Subject: Re: [RFC PATCH v3 09/12] ath: Basic Extended Key ID support
 (COMPAT+NATIVE)
To:     Kalle Valo <kvalo@codeaurora.org>
Cc:     johannes@sipsolutions.net, linux-wireless@vger.kernel.org
References: <20190210210620.31181-1-alexander@wetzel-home.de>
 <20190210210620.31181-10-alexander@wetzel-home.de>
 <87r2ccq78j.fsf@purkki.adurom.net>
From:   Alexander Wetzel <alexander@wetzel-home.de>
Message-ID: <750c25be-478e-4be4-6118-f272825ea50c@wetzel-home.de>
Date:   Thu, 14 Feb 2019 00:15:33 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.0
MIME-Version: 1.0
In-Reply-To: <87r2ccq78j.fsf@purkki.adurom.net>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

> 
>> Extend the shared ath key cache code to support Extended Key ID.
>>
>> The key cache code has to accept unicast keys to use key idx 1 and allow
>> drivers to enable/disable hardware Rx decryption for a key independent
>> from Tx.
>>
>> Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
>> ---
>>
>> I know this is the wrong audience to discuss ath drivers.
> 
> I think this is the right forum. Do note that somewhere in this patch
You are of course right. I mixed that up somehow.

We can of course also discuss the ath patches any time :-)
My initial plan was, to get the nl80211/mac80211 API finalized and then 
get them reviewed together with another planned fix after some more 
polishing.

At this stage they are just a POC and not ready for merge. They work 
with ath9k in AP (vlan) mode and I believe managed mode should either 
work or need some trivial fix only. (There even seems to be a chance 
that managed mode could allow the usage of the NATIVE Extended Key ID 
mode, but so far I could not tested that.)

> (in the cover letter) you mentioned "all ath drivers" but AFAICS this
> patch only changes functionality for ath5k, ath9k and ath9k_htc. All the
> rest like wil6210, ath6kl and ath10k are unaffected.
> 
You are right, I should have used "shared ath key cache code" in the 
Cover Letter, as in the patch itself. This is not (yet) an attempt to 
implement Extended Key ID for anything else than ath9k AP mode. So any 
driver not using ath_key_config() won't be affected at all.

Now I believe it's possible for all Atheros drivers but the ath10k to 
get support. As long as a card can work with SW crypto we only need a 
way to disable Rx HW crypto for a running key without impact for ongoing Tx.
But the initial results when trying my hand at ath10k are strongly 
indicating the best we can hope there is SW encryption only with CT 
firmware... or maybe a firmware update.

While the API itself is perfectly able to handle NATIVE mode the keyid 
is not handled correctly. Installing a second key switches TX to the new 
key and overwrites the keyid in the MPDU mac80211 prepared. (I could not 
even get the card to properly make an RX/TX key to an TX only key, that 
caused clear text packets when changing the key and it looks like that 
SW crypto is only possible - with nonfree CT - when not using HW crypto 
for TX at all. With those limitations I shelved any plans for ath10k.)

One of my next planned steps is now to either get another ath9k card or 
get another driver working in AP mode to test ath9k also in managed 
mode. Of course I also have to get sniffing working properly, all cards 
tried so far have issues and it also looks like I have to update 
wireshark for serious testing. So I guess driver support will still take 
some time and efforts when we got the generic issues sorted out.

I can also try my hand at porting the other Atheros drives, but without 
someone being able to confirm it works I'm not planning that at the moment.

Alexander