[PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend van Spriel]

The Infineon chips support external authentication in station mode when
firmware advertises it. The feature that must be present in firmware is
sae_ext. This has been ported from Infineon repository and makes use of
the per-vendor framework. It showcases how things can be organized per
vendor to provide the functionality.

Unfortunately, I have no Infineon device and firmware that makes use of
external auth. This series was submitted earlier as RFT and it was tested
successfully by James Prestwood with iwd after adding a fourth patch to
the series. I would not mind if more testing is done with this series
like using wpa_supplicant instead of iwd.

Arend van Spriel (3):
  wifi: brcmfmac: support per-vendor cfg80211 callbacks and firmware
    events
  wifi: brcmfmac: make per-vendor event map const
  wifi: brcmfmac: cyw: support external SAE authentication in station
    mode

Ting-Ying Li (1):
  wifi: brcmfmac: Fix structure size for WPA3 external SAE

 .../broadcom/brcm80211/brcmfmac/cfg80211.c    |  44 ++-
 .../broadcom/brcm80211/brcmfmac/cfg80211.h    |  25 ++
 .../broadcom/brcm80211/brcmfmac/common.c      |   1 +
 .../broadcom/brcm80211/brcmfmac/core.c        |   2 +
 .../broadcom/brcm80211/brcmfmac/cyw/core.c    | 308 ++++++++++++++++++
 .../brcm80211/brcmfmac/cyw/fwil_types.h       |  87 +++++
 .../broadcom/brcm80211/brcmfmac/feature.c     |   3 +-
 .../broadcom/brcm80211/brcmfmac/feature.h     |   4 +-
 .../broadcom/brcm80211/brcmfmac/fweh.c        |   7 +-
 .../broadcom/brcm80211/brcmfmac/fweh.h        |   8 +-
 .../broadcom/brcm80211/brcmfmac/fwvid.h       |  29 ++
 11 files changed, 495 insertions(+), 23 deletions(-)
 create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/fwil_types.h


base-commit: f600832794c91d7021d7337104734246b02a2b86
-- 
2.43.5

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Peter Robinson]

Hi Arend,

> The Infineon chips support external authentication in station mode when
> firmware advertises it. The feature that must be present in firmware is
> sae_ext. This has been ported from Infineon repository and makes use of
> the per-vendor framework. It showcases how things can be organized per
> vendor to provide the functionality.
>
> Unfortunately, I have no Infineon device and firmware that makes use of
> external auth. This series was submitted earlier as RFT and it was tested
> successfully by James Prestwood with iwd after adding a fourth patch to
> the series. I would not mind if more testing is done with this series
> like using wpa_supplicant instead of iwd.

So I tried testing this on a RPi4 with the upstream linux-firmware
repo, both on Fedora 42 using NetworkManager on top of iwd or
wpa_supplicant.

Now I think this has  the right firmware but TBH I am not 100% sure
but I get the following listed in the "Supported extended features"
section when I run 'iw phy phy0 info':
* [ SAE_OFFLOAD ]: SAE offload support
* [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support

For reference the firmware version is:
brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Apr 15 2021
03:03:20 version 7.45.234 (4ca95bb CY) FWID 01-996384e2

When I was testing with iwd 3.6 it was actually not repporting WPA3 as
an option against my SSIDs, just WPA2 where with wpa_supplicant 2.11
it reports both.

With NM+iwd in use I get an error and nothing happens, if I set sae
for NM+wpa_supplicant I get a lot of the following in the kernel log
and the connection fails:
[ 1141.846900] brcmfmac: brcmf_set_channel: set chanspec 0xd022 fail, reason -52
[ 1141.962815] brcmfmac: brcmf_set_channel: set chanspec 0xd026 fail, reason -52
[ 1142.074828] brcmfmac: brcmf_set_channel: set chanspec 0xd02a fail, reason -52

I will try and find a couple of other devices with an appropriate
cypress/infineon.

