32 files changed, 199 insertions, 57 deletions

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index d120a5c1c093..ab3894f742c3 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -68,6 +68,9 @@ static struct usb_device_id btusb_table[] = {
         /* Apple MacBookPro6,2 */
         { USB_DEVICE(0x05ac, 0x8218) },
 
+        /* Apple MacBookAir3,1, MacBookAir3,2 */
+        { USB_DEVICE(0x05ac, 0x821b) },
+
         /* AVM BlueFRITZ! USB v2.0 */
         { USB_DEVICE(0x057c, 0x3800) },
 
@@ -1029,6 +1032,8 @@ static int btusb_probe(struct usb_interface *intf,
 
         usb_set_intfdata(intf, data);
 
+        usb_enable_autosuspend(interface_to_usbdev(intf));
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index a0471f2e1c7a..48261b7252d0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -410,6 +410,9 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                         val &= ~(AR_WA_BIT6 | AR_WA_BIT7);
                 }
 
+                if (AR_SREV_9280(ah))
+                        val |= AR_WA_BIT22;
+
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index be9c8d3b3337..6f90acc5cca7 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -657,6 +657,7 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 }
 
 extern struct ieee80211_ops ath9k_ops;
+extern struct pm_qos_request_list ath9k_pm_qos_req;
 extern int modparam_nohwcrypt;
 extern int led_blink;
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 34a588837d4d..e75697858ae8 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -37,7 +37,7 @@ static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
         int addr, eep_start_loc;
         eep_data = (u16 *)eep;
 
-        if (ah->hw_version.devid == 0x7015)
+        if (AR9287_HTC_DEVID(ah))
                 eep_start_loc = AR9287_HTC_EEP_START_LOC;
         else
                 eep_start_loc = AR9287_EEP_START_LOC;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 6576f683dba0..dfb6560dab92 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -35,8 +35,14 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
         { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
         { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3346) }, /* IMC Networks */
+        { USB_DEVICE(0x13D3, 0x3348) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
         { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
         { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
+        { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
+        { USB_DEVICE(0x1668, 0x1200) }, /* Verizon */
         { },
 };
 
@@ -540,11 +546,11 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                         return;
                 }
 
-                usb_fill_int_urb(urb, hif_dev->udev,
+                usb_fill_bulk_urb(urb, hif_dev->udev,
                                  usb_rcvbulkpipe(hif_dev->udev,
                                                  USB_REG_IN_PIPE),
                                  nskb->data, MAX_REG_IN_BUF_SIZE,
-                                 ath9k_hif_usb_reg_in_cb, nskb, 1);
+                                 ath9k_hif_usb_reg_in_cb, nskb);
 
                 ret = usb_submit_urb(urb, GFP_ATOMIC);
                 if (ret) {
@@ -720,11 +726,11 @@ static int ath9k_hif_usb_alloc_reg_in_urb(struct hif_device_usb *hif_dev)
         if (!skb)
                 goto err;
 
-        usb_fill_int_urb(hif_dev->reg_in_urb, hif_dev->udev,
+        usb_fill_bulk_urb(hif_dev->reg_in_urb, hif_dev->udev,
                          usb_rcvbulkpipe(hif_dev->udev,
                                          USB_REG_IN_PIPE),
                          skb->data, MAX_REG_IN_BUF_SIZE,
-                         ath9k_hif_usb_reg_in_cb, skb, 1);
+                         ath9k_hif_usb_reg_in_cb, skb);
 
         if (usb_submit_urb(hif_dev->reg_in_urb, GFP_KERNEL) != 0)
                 goto err;
@@ -805,6 +811,8 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 firm_offset = AR7010_FIRMWARE_TEXT;
                 break;
         default:
@@ -843,14 +851,6 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
                 goto err_fw_req;
         }
 
-        /* Alloc URBs */
-        ret = ath9k_hif_usb_alloc_urbs(hif_dev);
-        if (ret) {
-                dev_err(&hif_dev->udev->dev,
-                        "ath9k_htc: Unable to allocate URBs\n");
-                goto err_urb;
-        }
-
         /* Download firmware */
         ret = ath9k_hif_usb_download_fw(hif_dev);
         if (ret) {
@@ -866,16 +866,22 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
          */
         for (idx = 0; idx < alt->desc.bNumEndpoints; idx++) {
                 endp = &alt->endpoint[idx].desc;
-                if (((endp->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK)
-                                == 0x04) &&
-                    ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
-                                == USB_ENDPOINT_XFER_INT)) {
+                if ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                == USB_ENDPOINT_XFER_INT) {
                         endp->bmAttributes &= ~USB_ENDPOINT_XFERTYPE_MASK;
                         endp->bmAttributes |= USB_ENDPOINT_XFER_BULK;
                         endp->bInterval = 0;
                 }
         }
 
+        /* Alloc URBs */
+        ret = ath9k_hif_usb_alloc_urbs(hif_dev);
+        if (ret) {
+                dev_err(&hif_dev->udev->dev,
+                        "ath9k_htc: Unable to allocate URBs\n");
+                goto err_urb;
+        }
+
         return 0;
 
 err_fw_download:
@@ -929,6 +935,8 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
                         hif_dev->fw_name = FIRMWARE_AR7010_1_1;
                 else
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f214e8e581ca..cba904a3e320 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -249,6 +249,8 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 priv->htc->credits = 45;
                 break;
         default:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 5324ffd96ec7..77958675b55f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -128,7 +128,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                         tx_hdr.data_type = ATH9K_HTC_NORMAL;
                 }
 
-                if (ieee80211_is_data(fc)) {
+                if (ieee80211_is_data_qos(fc)) {
                         qc = ieee80211_get_qos_ctl(hdr);
                         tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c686987c4840..ce9e59f4cd3d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -479,6 +479,7 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
                           "Failed allocating banks for "
                           "external radio\n");
+                ath9k_hw_rf_free_ext_banks(ah);
                 return ecode;
         }
 
@@ -947,9 +948,12 @@ static void ath9k_hw_set_operating_mode(struct ath_hw *ah, int opmode)
                 REG_SET_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_MONITOR:
                 REG_WRITE(ah, AR_STA_ID1, val | AR_STA_ID1_KSRCH_MODE);
                 break;
+        default:
+                if (ah->is_monitoring)
+                        REG_WRITE(ah, AR_STA_ID1, val | AR_STA_ID1_KSRCH_MODE);
+                break;
         }
 }
 
@@ -1629,7 +1633,6 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
 
         switch (ah->opmode) {
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_MONITOR:
                 REG_WRITE(ah, AR_NEXT_TBTT_TIMER, TU_TO_USEC(next_beacon));
                 REG_WRITE(ah, AR_NEXT_DMA_BEACON_ALERT, 0xffff);
                 REG_WRITE(ah, AR_NEXT_SWBA, 0x7ffff);
@@ -1658,6 +1661,14 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
                         AR_TBTT_TIMER_EN | AR_DBA_TIMER_EN | AR_SWBA_TIMER_EN;
                 break;
         default:
+                if (ah->is_monitoring) {
+                        REG_WRITE(ah, AR_NEXT_TBTT_TIMER,
+                                        TU_TO_USEC(next_beacon));
+                        REG_WRITE(ah, AR_NEXT_DMA_BEACON_ALERT, 0xffff);
+                        REG_WRITE(ah, AR_NEXT_SWBA, 0x7ffff);
+                        flags |= AR_TBTT_TIMER_EN;
+                        break;
+                }
                 ath_print(ath9k_hw_common(ah), ATH_DBG_BEACON,
                           "%s: unsupported opmode: %d\n",
                           __func__, ah->opmode);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index d5e68347ef72..cc8f3b9af71f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -665,6 +665,7 @@ struct ath_hw {
 
         bool sw_mgmt_crypto;
         bool is_pciexpress;
+        bool is_monitoring;
         bool need_an_top2_fixup;
         u16 tx_trig_level;
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e7764ce881df..7eef1faee668 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/pm_qos_params.h>
 
