├── .gitignore ├── LICENSE ├── Makefile ├── README.md ├── buildtools ├── Makefile ├── arc_gcc.patch ├── arc_mpc.patch ├── gcc-nexmon-plugin │ ├── .gitignore │ ├── Makefile │ ├── include │ │ └── arc-cpus.def │ └── nexmon.c ├── qfim.py └── scripts │ ├── flashpatches.ld.awk │ ├── flashpatches.mk.awk │ ├── fw.ld.awk │ ├── fw.mk.1.awk │ ├── fw.mk.2.awk │ ├── getdefine.sh │ ├── getsectionaddr.sh │ ├── nexmon.ld.awk │ ├── uc.ld.awk │ ├── uc.mk.1.awk │ └── uc.mk.2.awk ├── firmwares └── wil6210 │ ├── 4-1-0_55 │ ├── definitions.mk │ └── structs.h │ ├── 5-2-0_18 │ ├── definitions.mk │ └── structs.h │ └── structs.common.h ├── logos ├── crisp.jpg ├── crossing.jpg ├── cysec.jpg ├── maki.png ├── nicer.png ├── seemoo.png ├── talon.png └── tudarmstadt.png ├── patches ├── .gitignore ├── common │ ├── header.mk │ ├── helper.c │ ├── hexdump.c │ ├── printf.c │ ├── putc.c │ ├── statistics.mk │ └── wrapper.c ├── include │ ├── bcmcdc.h │ ├── bcmwifi_channels.h │ ├── capabilities.h │ ├── debug.h │ ├── firmware_version.h │ ├── helper.h │ ├── ieee80211_radiotap.h │ ├── nexioctls.h │ ├── objmem.h │ ├── patcher.h │ ├── patcher.h.arm │ ├── rates.h │ ├── sendframe.h │ ├── types.h │ └── wrapper.h └── wil6210 │ ├── 4-1-0_55 │ ├── hello_world │ │ ├── Makefile │ │ ├── fw_patch.ld │ │ ├── src │ │ │ ├── fw_patch.c │ │ │ └── uc_patch.c │ │ └── uc_patch.ld │ └── sweep_info │ │ ├── Makefile │ │ ├── fw_patch.ld │ │ ├── src │ │ ├── fw_patch.c │ │ ├── sweep_info.h │ │ └── uc_sweep_info.c │ │ └── uc_patch.ld │ └── 5-2-0_18 │ ├── hello_world │ ├── Makefile │ ├── fw_patch.ld │ ├── src │ │ ├── fw_patch.c │ │ └── uc_patch.c │ └── uc_patch.ld │ └── sweep_info │ ├── Makefile │ ├── fw_patch.ld │ ├── src │ ├── fw_patch.c │ └── uc_patch.c │ └── uc_patch.ld └── setup_env.sh /.gitignore: -------------------------------------------------------------------------------- 1 | wil6210.fw 2 | linux-firmware/ 3 | .UUID 4 | buildtools/arc_gnu_2016.03_sources.tar.gz 5 | buildtools/arc_gnu_2016.03_sources/ 6 | buildtools/arc_gnu_bin/ -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | all: fetch buildtools 2 | 3 | fetch: 4 | mkdir linux-firmware 5 | @printf "\033[0;31m DOWNLOADING FIRMWARE VERSION 4.1.0.55\033[0m\n" 6 | cd linux-firmware; git init; \ 7 | git remote add origin git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git; \ 8 | git fetch; \ 9 | git checkout 936b035d5ec7225c20d86784edeb8b3146194405 wil6210.fw 10 | cp linux-firmware/wil6210.* firmwares/wil6210/4-1-0_55/ 11 | @printf "\033[0;31m DOWNLOADING FIRMWARE VERSION 5.2.0.18\033[0m\n" 12 | cd linux-firmware; \ 13 | git checkout b562d2f3583f19ecda22b08e514ced57dd1e5f4d wil6210.fw 14 | cp linux-firmware/wil6210.* firmwares/wil6210/5-2-0_18/ 15 | rm -rf linux-firmware 16 | 17 | buildtools: FORCE 18 | @printf "\033[0;31m BUILDING BUILDTOOLS\033[0m\n" 19 | $(Q)make -C $@ 20 | 21 | FORCE: 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Nexmon for ARC 2 | 3 | This is the nexmon C-based firmware patching framework adapted for the ARC architecture, that enables you to write your own firmware patches for ARC based WiFi chips such as the QCA9500. 4 | 5 | ## Getting Started 6 | The following explained how to use nexmon-arc and compile our hello world application for the wil6210 firmware v4.1.0.55, which prints a debug output that is readable from the device driver. The following instructions have been tested with Ubuntu 16.04.03. 7 | 8 | ### Setting up the environment (needs to be done only once) 9 | * Installing dependencies (mostly for the ARC toolchain): 10 | 11 | ```bash 12 | sudo apt-get install texinfo byacc flex libncurses5-dev zlib1g-dev libexpat1-dev texlive build-essential git wget bison gawk libgmp3-dev 13 | ``` 14 | 15 | * Run `make` in the root directory, this will download the original firmware and compile the ARC toolchain. 16 | 17 | ### Patch the firmware 18 | * Setup the build environment for Nexmon: 19 | 20 | ```bash 21 | source setup_env.sh 22 | ``` 23 | 24 | * Go to the hello world example in the patches directory and execute `make`. This will build a patched firmware which prints a string at the initialization time of the fw and uc code. 25 | 26 | ```bash 27 | cd patches/wil6210/4-1-0_55/hello_world 28 | make 29 | ``` 30 | * Copy the resulting `wil6210.fw` to your device (the default place in the filesystem is `/lib/firmware/wil6210.fw`) 31 | * Restart the interface (executed on the device): 32 | 33 | ```bash 34 | ifconfig wlan2 down && ifconfig wlan2 up 35 | ``` 36 | * You should be able to get the following results by reading the `console_fw` and `console_uc` files in the debugfs: 37 | 38 | ```bash 39 | root@TALON1:~# cat /sys/kernel/debug/ieee80211/phy2/wil6210/console_dump_fw 40 | FW: INITIALIZED 41 | root@TALON1:~# cat /sys/kernel/debug/ieee80211/phy2/wil6210/console_dump_uc 42 | UC: INITIALIZED 43 | ``` 44 | 45 | The `console_fw` and `console_uc` debugfs interfaces are custom extensions of the wil6210 driver that allow to read the output buffer from the firmware. This function is integrated in our [lede-ad7200](https://github.com/seemoo-lab/lede-ad7200) image for TP-Link Talon AD7200 devices and provided by [this](https://github.com/seemoo-lab/lede-ad7200/blob/release/overlay/seemoo/mac80211/patches/0002-adding-support-to-read-console-output.patch) patch. 