Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Aditya Garg]

Hi

wpa_supplicant 2.11 broke Wi-Fi on T2 Macs as well, but this patch doesn't seem to be fixing Wi-Fi. Instead, it's breaking it even on older 2.10 wpa_supplicant. Tested by a user on bcm4364b2 wifi chip with a WPA2-PSK [AES] network. dmesg output:

However dmesg outputs more info 

[    5.852978] usbcore: registered new interface driver brcmfmac
[    5.853114] brcmfmac 0000:01:00.0: enabling device (0000 -> 0002)
[    5.992212] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4364b2-pcie for chip BCM4364/3
[    5.993923] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u-7.5-X0.bin failed with error -2
[    5.993968] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u-7.5.bin failed with error -2
[    5.994004] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u.bin failed with error -2
[    5.994041] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4364b2-pcie.apple,maui-HRPN.bin failed with error -2
[    5.994076] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4364b2-pcie.apple,maui-X0.bin failed with error -2
[    6.162830] Bluetooth: hci0: BCM: 'brcm/BCM.hcd'
[    6.796637] brcmfmac: brcmf_c_process_txcap_blob: TxCap blob found, loading
[    6.798396] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4364/3 wl0: Jul 10 2023 12:30:19 version 9.30.503.0.32.5.92 FWID 01-88a8883
[    6.885876] brcmfmac 0000:01:00.0 wlp1s0: renamed from wlan0
[    8.195243] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update device address ret -52
[    8.196584] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
[    8.196588] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface p2p-dev-wlp1s0 type 10 failed: err=-52

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Arend Van Spriel]

On August 4, 2024 5:11:00 AM Aditya Garg <gargaditya08@live.com> wrote:

> Hi
>
> wpa_supplicant 2.11 broke Wi-Fi on T2 Macs as well, but this patch doesn't 
> seem to be fixing Wi-Fi. Instead, it's breaking it even on older 2.10 
> wpa_supplicant. Tested by a user on bcm4364b2 wifi chip with a WPA2-PSK 
> [AES] network. dmesg output:
>
> However dmesg outputs more info

Not seeing much info in this output which indicate an issue.

> [    5.852978] usbcore: registered new interface driver brcmfmac
> [    5.853114] brcmfmac 0000:01:00.0: enabling device (0000 -> 0002)
> [    5.992212] brcmfmac: brcmf_fw_alloc_request: using 
> brcm/brcmfmac4364b2-pcie for chip BCM4364/3
> [    5.993923] brcmfmac 0000:01:00.0: Direct firmware load for 
> brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u-7.5-X0.bin failed with error -2
> [    5.993968] brcmfmac 0000:01:00.0: Direct firmware load for 
> brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u-7.5.bin failed with error -2
> [    5.994004] brcmfmac 0000:01:00.0: Direct firmware load for 
> brcm/brcmfmac4364b2-pcie.apple,maui-HRPN-u.bin failed with error -2
> [    5.994041] brcmfmac 0000:01:00.0: Direct firmware load for 
> brcm/brcmfmac4364b2-pcie.apple,maui-HRPN.bin failed with error -2
> [    5.994076] brcmfmac 0000:01:00.0: Direct firmware load for 
> brcm/brcmfmac4364b2-pcie.apple,maui-X0.bin failed with error -2
> [    6.162830] Bluetooth: hci0: BCM: 'brcm/BCM.hcd'
> [    6.796637] brcmfmac: brcmf_c_process_txcap_blob: TxCap blob found, loading
> [    6.798396] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4364/3 wl0: 
> Jul 10 2023 12:30:19 version 9.30.503.0.32.5.92 FWID 01-88a8883

This message means the firmware download was completed successfully.

> [    6.885876] brcmfmac 0000:01:00.0 wlp1s0: renamed from wlan0
> [    8.195243] ieee80211 phy0: brcmf_p2p_set_firmware: failed to update 
> device address ret -52
> [    8.196584] ieee80211 phy0: brcmf_p2p_create_p2pdev: set p2p_disc error
> [    8.196588] ieee80211 phy0: brcmf_cfg80211_add_iface: add iface 
> p2p-dev-wlp1s0 type 10 failed: err=-52

The creation of P2P device fails, but this only disables P2P aka 
WiFi-Direct. A full kernel log would be helpful. Even better to build the 
driver with CONFIG_BRCMDBG and load the driver with modparam 
'debug=0x9416'. That will show a lot more driver logging which may provide 
more clues.

Regards,
Arend

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Janne Grunau]

Hej,

On Sun, Aug 4, 2024, at 05:10, Aditya Garg wrote:
> Hi
>
> wpa_supplicant 2.11 broke Wi-Fi on T2 Macs as well, but this patch 
> doesn't seem to be fixing Wi-Fi. Instead, it's breaking it even on 
> older 2.10 wpa_supplicant. Tested by a user on bcm4364b2 wifi chip with 
> a WPA2-PSK [AES] network. dmesg output:

On bcm4377, bcm4378 and bcm4388 (chipsets used in M1/M2 macs)
WPA3-SAE and WPA2-PSK still works with Fedora's wpa_supplicant 2.10.
Fedora's package carried SAE offload patches in 2.10.
wpa_supplicant 2.11 still doesn't work with this patch but it prevents a
kernel oops after a disconnect (due to an authentication timeout in the
current broken state) in wpa_supplicant.

I'll continue to debug the wpa_supplicant 2.11

best regards,
Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Aditya Garg]

Hi

WPA3 is broken on T2 Macs (atleast on 4364) for a long time. I was under the impression brcmfmac doesn't support it.

Anyways, I've asked a fedora user to compile a kernel with CONFIG_BRCMDBG.

If you want logs without it, look over here:
https://pastebin.com/fnhH30JA

________________________________________
From: Janne Grunau <j@jannau.net>
Sent: 04 August 2024 11:49
To: Aditya Garg; devnull+j.jannau.net@kernel.org
Cc: arend.vanspriel@broadcom.com; asahi@lists.linux.dev; brcm80211-dev-list.pdl@broadcom.com; brcm80211@lists.linux.dev; kvalo@kernel.org; linus.walleij@linaro.org; LKML; linux-wireless@vger.kernel.org; Hector Martin; stable@vger.kernel.org
Subject: Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

Hej,

On Sun, Aug 4, 2024, at 05:10, Aditya Garg wrote:
> Hi
>
> wpa_supplicant 2.11 broke Wi-Fi on T2 Macs as well, but this patch
> doesn't seem to be fixing Wi-Fi. Instead, it's breaking it even on
> older 2.10 wpa_supplicant. Tested by a user on bcm4364b2 wifi chip with
> a WPA2-PSK [AES] network. dmesg output:

On bcm4377, bcm4378 and bcm4388 (chipsets used in M1/M2 macs)
WPA3-SAE and WPA2-PSK still works with Fedora's wpa_supplicant 2.10.
Fedora's package carried SAE offload patches in 2.10.
wpa_supplicant 2.11 still doesn't work with this patch but it prevents a
kernel oops after a disconnect (due to an authentication timeout in the
current broken state) in wpa_supplicant.

I'll continue to debug the wpa_supplicant 2.11

best regards,
Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Arend Van Spriel]

On August 4, 2024 8:27:04 AM Aditya Garg <gargaditya08@live.com> wrote:

> Hi
>
> WPA3 is broken on T2 Macs (atleast on 4364) for a long time. I was under 
> the impression brcmfmac doesn't support it.
>
> Anyways, I've asked a fedora user to compile a kernel with CONFIG_BRCMDBG.
>
> If you want logs without it, look over here:
> https://pastebin.com/fnhH30JA

Not sure what to make of this. The interface comes up without any obvious 
error and then another interface is created by another driver:

[ 7.006441] rtl8xxxu 1-8.3:1.0 wlp0s20f0u8u3: renamed from wlan0

That interface connects:

[ 9.103599] wlp0s20f0u8u3: authenticate with 98:da:c4:af:1f:c2 (local 
address=2e:87:9a:a9:38:66)
[ 9.103605] wlp0s20f0u8u3: send auth to 98:da:c4:af:1f:c2 (try 1/3)
[ 9.109051] wlp0s20f0u8u3: authenticated
[ 9.110202] wlp0s20f0u8u3: associate with 98:da:c4:af:1f:c2 (try 1/3)
[ 9.126945] wlp0s20f0u8u3: RX AssocResp from 98:da:c4:af:1f:c2 
(capab=0x1431 status=0 aid=5)
[ 9.127678] usb 1-8.3: rtl8xxxu_bss_info_changed: HT supported
[ 9.128606] wlp0s20f0u8u3: associated

Is brcmfmac setup to connect to the same access point. There are a lot of 
unknowns here.

Regards,
Arend

> ________________________________________
> From: Janne Grunau <j@jannau.net>
> Sent: 04 August 2024 11:49
> To: Aditya Garg; devnull+j.jannau.net@kernel.org
> Cc: arend.vanspriel@broadcom.com; asahi@lists.linux.dev; 
> brcm80211-dev-list.pdl@broadcom.com; brcm80211@lists.linux.dev; 
> kvalo@kernel.org; linus.walleij@linaro.org; LKML; 
> linux-wireless@vger.kernel.org; Hector Martin; stable@vger.kernel.org
> Subject: Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
>
> Hej,
>
> On Sun, Aug 4, 2024, at 05:10, Aditya Garg wrote:
>> Hi
>>
>> wpa_supplicant 2.11 broke Wi-Fi on T2 Macs as well, but this patch
>> doesn't seem to be fixing Wi-Fi. Instead, it's breaking it even on
>> older 2.10 wpa_supplicant. Tested by a user on bcm4364b2 wifi chip with
>> a WPA2-PSK [AES] network. dmesg output:
>
> On bcm4377, bcm4378 and bcm4388 (chipsets used in M1/M2 macs)
> WPA3-SAE and WPA2-PSK still works with Fedora's wpa_supplicant 2.10.
> Fedora's package carried SAE offload patches in 2.10.
> wpa_supplicant 2.11 still doesn't work with this patch but it prevents a
> kernel oops after a disconnect (due to an authentication timeout in the
> current broken state) in wpa_supplicant.
>
> I'll continue to debug the wpa_supplicant 2.11
>
> best regards,
> Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Janne Grunau]

Hej,

On Sun, Aug 4, 2024, at 13:04, Arend Van Spriel wrote:
> On August 4, 2024 8:27:04 AM Aditya Garg <gargaditya08@live.com> wrote:
>
>> Hi
>>
>> WPA3 is broken on T2 Macs (atleast on 4364) for a long time. I was under 
>> the impression brcmfmac doesn't support it.
>>
>> Anyways, I've asked a fedora user to compile a kernel with CONFIG_BRCMDBG.
>>
>> If you want logs without it, look over here:
>> https://pastebin.com/fnhH30JA
>
> Not sure what to make of this. The interface comes up without any obvious 
> error and then another interface is created by another driver:

I've bisected the authentication timeouts for WPA2-PSK and WPA3-SAE (and
probably every other authentication method) down to

https://w1.fi/cgit/hostap/commit/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5

With that commit reverted on top of wpa_supplicant 2.11 both WPA2 and WPA3
work. Looks after cursory inspection if brcmfmac fails to notify wpa_supplicant
that it is authenticated.

best regards,
Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Janne Grunau]

Hej,

On Sun, Aug 4, 2024, at 13:37, Janne Grunau wrote:
> On Sun, Aug 4, 2024, at 13:04, Arend Van Spriel wrote:
>> On August 4, 2024 8:27:04 AM Aditya Garg <gargaditya08@live.com> wrote:
>>>
>>> WPA3 is broken on T2 Macs (atleast on 4364) for a long time. I was
>>> under the impression brcmfmac doesn't support it.
>>>
>>> Anyways, I've asked a fedora user to compile a kernel with
>>> CONFIG_BRCMDBG.
>>>
>>> If you want logs without it, look over here:
>>> https://pastebin.com/fnhH30JA
>>
>> Not sure what to make of this. The interface comes up without any
>> obvious error and then another interface is created by another
>> driver:
>
> I've bisected the authentication timeouts for WPA2-PSK and WPA3-SAE
> (and probably every other authentication method) down to
>
> https://w1.fi/cgit/hostap/commit/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5

this is reported upstream in
http://lists.infradead.org/pipermail/hostap/2024-August/042893.html

Disabling offloading in brcmfmac with "brcmfmac.feature_disable=0x82000"
on the kernel command line works around both the kernel and
wpa_supplicant issue.

HTH,
Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Aditya Garg]

Hi Arend, Janne

Even till this date, the issue still persists with wpa_supplicant. So, will we have to use brcmfmac.feature_disable=0x82000 forever (not very ideal) or do we have another plan in mind?

> On 5 Aug 2024, at 11:56 AM, Janne Grunau <j@jannau.net> wrote:
> 
> Hej,
> 
>> On Sun, Aug 4, 2024, at 13:37, Janne Grunau wrote:
>>> On Sun, Aug 4, 2024, at 13:04, Arend Van Spriel wrote:
>>> On August 4, 2024 8:27:04 AM Aditya Garg <gargaditya08@live.com> wrote:
>>>> 
>>>> WPA3 is broken on T2 Macs (atleast on 4364) for a long time. I was
>>>> under the impression brcmfmac doesn't support it.
>>>> 
>>>> Anyways, I've asked a fedora user to compile a kernel with
>>>> CONFIG_BRCMDBG.
>>>> 
>>>> If you want logs without it, look over here:
>>>> https://pastebin.com/fnhH30JA
>>> 
>>> Not sure what to make of this. The interface comes up without any
>>> obvious error and then another interface is created by another
>>> driver:
>> 
>> I've bisected the authentication timeouts for WPA2-PSK and WPA3-SAE
>> (and probably every other authentication method) down to
>> 
>> https://w1.fi/cgit/hostap/commit/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5
> 
> this is reported upstream in
> http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
> 
> Disabling offloading in brcmfmac with "brcmfmac.feature_disable=0x82000"
> on the kernel command line works around both the kernel and
> wpa_supplicant issue.
> 
> HTH,
> Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Arend van Spriel]

