25 files changed, 126 insertions, 94 deletions

diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index db7cb8111fbe..106beb194f3c 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -105,7 +105,7 @@ static int ath3k_load_firmware(struct usb_device *udev,
 
         pipe = usb_sndctrlpipe(udev, 0);
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
@@ -176,7 +176,7 @@ static int ath3k_load_fwfile(struct usb_device *udev,
 
         count = firmware->size;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 8b1b643a519b..54952ab800b8 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -24,6 +24,7 @@
 
 #include <linux/module.h>
 
+#include <linux/atomic.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -65,6 +66,7 @@ struct bcm203x_data {
         unsigned long           state;
 
         struct work_struct      work;
+        atomic_t                shutdown;
 
         struct urb              *urb;
         unsigned char           *buffer;
@@ -97,6 +99,7 @@ static void bcm203x_complete(struct urb *urb)
 
                 data->state = BCM203X_SELECT_MEMORY;
 
+                /* use workqueue to have a small delay */
                 schedule_work(&data->work);
                 break;
 
@@ -155,7 +158,10 @@ static void bcm203x_work(struct work_struct *work)
         struct bcm203x_data *data =
                 container_of(work, struct bcm203x_data, work);
 
-        if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
+        if (atomic_read(&data->shutdown))
+                return;
+
+        if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
                 BT_ERR("Can't submit URB");
 }
 
@@ -243,6 +249,7 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
 
         usb_set_intfdata(intf, data);
 
+        /* use workqueue to have a small delay */
         schedule_work(&data->work);
 
         return 0;
@@ -254,6 +261,9 @@ static void bcm203x_disconnect(struct usb_interface *intf)
 
         BT_DBG("intf %p", intf);
 
+        atomic_inc(&data->shutdown);
+        cancel_work_sync(&data->work);
+
         usb_kill_urb(data->urb);
 
         usb_set_intfdata(intf, NULL);
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 005919ab043c..61b591470a90 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -568,22 +568,23 @@ static int bfusb_load_firmware(struct bfusb_data *data,
 
         BT_INFO("BlueFRITZ! USB loading firmware");
 
+        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL);
+        if (!buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
         pipe = usb_sndctrlpipe(data->udev, 0);
 
         if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
                                 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) {
                 BT_ERR("Can't change to loading configuration");
+                kfree(buf);
                 return -EBUSY;
         }
 
         data->udev->toggle[0] = data->udev->toggle[1] = 0;
 
-        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_ATOMIC);
-        if (!buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
 
         while (count) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index e0ab0657cc3a..88279e325dca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -868,10 +868,6 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         /* Do PA Calibration */
         ar9002_hw_pa_cal(ah, true);
 
-        /* Do NF Calibration after DC offset and other calibrations */
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
-
         if (ah->caldata)
                 ah->caldata->nfcal_pending = true;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 16851cb109a6..12a730dcb500 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -908,12 +908,15 @@ static bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
         int i;
         bool restore;
 
-        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT) || !ah->caldata)
+        if (!ah->caldata)
                 return false;
 
         hist = &ah->caldata->rtt_hist;
+        if (!hist->num_readings)
+                return false;
+
         ar9003_hw_rtt_enable(ah);
-        ar9003_hw_rtt_set_mask(ah, 0x10);
+        ar9003_hw_rtt_set_mask(ah, 0x00);
         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                 if (!(ah->rxchainmask & (1 << i)))
                         continue;
@@ -1070,6 +1073,7 @@ skip_tx_iqcal:
                 if (is_reusable && (hist->num_readings < RTT_HIST_MAX)) {
                         u32 *table;
 
+                        hist->num_readings++;
                         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                                 if (!(ah->rxchainmask & (1 << i)))
                                         continue;
@@ -1081,9 +1085,6 @@ skip_tx_iqcal:
                 ar9003_hw_rtt_disable(ah);
         }
 