46 | 47 | ## Access the received signal strength of sector sweep frames 48 | 49 | The following explained how to use nexmon-arc to gain access to the signal strength of received sector sweep frames in wil6210 firmware v4.1.0.55, and v5.2.0.18 and make it readable from our extended wil6210 device driver. The following instructions have been tested with Ubuntu 16.04.03. 50 | 51 | * Choose the firmware you aim to work with either v4.1.0.55 or v5.2.0.18 are supported. 52 | * Go to the sweep_info example in the patches directory and execute `make`. This will build a patched firmware which keeps information on received sweep frames in a buffer in the uc code. 53 | 54 | ```bash 55 | cd patches/wil6210/4-1-0_55/sweep_info 56 | make 57 | ``` 58 | * Copy the resulting `wil6210.fw` to your device (the default place in the filesystem is `/lib/firmware/wil6210.fw`) 59 | * Restart the interface (executed on the device): 60 | 61 | ```bash 62 | ifconfig wlan2 down && ifconfig wlan2 up 63 | ``` 64 | * You should be able to see a table of results by reading the `sweep_dump` files in the debugfs: 65 | 66 | ```bash 67 | root@TALON1:~# cat /sys/kernel/debug/ieee80211/phy2/wil6210/sweep_dump 68 | ``` 69 | 70 | The `sweep_dump` debugfs interface is a custom extension for the wil6210 driver that allow to read the signal strength of received sector sweep frames from the firmware. This function is integrated in our [lede-ad7200](https://github.com/seemoo-lab/lede-ad7200) image for TP-Link Talon AD7200 devices. 71 | Please check the version of the wil6210 firmware that is running in your LEDE system. Running a new firmware with an old driver might cause errors. You should keep the same version or update both the extended device driver and the patched firmware to the most recent release. 72 | 73 | ### Write your own patch 74 | To write your own patches, check the example files in *patches/wil6210/4-1-0_55/hello_world/src* and consider the original [Nexmon](https://nexmon.org) project for further documentation on the patching process. 75 | 76 | ## DISCLAIMER 77 | This software might damage your hardware and may void your hardware’s warranty. You use our tools at your risk and responsibility. 78 | 79 | You acknowledge that you are solely responsible for how you use the software, & for complying with all relevant laws in your area. 80 | You also acknowledge that neither of the developers of nexmon-arc nor any of its affiliates & associates may be held liable, 81 | responsible or accountable for any type of damage, litigation or other legal action, which may arise either from your legal or 82 | illegal use of nexmon-arc, or any other software. We do not tolerate the use of our software for any illegal purpose. 83 | By using our software in any way, you acknowledge & approve to use it exclusively in a lawful manner. 84 | 85 | ## Statistics 86 | Nexmon is mainly intended as a research project that we share with the community so that others can benefit from our tools. 87 | We want to collect statistics to figure out how often Nexmon is used in general and which platform and firmware version is the most popular. 88 | We also intent to share our findings in the future. For further information please check the original [Nexmon](https://nexmon.org) project page. 89 | 90 | ### What kind of statistics do you collect? 91 | 92 | Every time you run a Nexmon firmware build, we collect the following information: 93 | * A unique identifier based on a random number (e.g., 5O31UY9Z5IEX3O9KL680V5IHNASIE1SB) 94 | * The name, release, machine and processor of your build system (`uname -srmp`, e.g., `Linux 4.2.0-42-generic x86_64 x86_64`) 95 | * Git internal path to the built project (e.g., `patches/wil6210/4-1-0_55/hello_world/`) 96 | * Git version (e.g., `2.2.1-55-g3684a80c-dirty`) 97 | * Git repository URL (e.g., `git@github.com:seemoo-lab/nexmon-arc.git`) 98 | 99 | ### How do I disable the collection of statistics? 100 | 101 | If you have privacy concerns, we also offer to opt-out of the statistic collections. To this end, you simply have to create a `DISABLE_STATISTICS` file in your Nexmon root directory. 102 | 103 | ## Talon Tools 104 | This software has been released as part of [Talon Tools: The Framework for Practical IEEE 802.11ad Research](https://seemoo.de/talon-tools/). Any use of it, which results in an academic publication or other publication which includes a bibliography is encouraged to appreciate this work and include a citation the Talon Tools project and any of our papers. You can find all references on Talon Tools in our [bibtex file](https://seemoo-lab.github.io/talon-tools/talon-tools.bib). Please also check the [project page](https://seemoo.de/talon-tools/) for supplemental tools. 