Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Aarch64 #422

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Aarch64 #422

wants to merge 10 commits into from

Conversation

SJuhl75
Copy link

@SJuhl75 SJuhl75 commented Jul 17, 2020

  1. Adjusted code so that it can be successfully build and used in Armbian Focal 20.04 & aarch64 architecture environment
  2. Verified with firmware 7_45_41_46 on an NanoPi NEO Plus2 running a recent Armbian distro
  3. Added firmwares of Cypress Linux WiFi Driver Release (FMAC) [2020-06-25] (Source: https://community.cypress.com/docs/DOC-20044)
    NOTE: By using ghidra (I have no access to IDA pro) I was able to identify all hooks in BCM43430 firmwares 7_45_98_38 and 7_45_98_97. I adjusted the address hooks in the patching source code accordingly. However the patched firmwares do not work.
    I am at the end of my knowledge and would be very happy if someone could improve the code further.

@matthiasseemoo
Copy link
Member

matthiasseemoo commented Jul 17, 2020 via email

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 17, 2020

Hi Stefan, did you adjust the definitions.mk files as well? Just try to make the patch.c file work and then copy each of the other files one by one. Matthias

Hi Matthias, I adjusted the following things:

  1. patches/include/firmware_version.h -> added FW_VER_7_49_98_XX definitions
  2. patches/common/wrapper.c -> added adjusted address pointers for FW_VER_7_49_98_XX, incl. hints for look-up
  3. adjusted definitions.mk -> WLC_UCODE_WRITE_BL_HOOK_ADDR, UCODESTART and all others ...
  4. adjusted version.mk accordingly
  5. adjusted all address pointers in autostart.c, injection.c, ioctl.c, patch.c and version.c

Result: lsmod tells me kernel module is loaded, but interface does not show up. dmesg output:
brcmfmac: brcmf_sdio_htclk: HT Avail timeout (1000000): clkctl 0x50

@matthiasseemoo
Copy link
Member

matthiasseemoo commented Jul 18, 2020 via email

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 19, 2020 •
edited

The unpatched firmware 7_45_98_97 loads without any issues. I also checked the patch infrastructure by using the 7_45_41_46 firmware instead 7_45_98_97 and also tried to build only with minimal patchset as suggested by you - still no success. The hooks I found and set in definitions.mk are very close to the ones DrSchottky noted for his 7_45_98_94 branch. The templateram.bin extracted from 7_45_98_97 and 7_45_41_46 are identical. Start and end of ucode.bin also look reasonable.
So I think the root cause of the problem are the definitions in wrapper.c, although I was very thorough in my search for hooks. (I compared the opcodes of 7_45_41_26, 7_45_41_46, 7_45_98_38 with 7_45_98_97 and matched them by pattern matching due to absence of higher microcode programming knowledge).

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 21, 2020 •
edited

Hi Matthias, I wrote a script to automatically verify the manual address hooks I made in wrapper.c and fixed three typos.
I disassembled the individual functions of the firmware using Ghidra and compared 7_45_41_46 vs. 7_45_98_97. Most of them 100% identical; I attach a list for reference. However, even if I remove all referenced hooks from wrapper.c and limit patching to version.c and patch.c the patched firmware 7_45_98_38 or 7_45_98_97 exit early with HT Avail timeout (1000000) without the interface beeing created.
This needs a specialist with deeper understanding of the chipset and the ARM Cortex-M3 opcodes
Nevertheless the Aarch64 build chain works fine ;)

