QCA6174 showing terrible performance when connecting via WPA3-SAE

QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

Hello! I have a Samsung NT500R5H-Y53L with the QCA6174 card, and I 
noticed I was getting terrible performance (around 20-30 Mbps) compared 
to other devices on the network (600-700 Mbps), when running a speedtest.

I tried modifying some settings and discovered that I can get around 
500-600 Mbps on the speedtest if I limited the router settings to 
WPA2-PSK, but once I set the setting to allow for both WPA2 and WPA3, 
the card connects using WPA3-SAE but then has terrible performance as a 
result.

Is this a driver bug, or a limitation of the hardware? Is there a way to 
force the card to connect over WPA2-PSK?

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> Hello! I have a Samsung NT500R5H-Y53L with the QCA6174 card, and I
> noticed I was getting terrible performance (around 20-30 Mbps)
> compared to other devices on the network (600-700 Mbps), when running
> a speedtest.
>
> I tried modifying some settings and discovered that I can get around
> 500-600 Mbps on the speedtest if I limited the router settings to
> WPA2-PSK, but once I set the setting to allow for both WPA2 and WPA3,
> the card connects using WPA3-SAE but then has terrible performance as
> a result.
>
> Is this a driver bug, or a limitation of the hardware?

My first guess it's because of software encryption with these cipher
suites (from ath10k_set_key()):

	/* this one needs to be done in software */
	if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
	    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
	    key->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256 ||
	    key->cipher == WLAN_CIPHER_SUITE_BIP_CMAC_256)
		return 1;

But with modern CPUs I would have still expected software encryption to
be faster than 20 Mbps so the chances are it can be something else as
well.

> Is there a way to force the card to connect over WPA2-PSK?

That's a user space decision and depends on what connection manager you
use. For example, here's some info how to setup key management with
Network Manager:

https://askubuntu.com/questions/1290589/how-to-use-wpa3-with-ubuntu-20-04

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

Resending as I forgot to CC the mailing list, sorry! I've added some 
more
info since the last email.

On 2024-03-11 11:21, Kalle Valo wrote:
> But with modern CPUs I would have still expected software encryption to
> be faster than 20 Mbps so the chances are it can be something else as
> well.

I just checked and the laptop has an i5-5200U, but I'm not sure if it's 
the
bottleneck. I ran a speedtest while monitoring the load and the CPU 
usage
never went past 20-50% or so.

> That's a user space decision and depends on what connection manager you
> use.

That's the weird part, for some reason I can't get it to force-connect 
via
WPA2-PSK. I've tried KDE's network configuration and `nmtui`, but when I
connect to the network it seems like it tries to negotiate with WPA2-PSK 
first
and then "upgrades" to WPA3-SAE. Or at least that's how it appears in 
the
network details dropdown if I click on the chevron next to the Wi-Fi 
SSID.

I've also used a different USB Wi-Fi card, and that one correctly limits 
to
WPA2 if I set it in the connection manager. (And I've verified it 
connects
through WPA3 as well if I set it so.) So something in the ath10k driver 
won't
actually let me limit it to WPA2.

I'd like to figure out if there's a way of debugging this further, or 
simply
working around the limitation for now by disabling WPA3 at the driver 
level.
Please let me know if there's anything I can try on my end.

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> Resending as I forgot to CC the mailing list, sorry! I've added some
> more info since the last email.

Thanks. Let's keep the discussion on the list so that others can join.

> On 2024-03-11 11:21, Kalle Valo wrote:
>> But with modern CPUs I would have still expected software encryption to
>> be faster than 20 Mbps so the chances are it can be something else as
>> well.
>
> I just checked and the laptop has an i5-5200U, but I'm not sure if
> it's the bottleneck. I ran a speedtest while monitoring the load and
> the CPU usage never went past 20-50% or so.

This depends how you measured CPU usage so I would not make any
conclusions from this yet. I also don't know what's the best way to
measure CPU usage from kernel driver point of view.