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
-
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
         ah->supp_cals = IQ_MISMATCH_CAL;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 2f4023e66081..4114fe752c6b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -572,14 +572,14 @@
 
 #define AR_PHY_TXGAIN_TABLE      (AR_SM_BASE + 0x300)
 
-#define AR_PHY_TX_IQCAL_CONTROL_0   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c4 : 0x444)
-#define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c8 : 0x448)
-#define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c4 : 0x440)
-#define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3f0 : 0x48c)
+#define AR_PHY_TX_IQCAL_CONTROL_0   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c4 : 0x444))
+#define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c8 : 0x448))
+#define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c4 : 0x440))
+#define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3f0 : 0x48c))
 #define AR_PHY_TX_IQCAL_CORR_COEFF_B0(_i)    (AR_SM_BASE + \
                                              (AR_SREV_9485(ah) ? \
                                               0x3d0 : 0x450) + ((_i) << 2))
@@ -651,7 +651,7 @@
 #define AR_SWITCH_TABLE_ALL_S (0)
 
 #define AR_PHY_65NM_CH0_THERM       (AR_SREV_9300(ah) ? 0x16290 :\
-                                        (AR_SREV_9485(ah) ? 0x1628c : 0x16294))
+                                        (AR_SREV_9462(ah) ? 0x16294 : 0x1628c))
 
 #define AR_PHY_65NM_CH0_THERM_LOCAL   0x80000000
 #define AR_PHY_65NM_CH0_THERM_LOCAL_S 31
@@ -668,12 +668,12 @@
 #define AR_PHY_65NM_CH2_RXTX2       0x16904
 
 #define AR_CH0_TOP2             (AR_SREV_9300(ah) ? 0x1628c : \
-                                        (AR_SREV_9485(ah) ? 0x16284 : 0x16290))
+                                        (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
 #define AR_CH0_TOP2_XPABIASLVL          0xf000
 #define AR_CH0_TOP2_XPABIASLVL_S        12
 
 #define AR_CH0_XTAL             (AR_SREV_9300(ah) ? 0x16294 : \
-                                        (AR_SREV_9485(ah) ? 0x16290 : 0x16298))
+                                        (AR_SREV_9462(ah) ? 0x16298 : 0x16290))
 #define AR_CH0_XTAL_CAPINDAC    0x7f000000
 #define AR_CH0_XTAL_CAPINDAC_S  24
 #define AR_CH0_XTAL_CAPOUTDAC   0x00fe0000
@@ -908,8 +908,8 @@
 #define AR_PHY_TPC_5_B1         (AR_SM1_BASE + 0x208)
 #define AR_PHY_TPC_6_B1         (AR_SM1_BASE + 0x20c)
 #define AR_PHY_TPC_11_B1        (AR_SM1_BASE + 0x220)
-#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_AR9300(ah) ? \
-                                        0x240 : 0x280))
+#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_AR9462(ah) ? \
+                                        0x280 : 0x240))
 #define AR_PHY_TPC_19_B1        (AR_SM1_BASE + 0x240)
 #define AR_PHY_TPC_19_B1_ALPHA_THERM            0xff
 #define AR_PHY_TPC_19_B1_ALPHA_THERM_S          0
@@ -931,10 +931,10 @@
 #define AR_PHY_AIC_SRAM_ADDR_B1 (AR_SM1_BASE + 0x5f0)
 #define AR_PHY_AIC_SRAM_DATA_B1 (AR_SM1_BASE + 0x5f4)
 
