This fixes:

=================================
[ INFO: inconsistent lock state ]
3.14.3+ #5 Tainted: G           O
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/3/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
 (&(&txq->lock)->rlock){+.?...}, at: [<ffffffffa059803c>] iwl_pcie_enqueue_hcmd+0x12c/0x1000 [iwlwifi]
{SOFTIRQ-ON-W} state was registered at:
  [<ffffffff810d9071>] __lock_acquire+0x5f1/0x13b0
  [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
  [<ffffffff817ef80e>] _raw_spin_lock+0x3e/0x80
  [<ffffffffa0598f7a>] iwl_pcie_txq_check_wrptrs+0x6a/0xb0 [iwlwifi]
  [<ffffffffa0594b5a>] iwl_pcie_irq_handler+0xdba/0x2670 [iwlwifi]
  [<ffffffff810ef1e0>] irq_thread_fn+0x20/0x50
  [<ffffffff810ef77f>] irq_thread+0x11f/0x150
  [<ffffffff810a04f0>] kthread+0xf0/0x110
  [<ffffffff817fa4bc>] ret_from_fork+0x7c/0xb0
irq event stamp: 1142192
hardirqs last  enabled at (1142192): [<ffffffff817efb6c>] _raw_spin_unlock_irq+0x2c/0x40
hardirqs last disabled at (1142191): [<ffffffff817ef9ef>] _raw_spin_lock_irq+0x1f/0x80
softirqs last  enabled at (1142188): [<ffffffff81079082>] _local_bh_enable+0x22/0x50
softirqs last disabled at (1142189): [<ffffffff8107ad35>] irq_exit+0xe5/0xf0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&txq->lock)->rlock);
  <Interrupt>
    lock(&(&txq->lock)->rlock);

Fixes: ea68f460 ("iwlwifi: pcie: clarify TX queue need_update handling")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When calling IWL_DEBUG_*() dev_dbg() is currently used, and this
could result in the log being ignored no matter the internal
loglevel, since dev_dbg() may get turned on or off based on the
dynamic debug mechanism.

Replace the dev_dbg() with dev_printk() since dynamic printing
is pointless as we use our own debug level mechanism and there
is just a single dev_dbg() call in the code.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
[rephrase commit message a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

CMD_SYNC is really 0 which is confusing:

if (cmd.flags & CMD_SYNC) is always false.
Fix this by simply removing its definition.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

There's an extra newline that shouldn't be there - remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If a (debug) message is missing a newline, cause build error
so we don't keep reintroducing this problem.

This also prevents using a non-constant argument as the format
string which is a good idea anyway (e.g. for security reasons.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

A binding object associates virtual MACs to a Phy.
Binding object can ask (and get) air time, thus
allowing several MACs to share the medium.
A binding object can be in either one of 3 states:
1) standalone - A single active MAC
2) Different Channel Mode (DCM) - There are 2 active
   MACs or more (not necessarily just clients), but each
   has its own channel.
3) Same Channel Mode (SCM) - There are 2 active
   MACs or more (not necessarily just clients), that
   share the same channel.
This patch introduces an additional condition for enabling uAPSD:
uAPSD should be disabled for a client in DCM.
The reason for that is a low latency issue in Miracast.
Signed-off-by: Avri Altman <avri.altman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If two clients are active while each one is alone on its channel,
and the applicable flags are set, power management should be enabled.
This condition is referred to as Different Channel Mode (DCM).
Up to now, in DCM power management was supported only on BSS.
This patch adds support for P2P power management in DCM as well.
Signed-off-by: Avri Altman <avri.altman@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

There was a deadlock in monitor mode when we were setting the
channel if the channel was not 1.

======================================================
[ INFO: possible circular locking dependency detected ]
3.14.3 #4 Not tainted
-------------------------------------------------------
iw/3323 is trying to acquire lock:
 (&local->chanctx_mtx){+.+.+.}, at: [<ffffffffa062e2f2>] ieee80211_vif_release_channel+0x42/0xb0 [mac80211]

but task is already holding lock:
 (&local->iflist_mtx){+.+...}, at: [<ffffffffa0609e0a>] ieee80211_set_monitor_channel+0x5a/0x1b0 [mac80211]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (&local->iflist_mtx){+.+...}:
       [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
       [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
       [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
       [<ffffffffa06225cf>] ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
       [<ffffffffa0518189>] iwl_mvm_recalc_multicast+0x49/0xa0 [iwlmvm]
       [<ffffffffa051822e>] iwl_mvm_configure_filter+0x4e/0x70 [iwlmvm]
       [<ffffffffa05e6d43>] ieee80211_configure_filter+0x153/0x5f0 [mac80211]
       [<ffffffffa05e71f5>] ieee80211_reconfig_filter+0x15/0x20 [mac80211]
       [snip]

