[PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Janne Grunau]

Since commit 416386060 ("Mark authorization completed on driver
indication during 4-way HS offload") [0] wpa_supplicant expects
NL80211_CMD_PORT_AUTHORIZED to complete the authentication when the
driver supports 4-way handshake offload.
This was apparently never tested with the upstream brcmfmac driver as it
does not report this. This broke authentication on Apple silicon devices
(BRCM4378, BRMC4387, BRMC4388) and other devices when wpa_supplicant
2.11 was released [1]. This was initially dealt with by reverting the
commit in Fedora [2] and other Linux distributions.
Instead of carrying the revert over to wpa_supplicant 2.12 add the
expected NL80211_CMD_PORT_AUTHORIZED when the connection is established.
This will conflict with the "brcmfmac: add FT/OKC roaming offload
support" [3] series but is written in a way to easily resolve the
conflicts.

The "Fixes:" tag is not fully accurate as this has only become an issue
after userspace changes years later. Since the change is expected to be
required in all active stable branches for wpa_supplicant 2.11 / 2.12
compatibility it is helpful even though BRCMF_PROFILE_FWSUP_SAE did not
exists then.

Link: https://github.com/zephyrproject-rtos/hostap/commit/41638606054a09867fe3f9a2b5523aa4678cbfa5 [0]
Link: https://lists.infradead.org/pipermail/hostap/2024-August/042893.html [1]
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2302577 [2]
Link: https://lore.kernel.org/linux-wireless/20260911065656.1269623-5-Jason.Huang2@infineon.com/ [3]
Cc: stable@vger.kernel.org
Fixes: b8a64f0e96c2 ("brcmfmac: support 4-way handshake offloading for WPA/WPA2-PSK")
Signed-off-by: Janne Grunau <j@jannau.net>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 872c48806d09..9fd0ec6255b0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6504,6 +6504,7 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
 	struct cfg80211_connect_resp_params conn_params;
+	bool authorized;
 
 	brcmf_dbg(TRACE, "Enter\n");
 
@@ -6528,7 +6529,15 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
 		conn_params.req_ie_len = conn_info->req_ie_len;
 		conn_params.resp_ie = conn_info->resp_ie;
 		conn_params.resp_ie_len = conn_info->resp_ie_len;
+		authorized = completed &&
+			     ((profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) ||
+			      (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK));
 		cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
+		if (authorized) {
+			cfg80211_port_authorized(ndev, profile->bssid, NULL, 0,
+						 GFP_KERNEL);
+			brcmf_dbg(CONN, "Report port authorized\n");
+		}
 		brcmf_dbg(CONN, "Report connect result - connection %s\n",
 			  completed ? "succeeded" : "failed");
 	}

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260912-brcmfmac-4way-handshake-offload-authenticated-event-853f58ae203e

Best regards,
-- 
Janne Grunau <j@jannau.net>

Re: [PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Arend van Spriel]

On Sat, 12 Sep 2026 11:40:51 +0200, Janne Grunau wrote:
> Since commit 416386060 ("Mark authorization completed on driver
> indication during 4-way HS offload") [0] wpa_supplicant expects
> NL80211_CMD_PORT_AUTHORIZED to complete the authentication when the
> driver supports 4-way handshake offload.

In brcmfmac for 4way offload the driver waits for two dongle events before brcmf_is_linkup()
returns true and subsequently brcmf_bss_connect_done() is called to inform wpa_supplicant. At
that time the supplicant did not rely on NL80211_CMD_PORT_AUTHORIZED.

[...]

> Link: https://github.com/zephyrproject-rtos/hostap/commit/41638606054a09867fe3f9a2b5523aa4678cbfa5 [0]
> Link: https://lists.infradead.org/pipermail/hostap/2024-August/042893.html [1]
> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2302577 [2]
> Link: https://lore.kernel.org/linux-wireless/20260911065656.1269623-5-Jason.Huang2@infineon.com/ [3]
> Cc: stable@vger.kernel.org
> Fixes: b8a64f0e96c2 ("brcmfmac: support 4-way handshake offloading for WPA/WPA2-PSK")

Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>

Regards,
Arend

> Signed-off-by: Janne Grunau <j@jannau.net>
> ---
>  drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Re: [PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Johannes Berg]

On Sat, 2026-09-12 at 11:40 +0200, Janne Grunau wrote:
> 
> This will conflict with the "brcmfmac: add FT/OKC roaming offload
> support" [3] series but is written in a way to easily resolve the
> conflicts.

I ... no, I'm not going to take that conflict, and I applied the FT/OKC
series to wireless-next. Please create this patch on top of wireless-
next, if needed at all, and then you can backport something later to
stable if needed.

johannes

Re: [PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Janne Grunau]

On Tue, Sep 15, 2026 at 03:22:50PM +0200, Johannes Berg wrote:
> On Sat, 2026-09-12 at 11:40 +0200, Janne Grunau wrote:
> > 
> > This will conflict with the "brcmfmac: add FT/OKC roaming offload
> > support" [3] series but is written in a way to easily resolve the
> > conflicts.
> 
> I ... no, I'm not going to take that conflict, and I applied the FT/OKC
> series to wireless-next. Please create this patch on top of wireless-
> next, if needed at all, and then you can backport something later to
> stable if needed.

That is very unfortunate. I hoped this change could merged as a fix for
7.3.

The change is required. wpa_supplicant 2.12 (and unpatched 2.11) will
run into its authentication timeout and disconnect WPA2/3 PSK networks
on brcmfmac devices with firmware offload support.

I'll rebase onto wireless-next and send a v2 but I think it's serious
issue in the process that it will take until after v7.4-rc1 (7+ weeks
from now) before this fix will land in stable kernel releases.

Janne

Re: [PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Johannes Berg]

On Tue, 2026-09-15 at 21:05 +0200, Janne Grunau wrote:
> On Tue, Sep 15, 2026 at 03:22:50PM +0200, Johannes Berg wrote:
> > On Sat, 2026-09-12 at 11:40 +0200, Janne Grunau wrote:
> > > 
> > > This will conflict with the "brcmfmac: add FT/OKC roaming offload
> > > support" [3] series but is written in a way to easily resolve the
> > > conflicts.
> > 
> > I ... no, I'm not going to take that conflict, and I applied the FT/OKC
> > series to wireless-next. Please create this patch on top of wireless-
> > next, if needed at all, and then you can backport something later to
> > stable if needed.
> 
> That is very unfortunate. I hoped this change could merged as a fix for
> 7.3.
> 
> The change is required. wpa_supplicant 2.12 (and unpatched 2.11) will
> run into its authentication timeout and disconnect WPA2/3 PSK networks
> on brcmfmac devices with firmware offload support.
> 
> I'll rebase onto wireless-next and send a v2 but I think it's serious
> issue in the process that it will take until after v7.4-rc1 (7+ weeks
> from now) before this fix will land in stable kernel releases.

That process issue is yours - wpa_s 2.11 was released *well over two
years ago*, and nobody cared to fix the issue since. AFAICT this could
have been fixed in kernel 6.11 or so, but now it's suddenly urgent
enough to make life more complicated for everyone? ...

johannes

Re: [PATCH] wifi: brcmfmac: cfg80211: Report port_authorized for 4-way HS offload

[Janne Grunau]

On Wed, Sep 16, 2026 at 10:32:38AM +0200, Johannes Berg wrote:
> On Tue, 2026-09-15 at 21:05 +0200, Janne Grunau wrote:
> > On Tue, Sep 15, 2026 at 03:22:50PM +0200, Johannes Berg wrote:
> > > On Sat, 2026-09-12 at 11:40 +0200, Janne Grunau wrote:
> > > > 
> > > > This will conflict with the "brcmfmac: add FT/OKC roaming offload
> > > > support" [3] series but is written in a way to easily resolve the
> > > > conflicts.
> > > 
> > > I ... no, I'm not going to take that conflict, and I applied the FT/OKC
> > > series to wireless-next. Please create this patch on top of wireless-
> > > next, if needed at all, and then you can backport something later to
> > > stable if needed.
> > 
> > That is very unfortunate. I hoped this change could merged as a fix for
> > 7.3.
> > 
> > The change is required. wpa_supplicant 2.12 (and unpatched 2.11) will
> > run into its authentication timeout and disconnect WPA2/3 PSK networks
> > on brcmfmac devices with firmware offload support.
> > 
> > I'll rebase onto wireless-next and send a v2 but I think it's serious
> > issue in the process that it will take until after v7.4-rc1 (7+ weeks
> > from now) before this fix will land in stable kernel releases.
> 
> That process issue is yours - wpa_s 2.11 was released *well over two
> years ago*, and nobody cared to fix the issue since. AFAICT this could
> have been fixed in kernel 6.11 or so, but now it's suddenly urgent
> enough to make life more complicated for everyone? ...

yes, the kernel change fell of the table 2 years ago. Nothing can be
done about that anymore.

The issue became urgent due to the wpa_supplicant 2.12 release. That was
more than one month ago but I became aware of it and the reintroduction
of the authentication issue last week after Gentoo shipped
wpa_supplicant 2.12.

The patch to avoid this issue in wpa_supplicant 2.11 does not apply to
wpa_supplicant 2.12. So distributions either drop the patch and are
broken or adept it for 2.12. One distro maintainer was reluctant to
carry a patch for a second release. Based on this I disagree that fixing
the issue quickly in stable kernels makes life more complicated for
everyone. It would make life easier for distro maintainers and users of
distributions shipping unpatched wpa_supplicant 2.12.

Janne