105 | 106 | ## Give us Feedback 107 | We want to learn how people use our platform and what aspects we might improve. Please report any issues or comments using the bug-tracker and do not hesitate to approach us via e-mail. 108 | 109 | ## Authors 110 | * [Daniel Steinmetzer](https://seemoo.tu-darmstadt.de/dsteinmetzer) <> 111 | * Daniel Wegemer <> 112 | * [Matthias Schulz](https://seemoo.tu-darmstadt.de/mschulz) <> 113 | 114 | ## Powered By 115 | ![SEEMOO logo](logos/seemoo.png)   116 | ![NICER logo](logos/nicer.png)   117 | ![CROSSING logo](logos/crossing.jpg)  118 | ![CRSIP logo](logos/crisp.jpg)  119 | ![MAKI logo](logos/maki.png)   120 | ![CYSEC logo](logos/cysec.jpg)  121 | ![TU Darmstadt logo](logos/tudarmstadt.png)  122 | -------------------------------------------------------------------------------- /buildtools/Makefile: -------------------------------------------------------------------------------- 1 | all: download unpack patch build gcc-nexmon-plugin 2 | 3 | download: FORCE 4 | if [ ! -f "arc_gnu_2016.03_sources.tar.gz" ]; then \ 5 | wget https://github.com/foss-for-synopsys-dwc-arc-processors/toolchain/releases/download/arc-2016.03/arc_gnu_2016.03_sources.tar.gz; \ 6 | fi 7 | 8 | unpack: FORCE 9 | if [ ! -d "arc_gnu_2016.03_sources/" ]; then \ 10 | tar xfvz arc_gnu_2016.03_sources.tar.gz; \ 11 | fi 12 | 13 | patch: FORCE 14 | patch arc_gnu_2016.03_sources/gcc/gcc/config/arc/arc.c < arc_gcc.patch 15 | patch arc_gnu_2016.03_sources/toolchain/arc-external.sh < arc_mpc.patch 16 | 17 | build: FORCE 18 | cd arc_gnu_2016.03_sources/toolchain/ && ./build-all.sh --cpu arc600 --install-dir ../../arc_gnu_bin --no-uclibc --no-multilib --no-pdf 19 | 20 | gcc-nexmon-plugin: FORCE 21 | $(Q)make -C $@ 22 | 23 | FORCE: 24 | -------------------------------------------------------------------------------- /buildtools/arc_gcc.patch: -------------------------------------------------------------------------------- 1 | --- arc.c 2 | +++ arc.c 3 | @@ -3213,11 +3213,7 @@ 4 | 5 | /* Naked functions don't have epilogue. */ 6 | if (ARC_NAKED_P (fn_type)) 7 | - { 8 | - if (sibcall_p == FALSE) 9 | - emit_jump_insn (gen_simple_return ()); 10 | return; 11 | - } 12 | 13 | size = arc_compute_frame_size (); 14 | 15 | -------------------------------------------------------------------------------- /buildtools/arc_mpc.patch: -------------------------------------------------------------------------------- 1 | --- arc-external.sh 2 | +++ arc-external.sh 3 | @@ -26,7 +26,7 @@ 4 | urls=' 5 | https://gmplib.org/download/gmp/gmp-5.1.3.tar.bz2 6 | http://www.mpfr.org/mpfr-3.1.2/mpfr-3.1.2.tar.bz2 7 | -http://www.multiprecision.org/mpc/download/mpc-1.0.1.tar.gz 8 | +https://ftp.gnu.org/gnu/mpc/mpc-1.0.1.tar.gz 9 | ' 10 | 11 | for url in ${urls} ; do -------------------------------------------------------------------------------- /buildtools/gcc-nexmon-plugin/.gitignore: -------------------------------------------------------------------------------- 1 | nexmon.o 2 | nexmon.so 3 | -------------------------------------------------------------------------------- /buildtools/gcc-nexmon-plugin/Makefile: -------------------------------------------------------------------------------- 1 | all: nexmon.so 2 | 3 | nexmon.so: nexmon.o 4 | g++ -m64 -shared -o $@ $< 5 | 6 | nexmon.o: nexmon.c 7 | g++ -std=c++11 -Wall -fno-rtti -Wno-literal-suffix -m64 -fPIC -I../arc_gnu_bin/lib/gcc/arc-elf32/4.8.5/plugin/include -I./include -c -o $@ $< 8 | 9 | clean: 10 | rm -f *.o *.so 11 | -------------------------------------------------------------------------------- /buildtools/gcc-nexmon-plugin/include/arc-cpus.def: -------------------------------------------------------------------------------- 1 | /* ARC CPU architectures. 2 | Copyright (C) 2016 Free Software Foundation, Inc. 3 | 4 | This file is part of GCC. 5 | 6 | GCC is free software; you can redistribute it and/or modify it 7 | under the terms of the GNU General Public License as published 8 | by the Free Software Foundation; either version 3, or (at your 9 | option) any later version. 10 | 11 | GCC is distributed in the hope that it will be useful, but WITHOUT 12 | ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 13 | or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public 14 | License for more details. 15 | 16 | You should have received a copy of the GNU General Public License 17 | along with GCC; see the file COPYING3. If not see 18 | . */ 19 | 20 | ARC_CPU (em, em, 0, NONE) 21 | ARC_CPU (arcem, em, FL_MPYOPT_2|FL_CD|FL_BS, NONE) 22 | ARC_CPU (em4, em, FL_CD, NONE) 23 | ARC_CPU (em4_dmips, em, FL_MPYOPT_2|FL_CD|FL_DIVREM|FL_NORM|FL_SWAP|FL_BS, NONE) 24 | ARC_CPU (em4_fpus, em, FL_MPYOPT_2|FL_CD|FL_DIVREM|FL_NORM|FL_SWAP|FL_BS|FL_FPU_FPUS, NONE) 25 | ARC_CPU (em4_fpuda, em, FL_MPYOPT_2|FL_CD|FL_DIVREM|FL_NORM|FL_SWAP|FL_BS|FL_FPU_FPUDA, NONE) 26 | ARC_CPU (quarkse_em, em, FL_MPYOPT_3|FL_CD|FL_DIVREM|FL_NORM|FL_SWAP|FL_BS|FL_FPX_QUARK|FL_SPFP|FL_DPFP, NONE) 27 | 28 | ARC_CPU (hs, hs, 0, NONE) 29 | ARC_CPU (archs, hs, FL_MPYOPT_2|FL_DIVREM|FL_LL64, NONE) 30 | ARC_CPU (hs34, hs, FL_MPYOPT_2, NONE) 31 | ARC_CPU (hs38, hs, FL_MPYOPT_9|FL_DIVREM|FL_LL64, NONE) 32 | ARC_CPU (hs38_linux, hs, FL_MPYOPT_9|FL_DIVREM|FL_LL64|FL_FPU_FPUD_ALL, NONE) 33 | 34 | ARC_CPU (arc600, 6xx, FL_BS, ARC600) 35 | ARC_CPU (arc600_norm, 6xx, FL_BS|FL_NORM, ARC600) 36 | ARC_CPU (arc600_mul64, 6xx, FL_BS|FL_NORM|FL_MUL64, ARC600) 37 | ARC_CPU (arc600_mul32x16, 6xx, FL_BS|FL_NORM|FL_MUL32x16, ARC600) 38 | ARC_CPU (arc601, 6xx, 0, ARC600) 39 | ARC_CPU (arc601_norm, 6xx, FL_NORM, ARC600) 40 | ARC_CPU (arc601_mul64, 6xx, FL_NORM|FL_MUL64, ARC600) 41 | ARC_CPU (arc601_mul32x16, 6xx, FL_NORM|FL_MUL32x16, ARC600) 42 | 43 | ARC_CPU (arc700, 700, 0, ARC700_4_2_STD) 44 | -------------------------------------------------------------------------------- /buildtools/gcc-nexmon-plugin/nexmon.