Michael MIC is an inherently weak algorithm that is specific to WPA
TKIP, which itself was an interim security solution to replace the
broken WEP standard.

Currently, the primary implementation of Michael MIC in the kernel is
the one in the mac80211 module.  But there's also a duplicate
implementation in crypto/michael_mic.c which is exposed via the
crypto_shash API.  It's used only by a few wireless drivers.

Seeing as Michael MIC is specific to WPA TKIP and should never be used
elsewhere, this series migrates those few drivers to the mac80211
implementation of Michael MIC, then removes the crypto implementation of
Michael MIC.  This consolidates duplicate code and prevents other kernel
subsystems from accidentally using this insecure algorithm.

This series is targeting wireless-next.

Eric Biggers (6):
  wifi: mac80211: Export michael_mic()
  wifi: ath11k: Use michael_mic() from mac80211
  wifi: ath12k: Use michael_mic() from mac80211
  wifi: ipw2x00: Depend on MAC80211
  wifi: ipw2x00: Use michael_mic() from mac80211
  crypto: Remove michael_mic from crypto_shash API

 arch/arm/configs/omap2plus_defconfig          |   1 -
 arch/arm/configs/spitz_defconfig              |   1 -
 arch/arm64/configs/defconfig                  |   1 -
 arch/m68k/configs/amiga_defconfig             |   1 -
 arch/m68k/configs/apollo_defconfig            |   1 -
 arch/m68k/configs/atari_defconfig             |   1 -
 arch/m68k/configs/bvme6000_defconfig          |   1 -
 arch/m68k/configs/hp300_defconfig             |   1 -
 arch/m68k/configs/mac_defconfig               |   1 -
 arch/m68k/configs/multi_defconfig             |   1 -
 arch/m68k/configs/mvme147_defconfig           |   1 -
 arch/m68k/configs/mvme16x_defconfig           |   1 -
 arch/m68k/configs/q40_defconfig               |   1 -
 arch/m68k/configs/sun3_defconfig              |   1 -
 arch/m68k/configs/sun3x_defconfig             |   1 -
 arch/mips/configs/bigsur_defconfig            |   1 -
 arch/mips/configs/decstation_64_defconfig     |   1 -
 arch/mips/configs/decstation_defconfig        |   1 -
 arch/mips/configs/decstation_r4k_defconfig    |   1 -
 arch/mips/configs/gpr_defconfig               |   1 -
 arch/mips/configs/ip32_defconfig              |   1 -
 arch/mips/configs/lemote2f_defconfig          |   1 -
 arch/mips/configs/malta_qemu_32r6_defconfig   |   1 -
 arch/mips/configs/maltaaprp_defconfig         |   1 -
 arch/mips/configs/maltasmvp_defconfig         |   1 -
 arch/mips/configs/maltasmvp_eva_defconfig     |   1 -
 arch/mips/configs/maltaup_defconfig           |   1 -
 arch/mips/configs/mtx1_defconfig              |   1 -
 arch/mips/configs/rm200_defconfig             |   1 -
 arch/mips/configs/sb1250_swarm_defconfig      |   1 -
 arch/parisc/configs/generic-32bit_defconfig   |   1 -
 arch/parisc/configs/generic-64bit_defconfig   |   1 -
 arch/powerpc/configs/g5_defconfig             |   1 -
 arch/powerpc/configs/linkstation_defconfig    |   1 -
 arch/powerpc/configs/mvme5100_defconfig       |   1 -
 arch/powerpc/configs/powernv_defconfig        |   1 -
 arch/powerpc/configs/ppc64_defconfig          |   1 -
 arch/powerpc/configs/ppc64e_defconfig         |   1 -
 arch/powerpc/configs/ppc6xx_defconfig         |   1 -
 arch/powerpc/configs/ps3_defconfig            |   1 -
 arch/s390/configs/debug_defconfig             |   1 -
 arch/s390/configs/defconfig                   |   1 -
 arch/sh/configs/sh2007_defconfig              |   1 -
 arch/sh/configs/titan_defconfig               |   1 -
 arch/sh/configs/ul2_defconfig                 |   1 -
 arch/sparc/configs/sparc32_defconfig          |   1 -
 arch/sparc/configs/sparc64_defconfig          |   1 -
 crypto/Kconfig                                |  12 --
 crypto/Makefile                               |   1 -
 crypto/michael_mic.c                          | 176 ------------------
 crypto/tcrypt.c                               |   4 -
 crypto/testmgr.c                              |   6 -
 crypto/testmgr.h                              |  50 -----
 drivers/net/wireless/ath/ath11k/Kconfig       |   1 -
 drivers/net/wireless/ath/ath11k/dp.c          |   2 -
 drivers/net/wireless/ath/ath11k/dp_rx.c       |  60 +-----
 drivers/net/wireless/ath/ath11k/peer.h        |   1 -
 drivers/net/wireless/ath/ath12k/Kconfig       |   1 -
 drivers/net/wireless/ath/ath12k/dp.c          |   2 -
 drivers/net/wireless/ath/ath12k/dp_peer.h     |   1 -
 drivers/net/wireless/ath/ath12k/dp_rx.c       |  55 +-----
 drivers/net/wireless/ath/ath12k/dp_rx.h       |   4 -
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c |   7 +-
 drivers/net/wireless/intel/ipw2x00/Kconfig    |   7 +-
 .../intel/ipw2x00/libipw_crypto_tkip.c        | 120 +-----------
 include/linux/ieee80211.h                     |   5 +
 net/mac80211/michael.c                        |   5 +-
 net/mac80211/michael.h                        |  22 ---
 net/mac80211/wpa.c                            |   1 -
 69 files changed, 32 insertions(+), 558 deletions(-)
 delete mode 100644 crypto/michael_mic.c
 delete mode 100644 net/mac80211/michael.h


