[PATCH v3 2/4] wifi: iwlwifi: enable MFP_CAPABLE in FIPS mode

[Jose Ignacio Tornos Martinez]

Re-enable MFP_CAPABLE flag in FIPS mode for iwlwifi to allow Management
Frame Protection (802.11w) to work with mac80211 software crypto.

Commit 0636800c8ee1f ("wifi: iwlwifi: disable certain features for
fips_enabled") disabled MFP_CAPABLE when fips_enabled=1.
The original concern about "some frames need to be handled in
firmware" applies to firmware-offloaded features like WoWLAN and beacon
protection, which remain correctly disabled by the commented commit.
For normal STA mode operation, management frames are processed in
software. And MFP can function in FIPS mode for normal STA operation
when mac80211 software crypto handles IGTK encryption/decryption using
FIPS-approved AES-CMAC/GMAC algorithms.

Other major WiFi drivers (ath11k, rtlwifi, mt76, ...) set MFP_CAPABLE
unconditionally, suggesting this approach is viable for FIPS mode
operation with software crypto.

When FIPS_EXCEPTION_WIFI_MFP is set via the fips_exception boot
parameter, use fips_allows_exception() to restore MFP_CAPABLE.
Without fips_exception set, the behavior remains exactly as commit
0636800c8ee1 implemented.

Testing on Intel WiFi 6E AX210 with fips=1 fips_exception=1 shows:
- IGTK ciphers (CMAC, GMAC-128, GMAC-256) are properly advertised
- WPA3-SAE connections with MFP required succeed
- iw station dump confirms "MFP: yes"

Firmware logs "Unhandled alg: 0x707" (SEC_ENC_ERR) during operation,
confirming that firmware does not have the keys and frames are being
handled by software crypto as expected.

Fixes: 0636800c8ee1f ("wifi: iwlwifi: disable certain features for fips_enabled")
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@xxxxxxxxxx>
---
v3: reuse v1 1/2 idea plus fips_allows_exception() helper from patch 1/4
v2: https://lore.kernel.org/all/20260930120829.383408-1-jtornosm@xxxxxxxxxx/
v1: https://lore.kernel.org/all/20260629121213.597038-2-jtornosm@xxxxxxxxxx/

 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 5bd246e37943..144a19a4015c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -462,7 +462,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 		IWL_ERR(mvm,
 			"iwlmvm doesn't allow to disable BT Coex, check bt_coex_active module parameter\n");

-	if (!fips_enabled)
+	if (!fips_enabled || fips_allows_exception(FIPS_EXCEPTION_WIFI_MFP))
 		ieee80211_hw_set(hw, MFP_CAPABLE);

 	mvm->ciphers[hw->wiphy->n_cipher_suites] = WLAN_CIPHER_SUITE_AES_CMAC;
--
2.49.0