nrfconnect · jtguggedal · Oct 21, 2024 · Oct 21, 2024 · Oct 8, 2024 · Oct 9, 2024
@@ -514,6 +514,7 @@
 /samples/wifi/softap/                     @D-Triveni @krish2718
 /samples/wifi/monitor/                    @D-Triveni
 /samples/wifi/promiscuous/                @D-Triveni
+/samples/wifi/offloaded_raw_tx/           @kapbh @sachinthegreen
 /samples/zigbee/                          @nrfconnect/ncs-zigbee
 
 /samples/app_event_manager/*.rst          @nrfconnect/ncs-si-muffin-doc @nrfconnect/ncs-si-bluebagel-doc

@@ -16,6 +16,8 @@ function(setup_nrf700x_xip_data)
     set(NRF70_PATCH ${NRF70_FW_BINS}/radio_test/nrf70.bin)
   elseif(SB_CONFIG_WIFI_NRF70_SCAN_ONLY)
     set(NRF70_PATCH ${NRF70_FW_BINS}/scan_only/nrf70.bin)
+  elseif(SB_CONFIG_WIFI_NRF70_OFFLOADED_RAW_TX)
+    set(NRF70_PATCH ${NRF70_FW_BINS}/offloaded_raw_tx/nrf70.bin)
   elseif(SB_CONFIG_WIFI_NRF70_SYSTEM_WITH_RAW_MODES)
     set(NRF70_PATCH ${NRF70_FW_BINS}/system_with_raw/nrf70.bin)
   else()

@@ -49,6 +49,7 @@
 
 * :ref:`ug_nrf70_developing_raw_ieee_80211_packet_transmission`: Allows the injection of raw IEEE 802.11 frames in Station and Monitor modes.
 * :ref:`Promiscuous reception <ug_nrf70_developing_promiscuous_packet_reception>`: Allows the reception of IEEE 802.11 packets from a connected BSSID when operating in Station mode.
+* :ref:`Wi-Fi advanced security modes <ug_nrf70_wifi_advanced_security_modes>`: Allows the use of of certificate-based Wi-Fi security and the Platform Security Architecture (PSA) security framework.
 
 Peer-to-peer support in the form of Wi-Fi Direct® will be available in the future.
 

@@ -910,6 +910,8 @@
 
 .. _`Testing the nRF Connect platform with Apple, Google and Samsung ecosystems`: https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/matter-testing-nrf-connect-sdk-platform-with-apple-google-and-samsung-ecosystems-218911247#mcetoc_1gkq24ojdf
 
+.. _`Online Power Profiler for Wi-Fi`: https://devzone.nordicsemi.com/power/w/opp/14/online-power-profiler-for-wi-fi
+
 .. ### Source: App stores (play.google.com & apps.apple.com)
 
 .. _`Fast Pair Validator app`: https://play.google.com/store/apps/details?id=com.google.location.nearby.apps.fastpair.validator

