[PATCH -next v3 00/13] wifi: cfg80211: consolidate cookie assignment for async ops

NL80211_ATTR_COOKIE is a userspace-visible u64 that correlates an async
nl80211 operation with its completion event. Three cfg80211 ops currently
delegate cookie generation to the driver: remain_on_channel, mgmt_tx, and
probe_peer. This produces inconsistent strategies across drivers: some use
an incrementing counter, some use get_random_u32(), some use a CID cast to
u64, and brcmfmac's mgmt_tx always assigned zero - which is arguably broken
since cfg80211 treats zero as an invalid cookie.

The add_nan_func op already does this calling cfg80211_assign_cookie()
before invoking the driver, ensuring a unique non-zero value without
any driver involvement. This series applies the same pattern to
remain_on_channel, mgmt_tx, probe_peer, and tx_control_port.

Structure
---------

Patch 1 does the cookie pre-assignment in the nl80211 command handlers
calling into the drivers. Drivers may still overwrite the value at this point;
subsequent patches remove the per-driver generation. Patch 2 updates mac80211,
which has its own internal cookie counter (roc_cookie_counter) that becomes
redundant. Patches 3-9 are per-driver cleanups. Patch 10 finalises the
interface by converting the u64 *cookie output parameter to a u64 cookie
input parameter, making the direction of data flow explicit. tx_control_port
is handled separately in patch 11 introducing the zero cookie value used for
the dont_wait_for_ack option. Patch 12 avoids sending frame tx status event
when a zero cookie is passed in the frame tx status calls for mgmt_tx and
tx_control_port.

Non-obvious aspects
-------------------

ath6kl (patch 3): when the destination STA is in power-save mode, ath6kl
queues the management frame in a software queue (struct ath6kl_mgmt_buff).
The cookie must survive enqueue and dequeue so that cfg80211_mgmt_tx_status()
is called with the correct value after the frame is eventually transmitted.
This means the cookie field is threaded through ath6kl_mgmt_powersave_ap()
and into the queue entry. The vif->last_roc_id and last_cancel_roc_id fields
are widened from u32 to u64 to hold the full 64-bit cookie.

Synchronous mgmt_tx (brcmfmac, wil6210): these drivers call
cfg80211_mgmt_tx_status() before the mgmt_tx callback returns. The status
event is therefore sent to userspace before the nl80211 command reply that
carries the cookie. Userspace must buffer the status event and match it
once the reply arrives. The pre-assigned cookie being consistent across both
the status event and the reply is what makes that correlation possible.
Previously brcmfmac passed cookie=0 to cfg80211_mgmt_tx_status(), which was
broken; this series fixes that as a side effect.

qtnfmac (patch 9): the qlink firmware protocol has no frame-TX-status event
type. qtnfmac never calls cfg80211_mgmt_tx_status(). The previous code
generated a random u32 short_cookie and sent it to firmware purely as a
debug identifier; it was never used for nl80211 cookie correlation. After
this series qtnfmac simply uses the pre-assigned cookie for the same debug
purpose and discards it. The absence of tx status reporting for the
wait_for_ack case is a pre-existing driver limitation not addressed here.

mac80211 0xffffffff removal (patch 2): the old code assigned *cookie =
0xffffffff for the dont_wait_for_ack + need_offchan case to ensure
roc->mgmt_tx_cookie was non-zero, which distinguishes a mgmt-tx ROC from a
regular remain-on-channel ROC internally. That dummy value is no longer
needed because cfg80211_assign_cookie() guarantees a non-zero result (it
warns and skips zero if the counter wraps). The cookie is still not sent to
userspace in the dont_wait_for_ack case.

Changelog:
  v2:
    - SoB for patch 1.
    - zero cookie usage in tx_control_port (patch 11).
    - drop frame tx status event for zero cookie (patch 12).
  v3:
    - deal with rtl8723bs staging driver as well (patch 10)

Arend van Spriel (10):
  wifi: cfg80211: pre-assign cookie for remain_on_channel, mgmt_tx,
    probe_peer and tx_control_port
  wifi: mac80211: stop using ieee80211_mgmt_tx_cookie()
  wifi: ath6kl: use pre-assigned cookie for remain_on_channel and
    mgmt_tx
  wifi: wil6210: use pre-assigned cookie for remain_on_channel, mgmt_tx
    and probe_peer
  wifi: brcmfmac: use pre-assigned cookie for remain_on_channel and
    mgmt_tx
  wifi: mwifiex: use pre-assigned cookie for remain_on_channel and
    mgmt_tx
  wifi: wilc1000: use pre-assigned cookie for remain_on_channel and
    mgmt_tx
  wifi: nxpwifi: use pre-assigned cookie for remain_on_channel and
    mgmt_tx
  wifi: qtnfmac: use pre-assigned cookie for mgmt_tx
  wifi: rtl8723bs: use pre-assigned cookie for mgmt_tx
  wifi: cfg80211: convert cookie output to input parameter
  wifi: cfg80211: convert tx_control_port cookie to input parameter
  wifi: nl80211: send frame tx status event only for non-zero cookie

 drivers/net/wireless/ath/ath6kl/cfg80211.c    | 22 +++++--------
 drivers/net/wireless/ath/ath6kl/core.h        |  5 +--
 drivers/net/wireless/ath/ath6kl/main.c        |  1 +
 drivers/net/wireless/ath/ath6kl/txrx.c        |  1 +
 drivers/net/wireless/ath/ath6kl/wmi.c         |  2 +-
 drivers/net/wireless/ath/ath6kl/wmi.h         |  1 +
 drivers/net/wireless/ath/wil6210/cfg80211.c   | 12 +++----
 drivers/net/wireless/ath/wil6210/debugfs.c    |  2 +-
 drivers/net/wireless/ath/wil6210/p2p.c        |  6 ++--
 drivers/net/wireless/ath/wil6210/wil6210.h    |  4 +--
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 12 +++----
 .../broadcom/brcm80211/brcmfmac/cfg80211.h    |  2 +-
 .../broadcom/brcm80211/brcmfmac/cyw/core.c    |  8 ++---
 .../broadcom/brcm80211/brcmfmac/p2p.c         | 10 +++---
 .../broadcom/brcm80211/brcmfmac/p2p.h         |  2 +-
 .../net/wireless/marvell/mwifiex/cfg80211.c   | 20 ++++++------
 .../wireless/microchip/wilc1000/cfg80211.c    | 19 ++++--------
 drivers/net/wireless/nxp/nxpwifi/cfg80211.c   | 20 ++++++------
 .../net/wireless/quantenna/qtnfmac/cfg80211.c |  4 +--
 .../staging/rtl8723bs/os_dep/ioctl_cfg80211.c |  7 ++---
 include/net/cfg80211.h                        | 14 +++++----
 net/mac80211/cfg.c                            | 18 ++---------
 net/mac80211/ieee80211_i.h                    | 11 +++----
 net/mac80211/offchannel.c                     | 27 ++++++----------
 net/mac80211/tdls.c                           |  2 +-
 net/mac80211/tx.c                             | 31 +++++++++----------
 net/wireless/core.h                           |  2 +-
 net/wireless/mlme.c                           |  2 +-
 net/wireless/nl80211.c                        | 18 ++++++++---
 net/wireless/rdev-ops.h                       | 16 +++++-----
 30 files changed, 128 insertions(+), 173 deletions(-)


base-commit: 4a0bd262df757b25fc4e2a53c947317c119ced4e
-- 
2.54.0