[PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
driver never told the firmware which SAE Password Element (PWE) method to
accept. The firmware was observed to corrupt its heap over time due to
this omission, leading to firmware trap (data abort in heap allocator).

Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
membership selector is present, 0 otherwise. This matches the behaviour
of the upstream/vendor driver and only applies to SAE-capable APs when
external SAE is supported.

Signed-off-by: Bogdan Nicolae <bogdan.nicolae@gmail.com>
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d32b35ce0..335647916 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -60,6 +60,10 @@
 #define RSN_AKM_SHA256_1X		5	/* SHA256, 802.1X */
 #define RSN_AKM_SHA256_PSK		6	/* SHA256, Pre-shared Key */
 #define RSN_AKM_SAE			8	/* SAE */
+#define BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY 123
+#define BSS_MEMBERSHIP_SELECTOR_SET	0x80
+#define SAE_H2E_ONLY_ENABLE		(BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY | \
+					 BSS_MEMBERSHIP_SELECTOR_SET)
 #define RSN_CAP_LEN			2	/* Length of RSN capabilities */
 #define RSN_CAP_PTK_REPLAY_CNTR_MASK	(BIT(2) | BIT(3))
 #define RSN_CAP_MFPR_MASK		BIT(6)
@@ -5091,6 +5095,73 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 	return err;
 }
 
+static s32
+brcmf_parse_configure_sae_pwe(struct brcmf_if *ifp,
+			      struct cfg80211_ap_settings *settings)
+{
+	s32 err = 0;
+	const struct brcmf_tlv *rsnx_ie;
+	const struct brcmf_tlv *ext_rate_ie;
+	const struct brcmf_tlv *supp_rate_ie;
+	u8 ie_len, i;
+	u32 wpa_auth = 0;
+	/* SAE PWE method(s) to accept: 0 = Hunting-and-Pecking only,
+	 * 1 = H2E only, 2 = both.
+	 */
+	u32 sae_pwe = 0;
+
+	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT))
+		return 0;
+
+	err = brcmf_fil_bsscfg_int_get(ifp, "wpa_auth", &wpa_auth);
+	if (err || (wpa_auth & WPA3_AUTH_SAE_PSK) == 0) {
+		brcmf_dbg(INFO, "wpa_auth is not SAE:0x%x\n", wpa_auth);
+		return 0;
+	}
+
+	rsnx_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+				   settings->beacon.tail_len, WLAN_EID_RSNX);
+	if (rsnx_ie && rsnx_ie->len &&
+	    (rsnx_ie->data[0] & WLAN_RSNX_CAPA_SAE_H2E))
+		sae_pwe = 2;
+
+	if (sae_pwe == 2) {
+		supp_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.head,
+						settings->beacon.head_len,
+						WLAN_EID_SUPP_RATES);
+		ext_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+					       settings->beacon.tail_len,
+					       WLAN_EID_EXT_SUPP_RATES);
+		if (ext_rate_ie) {
+			ie_len = ext_rate_ie->len;
+			for (i = 0; i < ie_len; i++) {
+				if (ext_rate_ie->data[i] == SAE_H2E_ONLY_ENABLE) {
+					sae_pwe = 1;
+					break;
+				}
+			}
+		}
+		if (sae_pwe == 2 && supp_rate_ie) {
+			ie_len = supp_rate_ie->len;
+			for (i = 0; i < ie_len; i++) {
+				if (supp_rate_ie->data[i] == SAE_H2E_ONLY_ENABLE) {
+					sae_pwe = 1;
+					break;
+				}
+			}
+		}
+	}
+
+	err = brcmf_fil_iovar_int_set(ifp, "extsae_pwe", sae_pwe);
+	if (err) {
+		brcmf_err("extsae_pwe iovar not supported\n");
+		return -EOPNOTSUPP;
+	}
+
+	brcmf_dbg(INFO, "extsae_pwe=%u\n", sae_pwe);
+	return 0;
+}
+
 static s32
 brcmf_parse_configure_security(struct brcmf_if *ifp,
 			       struct cfg80211_ap_settings *settings,
@@ -5124,6 +5195,10 @@ brcmf_parse_configure_security(struct brcmf_if *ifp,
 			err = brcmf_configure_wpaie(ifp, tmp_ie, true);
 			if (err < 0)
 				return err;
+
+			err = brcmf_parse_configure_sae_pwe(ifp, settings);
+			if (err < 0)
+				return err;
 		}
 	} else {
 		brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
-- 
2.55.0

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

On 29/07/2026 07:34, Bogdan Nicolae wrote:
> When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> driver never told the firmware which SAE Password Element (PWE) method to
> accept. The firmware was observed to corrupt its heap over time due to
> this omission, leading to firmware trap (data abort in heap allocator).
> 
> Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> membership selector is present, 0 otherwise. This matches the behaviour
> of the upstream/vendor driver and only applies to SAE-capable APs when
> external SAE is supported.

This makes sense, but may I ask what device do you have? Suspect it is a 
Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca) 
code base so I suspect it is vendor specific.

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Gokul Sivakumar]

On 07/29, Arend van Spriel wrote:
> On 29/07/2026 07:34, Bogdan Nicolae wrote:
> > When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> > driver never told the firmware which SAE Password Element (PWE) method to
> > accept. The firmware was observed to corrupt its heap over time due to
> > this omission, leading to firmware trap (data abort in heap allocator).
> > 
> > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> > membership selector is present, 0 otherwise. This matches the behaviour
> > of the upstream/vendor driver and only applies to SAE-capable APs when
> > external SAE is supported.
> 
> This makes sense, but may I ask what device do you have? Suspect it is a
> Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca)
> code base so I suspect it is vendor specific.

Arend, yes, this an Infineon vendor specific Firmware IOVAR. Seems like
he got the patch from Infineon's downstream brcmfmac github and applied
it on upstream brcmfmac driver as it is with minor changes.

Bogdan, from Infineon we are currently working on a patch to adopt our
"extsae_pwe" vendor changes for the upstream brcmfmac driver. Because it
can't be applied as it is on upstream brcmfmac without affecting other
firmware vendors.

We will submit our "extsae_pwe" patch for upstream review in a few days.
Kindly wait.

Regards,
Gokul

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

On 29/07/2026 13:48, Bogdan Nicolae wrote:
>> On Wed, Jul 29, 2026, 04:48 Arend van Spriel 
>> <arend.vanspriel@broadcom.com <mailto:arend.vanspriel@broadcom.com>> wrote:
>> 
>>     On 29/07/2026 07:34, Bogdan Nicolae wrote:
>>      > When bringing up a WPA3-SAE SoftAP with external (user space)
>>     SAE, the
>>      > driver never told the firmware which SAE Password Element (PWE)
>>     method to
>>      > accept. The firmware was observed to corrupt its heap over time
>>     due to
>>      > this omission, leading to firmware trap (data abort in heap
>>     allocator).
>>      >
>>      > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
>>      > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
>>      > membership selector is present, 0 otherwise. This matches the
>>     behaviour
>>      > of the upstream/vendor driver and only applies to SAE-capable APs
>>     when
>>      > external SAE is supported.
>> 
>>     This makes sense, but may I ask what device do you have? Suspect it
>>     is a
>>     Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca)
>>     code base so I suspect it is vendor specific.
> Hi Arend,
> 
> Indeed, this is a bcm43455 as found on Raspberry Pi SoCs.
Than we should only invoke the parse function for cyw vendor.

Regards,
Arend