As you know, the rule is to use who for semantic subjects and whom for semantic objects. For example,
 I have visited whom. <object of 'visited'>But when that WH-word sits in a subject position, as in the second example above, speakers might use who instead of whom.
 Whom have you visited? <object of 'visited'>
Who have you visited? <Subject of the sentence>Prepositions are omitted only if their meaning can be picked up in the context:
Where are you going (to)?
What time will you go (at)?