 #include "ath9k.h"
 
@@ -179,6 +180,8 @@ static const struct ath_ops ath9k_common_ops = {
         .write = ath9k_iowrite32,
 };
 
+struct pm_qos_request_list ath9k_pm_qos_req;
+
 /**************************/
 /*     Initialization     */
 /**************************/
@@ -753,6 +756,9 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
         ath_init_leds(sc);
         ath_start_rfkill_poll(sc);
 
+        pm_qos_add_request(&ath9k_pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
+                           PM_QOS_DEFAULT_VALUE);
+
         return 0;
 
 error_world:
@@ -821,6 +827,7 @@ void ath9k_deinit_device(struct ath_softc *sc)
         }
 
         ieee80211_unregister_hw(hw);
+        pm_qos_remove_request(&ath9k_pm_qos_req);
         ath_rx_cleanup(sc);
         ath_tx_cleanup(sc);
         ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index dede9a9aa689..50bdb5db23b4 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/nl80211.h>
+#include <linux/pm_qos_params.h>
 #include "ath9k.h"
 #include "btcoex.h"
 
@@ -93,11 +94,13 @@ void ath9k_ps_wakeup(struct ath_softc *sc)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         unsigned long flags;
+        enum ath9k_power_mode power_mode;
 
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if (++sc->ps_usecount != 1)
                 goto unlock;
 
+        power_mode = sc->sc_ah->power_mode;
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
 
         /*
@@ -105,10 +108,12 @@ void ath9k_ps_wakeup(struct ath_softc *sc)
          * useful data. Better clear them now so that they don't mess up
          * survey data results.
          */
-        spin_lock(&common->cc_lock);
-        ath_hw_cycle_counters_update(common);
-        memset(&common->cc_survey, 0, sizeof(common->cc_survey));
-        spin_unlock(&common->cc_lock);
+        if (power_mode != ATH9K_PM_AWAKE) {
+                spin_lock(&common->cc_lock);
+                ath_hw_cycle_counters_update(common);
+                memset(&common->cc_survey, 0, sizeof(common->cc_survey));
+                spin_unlock(&common->cc_lock);
+        }
 
  unlock:
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
@@ -1157,6 +1162,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 ah->imask |= ATH9K_INT_CST;
 
         sc->sc_flags &= ~SC_OP_INVALID;
+        sc->sc_ah->is_monitoring = false;
 
         /* Disable BMISS interrupt when we're not associated */
         ah->imask &= ~(ATH9K_INT_SWBA | ATH9K_INT_BMISS);
@@ -1178,6 +1184,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
                         ath9k_btcoex_timer_resume(sc);
         }
 
+        pm_qos_update_request(&ath9k_pm_qos_req, 55);
+
 mutex_unlock:
         mutex_unlock(&sc->mutex);
 
@@ -1331,6 +1339,8 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         sc->sc_flags |= SC_OP_INVALID;
 
+        pm_qos_update_request(&ath9k_pm_qos_req, PM_QOS_DEFAULT_VALUE);
+
         mutex_unlock(&sc->mutex);
 
         ath_print(common, ATH_DBG_CONFIG, "Driver halt\n");
@@ -1409,8 +1419,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         ath9k_hw_set_interrupts(ah, ah->imask);
 
