madwifi+WPA2+WME = chaos

[branen salmon]

Hi, all--

I've been poking with this madwifi+Nokia+WPA2 issue, and have managed 
tuss out a little more detail...

Said Sven Nielsen:

 > To get Nokia E65, E51 (and possibly others) working [when using
 > encryption] , parameters "uapsd" and "wmm" both have to
 > be _disabled_ by setting them to zero with iwpriv.

Said Jouni Malinen:

> This is somewhat surprising since I would not expect these settings to
> have much difference regardless of whether encryption is used or not..
> Or at least UAPSD should affect both. Maybe there are some WMM-related
> interop issues that apply to encryption, too.
 > [...]
> Did you try just disabling UAPSD? I haven't done much testing with WMM,
> but I've been able to work arounds most issues by disabling power saving
> the phone configuration (advanced options for Wireless LAN).

I've been working on this with a Nokia N810, hostapd 0.5.9, and madwifi 
0.9.2.  Per Sven, disabling uapsd and wmm on the AP fixes the problem. 
However, in my preliminary tests, it seems that enabling uapsd alone 
doesn't reproduce the problem: wmm is the important one.

I should state upfront that I don't understand WMM, UAPSD, or WPA2 very 
well, but I'm wondering if, perhaps, this is related to the WME+WPA2 IE 
mismatch issue described here:
   http://readlist.com/lists/shmoo.com/hostap/0/3179.html

When wme_enabled=1 in my hostapd config, then my STAs can't associate 
(per above).  When wme_enabled=0 but madwifi's wmm is 1, then 
power-saving Nokia STAs stop receiving packets.  When madwifi's wmm is 
0, then everything works fine.

I'm unsure of what role hostapd normally plays in managing the WME 
capabilities of an AP.  The WME power-saving extensions, of which I 
assume UAPSD is a part, save STA-destined packets in a buffer and then 
transmit immediately after receiving a frame from the STA.  If, when 
madwifi's wmm is 1, it's expecting hostapd to play some kind of a role 
in this, then we have a plausible explanation.

I haven't been able to reproduce the issue reliably with a madwifi 
*STA*.  This may or may not be related to Atheros's "simulated UAPSD" 
function:
   http://www.atheros.com/news/AR9280_AR9281.htm

So, I'm thinking that this is either related to some kind of WPA2-WME 
incompatibility, or to a weird interop fluke between two chipset 
manufacturers, and I'm leaning towards the former.

If anyone else has any thoughts, I'd be most interested to hear them.

Thanks!

--branen