Re: [PATCH] wifi: brcmfmac: cyw: clean up PMKID and cookie code

[Arend van Spriel]

On 09/07/2026 14:23, Bogdan Nicolae wrote:
> Avoid setting packet_id to cookie, which is always 0. Instead, use an
> increasing atomic counter. Avoids mismatches of completion events later
> in brcmf_notify_mgmt_tx_status, where packet_id != vif->mgmt_tx_id is
> checked.
>
> Also, zero out auth_status on initialization. Otherwise, garbage will
> leak from the stack to the firmware (when bssid is less than 32 bytes
> and/or when params->pmkid is set). Then, pass the params->pmkid to the
> firmware (without it, the firmware caches a garbage PMKID on successful
> authentication and denies a subsequent association request that includes
> the PMKID).
>
> Signed-off-by: Bogdan Nicolae <bogdan.nicolae@xxxxxxx>

I always get a bit confused when people use different email addresses to 
send and sign-off patches.
  > ---
>   .../net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c   | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
> index ce09d44fa..cca53ff19 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
> @@ -23,6 +23,8 @@
>   #define MGMT_AUTH_FRAME_DWELL_TIME	4000
>   #define MGMT_AUTH_FRAME_WAIT_TIME	(MGMT_AUTH_FRAME_DWELL_TIME + 100)
>   
> +static atomic_t brcmf_cyw_mgmt_tx_id = ATOMIC_INIT(0);
> +
>   static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp,
>   				 struct cfg80211_crypto_settings *crypto)
>   {
> @@ -155,7 +157,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
>   
>   	memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN);
>   	memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
> -	mf_params->packet_id = cpu_to_le32(*cookie);
> +	mf_params->packet_id = cpu_to_le32(atomic_inc_return(&brcmf_cyw_mgmt_tx_id));

As I understand things the cookie value here is an output parameter. The 
driver should assign it:

+	*cookie = atomic_inc_return(&brcmf_cyw_mgmt_tx_id);
	mf_params->packet_id = cpu_to_le32(*cookie);

>   	memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN],
>   	       le16_to_cpu(mf_params->len));
Regards,
Arend