         if (vif->type == NL80211_IFTYPE_AP    ||
-            vif->type == NL80211_IFTYPE_ADHOC ||
-            vif->type == NL80211_IFTYPE_MONITOR) {
+            vif->type == NL80211_IFTYPE_ADHOC) {
                 sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
         }
@@ -1560,8 +1569,12 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
                 if (conf->flags & IEEE80211_CONF_MONITOR) {
                         ath_print(common, ATH_DBG_CONFIG,
-                                  "HW opmode set to Monitor mode\n");
-                        sc->sc_ah->opmode = NL80211_IFTYPE_MONITOR;
+                                  "Monitor mode is enabled\n");
+                        sc->sc_ah->is_monitoring = true;
+                } else {
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "Monitor mode is disabled\n");
+                        sc->sc_ah->is_monitoring = false;
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 60300b225b6d..262c81595f6d 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -441,7 +441,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
          */
         if (((sc->sc_ah->opmode != NL80211_IFTYPE_AP) &&
              (sc->rx.rxfilter & FIF_PROMISC_IN_BSS)) ||
-            (sc->sc_ah->opmode == NL80211_IFTYPE_MONITOR))
+            (sc->sc_ah->is_monitoring))
                 rfilt |= ATH9K_RX_FILTER_PROM;
 
         if (sc->rx.rxfilter & FIF_CONTROL)
@@ -518,7 +518,7 @@ bool ath_stoprecv(struct ath_softc *sc)
         bool stopped;
 
         spin_lock_bh(&sc->rx.rxbuflock);
-        ath9k_hw_stoppcurecv(ah);
+        ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
 
@@ -899,7 +899,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
                  * decryption and MIC failures. For monitor mode,
                  * we also ignore the CRC error.
                  */
-                if (ah->opmode == NL80211_IFTYPE_MONITOR) {
+                if (ah->is_monitoring) {
                         if (rx_stats->rs_status &
                             ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
                               ATH9K_RXERR_CRC))
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index f6058b439fb3..f1bbc7560c86 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -703,6 +703,7 @@
 #define AR_WA_RESET_EN                  (1 << 18) /* Sw Control to enable PCI-Reset to POR (bit 15) */
 #define AR_WA_ANALOG_SHIFT              (1 << 20)
 #define AR_WA_POR_SHORT                 (1 << 21) /* PCI-E Phy reset control */
+#define AR_WA_BIT22                     (1 << 22)
 #define AR9285_WA_DEFAULT               0x004a050b
 #define AR9280_WA_DEFAULT               0x0040073b
 #define AR_WA_DEFAULT                   0x0000073f
@@ -865,7 +866,13 @@
 #define AR_DEVID_7010(_ah) \
         (((_ah)->hw_version.devid == 0x7010) || \
          ((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x9018))
+         ((_ah)->hw_version.devid == 0x9018) || \
+         ((_ah)->hw_version.devid == 0xA704) || \
+         ((_ah)->hw_version.devid == 0x1200))
+
+#define AR9287_HTC_DEVID(_ah) \
+        (((_ah)->hw_version.devid == 0x7015) || \
+         ((_ah)->hw_version.devid == 0x1200))
 
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4ae6a5849076..511dbe3caf58 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -663,7 +663,7 @@ init:
         }
 
 unlock:
-        if (err && (vif_id != -1)) {
+        if (err && (vif_id >= 0)) {
                 vif_priv->active = false;
                 bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
                 ar->vifs--;
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index ddf5373ee689..a268053e18e5 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -82,9 +82,11 @@ static struct usb_device_id carl9170_usb_ids[] = {
         { USB_DEVICE(0x07d1, 0x3c10) },
         /* D-Link DWA 160 A2 */
         { USB_DEVICE(0x07d1, 0x3a09) },
+        /* D-Link DWA 130 D */
+        { USB_DEVICE(0x07d1, 0x3a0f) },
         /* Netgear WNA1000 */
         { USB_DEVICE(0x0846, 0x9040) },
-        /* Netgear WNDA3100 */
+        /* Netgear WNDA3100 (v1) */
         { USB_DEVICE(0x0846, 0x9010) },
         /* Netgear WN111 v2 */
         { USB_DEVICE(0x0846, 0x9001), .driver_info = CARL9170_ONE_LED },
@@ -551,12 +553,12 @@ static int carl9170_usb_flush(struct ar9170 *ar)
                 usb_free_urb(urb);
         }
 
-        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, HZ);
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, 1000);
         if (ret == 0)
                 err = -ETIMEDOUT;
 
         /* lets wait a while until the tx - queues are dried out */
-        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, HZ);
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, 1000);
         if (ret == 0)
                 err = -ETIMEDOUT;
 
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 9a55338d957f..09e2dfd7b175 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
         kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
         sdio_disable_func(func);
 err_release_host:
         sdio_release_host(func);
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index 32dee2ce5d31..d5ef696298ee 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -54,6 +54,7 @@
 
 #define DRV_DESCRIPTION "802.11 data/management/control stack"
 #define DRV_NAME        "libipw"
+#define DRV_PROCNAME    "ieee80211"
 #define DRV_VERSION     LIBIPW_VERSION
 #define DRV_COPYRIGHT   "Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>"
 
@@ -293,16 +294,16 @@ static int __init libipw_init(void)
         struct proc_dir_entry *e;
 
         libipw_debug_level = debug;
-        libipw_proc = proc_mkdir("ieee80211", init_net.proc_net);
+        libipw_proc = proc_mkdir(DRV_PROCNAME, init_net.proc_net);
         if (libipw_proc == NULL) {
-                LIBIPW_ERROR("Unable to create " DRV_NAME
+                LIBIPW_ERROR("Unable to create " DRV_PROCNAME
                                 " proc directory\n");
                 return -EIO;
         }
         e = proc_create("debug_level", S_IRUGO | S_IWUSR, libipw_proc,
                         &debug_level_proc_fops);
         if (!e) {
-                remove_proc_entry(DRV_NAME, init_net.proc_net);
+                remove_proc_entry(DRV_PROCNAME, init_net.proc_net);
                 libipw_proc = NULL;
                 return -EIO;
         }
@@ -319,7 +320,7 @@ static void __exit libipw_exit(void)
 #ifdef CONFIG_LIBIPW_DEBUG
         if (libipw_proc) {
                 remove_proc_entry("debug_level", libipw_proc);
-                remove_proc_entry(DRV_NAME, init_net.proc_net);
+                remove_proc_entry(DRV_PROCNAME, init_net.proc_net);
                 libipw_proc = NULL;
         }
 #endif                          /* CONFIG_LIBIPW_DEBUG */
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c3ebc04cbd00..8eb1393506bc 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3997,7 +3997,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * "the hard way", rather than using device's scan.
          */
         if (iwl3945_mod_params.disable_hw_scan) {
-                IWL_ERR(priv, "sw scan support is deprecated\n");
+                dev_printk(KERN_DEBUG, &(pdev->dev),
+                        "sw scan support is deprecated\n");
                 iwl3945_hw_ops.hw_scan = NULL;
         }
 
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index a90953678b99..dee32d3681a5 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -698,8 +698,9 @@ static void lbs_scan_worker(struct work_struct *work)
 
         if (priv->scan_channel < priv->scan_req->n_channels) {
                 cancel_delayed_work(&priv->scan_work);
-                queue_delayed_work(priv->work_thread, &priv->scan_work,
-                        msecs_to_jiffies(300));
+                if (!priv->stopping)
+                        queue_delayed_work(priv->work_thread, &priv->scan_work,
+                                msecs_to_jiffies(300));
         }
 
         /* This is the final data we are about to send */
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index f5a9851fc7ee..18dd9a02c459 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -36,6 +36,7 @@ struct lbs_private {
         /* CFG80211 */
         struct wireless_dev *wdev;
         bool wiphy_registered;
+        bool stopping;
         struct cfg80211_scan_request *scan_req;
         u8 assoc_bss[ETH_ALEN];
         u8 disassoc_reason;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 6d7af91d52c2..143473c59393 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -104,6 +104,7 @@ static int lbs_dev_open(struct net_device *dev)
         lbs_deb_enter(LBS_DEB_NET);
 
         spin_lock_irq(&priv->driver_lock);
+        priv->stopping = false;
 
         if (priv->connect_status == LBS_CONNECTED)
                 netif_carrier_on(dev);
@@ -131,10 +132,16 @@ static int lbs_eth_stop(struct net_device *dev)
         lbs_deb_enter(LBS_DEB_NET);
 
         spin_lock_irq(&priv->driver_lock);
+        priv->stopping = true;
         netif_stop_queue(dev);
         spin_unlock_irq(&priv->driver_lock);
 
         schedule_work(&priv->mcast_work);
+        cancel_delayed_work_sync(&priv->scan_work);
+        if (priv->scan_req) {
+                cfg80211_scan_done(priv->scan_req, false);
+                priv->scan_req = NULL;
+        }
 
         lbs_deb_leave(LBS_DEB_NET);
         return 0;
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index ef9c6a04ad8f..744d3f6e4709 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC,  0x4318) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index c6bcfe93b9ca..32bd56949604 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2047,6 +2047,7 @@
 #define PCI_DEVICE_ID_AFAVLAB_P030      0x2182
 #define PCI_SUBDEVICE_ID_AFAVLAB_P061           0x2150
 
+#define PCI_VENDOR_ID_BCM_GVC          0x14a4
 #define PCI_VENDOR_ID_BROADCOM          0x14e4
 #define PCI_DEVICE_ID_TIGON3_5752       0x1600
 #define PCI_DEVICE_ID_TIGON3_5752M      0x1601
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8fd9eebd0cc9..91f099556ac1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1361,7 +1361,7 @@ enum wiphy_flags {
         WIPHY_FLAG_4ADDR_AP                     = BIT(5),
         WIPHY_FLAG_4ADDR_STATION                = BIT(6),
         WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
-        WIPHY_FLAG_IBSS_RSN                     = BIT(7),
+        WIPHY_FLAG_IBSS_RSN                     = BIT(8),
 };
 
 struct mac_address {
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 1fa5306e3e23..51665b3461b8 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -2,6 +2,7 @@
 #define _NET_DST_OPS_H
 #include <linux/types.h>
 #include <linux/percpu_counter.h>
+#include <linux/cache.h>
 
 struct dst_entry;
 struct kmem_cachep;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index bfef5bae0b3a..84093b0000b9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1175,6 +1175,12 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                                 hci_send_cmd(hdev,
                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
                                                         sizeof(cp), &cp);
+                        } else if (!ev->status && conn->out &&
+                                        conn->sec_level == BT_SECURITY_HIGH) {
+                                struct hci_cp_auth_requested cp;
+                                cp.handle = ev->handle;
+                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
+                                                        sizeof(cp), &cp);
                         } else {
                                 conn->state = BT_CONNECTED;
                                 hci_proto_connect_cfm(conn, ev->status);
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 98fdfa1fbddd..86a91543172a 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && INPUT
+        depends on BT && BT_L2CAP && INPUT && HID_SUPPORT
         select HID
         help
           HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index daa7a988d9a6..cd8f6ea03841 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2421,11 +2421,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                 break;
 
         case 2:
-                *val = __le16_to_cpu(*((__le16 *) opt->val));
+                *val = get_unaligned_le16(opt->val);
                 break;
 
         case 4:
-                *val = __le32_to_cpu(*((__le32 *) opt->val));
+                *val = get_unaligned_le32(opt->val);
                 break;
 
         default:
@@ -2452,11 +2452,11 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
                 break;
 
         case 2:
-                *((__le16 *) opt->val) = cpu_to_le16(val);
+                put_unaligned_le16(val, opt->val);
                 break;
 
         case 4:
-                *((__le32 *) opt->val) = cpu_to_le32(val);
+                put_unaligned_le32(val, opt->val);
                 break;
 
         default:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 39a5d87e33b4..fa642aa652bd 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -79,7 +79,10 @@ static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 
 static void rfcomm_process_connect(struct rfcomm_session *s);
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err);
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 static void rfcomm_session_del(struct rfcomm_session *s);
 
