186668a70f
* Apply the Broadcom Wi-Fi quirk to Macs without a T2 brcmfmac lets the Wi-Fi firmware run the WPA handshake itself, and on Apple hardware that offload fails against an access point in WPA2/WPA3 transition mode: the client associates, the four-way handshake never completes, and NetworkManager reports the password as wrong. feature_disable=0x82000 turns off the firmware supplicant and authenticator so wpa_supplicant does the handshake in software. That quirk already shipped, but only for Macs with a T2 chip. The bug is in the Broadcom firmware rather than in the T2 bridge, so it was never the right thing to gate on: a MacBookPro11,4 has BCM43602 with 2015 firmware, fails exactly this way, and got nothing. Gate on the hardware that actually has the firmware — an Apple machine with a Broadcom wireless part — which covers both. Moving it out of fix-t2.sh also leaves one owner for the file. Two leaves writing the same config would have meant the later one silently winning, decided by an ordering in all.sh nobody would think to check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Gate the Broadcom Wi-Fi quirk on the T2 ID or a brcmfmac chip ID Sniffing lspci for an Apple vendor with a Broadcom network controller made T2 Macs depend on a detection line they never needed: they carry a T2 PCI ID that is always there, and the class name half of `lspci -nn` comes from the pci.ids database. Keep their original gate untouched. Naming the rest by DMI model does not hold up either, because the model year does not predict the part. A MacBookPro11,4 from Mid 2015 carries a BCM43602 and needs this; a MacBookAir7,2 from Early 2015 carries a BCM4360 and does not. Covering the lineup by name takes around twenty identifiers across four product lines and grows every time Apple ships hardware. The set has an exact definition already: the PCI IDs brcmfmac binds, from the driver's own brcm_hw_ids.h. That reaches the 2016 and 2017 MacBook Pros and the T2-less iMac19,1 and iMac19,2 that a hand-written list missed, and it leaves out the BCM4360 Macs for free, since their out-of-tree wl driver would never read a brcmfmac option anyway. Matching an exact vendor:device ID also drops the piped `grep -q`, which returns 141 under pipefail once the producer is killed by SIGPIPE (#6608). The test runs the leaf with pipefail so the chatty lspci stub proves it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix Macs already installed without the Broadcom Wi-Fi quirk The quirk is written at install time, so a machine set up before it shipped never gets it, and no pre-T2 Mac ever did. Those installs still fail the WPA four-way handshake against an access point in WPA2/WPA3 transition mode, which is the state the reporter had to repair by hand. Appending leaves anything else in the config alone: modprobe reads every options line for a module, and nothing else sets feature_disable. Only an active options line counts as already applied, and the driver keeps the old behaviour until it reloads, so this asks for a reboot rather than pulling brcmfmac out from under a connection that currently works. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: David Heinemeier Hansson <david@hey.com>
36 lines
1.8 KiB
Bash
36 lines
1.8 KiB
Bash
# Apple Macs ship Broadcom Wi-Fi driven by brcmfmac, whose firmware runs the WPA
|
|
# handshake itself. On these parts that offload fails against an access point in
|
|
# WPA2/WPA3 transition mode: the client associates, the four-way handshake never
|
|
# completes, and NetworkManager reports the password as wrong.
|
|
#
|
|
# feature_disable turns off the firmware supplicant (FWSUP, 0x2000) and firmware
|
|
# authenticator (FWAUTH, 0x80000), handing the handshake back to wpa_supplicant
|
|
# in software.
|
|
#
|
|
# This quirk already shipped for T2 Macs, detected by the T2 PCI ID that every
|
|
# one of them carries. The bug is in the Broadcom firmware, not in the T2 bridge,
|
|
# so every Mac whose Wi-Fi brcmfmac drives needs it: a MacBookPro11,4 with
|
|
# BCM43602 and 2015 firmware fails exactly this way, and connects once the
|
|
# offload is disabled.
|
|
#
|
|
# The IDs are brcmfmac's own, from brcm_hw_ids.h: BCM43602 and its single-band
|
|
# variants in 2015-2017 Macs, BCM4350, BCM4355 and BCM4364 in the 2018-2019
|
|
# machines including the T2-less iMac19,1 and iMac19,2, and BCM4377/4378/4387
|
|
# from the T2 era on. The BCM4360 in 2013-2015 Macs is deliberately absent: it
|
|
# runs the out-of-tree wl driver, which never reads a brcmfmac option.
|
|
sys_vendor="$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null || true)"
|
|
|
|
if lspci -nn | grep "106b:180[12]" >/dev/null ||
|
|
{ [[ $sys_vendor == Apple* ]] &&
|
|
lspci -nn | grep -E "14e4:(43ba|43bb|43bc|43a3|43dc|4464|4488|4425|4433)" >/dev/null; }; then
|
|
echo "Detected a Mac with Broadcom Wi-Fi; running the WPA handshake in software"
|
|
|
|
mkdir -p /etc/modprobe.d
|
|
cat > /etc/modprobe.d/brcmfmac.conf <<'EOF'
|
|
# Broadcom's firmware supplicant and authenticator fail the WPA four-way
|
|
# handshake on Apple hardware, which surfaces as a rejected password. Disable
|
|
# both so wpa_supplicant performs the handshake instead.
|
|
options brcmfmac feature_disable=0x82000
|
|
EOF
|
|
fi
|