[PATCH wireless-next v3] wifi: brcmfmac: log the firmware status when a connect fails

[PATCH wireless-next v3] wifi: brcmfmac: log the firmware status when a connect fails

[Ryohei Hashimoto]

brcmf_bss_connect_done() receives the firmware event in @e but discards it
on the failure path.  Every failed connect is reported to cfg80211 as
WLAN_STATUS_AUTH_TIMEOUT (16), whatever the firmware actually said, so
userspace only ever sees:

  wlan0: CTRL-EVENT-ASSOC-REJECT bssid=00:00:00:00:00:00 status_code=16

The all-zero BSSID comes from the same place: conn_params is memset to
zero and profile->bssid has not been filled in when the station never
associated.

status_code=16 therefore carries no information about the cause.  It is not
an AP response and it does not mean "authentication timed out" - it is the
only failure value this driver can produce.  This is a recurring source of
confusion: [1] has been open since 2023 with more than twenty follow-ups
and no explanation of the code, and covers BCM4345/6, BCM43430 and
CYW43455 across several kernel versions.  It supersedes [2], filed against
the firmware repository a day earlier and closed in favour of it.

The firmware's own status (BRCMF_E_STATUS_*) is more specific - FAIL,
TIMEOUT, NO_NETWORKS, ABORT and so on - and it is already in hand.  Log it
so the cause can be narrowed down without rebuilding the kernel.

bphy_err() is used rather than brcmf_dbg() or brcmf_info(): it is the form
the rest of this file uses, and of the three it is the only one that is
both visible in a distribution kernel and bounded.  brcmf_dbg(CONN)
expands to no_printk() unless CONFIG_BRCMDBG is set, which is what makes
the reports in [1] and [2] impossible to act on - the people hitting this
run stock kernels.  brcmf_info() expands to a plain pr_info() in a
non-debug build and is not rate limited, and wpa_supplicant retries the
association every few seconds, so it would flood the log.  bphy_err() is
guarded by net_ratelimit() there, so a station retrying against an
unreachable AP prints at most a few lines per second.

All three fields are printed because only some of them are meaningful on
each path into the failure branch.  brcmf_is_nonetwork() keys off @status,
so that is the useful field for a join that never associated - the case in
[1].  brcmf_is_linkdown() keys off @event_code and @flags and does not look
at @status at all, so @status can read 0 there; on those events it is
@reason which carries the 802.11 reason code, as the mapping in
brcmf_map_fw_linkdown_reason() shows.  Printing the three together lets
the reader tell which path was taken instead of guessing from one number.

The status reported to cfg80211 is left alone; changing it would alter what
userspace sees.

[1] https://github.com/RPi-Distro/firmware-nonfree/issues/38
[2] https://github.com/raspberrypi/firmware/issues/1829

Assisted-by: Claude:claude-opus-5
Signed-off-by: Ryohei Hashimoto <laurel.medalist12@gmail.com>
---
v3:
  - add the Assisted-by tag required by
    Documentation/process/coding-assistants.rst.  It was missing from v1
    and v2; sorry for the omission.

Tooling, as asked for by Documentation/process/generated-content.rst: an
LLM was used throughout.  It read the driver, proposed the change, and
drafted this changelog.  The starting point was my own problem - a
Raspberry Pi in a car that logs status_code=16 on every failed connect -
and every claim above was checked against the source before being written
down: that brcmf_is_nonetwork() reads @status, that brcmf_is_linkdown()
reads @event_code and @flags, that bphy_err() is behind net_ratelimit()
while brcmf_info() is not, and that bphy_err() is what the rest of
cfg80211.c uses.  No specialized analysis tool (coccinelle, sparse and
the like) was involved.

Testing: built against mainline (2f0c1cf72, 2026-09-12) for arm64 with
W=1; cfg80211.o compiles with no new warnings, and checkpatch.pl
--strict reports no issues.  Not tested on hardware: the affected device
has a read-only root and lives in a car, so building a module on it is
impractical and I have not observed the new line firing.

v2: https://lore.kernel.org/linux-wireless/20260909080603.2955-1-laurel.medalist12@gmail.com/
v1: https://lore.kernel.org/linux-wireless/20260909064125.67844-1-laurel.medalist12@gmail.com/

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 872c488..114dabb 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6522,6 +6522,8 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
 			clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
 				  &ifp->vif->sme_state);
 			conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
+			bphy_err(ifp->drvr, "connect failed: event %u status %u reason %u\n",
+				 e->event_code, e->status, e->reason);
 		}
 		conn_params.links[0].bssid = profile->bssid;
 		conn_params.req_ie = conn_info->req_ie;

Re: [PATCH wireless-next v3] wifi: brcmfmac: log the firmware status when a connect fails

[Arend van Spriel]

On Mon, 14 Sep 2026 01:55:26 +0900, Ryohei Hashimoto wrote:
> brcmf_bss_connect_done() receives the firmware event in @e but discards it
> on the failure path.  Every failed connect is reported to cfg80211 as
> WLAN_STATUS_AUTH_TIMEOUT (16), whatever the firmware actually said, so
> userspace only ever sees:
> 
>   wlan0: CTRL-EVENT-ASSOC-REJECT bssid=00:00:00:00:00:00 status_code=16

[...]
 
> The status reported to cfg80211 is left alone; changing it would alter what
> userspace sees.
> 
> [1] https://github.com/RPi-Distro/firmware-nonfree/issues/38
> [2] https://github.com/raspberrypi/firmware/issues/1829
> 
> Assisted-by: Claude:claude-opus-5

Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>

Regards,
Arend

> Signed-off-by: Ryohei Hashimoto <laurel.medalist12@gmail.com>
> ---
>  drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
>  1 file changed, 2 insertions(+)