>> That's a user space decision and depends on what connection manager you
>> use.
>
> That's the weird part, for some reason I can't get it to force-connect
> via WPA2-PSK. I've tried KDE's network configuration and `nmtui`, but
> when I connect to the network it seems like it tries to negotiate with
> WPA2-PSK first and then "upgrades" to WPA3-SAE. Or at least that's how
> it appears in the network details dropdown if I click on the chevron
> next to the Wi-Fi SSID.

I do not use Network Manager or other connection managers when testing.
It's much more reliable to use wpasupplicant directly and you get full
control. I usually create a custom config file and then start the
supplicant manually. Some pointers:

https://wiki.archlinux.org/title/wpa_supplicant

https://w1.fi/cgit/hostap/plain/wpa_supplicant/README

https://w1.fi/cgit/hostap/tree/wpa_supplicant/wpa_supplicant.conf

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 4/25/24 5:51 AM, Kalle Valo wrote:

> I do not use Network Manager or other connection managers when testing.
> It's much more reliable to use wpasupplicant directly and you get full
> control. I usually create a custom config file and then start the
> supplicant manually. Some pointers:
>
> (...)

I had some time today to test this, but unfortunately I couldn't figure 
out if wpa_supplicant was using WPA2 or WPA3. Trying to connect via 
`key_mgmt=SAE` caused `dhcpcd` to time out looking for carriers, so I 
guess it was connecting via WPA2. In any case the speed results were the 
same as disabling WPA3 on the router-side.

The reason I'm sending this email despite not making much progress above 
is because it turns out I was chasing a red herring. The real problem 
behind the degraded throughput was 802.11w. The router was advertising 
support for it (802.11w capable but optional), but was not forcing 
clients that didn't have the capability (required mode).

In Optional mode, I was experiencing the degraded performance. But after 
I disabled 802.11w on the router side, the speeds recovered to normal 
levels on both 2.4 GHz and 5 GHz bands, even connected over WPA3.

So I'm guessing something on the driver's side is signaling that it 
supports 802.11w, when in reality it doesn't or some bug with the 
implementation causes the speed to drop. Or maybe there's an overhead 
I'm unaware of when 802.11w is enabled? My limited understanding of 
802.11w is that the management frames are protected to prevent deauth 
attacks.

I'm not sure where to begin troubleshooting this, but in the interim can 
I disable the capability advertising on the driver-level? I don't want 
to disable 802.11w on my entire network, if possible.

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> On 4/25/24 5:51 AM, Kalle Valo wrote:
>
>> I do not use Network Manager or other connection managers when testing.
>> It's much more reliable to use wpasupplicant directly and you get full
>> control. I usually create a custom config file and then start the
>> supplicant manually. Some pointers:
>>
>> (...)
>
> I had some time today to test this, but unfortunately I couldn't
> figure out if wpa_supplicant was using WPA2 or WPA3. Trying to connect
> via `key_mgmt=SAE` caused `dhcpcd` to time out looking for carriers,
> so I guess it was connecting via WPA2. In any case the speed results
> were the same as disabling WPA3 on the router-side.

If you run wpa_supplicant -dddt (or similar) you get a lot of debug
output, I'm sure it will also include the cipher.

> The reason I'm sending this email despite not making much progress
> above is because it turns out I was chasing a red herring. The real
> problem behind the degraded throughput was 802.11w. The router was
> advertising support for it (802.11w capable but optional), but was not
> forcing clients that didn't have the capability (required mode).
>
> In Optional mode, I was experiencing the degraded performance. But
> after I disabled 802.11w on the router side, the speeds recovered to
> normal levels on both 2.4 GHz and 5 GHz bands, even connected over
> WPA3.
>
> So I'm guessing something on the driver's side is signaling that it
> supports 802.11w, when in reality it doesn't or some bug with the
> implementation causes the speed to drop. Or maybe there's an overhead
> I'm unaware of when 802.11w is enabled? My limited understanding of
> 802.11w is that the management frames are protected to prevent deauth
> attacks.
>
> I'm not sure where to begin troubleshooting this, but in the interim
> can I disable the capability advertising on the driver-level? I don't
> want to disable 802.11w on my entire network, if possible.

Very good that you found this is 802.11w related. What is the make and
model of your router?

I don't know how well ath10k 802.11w support is tested and then it was
last tested. Do you happen to have other Access Points supporting
802.11w? That might help to pinpoint if 802.11w is completely broken in
ath10k or if this is an interoperability issue with ath10k and your AP.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 2024-04-29 14:18, Kalle Valo wrote:
> If you run wpa_supplicant -dddt (or similar) you get a lot of debug
> output, I'm sure it will also include the cipher.

Good to know, thank you. Will keep this in mind the next time I'm
troubleshooting WPA-levels.

> Very good that you found this is 802.11w related. What is the make and
> model of your router?

I'm using a GL-AXT1800 (Slate AX) router from GL.iNet.

> I don't know how well ath10k 802.11w support is tested and then it was
> last tested. Do you happen to have other Access Points supporting
> 802.11w? That might help to pinpoint if 802.11w is completely broken in
> ath10k or if this is an interoperability issue with ath10k and your AP.

I unfortunately do not have access to any other routers I can modify
settings on at the moment (or any other APs to connect to, to test on,
really...) I may have some routers to test it on next week, but I'm
unsure whether they allow me to modify the 802.11w settings as they're
mostly proprietary and don't run something like OpenWRT.

Do you know if it'll be possible to add a flag to enable/disable 802.11w
on ath10k's side? Even if it turns out to be an interoperability issue,
it will most likely be useful to have the ability to switch it off for
APs that don't play nice. Especially for public APs and proprietary
APs where the end-user can't realistically turn off 802.11w for the
entire network.

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> On 2024-04-29 14:18, Kalle Valo wrote:
>> If you run wpa_supplicant -dddt (or similar) you get a lot of debug
>> output, I'm sure it will also include the cipher.
>
> Good to know, thank you. Will keep this in mind the next time I'm
> troubleshooting WPA-levels.
>
>> Very good that you found this is 802.11w related. What is the make and
>> model of your router?
>
> I'm using a GL-AXT1800 (Slate AX) router from GL.iNet.
>
>> I don't know how well ath10k 802.11w support is tested and then it was
>> last tested. Do you happen to have other Access Points supporting
>> 802.11w? That might help to pinpoint if 802.11w is completely broken in
>> ath10k or if this is an interoperability issue with ath10k and your AP.
>
> I unfortunately do not have access to any other routers I can modify
> settings on at the moment (or any other APs to connect to, to test on,
> really...) I may have some routers to test it on next week, but I'm
> unsure whether they allow me to modify the 802.11w settings as they're
> mostly proprietary and don't run something like OpenWRT.
>
> Do you know if it'll be possible to add a flag to enable/disable 802.11w
> on ath10k's side? Even if it turns out to be an interoperability issue,
> it will most likely be useful to have the ability to switch it off for
> APs that don't play nice. Especially for public APs and proprietary
> APs where the end-user can't realistically turn off 802.11w for the
> entire network.

If the problem is on ath10k side I would rather semove support for
802.11w altogether (until it's fixed). It's controlled with this flag:

	ieee80211_hw_set(ar->hw, MFP_CAPABLE);

Alternatively if it works on some hardware and not on others we could
make it per hw, for example disabled on QCA6174 and enabled on all
others.

But I found some old documentation claiming that 802.11w can be disabled
from Network Manager, if it works that sounds like a good temporary
solution:

"pmf int32 0 Indicates whether Protected Management Frames (802.11w)
must be enabled for the connection."

https://developer-old.gnome.org/NetworkManager/stable/settings-802-11-wireless-security.html

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 4/29/2024 12:32 PM, Kalle Valo wrote:

> If the problem is on ath10k side I would rather semove support for
> 802.11w altogether (until it's fixed). It's controlled with this flag:
>
> 	ieee80211_hw_set(ar->hw, MFP_CAPABLE);
>
> Alternatively if it works on some hardware and not on others we could
> make it per hw, for example disabled on QCA6174 and enabled on all
> others.

Yup, that would definitely be ideal.

>
> But I found some old documentation claiming that 802.11w can be disabled
> from Network Manager, if it works that sounds like a good temporary
> solution:
>
> (...)

So I tried this by running `nmcli connection modify <SSID> wifi-sec.pmf 
1` (after setting `key-mgmt` to `wpa-psk` since `SAE` requires PMF), but 
for some reason it is now refusing to connect. The "Configuring 
Interface" message shows up with the spinner, and then after a while a 
"No secrets were provided" error shows. In `journalctl` I see the 
following output (pasting Gist link since I don't know if you're 
supposed to attach logs in email on mailing lists, please let me know if 
that's expected otherwise!):

https://gist.github.com/ericswpark/b7447021cda590237aea0a9f13f92134

Once I turn it back to defaults with `wifi-sec pmf 0` it starts to 
connect again.

Perhaps the driver showing that the card is capable of PMF, however 
broken it might be, is causing NetworkManager and wpa_supplicant to be 
confused? I did find a couple of bug reports that might be related:

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/104
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/129


- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

I had the opportunity to test the connection with another router (Asus 
RT-AX56U) today and it negotiated with WPA2-PSK, PMF default on, on 5 
GHz. I ran a speedtest and got 20 Mbps both up/down.

I then ran the `nmcli connection modify <SSID2> wifi-sec.pmf 1` and 
after reconnecting it connected with PMF disabled. (I think the reason 
it worked this time is because of WPA2-PSK -- there's probably some way 
of making it work with WPA3 APs and `nmcli` but I don't know the correct 
commands to give in order to make that happen.) The speedtest increased 
to 100 Mbps both up/down, and that's the WAN limit -- I'm pretty sure if 
I ran a iperf3 inside the LAN it would've been much faster.

I think the PMF implementation in ath10k, at least for the QCA6174 chip, 
has some issues as it has consistently worsened performance on two out 
of two sample APs I've tested it on.


- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> I had the opportunity to test the connection with another router (Asus
> RT-AX56U) today and it negotiated with WPA2-PSK, PMF default on, on 5
> GHz. I ran a speedtest and got 20 Mbps both up/down.
>
> I then ran the `nmcli connection modify <SSID2> wifi-sec.pmf 1` and
> after reconnecting it connected with PMF disabled. (I think the reason
> it worked this time is because of WPA2-PSK -- there's probably some
> way of making it work with WPA3 APs and `nmcli` but I don't know the
> correct commands to give in order to make that happen.) The speedtest
> increased to 100 Mbps both up/down, and that's the WAN limit -- I'm
> pretty sure if I ran a iperf3 inside the LAN it would've been much
> faster.
>
> I think the PMF implementation in ath10k, at least for the QCA6174
> chip, has some issues as it has consistently worsened performance on
> two out of two sample APs I've tested it on.

Yeah, clearly something is wrong somewhere but difficult to say where
exactly. I got a private comment that one possible cause might be that
the first ADDBA frame is not decrypted correctly and the aggregation is
not working. Broken aggregation would explain the decrease in
throughput.

This is of course just a theory. I don't know how familiar you are with
802.11 protocols but that is something to investigate. Unfortunately I
have very little time for ath10k nowadays.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 5/6/2024 6:04 PM, Kalle Valo wrote:

> (...)
> This is of course just a theory. I don't know how familiar you are with
> 802.11 protocols but that is something to investigate. Unfortunately I
> have very little time for ath10k nowadays.

Not very familiar with 802.11 protocols, I'm just a user. Until it can 
be fixed can PMF
be disabled for the QCA6174 card?

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> On 5/6/2024 6:04 PM, Kalle Valo wrote:
>
>> (...)
>> This is of course just a theory. I don't know how familiar you are with
>> 802.11 protocols but that is something to investigate. Unfortunately I
>> have very little time for ath10k nowadays.
>
> Not very familiar with 802.11 protocols, I'm just a user. Until it can
> be fixed can PMF
> be disabled for the QCA6174 card?

But James is reporting[1] that 802.11w is working for him. So it doesn't
seem to be completely broken even if you are having problems and
removing the 802.11w support from the driver doesn't sound right.

[1] https://lore.kernel.org/all/ce0e2043-5085-4dd6-86bd-89dca6f566be@gmail.com/

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 5/15/2024 12:27 AM, Kalle Valo wrote:

> But James is reporting[1] that 802.11w is working for him. So it doesn't
> seem to be completely broken even if you are having problems and
> removing the 802.11w support from the driver doesn't sound right.
>
> [1] https://lore.kernel.org/all/ce0e2043-5085-4dd6-86bd-89dca6f566be@gmail.com/

I actually didn't see that email -- I'm not very familiar with how 
mailing lists work but I guess I have to be subscribed to receive 
updates, even for mail chains that I've started. So thank you for 
linking me his email.

I'm unsure what to test next, if it can be triaged at all. It's an 
outdated card  in a really old laptop and I can always work around it 
with a USB WiFi adapter. If anyone has any suggestions I'm all ears but 
otherwise I think this would be a good place to stop.

- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> On 5/15/2024 12:27 AM, Kalle Valo wrote:
>
>> But James is reporting[1] that 802.11w is working for him. So it doesn't
>> seem to be completely broken even if you are having problems and
>> removing the 802.11w support from the driver doesn't sound right.
>>
>> [1] https://lore.kernel.org/all/ce0e2043-5085-4dd6-86bd-89dca6f566be@gmail.com/
>
> I actually didn't see that email -- I'm not very familiar with how
> mailing lists work but I guess I have to be subscribed to receive
> updates, even for mail chains that I've started. So thank you for
> linking me his email.

Usually we cc people so that people don't need to subscribe to lists,
but for some reason James didn't do that in this case.

You can also follow ath10k list via lore:

https://lore.kernel.org/ath10k/

And there's also lei which some people are using:

https://people.kernel.org/monsieuricon/lore-lei-part-1-getting-started

> I'm unsure what to test next, if it can be triaged at all. It's an
> outdated card  in a really old laptop and I can always work around it
> with a USB WiFi adapter. If anyone has any suggestions I'm all ears
> but otherwise I think this would be a good place to stop.

One thing to try is to make sure your setup matches what James is using,
especially the firmware version.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Eric Park]

On 5/15/24 5:04 PM, Kalle Valo wrote:

> Eric Park <me@ericswpark.com> writes:
>> I'm unsure what to test next, if it can be triaged at all. It's an
>> outdated card  in a really old laptop and I can always work around it
>> with a USB WiFi adapter. If anyone has any suggestions I'm all ears
>> but otherwise I think this would be a good place to stop.
> One thing to try is to make sure your setup matches what James is using,
> especially the firmware version.

Interesting, this is what I get from `dmesg`:

qca6174 hw2.1 target 0x05010000 chip_id 0x003405ff sub 144d:4125
firmware ver SW_RM.1.1.1-00157-QCARMSWPZ-1 api 5 features ignore-otp,
no-4addr-pad crc32 10bf8e08

I'm guessing the firmware version 1.1.1 is the latest one for the hw
2.1 variant (going off of the firmware repository), but please correct
me if I'm wrong!

Looking at the repository that version was updated 8 years ago. Is
there anything else I can try? I'm guessing newer firmware only
works on the newer hardware revisions.


