nRF Wi-Fi driver

The nRF Wi-Fi driver implements the Wi-Fi® protocol for the nRF70 FullMAC Series of devices. FullMAC devices implement the Wi-Fi protocol in the chipset. The driver configures the chipset and transfers the frames to and from the device to the networking stack.

nRF70 Series device is a companion IC and can be used with any Nordic Semiconductor System-on-Chips (SoCs), such as the nRF53 and nRF91 Series SoCs.

You can enable the driver by using the CONFIG_WIFI_NRF700X Kconfig option.

Architecture 

The following figure illustrates the architecture of the nRF Wi-Fi driver.

nRF Wi-Fi driver block diagram — nRF Wi-Fi driver architecture overview

Design overview 

The nRF Wi-Fi driver follows an OS agnostic design, and the driver implementation is split into OS agnostic and OS (Zephyr) specific code. The OS agnostic code is located in the drivers/wifi/nrf700x/osal/ folder and the OS specific code is located in the drivers/wifi/nrf700x/zephyr/ folder.

The driver supports two modes of operation:

Wi-Fi mode 

In this mode, the driver is designed to be used with the Zephyr networking stack. It is implemented as a network interface driver.

The driver supports the following IEEE 802.11 features:

Wi-Fi 6 (802.11ax) support
WPA3™/WPA2™ personal security
IEEE 802.11 Power Save modes
Scan-only mode
IEEE 802.11 Station mode (STA)
Software-enabled Access Point (SoftAP or SAP) mode

The Wi-Fi Direct® mode feature is in the driver code but is not yet supported.

Except for scan-only mode, the driver uses the host access point daemon (hostapd) to implement AP Media Access Control (MAC) Sublayer Management Entity (AP MLME) and wpa_supplicant to implement 802.1X supplicant.

Radio Test mode 

The nRF Wi-Fi driver supports Radio Test mode, which you can use to test the RF performance of the nRF70 Series device. This is a build time option that you can enable using the CONFIG_NRF700X_RADIO_TEST Kconfig option.

For more details about using this driver in Radio Test mode, see Wi-Fi: Radio test.

Driver to nRF70 Series device communication 

The driver communicates with the nRF70 Series device using the QSPI/SPI interface. The driver uses the QSPI/SPI interface to send commands to the nRF70 Series device, and to transfer data to and from the device. The nRF7002 DK uses QSPI, whereas the nRF7002 EK uses SPI.

To connect the nRF7002 EK to the SoC, the nrf7002ek shield is required.

Configuration 

The nRF Wi-Fi driver has the following configuration options:

Kconfig configuration 

CONFIG_WIFI_NRF700X

(bool) nRF700x driver

Nordic Wi-Fi Driver

CONFIG_WIFI_NRF700X_BUS_LOG_LEVEL

(unknown)

None

CONFIG_NRF700X_SYSTEM_MODE

(bool) Enable nRF700X system mode

Select this option to enable system mode of the nRF700x driver

CONFIG_NRF700X_SCAN_ONLY

(bool) Enable nRF700X scan only mode

Select this option to enable scan only mode of the nRF700x driver

CONFIG_NRF700X_RADIO_TEST

(bool) Radio test mode of the nRF700x driver

None

CONFIG_NRF700X_SYSTEM_WITH_RAW_MODES

(bool) Enable nRF700X system mode with raw modes

Select this option to enable system mode of the nRF700x driver with raw modes

CONFIG_NRF700X_STA_MODE

(bool) Enable nRF700X STA mode

Select this option to enable STA mode of the nRF700x driver

CONFIG_NRF700X_AP_MODE

(bool) Enable Access point mode

None

CONFIG_NRF700X_P2P_MODE

(bool) Enable P2P support in driver

None

CONFIG_NRF700X_RAW_DATA_TX

(bool) Enable RAW TX data path in the driver

None

CONFIG_NRF700X_RAW_DATA_RX

(bool) Enable RAW RX sniffer operation in the driver

None

CONFIG_NRF700X_PROMISC_DATA_RX

(bool) Enable promiscuous RX sniffer operation in the driver

None

CONFIG_NRF700X_DATA_TX

(bool) Enable TX data path in the driver

None

CONFIG_NRF_WIFI_IF_AUTO_START

(bool) Enable Wi-Fi interface auto start on boot

None

CONFIG_NRF_WIFI_PATCHES_BUILTIN

(bool) Store nRF700x FW patches as part of the driver

Select this option to store nRF700x FW patches as part of the driver. This option impacts the code memory footprint of the driver.

CONFIG_NRF_WIFI_PATCHES_EXT_FLASH_DISABLED

(bool) Store nRF700x FW patches in RAM

None

CONFIG_NRF_WIFI_PATCHES_EXT_FLASH_XIP

(bool) Relocate nRF700x FW patches to external memory and execute from there

None

CONFIG_NRF_WIFI_PATCHES_EXT_FLASH_STORE

(bool) Store nRF700x FW patches in external memory but execute from RAM

None

CONFIG_NRF_WIFI_FW_FLASH_CHUNK_SIZE

(int) Chunk size for nRF70 FW patches to be read from external flash

Chunk size for nRF70 FW patches to be read from external flash. This option impacts the loading time of the nRF70 FW patches and RAM usage (heap) of the application.

CONFIG_NRF_WIFI_FW_PATCH_INTEGRITY_CHECK

(bool) Enable integrity check of nRF70 FW patches

Select this option to enable integrity check of nRF70 FW patches using SHA-256 verification algorithm.This option impacts the loading time of the nRF70 FW patches but protects against corrupted FW patches.

CONFIG_NRF_WIFI_FW_PATCH_DFU

(bool) Direct Firmware Update of nRF70 FW patch

Enabling this option adds support for Device Firmware Update (DFU) for the nRF70 Series Firmware Patch.

This feature requires the addition of an MCUBoot partition pair: a primary and a secondary partition. These partitions are used to store the new firmware patch. The specific partition numbers to be used depend on the number of partitions already in use.

The “nrf70_wifi_fw” partition must be added to the newly created MCUBoot primary partition. Once this Kconfig option is enabled, the nRF70.hex file will be signed by MCUBoot. The signed image will then be merged with the application image and flashed onto the target board.

Ensure that the required MCUBoot partitions are properly configured before enabling this option. Refer to the documentation for detailed instructions on partition configuration and the DFU process.

CONFIG_CUSTOM_LINKER_SCRIPT

(string) Custom linker script for nRF700x FW patches

None

CONFIG_NRF_WIFI_LOW_POWER

(bool) Enable low power mode in nRF Wi-Fi chipsets

None

CONFIG_NRF700X_TCP_IP_CHECKSUM_OFFLOAD

(bool) Enable TCP/IP checksum offload

None

CONFIG_NRF700X_REG_DOMAIN

(string) The ISO/IEC alpha2 country code for the country in which this device is currently operating. Default 00 (World regulatory)

None

CONFIG_NET_MGMT_EVENT_STACK_SIZE

(unknown)

None

CONFIG_NRF700X_LOG_VERBOSE

(bool) Maintains the verbosity of information in logs

None

CONFIG_WIFI_NRF700X_LOG_LEVEL

(unknown)

None

CONFIG_NRF700X_ON_QSPI

(bool)

None

CONFIG_NRF700X_ON_SPI

(bool)

None

CONFIG_NRF700X_SR_COEX

(bool) Enable Wi-Fi and SR coexistence support

None

CONFIG_NRF700X_SR_COEX_RF_SWITCH

(bool)

None

CONFIG_NRF700X_WORKQ_STACK_SIZE

(int) Stack size for workqueue

None

CONFIG_NRF700X_WORKQ_MAX_ITEMS

(int) Maximum work items for all workqueues

None

CONFIG_NRF700X_MAX_TX_PENDING_QLEN

(int) Maximum number of pending TX packets

None

CONFIG_NRF700X_UTIL

(bool) Enable Utility shell in nRF700x driver

None

CONFIG_NRF700X_QSPI_LOW_POWER

(bool) Enable low power mode in QSPI

None

CONFIG_NRF700X_PCB_LOSS_2G

(int) PCB loss for 2.4 GHz band

Specifies PCB loss from the antenna connector to the RF pin. The values are in dB scale in steps of 1dB and range of 0-4dB. The loss is considered in the RX path only.

CONFIG_NRF700X_PCB_LOSS_5G_BAND1

(int) PCB loss for 5 GHz band (5150 MHz - 5350 MHz, Channel-32 - Channel-68)

Specifies PCB loss from the antenna connector to the RF pin. The values are in dB scale in steps of 1dB and range of 0-4dB. The loss is considered in the RX path only.

CONFIG_NRF700X_PCB_LOSS_5G_BAND2

(int) PCB loss for 5 GHz band (5470 MHz - 5730 MHz, Channel-96 - Channel-144)

Specifies PCB loss from the antenna connector to the RF pin. The values are in dB scale in steps of 1dB and range of 0-4dB. The loss is considered in the RX path only.

CONFIG_NRF700X_PCB_LOSS_5G_BAND3

(int) PCB loss for 5 GHz band (5730 MHz - 5895 MHz, Channel-149 - Channel-177)

Specifies PCB loss from the antenna connector to the RF pin. The values are in dB scale in steps of 1dB and range of 0-4dB. The loss is considered in the RX path only.

CONFIG_NRF700X_ANT_GAIN_2G

(int) Antenna gain for 2.4 GHz band

None

CONFIG_NRF700X_ANT_GAIN_5G_BAND1

(int) Antenna gain for 5 GHz band (5150 MHz - 5350 MHz)

None

CONFIG_NRF700X_ANT_GAIN_5G_BAND2

(int) Antenna gain for 5 GHz band (5470 MHz - 5730 MHz)

None

CONFIG_NRF700X_ANT_GAIN_5G_BAND3

(int) Antenna gain for 5 GHz band (5730 MHz - 5895 MHz)

None

CONFIG_NRF700X_BAND_2G_LOWER_EDGE_BACKOFF_DSSS

(int) DSSS Transmit power backoff (in dB) for lower edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_2G_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_2G_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_2G_UPPER_EDGE_BACKOFF_DSSS

(int) DSSS Transmit power backoff (in dB) for upper edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_2G_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_2G_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of 2.4 GHz frequency band

None

CONFIG_NRF700X_BAND_UNII_1_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of UNII-1 frequency band

None

CONFIG_NRF700X_BAND_UNII_1_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of UNII-1 frequency band

None

CONFIG_NRF700X_BAND_UNII_1_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of UNII-1 frequency band

None

CONFIG_NRF700X_BAND_UNII_1_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of UNII-1 frequency band

None

CONFIG_NRF700X_BAND_UNII_2A_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of UNII-2A frequency band

None

CONFIG_NRF700X_BAND_UNII_2A_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of UNII-2A frequency band

None

CONFIG_NRF700X_BAND_UNII_2A_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of UNII-2A frequency band

None

CONFIG_NRF700X_BAND_UNII_2A_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of UNII-2A frequency band

None

CONFIG_NRF700X_BAND_UNII_2C_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of UNII-2C frequency band

None

CONFIG_NRF700X_BAND_UNII_2C_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of UNII-2C frequency band

None

CONFIG_NRF700X_BAND_UNII_2C_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of UNII-2C frequency band

None

CONFIG_NRF700X_BAND_UNII_2C_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of UNII-2C frequency band

None

CONFIG_NRF700X_BAND_UNII_3_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of UNII-3 frequency band

None

CONFIG_NRF700X_BAND_UNII_3_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of UNII-3 frequency band

None

CONFIG_NRF700X_BAND_UNII_3_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of UNII-3 frequency band

None

CONFIG_NRF700X_BAND_UNII_3_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of UNII-3 frequency band

None

CONFIG_NRF700X_BAND_UNII_4_LOWER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for lower edge of UNII-4 frequency band

None

CONFIG_NRF700X_BAND_UNII_4_LOWER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for lower edge of UNII-4 frequency band

None

CONFIG_NRF700X_BAND_UNII_4_UPPER_EDGE_BACKOFF_HT

(int) HT/VHT Transmit power backoff (in dB) for upper edge of UNII-4 frequency band

None

CONFIG_NRF700X_BAND_UNII_4_UPPER_EDGE_BACKOFF_HE

(int) HE Transmit power backoff (in dB) for upper edge of UNII-4 frequency band

None

CONFIG_NRF700X_RX_NUM_BUFS

(int) Number of RX buffers

None

CONFIG_NRF700X_MAX_TX_AGGREGATION

(int) Maximum number of TX packets to aggregate

None

CONFIG_NRF700X_MAX_TX_TOKENS

(int) Maximum number of TX tokens

None

CONFIG_NRF700X_TX_MAX_DATA_SIZE

(int) Maximum size of TX data

None

CONFIG_NRF700X_RX_MAX_DATA_SIZE

(int) Maximum size of RX data

None

CONFIG_NRF700X_TX_DONE_WQ_ENABLED

(bool) Enable TX done workqueue (impacts performance negatively)

None

CONFIG_NRF700X_RX_WQ_ENABLED

(bool) Enable RX workqueue

None

CONFIG_NUM_METAIRQ_PRIORITIES

(unknown)

None

CONFIG_NRF700X_IRQ_WQ_PRIORITY

(int) Priority of the workqueue for handling IRQs

None

CONFIG_NRF700X_BH_WQ_PRIORITY

(int) Priority of the workqueue for handling bottom half

None

CONFIG_NRF700X_IRQ_WQ_STACK_SIZE

(int) Stack size of the workqueue for handling IRQs

None

CONFIG_NRF700X_BH_WQ_STACK_SIZE

(int) Stack size of the workqueue for handling bottom half

None

CONFIG_NRF700X_TX_DONE_WQ_PRIORITY

(int) Priority of the workqueue for handling TX done

None

CONFIG_NRF700X_TX_DONE_WQ_STACK_SIZE

(int) Stack size of the workqueue for handling TX done

None

CONFIG_NRF700X_RX_WQ_PRIORITY

(int) Priority of the workqueue for handling RX

None

CONFIG_NRF700X_RX_WQ_STACK_SIZE

(int) Stack size of the workqueue for handling RX

None

CONFIG_NRF700X_RPU_PS_IDLE_TIMEOUT_MS

(int) RPU power save idle timeout in milliseconds

None

CONFIG_NRF700X_RPU_EXTEND_TWT_SP

(bool) Enable extending TWT service period

In case frames accepted before beginning of SP are not transmitted before the SP completes then typically they are dropped to conform to SP window as per specification i.e., no transmission outside SP window.

This feature mitigates the frame loss by transmitting even after SP completion by using standard contention mechanism which is allowed in specification but not recommended. As the device is actively transmitting beyond SP, the power consumption increases depending on the amount of traffic available at the start of SP.

Please note that if a frame is sent after SP starts it will be queued and this mechanism is not used.

CONFIG_WIFI_FIXED_MAC_ADDRESS

(string) WiFi Fixed MAC address in format XX:XX:XX:XX:XX:XX

This overrides the MAC address read from OTP. Strictly for testing purposes only.

CONFIG_WIFI_OTP_MAC_ADDRESS

(bool) Use MAC address from OTP

This option uses the MAC address stored in the OTP memory of the nRF700x.

CONFIG_WIFI_FIXED_MAC_ADDRESS_ENABLED

(bool) Enable fixed MAC address

Enable fixed MAC address

CONFIG_WIFI_RANDOM_MAC_ADDRESS

(bool) Enable random MAC address generation at runtime

This option enables random MAC address generation at runtime. The random MAC address is generated using the entropy device random generator.

CONFIG_NRF700X_RSSI_STALE_TIMEOUT_MS

(int) RSSI stale timeout in milliseconds

RSSI stale timeout is the period after which driver queries RPU to get the RSSI the value. If data is active (e.g. ping), driver stores the RSSI value from the received frames and provides this stored information to wpa_supplicant. In this case a higher value will be suitable as stored RSSI value at driver will be updated regularly. If data is not active or after the stale timeout duration, driver queries the RPU to get the RSSI value and provides it to wpa_supplicant. The value should be set to lower value as driver does not store it and requires RPU to provide the info.

CONFIG_HEAP_MEM_POOL_SIZE

(unknown)

None

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE

(unknown)

None

CONFIG_NET_TX_STACK_SIZE

(unknown)

None

CONFIG_NET_RX_STACK_SIZE

(unknown)

None

CONFIG_NET_TC_TX_COUNT

(unknown)

None

CONFIG_WIFI_MGMT_SCAN_SSID_FILT_MAX

(unknown)

None

CONFIG_NRF_WIFI_SCAN_MAX_BSS_CNT

(int) Maximum number of scan results to return.

Maximum number of scan results to return. 0 represents unlimited number of BSSes.

CONFIG_NRF_WIFI_BEAMFORMING

(bool) Enable Wi-Fi beamforming. Enabling beamforming can provide slight improvement in performance where as disabling it can provide better power saving in low network activity applications

None

CONFIG_WIFI_NRF700X_SCAN_TIMEOUT_S

(int) Scan timeout in seconds

None

CONFIG_NRF_WIFI_2G_BAND

(bool) Set operation band to 2.4GHz

None

CONFIG_NRF_WIFI_5G_BAND

(bool) Set operation band to 5GHz

None

CONFIG_NRF_WIFI_OP_BAND

(int) Options to set operation band

Set this option to select frequency band 1 - 2.4GHz 2 - 5GHz 3 - All ( 2.4GHz and 5GHz )

CONFIG_NRF_WIFI_IFACE_MTU

(int) MTU for Wi-Fi interface

None

CONFIG_WIFI_NRF700X_SKIP_LOCAL_ADMIN_MAC

(bool) Suppress networks with non-individual MAC address as BSSID in the scan results

Wi-Fi access points use locally administered MAC address to manage multiple virtual interfaces, for geo-location usecase these networks from the virtual interfaces do not help in anyway as they are co-located with the primary interface that has globally unique MAC address.

So, to save resources, this option drops such networks from the scan results.

CONFIG_WIFI_NRF700X_SCAN_DISABLE_DFS_CHANNELS

(bool) Disables DFS channels in scan operation

This option disables inclusion of DFS channels in scan operation. This is useful to reduce the scan time, as DFS channels are seldom used.

CONFIG_NET_INTERFACE_NAME_LEN

(unknown)

None

CONFIG_NRF_WIFI_AP_DEAD_DETECT_TIMEOUT

(int) Access point dead detection timeout in seconds

The number of seconds after which AP is declared dead if no beacons are received from the AP. Used to detect AP silently going down e.g., power off.

CONFIG_NRF_WIFI_RPU_RECOVERY

(bool) Enable RPU recovery mechanism

Enable RPU recovery mechanism to recover from RPU (nRF70) hang. This feature performs an interface reset (down and up) which triggers a RPU coldboot. Application’s network connection will be lost during the recovery process and it is application’s responsibility to re-establish the network connection.

CONFIG_NRF_WIFI_RPU_RECOVERY_PROPAGATION_DELAY_MS

(int) RPU recovery propagation delay in milliseconds

Propagation delay in milliseconds to wait after RPU is powered down before powering it up. This delay is required to ensure that the recovery is propagted to all the applications and stack and have enough time to clean up the resources.

CONFIG_NET_MGMT_EVENT_QUEUE_SIZE

(unknown)

None

CONFIG_NRF_WIFI_COMBINED_BUCKEN_IOVDD_GPIO

(bool)

Enable this option to use a single GPIO to control both buck enable and IOVDD enable, there will be a internal hardware switch to add delay between the two operations. This is typically 4ms delay for nRF70.

Devicetree Specification configuration 

The maximum transmit power achieved on a nRF70 Series device-based product depends on the frequency band and operating channel. This varies from chip to chip as well as over different Printed Circuit Board (PCB) designs.

Multiple calibrations and checks are implemented to ensure consistency across channels and devices. However, these values have a dependency on PCB design, which may result in Error Vector Magnitude (EVM) and spectral mask failures. To avoid this problem, you can specify the power ceiling at which the EVM and spectral mask are met for a given PCB design. Additionally, build-time parameters are made available to drivers through the DTS overlay file.

The following code snippet shows an example of the DTS overlay file:

/
{
        nrf70_tx_power_ceiling: nrf70_tx_power_ceiling_node {
                status = "okay";
                compatible = "nordic,nrf700x-tx-power-ceiling";
                max-pwr-2g-dsss = <0x54>;
                max-pwr-2g-mcs0 = <0x40>;
                max-pwr-2g-mcs7 = <0x40>;
                max-pwr-5g-low-mcs0 = <0x38>;
                max-pwr-5g-low-mcs7 = <0x38>;
                max-pwr-5g-mid-mcs0 = <0x38>;
                max-pwr-5g-mid-mcs7 = <0x38>;
                max-pwr-5g-high-mcs0 = <0x38>;
                max-pwr-5g-high-mcs7 = <0x38>;
        };

};

The following table lists the parameters (8-bit unsigned values) defined in the DTS overlay board files:

DTS file parameters
DTS parameter	Description
max-pwr-2g-dsss	Transmit power ceiling for DSSS data rate in 0.25 dBm steps. This is applicable for all DSSS data rates.
max-pwr-2g-mcs0	Transmit power ceiling for MCS0 data rate in 2.4 GHz band in steps of 0.25 dBm steps.
max-pwr-2g-mcs7	Transmit power ceiling for MCS7 data rate in 2.4 GHz band in steps of 0.25 dBm steps.
max-pwr-5g-low-mcs0	Transmit power ceiling for MCS0 in lower 5 GHz frequency band in steps of 0.25 dBm. Lower 5 GHz frequency band refers to channels from 36 to 64.
max-pwr-5g-low-mcs7	Transmit power ceiling for MCS7 in lower 5 GHz frequency band in steps of 0.25 dBm.
max-pwr-5g-mid-mcs0	Transmit power ceiling for MCS0 in mid 5 GHz frequency band in steps of 0.25 dBm. Mid 5 GHz frequency band refers to channels from 100 to 132.
max-pwr-5g-mid-mcs7	Transmit power ceiling for MCS7 in mid 5 GHz frequency band in steps of 0.25 dBm.
max-pwr-5g-high-mcs0	Transmit power ceiling for MCS0 in high 5 GHz frequency band in steps of 0.25 dBm. High 5 GHz frequency band refers to channels from 136 to 177.
max-pwr-5g-mid-mcs7	Transmit power ceiling for MCS7 in mid 5 GHz frequency band in steps of 0.25 dBm.

API documentation 

After the nRF Wi-Fi driver has been initialized, the application will see it as an Ethernet interface. To use the Ethernet interface, the application can use Zephyr Network APIs.

See the nRF70 low-level API documentation to learn more about various modes of low-level API.