~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/mac80211/wpa.c

Version: ~ [ linux-5.8-rc5 ] ~ [ linux-5.7.8 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.51 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.132 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.188 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.230 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.230 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

Diff markup

Differences between /net/mac80211/wpa.c (Version linux-5.0.21) and /net/mac80211/wpa.c (Version linux-4.13.16)


  1 /*                                                  1 /*
  2  * Copyright 2002-2004, Instant802 Networks, I      2  * Copyright 2002-2004, Instant802 Networks, Inc.
  3  * Copyright 2008, Jouni Malinen <j@w1.fi>          3  * Copyright 2008, Jouni Malinen <j@w1.fi>
  4  * Copyright (C) 2016-2017 Intel Deutschland G !!   4  * Copyright (C) 2016 Intel Deutschland GmbH
  5  *                                                  5  *
  6  * This program is free software; you can redi      6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Publi      7  * it under the terms of the GNU General Public License version 2 as
  8  * published by the Free Software Foundation.       8  * published by the Free Software Foundation.
  9  */                                                 9  */
 10                                                    10 
 11 #include <linux/netdevice.h>                       11 #include <linux/netdevice.h>
 12 #include <linux/types.h>                           12 #include <linux/types.h>
 13 #include <linux/skbuff.h>                          13 #include <linux/skbuff.h>
 14 #include <linux/compiler.h>                        14 #include <linux/compiler.h>
 15 #include <linux/ieee80211.h>                       15 #include <linux/ieee80211.h>
 16 #include <linux/gfp.h>                             16 #include <linux/gfp.h>
 17 #include <asm/unaligned.h>                         17 #include <asm/unaligned.h>
 18 #include <net/mac80211.h>                          18 #include <net/mac80211.h>
 19 #include <crypto/aes.h>                            19 #include <crypto/aes.h>
 20 #include <crypto/algapi.h>                         20 #include <crypto/algapi.h>
 21                                                    21 
 22 #include "ieee80211_i.h"                           22 #include "ieee80211_i.h"
 23 #include "michael.h"                               23 #include "michael.h"
 24 #include "tkip.h"                                  24 #include "tkip.h"
 25 #include "aes_ccm.h"                               25 #include "aes_ccm.h"
 26 #include "aes_cmac.h"                              26 #include "aes_cmac.h"
 27 #include "aes_gmac.h"                              27 #include "aes_gmac.h"
 28 #include "aes_gcm.h"                               28 #include "aes_gcm.h"
 29 #include "wpa.h"                                   29 #include "wpa.h"
 30                                                    30 
 31 ieee80211_tx_result                                31 ieee80211_tx_result
 32 ieee80211_tx_h_michael_mic_add(struct ieee8021     32 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 33 {                                                  33 {
 34         u8 *data, *key, *mic;                      34         u8 *data, *key, *mic;
 35         size_t data_len;                           35         size_t data_len;
 36         unsigned int hdrlen;                       36         unsigned int hdrlen;
 37         struct ieee80211_hdr *hdr;                 37         struct ieee80211_hdr *hdr;
 38         struct sk_buff *skb = tx->skb;             38         struct sk_buff *skb = tx->skb;
 39         struct ieee80211_tx_info *info = IEEE8     39         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 40         int tail;                                  40         int tail;
 41                                                    41 
 42         hdr = (struct ieee80211_hdr *)skb->dat     42         hdr = (struct ieee80211_hdr *)skb->data;
 43         if (!tx->key || tx->key->conf.cipher !     43         if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
 44             skb->len < 24 || !ieee80211_is_dat     44             skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
 45                 return TX_CONTINUE;                45                 return TX_CONTINUE;
 46                                                    46 
 47         hdrlen = ieee80211_hdrlen(hdr->frame_c     47         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 48         if (skb->len < hdrlen)                     48         if (skb->len < hdrlen)
 49                 return TX_DROP;                    49                 return TX_DROP;
 50                                                    50 
 51         data = skb->data + hdrlen;                 51         data = skb->data + hdrlen;
 52         data_len = skb->len - hdrlen;              52         data_len = skb->len - hdrlen;
 53                                                    53 
 54         if (unlikely(info->flags & IEEE80211_T     54         if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
 55                 /* Need to use software crypto     55                 /* Need to use software crypto for the test */
 56                 info->control.hw_key = NULL;       56                 info->control.hw_key = NULL;
 57         }                                          57         }
 58                                                    58 
 59         if (info->control.hw_key &&                59         if (info->control.hw_key &&
 60             (info->flags & IEEE80211_TX_CTL_DO     60             (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
 61              ieee80211_hw_check(&tx->local->hw     61              ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
 62             !(tx->key->conf.flags & (IEEE80211 !!  62             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
 63                                      IEEE80211 !!  63                 /* hwaccel - with no need for SW-generated MMIC */
 64                 /* hwaccel - with no need for  << 
 65                 return TX_CONTINUE;                64                 return TX_CONTINUE;
 66         }                                          65         }
 67                                                    66 
 68         tail = MICHAEL_MIC_LEN;                    67         tail = MICHAEL_MIC_LEN;
 69         if (!info->control.hw_key)                 68         if (!info->control.hw_key)
 70                 tail += IEEE80211_TKIP_ICV_LEN     69                 tail += IEEE80211_TKIP_ICV_LEN;
 71                                                    70 
 72         if (WARN(skb_tailroom(skb) < tail ||       71         if (WARN(skb_tailroom(skb) < tail ||
 73                  skb_headroom(skb) < IEEE80211     72                  skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
 74                  "mmic: not enough head/tail (     73                  "mmic: not enough head/tail (%d/%d,%d/%d)\n",
 75                  skb_headroom(skb), IEEE80211_     74                  skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
 76                  skb_tailroom(skb), tail))         75                  skb_tailroom(skb), tail))
 77                 return TX_DROP;                    76                 return TX_DROP;
 78                                                    77 
 79         mic = skb_put(skb, MICHAEL_MIC_LEN);   << 
 80                                                << 
 81         if (tx->key->conf.flags & IEEE80211_KE << 
 82                 /* Zeroed MIC can help with de << 
 83                 memset(mic, 0, MICHAEL_MIC_LEN << 
 84                 return TX_CONTINUE;            << 
 85         }                                      << 
 86                                                << 
 87         key = &tx->key->conf.key[NL80211_TKIP_     78         key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
                                                   >>  79         mic = skb_put(skb, MICHAEL_MIC_LEN);
 88         michael_mic(key, hdr, data, data_len,      80         michael_mic(key, hdr, data, data_len, mic);
 89         if (unlikely(info->flags & IEEE80211_T     81         if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
 90                 mic[0]++;                          82                 mic[0]++;
 91                                                    83 
 92         return TX_CONTINUE;                        84         return TX_CONTINUE;
 93 }                                                  85 }
 94                                                    86 
 95                                                    87 
 96 ieee80211_rx_result                                88 ieee80211_rx_result
 97 ieee80211_rx_h_michael_mic_verify(struct ieee8     89 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 98 {                                                  90 {
 99         u8 *data, *key = NULL;                     91         u8 *data, *key = NULL;
100         size_t data_len;                           92         size_t data_len;
101         unsigned int hdrlen;                       93         unsigned int hdrlen;
102         u8 mic[MICHAEL_MIC_LEN];                   94         u8 mic[MICHAEL_MIC_LEN];
103         struct sk_buff *skb = rx->skb;             95         struct sk_buff *skb = rx->skb;
104         struct ieee80211_rx_status *status = I     96         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
105         struct ieee80211_hdr *hdr = (struct ie     97         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
106                                                    98 
107         /*                                         99         /*
108          * it makes no sense to check for MIC     100          * it makes no sense to check for MIC errors on anything other
109          * than data frames.                      101          * than data frames.
110          */                                       102          */
111         if (!ieee80211_is_data_present(hdr->fr    103         if (!ieee80211_is_data_present(hdr->frame_control))
112                 return RX_CONTINUE;               104                 return RX_CONTINUE;
113                                                   105 
114         /*                                        106         /*
115          * No way to verify the MIC if the har    107          * No way to verify the MIC if the hardware stripped it or
116          * the IV with the key index. In this     108          * the IV with the key index. In this case we have solely rely
117          * on the driver to set RX_FLAG_MMIC_E    109          * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
118          * MIC failure report.                    110          * MIC failure report.
119          */                                       111          */
120         if (status->flag & (RX_FLAG_MMIC_STRIP    112         if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
121                 if (status->flag & RX_FLAG_MMI    113                 if (status->flag & RX_FLAG_MMIC_ERROR)
122                         goto mic_fail_no_key;     114                         goto mic_fail_no_key;
123                                                   115 
124                 if (!(status->flag & RX_FLAG_I    116                 if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
125                     rx->key->conf.cipher == WL    117                     rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
126                         goto update_iv;           118                         goto update_iv;
127                                                   119 
128                 return RX_CONTINUE;               120                 return RX_CONTINUE;
129         }                                         121         }
130                                                   122 
131         /*                                        123         /*
132          * Some hardware seems to generate Mic    124          * Some hardware seems to generate Michael MIC failure reports; even
133          * though, the frame was not encrypted    125          * though, the frame was not encrypted with TKIP and therefore has no
134          * MIC. Ignore the flag them to avoid     126          * MIC. Ignore the flag them to avoid triggering countermeasures.
135          */                                       127          */
136         if (!rx->key || rx->key->conf.cipher !    128         if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
137             !(status->flag & RX_FLAG_DECRYPTED    129             !(status->flag & RX_FLAG_DECRYPTED))
138                 return RX_CONTINUE;               130                 return RX_CONTINUE;
139                                                   131 
140         if (rx->sdata->vif.type == NL80211_IFT    132         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
141                 /*                                133                 /*
142                  * APs with pairwise keys shou    134                  * APs with pairwise keys should never receive Michael MIC
143                  * errors for non-zero keyidx     135                  * errors for non-zero keyidx because these are reserved for
144                  * group keys and only the AP     136                  * group keys and only the AP is sending real multicast
145                  * frames in the BSS.             137                  * frames in the BSS.
