34 files changed, 164 insertions, 101 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 520a4b2eb9cc..a747c632597a 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -7233,8 +7233,8 @@ static int airo_get_aplist(struct net_device *dev,
                 }
         } else {
                 dwrq->flags = 1; /* Should be define'd */
-                memcpy(extra + sizeof(struct sockaddr)*i,
-                       &qual,  sizeof(struct iw_quality)*i);
+                memcpy(extra + sizeof(struct sockaddr) * i, qual,
+                       sizeof(struct iw_quality) * i);
         }
         dwrq->length = i;
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index c54b7d37bff1..420d69b2674c 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -143,6 +143,7 @@ struct ath_common {
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
         DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
         enum ath_crypt_caps crypt_caps;
 
         unsigned int clockrate;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index fbaa30930076..44ad6fe0278f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1045,11 +1045,11 @@ ath5k_drain_tx_buffs(struct ath5k_hw *ah)
 
                                 ath5k_txbuf_free_skb(ah, bf);
 
-                                spin_lock_bh(&ah->txbuflock);
+                                spin_lock(&ah->txbuflock);
                                 list_move_tail(&bf->list, &ah->txbuf);
                                 ah->txbuf_len++;
                                 txq->txq_len--;
-                                spin_unlock_bh(&ah->txbuflock);
+                                spin_unlock(&ah->txbuflock);
                         }
                         txq->link = NULL;
                         txq->txq_poll_mark = false;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index a277cf6f339d..4866550ddd96 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -214,6 +214,7 @@ struct ath_frame_info {
         enum ath9k_key_type keytype;
         u8 keyix;
         u8 retries;
+        u8 rtscts_rate;
 };
 
 struct ath_buf_state {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 2b8f61c210e1..abbd6effd60d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1496,6 +1496,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                         priv->num_sta_assoc_vif++ : priv->num_sta_assoc_vif--;
 
                 if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
+                        ath9k_htc_choose_set_bssid(priv);
                         if (bss_conf->assoc && (priv->num_sta_assoc_vif == 1))
                                 ath9k_htc_start_ani(priv);
                         else if (priv->num_sta_assoc_vif == 0)
@@ -1503,13 +1504,11 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
+        if (changed & BSS_CHANGED_IBSS) {
                 if (priv->ah->opmode == NL80211_IFTYPE_ADHOC) {
                         common->curaid = bss_conf->aid;
                         memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
                         ath9k_htc_set_bssid(priv);
-                } else if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
-                        ath9k_htc_choose_set_bssid(priv);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 7db1890448f2..995ca8e1302e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -622,7 +622,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
                 if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
                      !ah->is_pciexpress)) {
                         ah->config.serialize_regmode =
                                 SER_REG_MODE_ON;
@@ -784,13 +784,25 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
 
 u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+        int i = 0;
+
         REG_CLR_BIT(ah, PLL3, PLL3_DO_MEAS_MASK);
         udelay(100);
         REG_SET_BIT(ah, PLL3, PLL3_DO_MEAS_MASK);
 
-        while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0)
+        while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0) {
+
                 udelay(100);
 
+                if (WARN_ON_ONCE(i >= 100)) {
+                        ath_err(common, "PLL4 meaurement not done\n");
+                        break;
+                }
+
+                i++;
+        }
+
         return (REG_READ(ah, PLL3) & SQSUM_DVC_MASK) >> 3;
 }
 EXPORT_SYMBOL(ar9003_get_pll_sqsum_dvc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 4de4473776ac..dac1a2709e3c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -971,6 +971,15 @@ void ath_hw_pll_work(struct work_struct *work)
                                             hw_pll_work.work);
         u32 pll_sqsum;
 
+        /*
+         * ensure that the PLL WAR is executed only
+         * after the STA is associated (or) if the
+         * beaconing had started in interfaces that
+         * uses beacons.
+         */
+        if (!(sc->sc_flags & SC_OP_BEACONS))
+                return;
+
         if (AR_SREV_9485(sc->sc_ah)) {
 
                 ath9k_ps_wakeup(sc);
@@ -1443,15 +1452,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 }
         }
 