  1. 00009e24 00009e24 100_dma_rx
    0000a020 0000a020 dma_rxfill
    0000379c 0000379c dngl_sendpkt
    00004788 00004788 handle_sdio_xmit_request
    00002854 00002854 100_hndrte_del_timer
    00002414 00002414 100_memcpy
    0002d9b0 0002d9b0 100_phy_reg_or
    0002d9cc 0002d9cc 100_pyh_reg_mod
    0002d2c2 0002d2c2 100_phy_reg_read
    0000b3a4 0000b3a4 pkt_buf_get_skb
    0000b3e8 0000b3e8 pkt_buf_free_skb
    00025076 00025076 100_wlc_bmac_enable_mac
    00025624 00025654 wlc_bmac_suspend_mac_and_wait
    000250c4 000250c4 100_wlc_bmac_read_tsf
    00026720 00026720 100_wlc_bsscfg_find_by_wlcif
    0000eb5c 0000eb5c wlc_d11hdrs
    00012f80 00012f80 wlc_sendctl
    0000ea0e 0000ea0e 100_wlc_get_txh_info
    0000c664 0000c664 wl_send
    00018a3c 00018a3c wlc_recvdata
    00019300 00019300 wlc_recv
    0000dfdc 0000dfdc 100_wlc_iovar_op
    00035a7a 00035a7a 100_wlc_lcn40phy_deaf_mode
    0003280e 0003280e 100_wlc_lcn40phy_force_pwr_index
    0002f758 0002f758 100_wlc_lcn40phy_num_samples
    0003344c 0003344c 100_wlc_lcn40phy_run_samples
    00032568 00032568 100_wlc_lcn40phy_set_bbmult
    0002f99a 0002f99a 100_wlc_lcn40phy_set_pa_gain
    0002fde0 0002fde0 100_wlc_lcn40phy_set_tx_gain
    00034b42 00034b42 100_wlc_lcn40phy_set_tx_pwr_by_index
    00032fae 00032fae wlc_lcn40phy_set_tx_pwr_ctrl
    00035b4c 00035b4c 100_wlc_lcn40phy_start_tx_tone
    00035ac2 00035ac2 100_wlc_lcn40phy_stop_tx_tone
    00033272 00033272 100_wlc_lcn40phy_tx_tone_samples
    0003243e 0003243e wlc_lcn40phy_write_table
    0002e07c 0002e07c 100_wlc_phy_channel2freq
    0002edd8 0002edd8 100_wlc_phy_cordic
    0003d4f2 0003d4f2 100_wlc_scb_lookup
    000147b8 000147b8 100_wlc_txfifo
    0005227c 0005227c 100_wlc_ucode_download
    0000268c 0000268c 100_wlc_ucode_write_bl

@matthiasseemoo
Copy link
Member

matthiasseemoo commented Jul 21, 2020 via email

@SJuhl75
Disassembled, differencing firmware functions of 7_45_41_46 vs. 7_45_…
09cabbc 
…98_94 + script ChkHooks.sh for automatic hook search in firmware file
@SJuhl75
Copy link
Author

SJuhl75 commented Jul 23, 2020

Hi Matthias, I am GitHub newbie ... was this the right way to submit the pr?

@matthiasseemoo
Copy link
Member

matthiasseemoo commented Jul 23, 2020 via email

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 24, 2020

Thanks for your feedback; the structure change of definitons.mk was just another experiment .. I forgot to redo/delete it before the pull request; it worked for 7_45_41_46.
Some users report trouble with stock 7_45_98_xx related to a XTAL Setting in the NVRAM.txt file. I tried a few values without success, but without knowledge about valid values this is like playing roulette.
Therefore in a next step I will try to use the build firmware on a BananaPi One Zero and a Orange Pi SBC which I have on hand and both have a BCM43430 wifi chip. I will come back with results.

@SJuhl75
Copy link
Author

SJuhl75 commented Aug 2, 2020

Confirm 7_45_98_97 fails with same error "HT Avail timeout" on Banana Pi M2 Zero.
7_45_41_46 just works fine.

@alphafox02
Copy link

alphafox02 commented Apr 3, 2021 •
edited

Would it be possible to adapt this aarch64 support to the official Ubuntu aarch64 20.04 Pi image. I’d love to try Nexmon and the pi4s internal wireless chipset, however it doesn’t appear the Ubuntu aarch64 20.04 image is compatible. Thanks!

@PyMarc2
Copy link

PyMarc2 commented Jul 13, 2021

+1 ! How is it going ? Raspberry pi 4 user here with ubuntu20.04! Would love to see some comments / development :-)

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 15, 2021

Recently I was able to build a working brcmfmac.ko on an up to date armbian 20.x with an 5.10 armv7l kernel, using the 7_45_41_46 firmware .. so as hacking code is not my main business I have to find time to prepare an pull request ;)

@SJuhl75
Copy link
Author

SJuhl75 commented Jul 16, 2021

As announced I was able to push a pull request: #489

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@SJuhl75 @matthiasseemoo @alphafox02 @PyMarc2