[PATCH v2 1/2] mac80211: add option to generate CCMP IVs only for mgmt frames

[PATCH v2 1/2] mac80211: add option to generate CCMP IVs only for mgmt frames

[Marek Kwaczynski]

Some chips can encrypt managment frames in HW, but
require generated IV in the frame. Add a key flag
that allows us to achieve this.

Signed-off-by: Marek Kwaczynski <marek.kwaczynski@tieto.com>
---

v2: fix missed prefix

 include/net/mac80211.h |   16 ++++++++++------
 net/mac80211/tx.c      |    5 +++--
 net/mac80211/wpa.c     |    7 +++++--
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 2de7ff4..77689ca 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1202,14 +1202,18 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *	fall back to software crypto. Note that this flag deals only with
  *	RX, if your crypto engine can't deal with TX you can also set the
  *	%IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
+ * @IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX: This flag should be set by the
+ *	driver for a CCMP key to indicate that is requires IV generation
+ *	only for managment frames (MFP).
  */
 enum ieee80211_key_flags {
-	IEEE80211_KEY_FLAG_GENERATE_IV	= 1<<1,
-	IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
-	IEEE80211_KEY_FLAG_PAIRWISE	= 1<<3,
-	IEEE80211_KEY_FLAG_SW_MGMT_TX	= 1<<4,
-	IEEE80211_KEY_FLAG_PUT_IV_SPACE = 1<<5,
-	IEEE80211_KEY_FLAG_RX_MGMT	= 1<<6,
+	IEEE80211_KEY_FLAG_GENERATE_IV		= 1<<1,
+	IEEE80211_KEY_FLAG_GENERATE_MMIC	= 1<<2,
+	IEEE80211_KEY_FLAG_PAIRWISE		= 1<<3,
+	IEEE80211_KEY_FLAG_SW_MGMT_TX		= 1<<4,
+	IEEE80211_KEY_FLAG_PUT_IV_SPACE		= 1<<5,
+	IEEE80211_KEY_FLAG_RX_MGMT		= 1<<6,
+	IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX	= 1<<7,
 };
 
 /**
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 19d36d4..8a49272 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -625,8 +625,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 				tx->key = NULL;
 			else
 				skip_hw = (tx->key->conf.flags &
-					   IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
-					ieee80211_is_mgmt(hdr->frame_control);
+				   (IEEE80211_KEY_FLAG_SW_MGMT_TX |
+				    IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX)) &&
+				    ieee80211_is_mgmt(hdr->frame_control);
 			break;
 		case WLAN_CIPHER_SUITE_AES_CMAC:
 			if (!ieee80211_is_mgmt(hdr->frame_control))
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index b8600e3..2ef2e40 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -450,8 +450,11 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
 	ccmp_pn2hdr(pos, pn, key->conf.keyidx);
 
-	/* hwaccel - with software CCMP header */
-	if (info->control.hw_key)
+	/* hwaccel - with software CCMP header or the HW needs
+	 * generated the IV
+	 */
+	if (info->control.hw_key ||
+	    (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX))
 		return 0;
 
 	pos += IEEE80211_CCMP_HDR_LEN;
-- 
1.7.9.5

[PATCH v2 2/2] ath10k: Fix pmf for action frames

[Marek Kwaczynski]

Fix sending and receiveing protected managment frames.
Lack of protected flag for received protected action frames
causes report these frames as unprotected robust action frames.
If the driver in AP mode sent frame with protected flag and
CCMP header using IEEE80211_KEY_FLAG_SW_MGMT_TX flag,
the FW encrypted frames once again. From user side all
received SA Query Requests and Responses were skipped and
all protected action frames were sent as malformed packets.

Signed-off-by: Marek Kwaczynski <marek.kwaczynski@tieto.com>
---

v2: fix missed prefix

 drivers/net/wireless/ath/ath10k/mac.c |    5 ++++-
 drivers/net/wireless/ath/ath10k/wmi.c |   24 ++++++++++++++++++++----
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 58ec5a7..0c66c18 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -54,7 +54,10 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
 	switch (key->cipher) {
 	case WLAN_CIPHER_SUITE_CCMP:
 		arg.key_cipher = WMI_CIPHER_AES_CCM;
-		key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+		if (arvif->vdev_type == WMI_VDEV_TYPE_AP)
+			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX;
+		else
+			key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
 		break;
 	case WLAN_CIPHER_SUITE_TKIP:
 		arg.key_cipher = WMI_CIPHER_TKIP;
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index d4b48ef..6d8a097 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -639,6 +639,7 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 	struct sk_buff *wmi_skb;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	int len;
+	u32 buf_len = skb->len;
 	u16 fc;
 