base-commit: dbd94b9831bc52a1efb7ff3de841ffc3457428ce
-- 
2.53.0

On 4/4/2026 10:27 PM, Eric Biggers wrote:
> Michael MIC is an inherently weak algorithm that is specific to WPA
> TKIP, which itself was an interim security solution to replace the
> broken WEP standard.
> 
> Currently, the primary implementation of Michael MIC in the kernel is
> the one in the mac80211 module.  But there's also a duplicate
> implementation in crypto/michael_mic.c which is exposed via the
> crypto_shash API.  It's used only by a few wireless drivers.
> 
> Seeing as Michael MIC is specific to WPA TKIP and should never be used
> elsewhere, this series migrates those few drivers to the mac80211
> implementation of Michael MIC, then removes the crypto implementation of
> Michael MIC.  This consolidates duplicate code and prevents other kernel
> subsystems from accidentally using this insecure algorithm.
> 
> This series is targeting wireless-next.
> 
> Eric Biggers (6):
>   wifi: mac80211: Export michael_mic()
>   wifi: ath11k: Use michael_mic() from mac80211
>   wifi: ath12k: Use michael_mic() from mac80211
>   wifi: ipw2x00: Depend on MAC80211
>   wifi: ipw2x00: Use michael_mic() from mac80211
>   crypto: Remove michael_mic from crypto_shash API
> 
>  arch/arm/configs/omap2plus_defconfig          |   1 -
>  arch/arm/configs/spitz_defconfig              |   1 -
>  arch/arm64/configs/defconfig                  |   1 -
>  arch/m68k/configs/amiga_defconfig             |   1 -
>  arch/m68k/configs/apollo_defconfig            |   1 -
>  arch/m68k/configs/atari_defconfig             |   1 -
>  arch/m68k/configs/bvme6000_defconfig          |   1 -
>  arch/m68k/configs/hp300_defconfig             |   1 -
>  arch/m68k/configs/mac_defconfig               |   1 -
>  arch/m68k/configs/multi_defconfig             |   1 -
>  arch/m68k/configs/mvme147_defconfig           |   1 -
>  arch/m68k/configs/mvme16x_defconfig           |   1 -
>  arch/m68k/configs/q40_defconfig               |   1 -
>  arch/m68k/configs/sun3_defconfig              |   1 -
>  arch/m68k/configs/sun3x_defconfig             |   1 -
>  arch/mips/configs/bigsur_defconfig            |   1 -
>  arch/mips/configs/decstation_64_defconfig     |   1 -
>  arch/mips/configs/decstation_defconfig        |   1 -
>  arch/mips/configs/decstation_r4k_defconfig    |   1 -
>  arch/mips/configs/gpr_defconfig               |   1 -
>  arch/mips/configs/ip32_defconfig              |   1 -
>  arch/mips/configs/lemote2f_defconfig          |   1 -
>  arch/mips/configs/malta_qemu_32r6_defconfig   |   1 -
>  arch/mips/configs/maltaaprp_defconfig         |   1 -
>  arch/mips/configs/maltasmvp_defconfig         |   1 -
>  arch/mips/configs/maltasmvp_eva_defconfig     |   1 -
>  arch/mips/configs/maltaup_defconfig           |   1 -
>  arch/mips/configs/mtx1_defconfig              |   1 -
>  arch/mips/configs/rm200_defconfig             |   1 -
>  arch/mips/configs/sb1250_swarm_defconfig      |   1 -
>  arch/parisc/configs/generic-32bit_defconfig   |   1 -
>  arch/parisc/configs/generic-64bit_defconfig   |   1 -
>  arch/powerpc/configs/g5_defconfig             |   1 -
>  arch/powerpc/configs/linkstation_defconfig    |   1 -
>  arch/powerpc/configs/mvme5100_defconfig       |   1 -
>  arch/powerpc/configs/powernv_defconfig        |   1 -
>  arch/powerpc/configs/ppc64_defconfig          |   1 -
>  arch/powerpc/configs/ppc64e_defconfig         |   1 -
>  arch/powerpc/configs/ppc6xx_defconfig         |   1 -
>  arch/powerpc/configs/ps3_defconfig            |   1 -
>  arch/s390/configs/debug_defconfig             |   1 -
>  arch/s390/configs/defconfig                   |   1 -
>  arch/sh/configs/sh2007_defconfig              |   1 -
>  arch/sh/configs/titan_defconfig               |   1 -
>  arch/sh/configs/ul2_defconfig                 |   1 -
>  arch/sparc/configs/sparc32_defconfig          |   1 -
>  arch/sparc/configs/sparc64_defconfig          |   1 -
>  crypto/Kconfig                                |  12 --
>  crypto/Makefile                               |   1 -
>  crypto/michael_mic.c                          | 176 ------------------
>  crypto/tcrypt.c                               |   4 -
>  crypto/testmgr.c                              |   6 -
>  crypto/testmgr.h                              |  50 -----
>  drivers/net/wireless/ath/ath11k/Kconfig       |   1 -
>  drivers/net/wireless/ath/ath11k/dp.c          |   2 -
>  drivers/net/wireless/ath/ath11k/dp_rx.c       |  60 +-----
>  drivers/net/wireless/ath/ath11k/peer.h        |   1 -
>  drivers/net/wireless/ath/ath12k/Kconfig       |   1 -
>  drivers/net/wireless/ath/ath12k/dp.c          |   2 -
>  drivers/net/wireless/ath/ath12k/dp_peer.h     |   1 -
>  drivers/net/wireless/ath/ath12k/dp_rx.c       |  55 +-----
>  drivers/net/wireless/ath/ath12k/dp_rx.h       |   4 -
>  drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c |   7 +-
>  drivers/net/wireless/intel/ipw2x00/Kconfig    |   7 +-
>  .../intel/ipw2x00/libipw_crypto_tkip.c        | 120 +-----------
>  include/linux/ieee80211.h                     |   5 +
>  net/mac80211/michael.c                        |   5 +-
>  net/mac80211/michael.h                        |  22 ---
>  net/mac80211/wpa.c                            |   1 -
>  69 files changed, 32 insertions(+), 558 deletions(-)
>  delete mode 100644 crypto/michael_mic.c
>  delete mode 100644 net/mac80211/michael.h
> 
> 
> base-commit: dbd94b9831bc52a1efb7ff3de841ffc3457428ce

Note this series does not bisect cleanly since the introduction of the export
in 1/6 causes build failures:

../drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c:467:12: error: conflicting types for 'michael_mic'; have 'int(struct crypto_shash *, u8 *, u8 *, u8 *, size_t,  u8 *)' {aka 'int(struct crypto_shash *, unsigned char *, unsigned char *, unsigned char *, long unsigned int,  unsigned char *)'}
  467 | static int michael_mic(struct crypto_shash *tfm_michael, u8 *key, u8 *hdr,
      |            ^~~~~~~~~~~
In file included from ../drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c:25:
../include/linux/ieee80211.h:1926:6: note: previous declaration of 'michael_mic' with type 'void(const u8 *, struct ieee80211_hdr *, const u8 *, size_t,  u8 *)' {aka 'void(const unsigned char *, struct ieee80211_hdr *, const unsigned char *, long unsigned int,  unsigned char *)'}
 1926 | void michael_mic(const u8 *key, struct ieee80211_hdr *hdr,
      |      ^~~~~~~~~~~

On Mon, Apr 06, 2026 at 08:59:43AM -0700, Jeff Johnson wrote:
> On 4/4/2026 10:27 PM, Eric Biggers wrote:
> > Michael MIC is an inherently weak algorithm that is specific to WPA
> > TKIP, which itself was an interim security solution to replace the
> > broken WEP standard.
> > 
> > Currently, the primary implementation of Michael MIC in the kernel is
> > the one in the mac80211 module.  But there's also a duplicate
> > implementation in crypto/michael_mic.c which is exposed via the
> > crypto_shash API.  It's used only by a few wireless drivers.
> > 
> > Seeing as Michael MIC is specific to WPA TKIP and should never be used
> > elsewhere, this series migrates those few drivers to the mac80211
> > implementation of Michael MIC, then removes the crypto implementation of
> > Michael MIC.  This consolidates duplicate code and prevents other kernel
> > subsystems from accidentally using this insecure algorithm.
> > 
> > This series is targeting wireless-next.
> > 
> > Eric Biggers (6):
> >   wifi: mac80211: Export michael_mic()
> >   wifi: ath11k: Use michael_mic() from mac80211
> >   wifi: ath12k: Use michael_mic() from mac80211
> >   wifi: ipw2x00: Depend on MAC80211
> >   wifi: ipw2x00: Use michael_mic() from mac80211
> >   crypto: Remove michael_mic from crypto_shash API
> > 
> >  arch/arm/configs/omap2plus_defconfig          |   1 -
> >  arch/arm/configs/spitz_defconfig              |   1 -
> >  arch/arm64/configs/defconfig                  |   1 -
> >  arch/m68k/configs/amiga_defconfig             |   1 -
> >  arch/m68k/configs/apollo_defconfig            |   1 -
> >  arch/m68k/configs/atari_defconfig             |   1 -
> >  arch/m68k/configs/bvme6000_defconfig          |   1 -
> >  arch/m68k/configs/hp300_defconfig             |   1 -
> >  arch/m68k/configs/mac_defconfig               |   1 -
> >  arch/m68k/configs/multi_defconfig             |   1 -
> >  arch/m68k/configs/mvme147_defconfig           |   1 -
> >  arch/m68k/configs/mvme16x_defconfig           |   1 -
> >  arch/m68k/configs/q40_defconfig               |   1 -
> >  arch/m68k/configs/sun3_defconfig              |   1 -
> >  arch/m68k/configs/sun3x_defconfig             |   1 -
> >  arch/mips/configs/bigsur_defconfig            |   1 -
> >  arch/mips/configs/decstation_64_defconfig     |   1 -
> >  arch/mips/configs/decstation_defconfig        |   1 -
> >  arch/mips/configs/decstation_r4k_defconfig    |   1 -
> >  arch/mips/configs/gpr_defconfig               |   1 -
> >  arch/mips/configs/ip32_defconfig              |   1 -
> >  arch/mips/configs/lemote2f_defconfig          |   1 -
> >  arch/mips/configs/malta_qemu_32r6_defconfig   |   1 -
> >  arch/mips/configs/maltaaprp_defconfig         |   1 -
> >  arch/mips/configs/maltasmvp_defconfig         |   1 -
> >  arch/mips/configs/maltasmvp_eva_defconfig     |   1 -
