From patchwork Fri Dec 8 13:32:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Govind Singh X-Patchwork-Id: 10102555 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A67E6602A0 for ; Fri, 8 Dec 2017 13:32:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E80128C86 for ; Fri, 8 Dec 2017 13:32:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9201028C88; Fri, 8 Dec 2017 13:32:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 498E928C86 for ; Fri, 8 Dec 2017 13:32:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=T8LBkMYZLLUiWCi9xfkM5AEf9JPj6Yh6awBAkAilWzA=; b=j7b S2/+2XWO8i3H4VGMxt7AJi4QiVJ+1TvEVVUodja6/31ty3R1IMDqQC4I7oaWV/VzMmwJV71uE3Smi tahgNTNMa5aFB4/Z/nVnhaEnzsTX7cdNBGcyXMnJoS6TGTu96zT4twddeITH3uij9halSF5h8lb48 bd6F/0G3+W+frpxeo9zc3zwj/grR34Ub2UsLPtDcITfh4SYpiSVDoQDyn4QzCtVeWi+PN16hhx2QD ueaX8oI1sPCb+12rP/r2wjormB3z3VmF2x5/FdkEu3WeV5IktOg9Gzmml4ySW/i0SvCrdnGgPpdLi YP5BeRFWaxLH0Ypalxduwr3UhmJyHOA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1eNIla-00024E-Nl; Fri, 08 Dec 2017 13:32:38 +0000 Received: from alexa-out.qualcomm.com ([129.46.98.28]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1eNIlW-0001qo-Dv for ath10k@lists.infradead.org; Fri, 08 Dec 2017 13:32:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1512739954; x=1544275954; h=from:to:cc:subject:date:message-id; bh=TEeH8LmdbdmHmAgLMWBpRB05pyK3RAIGNH51UzdBCcY=; b=B41P/BW78+cF6ZAGZInmHn7nwZn0hnawkZ7qceHyfHNMo9uBmKg2tOKj RuWyPmtH+7li6HKPH5Ph7/kSMJa/zFmb7W74dFdJOStzhF+kNI/LL5TNS JAoBPu/dRnujWHi0cUvb3RIdpJ1WuqcgIne6CWLjHUyV1Q+yfAQeIno7p Q=; Received: from ironmsg02-l-new.qualcomm.com (HELO ironmsg02-L.qualcomm.com) ([10.53.140.109]) by alexa-out.qualcomm.com with ESMTP; 08 Dec 2017 05:32:17 -0800 X-IronPort-AV: E=McAfee;i="5900,7806,8738"; a="1052831864" X-MGA-submission: =?us-ascii?q?MDG7lwkRkeVzK3gPh9XGrObFVpxdbw5Joc+sEM?= =?us-ascii?q?DdO/XCLMjiqrrPkETzD4VuJpabMJETaJMISg6RdrqsnSpvzATxLD2yCG?= =?us-ascii?q?NdNkeL0o8P7SO1Vxs4+k7LJw/YN3fqY3bZPYTEGMP4R34oOXxIMBqRX4?= =?us-ascii?q?3W?= Received: from govinds-linux.qualcomm.com ([10.204.116.70]) by ironmsg02-L.qualcomm.com with ESMTP; 08 Dec 2017 05:32:14 -0800 Received: by govinds-linux.qualcomm.com (Postfix, from userid 399420) id E567F358C; Fri, 8 Dec 2017 19:02:13 +0530 (IST) From: Govind Singh To: ath10k@lists.infradead.org Subject: [PATCH 2/2] ath10k: Populate RSC counter to firmware Date: Fri, 8 Dec 2017 19:02:12 +0530 Message-Id: <1512739932-1577-1-git-send-email-govinds@qti.qualcomm.com> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20171208_053234_550605_49A0D73C X-CRM114-Status: GOOD ( 11.28 ) X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Govind Singh , linux-wireless@vger.kernel.org MIME-Version: 1.0 Sender: "ath10k" Errors-To: ath10k-bounces+patchwork-ath10k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Access Point (AP) re-transmits message 3 of 4 way handshake if AP does not receive an appropriate response as acknowledgment. As a result, the client may receive message 3 multiple times. Each time it receives this message, it reinstalls the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. Send RSC counter to FW in set key WMI command, so that FW can drop the packet in PN check if received packet sequence no is less than current RSC counter during group keys(GTK) exchange. Tested on QCA6174 HW3.0 with firmware version RM.4.4.1.c1-00035-QCARMSWP-1. Signed-off-by: Govind Singh --- drivers/net/wireless/ath/ath10k/mac.c | 1 + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ drivers/net/wireless/ath/ath10k/wmi.h | 4 +++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 06383e7..43f78e3 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -226,6 +226,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif, .macaddr = macaddr, }; + memcpy(arg.key_rsc_counter, key->rx_pn, IEEE80211_MAX_PN_LEN); lockdep_assert_held(&arvif->ar->conf_mutex); switch (key->cipher) { diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 7616c1c..e7148f0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -1849,6 +1849,9 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) if (arg->macaddr) ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr); + memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter, + WMI_MAX_RSC_LEN); + ptr += sizeof(*tlv); ptr += sizeof(*cmd); diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h index c02b21c..4849787 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.h +++ b/drivers/net/wireless/ath/ath10k/wmi.h @@ -4752,6 +4752,7 @@ struct wmi_key_seq_counter { #define WMI_CIPHER_CKIP 0x6 #define WMI_CIPHER_AES_CMAC 0x7 #define WMI_CIPHER_AES_GCM 0x8 +#define WMI_MAX_RSC_LEN 0x8 struct wmi_vdev_install_key_cmd { __le32 vdev_id; @@ -4759,7 +4760,7 @@ struct wmi_vdev_install_key_cmd { __le32 key_idx; __le32 key_flags; __le32 key_cipher; /* %WMI_CIPHER_ */ - struct wmi_key_seq_counter key_rsc_counter; + u8 key_rsc_counter[WMI_MAX_RSC_LEN]; struct wmi_key_seq_counter key_global_rsc_counter; struct wmi_key_seq_counter key_tsc_counter; u8 wpi_key_rsc_counter[16]; @@ -4782,6 +4783,7 @@ struct wmi_vdev_install_key_arg { u32 key_txmic_len; u32 key_rxmic_len; const void *key_data; + u8 key_rsc_counter[IEEE80211_MAX_PN_LEN]; }; /*