[PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
driver never told the firmware which SAE Password Element (PWE) method to
accept. The firmware was observed to corrupt its heap over time due to
this omission, leading to firmware trap (data abort in heap allocator).

Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
membership selector is present, 0 otherwise. This matches the behaviour
of the upstream/vendor driver and only applies to SAE-capable APs when
external SAE is supported.

Signed-off-by: Bogdan Nicolae <bogdan.nicolae@gmail.com>
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d32b35ce0..335647916 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -60,6 +60,10 @@
 #define RSN_AKM_SHA256_1X		5	/* SHA256, 802.1X */
 #define RSN_AKM_SHA256_PSK		6	/* SHA256, Pre-shared Key */
 #define RSN_AKM_SAE			8	/* SAE */
+#define BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY 123
+#define BSS_MEMBERSHIP_SELECTOR_SET	0x80
+#define SAE_H2E_ONLY_ENABLE		(BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY | \
+					 BSS_MEMBERSHIP_SELECTOR_SET)
 #define RSN_CAP_LEN			2	/* Length of RSN capabilities */
 #define RSN_CAP_PTK_REPLAY_CNTR_MASK	(BIT(2) | BIT(3))
 #define RSN_CAP_MFPR_MASK		BIT(6)
@@ -5091,6 +5095,73 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 	return err;
 }
 
+static s32
+brcmf_parse_configure_sae_pwe(struct brcmf_if *ifp,
+			      struct cfg80211_ap_settings *settings)
+{
+	s32 err = 0;
+	const struct brcmf_tlv *rsnx_ie;
+	const struct brcmf_tlv *ext_rate_ie;
+	const struct brcmf_tlv *supp_rate_ie;
+	u8 ie_len, i;
+	u32 wpa_auth = 0;
+	/* SAE PWE method(s) to accept: 0 = Hunting-and-Pecking only,
+	 * 1 = H2E only, 2 = both.
+	 */
+	u32 sae_pwe = 0;
+
+	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE_EXT))
+		return 0;
+
+	err = brcmf_fil_bsscfg_int_get(ifp, "wpa_auth", &wpa_auth);
+	if (err || (wpa_auth & WPA3_AUTH_SAE_PSK) == 0) {
+		brcmf_dbg(INFO, "wpa_auth is not SAE:0x%x\n", wpa_auth);
+		return 0;
+	}
+
+	rsnx_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+				   settings->beacon.tail_len, WLAN_EID_RSNX);
+	if (rsnx_ie && rsnx_ie->len &&
+	    (rsnx_ie->data[0] & WLAN_RSNX_CAPA_SAE_H2E))
+		sae_pwe = 2;
+
+	if (sae_pwe == 2) {
+		supp_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.head,
+						settings->beacon.head_len,
+						WLAN_EID_SUPP_RATES);
+		ext_rate_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+					       settings->beacon.tail_len,
+					       WLAN_EID_EXT_SUPP_RATES);
+		if (ext_rate_ie) {
+			ie_len = ext_rate_ie->len;
+			for (i = 0; i < ie_len; i++) {
+				if (ext_rate_ie->data[i] == SAE_H2E_ONLY_ENABLE) {
+					sae_pwe = 1;
+					break;
+				}
+			}
+		}
+		if (sae_pwe == 2 && supp_rate_ie) {
+			ie_len = supp_rate_ie->len;
+			for (i = 0; i < ie_len; i++) {
+				if (supp_rate_ie->data[i] == SAE_H2E_ONLY_ENABLE) {
+					sae_pwe = 1;
+					break;
+				}
+			}
+		}
+	}
+
+	err = brcmf_fil_iovar_int_set(ifp, "extsae_pwe", sae_pwe);
+	if (err) {
+		brcmf_err("extsae_pwe iovar not supported\n");
+		return -EOPNOTSUPP;
+	}
+
+	brcmf_dbg(INFO, "extsae_pwe=%u\n", sae_pwe);
+	return 0;
+}
+
 static s32
 brcmf_parse_configure_security(struct brcmf_if *ifp,
 			       struct cfg80211_ap_settings *settings,
@@ -5124,6 +5195,10 @@ brcmf_parse_configure_security(struct brcmf_if *ifp,
 			err = brcmf_configure_wpaie(ifp, tmp_ie, true);
 			if (err < 0)
 				return err;
+
+			err = brcmf_parse_configure_sae_pwe(ifp, settings);
+			if (err < 0)
+				return err;
 		}
 	} else {
 		brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
-- 
2.55.0

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

On 29/07/2026 07:34, Bogdan Nicolae wrote:
> When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> driver never told the firmware which SAE Password Element (PWE) method to
> accept. The firmware was observed to corrupt its heap over time due to
> this omission, leading to firmware trap (data abort in heap allocator).
> 
> Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> membership selector is present, 0 otherwise. This matches the behaviour
> of the upstream/vendor driver and only applies to SAE-capable APs when
> external SAE is supported.

This makes sense, but may I ask what device do you have? Suspect it is a 
Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca) 
code base so I suspect it is vendor specific.

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Gokul Sivakumar]

On 07/29, Arend van Spriel wrote:
> On 29/07/2026 07:34, Bogdan Nicolae wrote:
> > When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> > driver never told the firmware which SAE Password Element (PWE) method to
> > accept. The firmware was observed to corrupt its heap over time due to
> > this omission, leading to firmware trap (data abort in heap allocator).
> > 
> > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> > membership selector is present, 0 otherwise. This matches the behaviour
> > of the upstream/vendor driver and only applies to SAE-capable APs when
> > external SAE is supported.
> 
> This makes sense, but may I ask what device do you have? Suspect it is a
> Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca)
> code base so I suspect it is vendor specific.

Arend, yes, this an Infineon vendor specific Firmware IOVAR. Seems like
he got the patch from Infineon's downstream brcmfmac github and applied
it on upstream brcmfmac driver as it is with minor changes.

Bogdan, from Infineon we are currently working on a patch to adopt our
"extsae_pwe" vendor changes for the upstream brcmfmac driver. Because it
can't be applied as it is on upstream brcmfmac without affecting other
firmware vendors.

We will submit our "extsae_pwe" patch for upstream review in a few days.
Kindly wait.

Regards,
Gokul

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

On 29/07/2026 13:48, Bogdan Nicolae wrote:
>> On Wed, Jul 29, 2026, 04:48 Arend van Spriel 
>> <arend.vanspriel@broadcom.com <mailto:arend.vanspriel@broadcom.com>> wrote:
>> 
>>     On 29/07/2026 07:34, Bogdan Nicolae wrote:
>>      > When bringing up a WPA3-SAE SoftAP with external (user space)
>>     SAE, the
>>      > driver never told the firmware which SAE Password Element (PWE)
>>     method to
>>      > accept. The firmware was observed to corrupt its heap over time
>>     due to
>>      > this omission, leading to firmware trap (data abort in heap
>>     allocator).
>>      >
>>      > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
>>      > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
>>      > membership selector is present, 0 otherwise. This matches the
>>     behaviour
>>      > of the upstream/vendor driver and only applies to SAE-capable APs
>>     when
>>      > external SAE is supported.
>> 
>>     This makes sense, but may I ask what device do you have? Suspect it
>>     is a
>>     Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca)
>>     code base so I suspect it is vendor specific.
> Hi Arend,
> 
> Indeed, this is a bcm43455 as found on Raspberry Pi SoCs.
Than we should only invoke the parse function for cyw vendor.

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

Gokul,

Looks like this is also missing, can you please add it in your patch:

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d32b35ce0..455f5619f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -77,6 +77,11 @@

#define        DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe
fixed length */

+#define WL_IOV_OP_BSSCFG_DISABLE               0
+#define WL_IOV_OP_BSSCFG_ENABLE                        1
+#define WL_IOV_OP_MANUAL_STA_BSSCFG_CREATE     2
+#define WL_IOV_OP_MANUAL_AP_BSSCFG_CREATE      3
+
#define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS   320
#define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS  400
#define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS      20
@@ -5260,6 +5265,19 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy,
struct net_device *ndev,
               if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
                       brcmf_fil_iovar_int_set(ifp, "mbss", 1);

+               if (!test_bit(BRCMF_VIF_STATUS_AP_CREATED,
&ifp->vif->sme_state)) {
+                       bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
+                       bss_enable.enable =
+                               cpu_to_le32(WL_IOV_OP_MANUAL_AP_BSSCFG_CREATE);
+                       err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+                                                      sizeof(bss_enable));
+                       if (err < 0) {
+                               bphy_err(drvr, "bss_enable config failed %d\n",
+                                        err);
+                               goto exit;
+                       }
+               }
+
               err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
               if (err < 0) {
                       bphy_err(drvr, "setting AP mode failed %d\n",

Thanks,
Bogdan

On Wed, Jul 29, 2026 at 8:19 AM Bogdan Nicolae <bogdan.nicolae@gmail.com> wrote:
>
> Gokul,
>
> Great to hear. Are there any other changes you are planning to submit?
> I found this to be the minimal working config at least for WPA3 personal, but would like to know if I am missing anything else.
>
> Thanks,
> Bogdan
>
> On Wed, Jul 29, 2026, 07:28 Arend van Spriel <arend.vanspriel@broadcom.com> wrote:
>>
>> On 29/07/2026 13:48, Bogdan Nicolae wrote:
>> >> On Wed, Jul 29, 2026, 04:48 Arend van Spriel
>> >> <arend.vanspriel@broadcom.com <mailto:arend.vanspriel@broadcom.com>> wrote:
>> >>
>> >>     On 29/07/2026 07:34, Bogdan Nicolae wrote:
>> >>      > When bringing up a WPA3-SAE SoftAP with external (user space)
>> >>     SAE, the
>> >>      > driver never told the firmware which SAE Password Element (PWE)
>> >>     method to
>> >>      > accept. The firmware was observed to corrupt its heap over time
>> >>     due to
>> >>      > this omission, leading to firmware trap (data abort in heap
>> >>     allocator).
>> >>      >
>> >>      > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
>> >>      > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
>> >>      > membership selector is present, 0 otherwise. This matches the
>> >>     behaviour
>> >>      > of the upstream/vendor driver and only applies to SAE-capable APs
>> >>     when
>> >>      > external SAE is supported.
>> >>
>> >>     This makes sense, but may I ask what device do you have? Suspect it
>> >>     is a
>> >>     Cypress/Infineon chip. I could not find the iovar in our (Broadcom bca)
>> >>     code base so I suspect it is vendor specific.
>> > Hi Arend,
>> >
>> > Indeed, this is a bcm43455 as found on Raspberry Pi SoCs.
>> Than we should only invoke the parse function for cyw vendor.
>>
>> Regards,
>> Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Gokul Sivakumar]

On 07/29, Bogdan Nicolae wrote:
> Gokul,
> 
> Looks like this is also missing, can you please add it in your patch:

sure, we will include the quoted patch while submitting our "extsae_pwe" patchset
for community review.

Kindly avoid top-posting while sending your email replies.
Need to use interleaved quoting.
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index d32b35ce0..455f5619f 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -77,6 +77,11 @@
> 
> #define        DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe
> fixed length */
> 
> +#define WL_IOV_OP_BSSCFG_DISABLE               0
> +#define WL_IOV_OP_BSSCFG_ENABLE                        1
> +#define WL_IOV_OP_MANUAL_STA_BSSCFG_CREATE     2
> +#define WL_IOV_OP_MANUAL_AP_BSSCFG_CREATE      3
> +
> #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS   320
> #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS  400
> #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS      20
> @@ -5260,6 +5265,19 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy,
> struct net_device *ndev,
>                if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
>                        brcmf_fil_iovar_int_set(ifp, "mbss", 1);
> 
> +               if (!test_bit(BRCMF_VIF_STATUS_AP_CREATED,
> &ifp->vif->sme_state)) {
> +                       bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
> +                       bss_enable.enable =
> +                               cpu_to_le32(WL_IOV_OP_MANUAL_AP_BSSCFG_CREATE);
> +                       err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
> +                                                      sizeof(bss_enable));
> +                       if (err < 0) {
> +                               bphy_err(drvr, "bss_enable config failed %d\n",
> +                                        err);
> +                               goto exit;
> +                       }
> +               }
> +
>                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
>                if (err < 0) {
>                        bphy_err(drvr, "setting AP mode failed %d\n",
> 
> Thanks,
> Bogdan
> 
> On Wed, Jul 29, 2026 at 8:19 AM Bogdan Nicolae <bogdan.nicolae@gmail.com> wrote:
> >
> > Gokul,
> >
> > Great to hear. Are there any other changes you are planning to submit?
> > I found this to be the minimal working config at least for WPA3 personal,
> > but would like to know if I am missing anything else.

Could you help us with the exact version of 43455 firmware, Raspbian distro and
kernel that you are currently using in your RPi ? 

Regards,
Gokul

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

Gokul,

A detailed explanation is available in this issue:
https://github.com/raspberrypi/linux/issues/7528

On Fri, Jul 31, 2026 at 8:51 AM Gokul Sivakumar
<gokulkumar.sivakumar@infineon.com> wrote:
>
> Could you help us with the exact version of 43455 firmware, Raspbian distro and
> kernel that you are currently using in your RPi ?

Kernel 6.18.39 (fork form official rpi kernel):
https://github.com/bnicolae/linux-rpi (main adds code to capture
firmware trap; wpa3 branch configures the new iovars)
Firmware: BCM4345/6 wl0: Oct 28 2024 23:27:00 version 7.45.286
(be70ab3 CY) FWID 01-95efe7fa
Infineon Backports (used as a reference): v6.1.145

> Regards,
> Gokul

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

On Wed, 29 Jul 2026 00:34:08 -0500, Bogdan Nicolae wrote:
> When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> driver never told the firmware which SAE Password Element (PWE) method to
> accept. The firmware was observed to corrupt its heap over time due to
> this omission, leading to firmware trap (data abort in heap allocator).
>
> Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> membership selector is present, 0 otherwise. This matches the behaviour
> of the upstream/vendor driver and only applies to SAE-capable APs when
> external SAE is supported.
>
> Signed-off-by: Bogdan Nicolae <bogdan.nicolae@gmail.com>
> ---
>  .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 75 +++++++++++++++++++
>  1 file changed, 75 insertions(+)

As discussed the extsae_pwe iovar is vendor specific so the fix needs to
be gated on the CYW vendor. The cleanest approach would be to add a fwvid
hook (following the pattern of set_sae_password in brcmfmac/cyw/) so
brcmf_parse_configure_sae_pwe() is only invoked for CYW chipsets.

[...]

> +#define BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY 123

This is already defined as BSS_MEMBERSHIP_SELECTOR_SAE_H2E in
<linux/ieee80211.h>. Please reuse the existing constant.

[...]

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

Gokul (representing Infineon) promised he would send a patch a while back.
This would be a preferred solution as it comes directly from the vendor.
But it also takes time. I can send a revised patch next week.

Regards,
Bogdan

On Sun, Aug 2, 2026 at 3:39 AM Arend van Spriel
<arend.vanspriel@broadcom.com> wrote:
>
> On Wed, 29 Jul 2026 00:34:08 -0500, Bogdan Nicolae wrote:
> > When bringing up a WPA3-SAE SoftAP with external (user space) SAE, the
> > driver never told the firmware which SAE Password Element (PWE) method to
> > accept. The firmware was observed to corrupt its heap over time due to
> > this omission, leading to firmware trap (data abort in heap allocator).
> >
> > Parse the beacon IEs on start_ap() and set the extsae_pwe iovar
> > accordingly: 2 when the RSNX IE advertises H2E, 1 when an H2E-only
> > membership selector is present, 0 otherwise. This matches the behaviour
> > of the upstream/vendor driver and only applies to SAE-capable APs when
> > external SAE is supported.
> >
> > Signed-off-by: Bogdan Nicolae <bogdan.nicolae@gmail.com>
> > ---
> >  .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 75 +++++++++++++++++++
> >  1 file changed, 75 insertions(+)
>
> As discussed the extsae_pwe iovar is vendor specific so the fix needs to
> be gated on the CYW vendor. The cleanest approach would be to add a fwvid
> hook (following the pattern of set_sae_password in brcmfmac/cyw/) so
> brcmf_parse_configure_sae_pwe() is only invoked for CYW chipsets.
>
> [...]
>
> > +#define BSS_MEMBERSHIP_SELECTOR_SAE_H2E_ONLY 123
>
> This is already defined as BSS_MEMBERSHIP_SELECTOR_SAE_H2E in
> <linux/ieee80211.h>. Please reuse the existing constant.
>
> [...]
>
> Regards,
> Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Arend van Spriel]

Op 8 augustus 2026 02:00:22 schreef Bogdan Nicolae <bogdan.nicolae@gmail.com>:

> Gokul (representing Infineon) promised he would send a patch a while back.
> This would be a preferred solution as it comes directly from the vendor.
> But it also takes time. I can send a revised patch next week.

Yeah. With Johannes being on vacation I say we can give Infineon bit more 
time to provide their patch.

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Bogdan Nicolae]

On Sat, Aug 8, 2026 at 12:20 AM Arend van Spriel
<arend.vanspriel@broadcom.com> wrote:
>
> Op 8 augustus 2026 02:00:22 schreef Bogdan Nicolae <bogdan.nicolae@gmail.com>:
>
> > Gokul (representing Infineon) promised he would send a patch a while back.
> > This would be a preferred solution as it comes directly from the vendor.
> > But it also takes time. I can send a revised patch next week.
>
> Yeah. With Johannes being on vacation I say we can give Infineon bit more
> time to provide their patch.

Sounds good, Arend. Gokul, I'm available to test/collaborate, just let me know.

Best,
Bogdan

Re: [PATCH] wifi: brcmfmac: configure SAE PWE method for external SAE AP

[Gokul Sivakumar]

On 08/08, Bogdan Nicolae wrote:
> On Sat, Aug 8, 2026 at 12:20 AM Arend van Spriel
> <arend.vanspriel@broadcom.com> wrote:
> >
> > Op 8 augustus 2026 02:00:22 schreef Bogdan Nicolae <bogdan.nicolae@gmail.com>:
> >
> > > Gokul (representing Infineon) promised he would send a patch a while back.
> > > This would be a preferred solution as it comes directly from the vendor.
> > > But it also takes time. I can send a revised patch next week.
> >
> > Yeah. With Johannes being on vacation I say we can give Infineon bit more
> > time to provide their patch.
> 
> Sounds good, Arend. Gokul, I'm available to test/collaborate, just let me know.

Sure, we will send the Infineon patchset for review within few days.

Regards,
Gokul