> >  arch/mips/configs/maltaup_defconfig           |   1 -
> >  arch/mips/configs/mtx1_defconfig              |   1 -
> >  arch/mips/configs/rm200_defconfig             |   1 -
> >  arch/mips/configs/sb1250_swarm_defconfig      |   1 -
> >  arch/parisc/configs/generic-32bit_defconfig   |   1 -
> >  arch/parisc/configs/generic-64bit_defconfig   |   1 -
> >  arch/powerpc/configs/g5_defconfig             |   1 -
> >  arch/powerpc/configs/linkstation_defconfig    |   1 -
> >  arch/powerpc/configs/mvme5100_defconfig       |   1 -
> >  arch/powerpc/configs/powernv_defconfig        |   1 -
> >  arch/powerpc/configs/ppc64_defconfig          |   1 -
> >  arch/powerpc/configs/ppc64e_defconfig         |   1 -
> >  arch/powerpc/configs/ppc6xx_defconfig         |   1 -
> >  arch/powerpc/configs/ps3_defconfig            |   1 -
> >  arch/s390/configs/debug_defconfig             |   1 -
> >  arch/s390/configs/defconfig                   |   1 -
> >  arch/sh/configs/sh2007_defconfig              |   1 -
> >  arch/sh/configs/titan_defconfig               |   1 -
> >  arch/sh/configs/ul2_defconfig                 |   1 -
> >  arch/sparc/configs/sparc32_defconfig          |   1 -
> >  arch/sparc/configs/sparc64_defconfig          |   1 -
> >  crypto/Kconfig                                |  12 --
> >  crypto/Makefile                               |   1 -
> >  crypto/michael_mic.c                          | 176 ------------------
> >  crypto/tcrypt.c                               |   4 -
> >  crypto/testmgr.c                              |   6 -
> >  crypto/testmgr.h                              |  50 -----
> >  drivers/net/wireless/ath/ath11k/Kconfig       |   1 -
> >  drivers/net/wireless/ath/ath11k/dp.c          |   2 -
> >  drivers/net/wireless/ath/ath11k/dp_rx.c       |  60 +-----
> >  drivers/net/wireless/ath/ath11k/peer.h        |   1 -
> >  drivers/net/wireless/ath/ath12k/Kconfig       |   1 -
> >  drivers/net/wireless/ath/ath12k/dp.c          |   2 -
> >  drivers/net/wireless/ath/ath12k/dp_peer.h     |   1 -
> >  drivers/net/wireless/ath/ath12k/dp_rx.c       |  55 +-----
> >  drivers/net/wireless/ath/ath12k/dp_rx.h       |   4 -
> >  drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c |   7 +-
> >  drivers/net/wireless/intel/ipw2x00/Kconfig    |   7 +-
> >  .../intel/ipw2x00/libipw_crypto_tkip.c        | 120 +-----------
> >  include/linux/ieee80211.h                     |   5 +
> >  net/mac80211/michael.c                        |   5 +-
> >  net/mac80211/michael.h                        |  22 ---
> >  net/mac80211/wpa.c                            |   1 -
> >  69 files changed, 32 insertions(+), 558 deletions(-)
> >  delete mode 100644 crypto/michael_mic.c
> >  delete mode 100644 net/mac80211/michael.h
> > 
> > 
> > base-commit: dbd94b9831bc52a1efb7ff3de841ffc3457428ce
> 
> Note this series does not bisect cleanly since the introduction of the export
> in 1/6 causes build failures:
> 
> ../drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c:467:12: error: conflicting types for 'michael_mic'; have 'int(struct crypto_shash *, u8 *, u8 *, u8 *, size_t,  u8 *)' {aka 'int(struct crypto_shash *, unsigned char *, unsigned char *, unsigned char *, long unsigned int,  unsigned char *)'}
>   467 | static int michael_mic(struct crypto_shash *tfm_michael, u8 *key, u8 *hdr,
>       |            ^~~~~~~~~~~
> In file included from ../drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c:25:
> ../include/linux/ieee80211.h:1926:6: note: previous declaration of 'michael_mic' with type 'void(const u8 *, struct ieee80211_hdr *, const u8 *, size_t,  u8 *)' {aka 'void(const unsigned char *, struct ieee80211_hdr *, const unsigned char *, long unsigned int,  unsigned char *)'}
>  1926 | void michael_mic(const u8 *key, struct ieee80211_hdr *hdr,

