[PATCH v2 2/5] wifi: mac80211: allow keys to driver with fips_exception

[Jose Ignacio Tornos Martinez]

Commit 5241526dede9 ("wifi: mac80211: don't send keys to driver
when fips_enabled") blocks all keys from reaching the firmware
when fips_enabled. While this prevents firmware from using
non-validated crypto, it also means the firmware has no PTK/GTK
installed and blocks all data frames, resulting in a WiFi
connection authorized but with no traffic.

When FIPS_EXCEPTION_WIFI_MFP is set via fips_exception boot
parameter, use fips_allows() to allow keys to reach the firmware
so that data traffic works. The data encryption (CCMP/GCMP) is
still handled by mac80211 software crypto using FIPS-approved
algorithms on the host CPU, but the firmware needs the keys
installed to allow frames through.

Without fips_exception set, the behavior remains exactly as
commit 5241526dede9 implemented.

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@xxxxxxxxxx>
---
v2: complete the conditional FIPS disabling revert
v1: https://lore.kernel.org/all/20260629121213.597038-2-jtornosm@xxxxxxxxxx/

 net/mac80211/driver-ops.c | 2 +-
 net/mac80211/driver-ops.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index 49753b73aba2..0a50684d9cf6 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -519,7 +519,7 @@ int drv_set_key(struct ieee80211_local *local,
 		    !(sdata->vif.active_links & BIT(key->link_id))))
 		return -ENOLINK;
 
-	if (fips_enabled)
+	if (!fips_allows(FIPS_EXCEPTION_WIFI_MFP))
 		return -EOPNOTSUPP;
 
 	trace_drv_set_key(local, cmd, sdata, sta, key);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index f1c0b87fddd5..a24230feb864 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -903,7 +903,7 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
 	if (!check_sdata_in_driver(sdata))
 		return;
 
-	if (fips_enabled)
+	if (!fips_allows(FIPS_EXCEPTION_WIFI_MFP))
 		return;
 
 	trace_drv_set_rekey_data(local, sdata, data);
-- 
2.55.0