Pi 4 brcmfmac AP (2.4 GHz): firmware stops host TX after a client's mDNS burst. Flow control stuck in XOFF until the driver is reloaded

Offen
  • Stimmt etwas nicht?
#7,723 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
43/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
c, linux
Bereich
networking

Rechercherichtung

Start by reading the brcmfmac flow control and transmit paths, then look for existing handling of fc_xoff and fc_xon; the issue does not name specific source files or tests. Try to reproduce the stall with the described 2.4 GHz AP and multicast burst, and inspect the debugfs counters. Done means the AP continues transmitting after the burst and the counters recover without reloading the driver.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Describe the bug

A Pi 4B runs a NetworkManager hotspot (AP mode, 2.4 GHz, band bg, channel auto → 6, IPv4 shared). When a Windows 11 client joins, data flows for about 2 s, and then the Pi stops sending data to the client. Beacons continue. The driver's debugfs counters show the firmware turned host TX off and never turned it back on:

  • fc_xoff > fc_xon
  • f2txdata stops increasing

After that, reconnects fail at the 4-way handshake. Later the AP stops beaconing entirely. Only reloading the driver recovers it (modprobe -r brcmfmac_cyw brcmfmac; modprobe brcmfmac). No firmware trap or "halted" message is logged. The only related kernel messages are brcmf_vif_set_mgmt_ie: vndr ie set error : -52.

Trigger
A tcpdump on wlan0 shows that the stall starts when the client sends a burst of about 900 mDNS multicast packets in about 3 s. The packets are Windows Delivery Optimization re-announcing 76 _dosvc._tcp.local service instances, each about 540 bytes, with 3 probes and 3 announcements over both IPv4 and IPv6. This is a client-side quirk, but it's valid traffic, and it permanently disables the AP.

Test results

Test Result
Same client, 2.4 GHz, channels 6 and 11, Wi-Fi power saving on or off stalls every time
One run recovered after a 6 s outage (fc_xon caught up), so the stall looks like a race
Same client, same burst, 5 GHz (channel 36) fc_xoff 4 = fc_xon 4, stable 3+ min
Same client, outgoing mDNS blocked on the client no burst, fc_xoff 0, stable 3+ min
Same client after a reboot (no burst) stable
Android phone (about 40 mDNS packets) fc_xoff 23 = fc_xon 23, stable 3+ min
AP isolation enabled still stalls
Firmware 7.45.265 (standard) and 7.45.241 (minimal) both stall
Kernel 6.12.62 and 6.18.50 both stall
Ruled out: power (throttled=0x0), SDIO errors, and RF interference (the stall is repeatable across channels). Our guess is that airtime at the 1 Mbps basic rate on 2.4 GHz pushes the firmware into a flow-control state it doesn't recover from. We haven't tried reproducing it with a synthetic multicast flood.
Steps to reproduce the behaviour
  1. Start a 2.4 GHz NetworkManager hotspot on the Pi 4.
  2. Connect a client that sends about 900 multicast packets of about 540 bytes within a few seconds after associating. A long-running Windows 11 PC with Delivery Optimization LAN sharing on does this.
  3. Watch /sys/kernel/debug/ieee80211/phy*/counters: fc_xoff goes above fc_xon and f2txdata freezes.
Device (s)

Raspberry Pi 4 Mod. B

System
  • Raspberry Pi OS Trixie (image 2025-12-04), full-upgraded 2026-10-27
  • Kernel 6.18.50 (also seen on 6.12.62)
  • firmware-brcm80211 20260519
  • Firmware: BCM4345/6 7.45.265 (28bca26 CY) FWID 01-b677b91b; also 7.45.241 (minimal)
  • wpasupplicant 2.10-24+rpt3, NetworkManager AP mode
Logs

System Information.txt

Additional context

Possible related to #7092

Vorherrschende Sprache
C
Sterne
13.3k
Forks
5.5k
Ø Merge
3 T. 20 Std.
Gemergte PRs (30 T.)
27

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus raspberrypi/linux

Alle Issues in raspberrypi/linux

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.