WPA3 SAE is not supported on Pi 400 (BCM43456)

[ValdikSS]

Describe the bug

WPA3-Personal SAE Wi-Fi standard doesn't seem to be supported by the firmware/driver of Raspberry Pi 400.
The 400 has BCM43456 module (brcm/brcmfmac43456-sdio firmware), compared to Pi 3B/4/5, which use SYM43455 (cypress/cyfmac43455-sdio firmware).

So far there were issues here and on forum, firmware and code updates from Infineon for 43455 only as far as I could see.
Raspberry Pi 400 on the latest official OS version does not report anything related to SAE in iw phy, as well as wpa_cli get_capability key_mgmt.

Connecting to WPA3-Personal Only networks on Raspberry Pi 400 does not work.

Steps to reproduce the behaviour

Try to connect to WPA3-Personal Only network using Rasberry Pi 400

Device (s)

Raspberry Pi 400

System

6.18.39+rpt-rpi-v8

Logs

$ dmesg | grep 4345
[    8.809313] Bluetooth: hci0: BCM4345C5
[    8.809321] Bluetooth: hci0: BCM4345C5 (003.006.006) build 0000
[    8.938140] brcmfmac: F1 signature read @0x18000000=0x15294345
[    8.941616] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43456-sdio for chip BCM4345/9
[    8.980155] Bluetooth: hci0: BCM4345C5 'brcm/BCM4345C5.raspberrypi,400.hcd' Patch
[    9.212095] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/9 wl0: May 14 2020 17:26:08 version 7.84.17.1 (r871554) FWID 01-3d9e1d87
[    9.714776] Bluetooth: hci0: BCM43456 37.4MHz Raspberry Pi BT5.0 [Version: 1052.1108]
[    9.714782] Bluetooth: hci0: BCM4345C5 (003.006.006) build 1108


$ iw phy | grep -i sae || echo empty!
empty!

$ wpa_cli get_capability key_mgmt
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B OWE DPP FT-PSK FT-EAP
(no sae)

$ wpa_cli get_capability auth_alg
OPEN SHARED LEAP
(no sae)

[ValdikSS]

The updated firmware from New WiFi clm_blob file for BCM43456 (Pi 400) forum topic does not support SAE either: although that firmware (unlike the one in the Raspberry distro) has extsae feature as seen with strings, it is not supported:

#5945

(*) This appears to be different from extsae, as used by Synaptics, which isn't supported here yet, although both appear as extsae in the firmware version. It's necessary to run strings on the firmware and grep for sae_ext to be sure. And obviously, both are different to the in-firmware WPA3 support provided by the sae feature, but which only works with iwd.

The linked firmware has only extsae, not sae_ext. The stock firmware has none.

[MichaIng]

It looks like the culprit is RPi-Distro/firmware-nonfree@348a967. IMO pretty bad nonsense to me (sorry for the wording, but need to be honest here). (Re)move /usr/lib/modprobe.d/rpi-brcmfmac.conf, reboot, retry. If you face stability issues, a confirmation of in raspberrypi/firmware#1973 would be good. Then testing to narrow down the instability to one of the 4 disabled features. Disabling SAE (WPA3) all together cannot be a solution.

[ValdikSS]

It looks like the culprit

This is not applicable to 43456, as the bundled firmware doesn't have SAE support at all.
I've also tested the updated firmware from the linked forum topic on Orange Pi 4a, mainline 7.1 kernel, Debian 13, it has Ampak AP6256 module with the same BCM43456 chip. Does not work, because the kernel driver can't handle that special extsae command.

[MichaIng]

Oh good point. However, his config file is shipped to all RPi models. If SAE really needs to be actively disabled on 43456 to mitigate stability issues (which has not been verified in the related issue), then in a different way, conditionally via udev rules for affected models only or such. But this is OOT here then, aside of the fact that, if any new firmware is tested regarding WPA3, one must not forget to (re)move/override/mask /usr/lib/modprobe.d/rpi-brcmfmac.conf first.