21 files changed, 51 insertions, 34 deletions

diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index e6acaba1e45c..5577ed656e2f 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -69,6 +69,9 @@ static struct usb_device_id ath3k_table[] = {
         /* Atheros AR3012 with sflash firmware*/
         { USB_DEVICE(0x0CF3, 0x3004) },
 
+        /* Atheros AR5BBU12 with sflash firmware */
+        { USB_DEVICE(0x0489, 0xE02C) },
+
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 89b9e51eec1f..411ae9c9b384 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -108,6 +108,9 @@ static struct usb_device_id blacklist_table[] = {
         /* Atheros 3012 with sflash firmware */
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_IGNORE },
 
+        /* Atheros AR5BBU12 with sflash firmware */
+        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+
         /* Broadcom BCM2035 */
         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
@@ -828,7 +831,7 @@ static void btusb_work(struct work_struct *work)
 
         if (hdev->conn_hash.sco_num > 0) {
                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
-                        err = usb_autopm_get_interface(data->isoc);
+                        err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
                         if (err < 0) {
                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
                                 usb_kill_anchored_urbs(&data->isoc_anchor);
@@ -857,7 +860,7 @@ static void btusb_work(struct work_struct *work)
 
                 __set_isoc_interface(hdev, 0);
                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
-                        usb_autopm_put_interface(data->isoc);
+                        usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index d673ab2f6cda..62ce2f4e8605 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1281,6 +1281,7 @@ static int ath5k_hw_channel(struct ath5k_hw *ah,
         case AR5K_RF5111:
                 ret = ath5k_hw_rf5111_channel(ah, channel);
                 break;
+        case AR5K_RF2317:
         case AR5K_RF2425:
                 ret = ath5k_hw_rf2425_channel(ah, channel);
                 break;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 4d60583b0f69..a224c56448de 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -21,7 +21,6 @@
 #include <linux/device.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
-#include <linux/pm_qos_params.h>
 
 #include "debug.h"
 #include "common.h"
@@ -57,8 +56,6 @@ struct ath_node;
 
 #define A_MAX(a, b) ((a) > (b) ? (a) : (b))
 
-#define ATH9K_PM_QOS_DEFAULT_VALUE      55
-
 #define TSF_TO_TU(_h,_l) \
         ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
 
@@ -218,6 +215,7 @@ struct ath_frame_info {
 struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
+        unsigned long bfs_paprd_timestamp;
         enum ath9k_internal_frame_type bfs_ftype;
 };
 
@@ -602,7 +600,6 @@ struct ath_softc {
         struct work_struct paprd_work;
         struct work_struct hw_check_work;
         struct completion paprd_complete;
-        bool paprd_pending;
 
         unsigned int hw_busy_count;
 
@@ -649,8 +646,6 @@ struct ath_softc {
         struct ath_descdma txsdma;
 
         struct ath_ant_comb ant_comb;
-
-        struct pm_qos_request_list pm_qos_req;
 };
 
 void ath9k_tasklet(unsigned long data);
@@ -665,7 +660,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
 extern int led_blink;
-extern int ath9k_pm_qos_value;
 extern bool is_ath9k_unloaded;
 
 irqreturn_t ath_isr(int irq, void *dev);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e5c1eead98a2..f66c882a39e2 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -41,10 +41,6 @@ static int ath9k_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
 
-int ath9k_pm_qos_value = ATH9K_PM_QOS_DEFAULT_VALUE;
-module_param_named(pmqos, ath9k_pm_qos_value, int, S_IRUSR | S_IRGRP | S_IROTH);
-MODULE_PARM_DESC(pmqos, "User specified PM-QOS value");
-
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
 
@@ -760,9 +756,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
         ath_init_leds(sc);
         ath_start_rfkill_poll(sc);
 
-        pm_qos_add_request(&sc->pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
-                           PM_QOS_DEFAULT_VALUE);
-
         return 0;
 
 error_world:
@@ -819,7 +812,6 @@ void ath9k_deinit_device(struct ath_softc *sc)
         ath9k_ps_restore(sc);
 
         ieee80211_unregister_hw(hw);
-        pm_qos_remove_request(&sc->pm_qos_req);
         ath_rx_cleanup(sc);
         ath_tx_cleanup(sc);
         ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 31f0fad72391..1d2c7c3cc5ca 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -342,7 +342,6 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
         tx_info->control.rates[1].idx = -1;
 
         init_completion(&sc->paprd_complete);
-        sc->paprd_pending = true;
         txctl.paprd = BIT(chain);
 
         if (ath_tx_start(hw, skb, &txctl) != 0) {
@@ -353,7 +352,6 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
 
         time_left = wait_for_completion_timeout(&sc->paprd_complete,
                         msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
-        sc->paprd_pending = false;
 
         if (!time_left)
                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_CALIBRATE,
@@ -1119,12 +1117,6 @@ static int ath9k_start(struct ieee80211_hw *hw)
                         ath9k_btcoex_timer_resume(sc);
         }
 
-        /* User has the option to provide pm-qos value as a module
-         * parameter rather than using the default value of
-         * 'ATH9K_PM_QOS_DEFAULT_VALUE'.
-         */
-        pm_qos_update_request(&sc->pm_qos_req, ath9k_pm_qos_value);
-
         if (ah->caps.pcie_lcr_extsync_en && common->bus_ops->extn_synch_en)
                 common->bus_ops->extn_synch_en(common);
 
@@ -1269,8 +1261,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         sc->sc_flags |= SC_OP_INVALID;
 
