Merge commit 'v2.6.34' into next

17 files changed, 216 insertions, 78 deletions

diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 99a6da464bd3..e1c2fcaa8bed 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
         struct device *parent = aru->udev->dev.parent;
 
+        complete(&aru->firmware_loading_complete);
+
         /* unbind anything failed */
         if (parent)
                 down(&parent->sem);
         device_release_driver(&aru->udev->dev);
         if (parent)
                 up(&parent->sem);
+
+        usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
         if (err)
                 goto err_unrx;
 
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
         return;
 
  err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
+        usb_get_dev(aru->udev);
         return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                        &aru->udev->dev, GFP_KERNEL, aru,
                                        ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ceb..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 67ca4e5a6017..115e1aeedb59 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1532,8 +1532,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 all_wiphys_idle =  ath9k_all_wiphys_idle(sc);
                 ath9k_set_wiphy_idle(aphy, idle);
 
-                if (!idle && all_wiphys_idle)
-                        enable_radio = true;
+                enable_radio = (!idle && all_wiphys_idle);
 
                 /*
                  * After we unlock here its possible another wiphy
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 83c52a682622..8972166386cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2015,7 +2015,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                        if (qc)
+                                iwl_free_tfds_in_queue(priv, sta_id,
+                                                       tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -2041,14 +2043,17 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                    tx_resp->failure_frame);
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                if (qc && likely(sta_id != IWL_INVALID_STATION))
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                else if (sta_id == IWL_INVALID_STATION)
+                        IWL_DEBUG_TX_REPLY(priv, "Station not known\n");
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
-
-        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        if (qc && likely(sta_id != IWL_INVALID_STATION))
+                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 35f819ac87a3..1460116d329f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -346,6 +346,17 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
                !!(rate_n_flags & RATE_MCS_ANT_C_MSK);
 }
 
+/*
+ * Static function to get the expected throughput from an iwl_scale_tbl_info
+ * that wraps a NULL pointer check
+ */
+static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
+{
+        if (tbl->expected_tpt)
+                return tbl->expected_tpt[rs_index];
+        return 0;
+}
+
 /**
  * rs_collect_tx_data - Update the success/failure sliding window
  *
@@ -353,19 +364,21 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int rs_collect_tx_data(struct iwl_rate_scale_data *windows,
-                              int scale_index, s32 tpt, int attempts,
-                              int successes)
+static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+                              int scale_index, int attempts, int successes)
 {
         struct iwl_rate_scale_data *window = NULL;
         static const u64 mask = (((u64)1) << (IWL_RATE_MAX_WINDOW - 1));
-        s32 fail_count;
+        s32 fail_count, tpt;
 
         if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
                 return -EINVAL;
 
         /* Select window for current tx bit rate */
-        window = &(windows[scale_index]);
+        window = &(tbl->win[scale_index]);
+
+        /* Get expected throughput */
+        tpt = get_expected_tpt(tbl, scale_index);
 
         /*
          * Keep track of only the latest 62 tx frame attempts in this rate's
@@ -739,16 +752,6 @@ static bool table_type_matches(struct iwl_scale_tbl_info *a,
         return (a->lq_type == b->lq_type) && (a->ant_type == b->ant_type) &&
                 (a->is_SGI == b->is_SGI);
 }
-/*
- * Static function to get the expected throughput from an iwl_scale_tbl_info
- * that wraps a NULL pointer check
- */
-static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
-{
-        if (tbl->expected_tpt)
-                return tbl->expected_tpt[rs_index];
-        return 0;
-}
 
 /*
  * mac80211 sends us Tx status
@@ -765,12 +768,10 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct iwl_priv *priv = (struct iwl_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl_rate_scale_data *window = NULL;
         enum mac80211_rate_control_flags mac_flags;
         u32 tx_rate;
         struct iwl_scale_tbl_info tbl_type;
-        struct iwl_scale_tbl_info *curr_tbl, *other_tbl;
-        s32 tpt = 0;
+        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
 
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
@@ -853,7 +854,6 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 IWL_DEBUG_RATE(priv, "Neither active nor search matches tx rate\n");
                 return;
         }
-        window = (struct iwl_rate_scale_data *)&(curr_tbl->win[0]);
 
