Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH 4/4] iwlwifi: Enable Extended Key ID for mvm and dvm
To:     johannes@sipsolutions.net, Luca Coelho <luca@coelho.fi>
Cc:     linux-wireless@vger.kernel.org
References: <20190629195015.19680-1-alexander@wetzel-home.de>
 <20190629195015.19680-4-alexander@wetzel-home.de>
From:   Alexander Wetzel <alexander@wetzel-home.de>
Message-ID: <cd1b1a83-55e2-3c07-dbe2-0c459bbcdc7e@wetzel-home.de>
Date:   Sat, 17 Aug 2019 10:31:30 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <20190629195015.19680-4-alexander@wetzel-home.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

> All iwlwifi cards are able to handle multiple keyids per STA and are
> therefore fully compatible with the Extended Key ID implementation
> provided by mac80211.

I just tried Extended Key ID with a AX200 card and it really looks like 
it's incompatible:-(

The card is starting to use the PTK key immediately after installation, 
encrypting EAPOL #3 with the new (still Rx only!) key.

Digging around in the driver code it looks like we do not even pass the 
key information any longer to the card: iwl_mvm_set_tx_params() is 
bypassing iwl_mvm_set_tx_cmd_crypto() completely when we use the "new tx 
API". So all cards setting "use_tfh" to true are now incompatible.

Therefore it looks like that all cards starting with the 22000 series 
can't be used with Extended Key ID any longer.

Is there a way to hand over the key information within the new API or is 
the way forward to block Extended Key ID when the "new tx API" is being 
used?

The card is fine with using keyid 1 for unicast keys. But it looks like 
it assumes that a new key install also tells it to use the new key 
immediately... Still digging around but pretty sure that's happening now.

Alexander