[PATCH 0/1][SRU][OEM-5.10] Fix Intel AX210 Wi-Fi [8086:43f0] subsystem [1a56:1652] fw load failure

[You-Sheng Yang]

BugLink: https://bugs.launchpad.net/bugs/1913259

[Impact]

Intel AX210 Wi-Fi [8086:43f0] subsystem [1a56:1652] requests invalid
firmware path and fails device init:

  [ 4.146811] Intel(R) Wireless WiFi driver for Linux
  [ 4.146866] iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
  [ 4.155371] iwlwifi 0000:00:14.3: Direct firmware load for (efault)128.ucode failed with error -2
  [ 4.155388] iwlwifi 0000:00:14.3: Direct firmware load for (efault)127.ucode failed with error -2
  ...
  [ 4.157058] iwlwifi 0000:00:14.3: Direct firmware load for (efault)1.ucode failed with error -2
  [ 4.157068] iwlwifi 0000:00:14.3: Direct firmware load for (efault)0.ucode failed with error -2
  [ 4.157070] iwlwifi 0000:00:14.3: no suitable firmware found!
  [ 4.157071] iwlwifi 0000:00:14.3: minimum version required: (efault)0
  [ 4.157072] iwlwifi 0000:00:14.3: maximum version supported: (efault)128
  [ 4.157073] iwlwifi 0000:00:14.3: check git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git

This is a design flaw in iwlwifi driver source.

In drivers/net/wireless/intel/iwlwifi/pcie/drv.c

  static const struct pci_device_id iwl_hw_card_ids[] = {
    {IWL_PCI_DEVICE(0x4232, 0x1201, iwl5100_agn_cfg)},
    ...
    {IWL_PCI_DEVICE(0x43F0, PCI_ANY_ID, iwl_qu_long_latency_trans_cfg)},
    ...
  };

The third argument to IWL_PCI_DEVICE macro will be assigned to driver_data field
of struct pci_device_id. However, iwl5100_agn_cfg has type struct iwl_cfg, and
yet iwl_qu_long_latency_trans_cfg has type struct iwl_cfg_trans_params.

  struct iwl_cfg_trans_params {
    ...
  };

  struct iwl_cfg {
    struct iwl_cfg_trans_params trans;
    const char *name;
    const char *fw_name_pre;
    ...
  };

It's fine to cast a pointer to struct iwl_cfg, but it's not always valid to cast
a struct iwl_cfg_trans_params to struct iwl_cfg.

In function iwl_pci_probe, it tries to find an alternative cfg by iterating
throughout iwl_dev_info_table, but in our case, [8086:43f0] subsystem
[1a56:1652], all of the candidates will be skipped, and
iwl_qu_long_latency_trans_cfg will be assigned as the ultimate struct iwl_cfg,
which will be certainly wrong when you're trying to refer to anything beyond
sizeof(struct iwl_cfg_trans_params), e.g. cfg->fw_name_pre. In this case,
((struct iwl_cfg_trans_params*)&iwl_qu_long_latency_trans_cfg)->name will be
"'", and ((struct iwl_cfg_trans_params*)&iwl_qu_long_latency_trans_cfg)->fw_name_pre
gives "(efault)", pure garbage data.

[Fix]

Commit 410f758529bc ("iwlwifi: add new cards for So and Qu family") in v5.12-rc1
add a few additional entries to correctly catch this card.

[Test Case]

Booting from kernel built with aforementioned commit cherry-picked, WiFi
interface should be now up and working. Also tested this kernel against several
iwlwifi supported models on the target and a previous generation platform.

[Where problems could occur]

This card failed initialization previously. With it being up and running, it may
affect system stability if there are some undiscovered bugs related to this new
model.

[Other Info]

This change has been backported to stable kernel v5.11.4, so skipped nomination
for Hirsute/Unstable.

Ihab Zhaika (1):
  iwlwifi: add new cards for So and Qu family

 .../net/wireless/intel/iwlwifi/cfg/22000.c    | 18 +++++++++++++
 .../net/wireless/intel/iwlwifi/iwl-config.h   |  3 +++
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 27 +++++++++++++++++++
 3 files changed, 48 insertions(+)

-- 
2.30.2