WPA WPA2 EAPOL HANDSHAKE OFFLOAD(9)

🎀 WPA/WPA2 EAPOL handshake offload(9) 🎀

ok so bestie, welcome to the Kernel API Manual, section 9 💖 — and this page is literally the entire tea on letting a driver handle the WPA/WPA2 EAPOL handshake instead of doing it all in the kernel. it's short, it's crunchy, it's giving "small but mighty" and i'm obsessed. ✨

💅 DESCRIPTION

🔑 station mode PSK — NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK

sooo by setting the NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK flag, drivers can be like "i got this one" and indicate they support offloading EAPOL handshakes for WPA/WPA2 preshared key authentication in station mode. in NL80211_CMD_CONNECT the preshared key should be specified using NL80211_ATTR_PMK. and heads up 🙈 — drivers that support this offload may reject the NL80211_CMD_CONNECT when no preshared key material is provided, for example when that driver does not support setting the temporal keys through NL80211_CMD_NEW_KEY. so yeah, bring your key material or get politely declined 💀

🦋 station mode 802.1X — NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X

similarly (see what they did there 😌) the NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X flag can be set by drivers, indicating offload support of the PTK/GTK EAPOL handshakes during 802.1X authentication in station mode. to actually use the offload, your NL80211_CMD_CONNECT should have the NL80211_ATTR_WANT_1X_4WAY_HS attribute flag. and yep, same energy: drivers supporting this offload may reject the NL80211_CMD_CONNECT when the attribute flag is not present. no flag, no offload, no vibes. 🫶

👑 AP mode PSK — NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK

by setting the NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK flag, drivers can indicate they support offloading EAPOL handshakes for WPA/WPA2 preshared key authentication in AP mode. in NL80211_CMD_START_AP the preshared key should be specified using NL80211_ATTR_PMK. and (third time's the charm 🌸) drivers supporting this offload may reject the NL80211_CMD_START_AP when no preshared key material is provided, for example when that driver does not support setting the temporal keys through NL80211_CMD_NEW_KEY.

🔥 802.1X + PMK the manual way

for 802.1X the PMK or PMK-R0 are set by providing NL80211_ATTR_PMK using NL80211_CMD_SET_PMK. for offloaded FT support also NL80211_ATTR_PMKR0_NAME must be provided. like, both. don't skip the second one, that's the whole point bestie 😭

🌈 SEE ALSO

ok this list is long and honestly iconic — grab a snack 🍓 and take it in, because every single one is here:

• the kernel file ./include/uapi/linux/nl80211.h 👀 (the source of truth, go look)
• Station handling(9)
• Frame transmission/registration support(9)
• Virtual interface / concurrency capabilities(9)
• packet coalesce support(9)
• FILS shared key authentication offload(9)
• SAE authentication offload(9)
• VLAN offload support for setting group keys and binding STAs to VLANs(9)
• TID configuration(9)
• FILS shared key crypto offload(9)
• Multi-Link Operation(9)
• OWE DH IE handling offload(9)
• enum nl80211_commands(9)
• enum nl80211_attrs(9)
• enum nl80211_iftype(9)
• enum nl80211_sta_flags(9)
• enum nl80211_sta_p2p_ps_status(9)
• struct nl80211_sta_flag_update(9)
• enum nl80211_he_gi(9)
• enum nl80211_he_ltf(9)
• enum nl80211_he_ru_alloc(9)
• enum nl80211_eht_gi(9)
• enum nl80211_eht_ltf(9)
• enum nl80211_eht_ru_alloc(9)
• enum nl80211_rate_info(9)
• enum nl80211_sta_bss_param(9)
• enum nl80211_sta_info(9)
• enum nl80211_tid_stats(9)
• enum nl80211_txq_stats(9)
• enum nl80211_mpath_flags(9)
• enum nl80211_mpath_info(9)
• enum nl80211_band_iftype_attr(9)
• enum nl80211_band_attr(9)
• enum nl80211_nan_phy_cap_attr(9)
• enum nl80211_wmm_rule(9)
• enum nl80211_frequency_attr(9)
• enum nl80211_bitrate_attr(9)
• enum nl80211_reg_initiator(9)
• enum nl80211_reg_type(9)
• enum nl80211_reg_rule_attr(9)
• enum nl80211_sched_scan_match_attr(9)
• enum nl80211_reg_rule_flags(9)
• enum nl80211_dfs_regions(9)
• enum nl80211_user_reg_hint_type(9)
• enum nl80211_survey_info(9)
• enum nl80211_mntr_flags(9)
• enum nl80211_mesh_power_mode(9)
• enum nl80211_meshconf_params(9)
• enum nl80211_mesh_setup_params(9)
• enum nl80211_txq_attr(9)
• enum nl80211_channel_type(9)
• enum nl80211_key_mode(9)
• enum nl80211_chan_width(9)
• enum nl80211_bss_scan_width(9)
• enum nl80211_bss_use_for(9)
• enum nl80211_bss_cannot_use_reasons(9)
• enum nl80211_bss(9)
• enum nl80211_bss_status(9)
• enum nl80211_auth_type(9)
• enum nl80211_key_type(9)
• enum nl80211_mfp(9)
• enum nl80211_key_default_types(9)
• enum nl80211_key_attributes(9)
• enum nl80211_tx_rate_attributes(9)
• struct nl80211_txrate_vht(9)
• struct nl80211_txrate_he(9)
• struct nl80211_txrate_eht(9)
• enum nl80211_band(9)
• enum nl80211_ps_state(9)
• enum nl80211_attr_cqm(9)
• enum nl80211_cqm_rssi_threshold_event(9)
• enum nl80211_tx_power_setting(9)
• enum nl80211_tid_config(9)
• enum nl80211_packet_pattern_attr(9)
• struct nl80211_pattern_support(9)
• enum nl80211_wowlan_triggers(9)
• TCP connection wakeup(9)
• struct nl80211_wowlan_tcp_data_seq(9)
• struct nl80211_wowlan_tcp_data_token(9)
• struct nl80211_wowlan_tcp_data_token_feature(9)
• enum nl80211_wowlan_tcp_attrs(9)
• struct nl80211_coalesce_rule_support(9)
• enum nl80211_attr_coalesce_rule(9)
• enum nl80211_coalesce_condition(9)
• enum nl80211_iface_limit_attrs(9)
• enum nl80211_if_combination_attrs(9)
• enum nl80211_plink_state(9)
• enum nl80211_plink_action(9)
• enum nl80211_rekey_data(9)
• enum nl80211_hidden_ssid(9)
• enum nl80211_sta_wme_attr(9)
• enum nl80211_pmksa_candidate_attr(9)
• enum nl80211_tdls_operation(9)
• enum nl80211_ap_sme_features(9)
• enum nl80211_feature_flags(9)
• enum nl80211_ext_feature_index(9)
• enum nl80211_probe_resp_offload_support_attr(9)
• enum nl80211_connect_failed_reason(9)
• enum nl80211_timeout_reason(9)
• enum nl80211_scan_flags(9)
• enum nl80211_acl_policy(9)
• enum nl80211_smps_mode(9)
• enum nl80211_radar_event(9)
• enum nl80211_dfs_state(9)
• enum nl80211_protocol_features(9)
• enum nl80211_crit_proto_id(9)
• enum nl80211_rxmgmt_flags(9)
• struct nl80211_vendor_cmd_info(9)
• enum nl80211_tdls_peer_capability(9)
• enum nl80211_sched_scan_plan(9)
• struct nl80211_bss_select_rssi_adjust(9)
• enum nl80211_bss_select_attr(9)
• enum nl80211_nan_function_type(9)
• enum nl80211_nan_publish_type(9)
• enum nl80211_nan_func_term_reason(9)
• enum nl80211_nan_func_attributes(9)
• enum nl80211_nan_srf_attributes(9)
• enum nl80211_nan_match_attributes(9)
• enum nl80211_nan_band_conf_attributes(9)
• enum nl80211_nan_conf_attributes(9)
• enum nl80211_external_auth_action(9)
• enum nl80211_ftm_responder_attributes(9)
• enum nl80211_preamble(9)
• enum nl80211_peer_measurement_type(9)
• enum nl80211_peer_measurement_status(9)
• enum nl80211_peer_measurement_req(9)
• enum nl80211_peer_measurement_resp(9)
• enum nl80211_peer_measurement_ftm_req_type(9)
• enum nl80211_peer_measurement_peer_attrs(9)
• enum nl80211_peer_measurement_attrs(9)
• enum nl80211_peer_measurement_ftm_capa(9)
• enum nl80211_peer_measurement_ftm_type_capa(9)
• enum nl80211_peer_measurement_ftm_req(9)
• enum nl80211_peer_measurement_ftm_failure_reasons(9)
• enum nl80211_peer_measurement_ftm_resp(9)
• enum nl80211_obss_pd_attributes(9)
• enum nl80211_bss_color_attributes(9)
• enum nl80211_iftype_akm_attributes(9)
• enum nl80211_fils_discovery_attributes(9)
• enum nl80211_unsol_bcast_probe_resp_attributes(9)
• enum nl80211_sae_pwe_mechanism(9)
• enum nl80211_sar_type(9)
• enum nl80211_sar_attrs(9)
• enum nl80211_sar_specs_attrs(9)
• enum nl80211_mbssid_config_attributes(9)
• enum nl80211_ap_settings_flags(9)
• enum nl80211_wiphy_radio_attrs(9)
• enum nl80211_wiphy_radio_freq_range(9)
• enum nl80211_s1g_short_beacon_attrs(9)
• enum nl80211_nan_capabilities(9)
• enum nl80211_nan_peer_map_attrs(9)

💜 and that's the whole page bestie, you ate that. the source lives at ./include/uapi/linux, the date on this one is October 2026, and the footer still spells it WPA/WPA2 EAP...hake offload(9) because the terminal truncated it and honestly? we respect the truncation. slay ✨🎀