-        if ((ah->opmode == NL80211_IFTYPE_ADHOC) ||
-            ((vif->type == NL80211_IFTYPE_ADHOC) &&
-             sc->nvifs > 0)) {
-                ath_err(common, "Cannot create ADHOC interface when other"
-                        " interfaces already exist.\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
 
         sc->nvifs++;
@@ -1476,15 +1476,6 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
         mutex_lock(&sc->mutex);
         ath9k_ps_wakeup(sc);
 
-        /* See if new interface type is valid. */
-        if ((new_type == NL80211_IFTYPE_ADHOC) &&
-            (sc->nvifs > 1)) {
-                ath_err(common, "When using ADHOC, it must be the only"
-                        " interface.\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
         if (ath9k_uses_beacons(new_type) &&
             !ath9k_uses_beacons(vif->type)) {
                 if (sc->nbcnvifs >= ATH_BCBUF) {
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index e1fcc68124dc..0735aeb3b26c 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -695,9 +695,9 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
                         __skb_unlink(skb, &rx_edma->rx_fifo);
                         list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
-                } else {
-                        bf = NULL;
                 }
+
+                bf = NULL;
         }
 
         *dest = bf;
@@ -822,7 +822,8 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * descriptor does contain a valid key index. This has been observed
          * mostly with CCMP encryption.
          */
-        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
+        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
+            !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
                 rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
 
         if (!rx_stats->rs_datalen) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d59dd01d6cde..4d571394c7a8 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -938,6 +938,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
         struct ieee80211_tx_rate *rates;
         const struct ieee80211_rate *rate;
         struct ieee80211_hdr *hdr;
+        struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
         int i;
         u8 rix = 0;
 
@@ -948,18 +949,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
 
         /* set dur_update_en for l-sig computation except for PS-Poll frames */
         info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
-
-        /*
-         * We check if Short Preamble is needed for the CTS rate by
-         * checking the BSS's global flag.
-         * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
-         */
-        rate = ieee80211_get_rts_cts_rate(sc->hw, tx_info);
-        info->rtscts_rate = rate->hw_value;
-
-        if (tx_info->control.vif &&
-            tx_info->control.vif->bss_conf.use_short_preamble)
-                info->rtscts_rate |= rate->hw_value_short;
+        info->rtscts_rate = fi->rtscts_rate;
 
         for (i = 0; i < 4; i++) {
                 bool is_40, is_sgi, is_sp;
@@ -1001,13 +991,13 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                 }
 
                 /* legacy rates */
+                rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
                 if ((tx_info->band == IEEE80211_BAND_2GHZ) &&
                     !(rate->flags & IEEE80211_RATE_ERP_G))
                         phy = WLAN_RC_PHY_CCK;
                 else
                         phy = WLAN_RC_PHY_OFDM;
 
-                rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
                 info->rates[i].Rate = rate->hw_value;
                 if (rate->hw_value_short) {
                         if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
@@ -1776,10 +1766,22 @@ static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_sta *sta = tx_info->control.sta;
         struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        const struct ieee80211_rate *rate;
         struct ath_frame_info *fi = get_frame_info(skb);
         struct ath_node *an = NULL;
         enum ath9k_key_type keytype;
+        bool short_preamble = false;
+
+        /*
+         * We check if Short Preamble is needed for the CTS rate by
+         * checking the BSS's global flag.
+         * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
+         */
+        if (tx_info->control.vif &&
+            tx_info->control.vif->bss_conf.use_short_preamble)
+                short_preamble = true;
 