         /*
          * Updating the frame history depends on whether packets were
@@ -866,8 +866,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 tx_rate = le32_to_cpu(table->rs_table[0].rate_n_flags);
                 rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type,
                                 &rs_index);
-                tpt = get_expected_tpt(curr_tbl, rs_index);
-                rs_collect_tx_data(window, rs_index, tpt,
+                rs_collect_tx_data(curr_tbl, rs_index,
                                    info->status.ampdu_ack_len,
                                    info->status.ampdu_ack_map);
 
@@ -897,19 +896,13 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                          * table as active/search.
                          */
                         if (table_type_matches(&tbl_type, curr_tbl))
-                                tpt = get_expected_tpt(curr_tbl, rs_index);
+                                tmp_tbl = curr_tbl;
                         else if (table_type_matches(&tbl_type, other_tbl))
-                                tpt = get_expected_tpt(other_tbl, rs_index);
+                                tmp_tbl = other_tbl;
                         else
                                 continue;
-
-                        /* Constants mean 1 transmission, 0 successes */
-                        if (i < retries)
-                                rs_collect_tx_data(window, rs_index, tpt, 1,
-                                                0);
-                        else
-                                rs_collect_tx_data(window, rs_index, tpt, 1,
-                                                legacy_success);
+                        rs_collect_tx_data(tmp_tbl, rs_index, 1,
+                                           i < retries ? 0 : legacy_success);
                 }
 
                 /* Update success/fail counts if not searching for new mode */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index de3b3f403d1f..8b516c5ff0bb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -808,6 +808,18 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 }
         }
 
+        /*
+         * The above algorithm sometimes fails when the ucode
+         * reports 0 for all chains. It's not clear why that
+         * happens to start with, but it is then causing trouble
+         * because this can make us enable more chains than the
+         * hardware really has.
+         *
+         * To be safe, simply mask out any chains that we know
+         * are not on the device.
+         */
+        active_chains &= priv->hw_params.valid_rx_ant;
+
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 /* loops on all the bits of
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b3..f4e59ae07f8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index db050b811232..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -308,10 +308,13 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Allocate and init all Tx and Command queues */
-        ret = iwl_txq_ctx_reset(priv);
-        if (ret)
-                return ret;
+        /* Allocate or reset and init all Tx and Command queues */
+        if (!priv->txq) {
+                ret = iwl_txq_ctx_alloc(priv);
+                if (ret)
+                        return ret;
+        } else
+                iwl_txq_ctx_reset(priv);
 
         set_bit(STATUS_INIT, &priv->status);
 
@@ -3355,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 4ef7739f9e8e..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -442,7 +442,8 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-int iwl_txq_ctx_reset(struct iwl_priv *priv);
+int iwl_txq_ctx_alloc(struct iwl_priv *priv);
+void iwl_txq_ctx_reset(struct iwl_priv *priv);
 void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                  struct iwl_tx_queue *txq,
@@ -456,6 +457,8 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
 void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
 int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn);
 int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
@@ -503,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..741e65ec8301 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
         priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
         queue_work(priv->workqueue, &priv->request_scan);
-
-out:
-        return ret;
+ unlock:
+        mutex_unlock(&priv->mutex);
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 
@@ -805,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
                 /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
@@ -965,6 +986,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index f0b7e6cfbe4f..8dd0c036d547 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -194,10 +194,34 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
         struct iwl_queue *q = &txq->q;
         struct device *dev = &priv->pci_dev->dev;
         int i;
+        bool huge = false;
 
         if (q->n_bd == 0)
                 return;
 
+        for (; q->read_ptr != q->write_ptr;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+                /* we have no way to tell if it is a huge cmd ATM */
+                i = get_cmd_index(q, q->read_ptr, 0);
+
+                if (txq->meta[i].flags & CMD_SIZE_HUGE) {
+                        huge = true;
+                        continue;
+                }
+
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
+        if (huge) {
+                i = q->n_window;
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
+
         /* De-alloc array of command/tx buffers */
         for (i = 0; i <= TFD_CMD_SLOTS; i++)
                 kfree(txq->cmd[i]);
@@ -410,6 +434,26 @@ out_free_arrays:
 }
 EXPORT_SYMBOL(iwl_tx_queue_init);
 