146                  */                               138                  */
147                 return RX_DROP_UNUSABLE;          139                 return RX_DROP_UNUSABLE;
148         }                                         140         }
149                                                   141 
150         if (status->flag & RX_FLAG_MMIC_ERROR)    142         if (status->flag & RX_FLAG_MMIC_ERROR)
151                 goto mic_fail;                    143                 goto mic_fail;
152                                                   144 
153         hdrlen = ieee80211_hdrlen(hdr->frame_c    145         hdrlen = ieee80211_hdrlen(hdr->frame_control);
154         if (skb->len < hdrlen + MICHAEL_MIC_LE    146         if (skb->len < hdrlen + MICHAEL_MIC_LEN)
155                 return RX_DROP_UNUSABLE;          147                 return RX_DROP_UNUSABLE;
156                                                   148 
157         if (skb_linearize(rx->skb))               149         if (skb_linearize(rx->skb))
158                 return RX_DROP_UNUSABLE;          150                 return RX_DROP_UNUSABLE;
159         hdr = (void *)skb->data;                  151         hdr = (void *)skb->data;
160                                                   152 
161         data = skb->data + hdrlen;                153         data = skb->data + hdrlen;
162         data_len = skb->len - hdrlen - MICHAEL    154         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
163         key = &rx->key->conf.key[NL80211_TKIP_    155         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
164         michael_mic(key, hdr, data, data_len,     156         michael_mic(key, hdr, data, data_len, mic);
165         if (crypto_memneq(mic, data + data_len    157         if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
166                 goto mic_fail;                    158                 goto mic_fail;
167                                                   159 
168         /* remove Michael MIC from payload */     160         /* remove Michael MIC from payload */
169         skb_trim(skb, skb->len - MICHAEL_MIC_L    161         skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
170                                                   162 
171 update_iv:                                        163 update_iv:
172         /* update IV in key information to be     164         /* update IV in key information to be able to detect replays */
173         rx->key->u.tkip.rx[rx->security_idx].i    165         rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
174         rx->key->u.tkip.rx[rx->security_idx].i    166         rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
175                                                   167 
176         return RX_CONTINUE;                       168         return RX_CONTINUE;
177                                                   169 
178 mic_fail:                                         170 mic_fail:
179         rx->key->u.tkip.mic_failures++;           171         rx->key->u.tkip.mic_failures++;
180                                                   172 
181 mic_fail_no_key:                                  173 mic_fail_no_key:
182         /*                                        174         /*
183          * In some cases the key can be unset     175          * In some cases the key can be unset - e.g. a multicast packet, in
184          * a driver that supports HW encryptio    176          * a driver that supports HW encryption. Send up the key idx only if
185          * the key is set.                        177          * the key is set.
186          */                                       178          */
187         cfg80211_michael_mic_failure(rx->sdata    179         cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
188                                      is_multic    180                                      is_multicast_ether_addr(hdr->addr1) ?
189                                      NL80211_K    181                                      NL80211_KEYTYPE_GROUP :
190                                      NL80211_K    182                                      NL80211_KEYTYPE_PAIRWISE,
191                                      rx->key ?    183                                      rx->key ? rx->key->conf.keyidx : -1,
192                                      NULL, GFP    184                                      NULL, GFP_ATOMIC);
193         return RX_DROP_UNUSABLE;                  185         return RX_DROP_UNUSABLE;
194 }                                                 186 }
195                                                   187 
196 static int tkip_encrypt_skb(struct ieee80211_t    188 static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
197 {                                                 189 {
198         struct ieee80211_hdr *hdr = (struct ie    190         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
199         struct ieee80211_key *key = tx->key;      191         struct ieee80211_key *key = tx->key;
200         struct ieee80211_tx_info *info = IEEE8    192         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
201         unsigned int hdrlen;                      193         unsigned int hdrlen;
202         int len, tail;                            194         int len, tail;
203         u64 pn;                                   195         u64 pn;
204         u8 *pos;                                  196         u8 *pos;
205                                                   197 
206         if (info->control.hw_key &&               198         if (info->control.hw_key &&
207             !(info->control.hw_key->flags & IE    199             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
208             !(info->control.hw_key->flags & IE    200             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
209                 /* hwaccel - with no need for     201                 /* hwaccel - with no need for software-generated IV */
210                 return 0;                         202                 return 0;
211         }                                         203         }
212                                                   204 
213         hdrlen = ieee80211_hdrlen(hdr->frame_c    205         hdrlen = ieee80211_hdrlen(hdr->frame_control);
214         len = skb->len - hdrlen;                  206         len = skb->len - hdrlen;
215                                                   207 
216         if (info->control.hw_key)                 208         if (info->control.hw_key)
217                 tail = 0;                         209                 tail = 0;
218         else                                      210         else
219                 tail = IEEE80211_TKIP_ICV_LEN;    211                 tail = IEEE80211_TKIP_ICV_LEN;
220                                                   212 
221         if (WARN_ON(skb_tailroom(skb) < tail |    213         if (WARN_ON(skb_tailroom(skb) < tail ||
222                     skb_headroom(skb) < IEEE80    214                     skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
223                 return -1;                        215                 return -1;
224                                                   216 
225         pos = skb_push(skb, IEEE80211_TKIP_IV_    217         pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
226         memmove(pos, pos + IEEE80211_TKIP_IV_L    218         memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
227         pos += hdrlen;                            219         pos += hdrlen;
228                                                   220 
229         /* the HW only needs room for the IV,     221         /* the HW only needs room for the IV, but not the actual IV */
230         if (info->control.hw_key &&               222         if (info->control.hw_key &&
231             (info->control.hw_key->flags & IEE    223             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
232                 return 0;                         224                 return 0;
233                                                   225 
234         /* Increase IV for the frame */           226         /* Increase IV for the frame */
235         pn = atomic64_inc_return(&key->conf.tx    227         pn = atomic64_inc_return(&key->conf.tx_pn);
236         pos = ieee80211_tkip_add_iv(pos, &key-    228         pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
237                                                   229 
238         /* hwaccel - with software IV */          230         /* hwaccel - with software IV */
239         if (info->control.hw_key)                 231         if (info->control.hw_key)
240                 return 0;                         232                 return 0;
241                                                   233 
242         /* Add room for ICV */                    234         /* Add room for ICV */
243         skb_put(skb, IEEE80211_TKIP_ICV_LEN);     235         skb_put(skb, IEEE80211_TKIP_ICV_LEN);
244                                                   236 
245         return ieee80211_tkip_encrypt_data(tx-    237         return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
246                                            key    238                                            key, skb, pos, len);
247 }                                                 239 }
248                                                   240 
249                                                   241 
250 ieee80211_tx_result                               242 ieee80211_tx_result
251 ieee80211_crypto_tkip_encrypt(struct ieee80211    243 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
252 {                                                 244 {
253         struct sk_buff *skb;                      245         struct sk_buff *skb;
254                                                   246 
255         ieee80211_tx_set_protected(tx);           247         ieee80211_tx_set_protected(tx);
256                                                   248 
257         skb_queue_walk(&tx->skbs, skb) {          249         skb_queue_walk(&tx->skbs, skb) {
258                 if (tkip_encrypt_skb(tx, skb)     250                 if (tkip_encrypt_skb(tx, skb) < 0)
259                         return TX_DROP;           251                         return TX_DROP;
260         }                                         252         }
261                                                   253 
262         return TX_CONTINUE;                       254         return TX_CONTINUE;
263 }                                                 255 }
264                                                   256 
265                                                   257 
266 ieee80211_rx_result                               258 ieee80211_rx_result
267 ieee80211_crypto_tkip_decrypt(struct ieee80211    259 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
268 {                                                 260 {
269         struct ieee80211_hdr *hdr = (struct ie    261         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
270         int hdrlen, res, hwaccel = 0;             262         int hdrlen, res, hwaccel = 0;
271         struct ieee80211_key *key = rx->key;      263         struct ieee80211_key *key = rx->key;
272         struct sk_buff *skb = rx->skb;            264         struct sk_buff *skb = rx->skb;
273         struct ieee80211_rx_status *status = I    265         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
274                                                   266 
275         hdrlen = ieee80211_hdrlen(hdr->frame_c    267         hdrlen = ieee80211_hdrlen(hdr->frame_control);
276                                                   268 
277         if (!ieee80211_is_data(hdr->frame_cont    269         if (!ieee80211_is_data(hdr->frame_control))
278                 return RX_CONTINUE;               270                 return RX_CONTINUE;
279                                                   271 
280         if (!rx->sta || skb->len - hdrlen < 12    272         if (!rx->sta || skb->len - hdrlen < 12)
281                 return RX_DROP_UNUSABLE;          273                 return RX_DROP_UNUSABLE;
282                                                   274 
283         /* it may be possible to optimize this    275         /* it may be possible to optimize this a bit more */
284         if (skb_linearize(rx->skb))               276         if (skb_linearize(rx->skb))
285                 return RX_DROP_UNUSABLE;          277                 return RX_DROP_UNUSABLE;
286         hdr = (void *)skb->data;                  278         hdr = (void *)skb->data;
287                                                   279 
288         /*                                        280         /*
289          * Let TKIP code verify IV, but skip d    281          * Let TKIP code verify IV, but skip decryption.
290          * In the case where hardware checks t    282          * In the case where hardware checks the IV as well,
291          * we don't even get here, see ieee802    283          * we don't even get here, see ieee80211_rx_h_decrypt()
292          */                                       284          */
293         if (status->flag & RX_FLAG_DECRYPTED)     285         if (status->flag & RX_FLAG_DECRYPTED)
294                 hwaccel = 1;                      286                 hwaccel = 1;
295                                                   287 
296         res = ieee80211_tkip_decrypt_data(rx->    288         res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
297                                           key,    289                                           key, skb->data + hdrlen,
298                                           skb-    290                                           skb->len - hdrlen, rx->sta->sta.addr,
299                                           hdr-    291                                           hdr->addr1, hwaccel, rx->security_idx,
300                                           &rx-    292                                           &rx->tkip_iv32,
301                                           &rx-    293                                           &rx->tkip_iv16);
302         if (res != TKIP_DECRYPT_OK)               294         if (res != TKIP_DECRYPT_OK)
303                 return RX_DROP_UNUSABLE;          295                 return RX_DROP_UNUSABLE;
304                                                   296 
305         /* Trim ICV */                            297         /* Trim ICV */
306         if (!(status->flag & RX_FLAG_ICV_STRIP    298         if (!(status->flag & RX_FLAG_ICV_STRIPPED))
307                 skb_trim(skb, skb->len - IEEE8    299                 skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
308                                                   300 
309         /* Remove IV */                           301         /* Remove IV */
310         memmove(skb->data + IEEE80211_TKIP_IV_    302         memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
311         skb_pull(skb, IEEE80211_TKIP_IV_LEN);     303         skb_pull(skb, IEEE80211_TKIP_IV_LEN);
312                                                   304 
313         return RX_CONTINUE;                       305         return RX_CONTINUE;
314 }                                                 306 }
315                                                   307 
316                                                   308 
317 static void ccmp_special_blocks(struct sk_buff    309 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
318 {                                                 310 {
319         __le16 mask_fc;                           311         __le16 mask_fc;
320         int a4_included, mgmt;                    312         int a4_included, mgmt;
321         u8 qos_tid;                               313         u8 qos_tid;
322         u16 len_a;                                314         u16 len_a;
323         unsigned int hdrlen;                      315         unsigned int hdrlen;
324         struct ieee80211_hdr *hdr = (struct ie    316         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
325                                                   317 
326         /*                                        318         /*
327          * Mask FC: zero subtype b4 b5 b6 (if     319          * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
328          * Retry, PwrMgt, MoreData; set Protec    320          * Retry, PwrMgt, MoreData; set Protected
329          */                                       321          */
330         mgmt = ieee80211_is_mgmt(hdr->frame_co    322         mgmt = ieee80211_is_mgmt(hdr->frame_control);
331         mask_fc = hdr->frame_control;             323         mask_fc = hdr->frame_control;
332         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    324         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
333                                 IEEE80211_FCTL    325                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
334         if (!mgmt)                                326         if (!mgmt)
335                 mask_fc &= ~cpu_to_le16(0x0070    327                 mask_fc &= ~cpu_to_le16(0x0070);
336         mask_fc |= cpu_to_le16(IEEE80211_FCTL_    328         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
337                                                   329 
338         hdrlen = ieee80211_hdrlen(hdr->frame_c    330         hdrlen = ieee80211_hdrlen(hdr->frame_control);
339         len_a = hdrlen - 2;                       331         len_a = hdrlen - 2;
340         a4_included = ieee80211_has_a4(hdr->fr    332         a4_included = ieee80211_has_a4(hdr->frame_control);
341                                                   333 
342         if (ieee80211_is_data_qos(hdr->frame_c    334         if (ieee80211_is_data_qos(hdr->frame_control))
343                 qos_tid = ieee80211_get_tid(hd !! 335                 qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
344         else                                      336         else
345                 qos_tid = 0;                      337                 qos_tid = 0;
346                                                   338 
347         /* In CCM, the initial vectors (IV) us    339         /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
348          * mode authentication are not allowed    340          * mode authentication are not allowed to collide, yet both are derived
349          * from this vector b_0. We only set L    341          * from this vector b_0. We only set L := 1 here to indicate that the
350          * data size can be represented in (L+    342          * data size can be represented in (L+1) bytes. The CCM layer will take
351          * care of storing the data length in     343          * care of storing the data length in the top (L+1) bytes and setting
352          * and clearing the other bits as is r    344          * and clearing the other bits as is required to derive the two IVs.
353          */                                       345          */
354         b_0[0] = 0x1;                             346         b_0[0] = 0x1;
355                                                   347 
356         /* Nonce: Nonce Flags | A2 | PN           348         /* Nonce: Nonce Flags | A2 | PN
357          * Nonce Flags: Priority (b0..b3) | Ma    349          * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
358          */                                       350          */
359         b_0[1] = qos_tid | (mgmt << 4);           351         b_0[1] = qos_tid | (mgmt << 4);
360         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);    352         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
361         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_    353         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
362                                                   354 
363         /* AAD (extra authenticate-only data)     355         /* AAD (extra authenticate-only data) / masked 802.11 header
364          * FC | A1 | A2 | A3 | SC | [A4] | [QC    356          * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
365         put_unaligned_be16(len_a, &aad[0]);       357         put_unaligned_be16(len_a, &aad[0]);
366         put_unaligned(mask_fc, (__le16 *)&aad[    358         put_unaligned(mask_fc, (__le16 *)&aad[2]);
367         memcpy(&aad[4], &hdr->addr1, 3 * ETH_A    359         memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
368                                                   360 
369         /* Mask Seq#, leave Frag# */              361         /* Mask Seq#, leave Frag# */
370         aad[22] = *((u8 *) &hdr->seq_ctrl) & 0    362         aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
371         aad[23] = 0;                              363         aad[23] = 0;
372                                                   364 
373         if (a4_included) {                        365         if (a4_included) {
374                 memcpy(&aad[24], hdr->addr4, E    366                 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
375                 aad[30] = qos_tid;                367                 aad[30] = qos_tid;
376                 aad[31] = 0;                      368                 aad[31] = 0;
377         } else {                                  369         } else {
378                 memset(&aad[24], 0, ETH_ALEN +    370                 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
379                 aad[24] = qos_tid;                371                 aad[24] = qos_tid;
380         }                                         372         }
381 }                                                 373 }
382                                                   374 
383                                                   375 
384 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn    376 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
385 {                                                 377 {
386         hdr[0] = pn[5];                           378         hdr[0] = pn[5];
387         hdr[1] = pn[4];                           379         hdr[1] = pn[4];
388         hdr[2] = 0;                               380         hdr[2] = 0;
389         hdr[3] = 0x20 | (key_id << 6);            381         hdr[3] = 0x20 | (key_id << 6);
390         hdr[4] = pn[3];                           382         hdr[4] = pn[3];
391         hdr[5] = pn[2];                           383         hdr[5] = pn[2];
392         hdr[6] = pn[1];                           384         hdr[6] = pn[1];
393         hdr[7] = pn[0];                           385         hdr[7] = pn[0];
394 }                                                 386 }
395                                                   387 
396                                                   388 
397 static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr    389 static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
398 {                                                 390 {
399         pn[0] = hdr[7];                           391         pn[0] = hdr[7];
400         pn[1] = hdr[6];                           392         pn[1] = hdr[6];
401         pn[2] = hdr[5];                           393         pn[2] = hdr[5];
402         pn[3] = hdr[4];                           394         pn[3] = hdr[4];
403         pn[4] = hdr[1];                           395         pn[4] = hdr[1];
404         pn[5] = hdr[0];                           396         pn[5] = hdr[0];
405 }                                                 397 }
406                                                   398 
407                                                   399 
408 static int ccmp_encrypt_skb(struct ieee80211_t    400 static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
409                             unsigned int mic_l    401                             unsigned int mic_len)
410 {                                                 402 {
411         struct ieee80211_hdr *hdr = (struct ie    403         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
412         struct ieee80211_key *key = tx->key;      404         struct ieee80211_key *key = tx->key;
413         struct ieee80211_tx_info *info = IEEE8    405         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
414         int hdrlen, len, tail;                    406         int hdrlen, len, tail;
415         u8 *pos;                                  407         u8 *pos;
416         u8 pn[6];                                 408         u8 pn[6];
417         u64 pn64;                                 409         u64 pn64;
418         u8 aad[CCM_AAD_LEN];                      410         u8 aad[CCM_AAD_LEN];
419         u8 b_0[AES_BLOCK_SIZE];                   411         u8 b_0[AES_BLOCK_SIZE];
420                                                   412 
421         if (info->control.hw_key &&               413         if (info->control.hw_key &&
422             !(info->control.hw_key->flags & IE    414             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
423             !(info->control.hw_key->flags & IE    415             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
424             !((info->control.hw_key->flags &      416             !((info->control.hw_key->flags &
425                IEEE80211_KEY_FLAG_GENERATE_IV_    417                IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
426               ieee80211_is_mgmt(hdr->frame_con    418               ieee80211_is_mgmt(hdr->frame_control))) {
427                 /*                                419                 /*
428                  * hwaccel has no need for pre    420                  * hwaccel has no need for preallocated room for CCMP
429                  * header or MIC fields           421                  * header or MIC fields
430                  */                               422                  */
431                 return 0;                         423                 return 0;
432         }                                         424         }
433                                                   425 
434         hdrlen = ieee80211_hdrlen(hdr->frame_c    426         hdrlen = ieee80211_hdrlen(hdr->frame_control);
435         len = skb->len - hdrlen;                  427         len = skb->len - hdrlen;
436                                                   428 
437         if (info->control.hw_key)                 429         if (info->control.hw_key)
438                 tail = 0;                         430                 tail = 0;
439         else                                      431         else
440                 tail = mic_len;                   432                 tail = mic_len;
441                                                   433 
442         if (WARN_ON(skb_tailroom(skb) < tail |    434         if (WARN_ON(skb_tailroom(skb) < tail ||
443                     skb_headroom(skb) < IEEE80    435                     skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
444                 return -1;                        436                 return -1;
445                                                   437 
446         pos = skb_push(skb, IEEE80211_CCMP_HDR    438         pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
447         memmove(pos, pos + IEEE80211_CCMP_HDR_    439         memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
