wifi: brcmfmac: log the firmware status when a connect fails

brcmf_bss_connect_done() receives the firmware event in @e but discards it on the failure path. Every failed connect is reported to cfg80211 as WLAN_STATUS_AUTH_TIMEOUT (16), whatever the firmware actually said, so userspace only ever sees:

wlan0: CTRL-EVENT-ASSOC-REJECT bssid=00:00:00:00:00:00 status_code=16

The all-zero BSSID comes from the same place: conn_params is memset to zero and profile->bssid has not been filled in when the station never associated.

status_code=16 therefore carries no information about the cause. It is not an AP response and it does not mean "authentication timed out" - it is the only failure value this driver can produce. This is a recurring source of
confusion: [1] has been open since 2023 with more than twenty follow-ups and no explanation of the code, and covers BCM4345/6, BCM43430 and CYW43455 across several kernel versions. It supersedes [2], filed against the firmware repository a day earlier and closed in favour of it.

The firmware's own status (BRCMF_E_STATUS_*) is more specific - FAIL, TIMEOUT, NO_NETWORKS, ABORT and so on - and it is already in hand. Log it so the cause can be narrowed down without rebuilding the kernel.

bphy_err() is used rather than brcmf_dbg() or brcmf_info(): it is the form the rest of this file uses, and of the three it is the only one that is both visible in a distribution kernel and bounded. brcmf_dbg(CONN) expands to no_printk() unless CONFIG_BRCMDBG is set, which is what makes the reports in [1] and [2] impossible to act on - the people hitting this run stock kernels. brcmf_info() expands to a plain pr_info() in a non-debug build and is not rate limited, and wpa_supplicant retries the association every few seconds, so it would flood the log. bphy_err() is guarded by net_ratelimit() there, so a station retrying against an unreachable AP prints at most a few lines per second.

All three fields are printed because only some of them are meaningful on each path into the failure branch. brcmf_is_nonetwork() keys off @status, so that is the useful field for a join that never associated - the case in [1]. brcmf_is_linkdown() keys off @event_code and @flags and does not look at @status at all, so @status can read 0 there; on those events it is @reason which carries the 802.11 reason code, as the mapping in brcmf_map_fw_linkdown_reason() shows. Printing the three together lets the reader tell which path was taken instead of guessing from one number.

The status reported to cfg80211 is left alone; changing it would alter what userspace sees.

[1] https://github.com/RPi-Distro/firmware-nonfree/issues/38
[2] https://github.com/raspberrypi/firmware/issues/1829

---
v2:
- use bphy_err() instead of brcmf_err(); it is what the rest of
cfg80211.c uses and it names the wiphy in the message
- correct the commit message: brcmf_is_linkdown() keys off @flags,
not @reason
- tag the target tree in the subject
v1: https://lore.kernel.org/linux-wireless/[email protected]/

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
 1 file changed, 2 insertions(+)

index 872c488..114dabb 100644
@@ -6522,6 +6522,8 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
 			clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
 				  &ifp->vif->sme_state);
 			conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
+			bphy_err(ifp->drvr, "connect failed: event %u status %u reason %u\n",
+				 e->event_code, e->status, e->reason);
 		}
 		conn_params.links[0].bssid = profile->bssid;
 		conn_params.req_ie = conn_info->req_ie;