11 files changed, 73 insertions, 20 deletions

diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 791885262602..9a96550006ad 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -97,7 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         int ret;
         u16 val;
-        u32 cksum, offset;
+        u32 cksum, offset, eep_max = AR5K_EEPROM_INFO_MAX;
 
         /*
          * Read values from EEPROM and store them in the capability structure
@@ -116,12 +116,38 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
          * Validate the checksum of the EEPROM date. There are some
          * devices with invalid EEPROMs.
          */
-        for (cksum = 0, offset = 0; offset < AR5K_EEPROM_INFO_MAX; offset++) {
+        AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_UPPER, val);
+        if (val) {
+                eep_max = (val & AR5K_EEPROM_SIZE_UPPER_MASK) <<
+                           AR5K_EEPROM_SIZE_ENDLOC_SHIFT;
+                AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_LOWER, val);
+                eep_max = (eep_max | val) - AR5K_EEPROM_INFO_BASE;
+
+                /*
+                 * Fail safe check to prevent stupid loops due
+                 * to busted EEPROMs. XXX: This value is likely too
+                 * big still, waiting on a better value.
+                 */
+                if (eep_max > (3 * AR5K_EEPROM_INFO_MAX)) {
+                        ATH5K_ERR(ah->ah_sc, "Invalid max custom EEPROM size: "
+                                  "%d (0x%04x) max expected: %d (0x%04x)\n",
+                                  eep_max, eep_max,
+                                  3 * AR5K_EEPROM_INFO_MAX,
+                                  3 * AR5K_EEPROM_INFO_MAX);
+                        return -EIO;
+                }
+        }
+
+        for (cksum = 0, offset = 0; offset < eep_max; offset++) {
                 AR5K_EEPROM_READ(AR5K_EEPROM_INFO(offset), val);
                 cksum ^= val;
         }
         if (cksum != AR5K_EEPROM_INFO_CKSUM) {
-                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM "
+                          "checksum: 0x%04x eep_max: 0x%04x (%s)\n",
+                          cksum, eep_max,
+                          eep_max == AR5K_EEPROM_INFO_MAX ?
+                                "default size" : "custom size");
                 return -EIO;
         }
 
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 0123f3521a0b..473a483bb9c3 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -37,6 +37,14 @@
 #define AR5K_EEPROM_RFKILL_POLARITY_S   1
 
 #define AR5K_EEPROM_REG_DOMAIN          0x00bf  /* EEPROM regdom */
+
+/* FLASH(EEPROM) Defines for AR531X chips */
+#define AR5K_EEPROM_SIZE_LOWER          0x1b /* size info -- lower */
+#define AR5K_EEPROM_SIZE_UPPER          0x1c /* size info -- upper */
+#define AR5K_EEPROM_SIZE_UPPER_MASK     0xfff0
+#define AR5K_EEPROM_SIZE_UPPER_SHIFT    4
+#define AR5K_EEPROM_SIZE_ENDLOC_SHIFT   12
+
 #define AR5K_EEPROM_CHECKSUM            0x00c0  /* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE           0x00c0  /* EEPROM header */
 #define AR5K_EEPROM_INFO_MAX            (0x400 - AR5K_EEPROM_INFO_BASE)
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 03a1106ad725..5774cea23a3b 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -25,7 +25,7 @@ config ATH9K
 
 config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
-        depends on ATH9K
+        depends on ATH9K && DEBUG_FS
         ---help---
           Say Y, if you need access to ath9k's statistics for
           interrupts, rate control, etc.
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 9f1f523e02eb..9efebac5ed0e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -33,11 +33,11 @@ struct ath_node;
 
 /* Macro to expand scalars to 64-bit objects */
 
-#define ito64(x) (sizeof(x) == 8) ?                     \
+#define ito64(x) (sizeof(x) == 1) ?                     \
         (((unsigned long long int)(x)) & (0xff)) :      \
-        (sizeof(x) == 16) ?                             \
+        (sizeof(x) == 2) ?                              \
         (((unsigned long long int)(x)) & 0xffff) :      \
-        ((sizeof(x) == 32) ?                            \
+        ((sizeof(x) == 4) ?                             \
          (((unsigned long long int)(x)) & 0xffffffff) : \
          (unsigned long long int)(x))
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 78706ce8b7ae..cee368d4859f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         struct ieee80211_tx_info *info;
         struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
         u32  status = le32_to_cpu(tx_resp->u.status);
-        int tid = MAX_TID_COUNT;
+        int tid = MAX_TID_COUNT - 1;
         int sta_id;
         int freed;
         u8 *qc = NULL;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 23a5a3442623..a04863633d1a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3196,8 +3196,10 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
         /* Clear unsupported feature flags */
         *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
 
-        if (mwl8k_fw_lock(hw))
+        if (mwl8k_fw_lock(hw)) {
+                kfree(cmd);
                 return;
+        }
 
         if (priv->sniffer_enabled) {
                 mwl8k_cmd_enable_sniffer(hw, 0);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 8ff7db853286..126899091707 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -339,7 +339,7 @@ static int rt2800_blink_set(struct led_classdev *led_cdev,
         rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
         rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
         rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
-        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 3);
         rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
         rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
         rt2800_register_write(led->rt2x00dev, LED_CFG, reg);
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index b4c6e0a6d7e0..096da85a66fa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -119,6 +119,12 @@
         (  ((unsigned long)((__skb)->data + (__header))) & 3 )
 
 /*
+ * Constants for extra TX headroom for alignment purposes.
+ */
+#define RT2X00_ALIGN_SIZE       4 /* Only whole frame needs alignment */
+#define RT2X00_L2PAD_SIZE       8 /* Both header & payload need alignment */
+
+/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index d7711e4d4751..b93731b79903 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -688,7 +688,17 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize extra TX headroom required.
          */
-        rt2x00dev->hw->extra_tx_headroom = rt2x00dev->ops->extra_tx_headroom;
+        rt2x00dev->hw->extra_tx_headroom =
+                max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
+                      rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Take TX headroom required for alignment into account.
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
+        else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
          * Register HW.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 3d8fb684b4eb..0b4801a14601 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -104,7 +104,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
          * is also mapped to the DMA so it can be used for transfering
          * additional descriptor information to the hardware.
          */
-        skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->skb_dma =
             dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
@@ -112,7 +112,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         /*
          * Restore data pointer to original location again.
          */
-        skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
@@ -134,7 +134,7 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
                  * by the driver, but it was actually mapped to DMA.
                  */
                 dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->hw->extra_tx_headroom,
+                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index f4a4178c8d9f..d90f0a25b9cf 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -987,12 +987,13 @@ static void zd_op_configure_filter(struct ieee80211_hw *hw,
         changed_flags &= SUPPORTED_FIF_FLAGS;
         *new_flags &= SUPPORTED_FIF_FLAGS;
 
-        /* changed_flags is always populated but this driver
-         * doesn't support all FIF flags so its possible we don't
-         * need to do anything */
-        if (!changed_flags)
-                return;
-
+        /*
+         * If multicast parameter (as returned by zd_op_prepare_multicast)
+         * has changed, no bit in changed_flags is set. To handle this
+         * situation, we do not return if changed_flags is 0. If we do so,
+         * we will have some issue with IPv6 which uses multicast for link
+         * layer address resolution.
+         */
         if (*new_flags & (FIF_PROMISC_IN_BSS | FIF_ALLMULTI))
                 zd_mc_add_all(&hash);