Skip to content

Wi-Fi networks with WPA3 are not supported #171

Open
Open
Wi-Fi networks with WPA3 are not supported#171
Labels
enhancementNew feature or request

Description

@MarcoTheDingo
MarcoTheDingo
opened on Sep 12, 2022

Wi-Fi networks using only the WPA3 security protocol are showing the 🚫 symbol next to them, and cannot be joined.

  • The Qualcomm 845 does seem to support WPA3 at a hardware level. (Source: XDA Developers)
  • Discord user nelsonjchen said the missing Security Flag might be "NM_802_11_AP_SEC_KEY_MGMT_SAE". (Link to post)

See the network "DingoAteYourBaby" in the attached screenshot, which is only using WPA3. The IOT network current connected, has the exact same settings, on the same Access Point, except it is using WPA2.
Comma_WPA3

Activity

  1. MarcoTheDingo
    added
    enhancementNew feature or request
    on Sep 12, 2022

  2. nelsonjchen commented on Sep 12, 2022

    @nelsonjchen
    nelsonjchen
    on Sep 12, 2022
    Contributor

    https://github.com/commaai/openpilot/blob/f6398ea7864779f621f84df65ded7ee083e72c09/selfdrive/ui/qt/offroad/wifiManager.cc#L147-L149

    Probably just needs an extra flag added here.

    I would also say this issue probably only applies to networks with WPA3 only.

  3. adeebshihadeh commented on Sep 12, 2022

    @adeebshihadeh
    adeebshihadeh
    on Sep 12, 2022
    Contributor

    Great, want to open a PR and test it?

  4. MarcoTheDingo commented on Sep 12, 2022

    @MarcoTheDingo
    MarcoTheDingo
    on Sep 12, 2022
    Author

    I am by no means a developer, but I did fork and add the flag in both networkmanager.h & wifiManager.cc.
    https://github.com/TheOfficialJosh/openpilot/tree/wifi-wpa3

    It sees the network and allows me to type in the password, but it does not actually connect.

    Accidentally closed this

  5. MarcoTheDingo
    closed this as completedon Sep 12, 2022
  6. MarcoTheDingo
    reopened this on Sep 12, 2022

  7. MarcoTheDingo commented on Sep 12, 2022

    @MarcoTheDingo
    MarcoTheDingo
    on Sep 12, 2022
    Author

    Tested with two different Wi-Fi networks using only WPA3. It only saves the password, but never connects. Going to guess there's something more than these two lines.

    Is there a log file I can provide to help with figuring it out?

  8. incognitojam
    self-assigned this
    on Sep 12, 2022

  9. incognitojam commented on Sep 13, 2022

    @incognitojam
    incognitojam
    on Sep 13, 2022
    Contributor

    I can replicate this on my comma three, and looking at the system logs doesn't give much information. I think we might just have to update the network manager package, which is already on the latest release available in apt for Ubuntu 20.04/agnos...

    EDIT: If anyone wants to try and solve this I expect you'll need to temporarily add the jammy (22.04) package list to apt sources and upgrading network manager (remount / as rw and ro again after, and be warned upgrading any package might break your agnos! just try upgrading network manager alone)

  10. adeebshihadeh commented on Sep 13, 2022

    @adeebshihadeh
    adeebshihadeh
    on Sep 13, 2022
    Contributor

    We build ModemManager from source, might have to do the same for NetworkManager.

  11. incognitojam
    removed their assignment
    on Sep 27, 2022
  12. adeebshihadeh
    transferred this issue fromcommaai/openpiloton Aug 20, 2023
  13. adeebshihadeh
    changed the title [-]Wi-Fi networks with WPA3 are not supported[/-] [+][$100 bounty] Wi-Fi networks with WPA3 are not supported[/+] on Jan 4, 2024
  14. adeebshihadeh
    changed the title [-][$100 bounty] Wi-Fi networks with WPA3 are not supported[/-] [+]Wi-Fi networks with WPA3 are not supported[/+] on Jan 4, 2024

  15. adeebshihadeh commented on Jul 26, 2024

    @adeebshihadeh
    adeebshihadeh
    on Jul 26, 2024
    Contributor

    @andiradulescu you know if 24.04 fixes this for free?

