26 files changed, 114 insertions, 90 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index ea543fcf2687..e4f9f747de88 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -111,7 +111,7 @@ config WLAN_80211
           lets you choose drivers.
 
 config PCMCIA_RAYCS
-        tristate "Aviator/Raytheon 2.4MHz wireless support"
+        tristate "Aviator/Raytheon 2.4GHz wireless support"
         depends on PCMCIA && WLAN_80211
         select WIRELESS_EXT
         ---help---
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 4af2607deec0..8ef87356e083 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -2644,7 +2644,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (skb_headroom(skb) < padsize) {
                         ATH5K_ERR(sc, "tx hdrlen not %%4: %d not enough"
                                   " headroom to pad %d\n", hdrlen, padsize);
-                        return -1;
+                        return NETDEV_TX_BUSY;
                 }
                 skb_push(skb, padsize);
                 memmove(skb->data, skb->data+padsize, hdrlen);
@@ -2655,7 +2655,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
                 ieee80211_stop_queue(hw, skb_get_queue_mapping(skb));
-                return -1;
+                return NETDEV_TX_BUSY;
         }
         bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
         list_del(&bf->list);
@@ -2673,10 +2673,10 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 sc->txbuf_len++;
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
                 dev_kfree_skb_any(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int
diff --git a/drivers/net/wireless/ath5k/pcu.c b/drivers/net/wireless/ath5k/pcu.c
index 0cac05c6a9ce..75eb9f43c741 100644
--- a/drivers/net/wireless/ath5k/pcu.c
+++ b/drivers/net/wireless/ath5k/pcu.c
@@ -65,7 +65,7 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
                 if (ah->ah_version == AR5K_AR5210)
                         pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
                 else
-                        AR5K_REG_DISABLE_BITS(ah, AR5K_CFG, AR5K_CFG_ADHOC);
+                        AR5K_REG_ENABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
                 break;
 
         case NL80211_IFTYPE_AP:
@@ -75,7 +75,7 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
                 if (ah->ah_version == AR5K_AR5210)
                         pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
                 else
-                        AR5K_REG_ENABLE_BITS(ah, AR5K_CFG, AR5K_CFG_ADHOC);
+                        AR5K_REG_DISABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
                 break;
 
         case NL80211_IFTYPE_STATION:
diff --git a/drivers/net/wireless/ath5k/reg.h b/drivers/net/wireless/ath5k/reg.h
index 91aaeaf88199..9189ab13286c 100644
--- a/drivers/net/wireless/ath5k/reg.h
+++ b/drivers/net/wireless/ath5k/reg.h
@@ -73,7 +73,7 @@
 #define AR5K_CFG_SWRD           0x00000004      /* Byte-swap RX descriptor */
 #define AR5K_CFG_SWRB           0x00000008      /* Byte-swap RX buffer */
 #define AR5K_CFG_SWRG           0x00000010      /* Byte-swap Register access */
-#define AR5K_CFG_ADHOC          0x00000020      /* AP/Adhoc indication [5211+] */
+#define AR5K_CFG_IBSS           0x00000020      /* 0-BSS, 1-IBSS [5211+] */
 #define AR5K_CFG_PHY_OK         0x00000100      /* [5211+] */
 #define AR5K_CFG_EEBS           0x00000200      /* EEPROM is busy */
 #define AR5K_CFG_CLKGD          0x00000400      /* Clock gated (Disable dynamic clock) */
diff --git a/drivers/net/wireless/ath9k/Kconfig b/drivers/net/wireless/ath9k/Kconfig
index c43bd321f97f..90a8dd873786 100644
--- a/drivers/net/wireless/ath9k/Kconfig
+++ b/drivers/net/wireless/ath9k/Kconfig
@@ -1,6 +1,7 @@
 config ATH9K
         tristate "Atheros 802.11n wireless cards support"
         depends on PCI && MAC80211 && WLAN_80211
+        depends on RFKILL || RFKILL=n
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 191eec50dc75..727f067aca4f 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -2164,13 +2164,13 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                                     conf->ht.channel_type);
                 }
 
+                ath_update_chainmask(sc, conf->ht.enabled);
+
                 if (ath_set_channel(sc, &sc->sc_ah->ah_channels[pos]) < 0) {
                         DPRINTF(sc, ATH_DBG_FATAL, "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         return -EINVAL;
                 }
-
-                ath_update_chainmask(sc, conf->ht.enabled);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER)
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 3bfc3b90f256..c92f0c6e4adc 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -126,15 +126,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        tx_info->status.rates[0].count = tx_status->retries;
-        if (tx_info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
-                /* Change idx from internal table index to MCS index */
-                int idx = tx_info->status.rates[0].idx;
-                struct ath_rate_table *rate_table = sc->cur_rate_table;
-                if (idx >= 0 && idx < rate_table->rate_cnt)
-                        tx_info->status.rates[0].idx =
-                                rate_table->info[idx].ratecode & 0x7f;
-        }
+        tx_info->status.rates[0].count = tx_status->retries + 1;
 
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         padsize = hdrlen & 3;
@@ -264,25 +256,22 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
         }
 
         /* Get seqno */
-
-        if (ieee80211_is_data(fc) && !is_pae(skb)) {
-                /* For HT capable stations, we save tidno for later use.
-                 * We also override seqno set by upper layer with the one
-                 * in tx aggregation state.
-                 *
-                 * If fragmentation is on, the sequence number is
-                 * not overridden, since it has been
-                 * incremented by the fragmentation routine.
-                 *
-                 * FIXME: check if the fragmentation threshold exceeds
-                 * IEEE80211 max.
-                 */
-                tid = ATH_AN_2_TID(an, bf->bf_tidno);
-                hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
-                                            IEEE80211_SEQ_SEQ_SHIFT);
-                bf->bf_seqno = tid->seq_next;
-                INCR(tid->seq_next, IEEE80211_SEQ_MAX);
-        }
+        /* For HT capable stations, we save tidno for later use.
+         * We also override seqno set by upper layer with the one
+         * in tx aggregation state.
+         *
+         * If fragmentation is on, the sequence number is
+         * not overridden, since it has been
+         * incremented by the fragmentation routine.
+         *
+         * FIXME: check if the fragmentation threshold exceeds
+         * IEEE80211 max.
+         */
+        tid = ATH_AN_2_TID(an, bf->bf_tidno);
+        hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
+                        IEEE80211_SEQ_SEQ_SHIFT);
+        bf->bf_seqno = tid->seq_next;
+        INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
 
 static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
@@ -1718,11 +1707,10 @@ static int ath_tx_setup_buffer(struct ath_softc *sc, struct ath_buf *bf,
 
         /* Assign seqno, tidno */
 
-        if (bf_isht(bf) && (sc->sc_flags & SC_OP_TXAGGR))
+        if (ieee80211_is_data_qos(fc) && (sc->sc_flags & SC_OP_TXAGGR))
                 assign_aggr_tid_seqno(skb, bf);
 
         /* DMA setup */
-
         bf->bf_mpdu = skb;
 
         bf->bf_dmacontext = pci_map_single(sc->pdev, skb->data,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 7b31a327b24a..c788bad10661 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3261,7 +3261,7 @@ static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
         struct b43_wldev *down_dev;
         struct b43_wldev *d;
         int err;
-        bool gmode;
+        bool uninitialized_var(gmode);
         int prev_status;
 
         /* Find a device and PHY which supports the band. */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c1324e31d2f6..fb996c27a19b 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2465,7 +2465,7 @@ static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev)
 static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
                                       unsigned int new_mode)
 {
-        struct b43legacy_wldev *up_dev;
+        struct b43legacy_wldev *uninitialized_var(up_dev);
         struct b43legacy_wldev *down_dev;
         int err;
         bool gmode = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 8fdb34222c0a..45cfa1cf194a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2219,7 +2219,7 @@ int iwl3945_txpower_set_from_eeprom(struct iwl3945_priv *priv)
                 /* set tx power value for all OFDM rates */
                 for (rate_index = 0; rate_index < IWL_OFDM_RATES;
                      rate_index++) {
-                        s32 power_idx;
+                        s32 uninitialized_var(power_idx);
                         int rc;
 
                         /* use channel group's clip-power table,
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 52966ffbef6e..ba997204c8d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -255,7 +255,7 @@ struct iwl_cmd_header {
  *        0x3)  54 Mbps
  *
  * Legacy CCK rate format for bits 7:0 (bit 8 must be "0", bit 9 "1"):
- *  3-0:   10)  1 Mbps
+ *  6-0:   10)  1 Mbps
  *         20)  2 Mbps
  *         55)  5.5 Mbps
  *        110)  11 Mbps
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 01a2169cecec..8c71ad4f88c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -51,6 +51,7 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(REPLY_REMOVE_STA);
                 IWL_CMD(REPLY_REMOVE_ALL_STA);
                 IWL_CMD(REPLY_WEPKEY);
+                IWL_CMD(REPLY_3945_RX);
                 IWL_CMD(REPLY_TX);
                 IWL_CMD(REPLY_RATE_SCALE);
                 IWL_CMD(REPLY_LEDS_CMD);
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index d1fc305de5fe..e7289e2e7f16 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -206,7 +206,7 @@ static int lbtf_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * there are no buffered multicast frames to send
          */
         ieee80211_stop_queues(priv->hw);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void lbtf_tx_work(struct work_struct *work)
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index bc84e2792f8a..c3bb85e0251e 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -1610,6 +1610,16 @@ static void orinoco_rx_isr_tasklet(unsigned long data)
         struct orinoco_rx_data *rx_data, *temp;
         struct hermes_rx_descriptor *desc;
         struct sk_buff *skb;
+        unsigned long flags;
+
+        /* orinoco_rx requires the driver lock, and we also need to
+         * protect priv->rx_list, so just hold the lock over the
+         * lot.
+         *
+         * If orinoco_lock fails, we've unplugged the card. In this
+         * case just abort. */
+        if (orinoco_lock(priv, &flags) != 0)
+                return;
 
         /* extract desc and skb from queue */
         list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
@@ -1622,6 +1632,8 @@ static void orinoco_rx_isr_tasklet(unsigned long data)
 
                 kfree(desc);
         }
+
+        orinoco_unlock(priv, &flags);
 }
 
 /********************************************************************/
@@ -3645,12 +3657,22 @@ struct net_device
 void free_orinocodev(struct net_device *dev)
 {
         struct orinoco_private *priv = netdev_priv(dev);
+        struct orinoco_rx_data *rx_data, *temp;
 
-        /* No need to empty priv->rx_list: if the tasklet is scheduled
-         * when we call tasklet_kill it will run one final time,
-         * emptying the list */
+        /* If the tasklet is scheduled when we call tasklet_kill it
+         * will run one final time. However the tasklet will only
+         * drain priv->rx_list if the hw is still available. */
         tasklet_kill(&priv->rx_tasklet);
 
+        /* Explicitly drain priv->rx_list */
+        list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
+                list_del(&rx_data->list);
+
+                dev_kfree_skb(rx_data->skb);
+                kfree(rx_data->desc);
+                kfree(rx_data);
+        }
+
         unregister_pm_notifier(&priv->pm_notifier);
         orinoco_uncache_fw(priv);
 
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index f127602670ec..0b32215d3f5d 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -435,6 +435,7 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002), /* Samsung SWL2000-N 11Mb/s WLAN Card */
         PCMCIA_DEVICE_MANF_CARD(0x0261, 0x0002), /* AirWay 802.11 Adapter (PCMCIA) */
         PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0001), /* ARtem Onair */
+        PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0003), /* ARtem Onair Comcard 11 */
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0305), /* Buffalo WLI-PCM-S11 */
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612), /* Linksys WPC11 Version 2.5 */
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613), /* Linksys WPC11 Version 3 */
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 82354b974a04..c6a370fa9bcb 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -138,6 +138,7 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
         u8 *fw_version = NULL;
         size_t len;
         int i;
+        int maxlen;
 
         if (priv->rx_start)
                 return 0;
@@ -195,6 +196,16 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
                         else
                                 priv->rx_mtu = (size_t)
                                         0x620 - priv->tx_hdr_len;
+                        maxlen = priv->tx_hdr_len + /* USB devices */
+                                 sizeof(struct p54_rx_data) +
+                                 4 + /* rx alignment */
+                                 IEEE80211_MAX_FRAG_THRESHOLD;
+                        if (priv->rx_mtu > maxlen && PAGE_SIZE == 4096) {
+                                printk(KERN_INFO "p54: rx_mtu reduced from %d "
+                                                 "to %d\n", priv->rx_mtu,
+                                                 maxlen);
+                                priv->rx_mtu = maxlen;
+                        }
                         break;
                         }
                 case BR_CODE_EXPOSED_IF:
@@ -575,6 +586,7 @@ static int p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         u16 freq = le16_to_cpu(hdr->freq);
         size_t header_len = sizeof(*hdr);
         u32 tsf32;
+        u8 rate = hdr->rate & 0xf;
 
