|
|
@@ -0,0 +1,326 @@
|
|
|
+From: Felix Fietkau <[email protected]>
|
|
|
+Date: Wed, 22 Mar 2023 10:17:49 +0100
|
|
|
+Subject: [PATCH] wifi: mt76: ignore key disable commands
|
|
|
+
|
|
|
+This helps avoid cleartext leakage of already queued or powersave buffered
|
|
|
+packets, when a reassoc triggers the key deletion.
|
|
|
+
|
|
|
+Cc: [email protected]
|
|
|
+Signed-off-by: Felix Fietkau <[email protected]>
|
|
|
+---
|
|
|
+
|
|
|
+--- a/mt7603/main.c
|
|
|
++++ b/mt7603/main.c
|
|
|
+@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw,
|
|
|
+ !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
|
|
|
+ return -EOPNOTSUPP;
|
|
|
+
|
|
|
+- if (cmd == SET_KEY) {
|
|
|
+- key->hw_key_idx = wcid->idx;
|
|
|
+- wcid->hw_key_idx = idx;
|
|
|
+- } else {
|
|
|
++ if (cmd != SET_KEY) {
|
|
|
+ if (idx == wcid->hw_key_idx)
|
|
|
+ wcid->hw_key_idx = -1;
|
|
|
+
|
|
|
+- key = NULL;
|
|
|
++ return 0;
|
|
|
+ }
|
|
|
++
|
|
|
++ key->hw_key_idx = wcid->idx;
|
|
|
++ wcid->hw_key_idx = idx;
|
|
|
+ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+
|
|
|
+ return mt7603_wtbl_set_key(dev, wcid->idx, key);
|
|
|
+--- a/mt7615/mac.c
|
|
|
++++ b/mt7615/mac.c
|
|
|
+@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtsc
|
|
|
+ static int
|
|
|
+ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
|
|
|
+ struct ieee80211_key_conf *key,
|
|
|
+- enum mt76_cipher_type cipher, u16 cipher_mask,
|
|
|
+- enum set_key_cmd cmd)
|
|
|
++ enum mt76_cipher_type cipher, u16 cipher_mask)
|
|
|
+ {
|
|
|
+ u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
|
|
|
+ u8 data[32] = {};
|
|
|
+@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615
|
|
|
+ return -EINVAL;
|
|
|
+
|
|
|
+ mt76_rr_copy(dev, addr, data, sizeof(data));
|
|
|
+- if (cmd == SET_KEY) {
|
|
|
+- if (cipher == MT_CIPHER_TKIP) {
|
|
|
+- /* Rx/Tx MIC keys are swapped */
|
|
|
+- memcpy(data, key->key, 16);
|
|
|
+- memcpy(data + 16, key->key + 24, 8);
|
|
|
+- memcpy(data + 24, key->key + 16, 8);
|
|
|
+- } else {
|
|
|
+- if (cipher_mask == BIT(cipher))
|
|
|
+- memcpy(data, key->key, key->keylen);
|
|
|
+- else if (cipher != MT_CIPHER_BIP_CMAC_128)
|
|
|
+- memcpy(data, key->key, 16);
|
|
|
+- if (cipher == MT_CIPHER_BIP_CMAC_128)
|
|
|
+- memcpy(data + 16, key->key, 16);
|
|
|
+- }
|
|
|
++ if (cipher == MT_CIPHER_TKIP) {
|
|
|
++ /* Rx/Tx MIC keys are swapped */
|
|
|
++ memcpy(data, key->key, 16);
|
|
|
++ memcpy(data + 16, key->key + 24, 8);
|
|
|
++ memcpy(data + 24, key->key + 16, 8);
|
|
|
+ } else {
|
|
|
++ if (cipher_mask == BIT(cipher))
|
|
|
++ memcpy(data, key->key, key->keylen);
|
|
|
++ else if (cipher != MT_CIPHER_BIP_CMAC_128)
|
|
|
++ memcpy(data, key->key, 16);
|
|
|
+ if (cipher == MT_CIPHER_BIP_CMAC_128)
|
|
|
+- memset(data + 16, 0, 16);
|
|
|
+- else if (cipher_mask)
|
|
|
+- memset(data, 0, 16);
|
|
|
+- if (!cipher_mask)
|
|
|
+- memset(data, 0, sizeof(data));
|
|
|
++ memcpy(data + 16, key->key, 16);
|
|
|
+ }
|
|
|
+
|
|
|
+ mt76_wr_copy(dev, addr, data, sizeof(data));
|
|
|
+@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615
|
|
|
+ static int
|
|
|
+ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
|
|
|
+ enum mt76_cipher_type cipher, u16 cipher_mask,
|
|
|
+- int keyidx, enum set_key_cmd cmd)
|
|
|
++ int keyidx)
|
|
|
+ {
|
|
|
+ u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
|
|
|
+
|
|
|
+@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
|
|
|
+ else
|
|
|
+ w0 &= ~MT_WTBL_W0_RX_IK_VALID;
|
|
|
+
|
|
|
+- if (cmd == SET_KEY &&
|
|
|
+- (cipher != MT_CIPHER_BIP_CMAC_128 ||
|
|
|
+- cipher_mask == BIT(cipher))) {
|
|
|
++ if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) {
|
|
|
+ w0 &= ~MT_WTBL_W0_KEY_IDX;
|
|
|
+ w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx);
|
|
|
+ }
|
|
|
+@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
|
|
|
+
|
|
|
+ static void
|
|
|
+ mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
|
|
|
+- enum mt76_cipher_type cipher, u16 cipher_mask,
|
|
|
+- enum set_key_cmd cmd)
|
|
|
++ enum mt76_cipher_type cipher, u16 cipher_mask)
|
|
|
+ {
|
|
|
+ u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
|
|
|
+
|
|
|
+- if (!cipher_mask) {
|
|
|
+- mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE);
|
|
|
+- return;
|
|
|
+- }
|
|
|
+-
|
|
|
+- if (cmd != SET_KEY)
|
|
|
+- return;
|
|
|
+-
|
|
|
+ if (cipher == MT_CIPHER_BIP_CMAC_128 &&
|
|
|
+ cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128))
|
|
|
+ return;
|
|
|
+@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7
|
|
|
+
|
|
|
+ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
|
|
|
+ struct mt76_wcid *wcid,
|
|
|
+- struct ieee80211_key_conf *key,
|
|
|
+- enum set_key_cmd cmd)
|
|
|
++ struct ieee80211_key_conf *key)
|
|
|
+ {
|
|
|
+ enum mt76_cipher_type cipher;
|
|
|
+ u16 cipher_mask = wcid->cipher;
|
|
|
+@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7
|
|
|
+ if (cipher == MT_CIPHER_NONE)
|
|
|
+ return -EOPNOTSUPP;
|
|
|
+
|
|
|
+- if (cmd == SET_KEY)
|
|
|
+- cipher_mask |= BIT(cipher);
|
|
|
+- else
|
|
|
+- cipher_mask &= ~BIT(cipher);
|
|
|
+-
|
|
|
+- mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd);
|
|
|
+- err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask,
|
|
|
+- cmd);
|
|
|
++ cipher_mask |= BIT(cipher);
|
|
|
++ mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask);
|
|
|
++ err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask);
|
|
|
+ if (err < 0)
|
|
|
+ return err;
|
|
|
+
|
|
|
+ err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask,
|
|
|
+- key->keyidx, cmd);
|
|
|
++ key->keyidx);
|
|
|
+ if (err < 0)
|
|
|
+ return err;
|
|
|
+
|
|
|
+@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7
|
|
|
+
|
|
|
+ int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
|
|
|
+ struct mt76_wcid *wcid,
|
|
|
+- struct ieee80211_key_conf *key,
|
|
|
+- enum set_key_cmd cmd)
|
|
|
++ struct ieee80211_key_conf *key)
|
|
|
+ {
|
|
|
+ int err;
|
|
|
+
|
|
|
+ spin_lock_bh(&dev->mt76.lock);
|
|
|
+- err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
|
|
|
++ err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
|
|
|
+ spin_unlock_bh(&dev->mt76.lock);
|
|
|
+
|
|
|
+ return err;
|
|
|
+--- a/mt7615/main.c
|
|
|
++++ b/mt7615/main.c
|
|
|
+@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee802
|
|
|
+
|
|
|
+ if (cmd == SET_KEY)
|
|
|
+ *wcid_keyidx = idx;
|
|
|
+- else if (idx == *wcid_keyidx)
|
|
|
+- *wcid_keyidx = -1;
|
|
|
+- else
|
|
|
++ else {
|
|
|
++ if (idx == *wcid_keyidx)
|
|
|
++ *wcid_keyidx = -1;
|
|
|
+ goto out;
|
|
|
++ }
|
|
|
+
|
|
|
+- mt76_wcid_key_setup(&dev->mt76, wcid,
|
|
|
+- cmd == SET_KEY ? key : NULL);
|
|
|
+-
|
|
|
++ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+ if (mt76_is_mmio(&dev->mt76))
|
|
|
+- err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
|
|
|
++ err = mt7615_mac_wtbl_set_key(dev, wcid, key);
|
|
|
+ else
|
|
|
+- err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
|
|
|
++ err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
|
|
|
+
|
|
|
+ out:
|
|
|
+ mt7615_mutex_release(dev);
|
|
|
+--- a/mt7615/mt7615.h
|
|
|
++++ b/mt7615/mt7615.h
|
|
|
+@@ -491,11 +491,9 @@ int mt7615_mac_write_txwi(struct mt7615_
|
|
|
+ void mt7615_mac_set_timing(struct mt7615_phy *phy);
|
|
|
+ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
|
|
|
+ struct mt76_wcid *wcid,
|
|
|
+- struct ieee80211_key_conf *key,
|
|
|
+- enum set_key_cmd cmd);
|
|
|
++ struct ieee80211_key_conf *key);
|
|
|
+ int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
|
|
|
+- struct ieee80211_key_conf *key,
|
|
|
+- enum set_key_cmd cmd);
|
|
|
++ struct ieee80211_key_conf *key);
|
|
|
+ void mt7615_mac_reset_work(struct work_struct *work);
|
|
|
+ u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid);
|
|
|
+
|
|
|
+--- a/mt76x02_util.c
|
|
|
++++ b/mt76x02_util.c
|
|
|
+@@ -454,20 +454,20 @@ int mt76x02_set_key(struct ieee80211_hw
|
|
|
+ msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
|
|
|
+ wcid = msta ? &msta->wcid : &mvif->group_wcid;
|
|
|
+
|
|
|
+- if (cmd == SET_KEY) {
|
|
|
+- key->hw_key_idx = wcid->idx;
|
|
|
+- wcid->hw_key_idx = idx;
|
|
|
+- if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
|
|
|
+- key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
|
|
|
+- wcid->sw_iv = true;
|
|
|
+- }
|
|
|
+- } else {
|
|
|
++ if (cmd != SET_KEY) {
|
|
|
+ if (idx == wcid->hw_key_idx) {
|
|
|
+ wcid->hw_key_idx = -1;
|
|
|
+ wcid->sw_iv = false;
|
|
|
+ }
|
|
|
+
|
|
|
+- key = NULL;
|
|
|
++ return 0;
|
|
|
++ }
|
|
|
++
|
|
|
++ key->hw_key_idx = wcid->idx;
|
|
|
++ wcid->hw_key_idx = idx;
|
|
|
++ if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
|
|
|
++ key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
|
|
|
++ wcid->sw_iv = true;
|
|
|
+ }
|
|
|
+ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+
|
|
|
+--- a/mt7915/main.c
|
|
|
++++ b/mt7915/main.c
|
|
|
+@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee802
|
|
|
+ mt7915_mcu_add_bss_info(phy, vif, true);
|
|
|
+ }
|
|
|
+
|
|
|
+- if (cmd == SET_KEY)
|
|
|
++ if (cmd == SET_KEY) {
|
|
|
+ *wcid_keyidx = idx;
|
|
|
+- else if (idx == *wcid_keyidx)
|
|
|
+- *wcid_keyidx = -1;
|
|
|
+- else
|
|
|
++ } else {
|
|
|
++ if (idx == *wcid_keyidx)
|
|
|
++ *wcid_keyidx = -1;
|
|
|
+ goto out;
|
|
|
++ }
|
|
|
+
|
|
|
+- mt76_wcid_key_setup(&dev->mt76, wcid,
|
|
|
+- cmd == SET_KEY ? key : NULL);
|
|
|
+-
|
|
|
++ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+ err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
|
|
|
+ key, MCU_EXT_CMD(STA_REC_UPDATE),
|
|
|
+ &msta->wcid, cmd);
|
|
|
+--- a/mt7921/main.c
|
|
|
++++ b/mt7921/main.c
|
|
|
+@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee802
|
|
|
+
|
|
|
+ mt7921_mutex_acquire(dev);
|
|
|
+
|
|
|
+- if (cmd == SET_KEY)
|
|
|
++ if (cmd == SET_KEY) {
|
|
|
+ *wcid_keyidx = idx;
|
|
|
+- else if (idx == *wcid_keyidx)
|
|
|
+- *wcid_keyidx = -1;
|
|
|
+- else
|
|
|
++ } else {
|
|
|
++ if (idx == *wcid_keyidx)
|
|
|
++ *wcid_keyidx = -1;
|
|
|
+ goto out;
|
|
|
++ }
|
|
|
+
|
|
|
+- mt76_wcid_key_setup(&dev->mt76, wcid,
|
|
|
+- cmd == SET_KEY ? key : NULL);
|
|
|
+-
|
|
|
++ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+ err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
|
|
|
+ key, MCU_UNI_CMD(STA_REC_UPDATE),
|
|
|
+ &msta->wcid, cmd);
|
|
|
+--- a/mt7996/main.c
|
|
|
++++ b/mt7996/main.c
|
|
|
+@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee802
|
|
|
+ mt7996_mcu_add_bss_info(phy, vif, true);
|
|
|
+ }
|
|
|
+
|
|
|
+- if (cmd == SET_KEY)
|
|
|
++ if (cmd == SET_KEY) {
|
|
|
+ *wcid_keyidx = idx;
|
|
|
+- else if (idx == *wcid_keyidx)
|
|
|
+- *wcid_keyidx = -1;
|
|
|
+- else
|
|
|
++ } else {
|
|
|
++ if (idx == *wcid_keyidx)
|
|
|
++ *wcid_keyidx = -1;
|
|
|
+ goto out;
|
|
|
++ }
|
|
|
+
|
|
|
+- mt76_wcid_key_setup(&dev->mt76, wcid,
|
|
|
+- cmd == SET_KEY ? key : NULL);
|
|
|
+-
|
|
|
++ mt76_wcid_key_setup(&dev->mt76, wcid, key);
|
|
|
+ err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
|
|
|
+ key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
|
|
|
+ &msta->wcid, cmd);
|
Felix Fietkau