Peter

> Arend van Spriel (3):
>   wifi: brcmfmac: support per-vendor cfg80211 callbacks and firmware
>     events
>   wifi: brcmfmac: make per-vendor event map const
>   wifi: brcmfmac: cyw: support external SAE authentication in station
>    de
>
> Ting-Ying Li (1):
>   wifi: brcmfmac: Fix structure size for WPA3 external SAE
>
>  .../broadcom/brcm80211/brcmfmac/cfg80211.c    |  44 ++-
>  .../broadcom/brcm80211/brcmfmac/cfg80211.h    |  25 ++
>  .../broadcom/brcm80211/brcmfmac/common.c      |   1 +
>  .../broadcom/brcm80211/brcmfmac/core.c        |   2 +
>  .../broadcom/brcm80211/brcmfmac/cyw/core.c    | 308 ++++++++++++++++++
>  .../brcm80211/brcmfmac/cyw/fwil_types.h       |  87 +++++
>  .../broadcom/brcm80211/brcmfmac/feature.c     |   3 +-
>  .../broadcom/brcm80211/brcmfmac/feature.h     |   4 +-
>  .../broadcom/brcm80211/brcmfmac/fweh.c        |   7 +-
>  .../broadcom/brcm80211/brcmfmac/fweh.h        |   8 +-
>  .../broadcom/brcm80211/brcmfmac/fwvid.h       |  29 ++
>  11 files changed, 495 insertions(+), 23 deletions(-)
>  create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/fwil_types.h
>
>
> base-commit: f600832794c91d7021d7337104734246b02a2b86
> --
> 2.43.5
>
>

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend Van Spriel]

On April 28, 2025 4:52:48 PM Peter Robinson <pbrobinson@gmail.com> wrote:

> Hi Arend,
>
>> The Infineon chips support external authentication in station mode when
>> firmware advertises it. The feature that must be present in firmware is
>> sae_ext. This has been ported from Infineon repository and makes use of
>> the per-vendor framework. It showcases how things can be organized per
>> vendor to provide the functionality.
>>
>> Unfortunately, I have no Infineon device and firmware that makes use of
>> external auth. This series was submitted earlier as RFT and it was tested
>> successfully by James Prestwood with iwd after adding a fourth patch to
>> the series. I would not mind if more testing is done with this series
>> like using wpa_supplicant instead of iwd.
>
> So I tried testing this on a RPi4 with the upstream linux-firmware
> repo, both on Fedora 42 using NetworkManager on top of iwd or
> wpa_supplicant.
>
> Now I think this has  the right firmware but TBH I am not 100% sure
> but I get the following listed in the "Supported extended features"
> section when I run 'iw phy phy0 info':
> * [ SAE_OFFLOAD ]: SAE offload support
> * [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support
>
> For reference the firmware version is:
> brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Apr 15 2021
> 03:03:20 version 7.45.234 (4ca95bb CY) FWID 01-996384e2
>
> When I was testing with iwd 3.6 it was actually not repporting WPA3 as
> an option against my SSIDs, just WPA2 where with wpa_supplicant 2.11
> it reports both.
>
> With NM+iwd in use I get an error and nothing happens, if I set sae
> for NM+wpa_supplicant I get a lot of the following in the kernel log
> and the connection fails:
> [ 1141.846900] brcmfmac: brcmf_set_channel: set chanspec 0xd022 fail, 
> reason -52
> [ 1141.962815] brcmfmac: brcmf_set_channel: set chanspec 0xd026 fail, 
> reason -52
> [ 1142.074828] brcmfmac: brcmf_set_channel: set chanspec 0xd02a fail, 
> reason -52
>
> I will try and find a couple of other devices with an appropriate
> cypress/infineon.

Thanks for giving the patches a spin. The firmware should have a feature 
named sae_ext. I think the one you with iw are indicating same support in 
general.

You can check the firmware features in debugfs under 
<mount>/ieee80211/phyX/fwcap.

Regards,
Arend
>
>
>> Arend van Spriel (3):
>> wifi: brcmfmac: support per-vendor cfg80211 callbacks and firmware
>> events
>> wifi: brcmfmac: make per-vendor event map const
>> wifi: brcmfmac: cyw: support external SAE authentication in station
>> de
>>
>> Ting-Ying Li (1):
>> wifi: brcmfmac: Fix structure size for WPA3 external SAE
>>
>> .../broadcom/brcm80211/brcmfmac/cfg80211.c    |  44 ++-
>> .../broadcom/brcm80211/brcmfmac/cfg80211.h    |  25 ++
>> .../broadcom/brcm80211/brcmfmac/common.c      |   1 +
>> .../broadcom/brcm80211/brcmfmac/core.c        |   2 +
>> .../broadcom/brcm80211/brcmfmac/cyw/core.c    | 308 ++++++++++++++++++
>> .../brcm80211/brcmfmac/cyw/fwil_types.h       |  87 +++++
>> .../broadcom/brcm80211/brcmfmac/feature.c     |   3 +-
>> .../broadcom/brcm80211/brcmfmac/feature.h     |   4 +-
>> .../broadcom/brcm80211/brcmfmac/fweh.c        |   7 +-
>> .../broadcom/brcm80211/brcmfmac/fweh.h        |   8 +-
>> .../broadcom/brcm80211/brcmfmac/fwvid.h       |  29 ++
>> 11 files changed, 495 insertions(+), 23 deletions(-)
>> create mode 100644 
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/fwil_types.h
>>
>>
>> base-commit: f600832794c91d7021d7337104734246b02a2b86
>> --
>> 2.43.5

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Peter Robinson]

> > I will try and find a couple of other devices with an appropriate
> > cypress/infineon.
>
> Thanks for giving the patches a spin. The firmware should have a feature
> named sae_ext. I think the one you with iw are indicating same support in
> general.

I am not so sure.

RPi4 (BCM4345/6 - 7.45.234 (4ca95bb CY) FWID 01-996384e2)
        Supported extended features:
                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
                * [ 4WAY_HANDSHAKE_STA_PSK ]: 4-way handshake with PSK
in station mode
                * [ 4WAY_HANDSHAKE_STA_1X ]: 4-way handshake with
802.1X in station mode
                * [ DFS_OFFLOAD ]: DFS offload
                * [ SAE_OFFLOAD ]: SAE offload support
                * [ 4WAY_HANDSHAKE_AP_PSK ]: AP mode PSK offload support
                * [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support

Jetson TX1 (BCM4354/1 - fw 7.35.349.104 (775a9ab CY) FWID 01-d55901b0):
        Supported extended features:
                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
                * [ DFS_OFFLOAD ]: DFS offload

So I have different brcmfmac HW reporting different features.

> You can check the firmware features in debugfs under
> <mount>/ieee80211/phyX/fwcap.

I don't get fwcap on either of the above devices:

ls /sys/kernel/debug/ieee80211/phy0/
fragmentation_threshold  ht40allow_map  long_retry_limit
rts_threshold  short_retry_limit

Peter

Peter

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend Van Spriel]

On April 29, 2025 10:19:00 AM Peter Robinson <pbrobinson@gmail.com> wrote:

>>> I will try and find a couple of other devices with an appropriate
>>> cypress/infineon.
>>
>> Thanks for giving the patches a spin. The firmware should have a feature
>> named sae_ext. I think the one you with iw are indicating same support in
>> general.
>
> I am not so sure.
>
> RPi4 (BCM4345/6 - 7.45.234 (4ca95bb CY) FWID 01-996384e2)
>        Supported extended features:
>                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
>                * [ 4WAY_HANDSHAKE_STA_PSK ]: 4-way handshake with PSK
> in station mode
>                * [ 4WAY_HANDSHAKE_STA_1X ]: 4-way handshake with
> 802.1X in station mode
>                * [ DFS_OFFLOAD ]: DFS offload
>                * [ SAE_OFFLOAD ]: SAE offload support
>                * [ 4WAY_HANDSHAKE_AP_PSK ]: AP mode PSK offload support
>                * [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support
>
> Jetson TX1 (BCM4354/1 - fw 7.35.349.104 (775a9ab CY) FWID 01-d55901b0):
>        Supported extended features:
>                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
>                * [ DFS_OFFLOAD ]: DFS offload
>
> So I have different brcmfmac HW reporting different features.
>
>> You can check the firmware features in debugfs under
>> <mount>/ieee80211/phyX/fwcap.
>
> I don't get fwcap on either of the above devices:
>
> ls /sys/kernel/debug/ieee80211/phy0/
> fragmentation_threshold  ht40allow_map  long_retry_limit
> rts_threshold  short_retry_limit

Ah, yes. My bad. They are only created if CONFIG_BRCMDBG is selected.

Regards,
Arend

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend van Spriel]

On 4/29/2025 10:55 AM, Arend Van Spriel wrote:
> On April 29, 2025 10:19:00 AM Peter Robinson <pbrobinson@gmail.com> wrote:
> 
>>>> I will try and find a couple of other devices with an appropriate
>>>> cypress/infineon.
>>>
>>> Thanks for giving the patches a spin. The firmware should have a feature
>>> named sae_ext. I think the one you with iw are indicating same 
>>> support in
>>> general.
>>
>> I am not so sure.

Sorry for the confusion. Damn autocorrect. "Indicating same support" 
should have been "Indicating sae support". SAE offload support means 
that firmware is doing everything, ie. SAE handshake and 4-way handshake 
(if not mistaken). SAE external auth offloads the SAE handshake to 
user-space.

>> RPi4 (BCM4345/6 - 7.45.234 (4ca95bb CY) FWID 01-996384e2)
>>        Supported extended features:
>>                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
>>                * [ 4WAY_HANDSHAKE_STA_PSK ]: 4-way handshake with PSK
>> in station mode
>>                * [ 4WAY_HANDSHAKE_STA_1X ]: 4-way handshake with
>> 802.1X in station mode
>>                * [ DFS_OFFLOAD ]: DFS offload
>>                * [ SAE_OFFLOAD ]: SAE offload support
>>                * [ 4WAY_HANDSHAKE_AP_PSK ]: AP mode PSK offload support
>>                * [ SAE_OFFLOAD_AP ]: AP mode SAE authentication 
>> offload support

I think you mentioned earlier this one ends with an error. So SAE is not 
working with that firmware despite the claim. How about WPA2? These 
patches should not affect that, but better check if it does not cause a 
regression.

>> Jetson TX1 (BCM4354/1 - fw 7.35.349.104 (775a9ab CY) FWID 01-d55901b0):
>>        Supported extended features:
>>                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
>>                * [ DFS_OFFLOAD ]: DFS offload
>>
>> So I have different brcmfmac HW reporting different features.
>>
>>> You can check the firmware features in debugfs under
>>> <mount>/ieee80211/phyX/fwcap.
>>
>> I don't get fwcap on either of the above devices:
>>
>> ls /sys/kernel/debug/ieee80211/phy0/
>> fragmentation_threshold  ht40allow_map  long_retry_limit
>> rts_threshold  short_retry_limit
> 
> Ah, yes. My bad. They are only created if CONFIG_BRCMDBG is selected.

Appreciate the help.

Regards,
Arend

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Tim Harvey]

Hi Arend,

Thanks for this series! This allows WPA3 Personal in STA mode on a
CYW4373E based module we use on our boards however AP mode with WPA3
Personal does not appear to work. Do you know what is needed to allow
WPA3 Personal in a CYW4373E AP?

