Project

General

Profile

WiFiResearch » History » Version 126

Denis 'GNUtoo' Carikli, 05/06/2019 02:56 PM

1 75 Wolfgang Wiedmeyer
h1. WiFi Research
2 1 Denis 'GNUtoo' Carikli
3
h2. Issue
4 75 Wolfgang Wiedmeyer
5 77 Wolfgang Wiedmeyer
Currently, the internal WiFi chip cannot be used on any of the Replicant-supported devices without having to load non-free firmware. See [[ReplicantStatus|Replicant status]] and the [[Index#Supported-devices|device pages]] for more information. 
6 28 Denis 'GNUtoo' Carikli
7
On desktops and laptops, several WiFi chips don't require non-free firmwares to be loaded.
8 27 Denis 'GNUtoo' Carikli
9
Several cases exist:
10
* The WiFi chip doesn't need a firmware, and the driver talks directly to the hardware (ath5k and ath9k compatible chips)
11
* The WiFi chip has a free software firmware (ath9k_htc, carl1970, and some b43 compatible chips)
12
* The WiFi chip has a non-free firmware in a flash chip and don't need loadable firmware.
13
14 80 Joonas Kylmälä
On phones, the only WiFi chip that doesn't require a non-free firmware that we know of is the OpenMoko FreeRunner WiFi chip. The firmware is in a flash chip.
15 29 Denis 'GNUtoo' Carikli
16 31 Denis 'GNUtoo' Carikli
The idea here is to find ways to still get WiFi on Replicant Supported devices, without needing to load any non-free firmware.
17
18
h2. WiFi Drivers and Firmwares types
19
20
Either the firmware implements the WiFi operations (scanning, association, and so on), either the driver implements it.
21
22
h3. Firmware implementing the WiFi operations
23
24 32 Denis 'GNUtoo' Carikli
This is also known as Hard-MAC. 
25
An easy way to find out is to look into the WiFi driver Kconfig for "select CFG80211" or "depends CFG80211"
26
27
Example:
28 33 Denis 'GNUtoo' Carikli
<pre>
29
config LIBERTAS
30
        tristate "Marvell 8xxx Libertas WLAN driver support"
31
        depends on CFG80211
32
[...]
33
</pre>
34 31 Denis 'GNUtoo' Carikli
35
If it is implemented by the firmware, it often contains bugs which cannot be fixed by the community. That also severally limit the use case of such WiFi chip beyond its most common uses cases.
36
37
This can result in more help in getting a free software firmware to run on such chip. However the amount of work to re-implement such firmware may be bigger.
38
39 81 Kurtis Hanna
The best way to reimplement it would be to write a new driver taking care of such WiFi operations and to make the firmware do the smallest amount of work possible.
40 31 Denis 'GNUtoo' Carikli
41
h3. Driver implementing the WiFi operations
42
43 34 Denis 'GNUtoo' Carikli
This is also known as Soft-MAC. 
44
An easy way to find out is to look into the WiFi driver Kconfig for "select MAC80211" or "depends MAC80211"
45 31 Denis 'GNUtoo' Carikli
46 34 Denis 'GNUtoo' Carikli
Example:
47
<pre>
48 35 Denis 'GNUtoo' Carikli
config WL1251
49
        tristate "TI wl1251 driver support"
50
        depends on MAC80211
51 34 Denis 'GNUtoo' Carikli
[...]
52
</pre>
53 31 Denis 'GNUtoo' Carikli
54 1 Denis 'GNUtoo' Carikli
h2. Internal WiFi chips on devices currently targeted by Replicant
55 2 Denis 'GNUtoo' Carikli
56 91 Denis 'GNUtoo' Carikli
|_. Device |_. WiFi chip |_. driver(s) |_. Research |
57 56 Denis 'GNUtoo' Carikli
| Galaxy S |/3. Broadcom BCM4329 |/3. BCMDHD (cfg80211) |
58 54 Denis 'GNUtoo' Carikli
| LG Optimus Black |
59 1 Denis 'GNUtoo' Carikli
| Nexus S |
60 105 dl lud
| Galaxy Nexus |/5. Broadcom BCM4330 |/5. |/8. * See the "nexmon project":https://github.com/seemoo-lab/nexmon
61 94 Denis 'GNUtoo' Carikli
* The BCM4330 has a rom. Can the driver use it? do functional free software firmware 'patches' exist for it ?
62
* "Some documentation exists at least for the BCM4334":http://www.cypress.com/file/298706/download |
63 1 Denis 'GNUtoo' Carikli
| Galaxy Note |
64 78 Wolfgang Wiedmeyer
| Galaxy S 2 |
65
| Galaxy Tab 2 7.0 |
66
| Galaxy Tab 2 10.1 |
67
| Galaxy S 3 |/3. Broadcom BCM4334 |/3. |
68
| Galaxy S 3 4G |
69
| Galaxy Note 2 |
70 54 Denis 'GNUtoo' Carikli
|/2. GTA04 |/2. Marvell 8686 (W2CBW003) | libertas_sdio(mainline, cfg80211) |
71
| libertas_tf_sdio(patches, mac80211) |
72 40 Denis 'GNUtoo' Carikli
73 1 Denis 'GNUtoo' Carikli
h2. Available Internal WiFi chips for smartphones and tablets
74
75 103 Denis 'GNUtoo' Carikli
|_. Driver / Chip |_. Busses |_. Firmware |_. Usable in smartphones or tablets? |_. Research |
76 96 Denis 'GNUtoo' Carikli
| ath5k | PCI, PCIe, PCMCIA, AHB  | None(Driver<->Hardware) | Busses? chip size? power consumption? | |
77
| ath9k | PCI, PCIe, PCMCIA, AHB  | None(Driver<->Hardware) | Busses? chip size? power consumption? | |
78
| ath9k_htc | USB | Free firmware | Bus? chip size? power consumption? | |
79
| carl9170 | USB | Free firmware | Bus? chip size? power consumption? | |
80
| airo | PCI, PCMCIA | Non-free firmware on flash | ? | |
81
| at76c50x-usb | USB | Non-free firmware needed for some cards only | ? | |
82
| b43/b43-legacy | SSB, PCI, PCI-E, PCMCIA | OpenFWWF with 4306, 4311(rev1), 4318, 4320 | ? | |
83
| rt2400 | PCI | No non-free firmware needed | ? | |
84
| rt2500 | PCI | No non-free firmware needed | ? | |
85
| rt2500usb | PCI | No non-free firmware needed | ? | |
86
| rtl818x | PCI, USB | No non-free firmware needed | ? | |
87 104 Denis 'GNUtoo' Carikli
| esp8266 (out of tree) |  UART, SPI, SDIO  | * Unsigned fimrware and free software SDK available for it
88
* "nonfree binaries required to make WiFi work":https://github.com/espressif/ESP8266_NONOS_SDK/tree/master/lib
89
* "Out of tree Linux driver available":https://github.com/george-hopkins/esp8089-spi which depend on nonfree firmware | Used in a tablet? | |
90
| esp32 (out of tree) | |  * Unsigned fimrware and free software SDK available for it
91
* "nonfree binaries required to make WiFi work":https://github.com/espressif/esp32-wifi-lib | Used in a tablet? |
92 1 Denis 'GNUtoo' Carikli
| rsi91x | SDIO, USB, other? | * nonfree firmware required
93 103 Denis 'GNUtoo' Carikli
* "may be possible to add it on a dedicated flash chip":https://puri.sm/posts/librem5-2018-09-hardware-report/ | Might be used in a smartphone in the future | |
94 104 Denis 'GNUtoo' Carikli
| brcmfmac | SDIO, USB, pcie | * ARM CPU with ROM and ARM
95
* Unsigned code
96
* nonfree firmware are used with the Linux driver | Used in smartphones and tablets | * TODO: Look if it works once firmware loading has been patched out of the upstream Linux driver
97 84 Denis 'GNUtoo' Carikli
* TODO: Look at the nextmon project if there are usable free firmwares
98 96 Denis 'GNUtoo' Carikli
* According to the "BCM4334 documentation":http://www.cypress.com/file/298706/download it's possible to have the firmware on dedicated flash chip. |
99 101 Denis 'GNUtoo' Carikli
| rtlwifi (staging) | SDIO, USB, PCIe | nonfree firmware | Used at least in e-readers | * The nonfree firmware allow reverse engineering (GPL)
100 96 Denis 'GNUtoo' Carikli
* "Reverse engineering the nonfree firmware looks easy":https://libreplanet.org/wiki/Group:Hardware/Freest/e-readers/Aura_H2O_Edition_2#WiFi_firmware |
101 59 Denis 'GNUtoo' Carikli
102 72 Denis 'GNUtoo' Carikli
Notes:
103
* PCI, PCIe and PCMCIA are available on very few SOCs (Like I.MX)
104 80 Joonas Kylmälä
* We are not aware of phone designs using USB WiFi chips.
105
* AHB and SSB are usually used as internal memory bus for SOCS. Maybe it can be used to connect a WiFi chip to the SOC memory, like with the I.MX WEIM bus?
106
* Chip size is important to fit inside a phone. Might be less an issue for tablets.
107 72 Denis 'GNUtoo' Carikli
108 69 Denis 'GNUtoo' Carikli
References:
109
* https://en.wikipedia.org/wiki/Comparison_of_open-source_wireless_drivers#Status
110
* https://wireless.wiki.kernel.org/en/users/drivers
111
* http://netweb.ing.unibs.it/~openfwwf/index.php
112 70 Denis 'GNUtoo' Carikli
* https://nurdspace.nl/ESP8266
113 69 Denis 'GNUtoo' Carikli
114 85 Denis 'GNUtoo' Carikli
h3. TODO
115 1 Denis 'GNUtoo' Carikli
116 85 Denis 'GNUtoo' Carikli
* Coordinate the work with the "Libreplanet wiki":https://libreplanet.org/wiki/Group:Hardware/ReverseEngineering#WiFi.2FBluetooth_chips_for_Smartphones_and_Tablets
117 107 Denis 'GNUtoo' Carikli
* Look into Broadcom chipset reverse engineering tools like "nexmon":https://github.com/seemoo-lab/nexmon . Since Broadcom chipsets have Bluetooth support on the same chip it is also worth to look into tools such as "InternalBlue":https://github.com/seemoo-lab/internalblue.
118 1 Denis 'GNUtoo' Carikli
119 85 Denis 'GNUtoo' Carikli
h2. Internal WiFi chips on devices currently targeted by Replicant
120 57 Denis 'GNUtoo' Carikli
121 27 Denis 'GNUtoo' Carikli
h2. External Wifi solution
122 36 Denis 'GNUtoo' Carikli
123
Most/All Replicant supported devices support USB OTG. With the proper (standard) cable, the USB port of the device can do USB host.
124
125 80 Joonas Kylmälä
However devices differ a lot in the number of Milli-ampers they can deliver through that USB port. Some phones also have USB host enabled by default in their kernel configuration, and some other require patching the kernel.
126 37 Denis 'GNUtoo' Carikli
127
On Replicant kernels, USB WiFi drivers are probably not compiled in by default. So you will also need to recompile.
128
129 115 Denis 'GNUtoo' Carikli
|_. Device |_. Chips involved |_. Replicant 6 Kernel |_. Max mA |
130 113 Denis 'GNUtoo' Carikli
| Galaxy Nexus | TWL6040 | 3.0.101 | 500mA ("tuna_set_vbus_drive in board-tuna-connector.c":https://git.replicant.us/replicant/kernel_samsung_tuna/tree/arch/arm/mach-omap2/board-tuna-connector.c#n260 ) |
131 122 Denis 'GNUtoo' Carikli
| Galaxy S III (I9300) |/3. "MAX77693":https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm/boot/dts/exynos4412-midas.dtsi#n131 with the "ESAFEOUT1 regulator":https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm/boot/dts/exynos4412-midas.dtsi?h=v5.1#n401 |/5. 3.0.101 |/3. * Datasheet not found
132
* The upstream driver doesn't have the information
133
* Downstream drivers might have some information about how much mA ESAFEOUT1 can deliver |
134 120 Denis 'GNUtoo' Carikli
| Galaxy S III 4G (I9305) |
135 1 Denis 'GNUtoo' Carikli
| Galaxy Note 2 |
136
| Galaxy Note |
137 124 Denis 'GNUtoo' Carikli
| Galaxy S 2 | MAX8997 with the SAFEOUT1 regulator "[1]":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/mach-u1.c#n3486 "[2]":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/sec-switch_max8997.c#n61 | * Datasheet not found
138 122 Denis 'GNUtoo' Carikli
* The upstream driver doesn't have the information
139 123 Denis 'GNUtoo' Carikli
* Downstream drivers might have some information about how much mA SAFEOUT1 can deliver |
140 118 Denis 'GNUtoo' Carikli
| Galaxy Tab 2 7.0 | | | ? |
141
| Galaxy Tab 2 10.1 | | | ? |
142 55 Denis 'GNUtoo' Carikli
| GTA04 | | |
143 118 Denis 'GNUtoo' Carikli
| Galaxy S | | |
144 37 Denis 'GNUtoo' Carikli
| Nexus S | | |
145 55 Denis 'GNUtoo' Carikli
| Optimus Black | |
146 125 Denis 'GNUtoo' Carikli
147 126 Denis 'GNUtoo' Carikli
Moving forward:
148
* Since no documentation can be found on the Maxim Power Management ICs (PMICs) it is a good idea to do some measures to find the maximum amount of mA that can be delivered by measuring it.
149
* The "MAX77860":https://datasheets.maximintegrated.com/en/ds/MAX77860.pdf has a configurable current limit for USB OTG. It is configurable through the OTG_ILIM register which sets the limit when the device is in current sink and current source modes. It might be interesting to do some measurements and see if the chips mentioned above are similar enough and to check if the charging limit has an effect on how much mA can be delivered through the USB port in current source mode.