13 files changed, 107 insertions, 55 deletions

diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 2d4c0910295b..2d394af82171 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -41,7 +41,8 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
         case ADC_DC_CAL:
                 /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
                 if (!IS_CHAN_B(chan) &&
-                    !(IS_CHAN_2GHZ(chan) && IS_CHAN_HT20(chan)))
+                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                      IS_CHAN_HT20(chan)))
                         supported = true;
                 break;
         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 1baca8e4715d..fcafec0605f4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -671,7 +671,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                 REG_WRITE_ARRAY(&ah->iniModesAdditional,
                                 modesIndex, regWrites);
 
-        if (AR_SREV_9300(ah))
+        if (AR_SREV_9330(ah))
                 REG_WRITE_ARRAY(&ah->iniModesAdditional, 1, regWrites);
 
         if (AR_SREV_9340(ah) && !ah->is_clk_25mhz)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6530694a59ae..722967b86cf1 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2303,6 +2303,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
         mutex_lock(&sc->mutex);
         cancel_delayed_work_sync(&sc->tx_complete_work);
 
+        if (ah->ah_flags & AH_UNPLUGGED) {
+                ath_dbg(common, ATH_DBG_ANY, "Device has been unplugged!\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
+
         if (sc->sc_flags & SC_OP_INVALID) {
                 ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 26f1ab840cc7..e293a7921bf0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1632,7 +1632,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
         u32 cmd, beacon0_valid, beacon1_valid;
 
         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
-            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
                 return;
 
         /* This is the bottom half of the asynchronous beacon update. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 3774dd034746..ef9ad79d1bfd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,15 +1903,17 @@ static void ipw2100_down(struct ipw2100_priv *priv)
 static int ipw2100_net_init(struct net_device *dev)
 {
         struct ipw2100_priv *priv = libipw_priv(dev);
+
+        return ipw2100_up(priv, 1);
+}
+
+static int ipw2100_wdev_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
         struct wireless_dev *wdev = &priv->ieee->wdev;
-        int ret;
         int i;
 
-        ret = ipw2100_up(priv, 1);
-        if (ret)
-                return ret;
-
         memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
 
         /* fill-out priv->ieee->bg_band */
@@ -6350,9 +6352,13 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                        "Error calling register_netdev.\n");
                 goto fail;
         }
+        registered = 1;
+
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
 
         mutex_lock(&priv->action_mutex);
-        registered = 1;
 
         IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
 
@@ -6389,7 +6395,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
       fail_unlock:
         mutex_unlock(&priv->action_mutex);
-
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->bg_band.channels);
       fail:
         if (dev) {
                 if (registered)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 87813c33bdc2..4ffebede5e03 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11425,16 +11425,23 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int rc = 0;
+        struct ipw_priv *priv = libipw_priv(dev);
+
+        mutex_lock(&priv->mutex);
+        if (ipw_up(priv))
+                rc = -EIO;
+        mutex_unlock(&priv->mutex);
+
+        return rc;
+}
+
+static int ipw_wdev_init(struct net_device *dev)
+{
         int i, rc = 0;
         struct ipw_priv *priv = libipw_priv(dev);
         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
         struct wireless_dev *wdev = &priv->ieee->wdev;
-        mutex_lock(&priv->mutex);
-
-        if (ipw_up(priv)) {
-                rc = -EIO;
-                goto out;
-        }
 
         memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
 
@@ -11519,13 +11526,9 @@ static int ipw_net_init(struct net_device *dev)
         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
 
         /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
+        if (wiphy_register(wdev->wiphy))
                 rc = -EIO;
-                goto out;
-        }
-
 out:
-        mutex_unlock(&priv->mutex);
         return rc;
 }
 
@@ -11832,14 +11835,22 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                 goto out_remove_sysfs;
         }
 
+        err = ipw_wdev_init(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register wireless device\n");
+                goto out_unregister_netdev;
+        }
+
 #ifdef CONFIG_IPW2200_PROMISCUOUS
         if (rtap_iface) {
                 err = ipw_prom_alloc(priv);
                 if (err) {
                         IPW_ERROR("Failed to register promiscuous network "
                                   "device (error %d).\n", err);
-                        unregister_netdev(priv->net_dev);
-                        goto out_remove_sysfs;
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
+                        kfree(priv->ieee->a_band.channels);
+                        kfree(priv->ieee->bg_band.channels);
+                        goto out_unregister_netdev;
                 }
         }
 #endif
@@ -11851,6 +11862,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
 
         return 0;
 
+      out_unregister_netdev:
+        unregister_netdev(priv->net_dev);
       out_remove_sysfs:
         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
       out_release_irq:
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
index 977bd2477c6a..164bcae821f8 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
@@ -822,12 +822,15 @@ static void iwl3945_rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 
  out:
 
