Re: Raspberry Pi 5 and WPA3

[James Prestwood <prestwoj@gmail.com>]

Hi Harry,

On 4/29/24 1:25 PM, Harry ten Berge wrote:
> Hi,
>
> I'm not sure this is the right place to ask for some assistance, but
> here we go...
>
> I'm the author for a small Raspberry Pi audio image that is
> specifically targeting Roon.
> If you're not familiair with Roon: it's an audio streaming platform
> targeting audiophiles ;-)
>
> Anyways, about a year ago I switched from wpa_supplicant to iwd, to
> full satisfaction.
> Better and easier integration, and overall a feel of me being in more control.
>
> Now, recently I'm having issues with WPA3 support. This is partly
> related to firmware (it's just so obfuscated how this all works with
> firmware from broadcom and firmware from cypress :-(
>
> And one of those things is that I can't get it to work on the new Pi
> 5. Specifically IWD reporting this:
>
> Apr 29 17:41:41 ropieee5 iwd[275]: src/wiphy.c:wiphy_select_akm()
> Network is WPA3-Personal...
> Apr 29 17:41:41 ropieee5 iwd[275]: SAE unsupported: brcmfmac needs
> CMD_EXTERNAL_AUTH for SAE
> Apr 29 17:41:41 ropieee5 iwd[275]: src/wiphy.c:wiphy_select_akm()
> Can't use SAE, trying WPA2
>
> Now, the Pi guys point me to the missing CMD_EXTERNAL_AUTH message and
> advise me to go back to wpa_supplicant. Which is not something I would
> like to do for various reasons...
>
> Do you have any advice for me on what I can do? is this
> CMD_EXTERNAL_AUTH really related to  this and are you planning on
> implementing this?

Unfortunately the external auth support is not yet implemented in IWD. 
The brcmfmac driver itself is rather unique being a fullmac driver. 
Depending on how you look at it, this on its own is "easier" to support. 
It handles connecting/roaming all on its own. But then, for some reason, 
someone didn't want to do SAE/WPA3 on the card itself so they came up 
with some one-off mechanism to offload that onto userspace. This is one 
of those things that got put upstream that is a pain for projects like 
IWD to support IMO. Its something we do need to support eventually, 
especially given the raspi 5 requires it.

Thanks,

James

>
> Thanks
>