448                                                   440 
449         /* the HW only needs room for the IV,     441         /* the HW only needs room for the IV, but not the actual IV */
450         if (info->control.hw_key &&               442         if (info->control.hw_key &&
451             (info->control.hw_key->flags & IEE    443             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
452                 return 0;                         444                 return 0;
453                                                   445 
454         hdr = (struct ieee80211_hdr *) pos;       446         hdr = (struct ieee80211_hdr *) pos;
455         pos += hdrlen;                            447         pos += hdrlen;
456                                                   448 
457         pn64 = atomic64_inc_return(&key->conf.    449         pn64 = atomic64_inc_return(&key->conf.tx_pn);
458                                                   450 
459         pn[5] = pn64;                             451         pn[5] = pn64;
460         pn[4] = pn64 >> 8;                        452         pn[4] = pn64 >> 8;
461         pn[3] = pn64 >> 16;                       453         pn[3] = pn64 >> 16;
462         pn[2] = pn64 >> 24;                       454         pn[2] = pn64 >> 24;
463         pn[1] = pn64 >> 32;                       455         pn[1] = pn64 >> 32;
464         pn[0] = pn64 >> 40;                       456         pn[0] = pn64 >> 40;
465                                                   457 
466         ccmp_pn2hdr(pos, pn, key->conf.keyidx)    458         ccmp_pn2hdr(pos, pn, key->conf.keyidx);
467                                                   459 
468         /* hwaccel - with software CCMP header    460         /* hwaccel - with software CCMP header */
469         if (info->control.hw_key)                 461         if (info->control.hw_key)
470                 return 0;                         462                 return 0;
471                                                   463 
472         pos += IEEE80211_CCMP_HDR_LEN;            464         pos += IEEE80211_CCMP_HDR_LEN;
473         ccmp_special_blocks(skb, pn, b_0, aad)    465         ccmp_special_blocks(skb, pn, b_0, aad);
474         return ieee80211_aes_ccm_encrypt(key->    466         return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
475                                          skb_p !! 467                                          skb_put(skb, mic_len), mic_len);
476 }                                                 468 }
477                                                   469 
478                                                   470 
479 ieee80211_tx_result                               471 ieee80211_tx_result
480 ieee80211_crypto_ccmp_encrypt(struct ieee80211    472 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
481                               unsigned int mic    473                               unsigned int mic_len)
482 {                                                 474 {
483         struct sk_buff *skb;                      475         struct sk_buff *skb;
484                                                   476 
485         ieee80211_tx_set_protected(tx);           477         ieee80211_tx_set_protected(tx);
486                                                   478 
487         skb_queue_walk(&tx->skbs, skb) {          479         skb_queue_walk(&tx->skbs, skb) {
488                 if (ccmp_encrypt_skb(tx, skb,     480                 if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
489                         return TX_DROP;           481                         return TX_DROP;
490         }                                         482         }
491                                                   483 
492         return TX_CONTINUE;                       484         return TX_CONTINUE;
493 }                                                 485 }
494                                                   486 
495                                                   487 
496 ieee80211_rx_result                               488 ieee80211_rx_result
497 ieee80211_crypto_ccmp_decrypt(struct ieee80211    489 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
498                               unsigned int mic    490                               unsigned int mic_len)
499 {                                                 491 {
500         struct ieee80211_hdr *hdr = (struct ie    492         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
501         int hdrlen;                               493         int hdrlen;
502         struct ieee80211_key *key = rx->key;      494         struct ieee80211_key *key = rx->key;
503         struct sk_buff *skb = rx->skb;            495         struct sk_buff *skb = rx->skb;
504         struct ieee80211_rx_status *status = I    496         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
505         u8 pn[IEEE80211_CCMP_PN_LEN];             497         u8 pn[IEEE80211_CCMP_PN_LEN];
506         int data_len;                             498         int data_len;
507         int queue;                                499         int queue;
508                                                   500 
509         hdrlen = ieee80211_hdrlen(hdr->frame_c    501         hdrlen = ieee80211_hdrlen(hdr->frame_control);
510                                                   502 
511         if (!ieee80211_is_data(hdr->frame_cont    503         if (!ieee80211_is_data(hdr->frame_control) &&
512             !ieee80211_is_robust_mgmt_frame(sk    504             !ieee80211_is_robust_mgmt_frame(skb))
513                 return RX_CONTINUE;               505                 return RX_CONTINUE;
514                                                   506 
515         if (status->flag & RX_FLAG_DECRYPTED)     507         if (status->flag & RX_FLAG_DECRYPTED) {
516                 if (!pskb_may_pull(rx->skb, hd    508                 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
517                         return RX_DROP_UNUSABL    509                         return RX_DROP_UNUSABLE;
518                 if (status->flag & RX_FLAG_MIC    510                 if (status->flag & RX_FLAG_MIC_STRIPPED)
519                         mic_len = 0;              511                         mic_len = 0;
520         } else {                                  512         } else {
521                 if (skb_linearize(rx->skb))       513                 if (skb_linearize(rx->skb))
522                         return RX_DROP_UNUSABL    514                         return RX_DROP_UNUSABLE;
523         }                                         515         }
524                                                   516 
525         data_len = skb->len - hdrlen - IEEE802    517         data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
526         if (!rx->sta || data_len < 0)             518         if (!rx->sta || data_len < 0)
527                 return RX_DROP_UNUSABLE;          519                 return RX_DROP_UNUSABLE;
528                                                   520 
529         if (!(status->flag & RX_FLAG_PN_VALIDA    521         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
530                 int res;                          522                 int res;
531                                                   523 
532                 ccmp_hdr2pn(pn, skb->data + hd    524                 ccmp_hdr2pn(pn, skb->data + hdrlen);
533                                                   525 
534                 queue = rx->security_idx;         526                 queue = rx->security_idx;
535                                                   527 
536                 res = memcmp(pn, key->u.ccmp.r    528                 res = memcmp(pn, key->u.ccmp.rx_pn[queue],
537                              IEEE80211_CCMP_PN    529                              IEEE80211_CCMP_PN_LEN);
538                 if (res < 0 ||                    530                 if (res < 0 ||
539                     (!res && !(status->flag &     531                     (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
540                         key->u.ccmp.replays++;    532                         key->u.ccmp.replays++;
541                         return RX_DROP_UNUSABL    533                         return RX_DROP_UNUSABLE;
542                 }                                 534                 }
543                                                   535 
544                 if (!(status->flag & RX_FLAG_D    536                 if (!(status->flag & RX_FLAG_DECRYPTED)) {
545                         u8 aad[2 * AES_BLOCK_S    537                         u8 aad[2 * AES_BLOCK_SIZE];
546                         u8 b_0[AES_BLOCK_SIZE]    538                         u8 b_0[AES_BLOCK_SIZE];
547                         /* hardware didn't dec    539                         /* hardware didn't decrypt/verify MIC */
548                         ccmp_special_blocks(sk    540                         ccmp_special_blocks(skb, pn, b_0, aad);
549                                                   541 
550                         if (ieee80211_aes_ccm_    542                         if (ieee80211_aes_ccm_decrypt(
551                                     key->u.ccm    543                                     key->u.ccmp.tfm, b_0, aad,
552                                     skb->data     544                                     skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
553                                     data_len,     545                                     data_len,
554                                     skb->data  !! 546                                     skb->data + skb->len - mic_len, mic_len))
555                                 return RX_DROP    547                                 return RX_DROP_UNUSABLE;
556                 }                                 548                 }
557                                                   549 
558                 memcpy(key->u.ccmp.rx_pn[queue    550                 memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
559         }                                         551         }
560                                                   552 
561         /* Remove CCMP header and MIC */          553         /* Remove CCMP header and MIC */
562         if (pskb_trim(skb, skb->len - mic_len)    554         if (pskb_trim(skb, skb->len - mic_len))
563                 return RX_DROP_UNUSABLE;          555                 return RX_DROP_UNUSABLE;
564         memmove(skb->data + IEEE80211_CCMP_HDR    556         memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
565         skb_pull(skb, IEEE80211_CCMP_HDR_LEN);    557         skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
566                                                   558 
567         return RX_CONTINUE;                       559         return RX_CONTINUE;
568 }                                                 560 }
569                                                   561 
570 static void gcmp_special_blocks(struct sk_buff    562 static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
571 {                                                 563 {
572         __le16 mask_fc;                           564         __le16 mask_fc;
573         u8 qos_tid;                               565         u8 qos_tid;
574         struct ieee80211_hdr *hdr = (struct ie    566         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
575                                                   567 
576         memcpy(j_0, hdr->addr2, ETH_ALEN);        568         memcpy(j_0, hdr->addr2, ETH_ALEN);
577         memcpy(&j_0[ETH_ALEN], pn, IEEE80211_G    569         memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
578         j_0[13] = 0;                              570         j_0[13] = 0;
579         j_0[14] = 0;                              571         j_0[14] = 0;
580         j_0[AES_BLOCK_SIZE - 1] = 0x01;           572         j_0[AES_BLOCK_SIZE - 1] = 0x01;
581                                                   573 
582         /* AAD (extra authenticate-only data)     574         /* AAD (extra authenticate-only data) / masked 802.11 header
583          * FC | A1 | A2 | A3 | SC | [A4] | [QC    575          * FC | A1 | A2 | A3 | SC | [A4] | [QC]
584          */                                       576          */
585         put_unaligned_be16(ieee80211_hdrlen(hd    577         put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
586         /* Mask FC: zero subtype b4 b5 b6 (if     578         /* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
587          * Retry, PwrMgt, MoreData; set Protec    579          * Retry, PwrMgt, MoreData; set Protected
588          */                                       580          */
589         mask_fc = hdr->frame_control;             581         mask_fc = hdr->frame_control;
590         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    582         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
591                                 IEEE80211_FCTL    583                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
592         if (!ieee80211_is_mgmt(hdr->frame_cont    584         if (!ieee80211_is_mgmt(hdr->frame_control))
593                 mask_fc &= ~cpu_to_le16(0x0070    585                 mask_fc &= ~cpu_to_le16(0x0070);
594         mask_fc |= cpu_to_le16(IEEE80211_FCTL_    586         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
595                                                   587 
596         put_unaligned(mask_fc, (__le16 *)&aad[    588         put_unaligned(mask_fc, (__le16 *)&aad[2]);
597         memcpy(&aad[4], &hdr->addr1, 3 * ETH_A    589         memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
598                                                   590 
599         /* Mask Seq#, leave Frag# */              591         /* Mask Seq#, leave Frag# */
600         aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x    592         aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
601         aad[23] = 0;                              593         aad[23] = 0;
602                                                   594 
603         if (ieee80211_is_data_qos(hdr->frame_c    595         if (ieee80211_is_data_qos(hdr->frame_control))
604                 qos_tid = ieee80211_get_tid(hd !! 596                 qos_tid = *ieee80211_get_qos_ctl(hdr) &
                                                   >> 597                         IEEE80211_QOS_CTL_TID_MASK;
605         else                                      598         else
606                 qos_tid = 0;                      599                 qos_tid = 0;
607                                                   600 
608         if (ieee80211_has_a4(hdr->frame_contro    601         if (ieee80211_has_a4(hdr->frame_control)) {
609                 memcpy(&aad[24], hdr->addr4, E    602                 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
610                 aad[30] = qos_tid;                603                 aad[30] = qos_tid;
611                 aad[31] = 0;                      604                 aad[31] = 0;
612         } else {                                  605         } else {
613                 memset(&aad[24], 0, ETH_ALEN +    606                 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
614                 aad[24] = qos_tid;                607                 aad[24] = qos_tid;
615         }                                         608         }
616 }                                                 609 }
617                                                   610 
618 static inline void gcmp_pn2hdr(u8 *hdr, const     611 static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
619 {                                                 612 {
620         hdr[0] = pn[5];                           613         hdr[0] = pn[5];
621         hdr[1] = pn[4];                           614         hdr[1] = pn[4];
622         hdr[2] = 0;                               615         hdr[2] = 0;
623         hdr[3] = 0x20 | (key_id << 6);            616         hdr[3] = 0x20 | (key_id << 6);
624         hdr[4] = pn[3];                           617         hdr[4] = pn[3];
625         hdr[5] = pn[2];                           618         hdr[5] = pn[2];
626         hdr[6] = pn[1];                           619         hdr[6] = pn[1];
627         hdr[7] = pn[0];                           620         hdr[7] = pn[0];
628 }                                                 621 }
629                                                   622 
630 static inline void gcmp_hdr2pn(u8 *pn, const u    623 static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
631 {                                                 624 {
632         pn[0] = hdr[7];                           625         pn[0] = hdr[7];
633         pn[1] = hdr[6];                           626         pn[1] = hdr[6];
634         pn[2] = hdr[5];                           627         pn[2] = hdr[5];
635         pn[3] = hdr[4];                           628         pn[3] = hdr[4];
636         pn[4] = hdr[1];                           629         pn[4] = hdr[1];
637         pn[5] = hdr[0];                           630         pn[5] = hdr[0];
638 }                                                 631 }
639                                                   632 
640 static int gcmp_encrypt_skb(struct ieee80211_t    633 static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
641 {                                                 634 {
642         struct ieee80211_hdr *hdr = (struct ie    635         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
643         struct ieee80211_key *key = tx->key;      636         struct ieee80211_key *key = tx->key;
644         struct ieee80211_tx_info *info = IEEE8    637         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
645         int hdrlen, len, tail;                    638         int hdrlen, len, tail;
646         u8 *pos;                                  639         u8 *pos;
647         u8 pn[6];                                 640         u8 pn[6];
648         u64 pn64;                                 641         u64 pn64;
649         u8 aad[GCM_AAD_LEN];                      642         u8 aad[GCM_AAD_LEN];
650         u8 j_0[AES_BLOCK_SIZE];                   643         u8 j_0[AES_BLOCK_SIZE];
651                                                   644 
652         if (info->control.hw_key &&               645         if (info->control.hw_key &&
653             !(info->control.hw_key->flags & IE    646             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
654             !(info->control.hw_key->flags & IE    647             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
655             !((info->control.hw_key->flags &      648             !((info->control.hw_key->flags &
656                IEEE80211_KEY_FLAG_GENERATE_IV_    649                IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
657               ieee80211_is_mgmt(hdr->frame_con    650               ieee80211_is_mgmt(hdr->frame_control))) {
658                 /* hwaccel has no need for pre    651                 /* hwaccel has no need for preallocated room for GCMP
659                  * header or MIC fields           652                  * header or MIC fields
660                  */                               653                  */
661                 return 0;                         654                 return 0;
662         }                                         655         }
663                                                   656 
664         hdrlen = ieee80211_hdrlen(hdr->frame_c    657         hdrlen = ieee80211_hdrlen(hdr->frame_control);
665         len = skb->len - hdrlen;                  658         len = skb->len - hdrlen;
666                                                   659 
667         if (info->control.hw_key)                 660         if (info->control.hw_key)
668                 tail = 0;                         661                 tail = 0;
669         else                                      662         else
670                 tail = IEEE80211_GCMP_MIC_LEN;    663                 tail = IEEE80211_GCMP_MIC_LEN;
671                                                   664 
672         if (WARN_ON(skb_tailroom(skb) < tail |    665         if (WARN_ON(skb_tailroom(skb) < tail ||
673                     skb_headroom(skb) < IEEE80    666                     skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
674                 return -1;                        667                 return -1;
675                                                   668 
676         pos = skb_push(skb, IEEE80211_GCMP_HDR    669         pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
677         memmove(pos, pos + IEEE80211_GCMP_HDR_    670         memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
678         skb_set_network_header(skb, skb_networ    671         skb_set_network_header(skb, skb_network_offset(skb) +
679                                     IEEE80211_    672                                     IEEE80211_GCMP_HDR_LEN);
680                                                   673 
681         /* the HW only needs room for the IV,     674         /* the HW only needs room for the IV, but not the actual IV */
682         if (info->control.hw_key &&               675         if (info->control.hw_key &&
683             (info->control.hw_key->flags & IEE    676             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
684                 return 0;                         677                 return 0;
685                                                   678 
686         hdr = (struct ieee80211_hdr *)pos;        679         hdr = (struct ieee80211_hdr *)pos;
687         pos += hdrlen;                            680         pos += hdrlen;
688                                                   681 
689         pn64 = atomic64_inc_return(&key->conf.    682         pn64 = atomic64_inc_return(&key->conf.tx_pn);
690                                                   683 
691         pn[5] = pn64;                             684         pn[5] = pn64;
692         pn[4] = pn64 >> 8;                        685         pn[4] = pn64 >> 8;
693         pn[3] = pn64 >> 16;                       686         pn[3] = pn64 >> 16;
694         pn[2] = pn64 >> 24;                       687         pn[2] = pn64 >> 24;
695         pn[1] = pn64 >> 32;                       688         pn[1] = pn64 >> 32;
696         pn[0] = pn64 >> 40;                       689         pn[0] = pn64 >> 40;
697                                                   690 
698         gcmp_pn2hdr(pos, pn, key->conf.keyidx)    691         gcmp_pn2hdr(pos, pn, key->conf.keyidx);
699                                                   692 
700         /* hwaccel - with software GCMP header    693         /* hwaccel - with software GCMP header */
701         if (info->control.hw_key)                 694         if (info->control.hw_key)
702                 return 0;                         695                 return 0;
703                                                   696 
704         pos += IEEE80211_GCMP_HDR_LEN;            697         pos += IEEE80211_GCMP_HDR_LEN;
705         gcmp_special_blocks(skb, pn, j_0, aad)    698         gcmp_special_blocks(skb, pn, j_0, aad);
706         return ieee80211_aes_gcm_encrypt(key->    699         return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
707                                          skb_p    700                                          skb_put(skb, IEEE80211_GCMP_MIC_LEN));
708 }                                                 701 }
709                                                   702 
710 ieee80211_tx_result                               703 ieee80211_tx_result
711 ieee80211_crypto_gcmp_encrypt(struct ieee80211    704 ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
712 {                                                 705 {
713         struct sk_buff *skb;                      706         struct sk_buff *skb;
714                                                   707 
715         ieee80211_tx_set_protected(tx);           708         ieee80211_tx_set_protected(tx);
716                                                   709 
717         skb_queue_walk(&tx->skbs, skb) {          710         skb_queue_walk(&tx->skbs, skb) {
718                 if (gcmp_encrypt_skb(tx, skb)     711                 if (gcmp_encrypt_skb(tx, skb) < 0)
719                         return TX_DROP;           712                         return TX_DROP;
720         }                                         713         }
721                                                   714 
722         return TX_CONTINUE;                       715         return TX_CONTINUE;
723 }                                                 716 }
724                                                   717 
725 ieee80211_rx_result                               718 ieee80211_rx_result
726 ieee80211_crypto_gcmp_decrypt(struct ieee80211    719 ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
727 {                                                 720 {
728         struct ieee80211_hdr *hdr = (struct ie    721         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
729         int hdrlen;                               722         int hdrlen;
730         struct ieee80211_key *key = rx->key;      723         struct ieee80211_key *key = rx->key;
731         struct sk_buff *skb = rx->skb;            724         struct sk_buff *skb = rx->skb;
732         struct ieee80211_rx_status *status = I    725         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
733         u8 pn[IEEE80211_GCMP_PN_LEN];             726         u8 pn[IEEE80211_GCMP_PN_LEN];
734         int data_len, queue, mic_len = IEEE802    727         int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
735                                                   728 
736         hdrlen = ieee80211_hdrlen(hdr->frame_c    729         hdrlen = ieee80211_hdrlen(hdr->frame_control);
737                                                   730 
738         if (!ieee80211_is_data(hdr->frame_cont    731         if (!ieee80211_is_data(hdr->frame_control) &&
739             !ieee80211_is_robust_mgmt_frame(sk    732             !ieee80211_is_robust_mgmt_frame(skb))
740                 return RX_CONTINUE;               733                 return RX_CONTINUE;
741                                                   734 
742         if (status->flag & RX_FLAG_DECRYPTED)     735         if (status->flag & RX_FLAG_DECRYPTED) {
743                 if (!pskb_may_pull(rx->skb, hd    736                 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
744                         return RX_DROP_UNUSABL    737                         return RX_DROP_UNUSABLE;
745                 if (status->flag & RX_FLAG_MIC    738                 if (status->flag & RX_FLAG_MIC_STRIPPED)
746                         mic_len = 0;              739                         mic_len = 0;
747         } else {                                  740         } else {
748                 if (skb_linearize(rx->skb))       741                 if (skb_linearize(rx->skb))
749                         return RX_DROP_UNUSABL    742                         return RX_DROP_UNUSABLE;
750         }                                         743         }
751                                                   744 
752         data_len = skb->len - hdrlen - IEEE802    745         data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
753         if (!rx->sta || data_len < 0)             746         if (!rx->sta || data_len < 0)
754                 return RX_DROP_UNUSABLE;          747                 return RX_DROP_UNUSABLE;
755                                                   748 
756         if (!(status->flag & RX_FLAG_PN_VALIDA    749         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
757                 int res;                          750                 int res;
758                                                   751 
759                 gcmp_hdr2pn(pn, skb->data + hd    752                 gcmp_hdr2pn(pn, skb->data + hdrlen);
760                                                   753 
761                 queue = rx->security_idx;         754                 queue = rx->security_idx;
762                                                   755 
763                 res = memcmp(pn, key->u.gcmp.r    756                 res = memcmp(pn, key->u.gcmp.rx_pn[queue],
764                              IEEE80211_GCMP_PN    757                              IEEE80211_GCMP_PN_LEN);
765                 if (res < 0 ||                    758                 if (res < 0 ||
766                     (!res && !(status->flag &     759                     (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
767                         key->u.gcmp.replays++;    760                         key->u.gcmp.replays++;
768                         return RX_DROP_UNUSABL    761                         return RX_DROP_UNUSABLE;
769                 }                                 762                 }
770                                                   763 
771                 if (!(status->flag & RX_FLAG_D    764                 if (!(status->flag & RX_FLAG_DECRYPTED)) {
772                         u8 aad[2 * AES_BLOCK_S    765                         u8 aad[2 * AES_BLOCK_SIZE];
773                         u8 j_0[AES_BLOCK_SIZE]    766                         u8 j_0[AES_BLOCK_SIZE];
774                         /* hardware didn't dec    767                         /* hardware didn't decrypt/verify MIC */
775                         gcmp_special_blocks(sk    768                         gcmp_special_blocks(skb, pn, j_0, aad);
776                                                   769 
777                         if (ieee80211_aes_gcm_    770                         if (ieee80211_aes_gcm_decrypt(
778                                     key->u.gcm    771                                     key->u.gcmp.tfm, j_0, aad,
779                                     skb->data     772                                     skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
780                                     data_len,     773                                     data_len,
781                                     skb->data     774                                     skb->data + skb->len -
782                                     IEEE80211_    775                                     IEEE80211_GCMP_MIC_LEN))
783                                 return RX_DROP    776                                 return RX_DROP_UNUSABLE;
784                 }                                 777                 }
785                                                   778 
786                 memcpy(key->u.gcmp.rx_pn[queue    779                 memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
787         }                                         780         }
788                                                   781 
789         /* Remove GCMP header and MIC */          782         /* Remove GCMP header and MIC */
790         if (pskb_trim(skb, skb->len - mic_len)    783         if (pskb_trim(skb, skb->len - mic_len))
791                 return RX_DROP_UNUSABLE;          784                 return RX_DROP_UNUSABLE;
792         memmove(skb->data + IEEE80211_GCMP_HDR    785         memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
793         skb_pull(skb, IEEE80211_GCMP_HDR_LEN);    786         skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
794                                                   787 
795         return RX_CONTINUE;                       788         return RX_CONTINUE;
796 }                                                 789 }
797                                                   790 
798 static ieee80211_tx_result                        791 static ieee80211_tx_result
799 ieee80211_crypto_cs_encrypt(struct ieee80211_t    792 ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
800                             struct sk_buff *sk    793                             struct sk_buff *skb)
801 {                                                 794 {
802         struct ieee80211_hdr *hdr = (struct ie    795         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
803         struct ieee80211_key *key = tx->key;      796         struct ieee80211_key *key = tx->key;
804         struct ieee80211_tx_info *info = IEEE8    797         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
805         int hdrlen;                               798         int hdrlen;
806         u8 *pos, iv_len = key->conf.iv_len;       799         u8 *pos, iv_len = key->conf.iv_len;
807                                                   800 
808         if (info->control.hw_key &&               801         if (info->control.hw_key &&
809             !(info->control.hw_key->flags & IE    802             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
810                 /* hwaccel has no need for pre    803                 /* hwaccel has no need for preallocated head room */
811                 return TX_CONTINUE;               804                 return TX_CONTINUE;
812         }                                         805         }
813                                                   806 
814         if (unlikely(skb_headroom(skb) < iv_le    807         if (unlikely(skb_headroom(skb) < iv_len &&
815                      pskb_expand_head(skb, iv_    808                      pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
816                 return TX_DROP;                   809                 return TX_DROP;
817                                                   810 
818         hdrlen = ieee80211_hdrlen(hdr->frame_c    811         hdrlen = ieee80211_hdrlen(hdr->frame_control);
819                                                   812 
820         pos = skb_push(skb, iv_len);              813         pos = skb_push(skb, iv_len);
821         memmove(pos, pos + iv_len, hdrlen);       814         memmove(pos, pos + iv_len, hdrlen);
822                                                   815 
823         return TX_CONTINUE;                       816         return TX_CONTINUE;
824 }                                                 817 }
825                                                   818 
826 static inline int ieee80211_crypto_cs_pn_compa    819 static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
827 {                                                 820 {
828         int i;                                    821         int i;
829                                                   822 
830         /* pn is little endian */                 823         /* pn is little endian */
831         for (i = len - 1; i >= 0; i--) {          824         for (i = len - 1; i >= 0; i--) {
832                 if (pn1[i] < pn2[i])              825                 if (pn1[i] < pn2[i])
833                         return -1;                826                         return -1;
834                 else if (pn1[i] > pn2[i])         827                 else if (pn1[i] > pn2[i])
835                         return 1;                 828                         return 1;
836         }                                         829         }
837                                                   830 
838         return 0;                                 831         return 0;
839 }                                                 832 }
840                                                   833 
841 static ieee80211_rx_result                        834 static ieee80211_rx_result
842 ieee80211_crypto_cs_decrypt(struct ieee80211_r    835 ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
843 {                                                 836 {
844         struct ieee80211_key *key = rx->key;      837         struct ieee80211_key *key = rx->key;
845         struct ieee80211_hdr *hdr = (struct ie    838         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
846         const struct ieee80211_cipher_scheme *    839         const struct ieee80211_cipher_scheme *cs = NULL;
847         int hdrlen = ieee80211_hdrlen(hdr->fra    840         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
848         struct ieee80211_rx_status *status = I    841         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
849         int data_len;                             842         int data_len;
850         u8 *rx_pn;                                843         u8 *rx_pn;
851         u8 *skb_pn;                               844         u8 *skb_pn;
852         u8 qos_tid;                               845         u8 qos_tid;
853                                                   846 
854         if (!rx->sta || !rx->sta->cipher_schem    847         if (!rx->sta || !rx->sta->cipher_scheme ||
855             !(status->flag & RX_FLAG_DECRYPTED    848             !(status->flag & RX_FLAG_DECRYPTED))
856                 return RX_DROP_UNUSABLE;          849                 return RX_DROP_UNUSABLE;
857                                                   850 
858         if (!ieee80211_is_data(hdr->frame_cont    851         if (!ieee80211_is_data(hdr->frame_control))
859                 return RX_CONTINUE;               852                 return RX_CONTINUE;
860                                                   853 
861         cs = rx->sta->cipher_scheme;              854         cs = rx->sta->cipher_scheme;
862                                                   855 
863         data_len = rx->skb->len - hdrlen - cs-    856         data_len = rx->skb->len - hdrlen - cs->hdr_len;
864                                                   857 
865         if (data_len < 0)                         858         if (data_len < 0)
866                 return RX_DROP_UNUSABLE;          859                 return RX_DROP_UNUSABLE;
867                                                   860 
868         if (ieee80211_is_data_qos(hdr->frame_c    861         if (ieee80211_is_data_qos(hdr->frame_control))
869                 qos_tid = ieee80211_get_tid(hd !! 862                 qos_tid = *ieee80211_get_qos_ctl(hdr) &
                                                   >> 863                                 IEEE80211_QOS_CTL_TID_MASK;
870         else                                      864         else
871                 qos_tid = 0;                      865                 qos_tid = 0;
872                                                   866 
873         if (skb_linearize(rx->skb))               867         if (skb_linearize(rx->skb))
874                 return RX_DROP_UNUSABLE;          868                 return RX_DROP_UNUSABLE;
875                                                   869 
876         hdr = (struct ieee80211_hdr *)rx->skb-    870         hdr = (struct ieee80211_hdr *)rx->skb->data;
877                                                   871 
878         rx_pn = key->u.gen.rx_pn[qos_tid];        872         rx_pn = key->u.gen.rx_pn[qos_tid];
879         skb_pn = rx->skb->data + hdrlen + cs->    873         skb_pn = rx->skb->data + hdrlen + cs->pn_off;
880                                                   874 
881         if (ieee80211_crypto_cs_pn_compare(skb    875         if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
882                 return RX_DROP_UNUSABLE;          876                 return RX_DROP_UNUSABLE;
883                                                   877 
884         memcpy(rx_pn, skb_pn, cs->pn_len);        878         memcpy(rx_pn, skb_pn, cs->pn_len);
885                                                   879 
886         /* remove security header and MIC */      880         /* remove security header and MIC */
887         if (pskb_trim(rx->skb, rx->skb->len -     881         if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
888                 return RX_DROP_UNUSABLE;          882                 return RX_DROP_UNUSABLE;
889                                                   883 
890         memmove(rx->skb->data + cs->hdr_len, r    884         memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
891         skb_pull(rx->skb, cs->hdr_len);           885         skb_pull(rx->skb, cs->hdr_len);
892                                                   886 
893         return RX_CONTINUE;                       887         return RX_CONTINUE;
894 }                                                 888 }
895                                                   889 
896 static void bip_aad(struct sk_buff *skb, u8 *a    890 static void bip_aad(struct sk_buff *skb, u8 *aad)
897 {                                                 891 {
898         __le16 mask_fc;                           892         __le16 mask_fc;
899         struct ieee80211_hdr *hdr = (struct ie    893         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
900                                                   894 
901         /* BIP AAD: FC(masked) || A1 || A2 ||     895         /* BIP AAD: FC(masked) || A1 || A2 || A3 */
902                                                   896 
903         /* FC type/subtype */                     897         /* FC type/subtype */
904         /* Mask FC Retry, PwrMgt, MoreData fla    898         /* Mask FC Retry, PwrMgt, MoreData flags to zero */
905         mask_fc = hdr->frame_control;             899         mask_fc = hdr->frame_control;
906         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    900         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
907                                 IEEE80211_FCTL    901                                 IEEE80211_FCTL_MOREDATA);
908         put_unaligned(mask_fc, (__le16 *) &aad    902         put_unaligned(mask_fc, (__le16 *) &aad[0]);
909         /* A1 || A2 || A3 */                      903         /* A1 || A2 || A3 */
910         memcpy(aad + 2, &hdr->addr1, 3 * ETH_A    904         memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
911 }                                                 905 }
912                                                   906 
913                                                   907 
914 static inline void bip_ipn_set64(u8 *d, u64 pn    908 static inline void bip_ipn_set64(u8 *d, u64 pn)
915 {                                                 909 {
916         *d++ = pn;                                910         *d++ = pn;
917         *d++ = pn >> 8;                           911         *d++ = pn >> 8;
918         *d++ = pn >> 16;                          912         *d++ = pn >> 16;
919         *d++ = pn >> 24;                          913         *d++ = pn >> 24;
920         *d++ = pn >> 32;                          914         *d++ = pn >> 32;
921         *d = pn >> 40;                            915         *d = pn >> 40;
922 }                                                 916 }
923                                                   917 
924 static inline void bip_ipn_swap(u8 *d, const u    918 static inline void bip_ipn_swap(u8 *d, const u8 *s)
925 {                                                 919 {
926         *d++ = s[5];                              920         *d++ = s[5];
927         *d++ = s[4];                              921         *d++ = s[4];
928         *d++ = s[3];                              922         *d++ = s[3];
929         *d++ = s[2];                              923         *d++ = s[2];
930         *d++ = s[1];                              924         *d++ = s[1];
931         *d = s[0];                                925         *d = s[0];
932 }                                                 926 }
933                                                   927 
934                                                   928 