- Eric

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[Kalle Valo]

Eric Park <me@ericswpark.com> writes:

> On 5/15/24 5:04 PM, Kalle Valo wrote:
>
>> Eric Park <me@ericswpark.com> writes:
>>> I'm unsure what to test next, if it can be triaged at all. It's an
>>> outdated card  in a really old laptop and I can always work around it
>>> with a USB WiFi adapter. If anyone has any suggestions I'm all ears
>>> but otherwise I think this would be a good place to stop.
>> One thing to try is to make sure your setup matches what James is using,
>> especially the firmware version.
>
> Interesting, this is what I get from `dmesg`:
>
> qca6174 hw2.1 target 0x05010000 chip_id 0x003405ff sub 144d:4125
> firmware ver SW_RM.1.1.1-00157-QCARMSWPZ-1 api 5 features ignore-otp,
> no-4addr-pad crc32 10bf8e08
>
> I'm guessing the firmware version 1.1.1 is the latest one for the hw
> 2.1 variant (going off of the firmware repository), but please correct
> me if I'm wrong!
>
> Looking at the repository that version was updated 8 years ago. Is
> there anything else I can try? I'm guessing newer firmware only
> works on the newer hardware revisions.

Aha! I had totally missed that you are using hw2.1. (James is using
hw3.2) Yeah, that hardware version has been problematic almost since the
beginning and there has been any firmware updates for a long time. I'm
not surprised at all that 802.11w is slow on hw2.1.

I think disabling 802.11w for QCA6174 hw2.1 is a good idea, patches
welcome.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: QCA6174 showing terrible performance when connecting via WPA3-SAE

[James Prestwood]

Hi Eric,

On 4/29/24 5:18 AM, Kalle Valo wrote:
> Eric Park <me@ericswpark.com> writes:
>
>> On 4/25/24 5:51 AM, Kalle Valo wrote:
>>
>>> I do not use Network Manager or other connection managers when testing.
>>> It's much more reliable to use wpasupplicant directly and you get full
>>> control. I usually create a custom config file and then start the
>>> supplicant manually. Some pointers:
>>>
>>> (...)
>> I had some time today to test this, but unfortunately I couldn't
>> figure out if wpa_supplicant was using WPA2 or WPA3. Trying to connect
>> via `key_mgmt=SAE` caused `dhcpcd` to time out looking for carriers,
>> so I guess it was connecting via WPA2. In any case the speed results
>> were the same as disabling WPA3 on the router-side.
> If you run wpa_supplicant -dddt (or similar) you get a lot of debug
> output, I'm sure it will also include the cipher.
>
>> The reason I'm sending this email despite not making much progress
>> above is because it turns out I was chasing a red herring. The real
>> problem behind the degraded throughput was 802.11w. The router was
>> advertising support for it (802.11w capable but optional), but was not
>> forcing clients that didn't have the capability (required mode).
>>
>> In Optional mode, I was experiencing the degraded performance. But
>> after I disabled 802.11w on the router side, the speeds recovered to
>> normal levels on both 2.4 GHz and 5 GHz bands, even connected over
>> WPA3.
>>
>> So I'm guessing something on the driver's side is signaling that it
>> supports 802.11w, when in reality it doesn't or some bug with the
>> implementation causes the speed to drop. Or maybe there's an overhead
>> I'm unaware of when 802.11w is enabled? My limited understanding of
>> 802.11w is that the management frames are protected to prevent deauth
>> attacks.
>>
>> I'm not sure where to begin troubleshooting this, but in the interim
>> can I disable the capability advertising on the driver-level? I don't
>> want to disable 802.11w on my entire network, if possible.
> Very good that you found this is 802.11w related. What is the make and
> model of your router?
>
> I don't know how well ath10k 802.11w support is tested and then it was
> last tested. Do you happen to have other Access Points supporting
> 802.11w? That might help to pinpoint if 802.11w is completely broken in
> ath10k or if this is an interoperability issue with ath10k and your AP.

FWIW I just had 802.11w enabled on our test floor (should have been to 
begin with...) where all clients are running QCA6174's. I tested with 
iperf and saw zero difference in throughput between MFP disabled and 
enabled. We also set MFP to required, not optional. So at least the 
hardware variant/firmware we run isn't picky with MFP:

qca6174 hw3.2 target 0x05030000 chip_id 0x00340aff sub 168c:3363
firmware ver WLAN.RM.4.4.1-00288- api 6 features wowlan,ignore-otp,mfp 
crc32 bf907c7c

Thanks,

James

>