-> #1 (&mvm->mutex){+.+.+.}:
       [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
       [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
       [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
       [<ffffffffa0517246>] iwl_mvm_add_chanctx+0x56/0xe0 [iwlmvm]
       [<ffffffffa062ca1e>] ieee80211_new_chanctx+0x13e/0x410 [mac80211]
       [<ffffffffa062d953>] ieee80211_vif_use_channel+0x1c3/0x5a0 [mac80211]
       [<ffffffffa06035ab>] ieee80211_add_virtual_monitor+0x1ab/0x6b0 [mac80211]
       [<ffffffffa06052ea>] ieee80211_do_open+0xe6a/0x15a0 [mac80211]
       [<ffffffffa0605a79>] ieee80211_open+0x59/0x60 [mac80211]
       [snip]

-> #0 (&local->chanctx_mtx){+.+.+.}:
       [<ffffffff810d6cb7>] check_prevs_add+0x977/0x980
       [<ffffffff810d95bb>] __lock_acquire+0xb3b/0x13b0
       [<ffffffff810d9ee0>] lock_acquire+0xb0/0x1f0
       [<ffffffff817eb9c8>] mutex_lock_nested+0x78/0x4f0
       [<ffffffffa062e2f2>] ieee80211_vif_release_channel+0x42/0xb0 [mac80211]
       [<ffffffffa0609ec3>] ieee80211_set_monitor_channel+0x113/0x1b0 [mac80211]
       [<ffffffffa058fb37>] cfg80211_set_monitor_channel+0x77/0x2b0 [cfg80211]
       [<ffffffffa056e0b2>] __nl80211_set_channel+0x122/0x140 [cfg80211]
       [<ffffffffa0581374>] nl80211_set_wiphy+0x284/0xaf0 [cfg80211]
       [snip]

other info that might help us debug this:

Chain exists of:
  &local->chanctx_mtx --> &mvm->mutex --> &local->iflist_mtx

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&local->iflist_mtx);
                               lock(&mvm->mutex);
                               lock(&local->iflist_mtx);
  lock(&local->chanctx_mtx);

 *** DEADLOCK ***

This deadlock actually occurs:
INFO: task iw:3323 blocked for more than 120 seconds.
      Not tainted 3.14.3 #4
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
iw              D ffff8800c8afcd80  4192  3323   3322 0x00000000
 ffff880078fdb7e0 0000000000000046 ffff8800c8afcd80 ffff880078fdbfd8
 00000000001d5540 00000000001d5540 ffff8801141b0000 ffff8800c8afcd80
 ffff880078ff9e38 ffff880078ff9e38 ffff880078ff9e40 0000000000000246
Call Trace:
 [<ffffffff817ea841>] schedule_preempt_disabled+0x31/0x80
 [<ffffffff817ebaed>] mutex_lock_nested+0x19d/0x4f0
 [<ffffffffa06225cf>] ? ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
 [<ffffffffa06225cf>] ? ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
 [<ffffffffa052a680>] ? iwl_mvm_power_mac_update_mode+0xc0/0xc0 [iwlmvm]
 [<ffffffffa06225cf>] ieee80211_iterate_active_interfaces+0x2f/0x60 [mac80211]
 [<ffffffffa0529357>] _iwl_mvm_power_update_binding+0x27/0x80 [iwlmvm]
 [<ffffffffa0516eb1>] iwl_mvm_unassign_vif_chanctx+0x81/0xc0 [iwlmvm]
 [<ffffffffa062d3ff>] __ieee80211_vif_release_channel+0xdf/0x470 [mac80211]
 [<ffffffffa062e2fa>] ieee80211_vif_release_channel+0x4a/0xb0 [mac80211]
 [<ffffffffa0609ec3>] ieee80211_set_monitor_channel+0x113/0x1b0 [mac80211]
 [<ffffffffa058fb37>] cfg80211_set_monitor_channel+0x77/0x2b0 [cfg80211]
 [<ffffffffa056e0b2>] __nl80211_set_channel+0x122/0x140 [cfg80211]
 [<ffffffffa0581374>] nl80211_set_wiphy+0x284/0xaf0 [cfg80211]

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=75541

Cc: <stable@vger.kernel.org> [3.13+]
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Stop sched scan on bss_info_changed if !idle to avoid sched scan
during association.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Add an option to notify mac80211 about sched scan complete from
iwl_mvm_stop_sched_scan(), to enable this notification when the
stop was called from within the driver.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Reviewed-by: Alexander Bondar <alexander.bondar@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

in family 8000: additional channel 14 added to the low
band list. now the number of channels in the low band
is 15.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Dor Shaish <dor.shaish@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Some races with the hardware can happen when we take
ownership of the device. Don't give up after the first try.

