Skip to content

wifi: Fix runtime certs #2724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 23 commits into from
Apr 11, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
13ed947
Revert "[nrf fromlist] samples: net: wifi: Add a script to install ce…
krish2718 Apr 7, 2025
c3199dc
Revert "[nrf fromlist] doc: net: wifi: Fix the connect command"
krish2718 Apr 7, 2025
3506b49
Revert "[nrf fromlist] samples: net: wifi: Add two variants of certs"
krish2718 Apr 7, 2025
cb7de83
Revert "[nrf fromlist] net: l2: wifi: Make build time certs as optional"
krish2718 Apr 7, 2025
e27e4f2
Revert "[nrf fromlist] net: lib: tls_credentials_shell: Fix crash dur…
krish2718 Apr 7, 2025
785993d
Revert "[nrf fromlist] snippets: wifi-enterprise: Add support for TLS…
krish2718 Apr 7, 2025
5beede1
Revert "[nrf fromlist] wifi: Move Wi-Fi enterprise configs to a snippet"
krish2718 Apr 7, 2025
608385c
Revert "[nrf fromlist] net: lib: tls_credentials_shell: Add a config …
krish2718 Apr 7, 2025
672ceff
Revert "[nrf fromlist] net: l2: wifi: Add support for run-time certif…
krish2718 Apr 7, 2025
1ab9d2e
[nrf fromlist] net: l2: wifi: Add support for run-time certificates
krish2718 Mar 26, 2025
8507921
[nrf fromlist] net: lib: tls_credentials_shell: Add a config for heap
krish2718 Mar 25, 2025
9a52623
[nrf fromlist] wifi: Move Wi-Fi enterprise configs to a snippet
krish2718 Mar 25, 2025
d3e83bf
[nrf fromlist] snippets: wifi-enterprise: Add support for TLS credent…
krish2718 Mar 25, 2025
532b7aa
[nrf fromlist] net: lib: tls_credentials_shell: Fix crash during delete
krish2718 Mar 26, 2025
1fbbbc0
[nrf fromlist] net: l2: wifi: Make build time certs as optional
krish2718 Mar 27, 2025
ee64c76
[nrf fromlist] samples: net: wifi: Add two variants of certs
krish2718 Mar 27, 2025
ca237ac
[nrf fromlist] doc: net: wifi: Fix the connect command
krish2718 Mar 27, 2025
0481a66
[nrf fromlist] samples: net: wifi: Add a script to install certs
krish2718 Mar 25, 2025
a4e01da
[nrf fromlist] tests: net: wifi: Add a test for Enterprise with run-t…
krish2718 Apr 7, 2025
d1e578b
[nrf fromtree] doc: net: Add link address change info to migration guide
jukkar Mar 13, 2025
d55201d
[nrf fromtree] dts: bindings: spi: use hyphen instead of underscore
jilaypandya Jan 11, 2025
6b778f3
[nrf fromtree] kernel: rename 'dumb' scheduler and simply call it 'si…
nashif Mar 12, 2025
cca7995
[nrf fromtree] net: lib: tls_credentials: Rename TLS_CREDENTIAL_SERVE…
rlubos Mar 19, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions boards/microchip/mec15xxevb_assy6853/mec15xxevb_assy6853.dts
Original file line number Diff line number Diff line change
Expand Up @@ -192,8 +192,8 @@

&spi0 {
status = "okay";
port_sel = <0>;
chip_select = <0>;
port-sel = <0>;
chip-select = <0>;
lines = <1>;
pinctrl-0 = < &shd_cs0_n_gpio055
&shd_clk_gpio056
Expand Down
4 changes: 2 additions & 2 deletions boards/qemu/x86/qemu_x86_atom_nommu_defconfig
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,6 @@ CONFIG_SYS_CLOCK_HW_CYCLES_PER_SEC=25000000
CONFIG_TEST_RANDOM_GENERATOR=y
CONFIG_X86_MMU=n
CONFIG_DEBUG_INFO=y
CONFIG_SCHED_DUMB=y
CONFIG_WAITQ_DUMB=y
CONFIG_SCHED_SIMPLE=y
CONFIG_WAITQ_SIMPLE=y
CONFIG_X86_VERY_EARLY_CONSOLE=n
2 changes: 1 addition & 1 deletion doc/connectivity/networking/api/sockets.rst
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ socket options.
The following TLS credential types can be registered in the system:

- ``TLS_CREDENTIAL_CA_CERTIFICATE``
- ``TLS_CREDENTIAL_SERVER_CERTIFICATE``
- ``TLS_CREDENTIAL_PUBLIC_CERTIFICATE``
- ``TLS_CREDENTIAL_PRIVATE_KEY``
- ``TLS_CREDENTIAL_PSK``
- ``TLS_CREDENTIAL_PSK_ID``
Expand Down
20 changes: 10 additions & 10 deletions doc/connectivity/networking/api/wifi.rst
Original file line number Diff line number Diff line change
Expand Up @@ -46,20 +46,20 @@ If you want to use your own certificates, you can replace the existing certifica

.. code-block:: bash

$ export CERTS_DIR=samples/net/wifi/test_certs/rsa3k
$ cp client.pem $CERTS_DIR
$ cp client-key.pem $CERTS_DIR
$ cp ca.pem $CERTS_DIR
$ cp client2.pem $CERTS_DIR
$ cp client-key2.pem $CERTS_DIR
$ cp ca2.pem $CERTS_DIR
$ export WIFI_TEST_CERTS_DIR=samples/net/wifi/test_certs/rsa3k
$ cp client.pem $WIFI_TEST_CERTS_DIR
$ cp client-key.pem $WIFI_TEST_CERTS_DIR
$ cp ca.pem $WIFI_TEST_CERTS_DIR
$ cp client2.pem $WIFI_TEST_CERTS_DIR
$ cp client-key2.pem $WIFI_TEST_CERTS_DIR
$ cp ca2.pem $WIFI_TEST_CERTS_DIR
$ west build -p -b <board> samples/net/wifi -S wifi-enterprise

or alternatively copy ``rsa2k`` certificates by changing the ``CERTS_DIR`` environment variable.
or alternatively copy ``rsa2k`` certificates by changing the ``WIFI_TEST_CERTS_DIR`` environment variable.

.. code-block:: bash

$ export CERTS_DIR=samples/net/wifi/test_certs/rsa2k
$ export WIFI_TEST_CERTS_DIR=samples/net/wifi/test_certs/rsa2k

or you can set the :envvar:`WIFI_TEST_CERTS_DIR` environment variable to point to the directory containing your certificates.

Expand All @@ -77,7 +77,7 @@ To facilitate installation of the certificates, a helper script is provided in t

.. code-block:: bash

$ samples/net/wifi/test_certs/install_certs.sh samples/net/wifi/test_certs/rsa2k
$ samples/net/wifi/test_certs/install_certs.py -p samples/net/wifi/test_certs/rsa2k

The script will install the certificates in the ``rsa2k`` directory to the TLS credentials store in the device over UART and using TLS credentials shell commands.

Expand Down
8 changes: 4 additions & 4 deletions doc/kernel/services/scheduling/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ The kernel can be built with one of several choices for the ready queue
implementation, offering different choices between code size, constant factor
runtime overhead and performance scaling when many threads are added.

* Simple linked-list ready queue (:kconfig:option:`CONFIG_SCHED_DUMB`)
* Simple linked-list ready queue (:kconfig:option:`CONFIG_SCHED_SIMPLE`)

The scheduler ready queue will be implemented as a simple unordered list, with
very fast constant time performance for single threads and very low code size.
Expand Down Expand Up @@ -95,7 +95,7 @@ runtime overhead and performance scaling when many threads are added.
list of threads.

Typical applications with small numbers of runnable threads probably want the
DUMB scheduler.
simple scheduler.


The wait_q abstraction used in IPC primitives to pend threads for later wakeup
Expand All @@ -106,13 +106,13 @@ the same options.

When selected, the wait_q will be implemented with a balanced tree. Choose
this if you expect to have many threads waiting on individual primitives.
There is a ~2kb code size increase over :kconfig:option:`CONFIG_WAITQ_DUMB` (which may
There is a ~2kb code size increase over :kconfig:option:`CONFIG_WAITQ_SIMPLE` (which may
be shared with :kconfig:option:`CONFIG_SCHED_SCALABLE`) if the red/black tree is not
used elsewhere in the application, and pend/unpend operations on "small"
queues will be somewhat slower (though this is not generally a performance
path).

* Simple linked-list wait_q (:kconfig:option:`CONFIG_WAITQ_DUMB`)
* Simple linked-list wait_q (:kconfig:option:`CONFIG_WAITQ_SIMPLE`)

When selected, the wait_q will be implemented with a doubly-linked list.
Choose this if you expect to have only a few threads blocked on any single
Expand Down
2 changes: 1 addition & 1 deletion doc/kernel/services/smp/smp.rst
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ traversed in full. The kernel does not keep a per-CPU run queue.
That means that the performance benefits from the
:kconfig:option:`CONFIG_SCHED_SCALABLE` and :kconfig:option:`CONFIG_SCHED_MULTIQ`
scheduler backends cannot be realized. CPU mask processing is
available only when :kconfig:option:`CONFIG_SCHED_DUMB` is the selected
available only when :kconfig:option:`CONFIG_SCHED_SIMPLE` is the selected
backend. This requirement is enforced in the configuration layer.

SMP Boot Process
Expand Down
22 changes: 22 additions & 0 deletions doc/releases/migration-guide-4.2.rst
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,28 @@ Bluetooth Host
Networking
**********

* The struct ``net_linkaddr_storage`` has been renamed to struct
:c:struct:`net_linkaddr` and the old struct ``net_linkaddr`` has been removed.
The struct :c:struct:`net_linkaddr` now contains space to store the link
address instead of having pointer that point to the link address. This avoids
possible dangling pointers when cloning struct :c:struct:`net_pkt`. This will
increase the size of struct :c:struct:`net_pkt` by 4 octets for IEEE 802.15.4,
but there is no size increase for other network technologies like Ethernet.
Note that any code that is using struct :c:struct:`net_linkaddr` directly, and
which has checks like ``if (lladdr->addr == NULL)``, will no longer work as expected
(because the addr is not a pointer) and must be changed to ``if (lladdr->len == 0)``
if the code wants to check that the link address is not set.

* TLS credential type ``TLS_CREDENTIAL_SERVER_CERTIFICATE`` was renamed to
more generic :c:enumerator:`TLS_CREDENTIAL_PUBLIC_CERTIFICATE` to better
reflect the purpose of this credential type.

SPI
===

* Renamed the device tree property ``port_sel`` to ``port-sel``.
* Renamed the device tree property ``chip_select`` to ``chip-select``.

Other subsystems
****************

Expand Down
8 changes: 8 additions & 0 deletions doc/releases/release-notes-4.2.rst
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,14 @@ Removed APIs and options
========================

Deprecated APIs and options

* The scheduler Kconfig options CONFIG_SCHED_DUMB and CONFIG_WAITQ_DUMB were
renamed and deprecated. Use :kconfig:option:`CONFIG_SCHED_SIMPLE` and
:kconfig:option:`CONFIG_WAITQ_SIMPLE` instead.

* TLS credential type ``TLS_CREDENTIAL_SERVER_CERTIFICATE`` was renamed and
deprecated, use :c:enumerator:`TLS_CREDENTIAL_PUBLIC_CERTIFICATE` instead.

===========================

New APIs and options
Expand Down
2 changes: 1 addition & 1 deletion drivers/wifi/eswifi/eswifi_socket_offload.c
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ static int map_credentials(int sd, const void *optval, socklen_t optlen)
case TLS_CREDENTIAL_CA_CERTIFICATE:
id = 0;
break;
case TLS_CREDENTIAL_SERVER_CERTIFICATE:
case TLS_CREDENTIAL_PUBLIC_CERTIFICATE:
id = 1;
break;
case TLS_CREDENTIAL_PRIVATE_KEY:
Expand Down
2 changes: 1 addition & 1 deletion drivers/wifi/simplelink/simplelink_sockets.c
Original file line number Diff line number Diff line change
Expand Up @@ -674,7 +674,7 @@ static int map_credentials(int sd, const void *optval, socklen_t optlen)
case TLS_CREDENTIAL_CA_CERTIFICATE:
opt = SL_SO_SECURE_FILES_CA_FILE_NAME;
break;
case TLS_CREDENTIAL_SERVER_CERTIFICATE:
case TLS_CREDENTIAL_PUBLIC_CERTIFICATE:
opt = SL_SO_SECURE_FILES_CERTIFICATE_FILE_NAME;
break;
case TLS_CREDENTIAL_PRIVATE_KEY:
Expand Down
2 changes: 1 addition & 1 deletion dts/arm/microchip/mec1501hsz.dtsi
Original file line number Diff line number Diff line change
Expand Up @@ -471,7 +471,7 @@
rxdma = <11>;
txdma = <10>;
lines = <1>;
chip_select = <0>;
chip-select = <0>;
dcsckon = <6>;
dckcsoff = <4>;
dldh = <6>;
Expand Down
4 changes: 2 additions & 2 deletions dts/bindings/spi/microchip,xec-qmspi.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ properties:
reg:
required: true

port_sel:
port-sel:
type: int
required: true
description: SPI Port 0 or 1.
Expand All @@ -37,7 +37,7 @@ properties:
required: true
description: QMSPI lines 1, 2, or 4

chip_select:
chip-select:
type: int
required: true
description: Use QMSPI CS0# or CS1#
Expand Down
2 changes: 1 addition & 1 deletion include/zephyr/kernel_structs.h
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ struct _ready_q {
struct k_thread *cache;
#endif

#if defined(CONFIG_SCHED_DUMB)
#if defined(CONFIG_SCHED_SIMPLE)
sys_dlist_t runq;
#elif defined(CONFIG_SCHED_SCALABLE)
struct _priq_rb runq;
Expand Down
10 changes: 7 additions & 3 deletions include/zephyr/net/tls_credentials.h
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,15 @@ enum tls_credential_type {
*/
TLS_CREDENTIAL_CA_CERTIFICATE,

/** A public server certificate. Use this to register your own server
/** A public client or server certificate. Use this to register your own
* certificate. Should be registered together with a corresponding
* private key. Used with certificate-based ciphersuites.
*/
TLS_CREDENTIAL_SERVER_CERTIFICATE,
TLS_CREDENTIAL_PUBLIC_CERTIFICATE,

/** @deprecated Use TLS_CREDENTIAL_PUBLIC_CERTIFICATE instead.
*/
TLS_CREDENTIAL_SERVER_CERTIFICATE = TLS_CREDENTIAL_PUBLIC_CERTIFICATE,

/** Private key. Should be registered together with a corresponding
* public certificate. Used with certificate-based ciphersuites.
Expand All @@ -64,7 +68,7 @@ enum tls_credential_type {
* in the system.
*
* @note Some TLS credentials come in pairs:
* - TLS_CREDENTIAL_SERVER_CERTIFICATE with TLS_CREDENTIAL_PRIVATE_KEY,
* - TLS_CREDENTIAL_PUBLIC_CERTIFICATE with TLS_CREDENTIAL_PRIVATE_KEY,
* - TLS_CREDENTIAL_PSK with TLS_CREDENTIAL_PSK_ID.
* Such pairs of credentials must be assigned the same secure tag to be
* correctly handled in the system.
Expand Down
32 changes: 23 additions & 9 deletions kernel/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -120,14 +120,14 @@ config SCHED_DEADLINE

config SCHED_CPU_MASK
bool "CPU mask affinity/pinning API"
depends on SCHED_DUMB
depends on SCHED_SIMPLE
help
When true, the application will have access to the
k_thread_cpu_mask_*() APIs which control per-CPU affinity masks in
SMP mode, allowing applications to pin threads to specific CPUs or
disallow threads from running on given CPUs. Note that as currently
implemented, this involves an inherent O(N) scaling in the number of
idle-but-runnable threads, and thus works only with the DUMB
idle-but-runnable threads, and thus works only with the simple
scheduler (as SCALABLE and MULTIQ would see no benefit).

Note that this setting does not technically depend on SMP and is
Expand Down Expand Up @@ -296,16 +296,23 @@ endchoice # DYNAMIC_THREAD_PREFER

endif # DYNAMIC_THREADS

config SCHED_DUMB
bool "Simple linked-list ready queue"
select DEPRECATED
help
Deprecated in favour of SCHED_SIMPLE.

choice SCHED_ALGORITHM
prompt "Scheduler priority queue algorithm"
default SCHED_DUMB
default SCHED_SIMPLE if SCHED_DUMB
default SCHED_SIMPLE
help
The kernel can be built with several choices for the
ready queue implementation, offering different choices between
code size, constant factor runtime overhead and performance
scaling when many threads are added.

config SCHED_DUMB
config SCHED_SIMPLE
bool "Simple linked-list ready queue"
help
When selected, the scheduler ready queue will be implemented
Expand Down Expand Up @@ -338,20 +345,27 @@ config SCHED_MULTIQ
as the classic/textbook array of lists, one per priority.
This corresponds to the scheduler algorithm used in Zephyr
versions prior to 1.12. It incurs only a tiny code size
overhead vs. the "dumb" scheduler and runs in O(1) time
overhead vs. the "simple" scheduler and runs in O(1) time
in almost all circumstances with very low constant factor.
But it requires a fairly large RAM budget to store those list
heads, and the limited features make it incompatible with
features like deadline scheduling that need to sort threads
more finely, and SMP affinity which need to traverse the list
of threads. Typical applications with small numbers of runnable
threads probably want the DUMB scheduler.
threads probably want the simple scheduler.

endchoice # SCHED_ALGORITHM

config WAITQ_DUMB
bool "Simple linked-list wait_q"
select DEPRECATED
help
Deprecated in favour of WAITQ_SIMPLE.

choice WAITQ_ALGORITHM
prompt "Wait queue priority algorithm"
default WAITQ_DUMB
default WAITQ_SIMPLE if WAITQ_DUMB
default WAITQ_SIMPLE
help
The wait_q abstraction used in IPC primitives to pend
threads for later wakeup shares the same backend data
Expand All @@ -364,13 +378,13 @@ config WAITQ_SCALABLE
When selected, the wait_q will be implemented with a
balanced tree. Choose this if you expect to have many
threads waiting on individual primitives. There is a ~2kb
code size increase over WAITQ_DUMB (which may be shared with
code size increase over WAITQ_SIMPLE (which may be shared with
SCHED_SCALABLE) if the rbtree is not used elsewhere in the
application, and pend/unpend operations on "small" queues
will be somewhat slower (though this is not generally a
performance path).

config WAITQ_DUMB
config WAITQ_SIMPLE
bool "Simple linked-list wait_q"
help
When selected, the wait_q will be implemented with a
Expand Down
Loading
Loading