Bug 432883

Summary: ieee80211_softmac drivers fail to associate with WPA2/CCMP
Product: Red Hat Enterprise Linux 5 Reporter: Dan Williams <dcbw>
Component: kernelAssignee: John W. Linville <linville>
Status: CLOSED WORKSFORME QA Contact: Martin Jenner <mjenner>
Severity: low Docs Contact:
Priority: low    
Version: 5.2CC: dzickus
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-12-04 19:09:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dan Williams 2008-02-14 22:09:24 UTC
Configure the AP for WPA2-PSK with a pairwise cipher of CCMP (group can be
TKIP).  Configure wpa_supplicant to connect to it, watch the supplicant get
through the 4-way handshake step 4/4 but then fail because the driver sends a
disconnection event.

RHEL-5.2 with ipw3945 is able to connect fine; ipw2200 F-7 2.6.23-15 works fine;
but bcm43xx and zd1211rw (both use softmac) on RHEL 5.2 fail.

Example AP configuration:

   IE: IEEE 802.11i/WPA2 Version 1
       Group Cipher : CCMP 
       Pairwise Ciphers (1) : CCMP 
       Authentication Suites (1) : PSK

Comment 1 Dan Williams 2008-02-14 22:21:21 UTC
Feel free to point me at kernels with softmac debugging compiled in and I'll
happily get some logs for you if you'd like.

Just tried with a Dell Precision M6300, RHEL 5, kernel 2.6.18-53.1.4.el5, with
onboard ipw3945 and a USB zd1211rw (3Com 3CRUSB10075).  ipw3945 works as
expected, zd1211rw fails as expected.

wpa_supplicant config:

ap_scan=1

network={
    ssid="my ssid"
    key_mgmt=WPA-PSK
    scan_ssid=1
    proto=RSN WPA
    pairwise=CCMP
    group=CCMP
    psk="my fancy psk"
}

This specific config tested iwth a Linksys WRT54GC (a small travel-type AP),
though another machine failed when trying to connect to a very similarly
configured WRT54GL.

I'd also note that softmac is missing some WEXT disassoc events on failure
cases, seems like ieee80211softmac_call_events_locked() should be sending an
SIWAP event of 00:00:00:00:00:00 on both IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED
and IEEE80211SOFTMAC_EVENT_AUTH_FAILED, and possibly their TIMED_OUT
counterparts as well.  This causes the supplicant to get stuck waiting for the
driver to associate long after the driver has given up and sent the EVCUSTOM
"associate failed" event.

Comment 2 John W. Linville 2008-05-14 21:48:43 UTC
Dan, the kernels here have IEEE80211_DEBUG set:

   http://people.redhat.com/linville/kernels/rhel5/

Comment 3 John W. Linville 2008-05-29 20:37:58 UTC
ieee80211 and related drivers updated in the kernels currently at the URL 
above.  Dan can you recreate this issue with those kernels?

Comment 4 John W. Linville 2008-08-14 20:07:42 UTC
Can you recreate the issue with the kernels available here?

   http://people.redhat.com/linville/kernels/rhel5/

Please give them a try and post the results here...thanks!

Comment 5 John W. Linville 2008-12-04 15:57:20 UTC
Dan, are you still seeing this?

Comment 6 Dan Williams 2008-12-04 19:09:18 UTC
Tested with a bcm4318 with "Microcode rev 0x127, pl 0xe (2005-04-18 02:36:27)" on the same AP the bug was reported against, and it works fine with your jwltest.73 kernel.

I get a lot of:

bcm43xx: ASSERTION FAILED (radio_attenuation < 10) at: drivers/net/wireless/bcm43xx/bcm43xx_phy.c:1489:bcm43xx_find_lopair()
bcm43xx: WARNING Writing invalid LOpair (low: 0, high: -56, index: 120)
 [<f8fca20b>] bcm43xx_phy_lo_adjust+0x1a3/0x1e5 [bcm43xx]
 [<f8fc72fd>] bcm43xx_radio_set_txpower_bg+0x1b2/0x1dd [bcm43xx]
 [<f8fcb649>] bcm43xx_phy_initb6+0x43d/0x637 [bcm43xx]
 [<f8fcb827>] bcm43xx_phy_initg+0x94/0xd3e [bcm43xx]
 [<c0439b7f>] delay_tsc+0xb/0x13
 [<f8fcd8f9>] bcm43xx_phy_init+0x5ba/0x5d1 [bcm43xx]
 [<f8fbeed4>] bcm43xx_chip_init+0x6ff/0x9f0 [bcm43xx]
 [<c0410002>] cyrix_get_free_region+0x43/0x90
 [<f8fc03c1>] wireless_core_up+0x16d/0x62f [bcm43xx]
 [<f8fcdbb9>] bcm43xx_pctl_set_clock+0xd6/0x104 [bcm43xx]
 [<f8fc0bb8>] bcm43xx_select_wireless_core+0x335/0x496 [bcm43xx]
 [<f8fc0df2>] bcm43xx_init_board+0x44/0x104 [bcm43xx]
 [<c05b56b7>] dev_open+0x2b/0x62
 ...