Best Regards,

Tim

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend Van Spriel]

On May 16, 2025 2:38:51 AM Tim Harvey <tharvey@gateworks.com> wrote:

> Hi Arend,
>
> Thanks for this series! This allows WPA3 Personal in STA mode on a
> CYW4373E based module we use on our boards however AP mode with WPA3
> Personal does not appear to work. Do you know what is needed to allow
> WPA3 Personal in a CYW4373E AP?

Hi Tim,

I did not look into AP mode (yet). Are you using hostapd as authenticator. 
Can you provide the conf file?

Regards,
Arend

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Tim Harvey]

On Thu, May 15, 2025 at 10:27 PM Arend Van Spriel
<arend.vanspriel@broadcom.com> wrote:
>
> On May 16, 2025 2:38:51 AM Tim Harvey <tharvey@gateworks.com> wrote:
>
> > Hi Arend,
> >
> > Thanks for this series! This allows WPA3 Personal in STA mode on a
> > CYW4373E based module we use on our boards however AP mode with WPA3
> > Personal does not appear to work. Do you know what is needed to allow
> > WPA3 Personal in a CYW4373E AP?
>
> Hi Tim,
>
> I did not look into AP mode (yet). Are you using hostapd as authenticator.
> Can you provide the conf file?
>

Hi Arend,

Yes, I'm using hostapd for AP and wpa_supplicant for STA and now I'm
thinking this is likely an issue with one of them and not the brcmfmac
driver although there are always relationships between hostap and the
drivers so it's hard to say. With more testing I've found that the
issue does not occur all the time... in fact it was difficult to make
it occur again.

Here is some more context:
- board: imx8mm-venice-gw73xx
- device: Ezurio Sterling LWB5+ (SDIO single-antenna using CYW4373E)

- testing using latest linux-wireless:
# uname -r
6.15.0-rc5-01256-g68b44b05f4c8
# ls -l /sys/class/net/wlan*
lrwxrwxrwx 1 root root 0 May 16 19:54 /sys/class/net/wlan0 ->
../../devices/platform/soc@0/30800000.bus/30b40000.mm
c/mmc_host/mmc0/mmc0:0001/mmc0:0001:1/net/wlan0
# dmesg | grep brcmfmac
[    1.345277] brcmfmac: brcmf_fw_alloc_request: using
brcm/brcmfmac4373-sdio for chip BCM4373/0
[    3.976263] brcmfmac mmc0:0001:1: Direct firmware load for
brcm/brcmfmac4373-sdio.gw,imx8mm-gw73xx-0x.bin failed
 with error -2
[    4.146166] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob
available (err=-2)
[    4.146642] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4373/0
wl0: Apr 18 2024 00:20:43 version 13.10.246.343
 (72478a2 CY) FWID 01-bd87f673
# iw phy | grep SAE
        Device supports SAE with AUTHENTICATE command

- on STA:
# iw reg set US
# wpa_supplicant -v
wpa_supplicant v2.11
Copyright (c) 2003-2024, Jouni Malinen <j@w1.fi> and contributors
# cat wpa_supplicant.conf
network={
        ssid="wpa3test"
        key_mgmt=SAE
        sae_password="012345678"
        ieee80211w=2
}
# wpa_supplicant -t -i wlan0 -c wpa_supplicant.conf
1747433610.388391: Successfully initialized wpa_supplicant
1747433621.394128: wlan0: Trying to associate with SSID 'wpa3test'
1747433626.465446: wlan0: PMKSA-CACHE-ADDED c0:ee:40:da:39:d6 0
1747433626.481277: wlan0: Associated with c0:ee:40:da:39:d6
1747433626.481786: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
1747433626.487603: wlan0: WPA: RSNXE mismatch between Beacon/ProbeResp
and EAPOL-Key msg 3/4
1747433626.487627: RSNXE in Beacon/ProbeResp - hexdump(len=3): f4 01 20
1747433626.487647: RSNXE in EAPOL-Key msg 3/4 - hexdump(len=0): [NULL]
1747433626.488175: nl80211: send_event_marker failed: Source based
routing not supported
1747433626.488215: wlan0: CTRL-EVENT-DISCONNECTED
bssid=c0:ee:40:da:39:d6 reason=17 locally_generated=1
1747433626.488261: wlan0: Added BSSID c0:ee:40:da:39:d6 into ignore
list, ignoring for 10 seconds
1747433626.488349: wlan0: CTRL-EVENT-DSCP-POLICY clear_all
1747433626.488397: wlan0: CTRL-EVENT-DSCP-POLICY clear_all
1747433626.490356: wlan0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
^^^ this is the point where I will see the 'associated' message from
hostapd, but then with a couple of seconds hostapd prints a series of
'disassociated' messaged in quick succession
1747433629.491254: wlan0: Removed BSSID c0:ee:40:da:39:d6 from ignore
list (clear)
1747433629.491551: wlan0: Trying to associate with SSID 'wpa3test'
1747433629.656365: wlan0: Associated with c0:ee:40:da:39:d6
1747433629.656455: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
1747433631.711703: wlan0: CTRL-EVENT-DISCONNECTED
bssid=c0:ee:40:da:39:d6 reason=6
1747433631.711812: wlan0: Added BSSID c0:ee:40:da:39:d6 into ignore
list, ignoring for 10 seconds
1747433631.713066: wlan0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
1747433634.715053: wlan0: Removed BSSID c0:ee:40:da:39:d6 from ignore
list (clear)
...
at this point I need to restart wpa_supplicant in order to see any
hostapd messages

- on AP:
# iw reg set US
# hostapd -v
hostapd v2.11
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi> and contributors
# cat hostapd.conf
interface=wlan0
driver=nl80211
ssid=wpa3test
hw_mode=g
channel=6
country_code=US
ieee80211n=1
wmm_enabled=1
auth_algs=1
wpa=2
wpa_key_mgmt=SAE
wpa_pairwise=CCMP
rsn_pairwise=CCMP
sae_password=012345678
ieee80211w=2
# -t hostapd -i wlan0 hostapd.conf &
1747433608.079907: wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
1747433613.321142: wlan0: interface state COUNTRY_UPDATE->ENABLED
1747433613.321229: wlan0: AP-ENABLED
1747433627.270790: 1747433627.270796: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: associated
1747433631.306003: 1747433631.306008: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433631.307505: 1747433631.307509: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433631.508982: 1747433631.508985: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433631.708937: 1747433631.708939: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433631.908929: 1747433631.908931: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433632.108885: 1747433632.108887: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433632.308912: 1747433632.308914: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433632.508999: 1747433632.509001: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated
1747433634.488061: 1747433634.488066: wlan0: STA c0:ee:40:83:06:2a
IEEE 802.11: disassociated

you can see from the hostapd timestamps that the disassociated
messages are in quick succession which is odd. When this occurs
wpa_supplicant appears to keep trying yet I no longer see any messages
from hostapd unless I restart wpa_supplicant. Additionally when this
occurs it will never stay associated unless I restart hostapd.

I've found the same behavior using hostapd/wpa_supplicant v2.10 as
well as 2.11. Any ideas what's going on here? The
'CTRL-EVENT-DISCONNECTED' with reason=6 I'm finding is usually due to
a client sending data before authentication is complete and is usually
chalked up to a driver bug.

Incidentally, while looking at this I noticed if you enable
CONFIG_FORTIFY_SOURCE you'll get a splat from the memcpy in function
you added in your patch:
[  161.608607] ------------[ cut here ]------------
[  161.608646] memcpy: detected field-spanning write (size 104) of
single field "&mgmt_frame->u" at drivers/net/wir
eless/broadcom/brcm80211/brcmfmac/cyw/core.c:307 (size 26)
[  161.608712] WARNING: CPU: 1 PID: 64 at
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:307
brcmf_not
ify_auth_frame_rx+0x1f4/0x210
[  161.647854] CPU: 1 UID: 0 PID: 64 Comm: kworker/1:2 Not tainted
6.15.0-rc5-01256-g68b44b05f4c8 #153 PREEMPT
[  161.657699] Hardware name: Gateworks Venice GW73xx-0x i.MX8MM
Development Kit (DT)
[  161.665279] Workqueue: events brcmf_fweh_event_worker
[  161.670348] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  161.677322] pc : brcmf_notify_auth_frame_rx+0x1f4/0x210
[  161.682557] lr : brcmf_notify_auth_frame_rx+0x1f4/0x210
[  161.687789] sp : ffff80008065bc30
[  161.691107] x29: ffff80008065bc30 x28: ffffabb0a8e7d270 x27: ffff1f01c0b0c8c0
[  161.698269] x26: dead000000000100 x25: dead000000000122 x24: ffff80008065bd58
[  161.705426] x23: ffff1f01c03bc008 x22: ffff1f01c114b750 x21: 0000000000000080
[  161.712587] x20: 0000000000000068 x19: ffff1f01c02c7f80 x18: 0000000000000030
[  161.719744] x17: 0000000000000000 x16: 0000000000000000 x15: 00000000ffffffff
[  161.726903] x14: 000000000000000d x13: 7720676e696e6e61 x12: 00000000ffffffea
[  161.734062] x11: ffff80008065b9f8 x10: ffffabb0a93242c0 x9 : 0000000000000001
[  161.741220] x8 : 0000000000000001 x7 : c0000000ffffefff x6 : 0000000000017fe8
[  161.748376] x5 : ffff1f01ff775808 x4 : 0000000000000000 x3 : 0000000000000027
[  161.755536] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1f01c028a080
[  161.762696] Call trace:
[  161.765151]  brcmf_notify_auth_frame_rx+0x1f4/0x210 (P)
[  161.770391]  brcmf_fweh_call_event_handler+0x40/0xc0
[  161.775368]  brcmf_fweh_event_worker+0x158/0x3b8
[  161.779999]  process_one_work+0x16c/0x2bc
[  161.784024]  worker_thread+0x2dc/0x3dc
[  161.787784]  kthread+0x130/0x200
[  161.791028]  ret_from_fork+0x10/0x20
[  161.794618] ---[ end trace 0000000000000000 ]---

Maybe you can submit a patch for that.

Best regards,

Tim

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend van Spriel]

On 5/17/2025 1:38 AM, Tim Harvey wrote:
> Yes, I'm using hostapd for AP and wpa_supplicant for STA and now I'm
> thinking this is likely an issue with one of them and not the brcmfmac
> driver although there are always relationships between hostap and the
> drivers so it's hard to say. With more testing I've found that the
> issue does not occur all the time... in fact it was difficult to make
> it occur again.
> 
> Here is some more context:
> - board: imx8mm-venice-gw73xx
> - device: Ezurio Sterling LWB5+ (SDIO single-antenna using CYW4373E)

So you have two identical device running with brcmfmac driver and one is 
playing the role of AP and the other STA. Is that correct?

Regards,
Arend

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend van Spriel]

