I suspect that porting brcmfmac was just too much, it's a lot of spagetti code. Not aware of any crypto in there that might be problematic.
I understand it to be the handling of WEP/WPA/WPA2 in establishing a connection which is the challenge as it's a lot of work with few resources to do that. So an issue within the protocol stack rather than with the firmware or chip.
Is it the same driver as implemented by LdB here https://github.com/LdB-ECM/Raspberry-Pi ... r/SD_FAT32.Thalhammer wrote: ↑Wed Jul 31, 2019 12:09 pmdespite my driver for the arasan controller working fine
Thalhammer wrote: ↑Wed Jul 31, 2019 4:32 pmNo its a custom implementation to fit my OS (I write a C++ RTOS, so no userspace etc and class oriented) but his code was one of the references I used.
The only things I currently have is the datasheet of the chip (very little usefull information), the official brcmfmac source of the linux driver and a dump of the traffic between module and kernel on boot.
However I didn't find a clk line, so the official saleae sdio analyser does not work and my attempts at a custom analyser which uses the edges on the commandline to detect clockspeed were not really successful, so that dump is not really that useful.
I never implemented WPA and so on but I did some work with injecting wifi frames from linux in the past so I know the basics.
Also I think there is a chance that you won't even have to deal with it (I.e. it is handled by the broadcom chip, I read that there is more or less a complete wifi stack in the firmware but I dont know if it is used by linux).
I tried to copy the init sequence used by linux but for some reason the card does not respond to any sdio command I send (they all timeout).
The basics is the following:
WL_ON needs to be high (gpio41 on pizerow).
Arasan is configured on pin 34-39 and uses 4 bit mode with 400kHz Operation during init and 25MHz during actual transmission.
I did not get anything working (yet) and moved on to some other projects with more information (Videocore and Bluetooth stack) to get my head free.
if you manage to get anything working feel free to share code or if you need help I am happy to help.
Thalhammer wrote: ↑Thu Aug 01, 2019 8:15 pmBroadcoms WIFI division was bought by Cypress and the provide some of the documentation. You can find the datasheet here:
https://www.cypress.com/file/298706/download
Linux driver is called brcmfmac and its source is here:
https://github.com/torvalds/linux/tree/ ... 1/brcmfmac
The SDIO code is separated in Linux from the Wi-Fi driver code in the MMC subsystem.
I dumped 2 types of bcm43438 sdio traffic .Thalhammer wrote: ↑Fri Aug 16, 2019 10:03 pmMaybe we could instrument the linux driver with more logging and check it using this way ?
Or is there some kernel option to dump all sdio traffic ?
Hey can you share your steps. I built brcmfmac kernel module, but if failed while loading .ko file using insmod with error "invalid symbol found".eggmansan wrote: Sat Aug 17, 2019 3:33 am
Maybe we could instrument the linux driver with more logging and check it using this way ?
Or is there some kernel option to dump all sdio traffic ?
I dumped 2 types of bcm43438 sdio traffic .
1. add some debug print to drivers/mmc/core/sdio_ops.c and core.c.
https://github.com/eggman/raspberrypi/b ... io_log.txt
2. brcmfmac driver have trace option. enable BRCM_TRACING in kernel config file.
https://github.com/eggman/raspberrypi/b ... ce_log.txt
And I write some baremetal sdio code. but not test on real hardware. I only tested my modified qemu.
https://github.com/eggman/raspberrypi/t ... pi3/sdio03
Code: Select all
uname -r
4.19.66-v7l+
Code: Select all
git clone --depth=1 --branch rpi-4.19.y https://github.com/raspberrypi/linux
Code: Select all
make -j4 modules
Thank you sir. I think it will help me writing small driver for this sdio wifi chip.9pi wrote: ↑Tue Aug 27, 2019 1:12 pmNot bare metal strictly speaking, but the Plan 9 driver is another alternative example you might want to look at for information. It's under 2400 lines of C, so it should be a bit easier to follow than the Linux brcmfmac driver. To write the Plan 9 driver without a device spec, I had to read all the brcmfmac code which is a 32,000+ line spaghetti of support for multiple chips and interface methods: not an experience I would recommend for pleasure.
Plan 9 driver source is at https://9p.io/sources/contrib/miller/9/bcm/ether4330.c, depends on the emmc driver (another 529 lines) in https://9p.io/sources/contrib/miller/9/bcm/emmc.c for sdio support.
Thanks for this l, now I can trace the source code.eggmansan wrote:I dumped 2 types of bcm43438 sdio traffic .Thalhammer wrote: ↑Fri Aug 16, 2019 10:03 pmMaybe we could instrument the linux driver with more logging and check it using this way ?