On 8/3/2024 9:52 PM, Janne Grunau via B4 Relay wrote:
> From: Janne Grunau <j@jannau.net>
> 
> wpa_supplicant 2.11 sends since 1efdba5fdc2c ("Handle PMKSA flush in the
> driver for SAE/OWE offload cases") SSID based PMKSA del commands.
> brcmfmac is not prepared and tries to dereference the NULL bssid and
> pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based
> updates so copy the SSID.
> 
> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
>- Cc: stable@vger.kernel.org
+ Cc: stable@vger.kernel.org # 6.4.x

This should be applied to the wireless tree.

Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> Signed-off-by: Janne Grunau <j@jannau.net>
> ---
>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)

Re: [PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Neal Gompa]

On Sat, Aug 3, 2024 at 3:53 PM Janne Grunau via B4 Relay
<devnull+j.jannau.net@kernel.org> wrote:
>
> From: Janne Grunau <j@jannau.net>
>
> wpa_supplicant 2.11 sends since 1efdba5fdc2c ("Handle PMKSA flush in the
> driver for SAE/OWE offload cases") SSID based PMKSA del commands.
> brcmfmac is not prepared and tries to dereference the NULL bssid and
> pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based
> updates so copy the SSID.
>
> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Janne Grunau <j@jannau.net>
> ---
>  drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index 5fe0e671ecb3..826b768196e2 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -4320,9 +4320,16 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
>                 /* Single PMK operation */
>                 pmk_op->count = cpu_to_le16(1);
>                 length += sizeof(struct brcmf_pmksa_v3);
> -               memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
> -               memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
> -               pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
> +               if (pmksa->bssid)
> +                       memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
> +               if (pmksa->pmkid) {
> +                       memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
> +                       pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
> +               }
> +               if (pmksa->ssid && pmksa->ssid_len) {
> +                       memcpy(pmk_op->pmk[0].ssid.SSID, pmksa->ssid, pmksa->ssid_len);
> +                       pmk_op->pmk[0].ssid.SSID_len = pmksa->ssid_len;
> +               }
>                 pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
>         }
>
>
> ---
> base-commit: 0c3836482481200ead7b416ca80c68a29cfdaabd
> change-id: 20240803-brcmfmac_pmksa_del_ssid-3c35efe35330
>

This looks reasonable to me and works on my Macs.

Reviewed-by: Neal Gompa <neal@gompa.dev>



--
真実はいつも一つ！/ Always, there's only one truth!

[PATCH] wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

[Janne Grunau via B4 Relay]

From: Janne Grunau <j@jannau.net>

wpa_supplicant 2.11 sends since 1efdba5fdc2c ("Handle PMKSA flush in the
driver for SAE/OWE offload cases") SSID based PMKSA del commands.
brcmfmac is not prepared and tries to dereference the NULL bssid and
pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based
updates so copy the SSID.

Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
Cc: stable@vger.kernel.org
Signed-off-by: Janne Grunau <j@jannau.net>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 5fe0e671ecb3..826b768196e2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4320,9 +4320,16 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
 		/* Single PMK operation */
 		pmk_op->count = cpu_to_le16(1);
 		length += sizeof(struct brcmf_pmksa_v3);
-		memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
-		memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
-		pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
+		if (pmksa->bssid)
+			memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
+		if (pmksa->pmkid) {
+			memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
+			pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
+		}
+		if (pmksa->ssid && pmksa->ssid_len) {
+			memcpy(pmk_op->pmk[0].ssid.SSID, pmksa->ssid, pmksa->ssid_len);
+			pmk_op->pmk[0].ssid.SSID_len = pmksa->ssid_len;
+		}
 		pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
 	}
 

---
base-commit: 0c3836482481200ead7b416ca80c68a29cfdaabd
change-id: 20240803-brcmfmac_pmksa_del_ssid-3c35efe35330

Best regards,
-- 
Janne Grunau <j@jannau.net>