-#define AR_PHY_RTT_TABLE_SW_INTF_B(i)   (0x384 + (i) ? \
-                                        AR_SM1_BASE : AR_SM_BASE)
-#define AR_PHY_RTT_TABLE_SW_INTF_1_B(i) (0x388 + (i) ? \
-                                        AR_SM1_BASE : AR_SM_BASE)
+#define AR_PHY_RTT_TABLE_SW_INTF_B(i)   (0x384 + ((i) ? \
+                                        AR_SM1_BASE : AR_SM_BASE))
+#define AR_PHY_RTT_TABLE_SW_INTF_1_B(i) (0x388 + ((i) ? \
+                                        AR_SM1_BASE : AR_SM_BASE))
 /*
  * Channel 2 Register Map
  */
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 611ea6ce8508..d16d029f81a9 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -521,7 +521,7 @@ static const u32 ar9485_1_1_radio_postamble[][2] = {
         {0x000160ac, 0x24611800},
         {0x000160b0, 0x03284f3e},
         {0x0001610c, 0x00170000},
-        {0x00016140, 0x10804008},
+        {0x00016140, 0x50804008},
 };
 
 static const u32 ar9485_1_1_mac_postamble[][5] = {
@@ -603,7 +603,7 @@ static const u32 ar9485_1_1_radio_core[][2] = {
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_enable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10052e5e},
+        {0x00018c00, 0x18052e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -776,7 +776,7 @@ static const u32 ar9485_modes_green_ob_db_tx_gain_1_1[][5] = {
 
 static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10013e5e},
+        {0x00018c00, 0x18013e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -882,7 +882,7 @@ static const u32 ar9485_fast_clock_1_1_baseband_postamble[][3] = {
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
         /* Addr        allmodes  */
-        {0x00018c00, 0x10012e5e},
+        {0x00018c00, 0x18012e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -1021,7 +1021,7 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
 
 static const u32 ar9485_1_1_pcie_phy_clkreq_enable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10053e5e},
+        {0x00018c00, 0x18053e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index f16d2033081f..b479160dc262 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1724,6 +1724,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (!ath9k_hw_init_cal(ah, chan))
                 return -EIO;
 
+        ath9k_hw_loadnf(ah, chan);
+        ath9k_hw_start_nfcal(ah, true);
+
         ENABLE_REGWRITE_BUFFER(ah);
 
         ath9k_hw_restore_chainmask(ah);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d20946939cd8..59472e1605cd 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -296,7 +296,8 @@ static void carl9170_tx_release(struct kref *ref)
                         super = (void *)skb->data;
                         txinfo->status.ampdu_len = super->s.rix;
                         txinfo->status.ampdu_ack_len = super->s.cnt;
-                } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
+                } else if ((txinfo->flags & IEEE80211_TX_STAT_ACK) &&
+                           !(txinfo->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
                         /*
                          * drop redundant tx_status reports:
                          *
@@ -308,15 +309,17 @@ static void carl9170_tx_release(struct kref *ref)
                          *
                          * 3. minstrel_ht is picky, it only accepts
                          *    reports of frames with the TX_STATUS_AMPDU flag.
+                         *
+                         * 4. mac80211 is not particularly interested in
+                         *    feedback either [CTL_REQ_TX_STATUS not set]
                          */
 
                         dev_kfree_skb_any(skb);
                         return;
                 } else {
                         /*
-                         * Frame has failed, but we want to keep it in
-                         * case it was lost due to a power-state
-                         * transition.
+                         * Either the frame transmission has failed or
+                         * mac80211 requested tx status.
                          */
                 }
         }
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index c73e8600d218..58ea0e5fabfd 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -827,7 +827,6 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
 #endif
         return;
 drop:
-        b43dbg(dev->wl, "RX: Packet dropped\n");
         dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index b247a56d5135..001fdf140abb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1755,16 +1755,6 @@ static inline int iwl_check_stuck_queue(struct iwl_priv *priv, int txq)
 {
         if (iwl_trans_check_stuck_queue(trans(priv), txq)) {
                 int ret;
-                if (txq == priv->shrd->cmd_queue) {
-                        /*
-                         * validate command queue still working
-                         * by sending "ECHO" command
-                         */
-                        if (!iwl_cmd_echo_test(priv))
-                                return 0;
-                        else
-                                IWL_DEBUG_HC(priv, "echo testing fail\n");
-                }
                 ret = iwl_force_reset(priv, IWL_FW_RESET, false);
                 return (ret == -EAGAIN) ? 0 : 1;
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index 3b6cc66365e5..19cc6a81da57 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -445,10 +445,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
         err = pci_enable_msi(pdev);
-        if (err) {
-                dev_printk(KERN_ERR, &pdev->dev, "pci_enable_msi failed");
-                goto out_iounmap;
-        }
+        if (err)
+                dev_printk(KERN_ERR, &pdev->dev,
+                        "pci_enable_msi failed(0X%x)", err);
 
