Miri Korenblit says: ==================== iwlwifi-fixes - missing unlock in error path - Avoid FW assert on bad command values - fix kernel panic due to incorrect index calculation ====================
Unified · Split
| @@ -1,6 +1,6 @@ | ||
| 1 | 1 | /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ |
| 2 | 2 | /* |
| 3 | − * Copyright (C) 2012-2014, 2018-2024 Intel Corporation | |
| 3 | + * Copyright (C) 2012-2014, 2018-2025 Intel Corporation | |
| 4 | 4 | * Copyright (C) 2013-2015 Intel Mobile Communications GmbH |
| 5 | 5 | * Copyright (C) 2016-2017 Intel Deutschland GmbH |
| 6 | 6 | */ |
| @@ -754,7 +754,7 @@ struct iwl_lari_config_change_cmd_v10 { · 747 unmodified lines | ||
| 754 | 754 | * according to the BIOS definitions. |
| 755 | 755 | * For LARI cmd version 11 - bits 0:4 are supported. |
| 756 | 756 | * For LARI cmd version 12 - bits 0:6 are supported and bits 7:31 are |
| 757 | − * reserved. No need to mask out the reserved bits. | |
| 757 | + * reserved. | |
| 758 | 758 | * @force_disable_channels_bitmap: Bitmap of disabled bands/channels. |
| 759 | 759 | * Each bit represents a set of channels in a specific band that should be |
| 760 | 760 | * disabled |
| @@ -787,6 +787,7 @@ struct iwl_lari_config_change_cmd { · 26 unmodified lines | ||
| 787 | 787 | /* Activate UNII-1 (5.2GHz) for World Wide */ |
| 788 | 788 | #define ACTIVATE_5G2_IN_WW_MASK BIT(4) |
| 789 | 789 | #define CHAN_STATE_ACTIVE_BITMAP_CMD_V11 0x1F |
| 790 | +#define CHAN_STATE_ACTIVE_BITMAP_CMD_V12 0x7F | |
| 790 | 791 | |
| 791 | 792 | /** |
| 792 | 793 | * struct iwl_pnvm_init_complete_ntfy - PNVM initialization complete |
| @@ -614,6 +614,7 @@ int iwl_fill_lari_config(struct iwl_fw_runtime *fwrt, · 613 unmodified lines | ||
| 614 | 614 | |
| 615 | 615 | ret = iwl_bios_get_dsm(fwrt, DSM_FUNC_ACTIVATE_CHANNEL, &value); |
| 616 | 616 | if (!ret) { |
| 617 | + value &= CHAN_STATE_ACTIVE_BITMAP_CMD_V12; | |
| 617 | 618 | if (cmd_ver < 8) |
| 618 | 619 | value &= ~ACTIVATE_5G2_IN_WW_MASK; |
| 619 | 620 | |
| @@ -251,8 +251,10 @@ void iwl_mld_configure_lari(struct iwl_mld *mld) · 250 unmodified lines | ||
| 251 | 251 | cpu_to_le32(value &= DSM_UNII4_ALLOW_BITMAP); |
| 252 | 252 | |
| 253 | 253 | ret = iwl_bios_get_dsm(fwrt, DSM_FUNC_ACTIVATE_CHANNEL, &value); |
| 254 | − if (!ret) | |
| 254 | + if (!ret) { | |
| 255 | + value &= CHAN_STATE_ACTIVE_BITMAP_CMD_V12; | |
| 255 | 256 | cmd.chan_state_active_bitmap = cpu_to_le32(value); |
| 257 | + } | |
| 256 | 258 | |
| 257 | 259 | ret = iwl_bios_get_dsm(fwrt, DSM_FUNC_ENABLE_6E, &value); |
| 258 | 260 | if (!ret) |
| @@ -546,8 +546,10 @@ again: · 545 unmodified lines | ||
| 546 | 546 | } |
| 547 | 547 | |
| 548 | 548 | if (WARN_ON(trans->do_top_reset && |
| 549 | − trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_SC)) | |
| 550 | − return -EINVAL; | |
| 549 | + trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_SC)) { | |
| 550 | + ret = -EINVAL; | |
| 551 | + goto out; | |
| 552 | + } | |
| 551 | 553 | |
| 552 | 554 | /* we need to wait later - set state */ |
| 553 | 555 | if (trans->do_top_reset) |
| @@ -2101,10 +2101,10 @@ static void iwl_txq_gen1_update_byte_cnt_tbl(struct iwl_trans *trans, · 2100 unmodified lines | ||
| 2101 | 2101 | |
| 2102 | 2102 | bc_ent = cpu_to_le16(len | (sta_id << 12)); |
| 2103 | 2103 | |
| 2104 | − scd_bc_tbl[txq_id * BC_TABLE_SIZE + write_ptr].tfd_offset = bc_ent; | |
| 2104 | + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + write_ptr].tfd_offset = bc_ent; | |
| 2105 | 2105 | |
| 2106 | 2106 | if (write_ptr < TFD_QUEUE_SIZE_BC_DUP) |
| 2107 | − scd_bc_tbl[txq_id * BC_TABLE_SIZE + TFD_QUEUE_SIZE_MAX + write_ptr].tfd_offset = | |
| 2107 | + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + TFD_QUEUE_SIZE_MAX + write_ptr].tfd_offset = | |
| 2108 | 2108 | bc_ent; |
| 2109 | 2109 | } |
| 2110 | 2110 | |
| @@ -2328,10 +2328,10 @@ static void iwl_txq_gen1_inval_byte_cnt_tbl(struct iwl_trans *trans, · 217 unmodified lines | ||
| 2328 | 2328 | |
| 2329 | 2329 | bc_ent = cpu_to_le16(1 | (sta_id << 12)); |
| 2330 | 2330 | |
| 2331 | − scd_bc_tbl[txq_id * BC_TABLE_SIZE + read_ptr].tfd_offset = bc_ent; | |
| 2331 | + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + read_ptr].tfd_offset = bc_ent; | |
| 2332 | 2332 | |
| 2333 | 2333 | if (read_ptr < TFD_QUEUE_SIZE_BC_DUP) |
| 2334 | − scd_bc_tbl[txq_id * BC_TABLE_SIZE + TFD_QUEUE_SIZE_MAX + read_ptr].tfd_offset = | |
| 2334 | + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + TFD_QUEUE_SIZE_MAX + read_ptr].tfd_offset = | |
| 2335 | 2335 | bc_ent; |
| 2336 | 2336 | } |
| 2337 | 2337 | |