19 files changed, 110 insertions, 98 deletions

diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 1a2141dabdc7..8bc4bc4c330e 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -32,6 +32,7 @@ config B43_PCI_AUTOSELECT
         bool
         depends on B43 && SSB_PCIHOST_POSSIBLE
         select SSB_PCIHOST
+        select SSB_B43_PCI_BRIDGE
         default y
 
 # Auto-select SSB PCICORE driver, if possible
diff --git a/drivers/net/wireless/b43legacy/Kconfig b/drivers/net/wireless/b43legacy/Kconfig
index 6745579ba96d..13c65faf0247 100644
--- a/drivers/net/wireless/b43legacy/Kconfig
+++ b/drivers/net/wireless/b43legacy/Kconfig
@@ -25,6 +25,7 @@ config B43LEGACY_PCI_AUTOSELECT
         bool
         depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
         select SSB_PCIHOST
+        select SSB_B43_PCI_BRIDGE
         default y
 
 # Auto-select SSB PCICORE driver, if possible
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e220..5f3f34e1dbfd 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void)
 #ifdef CONFIG_B43LEGACY_DMA
         feat_dma = "D";
 #endif
-        printk(KERN_INFO "Broadcom 43xx driver loaded "
+        printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
                "[ Features: %s%s%s%s%s, Firmware-ID: "
                B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
                feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 0159701e8456..afb8f4305c24 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -1,6 +1,6 @@
 config BCM43XX
         tristate "Broadcom BCM43xx wireless support (DEPRECATED)"
-        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && EXPERIMENTAL
+        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && (!SSB_B43_PCI_BRIDGE || SSB != y) && EXPERIMENTAL
         select WIRELESS_EXT
         select FW_LOADER
         select HW_RANDOM
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index eab020338fde..b3c1acbcc655 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1040,7 +1040,6 @@ int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
         lbs_deb_leave(LBS_DEB_CMD);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_mesh_access);
 
 int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan)
 {
@@ -1576,7 +1575,6 @@ done:
         lbs_deb_leave_args(LBS_DEB_HOST, "ret %d", ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_prepare_and_send_command);
 
 /**
  *  @brief This function allocates the command buffer and link
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a91903..f0ef7081bdeb 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
         }
 
         resp = (void *)priv->upld_buf;
-
-        curcmd = le16_to_cpu(resp->command);
-
+        curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
         respcmd = le16_to_cpu(resp->command);
         result = le16_to_cpu(resp->result);
 
@@ -572,15 +570,15 @@ int lbs_process_rx_command(struct lbs_private *priv)
                      respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
         lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
 
-        if (resp->seqnum != resp->seqnum) {
+        if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
                 lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
-                            le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
+                            le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 ret = -1;
                 goto done;
         }
         if (respcmd != CMD_RET(curcmd) &&
-            respcmd != CMD_802_11_ASSOCIATE && curcmd != CMD_RET_802_11_ASSOCIATE) {
+            respcmd != CMD_RET_802_11_ASSOCIATE && curcmd != CMD_802_11_ASSOCIATE) {
                 lbs_pr_info("Invalid CMD_RESP %x to command %x!\n", respcmd, curcmd);
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 ret = -1;
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index aaacd9bd6bd2..4e22341b4f3d 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -69,7 +69,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev);
 int lbs_remove_card(struct lbs_private *priv);
 int lbs_start_card(struct lbs_private *priv);
 int lbs_stop_card(struct lbs_private *priv);
-int lbs_reset_device(struct lbs_private *priv);
 void lbs_host_to_card_done(struct lbs_private *priv);
 
 int lbs_update_channel(struct lbs_private *priv);
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 84fb49ca0fae..4d4e2f3b66ac 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1351,8 +1351,6 @@ done:
         lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(lbs_add_mesh);
-
 
 static void lbs_remove_mesh(struct lbs_private *priv)
 {
@@ -1372,7 +1370,6 @@ static void lbs_remove_mesh(struct lbs_private *priv)
         free_netdev(mesh_dev);
         lbs_deb_leave(LBS_DEB_MESH);
 }
-EXPORT_SYMBOL_GPL(lbs_remove_mesh);
 
