Update to NCS3.0.0 broke wifi WPA2-PSK connect?

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

Elfving — Thu, 12 Jun 2025 12:22:53 GMT

Hi Brian, sorry about the back and forth regarding who's helping you here.

[quote user="BrianW"]

I'd push the point that if there is no way to reduce the wifi stack burden in the main flash significantly (either by optimising wpa_supp or by allowing it to be run as an XIP module) then the nrf5340 will not be seen as a viable target to build a wifi endpoint application.

[/quote]

This is understandable. Could you contact your local RSM regarding a prioritization of this feature? I have already contacted him about this myself, so assume he'll be in contact with you either way.

Regards,

Elfving

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Wed, 04 Jun 2025 12:38:06 GMT

[quote userid="75734" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect/537965"] take time to make/implement on our end,[/quote]

Currently I would not recommend to anyone looking to start a design process to select the nrf5340 if they have a need for even basic wifi STA connectivity due to the very high flash space usage (and I haven't even tried to get the softAP functionality in there, as often used by IOT devices for their setup).

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

Simonr — Wed, 04 Jun 2025 05:51:57 GMT

Hi Brian

I've forwarded these questions to the developer team now, and will get back to you when I hear from them. I wouldn't hold my breath waiting for a sample project though, as this would take time to make/implement on our end, but I'll let you know what we find out.

Best regards,

Simon

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Mon, 02 Jun 2025 12:24:58 GMT

[quote userid="75734" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect/537640"]From the latest replies here it seems like you've moved the WPA enterprise issue to a separate ticket, as the initial problem here was resolved, and now we should focus on memory optimization here, correct?[/quote]

I suspect the problem (failing to connect with WPA2-PSK on NCS3.0.0) is due to the mbedtls memory requirement, but I haven't had the time to try again with different heap configs...

[quote userid="75734" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect/537640"]Regarding running the entire WPA_SUPP module from an external flash, that would for one require that you don't use the QSPI on the nRF5340 for the nRF7002 connection, which is the default operation mode for an nRF5340 + nRF7002 design. But if you use the regular SPI for nRF7002, and then the QSPI and XIP to have application code on (like the wpa supp module) I think that should be feasible, but I can't say I know if it has been done before.[/quote]

Our custom board uses the connections used on the nrf5340 DK, ie the flash is on QSPI and the nrf7002 on the regular SPI. This works ok and optimises the speed towards the flash rather than the network which is better for our application.

Running the wap_supp module as XIP from the external flash would be VERY useful - external flash size can be MUCH bigger than the internal, and as this code is executed only for the connection phase (I think) the speed hit won't be a problem. It would be very useful to have an example build setup for the wifi_sta sample that does this, in the same way as the examples of putting the nrf70 FW in the external flash (including as an XIP function...)

Any chance of Nordic creating such a validated sample to help with this?

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

Simonr — Mon, 02 Jun 2025 11:28:36 GMT

Hi Brian

Sorry about the late reply, but we've had a bank holiday here in Norway, and now Håkon is out of office, so I have taken over this ticket.

From the latest replies here it seems like you've moved the WPA enterprise issue to a separate ticket, as the initial problem here was resolved, and now we should focus on memory optimization here, correct?

Unfortunately the WI-Fi stack is quite considerable with the STA mode added, you can see the Wi-Fi memory requirements here, as well as some suggestions on how to lower the memory footprint. https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/test_and_optimize/optimizing/memory.html#wi-fi

Regarding running the entire WPA_SUPP module from an external flash, that would for one require that you don't use the QSPI on the nRF5340 for the nRF7002 connection, which is the default operation mode for an nRF5340 + nRF7002 design. But if you use the regular SPI for nRF7002, and then the QSPI and XIP to have application code on (like the wpa supp module) I think that should be feasible, but I can't say I know if it has been done before.

Best regards,

Simon

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Mon, 02 Jun 2025 08:18:02 GMT

Elfving, any recommendation on reducing the wpa_supp code size here?

Question : would it possible to run the entire wpa_supp code module directly from an external flash partition, connected on QSPI as this supports XIP? Anyone done this and got a build process that does it?

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Wed, 28 May 2025 13:51:37 GMT

Update : this image did not manage to connect to a wifi AP; turns out it did not include the nrf70 fw (sysbuild issue).

Final image size (for wifi_sta sample with WPA2 enterprise enabled) is:

[7/7] Linking C executable zephyr\zephyr.elf
Memory region Used Size Region Size %age Used
FLASH: 803188 B 1 MB 76.60%
RAM: 414512 B 448 KB 90.36%
IDT_LIST: 0 GB 32 KB 0.00%

It also required as you will note substantial increases in the heap size and stack sizes to be able to run.

WPA2-PSK and WPA3-SAE work with this image; however, I cannot get WPA2 Enterprise with EAP-TLS to connect... I will open a seperate ticket for this issue.

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Wed, 28 May 2025 10:19:49 GMT

[quote userid="134465" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect/537308"]If you build just wifi-sta sample with WPA2 enterprise (and not even an MQTT or HTTP client in that sample) you will find the application size is over 350kB....[/quote]

Just built wifi-sta NCS2.9.0, just added to the prj.conf:

# WPA-PSK, WPA2-Enterprise, WPA3-SAE for at least EAP-TLS

CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE=y

CONFIG_WIFI_NM_WPA_SUPPLICANT_WPA3=y

# Only support EAP TLS method

CONFIG_EAP_ALL=n

CONFIG_EAP_TLS=y

This gives an image size of around 640kB - with basically NO application code in it!

[5/10] Performing build step for 'wifi_sta'
[10/434] Generating include/generated/zephyr/version.h
-- Zephyr version: 3.7.99 (C:/ncs/v2.9.0/zephyr), build: v3.7.99-ncs2
[434/434] Linking C executable zephyr\zephyr.elf
Memory region Used Size Region Size %age Used
FLASH: 645196 B 1 MB 61.53%
RAM: 225780 B 448 KB 49.22%
IDT_LIST: 0 GB 32 KB 0.00%

This is squeezable (put nrf70 fw into external flash, remove all logging from WPA) but still, it casts a doubt on the reality of using the nrf5340 with just 1Mb of internal flash for any real wifi based application....

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Wed, 28 May 2025 08:01:44 GMT

This is my custom application, which is now at 970kB (the absolute limit to fix in the 1Mb flash with mcuboot as well)

If you build just wifi-sta sample with WPA2 enterprise (and not even an MQTT or HTTP client in that sample) you will find the application size is over 350kB....

To return to the problem :

[quote userid="134465" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect"][00:02:21.110,382] <err> wpa_supp: Line 0: invalid key_mgmt 'SAE'[/quote]

what does this signify?

and

[quote userid="134465" url="~/f/nordic-q-a/121691/update-to-ncs3-0-0-broke-wifi-wpa2-psk-connect"][00:02:21.108,764] <err> wpa_supp: Error in pbkdf2_sha1()[/quote]

which seems to be the problem stopping WPA2-PSK working in NCS 3.0.0.

I now think that this is because the libc heap is at 0 in the NCS3.0 build (as the networking code is using its own sysheap my code then uses the system sysheap, so k_malloc() instead of malloc().) And because

CONFIG_MBEDTLS_ENABLE_HEAP=y

by default, but the heap is size 0, the mbedtls fn fails.

So, either I set CONFIG_MBEDTLS_ENABLE_HEAP=n, or I leave the libc heap in place I guess?

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

Elfving — Tue, 27 May 2025 11:47:04 GMT

[quote user="BrianW"]I haven't been able to try the enterprise wifi connection yet. My question here concerns WPA2-PSK on NCS3.0.0 vs NCS2.9.0: this works on 2.9 but fails to connect on 3.0. (application code is identical)[/quote]

Ah okay, seems I just misunderstood you for a second there.

[quote user="BrianW"]This is 35% of the nrf5340's internal flash, just to be able to connect a MQTT client... I can see no way to reduce this overhead currently.[/quote]

Hmm, this a surprise to me at least. I can check. You are seeing this on your custom application, right? Are you seeing this with a sample as well? Could you get me the exact build command that was used?

Regards,

Elfving

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Mon, 26 May 2025 16:24:54 GMT

I see someone else has experience the same issue on NCS 3.0.1, something about the mbedtls heap?

what has changed from 2.9.0?

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

BrianW — Mon, 26 May 2025 16:21:08 GMT

I haven't been able to try the enterprise wifi connection yet. My question here concerns WPA2-PSK on NCS3.0.0 vs NCS2.9.0: this works on 2.9 but fails to connect on 3.0. (application code is identical)

On 2.9 I get the SAE error (can you explain what this refers to?)

On 3.0 I get the SAE error but also the pbkdf2_sha1 error, which seems to be related to it not managing to connect?

So on NCS 3.0 not even WPA2-PSK is working for me...

Note: For the memory usage, in NCS2.9.0 a rom_report tells me that around 350kB is required to use IP networking over wifi with WPA2-PSK (between wifi drivers, TCP/IP, mbedtls, wpa_supp etc) - without adding 'enterprise' and WPA3 support. And this does not include the 79kB of nrf70 fw code that is stored in external flash).

This is 35% of the nrf5340's internal flash, just to be able to connect a MQTT client... I can see no way to reduce this overhead currently.

RE: Update to NCS3.0.0 broke wifi WPA2-PSK connect?

Elfving — Thu, 22 May 2025 14:02:16 GMT

Hi Bryan,

I am sorry to hear that. It's true that these Wi-Fi features are currently very memory hungry. Are you saying that Enterprise did work for you in 2.9?

Regards,

Elfving