Or is there some kernel option to dump all sdio traffic ?
1. add some debug print to drivers/mmc/core/sdio_ops.c and core.c.
https://github.com/eggman/raspberrypi/b ... io_log.txt
2. brcmfmac driver have trace option. enable BRCM_TRACING in kernel config file.
https://github.com/eggman/raspberrypi/b ... ce_log.txt
And I write some baremetal sdio code. but not test on real hardware. I only tested my modified qemu.
https://github.com/eggman/raspberrypi/t ... pi3/sdio03
I tried this code in steps It didn't work for me in first step itself.9pi wrote: ↑Tue Aug 27, 2019 1:12 pmNot bare metal strictly speaking, but the Plan 9 driver is another alternative example you might want to look at for information. It's under 2400 lines of C, so it should be a bit easier to follow than the Linux brcmfmac driver. To write the Plan 9 driver without a device spec, I had to read all the brcmfmac code which is a 32,000+ line spaghetti of support for multiple chips and interface methods: not an experience I would recommend for pleasure.
Plan 9 driver source is at https://9p.io/sources/contrib/miller/9/bcm/ether4330.c, depends on the emmc driver (another 529 lines) in https://9p.io/sources/contrib/miller/9/bcm/emmc.c for sdio support.
Code: Select all
uint32_t i;
for(i = 48; i <= 53; i++)
select_alt_func(i, Alt0);
for(i = 34; i <= 39; i++){
select_alt_func(i, Alt3);
if(i == 34)
disable_pulling(i); // Pull off
else
pullup_pin(i);
}
// ----- Pull up Pull Down code
#define PERIPHERAL_BASE 0x3F000000UL
#define GPIO_BASE ((volatile __attribute__((aligned(4))) uint32_t*)(uintptr_t)(PERIPHERAL_BASE + 0x200000))
#define SET_GPIO_ALT(g,a) *(GPIO_BASE + (((g)/10))) |= (((a)<=3?(a) + 4:(a)==4?3:2)<<(((g)%10)*3))
typedef enum {
Alt0 = 0x4,
Alt1 = 0x5,
Alt2 = 0x6,
Alt3 = 0x7,
Alt4 = 0x3,
Alt5 = 0x2,
} alt_func;
/* GPIO regs */
enum {
Set0 = 0x1c>>2,
Clr0 = 0x28>>2,
Lev0 = 0x34>>2,
PUD = 0x94>>2,
Off = 0x0,
Pulldown= 0x1,
Pullup = 0x2,
PUDclk0 = 0x98>>2,
PUDclk1 = 0x9c>>2,
};
void select_alt_func(uint32_t bcm_pin, alt_func alt_fun) {
SET_GPIO_ALT(bcm_pin, alt_fun);
}
void pullup_pin(uint32_t bcm_pin) {
volatile uint32_t *gp, *reg;
uint32_t mask;
gp = GPIO_BASE;
reg = &gp[PUDclk0 + bcm_pin/32];
mask = 1 << (bcm_pin % 32);
gp[PUD] = Pullup;
delay(150);
*reg = mask;
delay(150);
*reg = 0;
}
void pulldown_pin(uint32_t bcm_pin)
{
volatile uint32_t *gp, *reg;
uint32_t mask;
gp = GPIO_BASE;
reg = &gp[PUDclk0 + bcm_pin/32];
mask = 1 << (bcm_pin % 32);
gp[PUD] = Pulldown;
delay(150);
*reg = mask;
delay(150);
*reg = 0;
}
void disable_pulling(uint32_t bcm_pin)
{
volatile uint32_t *gp, *reg;
uint32_t mask;
gp = GPIO_BASE;
reg = &gp[PUDclk0 + bcm_pin/32];
mask = 1 << (bcm_pin % 32);
gp[PUD] = Off;
delay(150);
*reg = mask;
delay(150);
*reg = 0;
}
Code: Select all
(CMD5)IO_SEND_OP_COND, CMD52(RESET) by writing CIA(function = 00h) register (02h) wifi(bit 7) = 1
Code: Select all
cfgw(Sbaddr+1, addr>>16);
cfgw(Sbaddr+2, addr>>24);
Those are static functions defined earlier in the same file, ether4330.czeoneo wrote: ↑Sun Sep 01, 2019 1:11 pm
I am wondering where are the definition for these function calls like belowI tried searching there is no way I could clone your sources repository. Please let me know if you can help me with that.Code: Select all
cfgw(Sbaddr+1, addr>>16); cfgw(Sbaddr+2, addr>>24);