Bug 16608

Summary:	rt2800pci driver working on Ralink rt2860 throws Michael MIC failure when connecting to a wpa2-tkip wireless network.
Product:	Drivers	Reporter:	elena27183
Component:	network-wireless	Assignee:	drivers_network-wireless (drivers_network-wireless)
Status:	CLOSED CODE_FIX
Severity:	low	CC:	cijoml, gwingerde, IvDoorn, linville, zajec5
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	2.6.33.4	Subsystem:
Regression:	No	Bisected commit-id:
Attachments:	Exit of the command wpa_supplicant -dd iw dev wlan0 scan neo_lodz.conf [hwcrypt] wpa_supplicant -D nl80211 -i wlan0 -c /home/neo_lodz.conf -dd [nohwcrypt] wpa_supplicant -D nl80211 -i wlan0 -c /home/neo_lodz.conf -dd MMIO dump of setting hw crypt for rt2860sta MMIO dump of setting hw crypt for rt2800pci Patch with fix.

Description elena27183 2010-08-16 19:37:14 UTC

Created attachment 27473 [details]
Exit of the command wpa_supplicant -dd

Overview:
Driver compiled from compat-wireless-2010-08-11 in Slackware 13.1 on a machine with a Ralink rt2860
Wext detects a 'MLME-MICHAELMICFAILURE.indication(keyid=0 unicast addr=00:13:d3:6e:22:3c)' when connecting to a WPA2-TKIP wireless net.
The result is that the computer doesn't connect to the router.

Steps to reproduce:
1) Compile driver rt2800pci on a machine with a Ralink rt2860 and charge module
2) Execute: wpa_supplicant -Dwext -iwlan0 -c(path to wpa_supplicant.conf)

Workaround: Change encryption to WPA2-AES in the wireless router.

Fragment of wpa_supplicant -dd (Attached complete log):

Wireless event: cmd=0x8c02 len=81
WEXT: Custom wireless event: 'MLME-MICHAELMICFAILURE.indication(keyid=0 unicast addr=00:13:d3:6e:22:3c)'
Michael MIC failure detected
WPA: Sending EAPOL-Key Request (error=1 pairwise=1 ptk_set=1 len=99)
WPA: TX EAPOL-Key - hexdump(len=99): 01 03 00 5f 02 0d 09 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 31 60 b9 63 ff b4 38 a0 e1 10 f3 39 5e 86 ed 00 00
RTM_NEWLINK: operstate=1 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added

Comment 1 Rafał Miłecki 2010-12-21 21:44:26 UTC

I can see the same issue with my
RaLink RT3090 Wireless 802.11n 1T/1R PCIe [1814:3090]

Comment 2 Rafał Miłecki 2010-12-22 00:53:12 UTC

Created attachment 41202 [details]
iw dev wlan0 scan

Comment 3 Rafał Miłecki 2010-12-22 00:54:43 UTC

Created attachment 41212 [details]
neo_lodz.conf

Comment 4 Rafał Miłecki 2010-12-22 00:55:35 UTC

Created attachment 41222 [details]
[hwcrypt] wpa_supplicant -D nl80211 -i wlan0 -c /home/neo_lodz.conf -dd

Comment 5 Rafał Miłecki 2010-12-22 00:56:29 UTC

Created attachment 41232 [details]
[nohwcrypt] wpa_supplicant -D nl80211 -i wlan0 -c /home/neo_lodz.conf -dd

Comment 6 Rafał Miłecki 2010-12-22 00:58:43 UTC

In my case using nohwcrypt=1 (module parameter) workarounds this issue. I attached wpa_supplicant logs from both cases.


1) With hwcrypt I can not connect and I have maaaany
[  455.751158] wlan0: authenticate with 00:1e:37:10:86:39 (try 1)
[  455.753130] wlan0: authenticated
[  455.753644] wlan0: associate with 00:1e:37:10:86:39 (try 1)
[  455.757320] wlan0: RX ReassocResp from 00:1e:37:10:86:39 (capab=0x431 status=12 aid=0)
[  455.757332] wlan0: 00:1e:37:10:86:39 denied association (code=12)
[  455.757529] wlan0: deauthenticating from 00:1e:37:10:86:39 by local choice (reason=3)
in my dmesg


2) With nohwcrypt I can connect, get DHCP offer and I get nice:
[  332.533088] wlan0: authenticate with 00:1e:37:10:86:39 (try 1)
[  332.535152] wlan0: authenticated
[  332.541064] wlan0: associate with 00:1e:37:10:86:39 (try 1)
[  332.548464] wlan0: RX AssocResp from 00:1e:37:10:86:39 (capab=0x431 status=0 aid=2)
[  332.548473] wlan0: associated
[  332.549855] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  342.850040] wlan0: no IPv6 routers present
[  367.042982] SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=40:61:86:ad:d6:31:00:1b:bf:58:5a:e8:08:00 SRC=79.184.178.190 DST=192.168.0.6 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=10347 DF PROTO=TCP SPT=23653 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A0226F60C0000000001030306) 
[  385.755384] martian source 255.255.255.255 from 192.168.0.1, on dev wlan0
[  385.755397] ll header: 40:61:86:9c:c6:bf:00:1b:bf:58:5a:e8:08:00
[  396.357473] wlan0: deauthenticating from 00:1e:37:10:86:39 by local choice (reason=3)

Comment 7 Rafał Miłecki 2010-12-22 08:48:17 UTC

Created attachment 41272 [details]
MMIO dump of setting hw crypt for rt2860sta

Comment 8 Rafał Miłecki 2010-12-22 08:48:56 UTC

Created attachment 41282 [details]
MMIO dump of setting hw crypt for rt2800pci

Comment 9 Rafał Miłecki 2010-12-22 08:52:19 UTC

I don't know much about encryption, but what does rt2800pci looks a little weird for me.

My network is WPA TKIP, which is preshared key.

In that situation rt2860sta uses AsicAddSharedKeyEntry and plays with registers SHARED_KEY_TABLE_BASE and SHARED_KEY_MODE_BASE.

Driver rt2800pci on the other hand uses rt2800_config_pairwise_key (does WPA TKIP use pairwise key?!) and plays with registers PAIRWISE_KEY_ENTRY.

Comment 10 John W. Linville 2011-01-21 18:20:16 UTC

Does it work if you load rt2800pci with nohwcrypt=1?

Comment 11 Gertjan van Wingerde 2011-01-21 23:30:51 UTC

Created attachment 44712 [details]
Patch with fix.

This definitely is an issue with the hardware encryption of rt2800. Johannes Stezenbach reported on the rt2x00-users mailing list that this is due to the driver not reporting that the Michael MIC is checked and stripped by the hardware.

Please try the attached patch. This should fix the issues that you see.

Comment 12 Cijoml Cijomlovic Cijomlov 2011-02-05 17:57:08 UTC

*** Bug 28212 has been marked as a duplicate of this bug. ***

Comment 13 Rafał Miłecki 2011-02-17 17:01:13 UTC

(In reply to comment #11)
> Created an attachment (id=44712) [details]
> Patch with fix.
> 
> This definitely is an issue with the hardware encryption of rt2800. Johannes
> Stezenbach reported on the rt2x00-users mailing list that this is due to the
> driver not reporting that the Michael MIC is checked and stripped by the
> hardware.
> 
> Please try the attached patch. This should fix the issues that you see.

Thanks. Unfortunately I'm hitting;
phy0 -> rt2800_wait_wpdma_ready: Error - WPDMA TX/RX busy aborting
phy0 -> rt2800pci_set_device_state: Error - Device failed to enter state 4 (-5)
issue for some time and I can not use WiFi at all.

I'm updating to latest wireless-testing git, maybe it will resolve (both) issues.

Comment 14 Rafał Miłecki 2011-02-17 17:56:41 UTC

(In reply to comment #13)
> I'm updating to latest wireless-testing git, maybe it will resolve (both)
> issues.

Wohoo! I can confirm that:
1) With latest wireless-testing I can connect to WPA2 TKIP
2) Reverting a45f369d477c0e1b15b77c7b09ccfa043097e9ab ("rt2x00: Fix WPA TKIP Michael MIC failures.") breaks my WPA2 TKIP
(I was using hwcrypto in both cases). Great work, thanks!

Comment 15 Rafał Miłecki 2011-02-17 18:08:12 UTC

(In reply to comment #13)

> Thanks. Unfortunately I'm hitting;
> phy0 -> rt2800_wait_wpdma_ready: Error - WPDMA TX/RX busy aborting
> phy0 -> rt2800pci_set_device_state: Error - Device failed to enter state 4
> (-5)
> issue for some time and I can not use WiFi at all.

That was probably fixed by:

commit 08e5310028359de2daaa39cd10e9ca493c51792b
Author: Helmut Schaa <helmut.schaa@googlemail.com>
Date:   Thu Nov 4 20:37:47 2010 +0100

    rt2x00: Wait up to one second on rt2800 for WPDMA to be ready


Argh, why I can not change status to fixed/resolved? :/