935 ieee80211_tx_result                               929 ieee80211_tx_result
936 ieee80211_crypto_aes_cmac_encrypt(struct ieee8    930 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
937 {                                                 931 {
938         struct sk_buff *skb;                      932         struct sk_buff *skb;
939         struct ieee80211_tx_info *info;           933         struct ieee80211_tx_info *info;
940         struct ieee80211_key *key = tx->key;      934         struct ieee80211_key *key = tx->key;
941         struct ieee80211_mmie *mmie;              935         struct ieee80211_mmie *mmie;
942         u8 aad[20];                               936         u8 aad[20];
943         u64 pn64;                                 937         u64 pn64;
944                                                   938 
945         if (WARN_ON(skb_queue_len(&tx->skbs) !    939         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
946                 return TX_DROP;                   940                 return TX_DROP;
947                                                   941 
948         skb = skb_peek(&tx->skbs);                942         skb = skb_peek(&tx->skbs);
949                                                   943 
950         info = IEEE80211_SKB_CB(skb);             944         info = IEEE80211_SKB_CB(skb);
951                                                   945 
952         if (info->control.hw_key)                 946         if (info->control.hw_key)
953                 return TX_CONTINUE;               947                 return TX_CONTINUE;
954                                                   948 
955         if (WARN_ON(skb_tailroom(skb) < sizeof    949         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
956                 return TX_DROP;                   950                 return TX_DROP;
957                                                   951 
958         mmie = skb_put(skb, sizeof(*mmie));       952         mmie = skb_put(skb, sizeof(*mmie));
959         mmie->element_id = WLAN_EID_MMIE;         953         mmie->element_id = WLAN_EID_MMIE;
960         mmie->length = sizeof(*mmie) - 2;         954         mmie->length = sizeof(*mmie) - 2;
961         mmie->key_id = cpu_to_le16(key->conf.k    955         mmie->key_id = cpu_to_le16(key->conf.keyidx);
962                                                   956 
963         /* PN = PN + 1 */                         957         /* PN = PN + 1 */
964         pn64 = atomic64_inc_return(&key->conf.    958         pn64 = atomic64_inc_return(&key->conf.tx_pn);
965                                                   959 
966         bip_ipn_set64(mmie->sequence_number, p    960         bip_ipn_set64(mmie->sequence_number, pn64);
967                                                   961 
968         bip_aad(skb, aad);                        962         bip_aad(skb, aad);
969                                                   963 
970         /*                                        964         /*
971          * MIC = AES-128-CMAC(IGTK, AAD || Man    965          * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
972          */                                       966          */
973         ieee80211_aes_cmac(key->u.aes_cmac.tfm    967         ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
974                            skb->data + 24, skb    968                            skb->data + 24, skb->len - 24, mmie->mic);
975                                                   969 
976         return TX_CONTINUE;                       970         return TX_CONTINUE;
977 }                                                 971 }
978                                                   972 
979 ieee80211_tx_result                               973 ieee80211_tx_result
980 ieee80211_crypto_aes_cmac_256_encrypt(struct i    974 ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
981 {                                                 975 {
982         struct sk_buff *skb;                      976         struct sk_buff *skb;
983         struct ieee80211_tx_info *info;           977         struct ieee80211_tx_info *info;
984         struct ieee80211_key *key = tx->key;      978         struct ieee80211_key *key = tx->key;
985         struct ieee80211_mmie_16 *mmie;           979         struct ieee80211_mmie_16 *mmie;
986         u8 aad[20];                               980         u8 aad[20];
987         u64 pn64;                                 981         u64 pn64;
988                                                   982 
989         if (WARN_ON(skb_queue_len(&tx->skbs) !    983         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
990                 return TX_DROP;                   984                 return TX_DROP;
991                                                   985 
992         skb = skb_peek(&tx->skbs);                986         skb = skb_peek(&tx->skbs);
993                                                   987 
994         info = IEEE80211_SKB_CB(skb);             988         info = IEEE80211_SKB_CB(skb);
995                                                   989 
996         if (info->control.hw_key)                 990         if (info->control.hw_key)
997                 return TX_CONTINUE;               991                 return TX_CONTINUE;
998                                                   992 
999         if (WARN_ON(skb_tailroom(skb) < sizeof    993         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1000                 return TX_DROP;                  994                 return TX_DROP;
1001                                                  995 
1002         mmie = skb_put(skb, sizeof(*mmie));      996         mmie = skb_put(skb, sizeof(*mmie));
1003         mmie->element_id = WLAN_EID_MMIE;        997         mmie->element_id = WLAN_EID_MMIE;
1004         mmie->length = sizeof(*mmie) - 2;        998         mmie->length = sizeof(*mmie) - 2;
1005         mmie->key_id = cpu_to_le16(key->conf.    999         mmie->key_id = cpu_to_le16(key->conf.keyidx);
1006                                                  1000 
1007         /* PN = PN + 1 */                        1001         /* PN = PN + 1 */
1008         pn64 = atomic64_inc_return(&key->conf    1002         pn64 = atomic64_inc_return(&key->conf.tx_pn);
1009                                                  1003 
1010         bip_ipn_set64(mmie->sequence_number,     1004         bip_ipn_set64(mmie->sequence_number, pn64);
1011                                                  1005 
1012         bip_aad(skb, aad);                       1006         bip_aad(skb, aad);
1013                                                  1007 
1014         /* MIC = AES-256-CMAC(IGTK, AAD || Ma    1008         /* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
1015          */                                      1009          */
1016         ieee80211_aes_cmac_256(key->u.aes_cma    1010         ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1017                                skb->data + 24    1011                                skb->data + 24, skb->len - 24, mmie->mic);
1018                                                  1012 
1019         return TX_CONTINUE;                      1013         return TX_CONTINUE;
1020 }                                                1014 }
1021                                                  1015 
1022 ieee80211_rx_result                              1016 ieee80211_rx_result
1023 ieee80211_crypto_aes_cmac_decrypt(struct ieee    1017 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
1024 {                                                1018 {
1025         struct sk_buff *skb = rx->skb;           1019         struct sk_buff *skb = rx->skb;
1026         struct ieee80211_rx_status *status =     1020         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1027         struct ieee80211_key *key = rx->key;     1021         struct ieee80211_key *key = rx->key;
1028         struct ieee80211_mmie *mmie;             1022         struct ieee80211_mmie *mmie;
1029         u8 aad[20], mic[8], ipn[6];              1023         u8 aad[20], mic[8], ipn[6];
1030         struct ieee80211_hdr *hdr = (struct i    1024         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1031                                                  1025 
1032         if (!ieee80211_is_mgmt(hdr->frame_con    1026         if (!ieee80211_is_mgmt(hdr->frame_control))
1033                 return RX_CONTINUE;              1027                 return RX_CONTINUE;
1034                                                  1028 
1035         /* management frames are already line    1029         /* management frames are already linear */
1036                                                  1030 
1037         if (skb->len < 24 + sizeof(*mmie))       1031         if (skb->len < 24 + sizeof(*mmie))
1038                 return RX_DROP_UNUSABLE;         1032                 return RX_DROP_UNUSABLE;
1039                                                  1033 
1040         mmie = (struct ieee80211_mmie *)         1034         mmie = (struct ieee80211_mmie *)
1041                 (skb->data + skb->len - sizeo    1035                 (skb->data + skb->len - sizeof(*mmie));
1042         if (mmie->element_id != WLAN_EID_MMIE    1036         if (mmie->element_id != WLAN_EID_MMIE ||
1043             mmie->length != sizeof(*mmie) - 2    1037             mmie->length != sizeof(*mmie) - 2)
1044                 return RX_DROP_UNUSABLE; /* I    1038                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1045                                                  1039 
1046         bip_ipn_swap(ipn, mmie->sequence_numb    1040         bip_ipn_swap(ipn, mmie->sequence_number);
1047                                                  1041 
1048         if (memcmp(ipn, key->u.aes_cmac.rx_pn    1042         if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1049                 key->u.aes_cmac.replays++;       1043                 key->u.aes_cmac.replays++;
1050                 return RX_DROP_UNUSABLE;         1044                 return RX_DROP_UNUSABLE;
1051         }                                        1045         }
1052                                                  1046 
1053         if (!(status->flag & RX_FLAG_DECRYPTE    1047         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1054                 /* hardware didn't decrypt/ve    1048                 /* hardware didn't decrypt/verify MIC */
1055                 bip_aad(skb, aad);               1049                 bip_aad(skb, aad);
1056                 ieee80211_aes_cmac(key->u.aes    1050                 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
1057                                    skb->data     1051                                    skb->data + 24, skb->len - 24, mic);
1058                 if (crypto_memneq(mic, mmie->    1052                 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1059                         key->u.aes_cmac.icver    1053                         key->u.aes_cmac.icverrors++;
1060                         return RX_DROP_UNUSAB    1054                         return RX_DROP_UNUSABLE;
1061                 }                                1055                 }
1062         }                                        1056         }
1063                                                  1057 
1064         memcpy(key->u.aes_cmac.rx_pn, ipn, 6)    1058         memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1065                                                  1059 
1066         /* Remove MMIE */                        1060         /* Remove MMIE */
1067         skb_trim(skb, skb->len - sizeof(*mmie    1061         skb_trim(skb, skb->len - sizeof(*mmie));
1068                                                  1062 
1069         return RX_CONTINUE;                      1063         return RX_CONTINUE;
1070 }                                                1064 }
1071                                                  1065 
1072 ieee80211_rx_result                              1066 ieee80211_rx_result
1073 ieee80211_crypto_aes_cmac_256_decrypt(struct     1067 ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
1074 {                                                1068 {
1075         struct sk_buff *skb = rx->skb;           1069         struct sk_buff *skb = rx->skb;
1076         struct ieee80211_rx_status *status =     1070         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1077         struct ieee80211_key *key = rx->key;     1071         struct ieee80211_key *key = rx->key;
1078         struct ieee80211_mmie_16 *mmie;          1072         struct ieee80211_mmie_16 *mmie;
1079         u8 aad[20], mic[16], ipn[6];             1073         u8 aad[20], mic[16], ipn[6];
1080         struct ieee80211_hdr *hdr = (struct i    1074         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1081                                                  1075 
1082         if (!ieee80211_is_mgmt(hdr->frame_con    1076         if (!ieee80211_is_mgmt(hdr->frame_control))
1083                 return RX_CONTINUE;              1077                 return RX_CONTINUE;
1084                                                  1078 
1085         /* management frames are already line    1079         /* management frames are already linear */
1086                                                  1080 
1087         if (skb->len < 24 + sizeof(*mmie))       1081         if (skb->len < 24 + sizeof(*mmie))
1088                 return RX_DROP_UNUSABLE;         1082                 return RX_DROP_UNUSABLE;
1089                                                  1083 
1090         mmie = (struct ieee80211_mmie_16 *)      1084         mmie = (struct ieee80211_mmie_16 *)
1091                 (skb->data + skb->len - sizeo    1085                 (skb->data + skb->len - sizeof(*mmie));
1092         if (mmie->element_id != WLAN_EID_MMIE    1086         if (mmie->element_id != WLAN_EID_MMIE ||
1093             mmie->length != sizeof(*mmie) - 2    1087             mmie->length != sizeof(*mmie) - 2)
1094                 return RX_DROP_UNUSABLE; /* I    1088                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1095                                                  1089 
1096         bip_ipn_swap(ipn, mmie->sequence_numb    1090         bip_ipn_swap(ipn, mmie->sequence_number);
1097                                                  1091 
1098         if (memcmp(ipn, key->u.aes_cmac.rx_pn    1092         if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1099                 key->u.aes_cmac.replays++;       1093                 key->u.aes_cmac.replays++;
