Re: brcmfmac: regression using AP mode

[Arend van Spriel <arend.vanspriel@broadcom.com>]

On 11/25/2018 2:14 PM, Stefan Wahren wrote:
> Hi Rafał,
>
>> Rafał Miłecki <rafal@milecki.pl> hat am 24. November 2018 um 22:23 geschrieben:
>>
>>
>> Possibly you can just update hostapd to anything more recent? I'm afraid
>> the version you're using may suffer from a lot of security issues anyway
>
> thanks for your quick reply. I updated hostapd to 2.6.18 from Debian Buster. This makes hostapd work better, but AP mode still does work (kernel output):
>
> [    6.085594] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
> [    6.085772] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
> [    6.085781] cfg80211: failed to load regulatory.db
> [    6.148788] Console: switching to colour frame buffer device 240x67
> [    6.170518] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
> [    6.197752] vc4-drm soc:gpu: fb0: DRM emulated frame buffer device
> [    6.324425] random: crng init done
> [    6.324438] random: 7 urandom warning(s) missed due to ratelimiting
> [    6.365083] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
> [    6.398502] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Feb 27 2018 03:15:32 version 7.45.154 (r684107 CY) FWID 01-4fbe0b04
> [    6.800404] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0252
> [    9.961790] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
> [   10.026130] Adding 102396k swap on /var/swap.  Priority:-2 extents:1 across:102396k SS
> [   10.272507] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
> [   13.627905] brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
> [  146.411501] brcmfmac: brcmf_escan_timeout: timer expired
> [  146.862393] brcmfmac: brcmf_vif_set_mgmt_ie: vndr ie set error : -52
> [  257.130466] brcmfmac: brcmf_escan_timeout: timer expired
> [  257.581463] brcmfmac: brcmf_vif_set_mgmt_ie: vndr ie set error : -52
>
> Hostapd output:
>
> random: Trying to read entropy from /dev/random
> Configuration file: /etc/hostapd/hostapd.conf
> nl80211: Using driver-based roaming
> nl80211: TDLS supported
> nl80211: Supported cipher 00-0f-ac:1
> nl80211: Supported cipher 00-0f-ac:5
> nl80211: Supported cipher 00-0f-ac:2
> nl80211: Supported cipher 00-0f-ac:4
> nl80211: Supported cipher 00-0f-ac:6
> nl80211: Using driver-based off-channel TX
> nl80211: Supported vendor command: vendor_id=0x1018 subcmd=1
> nl80211: Use separate P2P group interface (driver advertised support)
> nl80211: Enable multi-channel concurrent (driver advertised support)
> nl80211: use P2P_DEVICE support
> nl80211: interface wlan0 in phy phy0
> nl80211: Set mode ifindex 3 iftype 3 (AP)
> nl80211: Setup AP(wlan0) - device_ap_sme=1 use_monitor=0
> nl80211: Subscribe to mgmt frames with AP handle 0x543340 (device SME)
> nl80211: Register frame type=0xd0 (WLAN_FC_STYPE_ACTION) nl_handle=0x543340 match=04
> nl80211: Register frame command failed (type=208): ret=-22 (Invalid argument)

Probably the mgmt_stypes is not properly set:

         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
                 return -EINVAL;

which makes sense as brcmfmac has following:

static const struct ieee80211_txrx_stypes
brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
         [NL80211_IFTYPE_STATION] = {
                 .tx = 0xffff,
                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
         },
         [NL80211_IFTYPE_P2P_CLIENT] = {
                 .tx = 0xffff,
                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
         },
         [NL80211_IFTYPE_P2P_GO] = {
                 .tx = 0xffff,
                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
                       BIT(IEEE80211_STYPE_AUTH >> 4) |
                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                       BIT(IEEE80211_STYPE_ACTION >> 4)
         },
         [NL80211_IFTYPE_P2P_DEVICE] = {
                 .tx = 0xffff,
                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
         }
};

So no AP listed here. I suspect Rafał was focusing on "device_ap_sme=1 
use_monitor=1" scenario. You can try adding AP entry with similar rx 
bits as P2P_GO above.

Regards,
Arend