@@ -226,6 +226,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
.macaddr = macaddr,
};
+ memcpy(arg.key_rsc_counter, key->rx_pn, IEEE80211_MAX_PN_LEN);
lockdep_assert_held(&arvif->ar->conf_mutex);
switch (key->cipher) {
@@ -1849,6 +1849,9 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar)
if (arg->macaddr)
ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr);
+ memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter,
+ WMI_MAX_RSC_LEN);
+
ptr += sizeof(*tlv);
ptr += sizeof(*cmd);
@@ -4752,6 +4752,7 @@ struct wmi_key_seq_counter {
#define WMI_CIPHER_CKIP 0x6
#define WMI_CIPHER_AES_CMAC 0x7
#define WMI_CIPHER_AES_GCM 0x8
+#define WMI_MAX_RSC_LEN 0x8
struct wmi_vdev_install_key_cmd {
__le32 vdev_id;
@@ -4759,7 +4760,7 @@ struct wmi_vdev_install_key_cmd {
__le32 key_idx;
__le32 key_flags;
__le32 key_cipher; /* %WMI_CIPHER_ */
- struct wmi_key_seq_counter key_rsc_counter;
+ u8 key_rsc_counter[WMI_MAX_RSC_LEN];
struct wmi_key_seq_counter key_global_rsc_counter;
struct wmi_key_seq_counter key_tsc_counter;
u8 wpi_key_rsc_counter[16];
@@ -4782,6 +4783,7 @@ struct wmi_vdev_install_key_arg {
u32 key_txmic_len;
u32 key_rxmic_len;
const void *key_data;
+ u8 key_rsc_counter[IEEE80211_MAX_PN_LEN];
};
/*
Access Point (AP) re-transmits message 3 of 4 way handshake if AP does not receive an appropriate response as acknowledgment. As a result, the client may receive message 3 multiple times. Each time it receives this message, it reinstalls the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. Send RSC counter to FW in set key WMI command, so that FW can drop the packet in PN check if received packet sequence no is less than current RSC counter during group keys(GTK) exchange. Tested on QCA6174 HW3.0 with firmware version RM.4.4.1.c1-00035-QCARMSWP-1. Signed-off-by: Govind Singh <govinds@qti.qualcomm.com> --- drivers/net/wireless/ath/ath10k/mac.c | 1 + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ drivers/net/wireless/ath/ath10k/wmi.h | 4 +++- 3 files changed, 7 insertions(+), 1 deletion(-)