1100                 return RX_DROP_UNUSABLE;         1094                 return RX_DROP_UNUSABLE;
1101         }                                        1095         }
1102                                                  1096 
1103         if (!(status->flag & RX_FLAG_DECRYPTE    1097         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1104                 /* hardware didn't decrypt/ve    1098                 /* hardware didn't decrypt/verify MIC */
1105                 bip_aad(skb, aad);               1099                 bip_aad(skb, aad);
1106                 ieee80211_aes_cmac_256(key->u    1100                 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1107                                        skb->d    1101                                        skb->data + 24, skb->len - 24, mic);
1108                 if (crypto_memneq(mic, mmie->    1102                 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1109                         key->u.aes_cmac.icver    1103                         key->u.aes_cmac.icverrors++;
1110                         return RX_DROP_UNUSAB    1104                         return RX_DROP_UNUSABLE;
1111                 }                                1105                 }
1112         }                                        1106         }
1113                                                  1107 
1114         memcpy(key->u.aes_cmac.rx_pn, ipn, 6)    1108         memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1115                                                  1109 
1116         /* Remove MMIE */                        1110         /* Remove MMIE */
1117         skb_trim(skb, skb->len - sizeof(*mmie    1111         skb_trim(skb, skb->len - sizeof(*mmie));
1118                                                  1112 
1119         return RX_CONTINUE;                      1113         return RX_CONTINUE;
1120 }                                                1114 }
1121                                                  1115 
1122 ieee80211_tx_result                              1116 ieee80211_tx_result
1123 ieee80211_crypto_aes_gmac_encrypt(struct ieee    1117 ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
1124 {                                                1118 {
1125         struct sk_buff *skb;                     1119         struct sk_buff *skb;
1126         struct ieee80211_tx_info *info;          1120         struct ieee80211_tx_info *info;
1127         struct ieee80211_key *key = tx->key;     1121         struct ieee80211_key *key = tx->key;
1128         struct ieee80211_mmie_16 *mmie;          1122         struct ieee80211_mmie_16 *mmie;
1129         struct ieee80211_hdr *hdr;               1123         struct ieee80211_hdr *hdr;
1130         u8 aad[GMAC_AAD_LEN];                    1124         u8 aad[GMAC_AAD_LEN];
1131         u64 pn64;                                1125         u64 pn64;
1132         u8 nonce[GMAC_NONCE_LEN];                1126         u8 nonce[GMAC_NONCE_LEN];
1133                                                  1127 
1134         if (WARN_ON(skb_queue_len(&tx->skbs)     1128         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
1135                 return TX_DROP;                  1129                 return TX_DROP;
1136                                                  1130 
1137         skb = skb_peek(&tx->skbs);               1131         skb = skb_peek(&tx->skbs);
1138                                                  1132 
1139         info = IEEE80211_SKB_CB(skb);            1133         info = IEEE80211_SKB_CB(skb);
1140                                                  1134 
1141         if (info->control.hw_key)                1135         if (info->control.hw_key)
1142                 return TX_CONTINUE;              1136                 return TX_CONTINUE;
1143                                                  1137 
1144         if (WARN_ON(skb_tailroom(skb) < sizeo    1138         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1145                 return TX_DROP;                  1139                 return TX_DROP;
1146                                                  1140 
1147         mmie = skb_put(skb, sizeof(*mmie));      1141         mmie = skb_put(skb, sizeof(*mmie));
1148         mmie->element_id = WLAN_EID_MMIE;        1142         mmie->element_id = WLAN_EID_MMIE;
1149         mmie->length = sizeof(*mmie) - 2;        1143         mmie->length = sizeof(*mmie) - 2;
1150         mmie->key_id = cpu_to_le16(key->conf.    1144         mmie->key_id = cpu_to_le16(key->conf.keyidx);
1151                                                  1145 
1152         /* PN = PN + 1 */                        1146         /* PN = PN + 1 */
1153         pn64 = atomic64_inc_return(&key->conf    1147         pn64 = atomic64_inc_return(&key->conf.tx_pn);
1154                                                  1148 
1155         bip_ipn_set64(mmie->sequence_number,     1149         bip_ipn_set64(mmie->sequence_number, pn64);
1156                                                  1150 
1157         bip_aad(skb, aad);                       1151         bip_aad(skb, aad);
1158                                                  1152 
1159         hdr = (struct ieee80211_hdr *)skb->da    1153         hdr = (struct ieee80211_hdr *)skb->data;
1160         memcpy(nonce, hdr->addr2, ETH_ALEN);     1154         memcpy(nonce, hdr->addr2, ETH_ALEN);
1161         bip_ipn_swap(nonce + ETH_ALEN, mmie->    1155         bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
1162                                                  1156 
1163         /* MIC = AES-GMAC(IGTK, AAD || Manage    1157         /* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
1164         if (ieee80211_aes_gmac(key->u.aes_gma    1158         if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1165                                skb->data + 24    1159                                skb->data + 24, skb->len - 24, mmie->mic) < 0)
1166                 return TX_DROP;                  1160                 return TX_DROP;
1167                                                  1161 
1168         return TX_CONTINUE;                      1162         return TX_CONTINUE;
1169 }                                                1163 }
1170                                                  1164 
1171 ieee80211_rx_result                              1165 ieee80211_rx_result
1172 ieee80211_crypto_aes_gmac_decrypt(struct ieee    1166 ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
1173 {                                                1167 {
1174         struct sk_buff *skb = rx->skb;           1168         struct sk_buff *skb = rx->skb;
1175         struct ieee80211_rx_status *status =     1169         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1176         struct ieee80211_key *key = rx->key;     1170         struct ieee80211_key *key = rx->key;
1177         struct ieee80211_mmie_16 *mmie;          1171         struct ieee80211_mmie_16 *mmie;
1178         u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LE    1172         u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN];
1179         struct ieee80211_hdr *hdr = (struct i    1173         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1180                                                  1174 
1181         if (!ieee80211_is_mgmt(hdr->frame_con    1175         if (!ieee80211_is_mgmt(hdr->frame_control))
1182                 return RX_CONTINUE;              1176                 return RX_CONTINUE;
1183                                                  1177 
1184         /* management frames are already line    1178         /* management frames are already linear */
1185                                                  1179 
1186         if (skb->len < 24 + sizeof(*mmie))       1180         if (skb->len < 24 + sizeof(*mmie))
1187                 return RX_DROP_UNUSABLE;         1181                 return RX_DROP_UNUSABLE;
1188                                                  1182 
1189         mmie = (struct ieee80211_mmie_16 *)      1183         mmie = (struct ieee80211_mmie_16 *)
1190                 (skb->data + skb->len - sizeo    1184                 (skb->data + skb->len - sizeof(*mmie));
1191         if (mmie->element_id != WLAN_EID_MMIE    1185         if (mmie->element_id != WLAN_EID_MMIE ||
1192             mmie->length != sizeof(*mmie) - 2    1186             mmie->length != sizeof(*mmie) - 2)
1193                 return RX_DROP_UNUSABLE; /* I    1187                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1194                                                  1188 
1195         bip_ipn_swap(ipn, mmie->sequence_numb    1189         bip_ipn_swap(ipn, mmie->sequence_number);
1196                                                  1190 
1197         if (memcmp(ipn, key->u.aes_gmac.rx_pn    1191         if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
1198                 key->u.aes_gmac.replays++;       1192                 key->u.aes_gmac.replays++;
1199                 return RX_DROP_UNUSABLE;         1193                 return RX_DROP_UNUSABLE;
1200         }                                        1194         }
1201                                                  1195 
1202         if (!(status->flag & RX_FLAG_DECRYPTE    1196         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1203                 /* hardware didn't decrypt/ve    1197                 /* hardware didn't decrypt/verify MIC */
1204                 bip_aad(skb, aad);               1198                 bip_aad(skb, aad);
1205                                                  1199 
1206                 memcpy(nonce, hdr->addr2, ETH    1200                 memcpy(nonce, hdr->addr2, ETH_ALEN);
1207                 memcpy(nonce + ETH_ALEN, ipn,    1201                 memcpy(nonce + ETH_ALEN, ipn, 6);
1208                                                  1202 
1209                 if (ieee80211_aes_gmac(key->u    1203                 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1210                                        skb->d    1204                                        skb->data + 24, skb->len - 24,
1211                                        mic) <    1205                                        mic) < 0 ||
1212                     crypto_memneq(mic, mmie->    1206                     crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1213                         key->u.aes_gmac.icver    1207                         key->u.aes_gmac.icverrors++;
1214                         return RX_DROP_UNUSAB    1208                         return RX_DROP_UNUSABLE;
1215                 }                                1209                 }
1216         }                                        1210         }
1217                                                  1211 
1218         memcpy(key->u.aes_gmac.rx_pn, ipn, 6)    1212         memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
1219                                                  1213 
1220         /* Remove MMIE */                        1214         /* Remove MMIE */
1221         skb_trim(skb, skb->len - sizeof(*mmie    1215         skb_trim(skb, skb->len - sizeof(*mmie));
1222                                                  1216 
1223         return RX_CONTINUE;                      1217         return RX_CONTINUE;
1224 }                                                1218 }
1225                                                  1219 
1226 ieee80211_tx_result                              1220 ieee80211_tx_result
1227 ieee80211_crypto_hw_encrypt(struct ieee80211_    1221 ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
1228 {                                                1222 {
1229         struct sk_buff *skb;                     1223         struct sk_buff *skb;
1230         struct ieee80211_tx_info *info = NULL    1224         struct ieee80211_tx_info *info = NULL;
1231         ieee80211_tx_result res;                 1225         ieee80211_tx_result res;
1232                                                  1226 
1233         skb_queue_walk(&tx->skbs, skb) {         1227         skb_queue_walk(&tx->skbs, skb) {
1234                 info  = IEEE80211_SKB_CB(skb)    1228                 info  = IEEE80211_SKB_CB(skb);
1235                                                  1229 
1236                 /* handle hw-only algorithm *    1230                 /* handle hw-only algorithm */
1237                 if (!info->control.hw_key)       1231                 if (!info->control.hw_key)
1238                         return TX_DROP;          1232                         return TX_DROP;
1239                                                  1233 
1240                 if (tx->key->flags & KEY_FLAG    1234                 if (tx->key->flags & KEY_FLAG_CIPHER_SCHEME) {
1241                         res = ieee80211_crypt    1235                         res = ieee80211_crypto_cs_encrypt(tx, skb);
1242                         if (res != TX_CONTINU    1236                         if (res != TX_CONTINUE)
1243                                 return res;      1237                                 return res;
1244                 }                                1238                 }
1245         }                                        1239         }
1246                                                  1240 
1247         ieee80211_tx_set_protected(tx);          1241         ieee80211_tx_set_protected(tx);
1248                                                  1242 
1249         return TX_CONTINUE;                      1243         return TX_CONTINUE;
1250 }                                                1244 }
1251                                                  1245 
1252 ieee80211_rx_result                              1246 ieee80211_rx_result
1253 ieee80211_crypto_hw_decrypt(struct ieee80211_    1247 ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
1254 {                                                1248 {
1255         if (rx->sta && rx->sta->cipher_scheme    1249         if (rx->sta && rx->sta->cipher_scheme)
1256                 return ieee80211_crypto_cs_de    1250                 return ieee80211_crypto_cs_decrypt(rx);
1257                                                  1251 
1258         return RX_DROP_UNUSABLE;                 1252         return RX_DROP_UNUSABLE;
1259 }                                                1253 }
1260                                                  1254 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp