Project

General

Profile

Actions

WiFi Research

Issue

Currently, the internal WiFi chip cannot be used on any of the Replicant-supported devices without having to load non-free firmware. See Replicant status and the device pages for more information.

On desktops and laptops, several WiFi chips don't require non-free firmwares to be loaded.

Several cases exist:
  • The WiFi chip doesn't need a firmware, and the driver talks directly to the hardware (ath5k and ath9k compatible chips)
  • The WiFi chip has a free software firmware (ath9k_htc, carl1970, and some b43 compatible chips)
  • The WiFi chip has a non-free firmware in a flash chip and don't need loadable firmware.

On phones, the only WiFi chip that doesn't require a non-free firmware that we know of is the OpenMoko FreeRunner WiFi chip. The firmware is in a flash chip.

The idea here is to find ways to still get WiFi on Replicant Supported devices, without needing to load any non-free firmware.

WiFi Drivers and Firmwares types

Either the firmware implements the WiFi operations (scanning, association, and so on), either the driver implements it.

Firmware implementing the WiFi operations

This is also known as Hard-MAC.
An easy way to find out is to look into the WiFi driver Kconfig for "select CFG80211" or "depends CFG80211"

Example:

config LIBERTAS
        tristate "Marvell 8xxx Libertas WLAN driver support" 
        depends on CFG80211
[...]

If it is implemented by the firmware, it often contains bugs which cannot be fixed by the community. That also severally limit the use case of such WiFi chip beyond its most common uses cases.

This can result in more help in getting a free software firmware to run on such chip. However the amount of work to re-implement such firmware may be bigger.

The best way to reimplement it would be to write a new driver taking care of such WiFi operations and to make the firmware do the smallest amount of work possible.

Driver implementing the WiFi operations

This is also known as Soft-MAC.
An easy way to find out is to look into the WiFi driver Kconfig for "select MAC80211" or "depends MAC80211"

Example:

config WL1251
        tristate "TI wl1251 driver support" 
        depends on MAC80211
[...]

Internal WiFi chips on devices currently targeted by Replicant

Device WiFi chip driver(s) Research
Galaxy S Broadcom BCM4329 BCMDHD (cfg80211)
LG Optimus Black
Nexus S
Galaxy Nexus Broadcom BCM4330 * See the nexmon project
* The BCM4330 has a rom. Can the driver use it? do functional free software firmware 'patches' exist for it ?
* Some documentation exists at least for the BCM4334
* Also see the blog post about reverse engineering Broadcom wireless chipsets
* A talk that was given about debugging code running on the chip
* See also the RECON-BRX-2018-DIY-ARM-Debugger-for-Wi-Fi-Chips.pdf slides
* A political solution might be worth pursuing
Galaxy Note
Galaxy S 2
Galaxy Tab 2 7.0
Galaxy Tab 2 10.1
Galaxy S 3 Broadcom BCM4334
Galaxy S 3 4G
Galaxy Note 2
GTA04 Marvell 8686 (W2CBW003) libertas_sdio(mainline, cfg80211)
libertas_tf_sdio(patches, mac80211)
See also the "All wireless communication stacks are equally broken talk at 36c3": https://media.ccc.de/v/36c3-10531-all_wireless_communication_stacks_are_equally_broken :
  • There are some tools to emulate WiFi and Bluetooth chips hardware
  • Around 34 minutes 30 seconds there is "So the first part is mapping all the hardware registers", so the software tools probably have some very rough documentation on the chips

