connection to open ap with Network manager using ipw3945

Hello,

I have spent quite some time reading about a number of problems with the ipw3945ABG driver in different forums, but I couldn't solve the issue on my own, maybe some of you can help. I am not sure whether my problem results from a bug in the combination of the ipw3945 module with NM or whether I am missing something essential in the configuration of my interface, knowing this would already help, I apologize in advance for this post being quite long.

I am trying to connect to an open wireless access point using the Network Manager Applet (Roaming Mode), which can be seen in the applet and analyzed by kismet. Unfortunately, the connection fails after a timeout of about two minutes. Previously on Suse 10.1, I had similar problems on most open APs, but successful connections on a few open university APs. Configuring manually the interface via iwconfig and wpa_supplicant failed, the dhclient goes into timeout.

My system is a recently built Ubuntu feisty fawn 7.04 2.6.20-16-generic running on a Toshiba Satellite L100-140; the lspci output for the wireless card is

        Network controller: Intel Corporation PRO/Wireless 3945ABG Network Connection (rev 02)
 Subsystem: Intel Corporation Unknown device 1041
 Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
 Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
 Latency: 0, Cache Line Size: 64 bytes
 Interrupt: pin A routed to IRQ 21
 Region 0: Memory at 54000000 (32-bit, non-prefetchable) [size=4K]
 Capabilities: [c8] Power Management version 2
  Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
  Status: D0 PME-Enable- DSel=0 DScale=0 PME-
 Capabilities: [d0] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0 Enable-
  Address: 0000000000000000 Data: 0000
 Capabilities: [e0] Express Legacy Endpoint IRQ 0
  Device: Supported: MaxPayload 128 bytes, PhantFunc 0, ExtTag-
  Device: Latency L0s <512ns, L1 unlimited
  Device: AtnBtn- AtnInd- PwrInd-
  Device: Errors: Correctable- Non-Fatal- Fatal- Unsupported-
  Device: RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
  Device: MaxPayload 128 bytes, MaxReadReq 128 bytes
  Link: Supported Speed 2.5Gb/s, Width x1, ASPM L0s L1, Port 0
  Link: Latency L0s <128ns, L1 <64us
  Link: ASPM Disabled RCB 64 bytes CommClk+ ExtSynch-
  Link: Speed 2.5Gb/s, Width x1

Firmware and the restricted modules are installed, the daemon is running from boot. The versions of the ipw3945 modules and ieee80211 (modinfo) are respectively 1.2.0mp and git-1.1.13. All lines except the one for lo interface are outcommented in /etc/network/interfaces, and the output of cat rf_kill in /sys/bus/pci/drivers/ipw3945/0000:02:00.0/ is 0. The relevant AP (iwlist) reads

          Cell 02 - Address: 00:0F:[...]
                    ESSID:"OPEN_AP"
                    Protocol:IEEE 802.11bg
                    Mode:Master
                    Channel:11
                    Encryption key:off
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 9 Mb/s; 11 Mb/s
                              6 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                              48 Mb/s; 54 Mb/s
                    Quality=54/100 Signal level=-76 dBm Noise level=-76 dBm
                    Extra: Last beacon: 44ms ago

and iwconfig gives

eth1 unassociated ESSID:off/any
          Mode:Managed Frequency=nan kHz Access Point: Not-Associated
          Bit Rate:0 kb/s Tx-Power:16 dBm
          Retry limit:15 RTS thr:off Fragment thr:off
          Encryption key:off
          Power Management:off
          Link Quality:0 Signal level:0 Noise level:0
          Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
          Tx excessive retries:0 Invalid misc:5068 Missed beacon:0

Most of these points can be set manually by iwconfig, but this did not help to establish a connection. According to a typical debug output (daemon.log), NM reaches Stage 2 of 5 but when switching from the wired network (eth0) to the open wireless AP (eth1) in the NM applet. I do not give the full output in order to avoid making the post too long and cryptic, but I'll be happy to provide it if it can help.

What strikes me in the output is that wpa_supplicant sends a AP_SCAN 1 request, accordingly the driver does not select the ieee80211 association parameters in this mode. Starting wpa_cli in a terminal and setting AP_SCAN 0 in the interactive mode while the nm-applet tries to connect gives a little bit of improvement (one out of the two green lights turn on), but still goes into timeout after a while.

Thanks for reading me up to here, of course I hope that somebody has a hint for a fix, but even the indication if it is a bug or if it is just me would help.