AIC8800D80 SDIO: hostapd stalls in COUNTRY_UPDATE when country_code changes the regulatory domain

[fuleo]

Summary

With country_code= set in hostapd.conf, hostapd enters
interface state UNINITIALIZED->COUNTRY_UPDATE and stays there for at least 90 s,
never reaching AP-ENABLED — but only when the requested country differs from the
regulatory domain already in force.

If the domain already matches, hostapd proceeds in ~1 s. Because the domain persists once
set, the second attempt/boot works — so it presents as intermittent, which makes it easy
to misdiagnose.

Throughout the stall systemctl is-active hostapd reports active.

Reproduction

# 1. force the world domain to recreate the pre-change condition
iw reg set 00
sleep 3
iw reg get | head -2          # -> country 00: DFS-UNSET

# 2. hostapd.conf:
#    interface=wlan0 / driver=nl80211 / ssid=test / hw_mode=g / channel=11
#    country_code=SG
#    ieee80211d=1

systemctl restart hostapd
journalctl -u hostapd -f

Observed:

wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
   ... no further state change for >90 s ...

Measured, three conditions:

Condition	Time to AP-ENABLED
no country_code	0 s
country_code=SG, domain already SG	1 s
country_code=SG, domain 00 (fresh iw reg set 00)	never within 90 s

The regulatory change itself succeeds — iw reg get goes from country 00 to
country SG: DFS-FCC. Only hostapd's state machine fails to advance.

What I verified, and what I did not

An obvious hypothesis is that rwnx_reg_notifier() fails to push the new channel
configuration to firmware — some public trees gate rwnx_send_me_chan_config_req() behind
a chip-ID list that omits the D80:

if (chipid == PRODUCT_ID_AIC8801 ||
   ((chipid == PRODUCT_ID_AIC8800DC || ...) && testmode == 0)) {
        rwnx_send_me_chan_config_req(rwnx_hw);
}

That is not what happens on my build. kprobes on the loaded module show both fire:

kworker/5:1 1172.505634: reg_notif: (rwnx_reg_notifier+0x0/0x58 [aic8800_fdrv])
kworker/5:1 1172.505652: chan_cfg:  (rwnx_send_me_chan_config_req+0x0/0x1e0 [aic8800_fdrv])
kworker/6:1 1172.588205: reg_notif: (rwnx_reg_notifier+0x0/0x58 [aic8800_fdrv])
kworker/6:1 1172.588212: chan_cfg:  (rwnx_send_me_chan_config_req+0x0/0x1e0 [aic8800_fdrv])
hostapd     1172.611143: apm_start: (rwnx_send_apm_start_req+0x0/0x2f8 [aic8800_fdrv])

reg_notifier fires twice, chan_config_req fires twice, and the driver goes on to call
rwnx_send_apm_start_req() — all while hostapd still reports COUNTRY_UPDATE. Also ruled
out: no phy-specific/custom regulatory domain is installed (iw reg get shows only the
global block, no phy#N section).

I have not identified the mechanism. hostapd leaves COUNTRY_UPDATE when it sees the
regulatory change reflected back over nl80211; that notification appears not to reach it,
or not in the form it expects. It is entirely possible this is a cfg80211/hostapd
interaction rather than a defect in this driver — I am reporting it here because this is
the most actively maintained AIC8800 SDIO tree, not because I can prove the fault is yours.

Environment — and an important caveat

Chip	AIC8800D80 over SDIO
Driver	aic8800_fdrv 20250410-011-6.4.3.0, in-tree Allwinner BSP
Kernel	6.6.98-vendor-sun60iw2
Board	Orange Pi 4 Pro (Allwinner A733), Armbian community build
hostapd	2.10

⚠️ This is not Radxa hardware, and the driver is the Allwinner BSP fork — which I have
confirmed differs from public trees (the chip-ID gate quoted above is present in one public
source and absent from my build). So this may not reproduce as-is on your tree.

The useful question: does a ROCK 5C show the same stall? It is the same chip on the same
bus, so if it does, this is a real shared issue; if it does not, the problem is specific to
the Allwinner BSP fork and I will take it there instead. Happy to run any instrumentation —
the board is on my bench with kprobes working.

Workaround

Omit country_code from hostapd.conf, or set the domain beforehand (iw reg set <CC>) so
hostapd's request is a no-op.

---

Context: found while diagnosing a separate, unrelated issue where 2.4 GHz AP mode emitted no
beacons at all on the Nov-2023 firmware blob (fixed by the Dec-2025 build — see
armbian/firmware#137). Full method and
tooling: https://github.com/fuleo/aic8800d80-ap-fix