         /* TODO: Move this away, not needed if not MSI */
         /* enable rfkill interrupt: hw bug w/a */
@@ -469,7 +468,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 out_disable_msi:
         pci_disable_msi(pdev);
-out_iounmap:
         pci_iounmap(pdev, pci_bus->hw_base);
 out_pci_release_regions:
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index 8e8c75c997ee..da3411057afc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -407,6 +407,7 @@ static void iwl_tx_queue_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_queue *q = &txq->q;
         enum dma_data_direction dma_dir;
         unsigned long flags;
+        spinlock_t *lock;
 
         if (!q->n_bd)
                 return;
@@ -414,19 +415,22 @@ static void iwl_tx_queue_unmap(struct iwl_trans *trans, int txq_id)
         /* In the command queue, all the TBs are mapped as BIDI
          * so unmap them as such.
          */
-        if (txq_id == trans->shrd->cmd_queue)
+        if (txq_id == trans->shrd->cmd_queue) {
                 dma_dir = DMA_BIDIRECTIONAL;
-        else
+                lock = &trans->hcmd_lock;
+        } else {
                 dma_dir = DMA_TO_DEVICE;
+                lock = &trans->shrd->sta_lock;
+        }
 
-        spin_lock_irqsave(&trans->shrd->sta_lock, flags);
+        spin_lock_irqsave(lock, flags);
         while (q->write_ptr != q->read_ptr) {
                 /* The read_ptr needs to bound by q->n_window */
                 iwlagn_txq_free_tfd(trans, txq, get_cmd_index(q, q->read_ptr),
                                     dma_dir);
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
         }
-        spin_unlock_irqrestore(&trans->shrd->sta_lock, flags);
+        spin_unlock_irqrestore(lock, flags);
 }
 
 /**
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ff6378276ff0..4fcd653bddc4 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -728,15 +728,9 @@ static void lbs_scan_worker(struct work_struct *work)
                 le16_to_cpu(scan_cmd->hdr.size),
                 lbs_ret_scan, 0);
 
-        if (priv->scan_channel >= priv->scan_req->n_channels) {
+        if (priv->scan_channel >= priv->scan_req->n_channels)
                 /* Mark scan done */
-                if (priv->internal_scan)
-                        kfree(priv->scan_req);
-                else
-                        cfg80211_scan_done(priv->scan_req, false);
-
-                priv->scan_req = NULL;
-        }
+                lbs_scan_done(priv);
 
         /* Restart network */
         if (carrier)
@@ -774,6 +768,21 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
         lbs_deb_leave(LBS_DEB_CFG80211);
 }
 
+/*
+ * Clean up priv->scan_req.  Should be used to handle the allocation details.
+ */
+void lbs_scan_done(struct lbs_private *priv)
+{
+        WARN_ON(!priv->scan_req);
+
+        if (priv->internal_scan)
+                kfree(priv->scan_req);
+        else
+                cfg80211_scan_done(priv->scan_req, false);
+
+        priv->scan_req = NULL;
+}
+
 static int lbs_cfg_scan(struct wiphy *wiphy,
         struct net_device *dev,
         struct cfg80211_scan_request *request)
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
index a02ee151710e..558168ce634d 100644
--- a/drivers/net/wireless/libertas/cfg.h
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -16,6 +16,7 @@ int lbs_reg_notifier(struct wiphy *wiphy,
 void lbs_send_disconnect_notification(struct lbs_private *priv);
 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
 