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id)
+{
+        int actual_slots = slots_num;
+
+        if (txq_id == IWL_CMD_QUEUE_NUM)
+                actual_slots++;
+
+        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
+
+        txq->need_update = 0;
+
+        /* Initialize queue's high/low-water marks, and head/tail indexes */
+        iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
+
+        /* Tell device where to find queue */
+        priv->cfg->ops->lib->txq_init(priv, txq);
+}
+EXPORT_SYMBOL(iwl_tx_queue_reset);
+
 /**
  * iwl_hw_txq_ctx_free - Free TXQ Context
  *
@@ -421,8 +465,7 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
 
         /* Tx queues */
         if (priv->txq) {
-                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
-                     txq_id++)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
                         if (txq_id == IWL_CMD_QUEUE_NUM)
                                 iwl_cmd_queue_free(priv);
                         else
@@ -438,15 +481,15 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
 EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
 
 /**
- * iwl_txq_ctx_reset - Reset TX queue context
- * Destroys all DMA structures and initialize them again
+ * iwl_txq_ctx_alloc - allocate TX queue context
+ * Allocate all Tx DMA structures and initialize them
  *
  * @param priv
  * @return error code
  */
-int iwl_txq_ctx_reset(struct iwl_priv *priv)
+int iwl_txq_ctx_alloc(struct iwl_priv *priv)
 {
-        int ret = 0;
+        int ret;
         int txq_id, slots_num;
         unsigned long flags;
 
@@ -504,8 +547,31 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
         return ret;
 }
 
+void iwl_txq_ctx_reset(struct iwl_priv *priv)
+{
+        int txq_id, slots_num;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
+                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
+        }
+}
+
 /**
- * iwl_txq_ctx_stop - Stop all Tx DMA channels, free Tx queue memory
+ * iwl_txq_ctx_stop - Stop all Tx DMA channels
  */
 void iwl_txq_ctx_stop(struct iwl_priv *priv)
 {
@@ -525,9 +591,6 @@ void iwl_txq_ctx_stop(struct iwl_priv *priv)
                                     1000);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Deallocate memory for all Tx queues */
-        iwl_hw_txq_ctx_free(priv);
 }
 EXPORT_SYMBOL(iwl_txq_ctx_stop);
 
@@ -1050,6 +1113,14 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 
         spin_lock_irqsave(&priv->hcmd_lock, flags);
 
+        /* If this is a huge cmd, mark the huge flag also on the meta.flags
+         * of the _original_ cmd. This is used for DMA mapping clean up.
+         */
+        if (cmd->flags & CMD_SIZE_HUGE) {
+                idx = get_cmd_index(q, q->write_ptr, 0);
+                txq->meta[idx].flags = CMD_SIZE_HUGE;
+        }
+
         idx = get_cmd_index(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
         out_cmd = txq->cmd[idx];
         out_meta = &txq->meta[idx];
@@ -1227,6 +1298,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
         struct iwl_device_cmd *cmd;
         struct iwl_cmd_meta *meta;
+        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
 
         /* If a Tx command is being handled and it isn't in the actual
          * command queue then there a command routing bug has been introduced
@@ -1240,9 +1312,17 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                 return;
         }
 
-        cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
-        cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
-        meta = &priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_index];
+        /* If this is a huge cmd, clear the huge flag on the meta.flags
+         * of the _original_ cmd. So that iwl_cmd_queue_free won't unmap
+         * the DMA buffer for the scan (huge) command.
+         */
+        if (huge) {
+                cmd_index = get_cmd_index(&txq->q, index, 0);
+                txq->meta[cmd_index].flags = 0;
+        }
+        cmd_index = get_cmd_index(&txq->q, index, huge);
+        cmd = txq->cmd[cmd_index];
+        meta = &txq->meta[cmd_index];
 
         pci_unmap_single(priv->pci_dev,
                          pci_unmap_addr(meta, mapping),
@@ -1264,6 +1344,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                                get_cmd_string(cmd->hdr.cmd));
                 wake_up_interruptible(&priv->wait_command_queue);
         }
+        meta->flags = 0;
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e1..b74a56c48d26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda362836..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {