Pi 4 brcmfmac AP (2.4 GHz): firmware stops host TX after a client's mDNS burst. Flow control stuck in XOFF until the driver is reloaded

Ouverte
  • Quelque chose ne va pas ?
#7,723 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
43/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
c, linux
Domaine
networking

Piste de recherche

Start by reading the brcmfmac flow control and transmit paths, then look for existing handling of fc_xoff and fc_xon; the issue does not name specific source files or tests. Try to reproduce the stall with the described 2.4 GHz AP and multicast burst, and inspect the debugfs counters. Done means the AP continues transmitting after the burst and the counters recover without reloading the driver.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Describe the bug

A Pi 4B runs a NetworkManager hotspot (AP mode, 2.4 GHz, band bg, channel auto → 6, IPv4 shared). When a Windows 11 client joins, data flows for about 2 s, and then the Pi stops sending data to the client. Beacons continue. The driver's debugfs counters show the firmware turned host TX off and never turned it back on:

  • fc_xoff > fc_xon
  • f2txdata stops increasing

After that, reconnects fail at the 4-way handshake. Later the AP stops beaconing entirely. Only reloading the driver recovers it (modprobe -r brcmfmac_cyw brcmfmac; modprobe brcmfmac). No firmware trap or "halted" message is logged. The only related kernel messages are brcmf_vif_set_mgmt_ie: vndr ie set error : -52.

Trigger
A tcpdump on wlan0 shows that the stall starts when the client sends a burst of about 900 mDNS multicast packets in about 3 s. The packets are Windows Delivery Optimization re-announcing 76 _dosvc._tcp.local service instances, each about 540 bytes, with 3 probes and 3 announcements over both IPv4 and IPv6. This is a client-side quirk, but it's valid traffic, and it permanently disables the AP.

Test results

Test Result
Same client, 2.4 GHz, channels 6 and 11, Wi-Fi power saving on or off stalls every time
One run recovered after a 6 s outage (fc_xon caught up), so the stall looks like a race
Same client, same burst, 5 GHz (channel 36) fc_xoff 4 = fc_xon 4, stable 3+ min
Same client, outgoing mDNS blocked on the client no burst, fc_xoff 0, stable 3+ min
Same client after a reboot (no burst) stable
Android phone (about 40 mDNS packets) fc_xoff 23 = fc_xon 23, stable 3+ min
AP isolation enabled still stalls
Firmware 7.45.265 (standard) and 7.45.241 (minimal) both stall
Kernel 6.12.62 and 6.18.50 both stall
Ruled out: power (throttled=0x0), SDIO errors, and RF interference (the stall is repeatable across channels). Our guess is that airtime at the 1 Mbps basic rate on 2.4 GHz pushes the firmware into a flow-control state it doesn't recover from. We haven't tried reproducing it with a synthetic multicast flood.
Steps to reproduce the behaviour
  1. Start a 2.4 GHz NetworkManager hotspot on the Pi 4.
  2. Connect a client that sends about 900 multicast packets of about 540 bytes within a few seconds after associating. A long-running Windows 11 PC with Delivery Optimization LAN sharing on does this.
  3. Watch /sys/kernel/debug/ieee80211/phy*/counters: fc_xoff goes above fc_xon and f2txdata freezes.
Device (s)

Raspberry Pi 4 Mod. B

System
  • Raspberry Pi OS Trixie (image 2025-12-04), full-upgraded 2026-10-27
  • Kernel 6.18.50 (also seen on 6.12.62)
  • firmware-brcm80211 20260519
  • Firmware: BCM4345/6 7.45.265 (28bca26 CY) FWID 01-b677b91b; also 7.45.241 (minimal)
  • wpasupplicant 2.10-24+rpt3, NetworkManager AP mode
Logs

System Information.txt

Additional context

Possible related to #7092

Langage dominant
C
Étoiles
13.3k
Forks
5.5k
Merge moyen
3 j 20 h
PR mergées (30 j)
27

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de raspberrypi/linux

Toutes les issues de raspberrypi/linux

Issues similaires

Plus d'issues C

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.