 	hdr = (struct ieee80211_hdr *)skb->data;
@@ -648,6 +649,15 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 		return -EINVAL;
 
 	len = sizeof(cmd->hdr) + skb->len;
+
+	if ((ieee80211_is_action(hdr->frame_control) ||
+	     ieee80211_is_deauth(hdr->frame_control) ||
+	     ieee80211_is_disassoc(hdr->frame_control)) &&
+	     ieee80211_has_protected(hdr->frame_control)) {
+		len += IEEE80211_CCMP_MIC_LEN;
+		buf_len += IEEE80211_CCMP_MIC_LEN;
+	}
+
 	len = round_up(len, 4);
 
 	wmi_skb = ath10k_wmi_alloc_skb(len);
@@ -659,7 +669,7 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 	cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(skb)->vdev_id);
 	cmd->hdr.tx_rate = 0;
 	cmd->hdr.tx_power = 0;
-	cmd->hdr.buf_len = __cpu_to_le32((u32)(skb->len));
+	cmd->hdr.buf_len = __cpu_to_le32(buf_len);
 
 	memcpy(cmd->hdr.peer_macaddr.addr, ieee80211_get_DA(hdr), ETH_ALEN);
 	memcpy(cmd->buf, skb->data, skb->len);
@@ -957,10 +967,16 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
 	 * frames with Protected Bit set. */
 	if (ieee80211_has_protected(hdr->frame_control) &&
 	    !ieee80211_is_auth(hdr->frame_control)) {
-		status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED |
-				RX_FLAG_MMIC_STRIPPED;
-		hdr->frame_control = __cpu_to_le16(fc &
+		status->flag |= RX_FLAG_DECRYPTED;
+
+		if (!ieee80211_is_action(hdr->frame_control) &&
+		    !ieee80211_is_deauth(hdr->frame_control) &&
+		    !ieee80211_is_disassoc(hdr->frame_control)) {
+			status->flag |= RX_FLAG_IV_STRIPPED |
+					RX_FLAG_MMIC_STRIPPED;
+			hdr->frame_control = __cpu_to_le16(fc &
 					~IEEE80211_FCTL_PROTECTED);
+		}
 	}
 
 	ath10k_dbg(ATH10K_DBG_MGMT,
-- 
1.7.9.5

Re: [PATCH v2 1/2] mac80211: add option to generate CCMP IVs only for mgmt frames

[Johannes Berg]

On Wed, 2014-04-09 at 10:57 +0200, Marek Kwaczynski wrote:
> Some chips can encrypt managment frames in HW, but
> require generated IV in the frame. Add a key flag
> that allows us to achieve this.

> + * @IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX: This flag should be set by the
> + *	driver for a CCMP key to indicate that is requires IV generation
> + *	only for managment frames (MFP).

Maybe IEEE80211_KEY_FLAG_GENERATE_IV_MGMT would be better and matching
the IEEE80211_KEY_FLAG_GENERATE_IV better?

>   */
>  enum ieee80211_key_flags {
> -	IEEE80211_KEY_FLAG_GENERATE_IV	= 1<<1,
> +	IEEE80211_KEY_FLAG_GENERATE_IV		= 1<<1,

Since you're touching all these, please convert them all to BIT().

> @@ -625,8 +625,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
>  				tx->key = NULL;
>  			else
>  				skip_hw = (tx->key->conf.flags &
> -					   IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
> -					ieee80211_is_mgmt(hdr->frame_control);
> +				   (IEEE80211_KEY_FLAG_SW_MGMT_TX |
> +				    IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX)) &&
> +				    ieee80211_is_mgmt(hdr->frame_control);

This seems wrong, you don't want to skip_hw in this case, you just want
to have the IV generated.

> +	/* hwaccel - with software CCMP header or the HW needs
> +	 * generated the IV
> +	 */
> +	if (info->control.hw_key ||
> +	    (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MGMT_IV_TX))
>  		return 0;

This seems equally wrong, and it looks like maybe in this case two
wrongs make a right, but I think you should probably put it in the
place(s) where IEEE80211_KEY_FLAG_GENERATE_IV is checked.

johannes