-        pm_qos_update_request(&sc->pm_qos_req, PM_QOS_DEFAULT_VALUE);
-
         mutex_unlock(&sc->mutex);
 
         ath_dbg(common, ATH_DBG_CONFIG, "Driver halt\n");
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 8d89aa958f1b..bc614acb96de 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1753,6 +1753,9 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         ar9003_hw_set_paprd_txdesc(sc->sc_ah, bf->bf_desc,
                                                    bf->bf_state.bfs_paprd);
 
+                if (txctl->paprd)
+                        bf->bf_state.bfs_paprd_timestamp = jiffies;
+
                 ath_tx_send_normal(sc, txctl->txq, tid, &bf_head);
         }
 
@@ -1910,7 +1913,9 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         bf->bf_buf_addr = 0;
 
         if (bf->bf_state.bfs_paprd) {
-                if (!sc->paprd_pending)
+                if (time_after(jiffies,
+                                bf->bf_state.bfs_paprd_timestamp +
+                                msecs_to_jiffies(ATH_PAPRD_TIMEOUT)))
                         dev_kfree_skb_any(skb);
                 else
                         complete(&sc->paprd_complete);
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 939a0e96ed1f..84866a4b8350 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
         cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
 
         /* 2. Maybe the AP wants to send multicast/broadcast data? */
-        cam = !!(tim_ie->bitmap_ctrl & 0x01);
+        cam |= !!(tim_ie->bitmap_ctrl & 0x01);
 
         if (!cam) {
                 /* back to low-power land. */
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 58213e72d107..5b6932c2193a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2734,7 +2734,6 @@ static struct iwl_lib_ops iwl3945_lib = {
         .isr_ops = {
                 .isr = iwl_isr_legacy,
         },
-        .check_plcp_health = iwl3945_good_plcp_health,
 
         .debugfs_ops = {
                 .rx_stats_read = iwl3945_ucode_rx_stats_read,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index aa32b1e05dff..f6493f77610d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -678,6 +678,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,                          \
         .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
         .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .valid_tx_ant = ANT_AB,         /* .cfg overwrite */    \
+        .valid_rx_ant = ANT_AB,         /* .cfg overwrite */    \
         .ops = &iwl6050_ops,                                    \
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index a3af656aab3d..abd0461bd307 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1183,6 +1183,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1397,6 +1400,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 }
 
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 8f4dfc3d8023..6ac0ff236893 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1119,6 +1119,8 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x3390), PCI_DEVICE_DATA(&rt2800pci_ops) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT35XX
+        { PCI_DEVICE(0x1432, 0x7711), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7722), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 1c8b0775d849..5a1c13878eaf 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -1050,6 +1050,9 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
+                if (!beacon)
+                        goto out_sleep;
+
                 ret = wl1251_cmd_template_set(wl, CMD_BEACON, beacon->data,
                                               beacon->len);
 
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index c7345dbf43fa..f8533795ee7f 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -733,7 +733,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
 
         /* Fetch the vendor specific tuples. */
         res = pcmcia_loop_tuple(bus->host_pcmcia, SSB_PCMCIA_CIS,
-                                ssb_pcmcia_do_get_invariants, sprom);
+                                ssb_pcmcia_do_get_invariants, iv);
         if ((res == 0) || (res == -ENOSPC))
                 return 0;
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 2575c2db6404..d7b9af4703d0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -727,7 +727,9 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
                         break;
                 }
 
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&dev->wait, &wait);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f7a1f08ec3e0..140503d4c97a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1838,6 +1838,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 *cookie ^= 2;
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
                 local->hw_roc_skb = skb;
+                local->hw_roc_skb_for_status = skb;
                 mutex_unlock(&local->mtx);
 
                 return 0;
@@ -1892,6 +1893,7 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
                 if (ret == 0) {
                         kfree_skb(local->hw_roc_skb);
                         local->hw_roc_skb = NULL;
+                        local->hw_roc_skb_for_status = NULL;
                 }
 
                 mutex_unlock(&local->mtx);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index bb63878d865e..0a570a111a84 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -951,7 +951,7 @@ struct ieee80211_local {
 
         struct ieee80211_channel *hw_roc_channel;
         struct net_device *hw_roc_dev;
-        struct sk_buff *hw_roc_skb;
+        struct sk_buff *hw_roc_skb, *hw_roc_skb_for_status;
         struct work_struct hw_roc_start, hw_roc_done;
         enum nl80211_channel_type hw_roc_channel_type;
         unsigned int hw_roc_duration;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d89e87866e51..7b3f9df725bd 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1071,6 +1071,12 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
+        /*
+         * In case we receive frames after disassociation.
+         */
+        if (!sdata->u.mgd.associated)
+                return;
+
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index ffb0de9bc2fa..010a559bd872 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -327,6 +327,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
                 struct ieee80211_work *wk;
+                u64 cookie = (unsigned long)skb;
 
                 rcu_read_lock();
                 list_for_each_entry_rcu(wk, &local->work_list, list) {
@@ -338,8 +339,12 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         break;
                 }
                 rcu_read_unlock();
+                if (local->hw_roc_skb_for_status == skb) {
+                        cookie = local->hw_roc_cookie ^ 2;
+                        local->hw_roc_skb_for_status = NULL;
+                }
                 cfg80211_mgmt_tx_status(
-                        skb->dev, (unsigned long) skb, skb->data, skb->len,
+                        skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d0f91d74eaf0..34edf7f22b0e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1550,7 +1550,7 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
                 skb_orphan(skb);
         }
 
-        if (skb_header_cloned(skb))
+        if (skb_cloned(skb))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 26fd5d29af7f..556647a910ac 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1204,7 +1204,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC;
+                        mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
+                        mutex_unlock(&sdata->u.mgd.mtx);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;