@@ -13,3 +13,5 @@ The following subpages cover topics related to the transmission and reception of
    raw_tx_operation
    sniffer_rx_operation
    promiscuous_operation
+   offloaded_raw_tx
+   wifi_advanced_security_modes.rst
@@ -0,0 +1,62 @@
+.. _ug_nrf70_developing_offloaded_raw_tx:
+
+Offloaded raw transmit operation
+################################
+
+.. contents::
+   :local:
+   :depth: 2
+
+The nRF70 Series ICs can be used as offloaded raw transmit devices, where the nRF70 Series device can transmit frames at regular intervals utilizing very low power.
+The contents of the frame as well as parameters such as frequency and channel of transmission are programmable.
+
+The major functionality of transmitting the frames is offloaded to the nRF70 device, thereby placing minimal requirements on the host (mainly programming capability).
+This results in minimal host memory requirements (RAM and flash memory).
+
+This can be used for applications such as indoor navigation and tracking, where it is essential for anchor nodes to perform low-power beaconing.
+Anchor devices can transmit beacon-compliant packets containing tracking or location information inside the BSSID or SSID fields.
+Devices scanning for these beacon-compliant packets can use this information.
+
+Offloaded raw TX mode in Wi-Fi driver
+*************************************
+
+The offloaded raw transmit operation is supported as a separate stand-alone compile-time mode of operation in the nRF Wi-Fi driver and is exclusive to the following existing modes of operation:
+
+* Wi-Fi mode
+* Radio Test mode
+
+In addition to providing start or stop control over the offloaded raw transmit operation, the driver supports the update of the following configuration parameters:
+
+* Frame contents
+* Channel of operation
+* Data rate
+* Rate flags
+* Periodicity of transmission
+* Transmit power
+
+.. _ug_nrf70_developing_enabling_offloaded_raw_tx:
+
+Offloaded raw transmit API
+**************************
+
+The offloaded raw transmit functionality of nRF70 Series ICs can be utilized by using the APIs provided by the driver.
+The API reference can be found at:
+
+| Header file: :file:`zephyr/drivers/wifi/nrfwifi/off_raw_tx/off_raw_tx_api.h`
+
+
+See the :ref:`Offloaded raw transmit sample <wifi_offloaded_raw_tx_packet_sample>` to know more about the offloaded raw transmit API.
+
+.. _ug_nrf70_developing_offloaded_raw_tx_power_consumption:
+
+Power consumption
+*****************
+
+The power consumed by the nRF70 Series device during the offloaded raw TX operation depends on the following parameters:
+
+* Operating data rate (for example, 6 Mbps, MCS0) : Power consumption decreases as the data rate increases.
+* Payload length : Power consumption increases with the payload length.
+* Periodicity of transmission : Power consumption increases as the period between successive transmissions decreases.
+* Transmit power : Power consumption increases as the transmit power increases.
+
+For optimizing the power consumption of your application, you can use the `Online Power Profiler for Wi-Fi`_ tool.
@@ -0,0 +1,52 @@
+.. _ug_nrf70_wifi_advanced_security_modes:
+
+Wi-Fi Enterprise test: X.509 Certificate header generation
+**********************************************************
+
+Wi-Fi enterprise security requires use of X.509 certificates, test certificates
+in PEM format are committed to the repo at :zephyr_file:`samples/net/wifi/test_certs/` and the during the
+build process the certificates are converted to a C header file that is included by the Wi-Fi shell
+module or the :ref:`lib_wifi_credentials` library.
+
+.. code-block:: bash
+
+    $ cp client.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/
+    $ cp client-key.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/
+    $ cp ca.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/
+    $ cp client.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/client2.pem
+    $ cp client-key.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/client-key2.pem
+    $ cp ca.pem ${ZEPHYR_BASE}/samples/net/wifi/test_certs/ca2.pem
+    $ west build -p -b <board> samples/net/wifi -- -DEXTRA_CONF_FILE=overlay-enterprise.conf
+
+.. note::
+     The EAP phase2 certificates (suffixed with 2) are unused in ``EAP-TLS`` but are mandatory for building the sample application.
+     The phase1 certificates are copied as phase2 certificates to avoid build errors.
+
+To initiate Wi-Fi connection, the following command can be used:
+
+.. code-block:: console
+
+    uart:~$ wifi connect -s <SSID> -k 7 -a anon -K <key passphrase>
+
+Server certificate is also provided in the same directory for testing purposes.
+Any AAA server can be used for testing purposes, for example, ``FreeRADIUS`` or ``hostapd``.
+
+.. note::
+
+    The certificates are for testing purposes only and should not be used in production.
+
+
+Wi-Fi PSA support
+#################
+
+The nRF70 Series device Wi-Fi solution supports `Platform Security Architecture (PSA)`_ (PSA) APIs for cryptographic operations.
+
+The nRF70 Series device Wi-Fi solution currently supports only WPA2-personal security profile in PSA mode.
+WPA3-personal and Enterprise security profiles will be supported in future releases using PSA APIs.
+
+Enabling Wi-Fi PSA support
+**************************
+
+To enable the Wi-Fi PSA support in your applications, use the :kconfig:option:`CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA` Kconfig option.
+
+Wi-Fi connection process is similar to the non-PSA mode, the only difference is that the cryptographic operations are performed using PSA APIs.
@@ -123,6 +123,15 @@ Libraries
 
 This section describes the changes related to libraries.
 
+Wi-Fi®
+------
+
+.. toggle::
+
+   * For :ref:`lib_wifi_credentials` library:
+
+     * Syntax for ``add`` command has been modified to support ``getopt`` model.
+
 LTE link control library
 ------------------------
 

@@ -256,6 +256,9 @@ Wi-Fi
 -----
 
 * The WPA supplicant is now switched to Zephyr upstream's fork instead of |NCS|.
+* Added the :ref:`ug_nrf70_developing_offloaded_raw_tx` page.
+* Added support for EAP-TLS authentication in the Wi-Fi stack.
+* Added :ref:`Platform Security Architecture (PSA) APIs support <ug_nrf70_developing_wifi_psa_support>`  for WPA2 security profiles.
 
 Applications
 ============
@@ -603,6 +606,10 @@ Networking samples
 
   * Fixed not to fail with a fatal error if IPv4 or IPv6 server setup fails.
 
+* :ref:`aws_iot` sample:
+
+  * Added support for the :ref:`zephyr:nrf54l15dk_nrf54l15` board in combination with an nRF7002-based shield.
+
 NFC samples
 -----------
 
@@ -691,6 +698,10 @@ Zigbee samples
 Wi-Fi samples
 -------------
 
+* Added:
+
+  * The :ref:`wifi_offloaded_raw_tx_packet_sample` sample that demonstrates transmission of raw packets.
+
 * :ref:`wifi_radio_test` sample:
 
   * Added capture timeout as a parameter for packet capture.
@@ -704,6 +715,7 @@ Wi-Fi samples
 
   * Added support for running the full stack on the Thingy:91 X.
      This is a special configuration that uses the nRF5340 as the host chip instead of the nRF9151.
+  * Added overlay to support enterprise mode.
 
 Other samples
 -------------

@@ -29,10 +29,16 @@ extern "C" {
 #define WIFI_CREDENTIALS_FLAG_2_4GHz		BIT(2)
 /* this entry can use the 5 GHz band */
 #define WIFI_CREDENTIALS_FLAG_5GHz		BIT(3)
+/* this entry can use the 5 GHz band */
+#define WIFI_CREDENTIALS_FLAG_6GHz		BIT(4)
 /* this entry requires management frame protection */
-#define WIFI_CREDENTIALS_FLAG_MFP_REQUIRED	BIT(4)
+#define WIFI_CREDENTIALS_FLAG_MFP_REQUIRED	BIT(5)
 /* this entry disables management frame protection */
-#define WIFI_CREDENTIALS_FLAG_MFP_DISABLED	BIT(5)
+#define WIFI_CREDENTIALS_FLAG_MFP_DISABLED	BIT(6)
+/* this entry has anonymous identity configured */
+#define WIFI_CREDENTIALS_FLAG_ANONYMOUS_IDENTITY  BIT(7)
+/* this entry has key password configured */
+#define WIFI_CREDENTIALS_FLAG_KEY_PASSWORD  BIT(8)
 
 #define WIFI_CREDENTIALS_MAX_PASSWORD_LEN\
 	MAX(WIFI_PSK_MAX_LEN, CONFIG_WIFI_CREDENTIALS_SAE_PASSWORD_LENGTH)
@@ -53,6 +59,10 @@ struct wifi_credentials_header {
 	uint32_t flags;
 	uint8_t channel;
 	uint32_t timeout;
+	char anon_id[WIFI_ENT_IDENTITY_MAX_LEN];
+	uint8_t aid_length; /* Max 64 */
+	char key_passwd[WIFI_ENT_PSWD_MAX_LEN];
+	uint8_t key_passwd_length; /* Max 128 */
 };
 
 /**