git: 4b9ae864fc46 - main - LinuxKPI: 802.11: make TKIP start to work
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 23 Apr 2025 16:25:24 UTC
The branch main has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=4b9ae864fc46f75d87d04b1b9c343f317a9d0bed commit 4b9ae864fc46f75d87d04b1b9c343f317a9d0bed Author: Bjoern A. Zeeb <bz@FreeBSD.org> AuthorDate: 2025-04-16 08:22:20 +0000 Commit: Bjoern A. Zeeb <bz@FreeBSD.org> CommitDate: 2025-04-23 16:24:21 +0000 LinuxKPI: 802.11: make TKIP start to work In lkpi_iv_key_set() change the order to check if the cipher suite is supported. This for one avoids a possible kc memory leak, for the other allows us to extend the keylen we use for allocating memory. TKIP does need extra space as in addition to the key the RX/TX MIC are appended. Copy those now as well. In lkpi_hw_crypto_prepare_tkip() do the "enmic" (making space) part first before doing the "encap" part (making space). While this is technically not fully correct as the "enmic" would be done once for the entire MSDU and the "encap" would be done for each fragment, we are currently not setup to do per-vap or per-ic callbacks for this at the right moment from net80211. It will require a bit of thought. On the other hand we expect the firmware to do all this so it should be fine for as long as we no longer skip one part. We can likely start being more creative here in the compat code if needed. Sponsored by: The FreeBSD Foundation MFC after: 3 days --- sys/compat/linuxkpi/common/src/linux_80211.c | 90 +++++++++++++++++++--------- 1 file changed, 61 insertions(+), 29 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index b9d8cc7263ae..eef8024c5e84 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -1353,6 +1353,7 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) struct ieee80211_key_conf *kc; uint32_t lcipher; uint16_t exp_flags; + uint8_t keylen; int error; ic = vap->iv_ic; @@ -1377,21 +1378,14 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) } sta = LSTA_TO_STA(lsta); - if (lsta->kc[k->wk_keyix] != NULL) { - IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?"); - ic_printf(ic, "%s: sta %6D found with key information\n", - __func__, sta->addr, ":"); - kc = lsta->kc[k->wk_keyix]; - lsta->kc[k->wk_keyix] = NULL; - free(kc, M_LKPI80211); - kc = NULL; /* safeguard */ - } - + keylen = k->wk_keylen; lcipher = lkpi_net80211_to_l80211_cipher_suite( k->wk_cipher->ic_cipher, k->wk_keylen); switch (lcipher) { case WLAN_CIPHER_SUITE_CCMP: + break; case WLAN_CIPHER_SUITE_TKIP: + keylen += 2 * k->wk_cipher->ic_miclen; break; default: ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n", @@ -1401,9 +1395,18 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) return (0); } - kc = malloc(sizeof(*kc) + k->wk_keylen, M_LKPI80211, M_WAITOK | M_ZERO); + if (lsta->kc[k->wk_keyix] != NULL) { + IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?"); + ic_printf(ic, "%s: sta %6D found with key information\n", + __func__, sta->addr, ":"); + kc = lsta->kc[k->wk_keyix]; + lsta->kc[k->wk_keyix] = NULL; + free(kc, M_LKPI80211); + kc = NULL; /* safeguard */ + } + + kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO); kc->_k = k; /* Save the pointer to net80211. */ - atomic64_set(&kc->tx_pn, k->wk_keytsc); kc->cipher = lcipher; kc->keyidx = k->wk_keyix; #if 0 @@ -1424,6 +1427,8 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) kc->icv_len = k->wk_cipher->ic_trailer; break; case WLAN_CIPHER_SUITE_TKIP: + memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, k->wk_txmic, k->wk_cipher->ic_miclen); + memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY, k->wk_rxmic, k->wk_cipher->ic_miclen); kc->iv_len = k->wk_cipher->ic_header; kc->icv_len = k->wk_cipher->ic_trailer; break; @@ -1437,9 +1442,9 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) #ifdef LINUXKPI_DEBUG_80211 if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO) ic_printf(ic, "%s: running set_key cmd %d(%s) for sta %6D: " - "kc %p keyidx %u hw_key_idx %u flags %b\n", __func__, - SET_KEY, "SET", sta->addr, ":", - kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS); + "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n", __func__, + SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx, + kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS); #endif lhw = ic->ic_softc; @@ -4679,16 +4684,51 @@ lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, } #ifdef LKPI_80211_HW_CRYPTO +/* + * This is a bit of a hack given we know we are operating on a + * single frame and we know that hardware will deal with it. + * But otherwise the enmic bit and the encrypt bit need to be + * decoupled. + */ static int lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k, struct ieee80211_key_conf *kc, struct sk_buff *skb) { struct ieee80211_hdr *hdr; uint32_t hlen, hdrlen; - uint8_t *p, *m; + uint8_t *p; /* - * Check if we have anythig to do as requested by driver + * TKIP only happens on data. + */ + hdr = (void *)skb->data; + if (!ieee80211_is_data_present(hdr->frame_control)) + return (0); + + /* + * "enmic" (though we do not do that). + */ + /* any conditions to not apply this? */ + if (skb_tailroom(skb) < k->wk_cipher->ic_miclen) + return (ENOBUFS); + + p = skb_put(skb, k->wk_cipher->ic_miclen); + if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0) + goto encrypt; + + /* + * (*enmic) which we hopefully do not have to do with hw accel. + * That means if we make it here we have a problem. + */ + TODO("(*enmic)"); + return (ENXIO); + +encrypt: + /* + * "encrypt" (though we do not do that). + */ + /* + * Check if we have anything to do as requested by driver * or if we are done? */ if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 && @@ -4697,23 +4737,13 @@ lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k, hlen = k->wk_cipher->ic_header; if (skb_headroom(skb) < hlen) - return (ENOSPC); + return (ENOBUFS); hdr = (void *)skb->data; hdrlen = ieee80211_hdrlen(hdr->frame_control); p = skb_push(skb, hlen); memmove(p, p + hlen, hdrlen); - /* - * Put in zeroed space for the MMIC if requested. - * XXX-BZ in theory this is not the right place but given we - * are here we know we do hw_crypto so not much missing. - */ - if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0) { - m = skb_put(skb, 8); - memset(m, 0, 8); - } - /* If driver request space only we are done. */ if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0) return (0); @@ -4721,6 +4751,8 @@ lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k, p += hdrlen; k->wk_cipher->ic_setiv(k, p); + /* If we make it hear we do sw encryption. */ + TODO("sw encrypt"); return (ENXIO); } static int @@ -4746,7 +4778,7 @@ lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k, hlen = k->wk_cipher->ic_header; if (skb_headroom(skb) < hlen) - return (ENOSPC); + return (ENOBUFS); hdrlen = ieee80211_hdrlen(hdr->frame_control); p = skb_push(skb, hlen);