--- /dev/null
+From a1fe52801a992e590cdaee2fb47a94bac9b5da90 Mon Sep 17 00:00:00 2001
+From: Piotr Haber <phaber@broadcom.com>
+Date: Thu, 10 Jan 2013 11:20:48 +0100
+Subject: brcmsmac: increase timer reference count for new timers only
+
+From: Piotr Haber <phaber@broadcom.com>
+
+commit a1fe52801a992e590cdaee2fb47a94bac9b5da90 upstream.
+
+On hardware reintialization reference count of
+already existing timers would be increased again.
+This leads to problems on module unloading.
+
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Piotr Haber <phaber@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+@@ -1400,9 +1400,10 @@ void brcms_add_timer(struct brcms_timer
+ #endif
+ t->ms = ms;
+ t->periodic = (bool) periodic;
+- t->set = true;
+-
+- atomic_inc(&t->wl->callbacks);
++ if (!t->set) {
++ t->set = true;
++ atomic_inc(&t->wl->callbacks);
++ }
+
+ ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
+ }
--- /dev/null
+From fa4cffcba9e13798ed7c6b8526b91b1631ecb53e Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 16 Jan 2013 11:45:15 +0100
+Subject: iwlegacy: fix IBSS cleanup
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit fa4cffcba9e13798ed7c6b8526b91b1631ecb53e upstream.
+
+We do not correctly change interface type when switching from
+IBSS mode to STA mode, that results in microcode errors.
+
+Resolves:
+https://bugzilla.redhat.com/show_bug.cgi?id=886946
+
+Reported-by: Jaroslav Skarvada <jskarvad@redhat.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlegacy/common.c | 35 +++++++++++++--------------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/common.c
++++ b/drivers/net/wireless/iwlegacy/common.c
+@@ -3957,17 +3957,21 @@ il_connection_init_rx_config(struct il_p
+
+ memset(&il->staging, 0, sizeof(il->staging));
+
+- if (!il->vif) {
++ switch (il->iw_mode) {
++ case NL80211_IFTYPE_UNSPECIFIED:
+ il->staging.dev_type = RXON_DEV_TYPE_ESS;
+- } else if (il->vif->type == NL80211_IFTYPE_STATION) {
++ break;
++ case NL80211_IFTYPE_STATION:
+ il->staging.dev_type = RXON_DEV_TYPE_ESS;
+ il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
+- } else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
++ break;
++ case NL80211_IFTYPE_ADHOC:
+ il->staging.dev_type = RXON_DEV_TYPE_IBSS;
+ il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
+ il->staging.filter_flags =
+ RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
+- } else {
++ break;
++ default:
+ IL_ERR("Unsupported interface type %d\n", il->vif->type);
+ return;
+ }
+@@ -4550,8 +4554,7 @@ out:
+ EXPORT_SYMBOL(il_mac_add_interface);
+
+ static void
+-il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
+- bool mode_change)
++il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
+ {
+ lockdep_assert_held(&il->mutex);
+
+@@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il
+ il_force_scan_end(il);
+ }
+
+- if (!mode_change)
+- il_set_mode(il);
+-
++ il_set_mode(il);
+ }
+
+ void
+@@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211
+
+ WARN_ON(il->vif != vif);
+ il->vif = NULL;
+-
+- il_teardown_interface(il, vif, false);
++ il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
++ il_teardown_interface(il, vif);
+ memset(il->bssid, 0, ETH_ALEN);
+
+ D_MAC80211("leave\n");
+@@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211
+ }
+
+ /* success */
+- il_teardown_interface(il, vif, true);
+ vif->type = newtype;
+ vif->p2p = false;
+- err = il_set_mode(il);
+- WARN_ON(err);
+- /*
+- * We've switched internally, but submitting to the
+- * device may have failed for some reason. Mask this
+- * error, because otherwise mac80211 will not switch
+- * (and set the interface type back) and we'll be
+- * out of sync with it.
+- */
++ il->iw_mode = newtype;
++ il_teardown_interface(il, vif);
+ err = 0;
+
+ out:
--- /dev/null
+From 83f0c6d1f502bd75bb4a9e31e8d64e59c6894ad1 Mon Sep 17 00:00:00 2001
+From: Avinash Patil <patila@marvell.com>
+Date: Mon, 21 Jan 2013 21:04:10 -0800
+Subject: mwifiex: fix typo in PCIe adapter NULL check
+
+From: Avinash Patil <patila@marvell.com>
+
+commit 83f0c6d1f502bd75bb4a9e31e8d64e59c6894ad1 upstream.
+
+Add missing "!" as we are supposed to check "!card->adapter"
+in PCIe suspend handler.
+
+Signed-off-by: Avinash Patil <patila@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Reviewed-by: Sergey V. <sftp.mtuci@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mwifiex/pcie.c
++++ b/drivers/net/wireless/mwifiex/pcie.c
+@@ -158,7 +158,7 @@ static int mwifiex_pcie_suspend(struct p
+
+ if (pdev) {
+ card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+- if (!card || card->adapter) {
++ if (!card || !card->adapter) {
+ pr_err("Card or adapter structure is not valid\n");
+ return 0;
+ }