Thanks!  I'll add a preparatory patch that temporarily renames the
michael_mic() in libipw_crypto_tkip.c.

- Eric

Hi,

On Sat, 2026-04-04 at 22:27 -0700, Eric Biggers wrote:
> Michael MIC is an inherently weak algorithm that is specific to WPA
> TKIP, which itself was an interim security solution to replace the
> broken WEP standard.

Heh, yeah, we keep thinking about whether or not we can remove either of
them completely, but ... backward compatibility is messy.

> Seeing as Michael MIC is specific to WPA TKIP and should never be used
> elsewhere, this series migrates those few drivers to the mac80211
> implementation of Michael MIC, then removes the crypto implementation of
> Michael MIC.  This consolidates duplicate code and prevents other kernel
> subsystems from accidentally using this insecure algorithm.

Makes sense, mostly.

The one thing that feels odd to me in this is moving it to *mac80211*
specifically, and then using that in the ancient drivers. Not only is
that a big module those don't (otherwise) need, but also it makes it
look like you need the softmac stack for those drivers, but they're
really hardmac so that's a bit confusing.

I wouldn't want to have a separate module just for this, but I think
since it's going to be exported anyway, we could move the whole
michael.c file to net/wireless/ and make it part of cfg80211. All
wireless drivers ought to depend on that anyway.

johannes

On Tue, Apr 07, 2026 at 08:00:53AM +0200, Johannes Berg wrote:
> The one thing that feels odd to me in this is moving it to *mac80211*
> specifically, and then using that in the ancient drivers. Not only is
> that a big module those don't (otherwise) need, but also it makes it
> look like you need the softmac stack for those drivers, but they're
> really hardmac so that's a bit confusing.
> 
> I wouldn't want to have a separate module just for this, but I think
> since it's going to be exported anyway, we could move the whole
> michael.c file to net/wireless/ and make it part of cfg80211. All
> wireless drivers ought to depend on that anyway.

Just to clarify, mac80211 already contains the michael_mic() function.
And every driver that needs Michael MIC already depends on mac80211
except for ipw2x00.  So bloat-wise I assumed it's probably better to
make that one driver depend on mac80211, rather than make every driver
pull in the Michael MIC code (by moving it from mac80211 to cfg80211).
But if you prefer that the code be in cfg80211 we can do it that way.

- Eric

On Mon, Apr 06, 2026 at 11:15:08PM -0700, Eric Biggers wrote:
> Just to clarify, mac80211 already contains the michael_mic() function.
> And every driver that needs Michael MIC already depends on mac80211
> except for ipw2x00.  So bloat-wise I assumed it's probably better to
> make that one driver depend on mac80211, rather than make every driver
> pull in the Michael MIC code (by moving it from mac80211 to cfg80211).
> But if you prefer that the code be in cfg80211 we can do it that way.

To me the most sensible thing would be to have a separate module for
the code.  If you don't want to expose it too widely for understandable
reasons, keep the module in net/wireless/.