 /**
  *  @brief This function finds the CFP in
@@ -1458,20 +1455,6 @@ void lbs_interrupt(struct lbs_private *priv)
 }
 EXPORT_SYMBOL_GPL(lbs_interrupt);
 
-int lbs_reset_device(struct lbs_private *priv)
-{
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_RESET,
-                                    CMD_ACT_HALT, 0, 0, NULL);
-        msleep_interruptible(10);
-
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(lbs_reset_device);
-
 static int __init lbs_init_module(void)
 {
         lbs_deb_enter(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a8..d191e055a788 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         struct p54_common *priv = dev->priv;
         struct eeprom_pda_wrap *wrap = NULL;
         struct pda_entry *entry;
-        int i = 0;
         unsigned int data_len, entry_len;
         void *tmp;
         int err;
+        u8 *end = (u8 *)eeprom + len;
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
-        entry = (void *)wrap->data + wrap->len;
-        i += 2;
-        i += le16_to_cpu(entry->len)*2;
-        while (i < len) {
+        entry = (void *)wrap->data + le16_to_cpu(wrap->len);
+
+        /* verify that at least the entry length/code fits */
+        while ((u8 *)entry <= end - sizeof(*entry)) {
                 entry_len = le16_to_cpu(entry->len);
                 data_len = ((entry_len - 1) << 1);
+
+                /* abort if entry exceeds whole structure */
+                if ((u8 *)entry + sizeof(*entry) + data_len > end)
+                        break;
+
                 switch (le16_to_cpu(entry->code)) {
                 case PDR_MAC_ADDRESS:
                         SET_IEEE80211_PERM_ADDR(dev, entry->data);
@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         priv->version = *(u8 *)(entry->data + 1);
                         break;
                 case PDR_END:
-                        i = len;
+                        /* make it overrun */
+                        entry_len = len;
                         break;
                 }
 
                 entry = (void *)entry + (entry_len + 1)*2;
-                i += 2;
-                i += entry_len*2;
         }
 
         if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d9..b67ff34e26fe 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -53,10 +53,10 @@ struct pda_entry {
 } __attribute__ ((packed));
 
 struct eeprom_pda_wrap {
-        u32 magic;
-        u16 pad;
-        u16 len;
-        u32 arm_opcode;
+        __le32 magic;
+        __le16 pad;
+        __le16 len;
+        __le32 arm_opcode;
         u8 data[0];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 8ce2ddf8024f..10b776c1adc5 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -228,9 +228,9 @@ struct NDIS_WLAN_BSSID_EX {
         struct NDIS_802_11_SSID Ssid;
         __le32 Privacy;
         __le32 Rssi;
-        enum NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
+        __le32 NetworkTypeInUse;
         struct NDIS_802_11_CONFIGURATION Configuration;
-        enum NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
+        __le32 InfrastructureMode;
         u8 SupportedRates[NDIS_802_11_LENGTH_RATES_EX];
         __le32 IELength;
         u8 IEs[0];
@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
         __le32 KeyLength;
         u8 Bssid[6];
         u8 Padding[6];
-        __le64 KeyRSC;
+        u8 KeyRSC[8];
         u8 KeyMaterial[32];
 } __attribute__((packed));
 
@@ -279,11 +279,11 @@ struct RNDIS_CONFIG_PARAMETER_INFOBUFFER {
 } __attribute__((packed));
 
 /* these have to match what is in wpa_supplicant */
-enum { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP } wpa_alg;
-enum { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP, CIPHER_WEP104 }
-        wpa_cipher;
-enum { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE, KEY_MGMT_802_1X_NO_WPA,
-        KEY_MGMT_WPA_NONE } wpa_key_mgmt;
+enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP };
+enum wpa_cipher { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
+                  CIPHER_WEP104 };
+enum wpa_key_mgmt { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE,
+                    KEY_MGMT_802_1X_NO_WPA, KEY_MGMT_WPA_NONE };
 
 /*
  *  private data
@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         struct usbnet *usbdev = dev->priv;
         struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
         struct NDIS_802_11_KEY ndis_key;
-        int i, keyidx, ret;
+        int keyidx, ret;
         u8 *addr;
 
         keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         ndis_key.KeyIndex = cpu_to_le32(keyidx);
 
         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-                for (i = 0; i < 6; i++)
-                        ndis_key.KeyRSC |=
-                                cpu_to_le64(ext->rx_seq[i] << (i * 8));
+                memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
                 ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index d6cba138c7ab..c69f85ed7669 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -960,8 +960,12 @@ static int rt2400pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2400pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2400pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index e874fdcae204..91e87b53374f 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1112,8 +1112,12 @@ static int rt2500pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2500pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 4ca9730e5e92..638c3d243108 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1001,8 +1001,12 @@ static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt2500usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt2500usb_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 72cfe00c1ed7..07adc576db49 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -97,12 +97,16 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         libconf.ant.rx = rx;
         libconf.ant.tx = tx;
 
+        if (rx == rt2x00dev->link.ant.active.rx &&
+            tx == rt2x00dev->link.ant.active.tx)
+                return;
+
         /*
          * Antenna setup changes require the RX to be disabled,
          * else the changes will be ignored by the device.
          */
         if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
+                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF_LINK);
 
         /*
          * Write new antenna setup to device and reset the link tuner.
@@ -116,7 +120,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->link.ant.active.tx = libconf.ant.tx;
 
         if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
 }
 
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c4be2ac4d7a4..0d51f478bcdf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -61,11 +61,33 @@ EXPORT_SYMBOL_GPL(rt2x00lib_get_ring);
 /*
  * Link tuning handlers
  */
-static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
+void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
 {
+        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
+                return;
+
+        /*
+         * Reset link information.
+         * Both the currently active vgc level as well as
+         * the link tuner counter should be reset. Resetting
+         * the counter is important for devices where the
+         * device should only perform link tuning during the
+         * first minute after being enabled.
+         */
         rt2x00dev->link.count = 0;
         rt2x00dev->link.vgc_level = 0;
 
+        /*
+         * Reset the link tuner.
+         */
+        rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
+}
+
+static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
+{
+        /*
+         * Clear all (possibly) pre-existing quality statistics.
+         */
         memset(&rt2x00dev->link.qual, 0, sizeof(rt2x00dev->link.qual));
 
         /*
@@ -79,10 +101,7 @@ static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->link.qual.rx_percentage = 50;
         rt2x00dev->link.qual.tx_percentage = 50;
 
-        /*
-         * Reset the link tuner.
-         */
-        rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
+        rt2x00lib_reset_link_tuner(rt2x00dev);
 
         queue_delayed_work(rt2x00dev->hw->workqueue,
                            &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
@@ -93,15 +112,6 @@ static void rt2x00lib_stop_link_tuner(struct rt2x00_dev *rt2x00dev)
         cancel_delayed_work_sync(&rt2x00dev->link.work);
 }
 
-void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
-{
-        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-                return;
-
-        rt2x00lib_stop_link_tuner(rt2x00dev);
-        rt2x00lib_start_link_tuner(rt2x00dev);
-}
-
 /*
  * Ring initialization
  */
@@ -260,19 +270,11 @@ static void rt2x00lib_evaluate_antenna_sample(struct rt2x00_dev *rt2x00dev)
         if (sample_a == sample_b)
                 return;
 
-        if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) {
-                if (sample_a > sample_b && rx == ANTENNA_B)
-                        rx = ANTENNA_A;
-                else if (rx == ANTENNA_A)
-                        rx = ANTENNA_B;
-        }
+        if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY)
+                rx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
 
-        if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY) {
-                if (sample_a > sample_b && tx == ANTENNA_B)
-                        tx = ANTENNA_A;
-                else if (tx == ANTENNA_A)
-                        tx = ANTENNA_B;
-        }
+        if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)
+                tx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
 
         rt2x00lib_config_antenna(rt2x00dev, rx, tx);
 }
@@ -293,7 +295,7 @@ static void rt2x00lib_evaluate_antenna_eval(struct rt2x00_dev *rt2x00dev)
          * sample the rssi from the other antenna to make a valid
          * comparison between the 2 antennas.
          */
-        if ((rssi_curr - rssi_old) > -5 || (rssi_curr - rssi_old) < 5)
+        if (abs(rssi_curr - rssi_old) < 5)
                 return;
 
         rt2x00dev->link.ant.flags |= ANTENNA_MODE_SAMPLE;
@@ -319,15 +321,15 @@ static void rt2x00lib_evaluate_antenna(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->link.ant.flags &= ~ANTENNA_TX_DIVERSITY;
 
         if (rt2x00dev->hw->conf.antenna_sel_rx == 0 &&
-            rt2x00dev->default_ant.rx != ANTENNA_SW_DIVERSITY)
+            rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
                 rt2x00dev->link.ant.flags |= ANTENNA_RX_DIVERSITY;
         if (rt2x00dev->hw->conf.antenna_sel_tx == 0 &&
-            rt2x00dev->default_ant.tx != ANTENNA_SW_DIVERSITY)
+            rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
                 rt2x00dev->link.ant.flags |= ANTENNA_TX_DIVERSITY;
 
         if (!(rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) &&
             !(rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)) {
-                rt2x00dev->link.ant.flags &= ~ANTENNA_MODE_SAMPLE;
+                rt2x00dev->link.ant.flags = 0;
                 return;
         }
 
@@ -441,17 +443,18 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
                 rt2x00dev->ops->lib->link_tuner(rt2x00dev);
 
         /*
-         * Evaluate antenna setup.
-         */
-        rt2x00lib_evaluate_antenna(rt2x00dev);
-
-        /*
          * Precalculate a portion of the link signal which is
          * in based on the tx/rx success/failure counters.
          */
         rt2x00lib_precalculate_link_signal(&rt2x00dev->link.qual);
 
         /*
+         * Evaluate antenna setup, make this the last step since this could
+         * possibly reset some statistics.
+         */
+        rt2x00lib_evaluate_antenna(rt2x00dev);
+
+        /*
          * Increase tuner counter, and reschedule the next link tuner run.
          */
         rt2x00dev->link.count++;
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 838421216da0..b1915dc7dda1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -85,6 +85,8 @@ enum dev_state {
         STATE_RADIO_OFF,
         STATE_RADIO_RX_ON,
         STATE_RADIO_RX_OFF,
+        STATE_RADIO_RX_ON_LINK,
+        STATE_RADIO_RX_OFF_LINK,
         STATE_RADIO_IRQ_ON,
         STATE_RADIO_IRQ_OFF,
 };
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index b31f0c26c32b..93ea212fedd5 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1482,8 +1482,12 @@ static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt61pci_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt61pci_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
@@ -2298,9 +2302,9 @@ static void rt61pci_configure_filter(struct ieee80211_hw *hw,
          * Apply some rules to the filters:
          * - Some filters imply different filters to be set.
          * - Some things we can't filter out at all.
+         * - Multicast filter seems to kill broadcast traffic so never use it.
          */
-        if (mc_count)
-                *total_flags |= FIF_ALLMULTI;
+        *total_flags |= FIF_ALLMULTI;
         if (*total_flags & FIF_OTHER_BSS ||
             *total_flags & FIF_PROMISC_IN_BSS)
                 *total_flags |= FIF_PROMISC_IN_BSS | FIF_OTHER_BSS;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 4d576ab3e7f9..8103d41a1543 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1208,8 +1208,12 @@ static int rt73usb_set_device_state(struct rt2x00_dev *rt2x00dev,
                 rt73usb_disable_radio(rt2x00dev);
                 break;
         case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+                rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
+                break;
         case STATE_RADIO_RX_OFF:
-                rt73usb_toggle_rx(rt2x00dev, state);
+        case STATE_RADIO_RX_OFF_LINK:
+                rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
                 break;
         case STATE_DEEP_SLEEP:
         case STATE_SLEEP:
@@ -1865,9 +1869,9 @@ static void rt73usb_configure_filter(struct ieee80211_hw *hw,
          * Apply some rules to the filters:
          * - Some filters imply different filters to be set.
          * - Some things we can't filter out at all.
+         * - Multicast filter seems to kill broadcast traffic so never use it.
          */
-        if (mc_count)
-                *total_flags |= FIF_ALLMULTI;
+        *total_flags |= FIF_ALLMULTI;
         if (*total_flags & FIF_OTHER_BSS ||
             *total_flags & FIF_PROMISC_IN_BSS)
                 *total_flags |= FIF_PROMISC_IN_BSS | FIF_OTHER_BSS;
@@ -2094,6 +2098,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* D-Link */
         { USB_DEVICE(0x07d1, 0x3c03), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gigabyte */