  16. andiradulescu commented on Jul 26, 2024

    @andiradulescu
    andiradulescu
    on Jul 26, 2024
    Collaborator

    As it is, I kind of doubt it. I need to test - switching my router to WPA3 only - let's see what happens when I try to connect from 24.04.

  17. andiradulescu commented on Jul 26, 2024

    @andiradulescu
    andiradulescu
    on Jul 26, 2024
    Collaborator

    The WPA3 network appears in the list grayed out with a "forbidden" icon to the left of the right signal icon. I think I need to patch this in commaai/openpilot#27824.

    selfdrive/ui/qt/network/wifi_manager.cc: Unsupported network! sflag: 1, wpaflag: 0, rsnflag: 1160

  18. andiradulescu commented on Jul 27, 2024

    @andiradulescu
    andiradulescu
    on Jul 27, 2024
    Collaborator

    Patched wifi_manager.cc to be able to connect to my WPA3 SSID but it doesn't work:

    selfdrive/ui/qt/network/wifi_manager.cc: DBus call error: "Did not receive a reply. Possible causes include: the remote
 application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the
 network connection was broken."

    also tried with nmcli 1.46.0 in Ubuntu 24.04:

    nmcli -v
nmcli tool, version 1.46.0

nmcli conn show
NAME                           UUID                                  TYPE      DEVICE
...
openpilot connection **redacted-ssid**  e5aea78d-42bb-4082-b4b8-d978c24098c9  wifi      --

ifconfig wlan0
wlan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 00:0a:f5:90:e8:d4  txqueuelen 3000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