On Mon, 2026-04-06 at 23:24 -0700, Christoph Hellwig wrote:
> On Mon, Apr 06, 2026 at 11:15:08PM -0700, Eric Biggers wrote:
> > Just to clarify, mac80211 already contains the michael_mic() function.
> > And every driver that needs Michael MIC already depends on mac80211
> > except for ipw2x00.  So bloat-wise I assumed it's probably better to
> > make that one driver depend on mac80211, rather than make every driver
> > pull in the Michael MIC code (by moving it from mac80211 to cfg80211).
> > But if you prefer that the code be in cfg80211 we can do it that way.
> 
> To me the most sensible thing would be to have a separate module for
> the code.  If you don't want to expose it too widely for understandable
> reasons, keep the module in net/wireless/.
> 
Maybe, but that'd probably be more overhead than anything else? The
text+data is 725 bytes (on x86-64).

johannes

On Tue, Apr 07, 2026 at 08:28:20AM +0200, Johannes Berg wrote:
> On Mon, 2026-04-06 at 23:24 -0700, Christoph Hellwig wrote:
> > On Mon, Apr 06, 2026 at 11:15:08PM -0700, Eric Biggers wrote:
> > > Just to clarify, mac80211 already contains the michael_mic() function.
> > > And every driver that needs Michael MIC already depends on mac80211
> > > except for ipw2x00.  So bloat-wise I assumed it's probably better to
> > > make that one driver depend on mac80211, rather than make every driver
> > > pull in the Michael MIC code (by moving it from mac80211 to cfg80211).
> > > But if you prefer that the code be in cfg80211 we can do it that way.
> > 
> > To me the most sensible thing would be to have a separate module for
> > the code.  If you don't want to expose it too widely for understandable
> > reasons, keep the module in net/wireless/.
> > 
> Maybe, but that'd probably be more overhead than anything else? The
> text+data is 725 bytes (on x86-64).

Yeah.  Just thinking out loud, if the wireless maintainers are fine with
the cگg80211 version that's probably fine.

On Mon, 2026-04-06 at 23:15 -0700, Eric Biggers wrote:
> On Tue, Apr 07, 2026 at 08:00:53AM +0200, Johannes Berg wrote:
> > The one thing that feels odd to me in this is moving it to *mac80211*
> > specifically, and then using that in the ancient drivers. Not only is
> > that a big module those don't (otherwise) need, but also it makes it
> > look like you need the softmac stack for those drivers, but they're
> > really hardmac so that's a bit confusing.
> > 
> > I wouldn't want to have a separate module just for this, but I think
> > since it's going to be exported anyway, we could move the whole
> > michael.c file to net/wireless/ and make it part of cfg80211. All
> > wireless drivers ought to depend on that anyway.
> 
> Just to clarify, mac80211 already contains the michael_mic() function.

Yes, for the SW crypto there, which apparently was never ported to the
crypto functions.

> And every driver that needs Michael MIC already depends on mac80211
> except for ipw2x00.

I'm actually surprised it's any of those (actually) mac80211 based
drivers at all, since they ought to just be able to hand the skb to
mac80211 for checking. Not sure what's going on there, but I haven't
looked carefully either.

> So bloat-wise I assumed it's probably better to
> make that one driver depend on mac80211, rather than make every driver
> pull in the Michael MIC code (by moving it from mac80211 to cfg80211).
> But if you prefer that the code be in cfg80211 we can do it that way.

I think you're probably right, but it's a pretty small function and
architecturally, having those drivers depend on mac80211 but not
actually use any of its "real" functionality is IMHO somewhat confusing,
maybe especially from a Kconfig POV.

Also most drivers already use mac80211 so for those it makes no
difference, but of course there are a number of non-mac80211 drivers
that would get this function.

So I think overall, it still makes more sense in cfg80211 - we've been
treating that as not just nl80211 but also "useful things for drivers"
(for obvious reasons, every WiFi driver must use it), so that'd be the
better place I think.

johannes