What is the proper way to force passive Wi-Fi scans with the nRF7000 on nRF Connect SDK v2.3.0?

Nordic Team:

We have a product in production that uses the nRF9160 and nRF7000 and had assumed the nRF7000 did not transmit.  We only recently discovered that it does, in fact, transmit, unless it is explicitly told to do passive scans.

This project is already in production and is using nRF Connect SDK v2.3.0.  We'd like to change as little as possible but switch the scans to passive.  According to this postnRF Connect SDK v2.3.0 did not have that ability.  It is indeed missing the CONFIG_NRF70_PASSIVE_SCAN_ONLY configuration option, and the wifi_scan_type enum.

/** @brief Wi-Fi scanning types. */
enum wifi_scan_type {
	/** Active scanning (default). */
	WIFI_SCAN_TYPE_ACTIVE = 0,
	/** Passive scanning. */
	WIFI_SCAN_TYPE_PASSIVE,
};

To keep changes minimal, and avoid changing the nRF Connect SDK version, we added this to the top of main():

void main(void)
{
	const struct device* wifi_dev = device_get_binding("wlan0");
	struct wifi_nrf_vif_ctx_zep* wifi_data = wifi_dev->data;
	wifi_data->passive_scan = true;
	...

This appears to make scans passive (we measured), and it looks to be how the wifi_util shell command does it.  See nrf_wifi_util_set_passive_scan() here.

But it still seems like a bit of a hack to add a feature that did not exist in this SDK version.  Do you think this is a suitable patch to achieve passive scans, or will this cause problems for us down the road?

Any advice you have would be appreciated.

Parents Reply Children
  • When you refer to firmware, I assume you mean the firmware in the nRF7000, which is patched with the binaries in rpu_fw_patches.h.  This file changes as the nRF Connect SDK changes, which means the firmware running on the nRF7000 varies with nRF Connect SDK version.  If the ability to do passive scans was only added to that firmware in nRF Connect SDK v2.5.0, then there's no way for us to get passive scanning working in a previous version, because the nRF7000 running the earlier firmware simply doesn't support it.

    However, I'm not convinced it's true that the nRF7000 firmware in nRF Connect SDK v2.3.0 can't do passive scans.

    Setting that passive_scan field has an effect: it causes num_scan_ssids in the request sent to the nRF7000 to be set to 0 instead of 1.

    See nrf/drivers/wifi/nrf700x/zephyr/src/zephyr_wifi_mgmt.c:

    if (!vif_ctx_zep->passive_scan) {
    	/* Wildcard SSID to trigger active scan */
    	scan_info.scan_params.num_scan_ssids = 1;
    }


    And, according to a comment on that structure, this triggers a passive scan.

    See nrf/drivers/wifi/nrf700x/osal/fw_if/umac_if/inc/fw/host_rpu_umac_if.h:

    /**
     * struct nrf_wifi_scan_params - Scan request parameters.
     *
     * @valid_fields: Indicate which of the following parameters are valid.
     * @num_scan_ssids: Number of elements in scan_ssids parameter.
     * @scan_ssids: Nested attribute with SSIDs, leave out for passive
     *	 scanning and include a zero-length SSID (wildcard) for wildcard scan.
     * @ie: Information element(s) data.
     * @num_scan_channels: Num of scan channels.
     * @scan_frequencies: Channel information.
     * @mac_addr: MAC address (various uses).
     * @mac_addr_mask: MAC address mask.
     * @scan_flags: Scan request control flags (u32). Bit values
     *	(NRF_WIFI_SCAN_FLAG_LOW_PRIORITY/NRF_WIFI_SCAN_FLAG_RANDOM_ADDR...)
     * @supp_rates: Supported rates.
     * @no_cck: used to send probe requests at non CCK rate in 2GHz band
     * @oper_ch__duration: Operating channel duration when STA is connected to AP
     * @scan_duration: Max scan duration in TU
     * @channels: See struct nrf_wifi_channel
     *
     * This structure specifies the parameters to be used when sending
     * %NRF_WIFI_UMAC_CMD_TRIGGER_SCAN command (Refer &enum nrf_wifi_umac_commands).
     */
    
    struct nrf_wifi_scan_params {
    	unsigned int valid_fields;
    	unsigned char num_scan_ssids;
    	unsigned char num_scan_channels;
    	unsigned int scan_flags;
    	struct nrf_wifi_ssid scan_ssids[NRF_WIFI_SCAN_MAX_NUM_SSIDS];
    	struct nrf_wifi_ie ie;
    	struct nrf_wifi_supp_rates supp_rates;
    	unsigned char mac_addr[NRF_WIFI_ETH_ADDR_LEN];
    	unsigned char mac_addr_mask[NRF_WIFI_ETH_ADDR_LEN];
    	unsigned char no_cck;
    	unsigned short oper_ch_duration;
    	unsigned short scan_duration[MAX_NUM_CHANNELS];
    	unsigned char probe_cnt[MAX_NUM_CHANNELS];
    	struct nrf_wifi_channel channels[0];
    } __NRF_WIFI_PKD;

    Note the description of the scan_ssids parameter:

    Nested attribute with SSIDs, leave out for passive scanning and include a zero-length SSID (wildcard) for wildcard scan.

    So, if these comments are to be believed, then the nRF7000 firmware should see a zero-length scan_ssids and do a passive scan.  But, of course, as the nRF7000 firmware is closed source and proprietary, and we don't even have the binaries (only patches), it's impossible for us to say if it actually does that.

    But, if you could ask someone at Nordic who is familiar with the nRF7000 firmware, perhaps they could answer definitively about this functionality.

  • Hi,

    Apologies for the delay. I am confirming about this with the team and will get back to you soon with an update. 

    Best Regards,

    Samruddhi

Related