Latest working kernel version: 2.6.23 (bcm43xx driver) Earliest failing kernel version: 2.6.24 Distribution: Gentoo Hardware Environment: x86_64 Software Environment: Problem Description: I am unable to associate with an AP, either manually with iwconfig or wpa_supplicant. This happens with the b43 driver under both 2.6.24 and wireless-2.6 everything branch as of commit d86916b7d36c4f0db8634fcc17fe2d747b317f17. My wireless card is: I have the following card: 02:07.0 Network controller: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller (rev 03) Subsystem: Linksys Unknown device 0013 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 64 Interrupt: pin A routed to IRQ 17 Region 0: Memory at fdffc000 (32-bit, non-prefetchable) [size=8K] Kernel driver in use: bcm43xx Kernel modules: bcm43xx 00: e4 14 20 43 06 00 00 00 03 00 80 02 00 40 00 00 10: 00 c0 ff fd 00 00 00 00 00 00 00 00 00 00 00 00 20: 00 00 00 00 00 00 00 00 00 00 00 00 37 17 13 00 30: 00 00 00 00 00 00 00 00 00 00 00 00 05 01 00 00 Attached is the dmesg and wpa_supplicant log when association is attempted
Created attachment 14815 [details] wpa_supplicant log
Created attachment 14816 [details] dmesg of kernel when attempting to associate
Please try with firmware from a driver v4.150. See the linuxwireless.org page from the logs.
Created attachment 14844 [details] dmesg of kernel with updated firmware Here's the dmesg for the updated firmware, same version of wireless-2.6 (tried to update but it won't build right now) Same failures as before, wpa_supplicant can't associate, I think this is the relevant error in the wpa_supplicant log: Authentication with 00:00:00:00:00:00 timed out.
Assocation still fails with same errors on updated wireless-2.6 tree, latest commit: commit 2b78397a79d3daa2ba6c633526a7e3b455f9fc73 Author: Stefano Brivio <stefano.brivio@polimi.it> Date: Sat Feb 9 07:20:43 2008 +0100
Assocation still fails with same errors on updated wireless-2.6 tree, latest commit: commit e040078e1d5700aaf2a554612db41c9384bc864a Author: Andrew Morton <akpm@linux-foundation.org> Date: Thu Feb 21 12:12:19 2008 -0500
Created attachment 14966 [details] dmesg with mem=1G parameter Requested in #bcm-users
Created attachment 14967 [details] dmesg of UP kernel requested in #bcm-users
Created attachment 14968 [details] dmesg of UP kernel with mem=1G Requested in #bcm-users
Created attachment 15043 [details] dmesg with noapic nolapic Requested in #bcm-users
cannot confirm, all fine here with same hw, check wpa_supplicant lists for reasons of 00-mac, check wpa_sup config, try EAPOL=2, check AP (firmware)
Created attachment 15048 [details] OK b43 with bcm4306 rev 3 + wpa_supplicant 0.5.5 RSN/EAP-PSK
wpa_supplicant 0.5.5 is known to work not very well with mac80211. Can you guys try to update to latest stable wpa_supplicant?
Created attachment 15065 [details] Upgraded wpa_supplicant debian maintainers disagree of reliable version. using ii wpasupplicant 0.6.2+git20080206.g8c0da Client support for WPA and WPA2 (IEEE 802.11i) no quality difference. well, only SIP/RTP and very low NTP/POP3/HTTP traffic on this network. RTP quality has still some occasional drops in voice quality with the T-Com TC300 WiFi-SIP/GSM mobile (known firmware bugs) connected to the AP, but b43/wpa_supplicant should not be involved in this. AP is a low quality Deutsche Telekom Sinus TC300 WiFi-FXO I "misuse" as SIP WLAN-ATA for CallWeaver PBX. but thx for the upgrade advise.
Created attachment 15103 [details] dmesg with updated wpa_supplicant-0.6.1 Updated wireless tree to: commit 6d85dc188604ae86181db0faadfe3d53e3fc9dbf Author: Johannes Berg <johannes@sipsolutions.net> Date: Mon Feb 25 16:27:50 2008 +0100 Upgraded to the (masked) wpa_supplicant-0.6.1 in gentoo, dmesg is attached. The MAC address is no longer all zeros, however, the card still cannot authenticate.
Assocation still fails with same errors on updated wireless-2.6 tree, latest commit: commit 4f739cf30891f277a6353d61275489528fab64e3 Author: Pavel Roskin <proski@gnu.org> Date: Fri Feb 22 00:01:07 2008 -0500
Still failing as of commit: commit 7556b76759a6a24931749473602a92b7a69e8688 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Date: Wed Mar 12 17:06:02 2008 -0700 It would be really really nice if someone would take some interest in this, I'm doing the best I can to supply information.
*STILL* failing as of commit: commit 78f8e644105878c3e13ca281529c3c9e661bf59f Author: Holger Schurig <hs4233@mail.mn-solutions.de> Date: Wed Mar 26 10:04:44 2008 +0100 Anyone out there? What should I do?
Created attachment 15662 [details] ssb IRQ routing patch Can you try this?
I am also having this same issue. lspci output to prove it: ;) 01:07.0 Network controller: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller (rev 03) I'll upload wpa_supplicant logs and b43 debug messages later today, but for now I can say my logs are almost, if not exactly, the same as Gabriel's. Michael, I'll try applying that patch to the linux-2.6.24-gentoo-r4 kernel later today, and see what happens. (Thank goodness we compile from source to begin with...)
Oh, and I thought I'd note that this _is_ a bigger issue than this one bug. Just google "b43 bcm4306 2.6.24" and you'll find numerous folks with similar symptoms (sees AP, won't connect, authentication times out, and MAC address mentioned by wpa_supplicant is blatantly wrong).
Re: comment #19, what should I be trying to apply this patch to?
(In reply to comment #22) > Re: comment #19, what should I be trying to apply this patch to? The kernel that doesn't work, I'd say.
Created attachment 15678 [details] dmesg with wireless-testing tree, patch applied Still doesn't work with patch applied to wireless-testing as of commit d8bc229839d90559418abd6c7c76c15d55df08b4 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Apr 8 16:46:36 2008 -0400
Can I have an lspci -vnn for the card?
Oh sorry, it was lspci -vvn
lspci -vvn for devices that use bcm43xx driver: 01:07.0 0280: 14e4:4320 (rev 03) Subsystem: 1737:0015 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 64 Interrupt: pin A routed to IRQ 18 Region 0: Memory at fdefe000 (32-bit, non-prefetchable) [size=8K] Kernel driver in use: bcm43xx Kernel modules: bcm43xx If you want complete output I've pasted that below: 00:00.0 0600: 8086:2560 (rev 01) Subsystem: 1028:0127 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx- Latency: 0 Region 0: Memory at f0000000 (32-bit, prefetchable) [size=64M] Capabilities: [e4] Vendor Specific Information <?> Kernel driver in use: agpgart-intel Kernel modules: intel-agp 00:02.0 0300: 8086:2562 (rev 01) (prog-if 00 [VGA controller]) Subsystem: 1028:0127 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 18 Region 0: Memory at e8000000 (32-bit, prefetchable) [size=128M] Region 1: Memory at fe100000 (32-bit, non-prefetchable) [size=512K] Capabilities: [d0] Power Management version 1 Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-) Status: D0 PME-Enable- DSel=0 DScale=0 PME- Kernel driver in use: intelfb Kernel modules: intelfb 00:1d.0 0c03: 8086:24c2 (rev 01) (prog-if 00 [UHCI]) Subsystem: 1028:0127 Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 18 Region 4: I/O ports at ff80 [size=32] Kernel driver in use: uhci_hcd 00:1d.1 0c03: 8086:24c4 (rev 01) (prog-if 00 [UHCI]) Subsystem: 1028:0127 Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin B routed to IRQ 19 Region 4: I/O ports at ff60 [size=32] Kernel driver in use: uhci_hcd 00:1d.2 0c03: 8086:24c7 (rev 01) (prog-if 00 [UHCI]) Subsystem: 1028:0127 Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin C routed to IRQ 16 Region 4: I/O ports at ff40 [size=32] Kernel driver in use: uhci_hcd 00:1d.7 0c03: 8086:24cd (rev 01) (prog-if 20 [EHCI]) Subsystem: 1028:0127 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin D routed to IRQ 17 Region 0: Memory at fe180800 (32-bit, non-prefetchable) [size=1K] Capabilities: [50] Power Management version 2 Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0+,D1-,D2-,D3hot+,D3cold+) Status: D0 PME-Enable- DSel=0 DScale=0 PME- Capabilities: [58] Debug port: BAR=1 offset=0080 Kernel driver in use: ehci_hcd 00:1e.0 0604: 8086:244e (rev 81) (prog-if 00 [Normal decode]) Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR+ INTx- Latency: 0 Bus: primary=00, secondary=01, subordinate=01, sec-latency=32 Memory behind bridge: fc000000-fdffffff Secondary status: 66MHz- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort+ <SERR- <PERR- BridgeCtl: Parity- SERR+ NoISA+ VGA- MAbort- >Reset- FastB2B- PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn- 00:1f.0 0601: 8086:24c0 (rev 01) Control: I/O+ Mem+ BusMaster+ SpecCycle+ MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 00:1f.1 0101: 8086:24cb (rev 01) (prog-if 8a [Master SecP PriP]) Subsystem: 1028:0127 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 16 Region 0: I/O ports at 01f0 [size=8] Region 1: I/O ports at 03f4 [size=1] Region 2: I/O ports at 0170 [size=8] Region 3: I/O ports at 0374 [size=1] Region 4: I/O ports at ffa0 [size=16] Region 5: Memory at 30000000 (32-bit, non-prefetchable) [size=1K] Kernel driver in use: PIIX_IDE 00:1f.3 0c05: 8086:24c3 (rev 01) Subsystem: 1028:0127 Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin B routed to IRQ 11 Region 4: I/O ports at ec80 [size=32] 00:1f.5 0401: 8086:24c5 (rev 01) Subsystem: 1028:0127 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin B routed to IRQ 20 Region 0: I/O ports at e800 [size=256] Region 1: I/O ports at ec40 [size=64] Region 2: Memory at fe180400 (32-bit, non-prefetchable) [size=512] Region 3: Memory at fe180000 (32-bit, non-prefetchable) [size=256] Capabilities: [50] Power Management version 2 Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0+,D1-,D2-,D3hot+,D3cold+) Status: D0 PME-Enable- DSel=0 DScale=0 PME- Kernel driver in use: Intel ICH Kernel modules: snd-intel8x0 01:07.0 0280: 14e4:4320 (rev 03) Subsystem: 1737:0015 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 64 Interrupt: pin A routed to IRQ 18 Region 0: Memory at fdefe000 (32-bit, non-prefetchable) [size=8K] Kernel driver in use: bcm43xx Kernel modules: bcm43xx 01:08.0 0400: 14f1:8800 (rev 05) Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 64 (5000ns min, 13750ns max), Cache Line Size: 64 bytes Interrupt: pin A routed to IRQ 11 Region 0: Memory at fc000000 (32-bit, non-prefetchable) [size=16M] Capabilities: [44] Vital Product Data <?> Capabilities: [4c] Power Management version 2 Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-) Status: D0 PME-Enable- DSel=0 DScale=0 PME-
Eep. Guess next time I'll attach instead.
Created attachment 15804 [details] hack to disable btcoex Can you test this patch? It is just a hack. If this makes your device work, I'll do the patch that fixes it correctly.
lspci -vvn 02:07.0 0280: 14e4:4320 (rev 03) Subsystem: 1737:0013 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 64 Interrupt: pin A routed to IRQ 17 Region 0: Memory at fdffc000 (32-bit, non-prefetchable) [size=8K] Kernel driver in use: bcm43xx Kernel modules: ssb, bcm43xx Next is trying the patch.
Association works now! Applied the patch to wireless-testing git tree as of commit: commit 37bfd4f9703be5de4f632b08431127c2c1263353 Author: Pavel Roskin <proski@gnu.org> Date: Fri Feb 22 00:01:07 2008 -0500
That patch works on a "2.6.24-gentoo-r4" kernel! Woohoo! Now, I still get strange "Operation not supported" messages, but I'll report those separately.
(In reply to comment #31) > Association works now! Applied the patch to wireless-testing git tree as of Can you provide me the output of cat $(find /sys -name ssb_sprom) please? You can send that to me in private, if you desire, as this information will contain your card's MAC address, in case you don't want to publish that here. Jacob, can you also do this, please?
(In reply to comment #32) > Now, I still get strange "Operation not supported" messages, but I'll report > those separately. If this doesn't break operation, please don't file a bug report for this. We are aware of these messages and they are harmless. This will all get fixed when the new nl80211 API is finished.
Alright, I won't file then. I'll just bug you on the mailing lists to please hurry up. ;) Output sent privately.
These two patches, applied in that order, are the official patches that should fix it: http://bu3sch.de/patches/wireless-testing/20080419-1646/patches/002-b43-workaround-bt-bit.patch http://bu3sch.de/patches/wireless-testing/20080419-1646/patches/004-b43-add-more-bf-workarounds.patch They are submitted for inclusion in wireless-testing.git and should soon appear in that git tree. Thanks a lot for your support in debugging this bug. If somebody else has a device with that bug, there's no need to re-open this bugzilla entry. Simply send me your lspci -vvn output and I will add your device to the workaround quirk code. (Of course, you can also send a patch to me).
I really appreciate your work. Please don't get me wrong. It's just, workaround code is good for temporary solutions. Is the quirk code for specific devices that have a bug in them or something?
The _device_ has a bug in the SPROM. We can only fix that with a workaround in the driver, of course. The device vendor set the boardflags bits in the PROM in a wrong way. In particular it is the bit that selects which GPIO pin is used for bluetooth coexistance. On these devices it turns out that the boardflags set the BT pin to a pin that's used for the TX circuitry. That obviously blows up. So, as these devices don't have a bluetooth device on the card anyway, we simply disable the bt-does-exit-bit.
Ah, great. I see now. Thanks for your patience and explanation!
Thanks for your help.