Bug 213621 - WIFI connection is lost periodically on ath0
Summary: WIFI connection is lost periodically on ath0
Status: Closed Not Enough Information
Alias: None
Product: Base System
Classification: Unclassified
Component: wireless (show other bugs)
Version: 11.0-STABLE
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-wireless (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-19 17:55 UTC by Sergey
Modified: 2017-01-03 10:08 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sergey 2016-10-19 17:55:59 UTC
Hello.

Every several hours my wifi connection is lost. Removing tunnings from sysctl.conf, tuning different setings on wifi router (disabling MAC Filtering, chnging Beacon Interval/DTIM Interval/DHCP Address Lease Time/Group Key Update Period) didn't help.
When connection is lost ifconfig shows nothing special, status stays 'associated'.

pinging shows following:
$ ping 192.168.0.1                                                                                                                                             
PING 192.168.0.1 (192.168.0.1): 56 data bytes
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
ping: sendto: Host is down
^C
--- 192.168.0.1 ping statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss

Wifi card is:

ath0@pci0:2:0:0:        class=0x028000 card=0x3116168c chip=0x0030168c rev=0x01 hdr=0x00
    vendor     = 'Qualcomm Atheros'
    device     = 'AR93xx Wireless Network Adapter'
    class      = network
    cap 01[40] = powerspec 3  supports D0 D1 D3  current D0
    cap 05[50] = MSI supports 4 messages, 64 bit, vector masks 
    cap 10[70] = PCI-Express 2 endpoint max data 128(128) RO
                 link x1(x1) speed 2.5(2.5) ASPM disabled(L0s/L1)
    ecap 0001[100] = AER 1 0 fatal 0 non-fatal 2 corrected
    ecap 0002[140] = VC 1 max VC0
    ecap 0003[300] = Serial 1 0000000000000000


When I do 'reassociate' command inside wpa_cli shell connection restores. Also it restores by running /etc/rc.d/netif restart.
Below is the listing from truss'ing wpa_supplicant service (first comes lines when connection is lost, then I did reassociate):

...
select(7,{ 4 5 6 },{ },{ },{ 9.999998 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999997 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999998 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999999 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999999 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999999 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999998 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999998 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999998 })         = 1 (0x1)
recvfrom(6,"ATTACH",4095,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-2" },0x7fffffffd96c) = 6 (0x6)
sendto(6,"OK\n",3,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-2" },0x6a) = 3 (0x3)
select(7,{ 4 5 6 },{ },{ },{ 1.494001 })         = 1 (0x1)
recvfrom(6,"BSS RANGE=ALL MASK=0x2",4095,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x7fffffffd96c) = 22 (0x16)
sendto(6,"bssid=a0:f3:c1:46:1a:f3\n",24,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x6a) = 24 (0x18)
select(7,{ 4 5 6 },{ },{ },{ 1.493639 })         = 1 (0x1)
recvfrom(6,"LIST_NETWORKS",4095,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x7fffffffd96c) = 13 (0xd)
sendto(6,"network id / ssid / bssid / flag"...,70,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x6a) = 70 (0x46)
select(7,{ 4 5 6 },{ },{ },{ 1.493325 })         = 0 (0x0)
select(7,{ 4 5 6 },{ },{ },{ 9.999999 })         = 1 (0x1)
recvfrom(6,"PING",4095,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x7fffffffd96c) = 4 (0x4)
sendto(6,"PONG\n",5,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x6a) = 5 (0x5)
select(7,{ 4 5 6 },{ },{ },{ 6.096650 })         = 1 (0x1)
recvfrom(6,"PING",4095,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x7fffffffd96c) = 4 (0x4)
sendto(6,"PONG\n",5,0x0,{ AF_UNIX "/tmp/wpa_ctrl_53916-1" },0x6a) = 5 (0x5)