On 5/17/2025 1:38 AM, Tim Harvey wrote:
> Incidentally, while looking at this I noticed if you enable
> CONFIG_FORTIFY_SOURCE you'll get a splat from the memcpy in function
> you added in your patch:
> [  161.608607] ------------[ cut here ]------------
> [  161.608646] memcpy: detected field-spanning write (size 104) of
> single field "&mgmt_frame->u" at drivers/net/wir
> eless/broadcom/brcm80211/brcmfmac/cyw/core.c:307 (size 26)
> [  161.608712] WARNING: CPU: 1 PID: 64 at
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:307
> brcmf_not
> ify_auth_frame_rx+0x1f4/0x210
> [  161.647854] CPU: 1 UID: 0 PID: 64 Comm: kworker/1:2 Not tainted
> 6.15.0-rc5-01256-g68b44b05f4c8 #153 PREEMPT
> [  161.657699] Hardware name: Gateworks Venice GW73xx-0x i.MX8MM
> Development Kit (DT)
> [  161.665279] Workqueue: events brcmf_fweh_event_worker
> [  161.670348] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [  161.677322] pc : brcmf_notify_auth_frame_rx+0x1f4/0x210
> [  161.682557] lr : brcmf_notify_auth_frame_rx+0x1f4/0x210
> [  161.687789] sp : ffff80008065bc30
> [  161.691107] x29: ffff80008065bc30 x28: ffffabb0a8e7d270 x27: ffff1f01c0b0c8c0
> [  161.698269] x26: dead000000000100 x25: dead000000000122 x24: ffff80008065bd58
> [  161.705426] x23: ffff1f01c03bc008 x22: ffff1f01c114b750 x21: 0000000000000080
> [  161.712587] x20: 0000000000000068 x19: ffff1f01c02c7f80 x18: 0000000000000030
> [  161.719744] x17: 0000000000000000 x16: 0000000000000000 x15: 00000000ffffffff
> [  161.726903] x14: 000000000000000d x13: 7720676e696e6e61 x12: 00000000ffffffea
> [  161.734062] x11: ffff80008065b9f8 x10: ffffabb0a93242c0 x9 : 0000000000000001
> [  161.741220] x8 : 0000000000000001 x7 : c0000000ffffefff x6 : 0000000000017fe8
> [  161.748376] x5 : ffff1f01ff775808 x4 : 0000000000000000 x3 : 0000000000000027
> [  161.755536] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1f01c028a080
> [  161.762696] Call trace:
> [  161.765151]  brcmf_notify_auth_frame_rx+0x1f4/0x210 (P)
> [  161.770391]  brcmf_fweh_call_event_handler+0x40/0xc0
> [  161.775368]  brcmf_fweh_event_worker+0x158/0x3b8
> [  161.779999]  process_one_work+0x16c/0x2bc
> [  161.784024]  worker_thread+0x2dc/0x3dc
> [  161.787784]  kthread+0x130/0x200
> [  161.791028]  ret_from_fork+0x10/0x20
> [  161.794618] ---[ end trace 0000000000000000 ]---
> 
> Maybe you can submit a patch for that.

Okay. I do not run with that Kconfig option. Will have to look into how 
to fix this. Probably need some kind of annotation. If you know what is 
needed feel free to post a patch for it.

Thanks,
Arend

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Johannes Berg]

On Sun, 2025-05-25 at 11:47 +0200, Arend van Spriel wrote:
> 
> > [  161.608607] ------------[ cut here ]------------
> > [  161.608646] memcpy: detected field-spanning write (size 104) of
> > single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:307 (size 26)
> 
> Okay. I do not run with that Kconfig option. Will have to look into how 
> to fix this. Probably need some kind of annotation. If you know what is 
> needed feel free to post a patch for it.

I think just copy to mgmt_frame->u.body instead of ->u itself.

johannes

Re: [PATCH wireless-next v3 0/4] wifi: brcmfmac: external auth support for Infineon devices

[Arend van Spriel]

On 5/25/2025 2:24 PM, Johannes Berg wrote:
> On Sun, 2025-05-25 at 11:47 +0200, Arend van Spriel wrote:
>>
>>> [  161.608607] ------------[ cut here ]------------
>>> [  161.608646] memcpy: detected field-spanning write (size 104) of
>>> single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:307 (size 26)
>>
>> Okay. I do not run with that Kconfig option. Will have to look into how
>> to fix this. Probably need some kind of annotation. If you know what is
>> needed feel free to post a patch for it.
> 
> I think just copy to mgmt_frame->u.body instead of ->u itself.

My gutt feeling was telling me the same when I was looking at it 
earlier. Thanks for the confirmation although your phrasing seems 
cautious ;-)

Regards,
Arend