Re: Broadcom brcm80211 Displays WPA3 as WEP in OpenWRT
Stephen C Goodman <[email protected]> Thu, 23 Oct 2025 12:41:24 +0000
| Newsgroups | dev.linux.lists.brcm80211,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <AS8P194MB1919CF76182E5B69021173D49DF0A@AS8P194MB1919.EURP194.PROD.OUTLOOK.COM> |
Hey!
Using Linux Firmware: BCM43664/4 wl0: Nov 5 2018 03:19:56 version 10.28.2 (r769115) FWID 01-d2cbb8fd and Asus Firmware: BCM43664/4 wl0: Aug 27 2021 18:31:04 version 10.10.122.303 (r666429) FWID 01-ccd91e51, and After running iw list, the capabilities output displays the following:
wiphy index: 1
max # scan SSIDs: 10
max scan IEs length: 2048 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports roaming.
Available Antennas: TX 0 RX 0
Supported interface modes:
* IBSS
* managed
* AP
* P2P-client
* P2P-GO
* P2P-device
Band 2:
Capabilities: 0x1062
HT20/HT40
Static SM Power Save
RX HT20 SGI
RX HT40 SGI
No RX STBC
Max AMSDU length: 3839 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 16 usec (0x07)
HT TX/RX MCS rate indexes supported: 0-31
VHT Capabilities (0x0c1b4064):
Max MPDU length: 3895
Supported Channel Width: 160 MHz
short GI (80 MHz)
short GI (160/80+80 MHz)
MU Beamformer
MU Beamformee
VHT RX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT RX highest supported: 0 Mbps
VHT TX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT TX highest supported: 0 Mbps
VHT extended NSS: not supported
Frequencies:
* 5170.0 MHz [34] (20.0 dBm)
* 5180.0 MHz [36] (20.0 dBm)
* 5190.0 MHz [38] (20.0 dBm)
* 5200.0 MHz [40] (20.0 dBm)
* 5210.0 MHz [42] (20.0 dBm)
* 5220.0 MHz [44] (20.0 dBm)
* 5230.0 MHz [46] (20.0 dBm)
* 5240.0 MHz [48] (20.0 dBm)
* 5260.0 MHz [52] (20.0 dBm) (radar detection)
* 5280.0 MHz [56] (20.0 dBm) (radar detection)
* 5300.0 MHz [60] (20.0 dBm) (radar detection)
* 5320.0 MHz [64] (20.0 dBm) (radar detection)
* 5500.0 MHz [100] (20.0 dBm) (radar detection)
* 5520.0 MHz [104] (20.0 dBm) (radar detection)
* 5540.0 MHz [108] (20.0 dBm) (radar detection)
* 5560.0 MHz [112] (20.0 dBm) (radar detection)
* 5580.0 MHz [116] (20.0 dBm) (radar detection)
* 5600.0 MHz [120] (20.0 dBm) (radar detection)
* 5620.0 MHz [124] (20.0 dBm) (radar detection)
* 5640.0 MHz [128] (20.0 dBm) (radar detection)
* 5660.0 MHz [132] (20.0 dBm) (radar detection)
* 5680.0 MHz [136] (20.0 dBm) (radar detection)
* 5700.0 MHz [140] (20.0 dBm) (radar detection)
* 5720.0 MHz [144] (13.0 dBm) (radar detection)
* 5745.0 MHz [149] (13.0 dBm)
* 5765.0 MHz [153] (13.0 dBm)
* 5785.0 MHz [157] (13.0 dBm)
* 5805.0 MHz [161] (13.0 dBm)
* 5825.0 MHz [165] (13.0 dBm)
valid interface combinations:
* #{ managed } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,
total <= 3, #channels <= 1
* #{ managed } <= 1, #{ AP } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,
total <= 4, #channels <= 1
* #{ AP } <= 4,
total <= 4, #channels <= 1, STA/AP BI must match
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ DFS_OFFLOAD ]: DFS offload
Wiphy phy0
wiphy index: 0
max # scan SSIDs: 10
max scan IEs length: 2048 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports roaming.
Available Antennas: TX 0 RX 0
Supported interface modes:
* IBSS
* managed
* AP
* P2P-client
* P2P-GO
* P2P-device
Band 1:
Capabilities: 0x1022
HT20/HT40
Static SM Power Save
RX HT20 SGI
No RX STBC
Max AMSDU length: 3839 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 16 usec (0x07)
HT TX/RX MCS rate indexes supported: 0-31
Frequencies:
* 2412.0 MHz [1] (20.0 dBm)
* 2417.0 MHz [2] (20.0 dBm)
* 2422.0 MHz [3] (20.0 dBm)
* 2427.0 MHz [4] (20.0 dBm)
* 2432.0 MHz [5] (20.0 dBm)
* 2437.0 MHz [6] (20.0 dBm)
* 2442.0 MHz [7] (20.0 dBm)
* 2447.0 MHz [8] (20.0 dBm)
* 2452.0 MHz [9] (20.0 dBm)
* 2457.0 MHz [10] (20.0 dBm)
* 2462.0 MHz [11] (20.0 dBm)
* 2467.0 MHz [12] (20.0 dBm)
* 2472.0 MHz [13] (20.0 dBm)
* 2484.0 MHz [14] (disabled)
valid interface combinations:
* #{ managed } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,
total <= 3, #channels <= 1
* #{ managed } <= 1, #{ AP } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,
total <= 4, #channels <= 1
* #{ AP } <= 4,
total <= 4, #channels <= 1, STA/AP BI must match
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records.
Regarding /sys/kernel/debug/ieee80211/phy0/features and /sys/kernel/debug/ieee80211/phy0/fwcap, both /sys/kernel/debug/ieee80211/phy0/ and /sys/kernel/debug/ieee80211/phy1/ are empty directories.
Additionally, I ran the command nvram show > /lib/firmware/brcmbrcmfmac4366c-pcie.txt to copy the nvram, as the brcmfmac driver had issues reading it. For reference, I consulted the documentation at BRCM80211 Documentation (https://wireless.docs.kernel.org/en/latest/en/users/drivers/brcm80211.html).
If you need any further information or assistance in troubleshooting these issues, please let me know.
Thank you,
________________________________________
From: Arend van Spriel <[email protected]>
Sent: Thursday, October 23, 2025 10:42 AM
To: Stephen C Goodman <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>
Subject: Re: Broadcom brcm80211 Displays WPA3 as WEP in OpenWRT
On 10/21/2025 2:45 PM, Stephen C Goodman wrote:
> I would like to report a bug concerning the Broadcom bcm4366c0 driver, which affects most brcmfmac PCIe chips.
> Issue Details:
> Chipset: Broadcom bcm4366c0
> Environment: OpenWRT
> Kernel Version: 6.12.54
> mac80211 Version: 6.16 (backports)
> Description: While WPA3 is shown as SAE in OpenWRT LuCI, attempts to connect to the network or using a Wi-Fi analyzer reveal that it is actually operating as WEP. This discrepancy creates confusion and undermines security expectations.
> Steps to Reproduce:
> Use the Broadcom bcm4366c0 in an OpenWRT environment.
> Configure a wireless network with WPA3 security via LuCI.
> Attempt to connect to the network or perform a scan with a Wi-Fi analyzer.
> Observe that it identifies WPA3 as WEP.
> Please let me know if you require any additional information or logs to help diagnose this issue. Thank you for addressing this matter promptly.
Can you get radio info using the iw utility? Also please share the
contents of /sys/kernel/debug/ieee80211/phy0/features and
/sys/kernel/debug/ieee80211/phy0/fwcap.
Regards,
Arend