# uname -a
FreeBSD CROSS 11.0-RELEASE FreeBSD 11.0-RELEASE #0: Sun Sep 25 15:53:24 MSK 2016     root@CROSS  amd64
# ifconfig wlan0                                                                                                                                               
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1480
        ether f8:1a:67:09:d2:7b
        inet 192.168.0.4 netmask 0xffffffe0 broadcast 192.168.0.31 
        media: IEEE 802.11 Wireless Ethernet MCS mode 11ng
        status: associated
        ssid KPECT channel 9 (2452 MHz 11g ht/40-) bssid a0:f3:c1:46:1a:f3
        regdomain 33 indoor ecm authmode WPA2/802.11i privacy ON
        deftxkey UNDEF AES-CCM 3:128-bit txpower 20 bmiss 7 scanvalid 60
        protmode CTS ampdulimit 64k shortgi wme burst roaming MANUAL
        bintval 300
        groups: wlan 
# cat /etc/wpa                                                                                                                                                 
wpa_supplicant.conf       wpa_supplicant.conf.bak
# cat /etc/wpa_supplicant.conf                                                                                                                                 
ctrl_interface=/var/run/wpa_supplicant
eapol_version=2
ap_scan=1
fast_reauth=1

network={
        ssid="KPECT"
        scan_ssid=1
        psk=<bla_bla>
        priority=5
}

# grep wlan0 /etc/rc.c                                                                                                                                         
rc.conf     rc.conf.d/
# grep wlan0 /etc/rc.conf                                                                                                                                      
wlans_ath0="wlan0"
ifconfig_wlan0="WPA DHCP mtu 1480 channel 9 -bgscan ssid KPECT"

Please help.
Comment 1 Adrian Chadd freebsd_committer freebsd_triage 2016-10-19 18:12:33 UTC
hi

what's logged in dmesg?

Can you compile with ATH_DEBUG, AH_DEBUG, ATH_DIAGAPI, and IEEE80211_DEBUG ? There's likely some debugging we can turn on to figure out why traffic is hanging. (My guess it's encryption - but let's first compile in with the above.)

THen when its' done, do this:

wlandebug +assoc +state +auth +crypto

and then capture what's logged in dmesg when it stops working.
Comment 2 Sergey 2016-10-19 19:17:26 UTC
(In reply to Adrian Chadd from comment #1)

Hi Adrian.
Now there's nothing more than this:

wlan0: Ethernet address: f8:1a:67:09:d2:7b
wlan0: link state changed to UP
wlan0: link state changed to DOWN
wlan0: link state changed to UP
ifa_maintain_loopback_route: deletion failed for interface wlan0: 3
wlan0: link state changed to DOWN
wlan0: Ethernet address: f8:1a:67:09:d2:7b
wlan0: link state changed to UP
wlan0: link state changed to DOWN
wlan0: link state changed to UP

I'll try to recompile the kernel with options you've provided and will post it as soon as I have the required info.

Thanx,
Sergey.
Comment 3 Sergey 2016-10-20 17:56:49 UTC
Hi Adrian.

Below is what I got. Up till TSFOOR line in dmesg is what came out when the link disapperared. 
Starting from 'wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0' came out after initiating reassociate in wpa_cli.

$ doas wlandebug +assoc +state +auth +crypto
net.wlan.0.debug: 0x0 => 0x10c80000<crypto,assoc,auth,state>