         /*
          * If the device is in a unspecified state we have to
@@ -603,8 +615,11 @@ static int p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         rx_status.qual = (100 * hdr->rssi) / 127;
         if (hdr->rate & 0x10)
                 rx_status.flag |= RX_FLAG_SHORTPRE;
-        rx_status.rate_idx = (dev->conf.channel->band == IEEE80211_BAND_2GHZ ?
-                        hdr->rate : (hdr->rate - 4)) & 0xf;
+        if (dev->conf.channel->band == IEEE80211_BAND_5GHZ)
+                rx_status.rate_idx = (rate < 4) ? 0 : rate - 4;
+        else
+                rx_status.rate_idx = rate;
+
         rx_status.freq = freq;
         rx_status.band =  dev->conf.channel->band;
         rx_status.antenna = hdr->antenna;
@@ -798,6 +813,16 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                         info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
                 info->status.ack_signal = p54_rssi_to_dbm(dev,
                                 (int)payload->ack_rssi);
+
+                if (entry_data->key_type == P54_CRYPTO_TKIPMICHAEL) {
+                        u8 *iv = (u8 *)(entry_data->align + pad +
+                                        entry_data->crypt_offset);
+
+                        /* Restore the original TKIP IV. */
+                        iv[2] = iv[0];
+                        iv[0] = iv[1];
+                        iv[1] = (iv[0] | 0x20) & 0x7f;  /* WEPSeed - 8.3.2.2 */
+                }
                 skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
                 ieee80211_tx_status_irqsafe(dev, entry);
                 goto out;
@@ -1383,7 +1408,6 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         hdr->tries = ridx;
         txhdr->rts_rate_idx = 0;
         if (info->control.hw_key) {
-                crypt_offset += info->control.hw_key->iv_len;
                 txhdr->key_type = p54_convert_algo(info->control.hw_key->alg);
                 txhdr->key_len = min((u8)16, info->control.hw_key->keylen);
                 memcpy(txhdr->key, info->control.hw_key->key, txhdr->key_len);
@@ -1397,6 +1421,8 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
                 }
                 /* reserve some space for ICV */
                 len += info->control.hw_key->icv_len;
+                memset(skb_put(skb, info->control.hw_key->icv_len), 0,
+                       info->control.hw_key->icv_len);
         } else {
                 txhdr->key_type = 0;
                 txhdr->key_len = 0;
@@ -1824,7 +1850,7 @@ static void p54_remove_interface(struct ieee80211_hw *dev,
 
 static int p54_config(struct ieee80211_hw *dev, u32 changed)
 {
-        int ret;
+        int ret = 0;
         struct p54_common *priv = dev->priv;
         struct ieee80211_conf *conf = &dev->conf;
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index c44a200059d2..6a6a72f6f82c 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
+        {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
         {USB_DEVICE(0x0846, 0x4240)},   /* Netgear WG111 (v2) */
@@ -284,6 +285,7 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb)
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
                           skb->data, skb->len, p54u_tx_cb, skb);
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(data_urb, &priv->submitted);
         if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 30028e2422fc..af6b5847be5c 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -38,7 +38,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 1;
+static int modparam_nohwcrypt = 0;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -376,11 +376,11 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
 
                 /*
                  * The driver does not support the IV/EIV generation
-                 * in hardware. However it doesn't support the IV/EIV
-                 * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
-                 * rt2x00lib will cut the IV/EIV data out of all frames
-                 * given to us by mac80211, but we must tell mac80211
+                 * in hardware. However it demands the data to be provided
+                 * both seperately as well as inside the frame.
+                 * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
+                 * to ensure rt2x00lib will not strip the data from the
+                 * frame after the copy, now we must tell mac80211
                  * to generate the IV/EIV data.
                  */
                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
@@ -1181,7 +1181,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
-        rt2x00_set_field32(&word, TXD_W0_CIPHER, txdesc->cipher);
+        rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
         rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
         rt2x00_desc_write(txd, 0, word);
 }
@@ -1334,14 +1334,7 @@ static void rt2500usb_fill_rxdone(struct queue_entry *entry,
 
                 /* ICV is located at the end of frame */
 
-                /*
-                 * Hardware has stripped IV/EIV data from 802.11 frame during
-                 * decryption. It has provided the data seperately but rt2x00lib
-                 * should decide if it should be reinserted.
-                 */
-                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
-                if (rxdesc->cipher != CIPHER_TKIP)
-                        rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                 if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                         rxdesc->flags |= RX_FLAG_DECRYPTED;
                 else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 6d92542fcf0d..87c0f2c83077 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -807,13 +807,11 @@ static void rt2x00lib_rate(struct ieee80211_rate *entry,
 {
         entry->flags = 0;
         entry->bitrate = rate->bitrate;
-        entry->hw_value = rt2x00_create_rate_hw_value(index, 0);
-        entry->hw_value_short = entry->hw_value;
+        entry->hw_value =index;
+        entry->hw_value_short = index;
 
-        if (rate->flags & DEV_RATE_SHORT_PREAMBLE) {
+        if (rate->flags & DEV_RATE_SHORT_PREAMBLE)
                 entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
-                entry->hw_value_short |= rt2x00_create_rate_hw_value(index, 1);
-        }
 }
 
 static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.c b/drivers/net/wireless/rt2x00/rt2x00leds.c
index 68f4e0fc35b9..a0cd35b6beb5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.c
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
@@ -97,7 +97,7 @@ void rt2x00leds_led_assoc(struct rt2x00_dev *rt2x00dev, bool enabled)
 
 void rt2x00leds_led_radio(struct rt2x00_dev *rt2x00dev, bool enabled)
 {
-        if (rt2x00dev->led_radio.type == LED_TYPE_ASSOC)
+        if (rt2x00dev->led_radio.type == LED_TYPE_RADIO)
                 rt2x00led_led_simple(&rt2x00dev->led_radio, enabled);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 03024327767b..86cd26fbf769 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -52,22 +52,11 @@ struct rt2x00_rate {
 
 extern const struct rt2x00_rate rt2x00_supported_rates[12];
 
-static inline u16 rt2x00_create_rate_hw_value(const u16 index,
-                                              const u16 short_preamble)
-{
-        return (short_preamble << 8) | (index & 0xff);
-}
-
 static inline const struct rt2x00_rate *rt2x00_get_rate(const u16 hw_value)
 {
         return &rt2x00_supported_rates[hw_value & 0xff];
 }
 
-static inline int rt2x00_get_rate_preamble(const u16 hw_value)
-{
-        return (hw_value & 0xff00);
-}
-
 /*
  * Radio control handlers.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index eaec6bd93ed5..746a8f36b931 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -313,7 +313,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
                  * When preamble is enabled we should set the
                  * preamble bit for the signal.
                  */
-                if (rt2x00_get_rate_preamble(rate->hw_value))
+                if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
                         txdesc->signal |= 0x08;
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 83df312ac56f..0b29d767a258 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -434,11 +434,11 @@ static int rt2x00usb_find_endpoints(struct rt2x00_dev *rt2x00dev)
 
                 if (usb_endpoint_is_bulk_in(ep_desc)) {
                         rt2x00usb_assign_endpoint(rt2x00dev->rx, ep_desc);
-                } else if (usb_endpoint_is_bulk_out(ep_desc)) {
+                } else if (usb_endpoint_is_bulk_out(ep_desc) &&
+                           (queue != queue_end(rt2x00dev))) {
                         rt2x00usb_assign_endpoint(queue, ep_desc);
+                        queue = queue_next(queue);
 
-                        if (queue != queue_end(rt2x00dev))
-                                queue = queue_next(queue);
                         tx_ep_desc = ep_desc;
                 }
         }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index d638a8a59370..96a8d69f8790 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2321,6 +2321,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Linksys */
         { USB_DEVICE(0x13b1, 0x0020), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
         /* MSI */
         { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 5f887fb137a9..387c133ec0f2 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -897,6 +897,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_RX_INCLUDES_FCS |
                      IEEE80211_HW_SIGNAL_UNSPEC;
+        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
         dev->queues = 1;
         dev->max_signal = 65;
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 00ce3ef39abe..6ad6bac37706 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -213,7 +213,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb) {
                 kfree_skb(skb);
-                return -ENOMEM;
+                return NETDEV_TX_OK;
         }
 
         flags = skb->len;
@@ -281,7 +281,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         }
         usb_free_urb(urb);
 
-        return rc;
+        return NETDEV_TX_OK;
 }
 
 static void rtl8187_rx_cb(struct urb *urb)
@@ -1471,6 +1471,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         ieee80211_unregister_hw(dev);
 
         priv = dev->priv;
+        usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
         ieee80211_free_hw(dev);
 }