Re: Raspberry Pi 5 and WPA3

[James Prestwood <prestwoj@gmail.com>]

Hi Marcel,

On 4/30/24 12:42 AM, Marcel Holtmann wrote:
> Hi James,
>
>>> I'm not sure this is the right place to ask for some assistance, but
>>> here we go...
>>>
>>> I'm the author for a small Raspberry Pi audio image that is
>>> specifically targeting Roon.
>>> If you're not familiair with Roon: it's an audio streaming platform
>>> targeting audiophiles ;-)
>>>
>>> Anyways, about a year ago I switched from wpa_supplicant to iwd, to
>>> full satisfaction.
>>> Better and easier integration, and overall a feel of me being in more control.
>>>
>>> Now, recently I'm having issues with WPA3 support. This is partly
>>> related to firmware (it's just so obfuscated how this all works with
>>> firmware from broadcom and firmware from cypress :-(
>>>
>>> And one of those things is that I can't get it to work on the new Pi
>>> 5. Specifically IWD reporting this:
>>>
>>> Apr 29 17:41:41 ropieee5 iwd[275]: src/wiphy.c:wiphy_select_akm()
>>> Network is WPA3-Personal...
>>> Apr 29 17:41:41 ropieee5 iwd[275]: SAE unsupported: brcmfmac needs
>>> CMD_EXTERNAL_AUTH for SAE
>>> Apr 29 17:41:41 ropieee5 iwd[275]: src/wiphy.c:wiphy_select_akm()
>>> Can't use SAE, trying WPA2
>>>
>>> Now, the Pi guys point me to the missing CMD_EXTERNAL_AUTH message and
>>> advise me to go back to wpa_supplicant. Which is not something I would
>>> like to do for various reasons...
>>>
>>> Do you have any advice for me on what I can do? is this
>>> CMD_EXTERNAL_AUTH really related to  this and are you planning on
>>> implementing this?
>> Unfortunately the external auth support is not yet implemented in IWD. The brcmfmac driver itself is rather unique being a fullmac driver. Depending on how you look at it, this on its own is "easier" to support. It handles connecting/roaming all on its own. But then, for some reason, someone didn't want to do SAE/WPA3 on the card itself so they came up with some one-off mechanism to offload that onto userspace. This is one of those things that got put upstream that is a pain for projects like IWD to support IMO. Its something we do need to support eventually, especially given the raspi 5 requires it.
> if the Broadcom firmware finally would be able to support external_auth,
> then it would be nice, but as seen on recent linux-wireless discussions,
> it is unclear who does what. Broadcom wanted to support external_auth,
> but then Infineon (the new owner) might be rather using SAE as part of
> the firmware. And actually the chip on the RPi5 marks itself as Cypress
> and so you it is an unclear story. I think that Raspberry Pi foundation
> should get their story straight. Until really recently they shipped a
> firmware that couldn’t do SAE and also their drivers couldn’t even do
> external_auth and you were stuck with WPA2 only.
>
> https://holtmann.dev/enabling-wpa3-on-raspberry-pi/
I was not aware that it didn't even support it correctly. I figured 
broadcom was who added it in the first place.
>
> You can use an upstream firmware from linux-firmware and make the RPi5
> support WPA3. And as of a few weeks ago, even RPi5 latest Debian was
> switching to the upstream firmware.
>
> On side note, there exists no wpa_supplicant release that really supports
> SAE offload properly. You need to back port a lot of patches or hope
> that your distro back ported them for you.
>
> We should actually check if nl80211 tells us that external_auth is
> supported by the driver. And if not (which is the case for the Broadcom
> upstream driver) send a proper message to users and not lead them into
> a wild goose chase.
>
> Regards
>
> Marcel
>