[PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[Sebastian Smolorz]

Fix authentication process of wireless driver at76c50x-usb.c which was broken
since kernel 2.6.31

Sebastian Smolorz (2):
  at76c50x-usb: Move function at76_join() several lines up
  at76c50x-usb: Extract bssid from authentication frame

 drivers/net/wireless/at76c50x-usb.c |  108 +++++++++++++++++++++++------------
 drivers/net/wireless/at76c50x-usb.h |    1 +
 2 files changed, 73 insertions(+), 36 deletions(-)

[PATCH 1/2] at76c50x-usb: Move function at76_join() several lines up

[Sebastian Smolorz]

This patch does a simple code move of at76_join() so that
at76_mac80211_tx() follows at76_join() in the driver's source file.

This is a preparatory patch for the following patch where we need
to call at76_join() from at76_mac80211_tx() in order to
authenticate successfully with a bssid.

Signed-off-by: Sebastian Smolorz <sesmo@gmx.net>
---
 drivers/net/wireless/at76c50x-usb.c |   72 +++++++++++++++++-----------------
 1 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 8a2d4af..cb3d4b7 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1649,6 +1649,42 @@ exit:
 		return NULL;
 }
 
+static int at76_join(struct at76_priv *priv)
+{
+	struct at76_req_join join;
+	int ret;
+
+	memset(&join, 0, sizeof(struct at76_req_join));
+	memcpy(join.essid, priv->essid, priv->essid_size);
+	join.essid_size = priv->essid_size;
+	memcpy(join.bssid, priv->bssid, ETH_ALEN);
+	join.bss_type = INFRASTRUCTURE_MODE;
+	join.channel = priv->channel;
+	join.timeout = cpu_to_le16(2000);
+
+	at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
+	ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
+				    sizeof(struct at76_req_join));
+
+	if (ret < 0) {
+		printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
+		       wiphy_name(priv->hw->wiphy), ret);
+		return 0;
+	}
+
+	ret = at76_wait_completion(priv, CMD_JOIN);
+	at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
+	if (ret != CMD_STATUS_COMPLETE) {
+		printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
+		       wiphy_name(priv->hw->wiphy), ret);
+		return 0;
+	}
+
+	at76_set_pm_mode(priv);
+
+	return 0;
+}
+
 static void at76_mac80211_tx_callback(struct urb *urb)
 {
 	struct at76_priv *priv = urb->context;
@@ -1818,42 +1854,6 @@ static void at76_remove_interface(struct ieee80211_hw *hw,
 	at76_dbg(DBG_MAC80211, "%s()", __func__);
 }
 
-static int at76_join(struct at76_priv *priv)
-{
-	struct at76_req_join join;
-	int ret;
-
-	memset(&join, 0, sizeof(struct at76_req_join));
-	memcpy(join.essid, priv->essid, priv->essid_size);
-	join.essid_size = priv->essid_size;
-	memcpy(join.bssid, priv->bssid, ETH_ALEN);
-	join.bss_type = INFRASTRUCTURE_MODE;
-	join.channel = priv->channel;
-	join.timeout = cpu_to_le16(2000);
-
-	at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
-	ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
-				    sizeof(struct at76_req_join));
-
-	if (ret < 0) {
-		printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-		       wiphy_name(priv->hw->wiphy), ret);
-		return 0;
-	}
-
-	ret = at76_wait_completion(priv, CMD_JOIN);
-	at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
-	if (ret != CMD_STATUS_COMPLETE) {
-		printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
-		       wiphy_name(priv->hw->wiphy), ret);
-		return 0;
-	}
-
-	at76_set_pm_mode(priv);
-
-	return 0;
-}
-
 static void at76_dwork_hw_scan(struct work_struct *work)
 {
 	struct at76_priv *priv = container_of(work, struct at76_priv,
-- 
1.6.4.4

[PATCH 2/2] at76c50x-usb: Extract bssid from authentication frame

[Sebastian Smolorz]

The driver at76c50x-usb is unable to authenticate with an AP since
kernel 2.6.31 for the following reason: The join command of the firmware
needs to be sent with the right bssid before any transmission can start.
Before kernel 2.6.31 mac80211 informed its drivers about the changing
bssid early enough for at76c50x-usb but during the development of 2.6.31
mac80211's behaviour changed. Now a new bssid is set after the
association.

This patch changes the tx routine of the driver at76c50x-usb in such a
way that a new bssid is extracted from an authentication frame and the
join command with that bssid is processed.

Signed-off-by: Sebastian Smolorz <sesmo@gmx.net>
---
 drivers/net/wireless/at76c50x-usb.c |   36 +++++++++++++++++++++++++++++++++++
 drivers/net/wireless/at76c50x-usb.h |    1 +
 2 files changed, 37 insertions(+), 0 deletions(-)

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index cb3d4b7..98328b7 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -7,6 +7,7 @@
  * Copyright (c) 2004 Balint Seeber <n0_5p4m_p13453@hotmail.com>
  * Copyright (c) 2007 Guido Guenther <agx@sigxcpu.org>
  * Copyright (c) 2007 Kalle Valo <kalle.valo@iki.fi>
+ * Copyright (c) 2010 Sebastian Smolorz <sesmo@gmx.net>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -1685,6 +1686,22 @@ static int at76_join(struct at76_priv *priv)
 	return 0;
 }
 
+static void at76_work_join_bssid(struct work_struct *work)
+{
+	struct at76_priv *priv = container_of(work, struct at76_priv,
+					      work_join_bssid);
+
+	if (priv->device_unplugged)
+		return;
+
+	mutex_lock(&priv->mtx);
+
+	if (is_valid_ether_addr(priv->bssid))
+		at76_join(priv);
+
+	mutex_unlock(&priv->mtx);
+}
+
 static void at76_mac80211_tx_callback(struct urb *urb)
 {
 	struct at76_priv *priv = urb->context;
@@ -1722,6 +1739,7 @@ static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 	struct at76_priv *priv = hw->priv;
 	struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 	int padding, submit_len, ret;
 
 	at76_dbg(DBG_MAC80211, "%s()", __func__);
@@ -1732,6 +1750,21 @@ static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 		return NETDEV_TX_BUSY;
 	}
 
+	/* The following code lines are important when the device is going to
+	 * authenticate with a new bssid. The driver must send CMD_JOIN before
+	 * an authentication frame is transmitted. For this to succeed, the
+	 * correct bssid of the AP must be known. As mac80211 does not inform
+	 * drivers about the bssid prior to the authentication process the
+	 * following workaround is necessary. If the TX frame is an
+	 * authentication frame extract the bssid and send the CMD_JOIN. */
+	if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) {
+		if (compare_ether_addr(priv->bssid, mgmt->bssid)) {
+			memcpy(priv->bssid, mgmt->bssid, ETH_ALEN);
+			ieee80211_queue_work(hw, &priv->work_join_bssid);
+			return NETDEV_TX_BUSY;
+		}
+	}
+
 	ieee80211_stop_queues(hw);
 
 	at76_ledtrig_tx_activity();	/* tell ledtrigger we send a packet */
@@ -1806,6 +1839,7 @@ static void at76_mac80211_stop(struct ieee80211_hw *hw)
 	at76_dbg(DBG_MAC80211, "%s()", __func__);
 
 	cancel_delayed_work(&priv->dwork_hw_scan);
+	cancel_work_sync(&priv->work_join_bssid);
 	cancel_work_sync(&priv->work_set_promisc);
 
 	mutex_lock(&priv->mtx);
@@ -2107,6 +2141,7 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
 	mutex_init(&priv->mtx);
 	INIT_WORK(&priv->work_set_promisc, at76_work_set_promisc);
 	INIT_WORK(&priv->work_submit_rx, at76_work_submit_rx);
+	INIT_WORK(&priv->work_join_bssid, at76_work_join_bssid);
 	INIT_DELAYED_WORK(&priv->dwork_hw_scan, at76_dwork_hw_scan);
 
 	tasklet_init(&priv->rx_tasklet, at76_rx_tasklet, 0);
@@ -2508,5 +2543,6 @@ MODULE_AUTHOR("Balint Seeber <n0_5p4m_p13453@hotmail.com>");
 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>");
 MODULE_AUTHOR("Guido Guenther <agx@sigxcpu.org>");
 MODULE_AUTHOR("Kalle Valo <kalle.valo@iki.fi>");
+MODULE_AUTHOR("Sebastian Smolorz <sesmo@gmx.net>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/at76c50x-usb.h b/drivers/net/wireless/at76c50x-usb.h
index 1ec5ccf..db89d72 100644
--- a/drivers/net/wireless/at76c50x-usb.h
+++ b/drivers/net/wireless/at76c50x-usb.h
@@ -387,6 +387,7 @@ struct at76_priv {
 	/* work queues */
 	struct work_struct work_set_promisc;
 	struct work_struct work_submit_rx;
+	struct work_struct work_join_bssid;
 	struct delayed_work dwork_hw_scan;
 
 	struct tasklet_struct rx_tasklet;
-- 
1.6.4.4

Re: [PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[Jason Andryuk]

On Tue, Jun 22, 2010 at 10:51 AM, Sebastian Smolorz
<Sebastian.Smolorz@gmx.de> wrote:
> Fix authentication process of wireless driver at76c50x-usb.c which was broken
> since kernel 2.6.31

Thanks for working on this, but unfortunately it does not work with my
Linksys WUSB11.  Does it work for you?

[  168.420082] usb 4-1: new full speed USB device using uhci_hcd and address 2
[  168.719582] Atmel at76x USB Wireless LAN Driver 0.17 loading
[  168.743011] usb 4-1: using firmware atmel_at76c503-i3861.bin
(version 0.90.0-44)
[  168.746784] phy1: Selected rate control algorithm 'minstrel'
[  168.747410] phy1: USB 4-1:1.0, MAC 00:06:25:00:6a:7a, firmware 0.90.0-2
[  168.747413] phy1: regulatory domain 0x10: FCC (USA)
[  168.747434] usbcore: registered new interface driver at76c50x-usb
[  168.803980] udev: renamed network interface wlan0 to wlan3
[  168.837883] ADDRCONF(NETDEV_UP): wlan3: link is not ready
[  274.423484] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
[  274.622558] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
[  274.822600] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
[  275.022557] wlan3: direct probe to 00:13:46:08:8a:6e timed out
[  284.694487] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
[  284.900075] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
[  285.105548] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
[  285.302565] wlan3: direct probe to 00:13:46:08:8a:6e timed out
[  294.954450] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
[  295.152564] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
[  295.352559] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
[  295.552556] wlan3: direct probe to 00:13:46:08:8a:6e timed out

> +       /* The following code lines are important when the device is going to
> +        * authenticate with a new bssid. The driver must send CMD_JOIN before
> +        * an authentication frame is transmitted. For this to succeed, the
> +        * correct bssid of the AP must be known. As mac80211 does not inform
> +        * drivers about the bssid prior to the authentication process the
> +        * following workaround is necessary. If the TX frame is an
> +        * authentication frame extract the bssid and send the CMD_JOIN. */
> +       if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) {
> +               if (compare_ether_addr(priv->bssid, mgmt->bssid)) {
> +                       memcpy(priv->bssid, mgmt->bssid, ETH_ALEN);
> +                       ieee80211_queue_work(hw, &priv->work_join_bssid);
> +                       return NETDEV_TX_BUSY;
> +               }
> +       }
> +

The check for IEEE80211_STYPE_AUTH may be insufficient since direct
probe is sent with frame control IEEE80211_STYPE_PROBE_REQ.  Maybe a
better check would be comparing struct ieee80211_work.type to
IEEE80211_WORK_DIRECT_PROBE or IEEE80211_WORK_AUTH?  I am not sure if
that is accessible in the driver's tx function though.

With the frame_control check modified for either IEEE80211_STYPE_AUTH
or IEEE80211_STYPE_PROBE_REQ, it is still unsuccessful.
at76_work_join_bssid is called between the first and second direct
probe attempt.  However, the CMD_JOIN command is not in the log.
Presumably that occurs because the BSSID pulled from the PROBE_REQ is
ff:ff:ff:ff:ff:ff which fails the is_valid_ether_addr(priv->bssid)
check in at76_work_join_bssid.

http://lxr.linux.no/#linux+v2.6.34/include/linux/etherdevice.h#L100

I'm glad someone is working on this.

Jason

Re: [PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[Sebastian Smolorz]

Jason Andryuk wrote:
> On Tue, Jun 22, 2010 at 10:51 AM, Sebastian Smolorz
> 
> <Sebastian.Smolorz@gmx.de> wrote:
> > Fix authentication process of wireless driver at76c50x-usb.c which was
> > broken since kernel 2.6.31
> 
> Thanks for working on this, but unfortunately it does not work with my
> Linksys WUSB11.

Thanks for testing the patch.

> Does it work for you?

It does but I must admit that I did not test the direct probing, only the 
authentication. 

Which kernel version did you patch?

> 
> [  168.420082] usb 4-1: new full speed USB device using uhci_hcd and
> address 2 [  168.719582] Atmel at76x USB Wireless LAN Driver 0.17
> loading
> [  168.743011] usb 4-1: using firmware atmel_at76c503-i3861.bin
> (version 0.90.0-44)
> [  168.746784] phy1: Selected rate control algorithm 'minstrel'
> [  168.747410] phy1: USB 4-1:1.0, MAC 00:06:25:00:6a:7a, firmware
> 0.90.0-2 [  168.747413] phy1: regulatory domain 0x10: FCC (USA)
> [  168.747434] usbcore: registered new interface driver at76c50x-usb
> [  168.803980] udev: renamed network interface wlan0 to wlan3
> [  168.837883] ADDRCONF(NETDEV_UP): wlan3: link is not ready
> [  274.423484] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
> [  274.622558] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
> [  274.822600] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
> [  275.022557] wlan3: direct probe to 00:13:46:08:8a:6e timed out
> [  284.694487] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
> [  284.900075] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
> [  285.105548] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
> [  285.302565] wlan3: direct probe to 00:13:46:08:8a:6e timed out
> [  294.954450] wlan3: direct probe to 00:13:46:08:8a:6e (try 1)
> [  295.152564] wlan3: direct probe to 00:13:46:08:8a:6e (try 2)
> [  295.352559] wlan3: direct probe to 00:13:46:08:8a:6e (try 3)
> [  295.552556] wlan3: direct probe to 00:13:46:08:8a:6e timed out
> 
> > +       /* The following code lines are important when the device is
> > going to +        * authenticate with a new bssid. The driver must
> > send CMD_JOIN before +        * an authentication frame is
> > transmitted. For this to succeed, the +        * correct bssid of the
> > AP must be known. As mac80211 does not inform +        * drivers about
> > the bssid prior to the authentication process the +        * following
> > workaround is necessary. If the TX frame is an +        *
> > authentication frame extract the bssid and send the CMD_JOIN. */ +    
> >   if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) { +    
> >           if (compare_ether_addr(priv->bssid, mgmt->bssid)) { +      
> >                 memcpy(priv->bssid, mgmt->bssid, ETH_ALEN); +        
> >               ieee80211_queue_work(hw, &priv->work_join_bssid); +    
> >                   return NETDEV_TX_BUSY;
> > +               }
> > +       }
> > +
> 
> The check for IEEE80211_STYPE_AUTH may be insufficient since direct
> probe is sent with frame control IEEE80211_STYPE_PROBE_REQ.  Maybe a
> better check would be comparing struct ieee80211_work.type to
> IEEE80211_WORK_DIRECT_PROBE or IEEE80211_WORK_AUTH?  I am not sure if
> that is accessible in the driver's tx function though.

No, it's not accessible by the driver.

> 
> With the frame_control check modified for either IEEE80211_STYPE_AUTH
> or IEEE80211_STYPE_PROBE_REQ, it is still unsuccessful.
> at76_work_join_bssid is called between the first and second direct
> probe attempt.  However, the CMD_JOIN command is not in the log.
> Presumably that occurs because the BSSID pulled from the PROBE_REQ is
> ff:ff:ff:ff:ff:ff which fails the is_valid_ether_addr(priv->bssid)
> check in at76_work_join_bssid.

The problem is that when probed directly, no (real) bssid is coded in the 
frame, only the multicast address. So with a frame of type 
IEEE80211_STYPE_PROBE_REQ we have no chance to decode the bssid because 
mac80211 doesn't give us the needed information. I think in the case of 
direct probing we are lost, only the authentication works with the patch I 
sent. Another solution would be to change mac80211 but that would be a 
special solution for just one driver. It's questionable if this is a viable 
way. On the other hand it would be great to have a working driver again.

-- 
Sebastian

Re: [PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[Jason Andryuk]

On Mon, Jun 28, 2010 at 11:46 AM, Sebastian Smolorz
<Sebastian.Smolorz@gmx.de> wrote:
> Jason Andryuk wrote:
>> On Tue, Jun 22, 2010 at 10:51 AM, Sebastian Smolorz
> It does but I must admit that I did not test the direct probing, only the
> authentication.
>
> Which kernel version did you patch?

I used John Linville's wireless-testing tag master-2010-06-24
(2.6.35-rc3).  Your patches were included in the tree.

> The problem is that when probed directly, no (real) bssid is coded in the
> frame, only the multicast address. So with a frame of type
> IEEE80211_STYPE_PROBE_REQ we have no chance to decode the bssid because
> mac80211 doesn't give us the needed information. I think in the case of
> direct probing we are lost, only the authentication works with the patch I
> sent. Another solution would be to change mac80211 but that would be a
> special solution for just one driver. It's questionable if this is a viable
> way. On the other hand it would be great to have a working driver again.

How do you bypass the direct probe and go immediately to
authentication?  NetworkManager/mac80211 tries the direct probe before
authentication.  Without a probe response, mac80211 does not progress
to the actual authentication.

Jason

Re: [PATCH 0/2] at76c50x-usb.c: Fix broken authentication process

[Sebastian Smolorz]

Jason Andryuk wrote:
> On Mon, Jun 28, 2010 at 11:46 AM, Sebastian Smolorz
> 
> <Sebastian.Smolorz@gmx.de> wrote:
> > Jason Andryuk wrote:
> >> On Tue, Jun 22, 2010 at 10:51 AM, Sebastian Smolorz
> > 
> > It does but I must admit that I did not test the direct probing, only
> > the authentication.
> > 
> > Which kernel version did you patch?
> 
> I used John Linville's wireless-testing tag master-2010-06-24
> (2.6.35-rc3).  Your patches were included in the tree.

OK.

> > The problem is that when probed directly, no (real) bssid is coded in
> > the frame, only the multicast address. So with a frame of type
> > IEEE80211_STYPE_PROBE_REQ we have no chance to decode the bssid because
> > mac80211 doesn't give us the needed information. I think in the case of
> > direct probing we are lost, only the authentication works with the
> > patch I sent. Another solution would be to change mac80211 but that
> > would be a special solution for just one driver. It's questionable if
> > this is a viable way. On the other hand it would be great to have a
> > working driver again.
> 
> How do you bypass the direct probe and go immediately to
> authentication?  NetworkManager/mac80211 tries the direct probe before
> authentication.  Without a probe response, mac80211 does not progress
> to the actual authentication.

I have one computer on which authentication is always processed without any 
preliminary direct probe. I tried that several times and with another 
wireless stick, too. On my laptop, the direct probe is processed first but I 
use the following workaround:

modprobe at76c50x-usb
iwconfig wlan0 essid <ESSID>
ifconfig wlan0 <IP>
ifconfig wlan0 down
ifconfig wlan0 <IP>
ifconfig wlan0 down
ifconfig wlan0 <IP>

So for me it's necessary to set the IP three times before the interface 
works. After the first time the direct probe is processed and fails. After 
the second time authentication is tried - but now the direct probe 
responses. After the third time, finally, the authentication is successful.

I know, this is very ugly, but maybe a feasible workaround for you, too.

-- 
Sebastian