+        rate = ieee80211_get_rts_cts_rate(hw, tx_info);
         keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
 
         if (sta)
@@ -1794,6 +1796,9 @@ static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
                 fi->keyix = ATH9K_TXKEYIX_INVALID;
         fi->keytype = keytype;
         fi->framelen = framelen;
+        fi->rtscts_rate = rate->hw_value;
+        if (short_preamble)
+                fi->rtscts_rate |= rate->hw_value_short;
 }
 
 u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate)
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index 0e81904956cf..5c54aa43ca2d 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *common,
                 return -EIO;
 
         set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                set_bit(idx, common->ccmp_keymap);
+
         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 set_bit(idx + 64, common->keymap);
                 set_bit(idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
                 return;
 
         clear_bit(key->hw_key_idx, common->keymap);
+        clear_bit(key->hw_key_idx, common->ccmp_keymap);
         if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
                 return;
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index acd03a4f9730..1b988f26bdf1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3767,7 +3767,7 @@ static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
         if (prev_status >= B43_STAT_STARTED) {
                 err = b43_wireless_core_start(up_dev);
                 if (err) {
-                        b43err(wl, "Fatal: Coult not start device for "
+                        b43err(wl, "Fatal: Could not start device for "
                                "selected %s-GHz band\n",
                                band_to_string(chan->band));
                         b43_wireless_core_exit(up_dev);
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index f1f8bd09bd87..c8baf020c20f 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1072,7 +1072,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
         meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
         /* create a bounce buffer in zone_dma on mapping failure. */
         if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb) {
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index cd9c9bc186d9..eae691e2f7dd 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2633,7 +2633,7 @@ static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
         if (prev_status >= B43legacy_STAT_STARTED) {
                 err = b43legacy_wireless_core_start(up_dev);
                 if (err) {
-                        b43legacyerr(wl, "Fatal: Coult not start device for "
+                        b43legacyerr(wl, "Fatal: Could not start device for "
                                "newly selected %s-PHY mode\n",
                                phymode_to_string(new_mode));
                         b43legacy_wireless_core_exit(up_dev);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..ff5d689e13f3 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -3405,7 +3405,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
                 return 0;
         }
 
-        if (il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
                 IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
                         key_flags);
                 spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -3420,7 +3420,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
         memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
         il->stations[sta_id].sta.key.key_flags =
             STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        il->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
         il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index cbf2dc18341f..5d4807c2b56d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4767,14 +4767,12 @@ il_bg_watchdog(unsigned long data)
                 return;
 
         /* monitor and check for other stuck queues */
-        if (il_is_any_associated(il)) {
-                for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
-                        /* skip as we already checked the command queue */
-                        if (cnt == il->cmd_queue)
-                                continue;
-                        if (il_check_stuck_queue(il, cnt))
-                                return;
-                }
+        for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
+                /* skip as we already checked the command queue */
+                if (cnt == il->cmd_queue)
+                        continue;
+                if (il_check_stuck_queue(il, cnt))
+                        return;
         }
 
         mod_timer(&il->watchdog,
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index e7c157e5ebeb..7f97dec8534d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -2239,6 +2239,7 @@ static ssize_t iwl_dbgfs_echo_test_write(struct file *file,
         return count;
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUG
 static ssize_t iwl_dbgfs_log_event_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
@@ -2276,6 +2277,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
 
         return count;
 }
+#endif
 
 static ssize_t iwl_dbgfs_calib_disabled_read(struct file *file,
                                          char __user *user_buf,
@@ -2345,7 +2347,9 @@ DEBUGFS_READ_FILE_OPS(bt_traffic);
 DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
 DEBUGFS_READ_FILE_OPS(reply_tx_error);
 DEBUGFS_WRITE_FILE_OPS(echo_test);
+#ifdef CONFIG_IWLWIFI_DEBUG
 DEBUGFS_READ_WRITE_FILE_OPS(log_event);
+#endif
 DEBUGFS_READ_WRITE_FILE_OPS(calib_disabled);
 
 /*
@@ -2405,7 +2409,9 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(echo_test, dir_debug, S_IWUSR);
+#ifdef CONFIG_IWLWIFI_DEBUG
         DEBUGFS_ADD_FILE(log_event, dir_debug, S_IWUSR | S_IRUSR);
+#endif
 
         if (iwl_advanced_bt_coexist(priv))
                 DEBUGFS_ADD_FILE(bt_traffic, dir_debug, S_IRUSR);
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index 3ee23134c02b..013680332f07 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -796,6 +796,18 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
         switch (op) {
         case ADD:
                 ret = iwlagn_mac_sta_add(hw, vif, sta);
+                if (ret)
+                        break;
+                /*
+                 * Clear the in-progress flag, the AP station entry was added
+                 * but we'll initialize LQ only when we've associated (which
+                 * would also clear the in-progress flag). This is necessary
+                 * in case we never initialize LQ because association fails.
+                 */
+                spin_lock_bh(&priv->sta_lock);
+                priv->stations[iwl_sta_id(sta)].used &=
+                        ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_bh(&priv->sta_lock);
                 break;
         case REMOVE:
                 ret = iwlagn_mac_sta_remove(hw, vif, sta);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 9c44088054dd..900ee129e825 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         else
                 last_seq = priv->rx_seq[tid];
 
-        if (last_seq >= new_node->start_win)
+        if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
+            last_seq >= new_node->start_win)
                 new_node->start_win = last_seq + 1;
 
         new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 
         INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
-        memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
+        mwifiex_reset_11n_rx_seq_num(priv);
 }
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index f1bffebabc60..6c9815a0f5d8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -37,6 +37,13 @@
 
 #define ADDBA_RSP_STATUS_ACCEPT 0
 
+#define MWIFIEX_DEF_11N_RX_SEQ_NUM      0xffff
+
+static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
+{
+        memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
+}
+
 int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
                                u16 seqNum,
                                u16 tid, u8 *ta,
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 015fec3371a0..5c7fd185373c 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -958,6 +958,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
         case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
                 /* firmware doesn't support this type of hidden SSID */
         default:
+                kfree(bss_cfg);
                 return -EINVAL;
         }
 
@@ -1484,7 +1485,7 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         struct wireless_dev *wdev;
 
         if (!adapter)
-                return NULL;
+                return ERR_PTR(-EFAULT);
 
         switch (type) {
         case NL80211_IFTYPE_UNSPECIFIED:
@@ -1494,12 +1495,12 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 if (priv->bss_mode) {
                         wiphy_err(wiphy,
                                   "cannot create multiple sta/adhoc ifaces\n");
-                        return NULL;
+                        return ERR_PTR(-EINVAL);
                 }
 
                 wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
                 if (!wdev)
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
 
                 wdev->wiphy = wiphy;
                 priv->wdev = wdev;
@@ -1522,12 +1523,12 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 
                 if (priv->bss_mode) {
                         wiphy_err(wiphy, "Can't create multiple AP interfaces");
-                        return NULL;
+                        return ERR_PTR(-EINVAL);
                 }
 
                 wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
                 if (!wdev)
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
 
                 priv->wdev = wdev;
                 wdev->wiphy = wiphy;
@@ -1544,14 +1545,15 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 break;
         default:
                 wiphy_err(wiphy, "type not supported\n");
-                return NULL;
+                return ERR_PTR(-EINVAL);
         }
 
         dev = alloc_netdev_mq(sizeof(struct mwifiex_private *), name,
                               ether_setup, 1);
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
-                goto error;
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -1582,7 +1584,9 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         /* Register network device */
         if (register_netdevice(dev)) {
                 wiphy_err(wiphy, "cannot register virtual network device\n");
-                goto error;
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-EFAULT);
         }
 
         sema_init(&priv->async_sem, 1);
@@ -1594,12 +1598,6 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         mwifiex_dev_debugfs_init(priv);
 #endif
         return dev;
-error:
-        if (dev && (dev->reg_state == NETREG_UNREGISTERED))
-                free_netdev(dev);
-        priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-
-        return NULL;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
 
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index ceb82cd749cc..383820a52beb 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -213,6 +213,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
                 /* save assoc resp ie index after auto-indexing */
                 *assoc_idx = *((u16 *)pos);
 
+        kfree(ap_custom_ie);
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index e0377473282f..fc8a9bfa1248 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                 dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
                 adapter->event_cause = *(u32 *) skb->data;
 
