ap: enable 40/80MHz AP on FullMAC chips (Galaxy S10)

On Broadcom FullMAC (brcmfmac) chips, hostapd aborted with -95 (Not
supported) whenever a 40/80MHz AP was requested: the firmware can't run the
HT40 OBSS coexistence scan on an AP vif. The crash surfaced reliably in
Droidspaces managed mode, where the longer setup window let hostapd reach
the scan instead of falling back first.

Emit no_pri_sec_switch=1 for HT40/VHT so hostapd skips that scan, and bump
the hostapd-vap submodule to wire no_pri_sec_switch into the config parser
(the upstream struct field exists but was unreachable from hostapd.conf) and
to fall back to 20MHz when the driver rejects the HT40 pair instead of
hard-failing. The FullMAC firmware then self-manages the final width. Assert
the patch is present at build time so a submodule bump can't silently drop it.

Signed-off-by: ravindu644 <droidcasts@protonmail.com>

Author: ravindu644

backend/start-ap

@@ -531,15 +531,26 @@ write_hostapd_conf() {
         # max chip compatibility (width is independent of it).
         extra="ieee80211n=1
 ieee80211ac=1"
+        # no_pri_sec_switch=1 skips hostapd's 20/40MHz OBSS coexistence scan
+        # (the HT_SCAN state). FullMAC chips (e.g. Broadcom/brcmfmac on the
+        # Galaxy S10) can't scan on an AP vif and return -95 (Not supported),
+        # which aborts hostapd whenever HT40/VHT is requested. The firmware
+        # self-manages the channel, so skipping the scan is safe. We set HT40+/-
+        # explicitly, so the pri/sec auto-switch this also disables is unwanted
+        # anyway. Only needed for HT40/VHT (20MHz has no ht_capab, no HT_SCAN).
+        # Requires the hostapd-vap fork's config-parser wiring (the upstream
+        # struct field exists but is otherwise unreachable from hostapd.conf).
         if [ "$EFFECTIVE_WIDTH" = "80" ]; then
             seg0=$(vht_seg0 "$CHANNEL"); dir=$(ht40_dir "$CHANNEL" "$seg0")
             extra="$extra
+no_pri_sec_switch=1
 ht_capab=[HT40$dir]
 vht_oper_chwidth=1
 vht_oper_centr_freq_seg0_idx=$seg0"
         elif [ "$EFFECTIVE_WIDTH" = "40" ]; then
             seg0=$(vht_seg0 "$CHANNEL"); dir=$(ht40_dir "$CHANNEL" "$seg0")
             extra="$extra
+no_pri_sec_switch=1
 ht_capab=[HT40$dir]
 vht_oper_chwidth=0"
         fi

externals/hostapd

@@ -68,6 +68,13 @@ strip "$OUT/busybox" 2>/dev/null || true
 echo "### Building hostapd"
 vendor hostapd
 cd "$SRC/hostapd/hostapd"
+# Assert the fork wires no_pri_sec_switch into the config parser. start-ap emits
+# no_pri_sec_switch=1 for HT40/VHT to skip the OBSS coexistence scan, which
+# FullMAC chips (Broadcom brcmfmac on the Galaxy S10) abort with -95. Stock
+# hostapd has the struct field but no parser line, so an unpatched submodule
+# would silently reject the option and crash on 40/80MHz. (See externals/hostapd.)
+grep -q 'no_pri_sec_switch' config_file.c || {
+    echo "hostapd source is missing the no_pri_sec_switch config patch - check externals/hostapd"; exit 1; }
 cat > .config <<'EOF'
 CONFIG_DRIVER_NL80211=y
 CONFIG_LIBNL32=y