-        rs_sta->last_txrate_idx = index;
-        if (sband->band == IEEE80211_BAND_5GHZ)
-                info->control.rates[0].idx = rs_sta->last_txrate_idx -
-                                IWL_FIRST_OFDM_RATE;
-        else
+        if (sband->band == IEEE80211_BAND_5GHZ) {
+                if (WARN_ON_ONCE(index < IWL_FIRST_OFDM_RATE))
+                        index = IWL_FIRST_OFDM_RATE;
+                rs_sta->last_txrate_idx = index;
+                info->control.rates[0].idx = index - IWL_FIRST_OFDM_RATE;
+        } else {
+                rs_sta->last_txrate_idx = index;
                 info->control.rates[0].idx = rs_sta->last_txrate_idx;
+        }
 
         IWL_DEBUG_RATE(priv, "leave: %d\n", index);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index a895a099d086..56211006a182 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -167,7 +167,7 @@ static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(offset_calib));
+        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(*offset_calib));
         if (!(cmd.radio_sensor_offset))
                 cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f083..f9c3cd95d614 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2140,7 +2140,12 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                     IEEE80211_HW_SPECTRUM_MGMT |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS;
 
+        /*
+         * Including the following line will crash some AP's.  This
+         * workaround removes the stimulus which causes the crash until
+         * the AP software can be fixed.
         hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+         */
 
         hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                      IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
index a6b2b1db0b1d..222d410c586e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
@@ -771,6 +771,8 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
 
+        txq->time_stamp = jiffies;
+
         iwlagn_unmap_tfd(priv, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index ef67f6786a84..0019dfd8fb01 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3697,14 +3697,15 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
         rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
 
         /* Apparently the data is read from end to start */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
-                                        (u32 *)&rt2x00dev->eeprom[i]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
-                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
-                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
-                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
+        /* The returned value is in CPU order, but eeprom is le */
+        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 4] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 6] = cpu_to_le32(reg);
 
         mutex_unlock(&rt2x00dev->csr_mutex);
 }
@@ -3870,19 +3871,23 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                 return -ENODEV;
         }
 
-        if (!rt2x00_rf(rt2x00dev, RF2820) &&
-            !rt2x00_rf(rt2x00dev, RF2850) &&
-            !rt2x00_rf(rt2x00dev, RF2720) &&
-            !rt2x00_rf(rt2x00dev, RF2750) &&
-            !rt2x00_rf(rt2x00dev, RF3020) &&
-            !rt2x00_rf(rt2x00dev, RF2020) &&
-            !rt2x00_rf(rt2x00dev, RF3021) &&
-            !rt2x00_rf(rt2x00dev, RF3022) &&
-            !rt2x00_rf(rt2x00dev, RF3052) &&
-            !rt2x00_rf(rt2x00dev, RF3320) &&
-            !rt2x00_rf(rt2x00dev, RF5370) &&
-            !rt2x00_rf(rt2x00dev, RF5390)) {
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+        switch (rt2x00dev->chip.rf) {
+        case RF2820:
+        case RF2850:
+        case RF2720:
+        case RF2750:
+        case RF3020:
+        case RF2020:
+        case RF3021:
+        case RF3022:
+        case RF3052:
+        case RF3320:
+        case RF5370:
+        case RF5390:
+                break;
+        default:
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%x detected.\n",
+                      rt2x00dev->chip.rf);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 1bdc1aa305c0..04c4e9eb6ee6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -610,6 +610,11 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
 
                         mac->link_state = MAC80211_NOLINK;
                         memset(mac->bssid, 0, 6);
+
+                        /* reset sec info */
+                        rtl_cam_reset_sec_info(hw);
+
+                        rtl_cam_reset_all_entry(hw);
                         mac->vendor = PEER_UNKNOWN;
 
                         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
@@ -1063,6 +1068,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                  *or clear all entry here.
                  */
                 rtl_cam_delete_one_entry(hw, mac_addr, key_idx);
+
+                rtl_cam_reset_sec_info(hw);
+
                 break;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 906e7aa55bc3..3e52a5496224 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -549,15 +549,16 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                                (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                : (tcb_desc->rts_use_shortgi ? 1 : 0)));
         if (mac->bw_40) {
-                if (tcb_desc->packet_bw) {
+                if (rate_flag & IEEE80211_TX_RC_DUP_DATA) {
                         SET_TX_DESC_DATA_BW(txdesc, 1);
                         SET_TX_DESC_DATA_SC(txdesc, 3);
+                } else if(rate_flag & IEEE80211_TX_RC_40_MHZ_WIDTH){
+                        SET_TX_DESC_DATA_BW(txdesc, 1);
+                        SET_TX_DESC_DATA_SC(txdesc, mac->cur_40_prime_sc);
                 } else {
                         SET_TX_DESC_DATA_BW(txdesc, 0);
-                                if (rate_flag & IEEE80211_TX_RC_DUP_DATA)
-                                        SET_TX_DESC_DATA_SC(txdesc,
-                                                          mac->cur_40_prime_sc);
-                        }
+                        SET_TX_DESC_DATA_SC(txdesc, 0);
+                }
         } else {
                 SET_TX_DESC_DATA_BW(txdesc, 0);
                 SET_TX_DESC_DATA_SC(txdesc, 0);