All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kalle Valo <kvalo@codeaurora.org>
To: bqiang@codeaurora.org
Cc: Jouni Malinen <jouni@codeaurora.org>,
	ath11k@lists.infradead.org, linux-wireless@vger.kernel.org
Subject: Re: [PATCH 2/3] ath11k: change return buffer manager for QCA6390
Date: Mon, 25 Oct 2021 16:02:06 +0300	[thread overview]
Message-ID: <87r1c99s1d.fsf@codeaurora.org> (raw)
In-Reply-To: <87a6jnftq9.fsf@codeaurora.org> (Kalle Valo's message of "Tue, 05 Oct 2021 17:10:06 +0300")

Kalle Valo <kvalo@codeaurora.org> writes:

> bqiang@codeaurora.org writes:
>
>> On 2021-09-28 23:14, Kalle Valo wrote:
>>> Jouni Malinen <jouni@codeaurora.org> writes:
>>>
>>>> From: Baochen Qiang <bqiang@codeaurora.org>
>>>>
>>>> QCA6390 firmware uses HAL_RX_BUF_RBM_SW1_BM, not
>>>> HAL_RX_BUF_RBM_SW3_BM.
>>>>
>>>> Tested-on: QCA6390 hw2.0 PCI
>>>> WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
>>>>
>>>> Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
>>>> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
>>>
>>> Same question as in patch 1, does this fix a bug or is just a
>>> theoretical issue found during code review?
>>
>> Yes, this patch did fix a bug.
>>
>> QCA6390 firmware expects some specific packets from WBM2SW1 ring,
>> which, however, will not happen because they are routed directly to
>> host through WBM2SW3 ring due to wrong configuration of RBM.
>
> What specific packets exactly?

We discussed this internally and I now changed the commit log to:

ath11k: change return buffer manager for QCA6390

QCA6390 firmware uses HAL_RX_BUF_RBM_SW1_BM, not HAL_RX_BUF_RBM_SW3_BM. This is
needed to fix a case where an A-MSDU has an unexpected LLC/SNAP header in the
first subframe (CVE-2020-24588).

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1

Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

-- 
ath11k mailing list
ath11k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath11k

WARNING: multiple messages have this Message-ID (diff)
From: Kalle Valo <kvalo@codeaurora.org>
To: bqiang@codeaurora.org
Cc: Jouni Malinen <jouni@codeaurora.org>,
	ath11k@lists.infradead.org, linux-wireless@vger.kernel.org
Subject: Re: [PATCH 2/3] ath11k: change return buffer manager for QCA6390
Date: Mon, 25 Oct 2021 16:02:06 +0300	[thread overview]
Message-ID: <87r1c99s1d.fsf@codeaurora.org> (raw)
In-Reply-To: <87a6jnftq9.fsf@codeaurora.org> (Kalle Valo's message of "Tue, 05 Oct 2021 17:10:06 +0300")

Kalle Valo <kvalo@codeaurora.org> writes:

> bqiang@codeaurora.org writes:
>
>> On 2021-09-28 23:14, Kalle Valo wrote:
>>> Jouni Malinen <jouni@codeaurora.org> writes:
>>>
>>>> From: Baochen Qiang <bqiang@codeaurora.org>
>>>>
>>>> QCA6390 firmware uses HAL_RX_BUF_RBM_SW1_BM, not
>>>> HAL_RX_BUF_RBM_SW3_BM.
>>>>
>>>> Tested-on: QCA6390 hw2.0 PCI
>>>> WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
>>>>
>>>> Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
>>>> Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
>>>
>>> Same question as in patch 1, does this fix a bug or is just a
>>> theoretical issue found during code review?
>>
>> Yes, this patch did fix a bug.
>>
>> QCA6390 firmware expects some specific packets from WBM2SW1 ring,
>> which, however, will not happen because they are routed directly to
>> host through WBM2SW3 ring due to wrong configuration of RBM.
>
> What specific packets exactly?

We discussed this internally and I now changed the commit log to:

ath11k: change return buffer manager for QCA6390

QCA6390 firmware uses HAL_RX_BUF_RBM_SW1_BM, not HAL_RX_BUF_RBM_SW3_BM. This is
needed to fix a case where an A-MSDU has an unexpected LLC/SNAP header in the
first subframe (CVE-2020-24588).

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1

Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

  reply	other threads:[~2021-10-25 13:02 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-14 16:37 [PATCH 1/3] ath11k: Change number of TCL rings to one for QCA6390 Jouni Malinen
2021-09-14 16:37 ` Jouni Malinen
2021-09-14 16:37 ` [PATCH 2/3] ath11k: change return buffer manager " Jouni Malinen
2021-09-14 16:37   ` Jouni Malinen
2021-09-16 10:02   ` Kalle Valo
2021-09-16 10:02     ` Kalle Valo
2021-09-28 15:09   ` Kalle Valo
2021-09-28 15:09     ` Kalle Valo
2021-09-28 15:14   ` Kalle Valo
2021-09-28 15:14     ` Kalle Valo
2021-09-29  2:42     ` bqiang
2021-09-29  2:42       ` bqiang
2021-10-01  6:26       ` Kalle Valo
2021-10-01  6:26         ` Kalle Valo
2021-10-05 14:10       ` Kalle Valo
2021-10-05 14:10         ` Kalle Valo
2021-10-25 13:02         ` Kalle Valo [this message]
2021-10-25 13:02           ` Kalle Valo
2021-10-25 13:03   ` Kalle Valo
2021-10-25 13:03     ` Kalle Valo
2021-09-14 16:37 ` [PATCH 3/3] ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855 Jouni Malinen
2021-09-14 16:37   ` Jouni Malinen
2021-09-16 10:08   ` Kalle Valo
2021-09-16 10:08     ` Kalle Valo
2021-09-16 14:09     ` Wen Gong
2021-09-16 14:09       ` Wen Gong
2021-09-16 15:15       ` Kalle Valo
2021-09-16 15:15         ` Kalle Valo
2021-10-28 10:07   ` Kalle Valo
2021-10-28 10:07     ` Kalle Valo
2021-10-29  2:30     ` Wen Gong
2021-10-29  2:30       ` Wen Gong
2021-11-01 14:13   ` Kalle Valo
2021-11-01 14:13     ` Kalle Valo
2021-09-28 15:12 ` [PATCH 1/3] ath11k: Change number of TCL rings to one for QCA6390 Kalle Valo
2021-09-28 15:12   ` Kalle Valo
2021-09-29  2:15   ` bqiang
2021-09-29  2:15     ` bqiang
2021-10-05 14:06     ` Kalle Valo
2021-10-05 14:06       ` Kalle Valo
2021-10-11 15:12 ` Kalle Valo
2021-10-11 15:12   ` Kalle Valo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87r1c99s1d.fsf@codeaurora.org \
    --to=kvalo@codeaurora.org \
    --cc=ath11k@lists.infradead.org \
    --cc=bqiang@codeaurora.org \
    --cc=jouni@codeaurora.org \
    --cc=linux-wireless@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.