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | //#include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | static tree handle_nexmon_place_at_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attr); 10 | 11 | int plugin_is_GPL_compatible = 1; 12 | 13 | static const char *objfile = "patch.o"; 14 | static const char *fwfile = "fw_bcmdhd.bin"; 15 | static const char *prefile = "nexmon.generated.pre"; 16 | static const char *targetregion = NULL; 17 | static unsigned int ramstart = 0x180000; 18 | static unsigned int chipver = 0; 19 | static unsigned int fwver = 0; 20 | 21 | static FILE *pre_fp; 22 | 23 | static struct attribute_spec user_attr = 24 | { 25 | .name = "at", 26 | .min_length = 1, 27 | .max_length = 4, 28 | .decl_required = true, 29 | .type_required = false, 30 | .function_type_required = false, 31 | .handler = handle_nexmon_place_at_attribute, 32 | .affects_type_identity = false, 33 | }; 34 | 35 | static tree 36 | handle_nexmon_place_at_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attr) 37 | { 38 | //tree itr; 39 | tree tmp_tree; 40 | 41 | const char *decl_name = IDENTIFIER_POINTER(DECL_NAME(*node)); 42 | //const char *attr_name = IDENTIFIER_POINTER(name); 43 | //const char *param1_str = TREE_STRING_POINTER(TREE_VALUE(args)); 44 | const char *region = NULL; 45 | unsigned int addr = 0; 46 | bool is_dummy = false; 47 | bool is_region = false; 48 | bool is_flashpatch = false; 49 | unsigned int chipver_local = 0; 50 | unsigned int fwver_local = 0; 51 | 52 | if (TREE_CODE(TREE_VALUE(args)) == STRING_CST) { 53 | region = TREE_STRING_POINTER(TREE_VALUE(args)); 54 | is_region = true; 55 | } else if (TREE_CODE(TREE_VALUE(args)) == INTEGER_CST) { 56 | addr = TREE_INT_CST_LOW(TREE_VALUE(args)); 57 | } 58 | 59 | tmp_tree = TREE_CHAIN(args); 60 | if(tmp_tree != NULL_TREE) { 61 | is_dummy = strstr(TREE_STRING_POINTER(TREE_VALUE(tmp_tree)), "dummy"); 62 | is_flashpatch = strstr(TREE_STRING_POINTER(TREE_VALUE(tmp_tree)), "flashpatch"); 63 | 64 | tmp_tree = TREE_CHAIN(tmp_tree); 65 | if(tmp_tree != NULL_TREE) { 66 | chipver_local = TREE_INT_CST_LOW(TREE_VALUE(tmp_tree)); 67 | 68 | tmp_tree = TREE_CHAIN(tmp_tree); 69 | if(tmp_tree != NULL_TREE) { 70 | fwver_local = TREE_INT_CST_LOW(TREE_VALUE(tmp_tree)); 71 | } 72 | } 73 | } 74 | 75 | printf("decl_name: %s\n", decl_name); 76 | 77 | //printf("attr_name: %s\n", attr_name); 78 | DECL_COMMON_CHECK (*node)->decl_common.align = 8; 79 | 80 | //printf("align: %d\n", DECL_COMMON_CHECK (*node)->decl_common.align); 81 | //if (DECL_COMMON_CHECK (*node)->decl_common.align == 32 && (addr & 1)) 82 | // DECL_COMMON_CHECK (*node)->decl_common.align = 8; 83 | 84 | //if (DECL_COMMON_CHECK (*node)->decl_common.align == 32 && (addr & 2)) 85 | // DECL_COMMON_CHECK (*node)->decl_common.align = 16; 86 | printf("align: %d\n", DECL_COMMON_CHECK (*node)->decl_common.align); 87 | 88 | //for(itr = args; itr != NULL_TREE; itr = TREE_CHAIN(itr)) { 89 | // printf("arg: %s %08x\n", TREE_STRING_POINTER(TREE_VALUE(itr)), (unsigned int) strtol(TREE_STRING_POINTER(TREE_VALUE(itr)), NULL, 0)); 90 | //debug_tree(itr); 91 | //debug_tree(TREE_VALUE(itr)); 92 | //} 93 | 94 | if ((chipver == 0 || chipver_local == 0 || chipver == chipver_local) && (fwver == 0 || fwver_local == 0 || fwver == fwver_local)) { 95 | if (is_region) { 96 | fprintf(pre_fp, "%s REGION %s %s\n", region, objfile, decl_name); 97 | } else if (is_flashpatch) { 98 | fprintf(pre_fp, "0x%08x FLASHPATCH %s %s\n", addr, objfile, decl_name); 99 | } else if (is_dummy) { 100 | fprintf(pre_fp, "0x%08x DUMMY %s %s\n", addr, objfile, decl_name); 101 | } else { 102 | fprintf(pre_fp, "0x%08x PATCH %s %s\n", addr, objfile, decl_name); 103 | } 104 | } 105 | 106 | //debug_tree(*node); 107 | //debug_tree(name); 108 | return NULL_TREE; 109 | } 110 | 111 | static void 112 | register_attributes(void *event_data, void *data) 113 | { 114 | register_attribute(&user_attr); 115 | } 116 | 117 | static void 118 | handle_pragma_targetregion(cpp_reader *dummy) 119 | { 120 | tree message = 0; 121 | if (pragma_lex(&message) != CPP_STRING) { 122 | printf ("<#pragma NEXMON targetregion> is not a string"); 123 | return; 124 | } 125 | 126 | if (TREE_STRING_LENGTH (message) > 1) { 127 | targetregion = TREE_STRING_POINTER (message); 128 | fprintf(pre_fp, "%s TARGETREGION %s\n", targetregion, objfile); 129 | } 130 | } 131 | 132 | static void 133 | register_pragmas(void *event_data, void *data) 134 | { 135 | c_register_pragma("NEXMON", "targetregion", handle_pragma_targetregion); 136 | } 137 | 138 | static void 139 | handle_plugin_finish(void *event_data, void *data) 140 | { 141 | fclose(pre_fp); 142 | } 143 | 144 | int 145 | plugin_init(struct plugin_name_args *info, struct plugin_gcc_version *ver) 146 | { 147 | int i = 0; 148 | for (i = 0; i < info->argc; i++) { 149 | if (!strcmp(info->argv[i].key, "objfile")) { 150 | objfile = info->argv[i].value; 151 | } else if (!strcmp(info->argv[i].key, "prefile")) { 152 | prefile = info->argv[i].value; 153 | } else if (!strcmp(info->argv[i].key, "fwfile")) { 154 | fwfile = info->argv[i].value; 155 | } else if (!strcmp(info->argv[i].key, "ramstart")) { 156 | ramstart = (unsigned int) strtol(info->argv[i].value, NULL, 0); 157 | } else if (!strcmp(info->argv[i].key, "chipver")) { 158 | chipver = (unsigned int) strtol(info->argv[i].value, NULL, 0); 159 | } else if (!strcmp(info->argv[i].key, "fwver")) { 160 | fwver = (unsigned int) strtol(info->argv[i].value, NULL, 0); 161 | } 162 | } 163 | 164 | pre_fp = fopen(prefile, "a"); 165 | 166 | if (!pre_fp) { 167 | fprintf(stderr, "gcc_nexmon_plugin: Pre file not writeable! (error)\n"); 168 | return -1; 169 | } 170 | 171 | register_callback("nexmon", PLUGIN_ATTRIBUTES, register_attributes, NULL); 172 | register_callback("nexmon", PLUGIN_PRAGMAS, register_pragmas, NULL); 173 | register_callback("nexmon", PLUGIN_FINISH, handle_plugin_finish, NULL); 174 | 175 | return 0; 176 | } 177 | -------------------------------------------------------------------------------- /buildtools/qfim.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import argparse 4 | import binascii 5 | import os 6 | import struct 7 | import math 8 | 9 | 10 | def image_read(filename): 11 | if os.path.exists(filename): 12 | with open(filename, 'rb') as f: 13 | data = f.read() 14 | return bytearray(data) 15 | print('Error: Unable to open file ', filename) 16 | exit(0) 17 | 18 | 19 | def image_write(data, filename): 20 | with open(filename, 'wb') as f: 21 | f.write(data) 22 | 23 | 24 | # Determines the offsets of records in data 25 | def get_record_offsets(data): 26 | offset = 0, 27 | while offset[-1] < len(data): 28 | r = struct.unpack('H H I', data[offset[-1]:(offset[-1] + 8)]) 29 | offset += (offset[-1] + r[2] + 8), 30 | if not offset[-1] == len(data): 31 | print('Error, malformatted firmware image') 32 | exit(0) 33 | return offset[0:-1] 34 | 35 | 36 | def recordtype_to_str(r): 37 | if r == 1: 38 | return 'COMM' 39 | if r == 2: 40 | return 'DATA' 41 | if r == 3: 42 | return 'FILL' 43 | if r == 4: 44 | return 'ACTN' 45 | if r == 5: 46 | return 'VERI' 47 | if r == 6: 48 | return 'HEAD' 49 | if r == 7: 50 | return 'DWRI' 51 | if r == 8: 52 | return 'GDAT' 53 | if r == 9: 54 | return 'GDA4' 55 | return None 56 | 57 | 58 | def get_record_head(data, roffsets, n): 59 | ro = roffsets[n] 60 | s = struct.unpack('H H I', data[ro:(ro + 8)]) 61 | rstr = recordtype_to_str(s[0]) 62 | if not rstr: 63 | print('Error: malformatted firmware image, unknown record type') 64 | exit(0) 65 | 66 | str = ' %2d: 0x%06x %1d %4s %04x %6d '\ 67 | % (n, ro, s[0], rstr, s[1], s[2]) 68 | 69 | # Append comment by Partition Type 70 | if s[0] == 2: 71 | raddr = struct.unpack('I', data[(ro + 8):(ro + 12)])[0] 72 | str += 'Write [%06x : %06x]' % (raddr, raddr + s[2] - 4) 73 | elif s[0] == 6: 74 | cmt = struct.unpack('4s I I I I 32s', data[(ro + 8):(ro + 60)]) 75 | if not cmt[0] == b'0126': 76 | print('Error: malformatted firmware image, magic failed') 77 | str += 'CRC: 0x%08x V: %1d Len: %6d %s' %\ 78 | (cmt[2], cmt[3], cmt[4], cmt[5]) 79 | return str 80 | 81 | 82 | def print_record_table(data, roffsets): 83 | print(' R Offset Type Flgs Size Contents') 84 | for n in range(0, len(roffsets)): 85 | print(get_record_head(data, roffsets, n)) 86 | 87 | 88 | def update_headerlength(data): 89 | # Obtain the length of the data array 90 | l_data = len(data) 91 | 92 | # Obtain the length of all data records 93 | l_records = 0 94 | ro = get_record_offsets(data) 95 | for n in range(0, len(ro)): 96 | s = struct.unpack('I', data[(ro[n] + 4):(ro[n] + 8)]) 97 | l_records += s[0] + 8 98 | 99 | if l_data == l_records: 100 | # Data size matches, write to header field 101 | data[24:28] = struct.pack('I', l_data) 102 | else: 103 | print('Error: malformatted firmware image, wrong length') 104 | exit(0) 105 | 106 | 107 | def update_crc(data, crc_new=None): 108 | # Read the old CRC value 109 | # crc_old = struct.unpack('I', data[16:20])[0] 110 | 111 | if crc_new is None: 112 | # Compute a new CRC value 113 | # Set crc to zero (temporary) and calculate crc 114 | data[16:20] = struct.pack('I', 0) 115 | crc_new = binascii.crc32(data) 116 | 117 | # print('Updating CRC: 0x%08x -> 0x%08x' % (crc_old, crc_new)) 118 | 119 | # Update the CRC field 120 | data[16:20] = struct.pack('I', crc_new) 121 | 122 | 123 | def cmd_set_data(imgdata, payload, ro): 124 | 125 | s = struct.unpack('H H I I', imgdata[ro:(ro + 12)]) 126 | 127 | if not s[0] == 2: 128 | print('Error, setting data requires a data type record') 129 | exit(0) 130 | 131 | # Overwrite the Payload 132 | imgdata[(ro + 12):(ro + s[2] + 8)] = payload 133 | 134 | # Update the Record Length 135 | imgdata[(ro + 4):(ro + 8)] = struct.pack('I', len(payload) + 4) 136 | 137 | 138 | def cmd_get_data(imgdata, ro): 139 | 140 | s = struct.unpack('H H I I', imgdata[ro:(ro + 12)]) 141 | 142 | if not s[0] == 2: 143 | print('Error, getting data requires a data type record') 144 | exit(0) 145 | 146 | # Overwrite the Payload 147 | return imgdata[(ro + 12):(ro + s[2] + 8)] 148 | 149 | 150 | def cmd_print_dwrite_data(data, ro): 151 | h = struct.unpack('H H I', imgdata[ro:(ro + 8)]) 152 | entries = list() 153 | r = ro + 8 154 | 155 | while r < (ro + 8 + h[2]): 156 | entry = struct.unpack('I I I', imgdata[r:(r + 12)]) 157 | entries.append(entry) 158 | r += 12 159 | 160 | print('ADDR\tVALUE\tMASK') 161 | for e in entries: 162 | str = '0x%08x\t0x%08x\t0x%08x\t' % (e[0], e[1], e[2]) 163 | 164 | nmask = ~e[2] & 0xffffffff 165 | rmb = int(math.log2(nmask ^ (nmask & (nmask - 1))) + 1) 166 | 167 | value = (e[1] & nmask) >> (rmb - 1) 168 | 169 | blen = int(math.log2((nmask >> (rmb - 1)) + 1)) 170 | 171 | str += '%2dBit Value: %8x (%d)\t' % (blen, value, value) 172 | print(str) 173 | 174 | 175 | def cmd_get_fw_capabilities(data, ro): 176 | # Look for a comment record 177 | for r in ro: 178 | h = struct.unpack('H H I', imgdata[r:(r + 8)]) 179 | if h[0] == 1: 180 | magic = struct.unpack('I', imgdata[(r + 8):(r + 12)]) 181 | if magic[0] == 0xabcddcba: 182 | 183 | # Found a capabilities entry 184 | cap = struct.unpack('I', imgdata[(r + 12):(r + 16)]) 185 | return cap 186 | return 0 187 | 188 | 189 | def cmd_set_fw_capabilities(data, ro, capabilities): 190 | # Look if a capabiltiies record is already present 191 | for r in ro: 192 | h = struct.unpack('H H I', imgdata[r:(r + 8)]) 193 | if h[0] == 1: 194 | magic = struct.unpack('I', imgdata[(r + 8):(r + 12)]) 195 | if magic[0] == 0xabcddcba: 196 | # Found record, just change the capabilites 197 | cap = struct.unpack('I', imgdata[(r + 12):(r + 16)])[0] 198 | imgdata[(r + 12):(r + 16)] = struct.pack('I', int(capabilities) | cap) 199 | return 200 | 201 | print('Adding new reccord') 202 | print(capabilities) 203 | # If not append a new capability record 204 | record = bytearray( 205 | b'\x01\x00\x00\x00\x08\x00\x00\x00\xba\xdc\xcd\xab\x00\x00\x00\x00') 206 | record[12:16] = struct.pack('I', int(capabilities)) 207 | print(len(record)) 208 | data += record 209 | return 210 | 211 | 212 | # def cmd_get(fwfile, ofile, record, rawdump): 213 | # if record is None: 214 | # print('No record id specified') 215 | # exit(0) 216 | # data = image_read(fwfile) 217 | # ro = get_record_offset(data, record) 218 | 219 | # # Extract the record data 220 | # rdata = data[ro[-2]:ro[-1]] 221 | 222 | # print('Extracting record %d [%08x:%08x]' % (record, ro[-2], ro[-1])) 223 | 224 | # if rawdump: 225 | # # Dump the raw record data 226 | # image_write(rdata, ofile) 227 | 228 | # else: 229 | # # Parse only the payload of the file 230 | # rr = struct.unpack('H H I', rdata[0:8]) 231 | # rtype = rr[0] 232 | # # rsize = rr[2] 233 | 234 | # if rtype == 2: 235 | # # Parse data record 236 | # rr = struct.unpack('I', rdata[8:12]) 237 | # raddress = rr[0] 238 | # rpayload = rdata[12:len(rdata)] 239 | 240 | # print('Destination address: 0x%08x' % raddress) 241 | 242 | # image_write(rpayload, ofile) 243 | 244 | # else: 245 | # # Parse different record 246 | # print('not supported yet, use rawdump flag instead') 247 | # exit(0) 248 | 249 | 250 | # def cmd_set(fwfile, ofile, record, rtype, rawdump, raddr): 251 | # if record is None: 252 | # print('No record id specified') 253 | # exit(0) 254 | # data = image_read(fwfile) 255 | # ro = get_record_offset(data, record) 256 | 257 | # # Load the record data 258 | # rpayload = image_read(ofile) 259 | 260 | # print('Overwriting record %d [%08x:%08x]' % (record, ro[-2], ro[-1])) 261 | 262 | # if rawdump: 263 | # # Directly overwrite the data 264 | # data[ro[-2]:ro[-1]] = rpayload 265 | 266 | # else: 267 | # # The object file just containts payload, add header arround 268 | # if rtype == 2: 269 | # rsize = len(rpayload) + 4 270 | # rheader = struct.pack('H H I I', rtype, 0, rsize, raddr) 271 | # else: 272 | # print('not supported yet, use rawdump flag instead') 273 | # exit(0) 274 | 275 | # data[ro[-2]:ro[-1]] = rheader + rpayload 276 | 277 | # update_headerlength(data) 278 | # update_crc(data) 279 | 280 | # image_write(data, fwfile) 281 | 282 | 283 | # def cmd_delete(fwfile, record): 284 | # if record is None: 285 | # print('No record id specified') 286 | # exit(0) 287 | # data = image_read(fwfile) 288 | # ro = get_record_offset(data, record) 289 | 290 | # # Overwrite record with empty byte array 291 | # data[ro[-2]:ro[-1]] = bytearray(0) 292 | 293 | # update_headerlength(data) 294 | # update_crc(data) 295 | 296 | # print('Removing record %d [%08x:%08x]' % (record, ro[-2], ro[-1])) 297 | # image_write(data, fwfile) 298 | 299 | 300 | # def cmd_insert(fwfile, ofile, record): 301 | # if record is None: 302 | # print('No record id specified') 303 | # exit(0) 304 | # data = image_read(fwfile) 305 | # ro = get_record_offset(data, record) 306 | 307 | # # Load the record data 308 | # rdata = image_read(ofile) 309 | 310 | # data[ro[-2]:ro[-2]] = rdata 311 | 312 | # update_headerlength(data) 313 | # update_crc(data) 314 | 315 | # print('Inserting record %d [%08x:%08x]' % (record, ro[-2], ro[-1])) 316 | 317 | # image_write(data, fwfile) 318 | 319 | 320 | # def cmd_crc(fwfile, crc): 321 | # data = image_read(fwfile) 322 | # update_crc(data, crc) 323 | # image_write(data, fwfile) 324 | 325 | 326 | if __name__ == "__main__": 327 | parser = argparse.ArgumentParser( 328 | prog='QFIM', 329 | description='QCA9500 Firmware Image Manager \ 330 | changes records in wil6210 firmware files.') 