186668a70f
* Apply the Broadcom Wi-Fi quirk to Macs without a T2 brcmfmac lets the Wi-Fi firmware run the WPA handshake itself, and on Apple hardware that offload fails against an access point in WPA2/WPA3 transition mode: the client associates, the four-way handshake never completes, and NetworkManager reports the password as wrong. feature_disable=0x82000 turns off the firmware supplicant and authenticator so wpa_supplicant does the handshake in software. That quirk already shipped, but only for Macs with a T2 chip. The bug is in the Broadcom firmware rather than in the T2 bridge, so it was never the right thing to gate on: a MacBookPro11,4 has BCM43602 with 2015 firmware, fails exactly this way, and got nothing. Gate on the hardware that actually has the firmware — an Apple machine with a Broadcom wireless part — which covers both. Moving it out of fix-t2.sh also leaves one owner for the file. Two leaves writing the same config would have meant the later one silently winning, decided by an ordering in all.sh nobody would think to check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Gate the Broadcom Wi-Fi quirk on the T2 ID or a brcmfmac chip ID Sniffing lspci for an Apple vendor with a Broadcom network controller made T2 Macs depend on a detection line they never needed: they carry a T2 PCI ID that is always there, and the class name half of `lspci -nn` comes from the pci.ids database. Keep their original gate untouched. Naming the rest by DMI model does not hold up either, because the model year does not predict the part. A MacBookPro11,4 from Mid 2015 carries a BCM43602 and needs this; a MacBookAir7,2 from Early 2015 carries a BCM4360 and does not. Covering the lineup by name takes around twenty identifiers across four product lines and grows every time Apple ships hardware. The set has an exact definition already: the PCI IDs brcmfmac binds, from the driver's own brcm_hw_ids.h. That reaches the 2016 and 2017 MacBook Pros and the T2-less iMac19,1 and iMac19,2 that a hand-written list missed, and it leaves out the BCM4360 Macs for free, since their out-of-tree wl driver would never read a brcmfmac option anyway. Matching an exact vendor:device ID also drops the piped `grep -q`, which returns 141 under pipefail once the producer is killed by SIGPIPE (#6608). The test runs the leaf with pipefail so the chatty lspci stub proves it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix Macs already installed without the Broadcom Wi-Fi quirk The quirk is written at install time, so a machine set up before it shipped never gets it, and no pre-T2 Mac ever did. Those installs still fail the WPA four-way handshake against an access point in WPA2/WPA3 transition mode, which is the state the reporter had to repair by hand. Appending leaves anything else in the config alone: modprobe reads every options line for a module, and nothing else sets feature_disable. Only an active options line counts as already applied, and the driver keeps the old behaviour until it reloads, so this asks for a reboot rather than pulling brcmfmac out from under a connection that currently works. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: David Heinemeier Hansson <david@hey.com>
44 lines
1.9 KiB
Bash
44 lines
1.9 KiB
Bash
echo "Run the WPA handshake in software on Macs with Broadcom Wi-Fi"
|
|
|
|
# The install-time quirk only reaches machines set up after it shipped, and it
|
|
# never covered Macs without a T2 at all, so an existing install on one still
|
|
# cannot join a WPA2/WPA3 transition-mode network. See
|
|
# install/hardware/apple/fix-brcmfmac-supplicant.sh for the failure it fixes and
|
|
# for where this list of brcmfmac PCI IDs comes from.
|
|
dmi_vendor="${OMARCHY_BRCMFMAC_DMI_VENDOR:-/sys/class/dmi/id/sys_vendor}"
|
|
conf="${OMARCHY_BRCMFMAC_CONF:-/etc/modprobe.d/brcmfmac.conf}"
|
|
|
|
sys_vendor="$(cat "$dmi_vendor" 2>/dev/null || true)"
|
|
|
|
if ! lspci -nn | grep "106b:180[12]" >/dev/null &&
|
|
! { [[ $sys_vendor == Apple* ]] &&
|
|
lspci -nn | grep -E "14e4:(43ba|43bb|43bc|43a3|43dc|4464|4488|4425|4433)" >/dev/null; }; then
|
|
exit 0
|
|
fi
|
|
|
|
# T2 installs already carry this from the installer, so the common case is a
|
|
# no-op for the first user and every user after them. Only an active options
|
|
# line counts: someone who commented theirs out still needs this.
|
|
if [[ -f $conf ]] &&
|
|
grep -Eq '^[[:space:]]*options[[:space:]]+brcmfmac[[:space:]].*feature_disable=0x82000' "$conf"; then
|
|
exit 0
|
|
fi
|
|
|
|
sudo mkdir -p "$(dirname "$conf")"
|
|
|
|
# Append rather than overwrite, so anything else a user keeps here survives:
|
|
# modprobe reads every options line for a module, and nothing else sets
|
|
# feature_disable. The leading newline also covers a file that ends without one.
|
|
sudo tee -a "$conf" >/dev/null <<'EOF'
|
|
|
|
# Broadcom's firmware supplicant and authenticator fail the WPA four-way
|
|
# handshake on Apple hardware, which surfaces as a rejected password. Disable
|
|
# both so wpa_supplicant performs the handshake instead.
|
|
options brcmfmac feature_disable=0x82000
|
|
EOF
|
|
|
|
# modprobe only reads this when the module loads. Reloading brcmfmac here would
|
|
# drop a Wi-Fi connection that works on the network the user is on right now,
|
|
# including the one carrying this update.
|
|
omarchy-state set reboot-required
|