@@ -401,7 +404,7 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
 
         s = rfcomm_session_get(src, dst);
         if (!s) {
-                s = rfcomm_session_create(src, dst, &err);
+                s = rfcomm_session_create(src, dst, d->sec_level, &err);
                 if (!s)
                         return err;
         }
@@ -679,7 +682,10 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         rfcomm_session_put(s);
 }
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err)
 {
         struct rfcomm_session *s = NULL;
         struct sockaddr_l2 addr;
@@ -704,6 +710,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         sk = sock->sk;
         lock_sock(sk);
         l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->sec_level = sec_level;
         if (l2cap_ertm)
                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f9163b12c7f1..7aa85591dbe7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -391,6 +391,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         u32 hw_reconf_flags = 0;
         int i;
 
+        if (local->scan_sdata == sdata)
+                ieee80211_scan_cancel(local);
+
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
         /*
@@ -523,9 +526,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 synchronize_rcu();
                 skb_queue_purge(&sdata->skb_queue);
 
-                if (local->scan_sdata == sdata)
-                        ieee80211_scan_cancel(local);
-
                 /*
                  * Disable beaconing here for mesh only, AP and IBSS
                  * are already taken care of.
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d0c92dddb26b..17cd0c04d139 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -44,6 +44,38 @@ rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
         return chan;
 }
 
+static bool can_beacon_sec_chan(struct wiphy *wiphy,
+                                struct ieee80211_channel *chan,
+                                enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *sec_chan;
+        int diff;
+
+        switch (channel_type) {
+        case NL80211_CHAN_HT40PLUS:
+                diff = 20;
+                break;
+        case NL80211_CHAN_HT40MINUS:
+                diff = -20;
+                break;
+        default:
+                return false;
+        }
+
+        sec_chan = ieee80211_get_channel(wiphy, chan->center_freq + diff);
+        if (!sec_chan)
+                return false;
+
+        /* we'll need a DFS capability later */
+        if (sec_chan->flags & (IEEE80211_CHAN_DISABLED |
+                               IEEE80211_CHAN_PASSIVE_SCAN |
+                               IEEE80211_CHAN_NO_IBSS |
+                               IEEE80211_CHAN_RADAR))
+                return false;
+
+        return true;
+}
+
 int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, int freq,
                       enum nl80211_channel_type channel_type)
@@ -68,6 +100,28 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
         if (!chan)
                 return -EINVAL;
 
+        /* Both channels should be able to initiate communication */
+        if (wdev && (wdev->iftype == NL80211_IFTYPE_ADHOC ||
+                     wdev->iftype == NL80211_IFTYPE_AP ||
+                     wdev->iftype == NL80211_IFTYPE_AP_VLAN ||
+                     wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
+                     wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
+                switch (channel_type) {
+                case NL80211_CHAN_HT40PLUS:
+                case NL80211_CHAN_HT40MINUS:
+                        if (!can_beacon_sec_chan(&rdev->wiphy, chan,
+                                                 channel_type)) {
+                                printk(KERN_DEBUG
+                                       "cfg80211: Secondary channel not "
+                                       "allowed to initiate communication\n");
+                                return -EINVAL;
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
         result = rdev->ops->set_channel(&rdev->wiphy,
                                         wdev ? wdev->netdev : NULL,
                                         chan, channel_type);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 605553842226..b15eb77195d8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -230,8 +230,8 @@ static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
         }
 
         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
-        if (IS_ERR(dev)) {
-                err = PTR_ERR(dev);
+        if (IS_ERR(*rdev)) {
+                err = PTR_ERR(*rdev);
                 goto out_rtnl;
         }