Skip to content

cfg80211 cookie rework for Linux 7.3 - #37

Merged
Kiborgik merged 4 commits into
mainfrom
cfg80211-cookie-input
Sep 29, 2026
Merged

Kiborgik merged 4 commits into
mainfrom
cfg80211-cookie-input

Conversation

@Kiborgik

@Kiborgik Kiborgik commented Sep 14, 2026 •

Copy link
Copy Markdown
Owner

Linux 7.3 reworked how cfg80211 hands out cookies. nl80211 now assigns the cookie before it calls the driver, so mgmt_tx, remain_on_channel and probe_peer take it as a u64 input instead of writing one back through a pointer. In the same series cfg80211_ops.probe_client was renamed to probe_peer and cfg80211_probe_status gained a link_id parameter. The upstream commits are 996753804410, 914781c72813, 4ab9b637b94a and 010e955c203e.

This driver minted its own cookies, the skb pointer for management frames and a counter for remain-on-channel, and reported those values back to cfg80211. Only changing the signatures would have compiled cleanly and then reported cookies userspace never asked about, so the assigned cookie is now stored in rwnx_sw_txhdr, rwnx_roc_elem and sta_probe.probe_id and reported from there. Transmissions the driver starts on its own, the internal remain-on-channel inside mgmt_tx and the TDLS discovery response, pass 0. cfg80211_assign_cookie never returns 0, and nl80211_frame_tx_status drops a zero-cookie status before it reaches userspace.

Detection lives in the fdrv Makefile and greps cfg80211.h, the same way AIC_SET_MONITOR_CHANNEL_NETDEV is detected, because Debian trixie has already shipped a 6.12 carrying a backported cfg80211 signature that LINUX_VERSION_CODE lied about. Each guard accepts either the macro or the version check, so a stock kernel builds correctly even when the header cannot be found. The internal RoC call in mgmt_tx uses the same rx_addr detection as the remain_on_channel definition, so a kernel with only rx_addr backported still builds.

Checked against the v7.3-rc5 cfg80211.h, core.h and nl80211.c, and against radxa-pkg's fix-linux-7.3-build.patch, which makes the same change keyed on the kernel version alone. CI builds 6.12 LTS, 6.18, 7.1, current Arch and mainline -rc.

Linux 7.3 makes the cookie of mgmt_tx, remain_on_channel and probe_peer an
input that nl80211 assigns before the driver runs, renames
cfg80211_ops.probe_client to probe_peer, and adds link_id to
cfg80211_probe_status. This driver minted its own cookies, so a
signature-only fix would compile and then report values userspace never
issued.

Carries the assigned cookie in rwnx_sw_txhdr, rwnx_roc_elem and
sta_probe.probe_id, and every sw_txhdr keeps the skb pointer as its default
because rwnx_start_monitor_if_xmit also raises TXU_CNTRL_MGMT. Internal RoC
and TDLS callers pass 0, which cfg80211_assign_cookie never hands out. The
fdrv Makefile greps cfg80211.h for the four shapes, remain_on_channel's
rx_addr included, since a backport that moves the cookie moves rx_addr with
it.
Make matches parentheses to find the end of a $(shell ...) call and knows
nothing about shell quoting, so the bracket in 'u64 cookie)' closed the call
early. The command then ran with an unterminated quote and returned nothing,
and the ifneq against 0 defined AIC_CFG80211_COOKIE_INPUT on every kernel,
which broke 6.12, 6.18, 7.1 and Arch.

Dropped the bracket. The 7.3 shape is already distinguished by u64 cookie
against u64 *cookie, and the -A2 window has to stay as it is because
cfg80211_probe_status carries the same u64 cookie text further down.
The remain_on_channel definition takes rx_addr when the Makefile detects it in cfg80211.h, but its caller in mgmt_tx still checked only the 7.2 version, so a kernel with rx_addr backported and the old cookie shape failed with too few arguments. The call now accepts AIC_CFG80211_ROC_RX_ADDR alongside the version.
@Kiborgik Kiborgik changed the title cfg80211 cookie rework for Linux 7.3 (untested on hardware, please do not merge yet) cfg80211 cookie rework for Linux 7.3 Sep 29, 2026
Builds on Linux 7.3 with its cfg80211 cookie rework, and prints make.log when a dkms build fails.
@Kiborgik
Kiborgik marked this pull request as ready for review September 29, 2026 19:48
@Kiborgik
Kiborgik merged commit e0242ec into main Sep 29, 2026
9 checks passed
@Kiborgik
Kiborgik deleted the cfg80211-cookie-input branch September 29, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant