2x00usb_register_read_lock(rt2x00dev, offset, reg);
                if (!rt2x00_get_field32(*reg, field))
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index b8f5ee33445e..14e7bb210075 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2389,10 +2389,13 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
        /* MSI */
+        { USB_DEVICE(0x0db0, 0x4600), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Ralink */
        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2420,6 +2423,8 @@ static struct usb_device_id rt73usb_device_table[] = {
        /* Planex */
        { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* WideTell */
+        { USB_DEVICE(0x7167, 0x3840), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Zcom */
        { USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
        /* ZyXEL */
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index a1c670fc1552..cf8a4a40fdf6 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -210,10 +210,10 @@ void rtl8187_leds_exit(struct ieee80211_hw *dev)
        /* turn the LED off before exiting */
        ieee80211_queue_delayed_work(dev, &priv->led_off, 0);
-        cancel_delayed_work_sync(&priv->led_off);
-        cancel_delayed_work_sync(&priv->led_on);
        rtl8187_unregister_led(&priv->led_rx);
        rtl8187_unregister_led(&priv->led_tx);
+        cancel_delayed_work_sync(&priv->led_off);
+        cancel_delayed_work_sync(&priv->led_on);
 }
 #endif /* def CONFIG_RTL8187_LED */
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
index 9fab13e4004e..cad8037ab2af 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
@@ -18,6 +18,7 @@
 #include <net/mac80211.h>
 #include "rtl8187.h"
+#include "rtl8187_rfkill.h"
 static bool rtl8187_is_radio_enabled(struct rtl8187_priv *priv)
 {