--- /dev/null
+From 788e4c75f831d06fcfbbec1d455fac429521e607 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 12 May 2024 07:31:06 +0300
+Subject: wifi: iwlwifi: mvm: fix a crash on 7265
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 788e4c75f831d06fcfbbec1d455fac429521e607 upstream.
+
+Since IWL_FW_CMD_VER_UNKNOWN = 99, then my change to consider
+cmd_ver >= 7 instead of cmd_ver = 7 included also firmwares that don't
+advertise the command version at all. This made us send a command with a
+bad size and because of that, the firmware hit a BAD_COMMAND immediately
+after handling the REDUCE_TX_POWER_CMD command.
+
+Fixes: 8f892e225f41 ("wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240512072733.eb20ff5050d3.Ie4fc6f5496cd296fd6ff20d15e98676f28a3cccd@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218963
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -884,8 +884,8 @@ int iwl_mvm_sar_select_profile(struct iw
+ int ret;
+ u16 len = 0;
+ u32 n_subbands;
+- u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id,
+- IWL_FW_CMD_VER_UNKNOWN);
++ u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id, 3);
++
+ if (cmd_ver >= 7) {
+ len = sizeof(cmd.v7);
+ n_subbands = IWL_NUM_SUB_BANDS_V2;
--- /dev/null
+From 8f892e225f416fcf2b55a0f9161162e08e2b0cc7 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 19 Mar 2024 10:10:18 +0200
+Subject: wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 8f892e225f416fcf2b55a0f9161162e08e2b0cc7 upstream.
+
+This just adds a __le32 that we (currently) don't use.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240319100755.29ff7a88ddac.I39cf2ff1d1ddf0fa62722538698dc7f21aaaf39e@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218963
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 30 ++++++++++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 ++
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ++
+ 3 files changed, 36 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
+@@ -385,6 +385,33 @@ struct iwl_dev_tx_power_cmd_v7 {
+ __le32 timer_period;
+ __le32 flags;
+ } __packed; /* TX_REDUCED_POWER_API_S_VER_7 */
++
++/**
++ * struct iwl_dev_tx_power_cmd_v8 - TX power reduction command version 8
++ * @per_chain: per chain restrictions
++ * @enable_ack_reduction: enable or disable close range ack TX power
++ * reduction.
++ * @per_chain_restriction_changed: is per_chain_restriction has changed
++ * from last command. used if set_mode is
++ * IWL_TX_POWER_MODE_SET_SAR_TIMER.
++ * note: if not changed, the command is used for keep alive only.
++ * @reserved: reserved (padding)
++ * @timer_period: timer in milliseconds. if expires FW will change to default
++ * BIOS values. relevant if setMode is IWL_TX_POWER_MODE_SET_SAR_TIMER
++ * @flags: reduce power flags.
++ * @tpc_vlp_backoff_level: user backoff of UNII5,7 VLP channels in USA.
++ * Not in use.
++ */
++struct iwl_dev_tx_power_cmd_v8 {
++ __le16 per_chain[IWL_NUM_CHAIN_TABLES_V2][IWL_NUM_CHAIN_LIMITS][IWL_NUM_SUB_BANDS_V2];
++ u8 enable_ack_reduction;
++ u8 per_chain_restriction_changed;
++ u8 reserved[2];
++ __le32 timer_period;
++ __le32 flags;
++ __le32 tpc_vlp_backoff_level;
++} __packed; /* TX_REDUCED_POWER_API_S_VER_8 */
++
+ /**
+ * struct iwl_dev_tx_power_cmd - TX power reduction command (multiversion)
+ * @common: common part of the command
+@@ -392,6 +419,8 @@ struct iwl_dev_tx_power_cmd_v7 {
+ * @v4: version 4 part of the command
+ * @v5: version 5 part of the command
+ * @v6: version 6 part of the command
++ * @v7: version 7 part of the command
++ * @v8: version 8 part of the command
+ */
+ struct iwl_dev_tx_power_cmd {
+ struct iwl_dev_tx_power_common common;
+@@ -401,6 +430,7 @@ struct iwl_dev_tx_power_cmd {
+ struct iwl_dev_tx_power_cmd_v5 v5;
+ struct iwl_dev_tx_power_cmd_v6 v6;
+ struct iwl_dev_tx_power_cmd_v7 v7;
++ struct iwl_dev_tx_power_cmd_v8 v8;
+ };
+ };
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -886,11 +886,13 @@ int iwl_mvm_sar_select_profile(struct iw
+ u32 n_subbands;
+ u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id,
+ IWL_FW_CMD_VER_UNKNOWN);
+- if (cmd_ver == 7) {
++ if (cmd_ver >= 7) {
+ len = sizeof(cmd.v7);
+ n_subbands = IWL_NUM_SUB_BANDS_V2;
+ per_chain = cmd.v7.per_chain[0][0];
+ cmd.v7.flags = cpu_to_le32(mvm->fwrt.reduced_power_flags);
++ if (cmd_ver == 8)
++ len = sizeof(cmd.v8);
+ } else if (cmd_ver == 6) {
+ len = sizeof(cmd.v6);
+ n_subbands = IWL_NUM_SUB_BANDS_V2;
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1399,7 +1399,9 @@ int iwl_mvm_set_tx_power(struct iwl_mvm
+ if (tx_power == IWL_DEFAULT_MAX_TX_POWER)
+ cmd.common.pwr_restriction = cpu_to_le16(IWL_DEV_MAX_TX_POWER);
+
+- if (cmd_ver == 7)
++ if (cmd_ver == 8)
++ len = sizeof(cmd.v8);
++ else if (cmd_ver == 7)
+ len = sizeof(cmd.v7);
+ else if (cmd_ver == 6)
+ len = sizeof(cmd.v6);
projects / thirdparty / kernel / stable-queue.git / commitdiff