Available Internal WiFi chips for smartphones and tablets

Driver / Chip Busses Firmware Usable in smartphones or tablets? Research
ath5k PCI, PCIe, PCMCIA, AHB None(Driver<->Hardware) Busses? chip size? power consumption?
ath9k PCI, PCIe, PCMCIA, AHB None(Driver<->Hardware) Busses? chip size? power consumption?
ath9k_htc USB Free firmware Bus? chip size? power consumption?
carl9170 USB Free firmware Bus? chip size? power consumption?
airo PCI, PCMCIA Non-free firmware on flash ?
at76c50x-usb USB Non-free firmware needed for some cards only ?
b43/b43-legacy SSB, PCI, PCI-E, PCMCIA OpenFWWF with 4306, 4311(rev1), 4318, 4320 ?
rt2400 PCI No non-free firmware needed ?
rt2500 PCI No non-free firmware needed ?
rt2500usb PCI No non-free firmware needed ?
rtl818x PCI, USB No non-free firmware needed ?
esp8266 (out of tree) UART, SPI, SDIO * Unsigned fimrware and free software SDK available for it
* nonfree binaries required to make WiFi work
* Out of tree Linux driver available which depend on nonfree firmware
Used in a tablet?
esp32 (out of tree) * Unsigned fimrware and free software SDK available for it
* nonfree binaries required to make WiFi work
Used in a tablet?
rsi91x SDIO, USB, other? * nonfree firmware required
* may be possible to add it on a dedicated flash chip
Might be used in a smartphone in the future
brcmfmac SDIO, USB, pcie * ARM CPU with ROM and ARM
* Unsigned code
* nonfree firmware are used with the Linux driver
Used in smartphones and tablets * TODO: Look if it works once firmware loading has been patched out of the upstream Linux driver
* TODO: Look at the nextmon project if there are usable free firmwares
* According to the BCM4334 documentation it's possible to have the firmware on dedicated flash chip.
rtlwifi (staging) SDIO, USB, PCIe nonfree firmware Used at least in e-readers * The nonfree firmware allow reverse engineering (GPL)
* Reverse engineering the nonfree firmware looks easy
Notes:
  • PCI, PCIe and PCMCIA are available on very few SOCs (Like I.MX)
  • We are not aware of phone designs using USB WiFi chips.
  • AHB and SSB are usually used as internal memory bus for SOCS. Maybe it can be used to connect a WiFi chip to the SOC memory, like with the I.MX WEIM bus?
  • Chip size is important to fit inside a phone. Might be less an issue for tablets.
References:

WiFi chip evaluation kit and hardware debug tools

It would also be nice to find evaluation kit for the following hardware:
  • ath9k_htc compatible chips: This probably would make it easier to modify the firmware to debug and improve power management
  • Realtek 8188F compatible chips, because freeing the firmware should be doable

TODO

  • Coordinate the work with the Libreplanet wiki
  • Look into Broadcom chipset reverse engineering tools like nexmon . Since Broadcom chipsets have Bluetooth support on the same chip it is also worth to look into tools such as InternalBlue.

Internal WiFi chips on devices currently targeted by Replicant

External Wifi solution

Most/All Replicant supported devices support USB OTG. With the proper (standard) cable, the USB port of the device can do USB host.

However devices differ a lot in the number of Milli-ampers they can deliver through that USB port. Some phones also have USB host enabled by default in their kernel configuration, and some other require patching the kernel.

On Replicant kernels, USB WiFi drivers are probably not compiled in by default. So you will also need to recompile.

Information about currently supported WiFi adapters for Replicant 6.0 can be found here: https://redmine.replicant.us/projects/replicant/wiki/WiFiAdapter

Device Chips involved Replicant 6 Kernel Max mA
Galaxy Nexus TWL6040 3.0.101 500mA (tuna_set_vbus_drive in board-tuna-connector.c )
Galaxy S III (I9300) MAX77693 with the ESAFEOUT1 regulator 3.0.101 * Datasheet not found
* The upstream driver doesn't have the information
* Downstream drivers might have some information about how much mA ESAFEOUT1 can deliver
Galaxy S III 4G (I9305)
Galaxy Note 2
Galaxy Note
Galaxy S 2 MAX8997 with the SAFEOUT1 regulator [1] [2] * Datasheet not found
* The upstream driver doesn't have the information
* Downstream drivers might have some information about how much mA SAFEOUT1 can deliver
Galaxy Tab 2 7.0 ?
Galaxy Tab 2 10.1 ?
GTA04
Galaxy S
Nexus S
Optimus Black

See #1926 for pointers on how to find the missing information for the Maxim Power Management ICs (PMICs).

Updated by Fil Lupin over 3 years ago ยท 142 revisions

Also available in: PDF HTML TXT