$ sysctl net.wlan.0.debug
net.wlan.0.debug: 281542656


$ dmesg
...
wlan0: link state changed to UP
wlan0: beacon miss, mode STA state RUN
ath0: ath_intr: TSFOOR                                                             <- no traffic here
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0      <- 'reassociate' command started here (traffic is available again)
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 2 flags 0x106 rsc 34643 tsc 0 len 16
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 4 flags 0x103 rsc 0 tsc 89273 len 16
wlan0: [a0:f3:c1:46:1a:f3] station assoc via MLME
wlan0: [a0:f3:c1:46:1a:f3] switch station to HT40 channel 2452/0x40480
wlan0: ieee80211_new_state_locked: RUN -> ASSOC (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: RUN -> ASSOC arg 1
wlan0: sta_newstate: RUN -> ASSOC (1)
wlan0: link state changed to DOWN
wlan0: [a0:f3:c1:46:1a:f3] station assoc via MLME
wlan0: [a0:f3:c1:46:1a:f3] switch station to HT40 channel 2452/0x40480
wlan0: ieee80211_new_state_locked: ASSOC -> AUTH (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: ASSOC -> AUTH arg 192
wlan0: sta_newstate: ASSOC -> AUTH (192)
wlan0: [a0:f3:c1:46:1a:f3] recv auth frame with algorithm 0 seq 2
wlan0: ieee80211_new_state_locked: AUTH -> ASSOC (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: AUTH -> ASSOC arg 0
wlan0: sta_newstate: AUTH -> ASSOC (0)
wlan0: [a0:f3:c1:46:1a:f3] assoc success at aid 2: short preamble, short slot time, QoS, HT40 (+AMPDU)
wlan0: ieee80211_new_state_locked: ASSOC -> RUN (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: ASSOC -> RUN arg 16
wlan0: sta_newstate: ASSOC -> RUN (16)
wlan0: link state changed to UP
wlan0: ieee80211_crypto_newkey: cipher 3 flags 0x3 keyix 65535
wlan0: ieee80211_crypto_setkey: AES-CCM keyix 4 flags 0x103 mac a0:f3:c1:46:1a:f3 rsc 0 tsc 0 len 16
wlan0: ieee80211_crypto_newkey: cipher 3 flags 0x6 keyix 2
wlan0: ieee80211_crypto_setkey: AES-CCM keyix 2 flags 0x106 mac ff:ff:ff:ff:ff:ff rsc 34673 tsc 0 len 16
Comment 4 Sergey 2016-10-22 07:34:49 UTC
Another excerpt from dmesg:

wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562136372, ticks=18446744071562137461
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562137615
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562137768
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562137921
wlan0: beacon miss, mode STA state RUN
wlan0: send probe req on channel 9 bssid a0:f3:c1:46:1a:f3 ssid "KPECT"
wlan0: received probe_resp from a0:f3:c1:46:1a:f3 rssi 37
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562138999
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562139149
...
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562143138
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562137585, ticks=18446744071562143292
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 1926 (attempt 1)
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562143445
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562143599
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562143752
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562143905
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562144059
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562143303, ticks=18446744071562144212
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 1927 (attempt 1)
wlan0: ieee80211_sta_ps_timer_check: lastdata=18446744071562144331, ticks=18446744071562144366
...
Comment 5 Adrian Chadd freebsd_committer freebsd_triage 2016-10-22 18:35:07 UTC
hi,

can you capture the whole dmesg from association to disconnects? I'd like to see what's going on the whole time.

Thanks!


-adrian
Comment 6 Sergey 2016-10-22 19:11:17 UTC
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 1 flags 0x106 rsc 0 tsc 0 len 16
wlan0: [a0:f3:c1:46:1a:f3] station assoc via MLME
wlan0: [a0:f3:c1:46:1a:f3] switch station to HT40 channel 2452/0x40480
wlan0: ieee80211_new_state_locked: ASSOC -> AUTH (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: ASSOC -> AUTH arg 192
wlan0: sta_newstate: ASSOC -> AUTH (192)
[a0:f3:c1:46:1a:f3] send auth on channel 9
wlan0: received auth from a0:f3:c1:46:1a:f3 rssi 37
wlan0: [a0:f3:c1:46:1a:f3] recv auth frame with algorithm 0 seq 2
wlan0: ieee80211_new_state_locked: AUTH -> ASSOC (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: AUTH -> ASSOC arg 0
wlan0: sta_newstate: AUTH -> ASSOC (0)
[a0:f3:c1:46:1a:f3] send assoc_req on channel 9
wlan0: received assoc_resp from a0:f3:c1:46:1a:f3 rssi 36
wlan0: [a0:f3:c1:46:1a:f3] assoc success at aid 1: short preamble, short slot time, QoS, HT40 (+AMPDU)
wlan0: ieee80211_new_state_locked: ASSOC -> RUN (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: ASSOC -> RUN arg 16
wlan0: sta_newstate: ASSOC -> RUN (16)
wlan0: associated with a0:f3:c1:46:1a:f3 ssid "KPECT" channel 9 start 1Mb
wlan0: link state changed to UP
wlan0: [ff:ff:ff:ff:ff:ff] no default transmit key (ieee80211_encap) deftxkey 65535
wlan0: ieee80211_crypto_newkey: cipher 3 flags 0x3 keyix 65535
wlan0: ieee80211_crypto_setkey: AES-CCM keyix 4 flags 0x103 mac a0:f3:c1:46:1a:f3 rsc 0 tsc 0 len 16
wlan0: ieee80211_crypto_newkey: cipher 3 flags 0x6 keyix 1
wlan0: ieee80211_crypto_setkey: AES-CCM keyix 1 flags 0x106 mac ff:ff:ff:ff:ff:ff rsc 2 tsc 0 len 16
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 37
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 36
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 28
[a0:f3:c1:46:1a:f3] send action on channel 9
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 31
[a0:f3:c1:46:1a:f3] send action on channel 9
wlan0: ieee80211_crypto_newkey: cipher 3 flags 0x6 keyix 2
wlan0: ieee80211_crypto_setkey: AES-CCM keyix 2 flags 0x106 mac ff:ff:ff:ff:ff:ff rsc 0 tsc 0 len 16
[a0:f3:c1:46:1a:f3] send action on channel 9
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 33
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 921730, csc 954497, keyix 4 rxkeyix 4>
ath0: ath_intr: TSFOOR
wlan0: received action from a0:f3:c1:46:1a:f3 rssi 34
[a0:f3:c1:46:1a:f3] send action on channel 9
ar9300_reset[4568]: ar9300_stop_dma_receive failed
wlan0: beacon miss, mode STA state RUN
wlan0: send probe req on channel 9 bssid a0:f3:c1:46:1a:f3 ssid "KPECT"
wlan0: received probe_resp from a0:f3:c1:46:1a:f3 rssi 33
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 3451 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2162 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2172 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2186 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 3451 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2162 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2172 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2186 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 555 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 576 (attempt 1)
wlan0: beacon miss, mode STA state RUN
wlan0: send probe req on channel 9 bssid a0:f3:c1:46:1a:f3 ssid "KPECT"
wlan0: received probe_resp from a0:f3:c1:46:1a:f3 rssi 33
NVRM: Xid (PCI:0000:01:00): 13, 0000 e0013900 00000039 00000320 00001000 00000002
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2466 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2490 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2513 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] send BAR: tid 0 ctl 0x4 start 2536 (attempt 1)
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407656, csc 2150891303, keyix 4 rxkeyix 4>
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407657, csc 2150891303, keyix 4 rxkeyix 4>
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407658, csc 2150891303, keyix 4 rxkeyix 4>
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407659, csc 2150891303, keyix 4 rxkeyix 4>
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407660, csc 2150891303, keyix 4 rxkeyix 4>
wlan0: [a0:f3:c1:46:1a:f3] AES-CCM replay detected tid 0 <rsc 3407661, csc 2150891303, keyix 4 rxkeyix 4>
ifa_maintain_loopback_route: deletion failed for interface wlan0: 3
wlan0: [a0:f3:c1:46:1a:f3] station deauth via MLME (reason: 3 (sending STA is leaving/has left IBSS or ESS))
wlan0: ieee80211_new_state_locked: RUN -> INIT (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: RUN -> INIT arg 3
wlan0: sta_newstate: RUN -> INIT (3)
wlan0: [a0:f3:c1:46:1a:f3] send station disassociate (reason: 8 (sending STA is leaving/has left BSS))
[a0:f3:c1:46:1a:f3] send disassoc on channel 9
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 4 flags 0x103 rsc 0 tsc 1782222 len 16
wlan0: link state changed to DOWN
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 1 flags 0x106 rsc 24 tsc 0 len 16
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 2 flags 0x106 rsc 18915 tsc 0 len 16
wlan0: stop running, 1 vaps running
wlan0: ieee80211_new_state_locked: INIT -> INIT (nrunning 0 nscanning 0)
wlan0: down parent ath0
wlan0: ieee80211_newstate_cb: INIT -> INIT arg -1
wlan0: sta_newstate: INIT -> INIT (-1)
wlan0: ieee80211_vap_detach: STA parent ath0
wlan0: stop running, 0 vaps running
wlan0: ieee80211_new_state_locked: INIT -> INIT (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: INIT -> INIT arg -1
wlan0: sta_newstate: INIT -> INIT (-1)
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: Ethernet address: f8:1a:67:09:d2:7b
wlan0: link state changed to UP
Comment 7 Adrian Chadd freebsd_committer freebsd_triage 2016-10-22 19:46:32 UTC
God damnit, okay. So it /looks/ like a single bit corruption of the RSC, which causes the AES-CCM code to consider everything afterwards to be a replay attack.

ie:

Adrians-MacBook-Pro:~ adrian$ perl -e 'printf "%x\n", 3407656;'
33ff28
Adrians-MacBook-Pro:~ adrian$ perl -e 'printf "%x\n", 2150891303;'
8033ff27

Those are from your AES-CCM replay logs.

I would've thought that a single bit error would've been caught by the MAC CRC/FCS.


-adrian
Comment 8 Sergey 2016-10-22 19:55:11 UTC
Adrian,
Do you have any thoughts about how can I fix the problem ?
Comment 9 Sergey 2016-10-22 19:58:08 UTC
Got another portion of messages after "disconnection"

wlan0: beacon miss, mode STA state RUN
wlan0: send probe req on channel 9 bssid a0:f3:c1:46:1a:f3 ssid "KPECT"
wlan0: beacon miss, mode STA state RUN
wlan0: ieee80211_new_state_locked: RUN -> SCAN (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: RUN -> SCAN arg 0
wlan0: sta_newstate: RUN -> SCAN (0)
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 4 flags 0x103 rsc 0 tsc 408791 len 16
wlan0: link state changed to DOWN
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: AES-CCM keyix 2 flags 0x106 rsc 19032 tsc 0 len 16
wlan0: [a0:f3:c1:46:1a:f3] station assoc via MLME
wlan0: [a0:f3:c1:46:1a:f3] switch station to HT40 channel 2452/0x40480
wlan0: ieee80211_new_state_locked: SCAN -> AUTH (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: SCAN -> AUTH arg 192
wlan0: sta_newstate: SCAN -> AUTH (192)
[a0:f3:c1:46:1a:f3] send auth on channel 9
wlan0: ieee80211_new_state_locked: AUTH -> SCAN (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: AUTH -> SCAN arg 1
wlan0: sta_newstate: AUTH -> SCAN (1)
wlan0: ieee80211_vap_transmit: ignore queue, in SCAN state
wlan0: [a0:f3:c1:46:1a:f3] station deauth via MLME (reason: 3 (sending STA is leaving/has left IBSS or ESS))
wlan0: ieee80211_new_state_locked: SCAN -> INIT (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: SCAN -> INIT arg 3
wlan0: sta_newstate: SCAN -> INIT (3)
wlan0: ieee80211_new_state_locked: INIT -> SCAN (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: INIT -> SCAN arg 0
wlan0: sta_newstate: INIT -> SCAN (0)
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid "KPECT"
wlan0: send probe req on channel 9 bssid ff:ff:ff:ff:ff:ff ssid ""
wlan0: received probe_resp from a0:f3:c1:46:1a:f3 rssi 33
wlan0: received probe_resp from a0:f3:c1:46:1a:f3 rssi 30
ifa_maintain_loopback_route: deletion failed for interface wlan0: 3
wlan0: stop running, 1 vaps running
wlan0: ieee80211_new_state_locked: SCAN -> INIT (nrunning 0 nscanning 0)
wlan0: down parent ath0
wlan0: ieee80211_newstate_cb: SCAN -> INIT arg -1
wlan0: sta_newstate: SCAN -> INIT (-1)
wlan0: ieee80211_vap_detach: STA parent ath0
wlan0: stop running, 0 vaps running
wlan0: ieee80211_new_state_locked: INIT -> INIT (nrunning 0 nscanning 0)
wlan0: ieee80211_newstate_cb: INIT -> INIT arg -1
wlan0: sta_newstate: INIT -> INIT (-1)
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: _ieee80211_crypto_delkey: NONE keyix 65535 flags 0x3 rsc 0 tsc 0 len 0
wlan0: Ethernet address: f8:1a:67:09:d2:7b
wlan0: link state changed to UP
Comment 10 Adrian Chadd freebsd_committer freebsd_triage 2016-10-22 20:00:18 UTC
Yeah, that's a beacon miss. I'm not sure why that is yet.

You can try -bgscan -powersave just to enforce things, but I don't know if it's going to help all that much. The PN corruption is just very damned frightening. I've seen it before but it's been really tricky to nail down :(


-adrian
Comment 11 Sergey 2016-10-22 20:14:37 UTC
But I already have -bgscan disabled in rc.conf and powersave mode seems to be turned off:

$ ifconfig -v wlan0 | grep -i power 
        AES-CCM 3:128-bit powersavemode OFF powersavesleep 100 txpower 20

$ grep wlan /etc/rc.conf
wlans_ath0="wlan0"
ifconfig_wlan0="WPA DHCP mtu 1480 channel 9 -bgscan ssid KPECT"

So no way to solve the problem? Maybe reinstalling the router nearer to the station?
Comment 12 Adrian Chadd freebsd_committer freebsd_triage 2016-10-22 20:30:16 UTC
Hiya,

So the beacon miss / TSFOOR is the driver side. I can go take another look at fixing that up.

The CCMP replay attack thing - that we need another NIC to sniff the air in monitor mode and try to capture the invalid PN showing up in the air. If it's coming over the air then sure, we can nail it down. If it's not coming over the air, and instead it's corrupted by the AR9380 NIC, we're in trouble.

I need to go double / triple-check to see if we pass frames that fail CRC/FCS/decrypt up to the stack for incorrect processing. I'm kinda worried that we're processing invalid frames a little too far along the input / decryption path.
Comment 13 Adrian Chadd freebsd_committer freebsd_triage 2016-10-22 20:30:29 UTC
how hard / quickly does the CCMP replay attack issue happen?
Comment 14 Sergey 2016-10-23 09:11:42 UTC
Hello.

I haven't seen those replays before, only yesterday, due to the messages file it happened at 15:48 and 21:59. That's it.
Comment 15 Sergey 2016-10-24 17:38:15 UTC
Something new in dmesg:

ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3882
Q1[  0] (nseg=2) (DS.V:0xfffffe01b3125700 DS.P:0xbfe3f700) I: 168cc117 L:bfe66300 F:1014
 (D[0] = 47062e5e(002c0000), D[1] = 4746d580(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 63168 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        cff98d15 4068006a 60008000 04348000 00898a8b 80918078
        000080c7 88f0048e 00903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b314c300 DS.P:0xbfe66300) I: 168cc117 L:bfe64f00 F:0004
 (D[0] = 4706275e(002c0000), D[1] = 471a1780(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 63184 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        cffab3e8 4028006a 60008000 04348000 008c8d8e 808d8082
        000080ae 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b314af00 DS.P:0xbfe64f00) I: 168cc117 L:bfe7cb00 F:0004
 (D[0] = 474e255e(002c0000), D[1] = 47111b80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 63200 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        cffb3228 4028006a 60008000 24348000 898d8e8f 802c802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3162b00 DS.P:0xbfe7cb00) I: 168cc117 L:00000000 F:0004
 (D[0] = 4719ce5e(002c0000), D[1] = 0774cc80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 63216 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        cffcc170 4028006a 40008000 04348000 008a8b8c 80d5809c
        0000810f 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3892
Q1[  0] (nseg=2) (DS.V:0xfffffe01b3107200 DS.P:0xbfe21200) I: 168cc117 L:bfe74400 F:1004
 (D[0] = 0774a25e(002c0000), D[1] = 474ba080(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64736 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d05b6dbe 4068009f 60008000 04348000 00858687 80458041
        00008048 88f00202 70903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b315a400 DS.P:0xbfe74400) I: 168cc117 L:00000000 F:0004
 (D[0] = 4706b35e(002c0000), D[1] = 0416e000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64752 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d05cb67f 4028006a 40008000 04348000 008d8e8f 802c802c
        00008030 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3984
Q1[  0] (nseg=2) (DS.V:0xfffffe01b3107200 DS.P:0xbfe21200) I: 168cc117 L:bfe74400 F:1004
 (D[0] = 0774a25e(002c0000), D[1] = 474ba080(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64736 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d05b6dbe 4068009f 60008000 04348000 00858687 809f8094
        000080ad 88f007eb 70903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b315a400 DS.P:0xbfe74400) I: 168cc117 L:bfe07300 F:0004
 (D[0] = 4706b35e(002c0000), D[1] = 0416e000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64752 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d05ce95f 4028006a 60008000 04348000 008d8e8f 802c802c
        00008030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b30ed300 DS.P:0xbfe07300) I: 168cc117 L:bfe96500 F:0004
 (D[0] = 47060d5e(002c0000), D[1] = 01d63000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64784 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d05e8327 4028006a 60008000 24348000 898c8d8e 802c802c
        80378030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b317c500 DS.P:0xbfe96500) I: 168cc117 L:bfe84800 F:0004
 (D[0] = 07752a5e(002c0000), D[1] = 471a5580(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64800 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d05fae8e 4028009f 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b316a800 DS.P:0xbfe84800) I: 168cc117 L:bfe8c000 F:0004
 (D[0] = 4706c35e(002c0000), D[1] = 4719f180(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64816 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0609aeb 4028006a 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3172000 DS.P:0xbfe8c000) I: 168cc117 L:00000000 F:0004
 (D[0] = 474a6d5e(002c0000), D[1] = 0412c000(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64832 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06150f3 4028009f 40008000 24348000 888a8b8c 80338030
        80498033 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3989
Q1[  0] (nseg=2) (DS.V:0xfffffe01b3107200 DS.P:0xbfe21200) I: 168cc117 L:bfe74400 F:1004
 (D[0] = 0774a25e(002c0000), D[1] = 474ba080(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64736 swtry: 2 ADDBAW?: 1 DOBAW?: 1
        d05b6dbe 4068009f 60008000 04348000 00858687 80f980e3
        00008112 88f00dd2 70903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b315a400 DS.P:0xbfe74400) I: 168cc117 L:bfe07300 F:0004
 (D[0] = 4706b35e(002c0000), D[1] = 0416e000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64752 swtry: 2 ADDBAW?: 1 DOBAW?: 1
        d05ce95f 4028006a 60008000 04348000 008d8e8f 802c802c
        00008030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b30ed300 DS.P:0xbfe07300) I: 168cc117 L:bfe96500 F:0004
 (D[0] = 47060d5e(002c0000), D[1] = 01d63000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64784 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d05e8327 4028006a 60008000 24348000 898c8d8e 802c802c
        80378030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b317c500 DS.P:0xbfe96500) I: 168cc117 L:bfe84800 F:0004
 (D[0] = 07752a5e(002c0000), D[1] = 471a5580(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64800 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d05fae8e 4028009f 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b316a800 DS.P:0xbfe84800) I: 168cc117 L:bfe8c000 F:0004
 (D[0] = 4706c35e(002c0000), D[1] = 4719f180(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64816 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d0609aeb 4028006a 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3172000 DS.P:0xbfe8c000) I: 168cc117 L:bfe5aa00 F:0004
 (D[0] = 474a6d5e(002c0000), D[1] = 0412c000(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64832 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d061bad9 4028009f 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3140a00 DS.P:0xbfe5aa00) I: 168cc117 L:bfe81600 F:0004
 (D[0] = 472c145e(002c0000), D[1] = 47068580(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64864 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d063d631 4028009f 60008000 04348000 008a8b8c 8091806d
        000080b1 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3167600 DS.P:0xbfe81600) I: 168cc117 L:bfe14500 F:0004
 (D[0] = 474adc5e(002c0000), D[1] = 47413980(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64880 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d064814f 4028006a 60008000 04348000 008a8b8c 813380dc
        0000818d 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b30fa500 DS.P:0xbfe14500) I: 168cc117 L:bfe75800 F:0004
 (D[0] = 474fd85e(002c0000), D[1] = 041a7000(00690000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64896 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06583e8 4028009f 60008000 04348000 008c8d8e 80dc80ca
        0000811a 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b315b800 DS.P:0xbfe75800) I: 168cc117 L:00000000 F:0004
 (D[0] = 472c1d5e(002c0000), D[1] = 4746d880(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64912 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0665c54 4028006a 40008000 04348000 008d8e8f 802c802c
        00008030 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3994
Q1[  0] (nseg=1) (DS.V:0xfffffe01b3184c00 DS.P:0xbfe9ec00) I: 168cc117 L:bfe73a00 F:1004
 (D[0] = 7059a030(00540000), D[1] = 00000000(00000000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64976 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06ae268 4068005e 60008000 04348000 00858687 807e8074
        00008089 88f005b2 70903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3159a00 DS.P:0xbfe73a00) I: 168cc117 L:bfe7a300 F:0004
 (D[0] = 01d64000(00540000), D[1] = 00000000(00000000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 64992 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06b7cb5 4028005e 60008000 24348000 888a8b8c 80338030
        80508037 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3160300 DS.P:0xbfe7a300) I: 168cc117 L:bfe85200 F:0014
 (D[0] = 041b1000(00540000), D[1] = 00000000(00000000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 65008 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06cfdfb 4028005e 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b316b200 DS.P:0xbfe85200) I: 168cc117 L:bfe8b600 F:0004
 (D[0] = 19f1d030(00540000), D[1] = 00000000(00000000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 65024 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06d3802 4028005e 60008000 24348000 888a8b8c 80338030
        80498033 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3171600 DS.P:0xbfe8b600) I: 168cc117 L:00000000 F:0004
 (D[0] = 0412e000(00540000), D[1] = 00000000(00000000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 65040 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d06ebc0a 4028005e 40008000 24348000 88898a8b 808a8070
        814580b8 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=2029
Q1[  0] (nseg=2) (DS.V:0xfffffe01b316da00 DS.P:0xbfe87a00) I: 168cc117 L:bfe3a200 F:1004
 (D[0] = bfec3000(002c0000), D[1] = 041bf000(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 928 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0c71def 4068006a 60008000 04348000 008a8b8c 8091806d
        000080b1 88f005ee 00903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3120200 DS.P:0xbfe3a200) I: 168cc117 L:bfe45100 F:0004
 (D[0] = 04178000(002c0000), D[1] = 47054a80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 944 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0c8fe84 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b312b100 DS.P:0xbfe45100) I: 168cc117 L:bfe2a800 F:0004
 (D[0] = 471a525e(002c0000), D[1] = 4706a380(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 960 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0c9c3e5 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3110800 DS.P:0xbfe2a800) I: 168cc117 L:bfe96a00 F:0004
 (D[0] = 47050a5e(002c0000), D[1] = 0774fa80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 976 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0ca5545 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b317ca00 DS.P:0xbfe96a00) I: 168cc117 L:00000000 F:0014
 (D[0] = 474e245e(002c0000), D[1] = 474e2380(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 992 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0cbae7e 4028006a 40008000 24348000 898c8d8e 8030802c
        803a8030 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=4095
Q1[  0] (nseg=2) (DS.V:0xfffffe01b3120200 DS.P:0xbfe3a200) I: 168cc117 L:bfe45100 F:1004
 (D[0] = 04178000(002c0000), D[1] = 47054a80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 944 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d0c8fe84 4068006a 60008000 04348000 008a8b8c 8091806d
        000080b1 88f005ee 00903def 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b312b100 DS.P:0xbfe45100) I: 168cc117 L:bfe2a800 F:0004
 (D[0] = 471a525e(002c0000), D[1] = 4706a380(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 960 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d0c9c3e5 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b3110800 DS.P:0xbfe2a800) I: 168cc117 L:bfe96a00 F:0004
 (D[0] = 47050a5e(002c0000), D[1] = 0774fa80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 976 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d0ca5545 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b317ca00 DS.P:0xbfe96a00) I: 168cc117 L:bfe18b00 F:0014
 (D[0] = 474e245e(002c0000), D[1] = 474e2380(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 992 swtry: 1 ADDBAW?: 1 DOBAW?: 1
        d0cbf95f 4028006a 60008000 24348000 898c8d8e 8030802c
        803a8030 08f00000 00000000 20000000 00000000 00000000 00000000
  [end]
 (DS.V:0xfffffe01b30feb00 DS.P:0xbfe18b00) I: 168cc117 L:00000000 F:0004
 (D[0] = 07748c5e(002c0000), D[1] = 4746da80(00340000)
 (D[2] = 00000000(00000000), D[3] = 00000000(00000000)
        Seq: 1008 swtry: 0 ADDBAW?: 1 DOBAW?: 1
        d0cc8d9d 4028006a 40008000 24348000 898c8d8e 8030802c
        803a8030 08000000 00000000 20000000 00000000 00000000 00000000
  [end]
ifa_maintain_loopback_route: deletion failed for interface wlan0: 3
wlan0: link state changed to DOWN