Cc: <stable@vger.kernel.org>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The 8000 family products need a file on the file system
which is used as NVM. This file is a must, if no filename
is supplied as module parameter, use a default filename.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Dor Shaish <dor.shaish@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This is not needed since the PCIe layer disables the
bottom halves before it calls the op_mode.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

All messages should have a trailing newline, add all the
missing ones. Also make all messages constants, replacing
the single one that pointlessly used a variable.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

In case RFKILL is in KILL position, the NIC will issue an
interrupt straight away. This interrupt won't be sent
because it is masked in the hardware.
But if our interrupt service routine is called for another
reason (SHARED_IRQ), then we'll look at the interrupt cause
and service it. This can cause bad things if we are not
ready yet.
Explicitly clean the interrupt cause register to make sure
we won't service anything before we are ready to.

Cc: <stable@vger.kernel.org> [3.14]
Reported-and-tested-by: Alexander Monakov <amonakov@gmail.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

After fixes to the rs algorithm reenable MCS9.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Since the declaration of iwl_mvm_fw_error_rxf_dump and
iwl_mvm_fw_error_sram_dump is under
ifdef CONFIG_IWLWIFI_DEBUGFS, do the same for their
implementation.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This allows mac80211 to flush the Tx queues before it sends
critical management frames.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Publish WIPHY_FLAG_HAS_CHANNEL_SWITCH if the fw supports
newly introduced IWL_UCODE_TLV_API_CSA_FLOW.
When CSA starts, save the switching vif inside mvm and during the CSA period
configure fw with a new beacon after each beacon transmission in order to
update the csa counters.
Also, handle correctly the CSA unbind-bind flow which is triggered by mac80211
when the actual channel switch happens.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Some ampdu actions change queues by direct target access.

Since the bus is disabled in d0i3, make sure to exit d0i3
before handling these actions.
Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Reviewed-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

When a firmware error occurs, capture the last 32 commands
(which are still in memory) in the error dump debugfs file.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently the FW doesn't support sched scan while associated,
Prevent it.
Signed-off-by: David Spinadel <david.spinadel@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

This variable always tracks a constant value (256) so there's
no need to have it. Removing it simplifies code generation,
reducing the .text size (by about 240 bytes on x86-64.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The 'reset' argument is clearly a boolean, so use bool instead
of u8 with 0/1 values.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

If there's no LED on the system, it doesn't make a lot of sense
to include close to 4k of LED-related code (mostly in mac80211),
so instead of forcing LED support into the kernel, don't build
iwlwifi/mac80211 LED support if there's no LED class support.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: EliadX Peller <eliad@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The old code checks if hw_section_num is valid while the
right thing to do is to check if section[hw_section_num].data
is valid.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

For family 8000 products, the driver should take the MAC
address from the mac_override section and only if this
section is empty it should take it from the HW section.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Read first the nvm sections from the OTP, then read the nvm
sections from the external file and override the OTP values
(if there were any values in the OTP).
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Dor Shaish <dor.shaish@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

A few devices aren't allowed to be powered up at driver
load time. Add "power_up_nic_in_init" flag to iwl_cfg
structure to customize the load flow according to the
device.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

OTP size changed in family 7000 and in family 8000.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

There's no need to use a variable just to return the result
of another function call at the end of a function, remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

The expected throughput table used when estimating a new column
depends on the channel bandwidth. When switching from legacy to
siso or mimo the wrong expected throughput table was used as it
was chosen based on the the channel bandwidth in legacy which is
always 20Mhz. Instead it should be chosen based on the current sta
bandwidth which could be also 40Mhz or 80Mhz.
When enabling MCS9 this bug leads to a problem where the max
expected throughput of the siso or mimo column is 0 as MCS9 isn't
supported in 20Mhz. This in turns prevents switching to siso or mimo.

Fix this by using the sta bandwidth when deciding which table to choose.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

TPC is a power optimization which should only be attempted when
we're in the "stay in column" state after we've locked onto an optimal
rate.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Currently we were checking only if the driver power_scheme is set
to CAM. TPC shouldn't be enabled also when disabling powersave on the
interface (e.g. iw wlan0 set power_save off)
which may occur even if power_scheme wasn't set to CAM.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

rs_get_best_rate determines the optimal rate to try in a
new Tx column. Currently we were sometimes trying a too high
rate which would lead us to fail and avoid switching to the
new column despite it having a potential to be better.
Change the logic to try and find the first rate which would
exceed the current actual throughput or be more aggressive
if the success ratio is good.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

Adding more options in the search cycle causes longer
search cycles with additional wondering off to non optimal Tx
configurations. Reduce the Tx configurations searched to
improve throughput in non optimal attenuations.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>