Commit 5241526dede9 ("wifi: mac80211: don't send keys to driver when fips_enabled") blocks all keys from reaching the firmware when fips_enabled. While this prevents firmware from using non-validated crypto, it also means the firmware has no PTK/GTK installed and blocks all data frames, resulting in a WiFi connection authorized but with no traffic. When FIPS_EXCEPTION_WIFI_MFP is set via fips_exception boot parameter, use fips_allows() to allow keys to reach the firmware so that data traffic works. The data encryption (CCMP/GCMP) is still handled by mac80211 software crypto using FIPS-approved algorithms on the host CPU, but the firmware needs the keys installed to allow frames through. Without fips_exception set, the behavior remains exactly as commit 5241526dede9 implemented. Signed-off-by: Jose Ignacio Tornos Martinez --- v2: complete the conditional FIPS disabling revert v1: https://lore.kernel.org/all/20260629121213.597038-2-jtornosm@redhat.com/ net/mac80211/driver-ops.c | 2 +- net/mac80211/driver-ops.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c index 49753b73aba2..0a50684d9cf6 100644 --- a/net/mac80211/driver-ops.c +++ b/net/mac80211/driver-ops.c @@ -519,7 +519,7 @@ int drv_set_key(struct ieee80211_local *local, !(sdata->vif.active_links & BIT(key->link_id)))) return -ENOLINK; - if (fips_enabled) + if (!fips_allows(FIPS_EXCEPTION_WIFI_MFP)) return -EOPNOTSUPP; trace_drv_set_key(local, cmd, sdata, sta, key); diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h index f1c0b87fddd5..a24230feb864 100644 --- a/net/mac80211/driver-ops.h +++ b/net/mac80211/driver-ops.h @@ -903,7 +903,7 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local, if (!check_sdata_in_driver(sdata)) return; - if (fips_enabled) + if (!fips_allows(FIPS_EXCEPTION_WIFI_MFP)) return; trace_drv_set_rekey_data(local, sdata, data); -- 2.55.0