331 | 332 | parser.add_argument('cmd', nargs='*', type=str, default=['list']) 333 | parser.add_argument('--filein', default='wil6210.fw') 334 | parser.add_argument('--fileout', default='wil6210_repacked.fw') 335 | parser.add_argument('-r', '--recordid', type=int) 336 | parser.add_argument('-d', '--datafile', type=str, default='wildata') 337 | parser.add_argument('--dsize', type=int, default='-1') 338 | parser.add_argument('-c', '--capabilities', default=0) 339 | args = parser.parse_args() 340 | # print(args) 341 | 342 | fw_write = False 343 | 344 | # Read the firmware image 345 | imgdata = image_read(args.filein) 346 | 347 | # Obtain the record offsets 348 | records = get_record_offsets(imgdata) 349 | 350 | if args.cmd[0] == 'list': 351 | print_record_table(imgdata, records) 352 | 353 | elif args.cmd[0] == 'set': 354 | if args.cmd[1] == 'data': 355 | # SET DATA COMMAND 356 | payload = image_read(args.datafile) 357 | if args.dsize is not -1: 358 | if len(payload) > args.dsize: 359 | print('Error, data too big') 360 | exit(0) 361 | else: 362 | padding = bytearray(args.dsize - len(payload)) 363 | payload += padding 364 | cmd_set_data(imgdata, payload, records[args.recordid]) 365 | fw_write = True 366 | 367 | elif args.cmd[1] == 'capabilities': 368 | cmd_set_fw_capabilities(imgdata, records, args.capabilities) 369 | fw_write = True 370 | 371 | elif args.cmd[0] == 'get': 372 | if args.cmd[1] == 'data': 373 | # GET DATA COMMAND 374 | payload = cmd_get_data(imgdata, records[args.recordid]) 375 | image_write(payload, args.datafile) 376 | 377 | elif args.cmd[1] == 'dwrite': 378 | # Get dwrite Data 379 | cmd_print_dwrite_data(imgdata, records[args.recordid]) 380 | 381 | elif args.cmd[1] == 'capabilities': 382 | cap = cmd_get_fw_capabilities(imgdata, records) 383 | print('0x%04x' % cap) 384 | 385 | # Write the firmware image to file, if necessary 386 | if fw_write: 387 | update_headerlength(imgdata) 388 | update_crc(imgdata) 389 | image_write(imgdata, args.fileout) 390 | -------------------------------------------------------------------------------- /buildtools/scripts/flashpatches.ld.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "FLASHPATCH") 3 | print ".text." $4 " " $1 " : { KEEP(" $3 " (.*." $4 ")) }"; 4 | } 5 | -------------------------------------------------------------------------------- /buildtools/scripts/flashpatches.mk.awk: -------------------------------------------------------------------------------- 1 | function htonl(a) { 2 | return rshift(and(a, 0xff000000), 24) + rshift(and(a, 0xff0000), 8) + lshift(and(a, 0xff00), 8) + lshift(and(a, 0xff), 24); 3 | } 4 | BEGIN { 5 | fp_data_base = strtonum(fp_data_base); 6 | fp_config_base = strtonum(fp_config_base); 7 | fp_data_end_ptr = strtonum(fp_data_end_ptr); 8 | fp_config_base_ptr_1 = strtonum(fp_config_base_ptr_1); 9 | fp_config_end_ptr_1 = strtonum(fp_config_end_ptr_1); 10 | fp_config_base_ptr_2 = strtonum(fp_config_base_ptr_2); 11 | fp_config_end_ptr_2 = strtonum(fp_config_end_ptr_2); 12 | ramstart = strtonum(ramstart); 13 | 14 | fp_data_end = fp_data_base; 15 | fp_config_end = fp_config_base; 16 | 17 | printf "%s: %s FORCE\n", out_file, src_file; 18 | } 19 | { 20 | if ($2 == "FLASHPATCH") { 21 | printf "\t$(Q)$(CC)objcopy -O binary -j .text." $4 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", fp_data_end, ramstart; 22 | printf "\t$(Q)printf %08x%08x%08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(strtonum($1)), htonl(4), htonl(fp_data_end), fp_config_end, ramstart; 23 | printf "\t$(Q)printf \" FLASHPATCH %s @ %s\\n\"\n", $4, $1; 24 | fp_data_end = fp_data_end + 8; 25 | fp_config_end = fp_config_end + 12; 26 | } 27 | } 28 | END { 29 | printf "\t$(Q)printf %08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(fp_data_end), fp_data_end_ptr, ramstart; 30 | printf "\t$(Q)printf \" PATCH fp_data_end @ 0x%08x\\n\"\n", fp_data_end_ptr; 31 | printf "\t$(Q)printf %08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(fp_config_base), fp_config_base_ptr_1, ramstart; 32 | printf "\t$(Q)printf \" PATCH fp_config_base @ 0x%08x\\n\"\n", fp_config_base_ptr_1; 33 | printf "\t$(Q)printf %08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(fp_config_end), fp_config_end_ptr_1, ramstart; 34 | printf "\t$(Q)printf \" PATCH fp_config_end @ 0x%08x\\n\"\n", fp_config_end_ptr_1; 35 | printf "\t$(Q)printf %08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(fp_config_base), fp_config_base_ptr_2, ramstart; 36 | printf "\t$(Q)printf \" PATCH fp_config_base @ 0x%08x\\n\"\n", fp_config_base_ptr_2; 37 | printf "\t$(Q)printf %08x | xxd -r -p | dd of=$@ bs=1 conv=notrunc seek=$$((0x%08x - 0x%08x))\n", htonl(fp_config_end), fp_config_end_ptr_2, ramstart; 38 | printf "\t$(Q)printf \" PATCH fp_config_end @ 0x%08x\\n\"\n", fp_config_end_ptr_2; 39 | printf "\n\nFORCE:\n" 40 | } 41 | -------------------------------------------------------------------------------- /buildtools/scripts/fw.ld.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "PATCH" && strtonum($1) < strtonum(0x900000)) 3 | print ".text." $4 " " $1 " : { KEEP(" $3 " (.*." $4 ")) }"; 4 | else if ($2 == "DUMMY" && strtonum($1) < strtonum(0x900000)) 5 | print ".text.dummy." $4 " " $1 " : { " $3 " (.*." $4 ") }"; 6 | else if ($2 == "REGION" && $1 != "ucpatch") 7 | print ".text." $4 " : { KEEP(" $3 " (.*." $4 ")) } >" $1; 8 | else if ($2 == "TARGETREGION" && $1 != "ucpatch") 9 | print ".text." $1 " : { " $3 " (.text .text.