+void lbs_scan_done(struct lbs_private *priv);
 void lbs_scan_deinit(struct lbs_private *priv);
 int lbs_disconnect(struct lbs_private *priv, u16 reason);
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index b03779bcd547..39a6a7a40244 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -255,10 +255,8 @@ static int lbs_eth_stop(struct net_device *dev)
 
         lbs_update_mcast(priv);
         cancel_delayed_work_sync(&priv->scan_work);
-        if (priv->scan_req) {
-                cfg80211_scan_done(priv->scan_req, false);
-                priv->scan_req = NULL;
-        }
+        if (priv->scan_req)
+                lbs_scan_done(priv);
 
         netif_carrier_off(priv->dev);
 
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index d5eee2093b1e..e2e3ecad1008 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -211,6 +211,7 @@ struct rfcomm_dlc {
 #define RFCOMM_AUTH_ACCEPT  6
 #define RFCOMM_AUTH_REJECT  7
 #define RFCOMM_DEFER_SETUP  8
+#define RFCOMM_ENC_DROP     9
 
 /* Scheduling flags and events */
 #define RFCOMM_SCHED_WAKEUP 31
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index dc1123aa8181..72eddd1b410b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3567,8 +3567,9 @@ rate_lowest_index(struct ieee80211_supported_band *sband,
                         return i;
 
         /* warn when we cannot find a rate. */
-        WARN_ON(1);
+        WARN_ON_ONCE(1);
 
+        /* and return 0 (the lowest index) */
         return 0;
 }
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b84458dcc226..be84ae33ae36 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -613,7 +613,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(250));
+                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 5a94eec06caa..5caff4d47596 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -147,8 +147,6 @@ static int read_index_list(struct sock *sk)
 
                 hci_del_off_timer(d);
 
-                set_bit(HCI_MGMT, &d->flags);
-
                 if (test_bit(HCI_SETUP, &d->flags))
                         continue;
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 38b618c96de6..4e32e18211f9 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1802,6 +1802,11 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
                         continue;
                 }
 
+                if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
+                        __rfcomm_dlc_close(d, ECONNREFUSED);
+                        continue;
+                }
+
                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (d->out) {
@@ -2077,7 +2082,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (status || encrypt == 0x00) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
@@ -2088,7 +2093,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
                                 continue;
                         } else if (d->sec_level == BT_SECURITY_HIGH) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ebd7fb101fbf..d06c65fa5526 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -832,6 +832,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
+        /* Only TDLS-supporting stations can add TDLS peers */
+        if ((params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
+            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+              sdata->vif.type == NL80211_IFTYPE_STATION))
+                return -ENOTSUPP;
+
         sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
         if (!sta)
                 return -ENOMEM;
@@ -841,12 +847,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         sta_apply_parameters(local, sta, params);
 
-        /* Only TDLS-supporting stations can add TDLS peers */
-        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-              sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -ENOTSUPP;
-
         rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4c3d1f591bec..ea10a51babda 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -389,6 +389,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ba2da11a997b..17258feaab9b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -637,6 +637,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1489,10 +1492,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 94472eb34d76..6c53b6d1002b 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -1084,14 +1084,13 @@ static void ieee80211_work_work(struct work_struct *work)
                         continue;
                 if (wk->chan != local->tmp_channel)
                         continue;
-                if (ieee80211_work_ct_coexists(wk->chan_type,
-                                               local->tmp_channel_type))
+                if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                                local->tmp_channel_type))
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
-                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
                 /* If tmp_channel wasn't operating channel, then
                  * we need to go back on-channel.
@@ -1101,7 +1100,7 @@ static void ieee80211_work_work(struct work_struct *work)
                  * we still need to do a hardware config.  Currently,
                  * we cannot be here while scanning, however.
                  */
-                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                if (!ieee80211_cfg_on_oper_channel(local))
                         ieee80211_hw_config(local, 0);
 
                 /* At the least, we need to disable offchannel_ps,