dmesg -w
...
[ 1819.334487] R0: [soft_irq][35058324353] [09:07:21.967314]  wlan: [0:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1819.339776] R0: [soft_irq][35058426523] [09:07:21.972635]  wlan: [0:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1836.334879] R0: [cds_mc_thread][35384732358] [09:07:38.967482]  wlan: [45934:E :SME] csr_get_active_scan_entry: 4978: Active list Empty scanId: 0
[ 1845.045532] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
    compared to a connecting to a WPA2 wifi afterwards 
    [ 1882.834414] R0: [soft_irq][36277523518] [09:08:25.466340]  wlan: [0:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1882.839890] R0: [soft_irq][36277628633] [09:08:25.471815]  wlan: [0:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1882.903422] R0: [wpa_supplicant][36278848348] [09:08:25.535340]  wlan: [3591:I :HDD] hdd_sme_roam_callback: 5141: Disabling queues
[ 1882.903621] R0: [wpa_supplicant][36278852290] [09:08:25.535546]  wlan: [3591:E :SME] csr_send_join_req_msg: 15855: Connecting to ssid:systeam bssid: 5c:02:14:b0:21:e2 rssi: -46 channel: 1 country_code: RO
[ 1882.905370] R0: [cds_mc_thread][36278885837] [09:08:25.537293]  wlan: [45934:I :WMI] send_vdev_start_cmd_tlv: vdev_id 0 freq 2412 chanmode 5 ch_info: 0x5 is_dfs 0 beacon interval 100 dtim 1 center_chan 2412 center_freq2 0 reg_info_1: 0x140000 reg_info_2: 0x1400, req->max_txpow: 0x14 Tx SS 2, Rx SS 2, ldpc_rx: 0
[ 1883.037358] R0: [cds_mc_thread][36281420020] [09:08:25.669280]  wlan: [45934:I :WMA] wma_send_peer_assoc: vdev_id 0 associd 1 peer_flags 219006 nss 2 phymode 5 ht_caps 1ed
[ 1883.037372] R0: [soft_irq][36281420316] [09:08:25.669295]  wlan: [0:I :TRX] ol_txrx_enqueue_rx_frames: 5519: Data on the peer before it is registered bufq->curr 0 bufq->drops 0
[ 1883.044946] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 1883.067431] R0: [soft_irq][36281997446] [09:08:25.699354]  wlan: [0:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1883.072234] wlan: 00:0a:f5:90:e8:d4 connected to 5c:02:14:b0:21:e2
[ 1883.072298] R0: [cds_mc_thread][36282090912] [09:08:25.704221]  wlan: [45934:I :HDD] hdd_send_peer_status_ind_to_oem_app: 716: OEM app is not registered(0) or pid is invalid(0)
[ 1883.109110] R0: [wpa_supplicant][36282797636] [09:08:25.741030]  wlan: [3591:I :HDD] hdd_print_netdev_txq_status: 18808: netdev tx queue[0] state: 0x0
[ 1883.109134] R0: [wpa_supplicant][36282798178] [09:08:25.741058]  wlan: [3591:I :HDD] hdd_print_netdev_txq_status: 18808: netdev tx queue[1] state: 0x0
[ 1883.109154] R0: [wpa_supplicant][36282798556] [09:08:25.741077]  wlan: [3591:I :HDD] hdd_print_netdev_txq_status: 18808: netdev tx queue[2] state: 0x0
[ 1883.109204] R0: [wpa_supplicant][36282798925] [09:08:25.741097]  wlan: [3591:I :HDD] hdd_print_netdev_txq_status: 18808: netdev tx queue[3] state: 0x0
[ 1883.109224] R0: [wpa_supplicant][36282799904] [09:08:25.741148]  wlan: [3591:I :HDD] hdd_print_netdev_txq_status: 18808: netdev tx queue[4] state: 0x0
[ 1883.109284] R0: [wpa_supplicant][36282801045] [09:08:25.741207]  wlan: [3591:I :HDD] __wlan_hdd_cfg80211_disconnect: 18909: Disconnect request from user space with reason: 2 (WLAN_REASON_PREV_AUTH_NOT_VALID) internal reason code: 3
[ 1883.109334] R0: [wpa_supplicant][36282802027] [09:08:25.741258]  wlan: [3591:I :HDD] wlan_hdd_disconnect: 18665: Disabling queues
[ 1883.114688] R0: [cds_mc_thread][36282904744] [09:08:25.746608]  wlan: [45934:W :WMA] wma_delete_bss: 5564: Outstanding msdu packets: 0
[ 1883.114861] R0: [cds_mc_thread][36282908133] [09:08:25.746785]  wlan: [45934:E :WMA] Invalid wma_cli_set vdev command/Not yet implemented 0x75
[ 1883.128876] R0: [cds_mc_thread][36283177186] [09:08:25.760797]  wlan: [45934:I :WMA] wma_remove_peer_by_reference: 1846: Deleting peer 5c:02:14:b0:21:e2 vdev id 0
[ 1883.128984] R0: [cds_mc_thread][36283179280] [09:08:25.760907]  wlan: [45934:I :TRX] ol_txrx_peer_detach:peer fffffff77fedb800 (5c:02:14:b0:21:e2)
[ 1883.144061] R0: [cds_mc_thread][36283468761] [09:08:25.775983]  wlan: [45934:E :PE ] pe_delete_session: 683: session is not valid
[ 1883.144316] R0: [cds_mc_thread][36283473675] [09:08:25.776239]  wlan: [45934:I :HDD] hdd_dis_connect_handler: 1651: Disabling queues
[ 1883.144473] R0: [cds_mc_thread][36283476684] [09:08:25.776396]  wlan: [45934:E :QDF] cds_dump_current_concurrency: 3331: unexpected num_connections value 0
[ 1883.144496] R0: [cds_mc_thread][36283477107] [09:08:25.776418]  wlan: [45934:E :QDF] cds_current_concurrency_is_mcc: 2145: unexpected num_connections value 0
[ 1883.144585] R0: [cds_mc_thread][36283478820] [09:08:25.776507]  wlan: [45934:I :HDD] hdd_send_peer_status_ind_to_oem_app: 716: OEM app is not registered(0) or pid is invalid(0)
[ 1883.145890] R0: [cds_mc_thread][36283503900] [09:08:25.777814]  wlan: [45934:E :SME] sme_8023_multicast_list: Invalid session: 0
[ 1883.146291] R0: [cds_mc_thread][36283511585] [09:08:25.778214]  wlan: [45934:E :WMA] vdev 0 is not up skipping limit_off_chan_param
[ 1884.482324] R0: [wpa_supplicant][36309163332] [09:08:27.114223]  wlan: [3591:I :HDD] hdd_sme_roam_callback: 5141: Disabling queues
[ 1884.482635] R0: [wpa_supplicant][36309169372] [09:08:27.114537]  wlan: [3591:E :SME] csr_send_join_req_msg: 15855: Connecting to ssid:systeam bssid: 5c:02:14:b0:21:e2 rssi: -47 channel: 1 country_code: US
[ 1884.484246] R0: [cds_mc_thread][36309200267] [09:08:27.116146]  wlan: [45934:I :WMI] send_vdev_start_cmd_tlv: vdev_id 0 freq 2412 chanmode 5 ch_info: 0x5 is_dfs 0 beacon interval 100 dtim 1 center_chan 2412 center_freq2 0 reg_info_1: 0x160000 reg_info_2: 0x1600, req->max_txpow: 0x16 Tx SS 2, Rx SS 2, ldpc_rx: 0
[ 1884.556783] R0: [cds_mc_thread][36310592959] [09:08:27.188681]  wlan: [45934:I :WMA] wma_send_peer_assoc: vdev_id 0 associd 1 peer_flags 219006 nss 2 phymode 5 ht_caps 1ed
[ 1884.559268] wlan: 00:0a:f5:90:e8:d4 connected to 5c:02:14:b0:21:e2
[ 1884.559332] R0: [cds_mc_thread][36310641980] [09:08:27.191235]  wlan: [45934:I :HDD] hdd_send_peer_status_ind_to_oem_app: 716: OEM app is not registered(0) or pid is invalid(0)
[ 1884.606551] R0: [wpa_supplicant][36311548510] [09:08:27.238449]  wlan: [3591:W :SME] sme_ft_update_key: 359: Unhandled state: 0
[ 1884.607072] R0: [wpa_supplicant][36311558581] [09:08:27.238973]  wlan: [3591:W :SME] sme_ft_update_key: 359: Unhandled state: 0
[ 1884.607309] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 1884.638117] R0: [cds_mc_thread][36312153935] [09:08:27.269981]  wlan: [45934:I :SME] sme_ps_enable_auto_ps_timer: 1052: Start auto_ps_timer for 5000 ms
[ 1884.638169] R0: [cds_mc_thread][36312155638] [09:08:27.270070]  wlan: [45934:I :SME] ########### Set Key Complete #############
[ 1884.638558] R0: [cds_mc_thread][36312163114] [09:08:27.270459]  wlan: [45934:I :WMI] send_per_roam_config_cmd_tlv: 12423: per roam enable=3, vdev=0
[ 1884.638881] R0: [cds_mc_thread][36312169300] [09:08:27.270781]  wlan: [45934:I :WMI] send_roam_scan_offload_rssi_change_cmd_tlv: 12484: roam_scan_rssi_change_thresh=5, bcn_rssi_weight=14
[ 1884.638902] R0: [cds_mc_thread][36312169716] [09:08:27.270803]  wlan: [45934:I :WMI] send_roam_scan_offload_rssi_change_cmd_tlv: 12486: hirssi_delay_btw_scans=15000
[ 1884.639014] R0: [cds_mc_thread][36312171877] [09:08:27.270916]  wlan: [45934:I :WMI] WMI --> WMI_ROAM_AP_PROFILE and other parameters
[ 1884.639055] R0: [cds_mc_thread][36312172655] [09:08:27.270956]  wlan: [45934:I :WMI] 2412,
[ 1884.639195] R0: [cds_mc_thread][36312175345] [09:08:27.271096]  wlan: [45934:I :WMI] LFR3:OKC enabled
[ 1884.639215] R0: [cds_mc_thread][36312175743] [09:08:27.271117]  wlan: [45934:I :WMI] LFR3:PMKSA caching enabled
[ 1884.648229] R0: [cds_mc_thread][36312347993] [09:08:27.280088]  wlan: [45934:I :SME] sme_ps_enable_auto_ps_timer: 1052: Start auto_ps_timer for 5000 ms
[ 1884.648263] R0: [cds_mc_thread][36312349384] [09:08:27.280161]  wlan: [45934:E :QDF] qdf_mc_timer_start: Cannot start timer in state = 21
[ 1884.648291] R0: [cds_mc_thread][36312349917] [09:08:27.280188]  wlan: [45934:W :SME] sme_ps_enable_auto_ps_timer: 1059: auto_ps_timer is already started
[ 1884.648344] R0: [cds_mc_thread][36312350967] [09:08:27.280243]  wlan: [45934:I :SME] ########### Set Key Complete #############
[ 1884.648741] R0: [cds_mc_thread][36312358585] [09:08:27.280640]  wlan: [45934:E :WMA] Unhandled WMA message of type 4209
[ 1885.009332] R0: [networkctl][36319281910] [09:08:27.641224]  wlan: [57654:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected
[ 1885.031507] R0: [NetworkManager][36319707668] [09:08:27.663399]  wlan: [3560:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected
[ 1885.077194] R0: [iwconfig][36320584860] [09:08:27.709085]  wlan: [57665:W :HDD] __hdd_ioctl: 7734: unknown ioctl 35587
[ 1885.090181] R0: [iwconfig][36320834205] [09:08:27.722072]  wlan: [57665:W :HDD] __hdd_ioctl: 7734: unknown ioctl 35593
[ 1886.795832] R0: [cds_mc_thread][36353581139] [09:08:29.427616]  wlan: [45934:I :HDD] hdd_local_unsafe_channel_updated: 8267: unsafe chan list same
[ 1889.029450] R0: [NetworkManager][36396467816] [09:08:31.661265]  wlan: [3560:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected
[ 1901.029431] R0: [NetworkManager][36626867499] [09:08:43.661072]  wlan: [3560:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected
[ 1907.029880] R0: [NetworkManager][36742075895] [09:08:49.661420]  wlan: [3560:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected
[ 1913.029222] R0: [NetworkManager][36857263587] [09:08:55.660690]  wlan: [3560:E :HDD] hdd_is_rcpi_applicable: 4948: mac addr is different from bssid connected

    So, it still doesn't work also in Ubuntu 24.04 with Network Manager 1.46.0

  19. MarcoTheDingo commented on Feb 27, 2025

    @MarcoTheDingo
    MarcoTheDingo
    on Feb 27, 2025
    Author

    Hey guys, bumping this since Wi-Fi 7/MLO becomes more prevalent and WPA3 is being enabled by default on some routers. I tried the recommended implementations on the newest AGNOS, but still it does not connect (https://github.com/MarcoTheDingo/openpilot/tree/wpa3).

  20. andiradulescu commented on Feb 27, 2025

    @andiradulescu
    andiradulescu
    on Feb 27, 2025
    Collaborator

    From what I remember it will work only with kernel driver support. Or when we switch to mainline.

  21. shunnag commented on Sep 24, 2026

    @shunnag
    shunnag
    on Sep 24, 2026

    Root cause found and fixed in the kernel; WPA3-only networks now connect on a comma four (AGNOS 19.8) with a 4-file qcacld-3.0 change. Details and on-device logs below.

    Root cause

    drivers/staging/qcacld-3.0/Kbuild only sets CONFIG_WLAN_FEATURE_SAE := y inside ifeq ($(KERNEL_BUILD), 0), the Android external-module path (MODNAME=wlan). AGNOS builds qcacld in-tree (CONFIG_QCA_CLD_WLAN=y, MODNAME empty → KERNEL_BUILD=1), and neither the qcacld Kconfig nor tici_defconfig has an SAE symbol. So -DWLAN_FEATURE_SAE has never been defined in any AGNOS kernel since the 2020 import (commaai/agnos-kernel-sdm845@2c6aed22f9ff).

    As a result, the driver never sets NL80211_FEATURE_SAE, and wpa_supplicant drops SAE before it sends CONNECT. This explains the missing csr_send_join_req_msg in the earlier dmesg and NM's ssid-not-found. It is not a NetworkManager / Ubuntu / firmware issue.

    The shipped 19.8 boot.img (335c1757…) contains none of the SAE-only log strings, and its .external_auth cfg80211 op is NULL.

    Before (stock AGNOS 19.8, comma four, WPA3-only AP: SAE, PMF required, no H2E)

    $ wpa_cli -i wlan0 get_capability auth_alg
OPEN SHARED LEAP
NetworkManager: Config: added 'key_mgmt' value 'SAE FT-SAE'
wpa_supplicant: WPA: AP key_mgmt 0x400 network profile key_mgmt 0xc00; available key_mgmt 0x0
wpa_supplicant: WPA: Failed to select authenticated key management type
NetworkManager: Activation: (wifi) association took too long, failing activation
$ nmcli dev wifi connect <ssid> password <pw>
Error: Connection activation failed: The Wi-Fi network could not be found.

    Fix

    Kernel PR: commaai/agnos-kernel-sdm845#142. It changes 4 files (+11/−2):

    1. Add a WLAN_FEATURE_SAE Kconfig symbol (like WLAN_FEATURE_11W) and set CONFIG_WLAN_FEATURE_SAE=y in tici_defconfig.
    2. Move case NL80211_AUTHTYPE_SAE in wlan_hdd_cfg80211_set_auth_type() out of the WLAN_FEATURE_FILS_SK guard. FILS is off in-tree, so enabling SAE alone still fails with -EINVAL. This matches the newer 5.1.1.75T driver in newer version of wlan driver agnos-kernel-sdm845#98.
    3. Port the "SAE with open authentication" branch in hdd_set_csr_auth_type() from the newer version of wlan driver agnos-kernel-sdm845#98 driver. Without it, SAE AKM + NL80211_AUTHTYPE_OPEN_SYSTEM (sent for PMKSA-caching reconnects, and by NM profiles with auth-alg=open) is mapped to eCSR_AUTH_TYPE_RSN.

    Build: agnos19.8 branch, kernel eccd146, comma's GCC 8.2.1 toolchain. A control build without the patch matches the shipped image except for build identity and module-signing key. With the patch, only drivers/staging/qcacld-3.0 (plus init/version.o and kernel/configs.o) is rebuilt. The added strings are all SAE-related.

    After (same device, 19.8 + patched boot.img)

    $ wpa_cli -i wlan0 get_capability auth_alg
OPEN SHARED LEAP SAE
$ nmcli dev wifi connect <ssid> password <pw>
Device 'wlan0' successfully activated
nl80211: BSS Event 127 (NL80211_CMD_EXTERNAL_AUTH) received for wlan0
SAE: Selecting supported ECC group 19
wlan0: nl80211: External auth status: 0
wlan0: WPA: Key negotiation completed with <bssid> [PTK=CCMP GTK=CCMP]
# DHCP ok, ping ok; BIP (AES-128-CMAC) negotiated
$ wpa_cli -i wlan0 reassociate          # PMKSA caching path (fix 3)
wlan0: SAE: Use WPA_AUTH_ALG_OPEN for PMKSA caching attempt
wlan0: CTRL-EVENT-CONNECTED

    The stock WLAN firmware (WLAN.HL.2.0.c10-00459, 2019) handles external-auth SAE and PMF fine.

    The driver skips firmware roam offload for SAE connections (Roaming not supported for SAE connection, by design in this driver). SAE links reconnect instead of roaming.

    Remaining / notes

    • openpilot UI: get_security_type() still marks SAE-only APs UNSUPPORTED and always creates key-mgmt=wpa-psk profiles.
      • Ubuntu's wpa_supplicant 2.10 doesn't report sae in D-Bus KeyMgmt for this driver, because the driver advertises no AKM suites (fixed upstream in hostap 2.12, d82c9e61). So NM won't add SAE to wpa-psk profiles on its own.
      • The UI needs to create key-mgmt=sae profiles (without auth-alg) for SAE-only APs, gated on GET_CAPABILITY auth_alg containing SAE. I have a patch for that, tested on the same device: a WPA3-only AP shows with a lock in the mici UI, and connecting creates a sae profile (key_mgmt SAE FT-SAE, ieee80211w 2, no auth_alg). Saved-profile reconnect works. A wrong password ends in need-auth → failed (no-secrets) after about 26 s, and the UI handles it. Transition APs still use wpa-psk. I'll open that PR after aligning with the NM-removal work (Remove NetworkManager + DBus rom WiFi stack openpilot#37752 / wifi: replace NetworkManager with wpa_supplicant openpilot#38968), since the wpa_supplicant-direct path needs the same change.
      • WPA2/WPA3 transition networks keep using WPA2-PSK.
    • Not supported: the driver has no RSNXE/SAE-H2E code, so H2E-only APs (sae_pwe=1, e.g. 6 GHz-style configs) will likely still fail. Hunting-and-pecking works.
    • Not tested: comma 3X. It uses the same kernel and firmware.

    Full before/after logs (redacted): https://gist.github.com/shunnag/90458a4e96a36e6260145a9ab1226edd

  22. shunnag commented on Sep 25, 2026

    @shunnag
    shunnag
    on Sep 25, 2026

    Follow-up for SAE hash-to-element (H2E), which my earlier comment listed as unsupported:

    Tested on a comma four against a Wi-Fi 7 mesh AP in WPA3-only mode that advertises H2E:

    • H2E connects (status 126), and RSNXE is in the association request (RSN: set own RSNXE instead of clearing own RSNXE).
    • PMKSA-cached reconnect and wrong-password handling work.
    • The stock WLAN firmware relays the H2E auth frames without changes.

    My AP supports both SAE methods, so an H2E-only AP is not tested on the device yet. It connects on mac80211_hwsim with hostapd sae_pwe=1.

  23. adeebshihadeh commented on Sep 26, 2026

    @adeebshihadeh
    adeebshihadeh
    on Sep 26, 2026
    Contributor

    Thanks, this is good to know. Can you port your changes over to our new OS, vamOS? AGNOS is currently in maintenance mode.

  24. shunnag commented on Sep 26, 2026

    @shunnag
    shunnag
    on Sep 26, 2026

    Thanks for taking a look! I'll see if I can port my changes to vamOS.

  25. shunnag commented on Sep 26, 2026

    @shunnag
    shunnag
    on Sep 26, 2026

    I tried vamOS on my comma four. WPA3-Personal works there without porting anything, but I found one reconnect problem with PMF.

    Setup:

    • Liberation Day 7.2 (vamos.json 442f27c3), installed into the inactive slot the way dorapilot does it.
    • AGNOS 19.8 bootloaders: xbl e8acf2a9, abl 29fd7ed1.
    • WCN3990 firmware WLAN.HL.2.0.c10-00459.
    • wpa_supplicant 2.12, NetworkManager 1.56.
    • The first attempt ended in EDL (9008) about 1.4 s after the reset, before ABL picked a slot (boot_a retry count unchanged). A cold boot from port 2 with the PC unplugged booted LD normally.

    Nothing from the AGNOS work needs porting. commaai/agnos-kernel-sdm845#142, commaai/agnos-kernel-sdm845#143 and #629 are qcacld- and Ubuntu-2.10-specific. With mac80211, wpa_supplicant does SAE itself, and NetworkManager sets SaePwe=2.

    What works on vamOS:

    Problem: reconnecting after a PMF disconnect (filed as commaai/vamOS#131).

    • On the Deco (Wi-Fi 7, MLO always on), after vamOS disconnects a PMF connection, an immediate reconnect fails for about 40 s to 2 min.
      • The AP answers with association comeback, the association times out, and auth frames from that MAC then get no answer for a while.
      • This happened with SAE and with WPA2-PSK + PMF. WPA2-PSK without PMF reconnects in about 1 s.
      • With a different MAC address the reconnect works in 3 s. So the AP still thinks the old PMF association is alive.
    • On the same device, AGNOS (qcacld) reconnects to the same SSID in 0-1 s (3/3). It looks like the Deco does not accept the deauth that vamOS sends when it disconnects a PMF link. I have no over-the-air capture to show why.
    • An iPhone hotspot (no MLO) mostly reconnected right away.

    openpilot side:

    • WPA3-only networks still need a key-mgmt=sae profile.
    • The UI patch I have checks wpa_supplicant's control socket, which vamOS doesn't create. Since wifi: replace NetworkManager with wpa_supplicant openpilot#38968 replaces NetworkManager, SAE probably belongs there: key_mgmt SAE, ieee80211w, sae_password, global sae_pwe=2.

    Side note on recovery: official qdl.js setactiveslot changes only the slot attributes and leaves the partition type GUIDs on the other slot. ABL then refused to boot ('press any key to shutdown') until I restored the GPT. andiradulescu/qdl.js swaps the GUIDs.

    I can share redacted logs if they help.

  26. shunnag commented on Sep 26, 2026

    @shunnag
    shunnag
    on Sep 26, 2026

    Correction to my comment above: I wrote that the mfp feature bit (samcday/pocketfed#27) was not needed on this firmware. That was wrong.

    Without the bit, data frames work, but ath10k never marks PMF peers to the firmware. The firmware then sends the protected Deauth with PN 0, the AP drops it, and that causes the reconnect problem in commaai/vamOS#131.

    With the bit set, 6 of 7 reconnects took 1-5 s instead of 21-25 s. Captures and details are in commaai/vamOS#131, and the proposed fix is commaai/vamOS#133.

  27. shunnag commented on Oct 1, 2026

    @shunnag
    shunnag
    on Oct 1, 2026

    Follow-up for the record (no action needed, since AGNOS is in maintenance mode).

    I ran the same measurements on AGNOS 19.8 with the WPA3 kernel and wpa_supplicant from my fork, on the same comma four and AP (5 GHz ch 48, iperf3 30 s each way, profiles created by the openpilot UI):

    AGNOS 19.8 + WPA3 vamOS LD 7.2 (stock)
    WPA3-only (SAE, PMF required), Mbit/s up / down 259 / 228, 270 / 227 32 / 22, 23 / 22
    WPA2/WPA3 mixed 271 / 217 (WPA2-PSK + PMF) 23 / 23 (SAE + PMF)
    WPA2-only 268 / 266, 270 / 262 283 / 265, 280 / 272
    Reconnect, same MAC 0.8-1.4 s 24 s (status 30)
    Connect right after a failed attempt 1.5 s (3/3, wrong SAE password first) ~20 s firmware Auth hold

    So the slow PMF links and the reconnect delays only happen on vamOS. qcacld sets the peer PMF flag and cleans up after a failed attempt; ath10k does not. The vamOS side is tracked in commaai/vamOS#131 and commaai/vamOS#133.

    The run log, the iperf3 per-second summary and the idle ping results are attached. SSIDs and AP addresses are removed.

    Note: I worked through this together with Claude (AI). English is hard for me, so the English was written with AI help. I ran the device tests myself on my comma four, and the results above come from those runs.

    agnos_wpa3_measurements.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions