3.1.0 wi-fi upmerge #3045

rado17 · 2025-07-14T07:27:30Z

Wi-Fi only Upmerge for 3.1.0

manifest-pr-skip

krish2718 · 2025-07-14T08:05:41Z

Why do we still need this noup, it was done last time as were in the release rush. If the certs from upstream don't work out-of-box then we can submit a variant that works out-of-box for nRF platforms.

rado17 · 2025-07-14T08:07:34Z

Why do we still need this noup, it was done last time as were in the release rush. If the certs from upstream don't work out-of-box then we can submit a variant that works out-of-box for nRF platforms.

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.
Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

krish2718 · 2025-07-14T08:12:06Z

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.

I would put a algo specific directory e.g., rsa2k-no-ebc3, this way it can be reused in case other platforms have similar constraints.

Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

We don't want to rely on noup unless its absolutely must, why can't we add <increased_heap> if SOC_FAMILY_NORDIC_NRF to upstream?

rado17 · 2025-07-14T08:19:21Z

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.

I would put a algo specific directory e.g., rsa2k-no-ebc3, this way it can be reused in case other platforms have similar constraints.

Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

We don't want to rely on noup unless its absolutely must, why can't we add <increased_heap> if SOC_FAMILY_NORDIC_NRF to upstream?

Let me check this.

github-actions · 2025-07-14T20:00:05Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
hostap	zephyrproject-rtos/hostap@`8412f4b`	zephyrproject-rtos/hostap@`e942f86` (`main`)	zephyrproject-rtos/[email protected]
nrf_wifi	zephyrproject-rtos/nrf_wifi@`936b502`	zephyrproject-rtos/nrf_wifi@`5f59c23` (`main`)	zephyrproject-rtos/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

In case FMAC API fails, increment the TX drop counter, helpful in debug. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit e728f80)

…ull check Deleted a redundant check for 'rpu_ctx_zep' pointer after it was already dereferenced. Clarifies code logic in nrf_wifi_get_power_save_config function. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit bac20e419eabf36625c073a366008f1384fcc272)

Return proper error codes for xmit instead of generic -1. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit 001f34d84c647d15d76480cb64fc6efce6ea736f)

Rpu recovey debug stats are stored in hal_dev_ctx which is not persistent in case of interface is brought down/up. Need to add in nrf_wifi_ctx_zep and update before interface goes down. Signed-off-by: Kapil Bhatt <[email protected]> (cherry picked from commit dd7413d269d69e2d0c8ee10c3d03929703e7efb1)

Automatically hide the nRF7x interface from the connection manager if the TX path is disabled (scan only mode). This prevents function calls like `conn_mgr_all_if_up(true)` from bringing up the interface which can never result in a connection. Signed-off-by: Jordan Yates <[email protected]> (cherry picked from commit 79edfc012803572b1c75a4667f03bfbb4fa9b6b0)

Monitor mode doesn't require station mode. Disabling station mode require necessary changes to work monitor mode. Upstream PR #: 92226 Signed-off-by: Kapil Bhatt <[email protected]>

…de from monitor" This reverts commit 926fafb. Signed-off-by: Chaitanya Tata <[email protected]>

Fixes memory leak seen during continuous raw TX transmission. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit d5c7cb171b21049758f2907ec4b5a85ac73b43eb)

…port" This reverts commit e2f9c7b. Signed-off-by: Chaitanya Tata <[email protected]>

Add a snippet for Wi-Fi credentials support. Update the heap sizes as required for enterprise mode. Signed-off-by: Ravi Dondaputi <[email protected]> (cherry picked from commit 4c14c618f69e8ae0d5ee95a6abbc8a1d5f89afac)

…lity issue. 1. When external station connects to soft ap, zephyr hostap will fill sta_info before sending mgmt event to l2 wifi layer. sta_info.twt_capable should be filled with external station capability rather than soft ap self. 2. Rename hapd_is_twt_capable to hapd_get_sta_he_twt_capable. Try to get twt_capa form capability of external station rather than soft ap. Signed-off-by: Qiankun Li <[email protected]> (cherry picked from commit 7ffc538)

Earlier we had socketpair to pass wifi event information from wpa_supplicant side to zephyr adaption layer. This is now replaced by k_fifo to save some RAM. Signed-off-by: Jukka Rissanen <[email protected]> (cherry picked from commit 96818f45a91472cb0eabd5cfe42b5b256860f6a5)

In case anyone enabled EAP_*_ALL explicitly without enabling the Enterprise then it leads to a build error. Fix by adding the dependency. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit 014dee7)

If the disconnect event is raised before the network has been connected, report the connection result as `WIFI_STATUS_CONN_FAIL`, instead of as `WIFI_REASON_DISCONN_SUCCESS`, which is interpretted as `WIFI_STATUS_CONN_SUCCESS`. Signed-off-by: Jordan Yates <[email protected]> (cherry picked from commit 9245f58b4ccf32b261341fdfc09e993b7eba74f0)

Set enterprise crypto insecure because certifcate validation is disabled. Signed-off-by: Flavio Ceolin <[email protected]> (cherry picked from commit 979fcc0)

Ensure 'params' is not NULL before accessing its fields. Prevents possible null pointer dereference when calling strlen(params->ssid). Delay access to ssid->ssid and ssid->ssid_len until after null check. Prevents potential crash if wpa_s->current_ssid is NULL. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit b6a5202)

Add a new promptless Kconfig symbol (INSECURE). This symbols must be selected by any setting which is used to enable an insecure feature. Signed-off-by: Flavio Ceolin <[email protected]> (cherry picked from commit 674fd094aa67b31d1d54b1f318adce8ed2faddd6)

Move usage of ap_ctx pointers after null checks to prevent potential crashes. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit cd85510)

Move usage of ap_ctx pointers after null checks to prevent potential crashes. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit 8a565c0a2b8c12b1ea0298367a0ff525c1ae20b8)

This change is needed to handle to stack overflow issues when using SPIM. Signed-off-by: Triveni Danda <[email protected]> (cherry picked from commit 0dcb5a4923f1bf07229e1695d726edb990064572)

… SAE mode When the external AP is in WPA3 SAE mode, the group cipher uses TKIP and the pairwise cipher uses TKIP and CCMP. Should not connect to the AP. For WPA2 & WPA3 SAE & WPA2/WPA3 mixed mode, set group cipher to CCMP, pairwise cipher to CCMP. Signed-off-by: Gang Li <[email protected]> (cherry picked from commit c8fa5e5899575fe5c0a0a6c3013fdc4527d2cdb4)

sync for coverity fix in hostap Signed-off-by: Qingling Wu <[email protected]> (cherry picked from commit f089959)

Make sure to use k_fifo for IPC in hostap to save memory. Signed-off-by: Jukka Rissanen <[email protected]> (cherry picked from commit 03ad3a32a27da098fc697376e2932c36b85c3509)

Fix a warning seen during interface down. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit a869c3e3a31afa893a8c88f8761f8f206769ee27)

Commit 5e25283821a("drivers: wifi: Create dedicated mem pool for Wi-Fi driver") introduced OSAL dependecy in the Zephyr QSPI driver for HL read, but in bustest we don't enable nrf_wifi OS module, so, it crashes here. And we should not be using OSAL APIs in Zephyr code anyway. And in this case we don't even need to use the heap, so, move the rx buffer to stack. Upstream PR #: 93303 Signed-off-by: Chaitanya Tata <[email protected]>

…covery When running Zperf traffic + scan in the background eventual we hit a deadlock: * sysworkq: recovery->stop_zep->vif_lock->hal_disable->wait lock_rx * nrf70_bh_wq: event_tasklet->lock_rx->disp_scan_done-> disp_scan_res_get_zep-> waiting on vif_lock The traffic triggers recovery (another bug) and conflicts with display scan. Fix by moving scan results processing to system workqueue instead of doing it in the FMAC event callback context, this is how supplicant scan also works. Upstream PR #: 93377 Signed-off-by: Chaitanya Tata <[email protected]>

hostap needs more eventfd to function so set a proper default value. Signed-off-by: Jukka Rissanen <[email protected]> (cherry picked from commit 410afba)

NordicBuilder mentioned this pull request Jul 14, 2025

manifest: sdk-zephyr: Update certificates for RSA-3072 support with NRF security nrfconnect/sdk-nrf#23282

Closed

rado17 requested review from krish2718, bama-nordic, sachinthegreen and kapbh July 14, 2025 07:51

rado17 force-pushed the certs_update branch from d3b1c3c to 7468d85 Compare July 14, 2025 17:22

github-actions bot added manifest manifest-nrf_wifi manifest-hostap labels Jul 14, 2025

krish2718 force-pushed the certs_update branch 2 times, most recently from 6697ba5 to 380a770 Compare July 14, 2025 20:11

kapbh force-pushed the certs_update branch 2 times, most recently from 6a2a279 to 359ba2e Compare July 15, 2025 10:21

rado17 force-pushed the certs_update branch 4 times, most recently from 882d7e2 to 245e1c7 Compare July 17, 2025 07:07

rado17 changed the title ~~Update certificates for RSA-3072 support with NRF security~~ Wi-Fi upmerge: Update certificates for RSA-3072 support with NRF security Jul 17, 2025

krish2718 changed the title ~~Wi-Fi upmerge: Update certificates for RSA-3072 support with NRF security~~ 3.1.0 wi-fi upmerge Jul 20, 2025

krish2718 force-pushed the certs_update branch from dd8fac4 to 24767eb Compare July 20, 2025 09:00

NordicBuilder mentioned this pull request Jul 20, 2025

wifi: Upmerge 3.1.0 nrfconnect/sdk-nrf#23365

Merged

krish2718 requested a review from D-Triveni July 20, 2025 09:06

krish2718 force-pushed the certs_update branch from 24767eb to be2b3ec Compare July 20, 2025 09:08

krish2718 approved these changes Jul 20, 2025

View reviewed changes

krish2718 force-pushed the certs_update branch from 228181f to 8e7d850 Compare July 20, 2025 18:52

krish2718 and others added 27 commits July 21, 2025 13:54

[nrf fromtree] drivers: nrf_wifi: Fix TX drop statistics

a9d46de

In case FMAC API fails, increment the TX drop counter, helpful in debug. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit e728f80)

[nrf fromtree] drivers: nrf_wifi: Fix return codes for xmit

a3571f7

Return proper error codes for xmit instead of generic -1. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit 001f34d84c647d15d76480cb64fc6efce6ea736f)

[nrf fromlist] drivers: nrf_wifi: Remove station mode from monitor mode

b5f4b8e

Monitor mode doesn't require station mode. Disabling station mode require necessary changes to work monitor mode. Upstream PR #: 92226 Signed-off-by: Kapil Bhatt <[email protected]>

Revert "[nrf fromlist] manifest: Update nrf_wifi SHA to remove sta mo…

17af3ed

…de from monitor" This reverts commit 926fafb. Signed-off-by: Chaitanya Tata <[email protected]>

[nrf fromtree] manifest: nrf_wifi: Pull fix for raw TX memory leak

d29f1a7

Fixes memory leak seen during continuous raw TX transmission. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit d5c7cb171b21049758f2907ec4b5a85ac73b43eb)

Revert "[nrf fromlist] net: wifi: shell: Enable Wi-Fi credentials sup…

602a422

…port" This reverts commit e2f9c7b. Signed-off-by: Chaitanya Tata <[email protected]>

[nrf fromtree] net: wifi: shell: Enable Wi-Fi credentials support

9280baf

Add a snippet for Wi-Fi credentials support. Update the heap sizes as required for enterprise mode. Signed-off-by: Ravi Dondaputi <[email protected]> (cherry picked from commit 4c14c618f69e8ae0d5ee95a6abbc8a1d5f89afac)

[nrf fromtree] modules: hostap: Fix EAP dependencies

52181b5

In case anyone enabled EAP_*_ALL explicitly without enabling the Enterprise then it leads to a build error. Fix by adding the dependency. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit 014dee7)

[nrf fromtree] hostap: Set enterprise crypto insecure

842d2d0

Set enterprise crypto insecure because certifcate validation is disabled. Signed-off-by: Flavio Ceolin <[email protected]> (cherry picked from commit 979fcc0)

[nrf fromtree] modules: hostap: hapd_events: Fix possible null deference

d0a69c9

Move usage of ap_ctx pointers after null checks to prevent potential crashes. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit cd85510)

[nrf fromtree] modules: hostap: supp_events: Fix possible null deference

86a4189

Move usage of ap_ctx pointers after null checks to prevent potential crashes. Signed-off-by: Gaetan Perrot <[email protected]> (cherry picked from commit 8a565c0a2b8c12b1ea0298367a0ff525c1ae20b8)

[nrf fromtree] modules: hostap: Set default stack size for softAP mode

45134f8

This change is needed to handle to stack overflow issues when using SPIM. Signed-off-by: Triveni Danda <[email protected]> (cherry picked from commit 0dcb5a4923f1bf07229e1695d726edb990064572)

[nrf fromtree] manifest: hostap: sync for coverity fix

a1b9cfa

sync for coverity fix in hostap Signed-off-by: Qingling Wu <[email protected]> (cherry picked from commit f089959)

[nrf fromtree] manifest: Use k_fifo for IPC in hostap

492bd22

Make sure to use k_fifo for IPC in hostap to save memory. Signed-off-by: Jukka Rissanen <[email protected]> (cherry picked from commit 03ad3a32a27da098fc697376e2932c36b85c3509)

[nrf fromtree] manifest: hostap: Pull fix for warning in interface down

9d74c13

Fix a warning seen during interface down. Signed-off-by: Chaitanya Tata <[email protected]> (cherry picked from commit a869c3e3a31afa893a8c88f8761f8f206769ee27)

[nrf fromtree] lib: zvfs: Add default eventfd count for hostap

8a24787

hostap needs more eventfd to function so set a proper default value. Signed-off-by: Jukka Rissanen <[email protected]> (cherry picked from commit 410afba)

sachinthegreen approved these changes Jul 21, 2025

View reviewed changes

krish2718 force-pushed the certs_update branch from 8e7d850 to 8a24787 Compare July 21, 2025 08:24

rlubos merged commit cebbc7c into nrfconnect:main Jul 21, 2025
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

3.1.0 wi-fi upmerge #3045

3.1.0 wi-fi upmerge #3045

rado17 commented Jul 14, 2025 •

edited by krish2718

Loading

Uh oh!

krish2718 commented Jul 14, 2025

Uh oh!

rado17 commented Jul 14, 2025 •

edited

Loading

Uh oh!

krish2718 commented Jul 14, 2025

Uh oh!

rado17 commented Jul 14, 2025

Uh oh!

github-actions bot commented Jul 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

3.1.0 wi-fi upmerge #3045

3.1.0 wi-fi upmerge #3045

Conversation

rado17 commented Jul 14, 2025 • edited by krish2718 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krish2718 commented Jul 14, 2025

Uh oh!

rado17 commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krish2718 commented Jul 14, 2025

Uh oh!

rado17 commented Jul 14, 2025

Uh oh!

github-actions bot commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rado17 commented Jul 14, 2025 •

edited by krish2718

Loading

rado17 commented Jul 14, 2025 •

edited

Loading

github-actions bot commented Jul 14, 2025 •

edited

Loading