-                skb_pull(skb, MWIFIEX_EVENT_HEADER_LEN);
-
                 if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
-                        memcpy(adapter->event_body, skb->data, skb->len);
+                        memcpy(adapter->event_body,
+                               skb->data + MWIFIEX_EVENT_HEADER_LEN,
+                               skb->len);
 
                 /* event cause has been saved to adapter->event_cause */
                 adapter->event_received = true;
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 4ace5a3dcd23..11e731f3581c 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 break;
 
         case EVENT_UAP_STA_ASSOC:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 memset(&sinfo, 0, sizeof(sinfo));
-                event = (struct mwifiex_assoc_event *)adapter->event_skb->data;
+                event = (struct mwifiex_assoc_event *)
+                        (adapter->event_body + MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) {
                         len = -1;
 
@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                  GFP_KERNEL);
                 break;
         case EVENT_UAP_STA_DEAUTH:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
-                cfg80211_del_sta(priv->netdev, adapter->event_skb->data,
-                                 GFP_KERNEL);
+                cfg80211_del_sta(priv->netdev, adapter->event_body +
+                                 MWIFIEX_UAP_EVENT_EXTRA_HEADER, GFP_KERNEL);
                 break;
         case EVENT_UAP_BSS_IDLE:
                 priv->media_connected = false;
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index e2faec4db108..cecb27283196 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -161,15 +161,11 @@ int mwifiex_write_data_complete(struct mwifiex_adapter *adapter,
                 goto done;
 
         for (i = 0; i < adapter->priv_num; i++) {
-
                 tpriv = adapter->priv[i];
 
-                if ((GET_BSS_ROLE(tpriv) == MWIFIEX_BSS_ROLE_STA) &&
-                    (tpriv->media_connected)) {
-                        if (netif_queue_stopped(tpriv->netdev))
-                                mwifiex_wake_up_net_dev_queue(tpriv->netdev,
-                                                              adapter);
-                }
+                if (tpriv->media_connected &&
+                    netif_queue_stopped(tpriv->netdev))
+                        mwifiex_wake_up_net_dev_queue(tpriv->netdev, adapter);
         }
 done:
         dev_kfree_skb_any(skb);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 8173ab66066d..89f9a2a45de3 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -27,6 +27,17 @@ int mwifiex_set_secure_params(struct mwifiex_private *priv,
                               struct cfg80211_ap_settings *params) {
         int i;
 
+        if (!params->privacy) {
+                bss_config->protocol = PROTOCOL_NO_SECURITY;
+                bss_config->key_mgmt = KEY_MGMT_NONE;
+                bss_config->wpa_cfg.length = 0;
+                priv->sec_info.wep_enabled = 0;
+                priv->sec_info.wpa_enabled = 0;
+                priv->sec_info.wpa2_enabled = 0;
+
+                return 0;
+        }
+
         switch (params->auth_type) {
         case NL80211_AUTHTYPE_OPEN_SYSTEM:
                 bss_config->auth_mode = WLAN_AUTH_OPEN;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 49ebf20c56eb..22a5916564b8 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -49,6 +49,7 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         struct device *dev = adapter->dev;
         u32 recv_type;
         __le32 tmp;
+        int ret;
 
         if (adapter->hs_activated)
                 mwifiex_process_hs_config(adapter);
@@ -69,16 +70,19 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_CMD:
                         if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
                                 dev_err(dev, "CMD: skb->len too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         } else if (!adapter->curr_cmd) {
                                 dev_dbg(dev, "CMD: no curr_cmd\n");
                                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                                         mwifiex_process_sleep_confirm_resp(
                                                         adapter, skb->data,
                                                         skb->len);
-                                        return 0;
+                                        ret = 0;
+                                        goto exit_restore_skb;
                                 }
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
                         adapter->curr_cmd->resp_skb = skb;
@@ -87,20 +91,22 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_EVENT:
                         if (skb->len < sizeof(u32)) {
                                 dev_err(dev, "EVENT: skb->len too small\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
                         skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
                         adapter->event_cause = le32_to_cpu(tmp);
-                        skb_pull(skb, sizeof(u32));
                         dev_dbg(dev, "event_cause %#x\n", adapter->event_cause);
 
                         if (skb->len > MAX_EVENT_SIZE) {
                                 dev_err(dev, "EVENT: event body too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
-                        skb_copy_from_linear_data(skb, adapter->event_body,
-                                                  skb->len);
+                        memcpy(adapter->event_body, skb->data +
+                               MWIFIEX_EVENT_HEADER_LEN, skb->len);
+
                         adapter->event_received = true;
                         adapter->event_skb = skb;
                         break;
@@ -124,6 +130,12 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         }
 
         return -EINPROGRESS;
+
+exit_restore_skb:
+        /* The buffer will be reused for further cmds/events */
+        skb_push(skb, INTF_HEADER_LEN);
+
+        return ret;
 }
 
 static void mwifiex_usb_rx_complete(struct urb *urb)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index f3fc65515857..3fa4d4176993 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                 priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
                 priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
 
+                mwifiex_reset_11n_rx_seq_num(priv);
+
                 atomic_set(&priv->wmm.tx_pkts_queued, 0);
                 atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
         }
@@ -1221,6 +1223,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
 
         if (!ptr->is_11n_enabled ||
             mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
+            priv->wps.session_enable ||
             ((priv->sec_info.wpa_enabled ||
               priv->sec_info.wpa2_enabled) &&
              !priv->wpa_is_gtk_set)) {
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 2e9e6af21362..dfcd02ab6cae 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2110,7 +2110,7 @@ resize_buf:
         while (check_bssid_list_item(bssid, bssid_len, buf, len)) {
                 if (rndis_bss_info_update(usbdev, bssid) && match_bssid &&
                     matched) {
-                        if (!ether_addr_equal(bssid->mac, match_bssid))
+                        if (ether_addr_equal(bssid->mac, match_bssid))
                                 *matched = true;
                 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index d357d1ed92f6..74ecc33fdd90 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -436,8 +436,8 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
         case QID_RX:
                 if (!rt2x00queue_full(queue))
                         rt2x00queue_for_each_entry(queue,
-                                                   Q_INDEX_DONE,
                                                    Q_INDEX,
+                                                   Q_INDEX_DONE,
                                                    NULL,
                                                    rt2x00usb_kick_rx_entry);
                 break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d228358e6a40..9970c2b1b199 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
         {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+        {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+        {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
         /* HP - Lite-On ,8188CUS Slim Combo */
         {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
         {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -346,6 +348,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
         {RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+        {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
         {RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
         {RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
         {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index ad87a1ac6462..db6430c1a084 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -869,7 +869,7 @@ int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime)
         }
 
         *mactime = tsf_info->current_tsf_lsb |
-                (tsf_info->current_tsf_msb << 31);
+                ((u64)tsf_info->current_tsf_msb << 32);
 
 out:
         kfree(tsf_info);
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 9f15ccaf8f05..5ec50a476a69 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -76,8 +76,7 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                 }
         }
 
-        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID &&
-            wl->station_mode != STATION_ACTIVE_MODE) {
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index 87f6305bda2c..567660cd2fcd 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -73,6 +73,8 @@ static void wl1251_spi_reset(struct wl1251 *wl)
         spi_sync(wl_to_spi(wl), &m);
 
         wl1251_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+
+        kfree(cmd);
 }
 
 static void wl1251_spi_wake(struct wl1251 *wl)
@@ -127,6 +129,8 @@ static void wl1251_spi_wake(struct wl1251 *wl)
         spi_sync(wl_to_spi(wl), &m);
 
         wl1251_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
+
+        kfree(cmd);
 }
 
 static void wl1251_spi_reset_wake(struct wl1251 *wl)
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
index 54156b0b5c2d..d7b907e67170 100644
--- a/drivers/net/wireless/ti/wlcore/Kconfig
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -1,7 +1,6 @@
 config WLCORE
         tristate "TI wlcore support"
         depends on WL_TI && GENERIC_HARDIRQS && MAC80211
-        depends on INET
         select FW_LOADER
         ---help---
           This module contains the main code for TI WLAN chips.  It abstracts