* .data .data.* .bss .bss.* .rodata .rodata.*) } >" $1; 10 | } 11 | -------------------------------------------------------------------------------- /buildtools/scripts/fw.mk.1.awk: -------------------------------------------------------------------------------- 1 | BEGIN { 2 | src_file = src_file; 3 | } 4 | { 5 | if ($2 == "TARGETREGION") { 6 | "$NEXMON_ROOT/buildtools/scripts/getsectionaddr.sh .text." $1 " " src_file | getline result; print $0 " " result 7 | } else { 8 | print; 9 | }; 10 | } 11 | -------------------------------------------------------------------------------- /buildtools/scripts/fw.mk.2.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "PATCH" && strtonum($1) < strtonum(0x900000)) 3 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $4 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((" $1 " - " ramstart "))\n\t$(Q)printf \" PATCH " $4 " @ " $1 "\\n\""; 4 | else if ($2 == "REGION" && strtonum("0x" $4) < strtonum(0x900000)) 5 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $1 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((0x" $4 " - " ramstart "))\t$(Q)printf \" REGION " $1 " @ " $4 "\\n\""; 6 | else if ($2 == "TARGETREGION" && $4 != "" && strtonum("0x" $4) < strtonum(0x900000)) 7 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $1 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((0x" $4 " - " ramstart "))\n\t$(Q)printf \" TARGETREGION " $1 " @ " $4 "\\n\""; 8 | } 9 | -------------------------------------------------------------------------------- /buildtools/scripts/getdefine.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | printf "#include \"%s/patches/include/firmware_version.h\"\n%s\n" $NEXMON_ROOT $1 | gcc -E -x c - | tail -n 1 3 | -------------------------------------------------------------------------------- /buildtools/scripts/getsectionaddr.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | $CC"objdump" -j $1 -t $2 | sed -e '5q;d' | awk '{ print $1; }' 3 | -------------------------------------------------------------------------------- /buildtools/scripts/nexmon.ld.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "PATCH") 3 | print ".text." $4 " " $1 " : { KEEP(" $3 " (.*." $4 ")) }"; 4 | else if ($2 == "DUMMY") 5 | print ".text.dummy." $4 " " $1 " : { " $3 " (.*." $4 ") }"; 6 | else if ($2 == "REGION") 7 | print ".text." $4 " : { KEEP(" $3 " (.*." $4 ")) } >" $1; 8 | else if ($2 == "TARGETREGION") 9 | print ".text." $1 " : { " $3 " (.text .text.* .data .data.* .bss .bss.* .rodata .rodata.*) } >" $1; 10 | } 11 | -------------------------------------------------------------------------------- /buildtools/scripts/uc.ld.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "PATCH" && strtonum($1) > strtonum(0x900000)) 3 | print ".text." $4 " " $1 " : { KEEP(" $3 " (.*." $4 ")) }"; 4 | else if ($2 == "DUMMY" && strtonum($1) > strtonum(0x900000)) 5 | print ".text.dummy." $4 " " $1 " : { " $3 " (.*." $4 ") }"; 6 | else if ($2 == "REGION" && $1 != "fwpatch") 7 | print ".text." $4 " : { KEEP(" $3 " (.*." $4 ")) } >" $1; 8 | else if ($2 == "TARGETREGION" && $1 != "fwpatch") 9 | print ".text." $1 " : { " $3 " (.text .text.* .data .data.* .bss .bss.* .rodata .rodata.*) } >" $1; 10 | } 11 | -------------------------------------------------------------------------------- /buildtools/scripts/uc.mk.1.awk: -------------------------------------------------------------------------------- 1 | BEGIN { 2 | src_file = src_file; 3 | } 4 | { 5 | if ($2 == "TARGETREGION") { 6 | "$NEXMON_ROOT/buildtools/scripts/getsectionaddr.sh .text." $1 " " src_file | getline result; print $0 " " result 7 | } else { 8 | print; 9 | }; 10 | } 11 | -------------------------------------------------------------------------------- /buildtools/scripts/uc.mk.2.awk: -------------------------------------------------------------------------------- 1 | { 2 | if ($2 == "PATCH" && strtonum($1) > strtonum(0x900000)) 3 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $4 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((" $1 " - " ramstart "))\n\t$(Q)printf \" PATCH " $4 " @ " $1 "\\n\""; 4 | else if ($2 == "REGION" && strtonum("0x" $4) > strtonum(0x900000)) 5 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $1 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((0x" $4 " - " ramstart "))\t$(Q)printf \" REGION " $1 " @ " $4 "\\n\""; 6 | else if ($2 == "TARGETREGION" && $4 != "" && strtonum("0x" $4) > strtonum(0x900000)) 7 | print "\t$(Q)$(CC)objcopy -O binary -j .text." $1 " $< gen/section.bin && dd if=gen/section.bin of=$@ bs=1 conv=notrunc seek=$$((0x" $4 " - " ramstart "))\n\t$(Q)printf \" TARGETREGION " $1 " @ " $4 "\\n\""; 8 | } 9 | -------------------------------------------------------------------------------- /firmwares/wil6210/4-1-0_55/definitions.mk: -------------------------------------------------------------------------------- 1 | NEXMON_CHIP=CHIP_VER_WIL6210 2 | NEXMON_CHIP_NUM=`$(NEXMON_ROOT)/buildtools/scripts/getdefine.sh $(NEXMON_CHIP)` 3 | NEXMON_FW_VERSION=FW_VER_410_55 4 | NEXMON_FW_VERSION_NUM=`$(NEXMON_ROOT)/buildtools/scripts/getdefine.sh $(NEXMON_FW_VERSION)` 5 | 6 | NEXMON_ARCH=arc600 7 | 8 | FW_FILE=wil6210.fw 9 | 10 | FW_CODE_FILE=wil6210.fw_code 11 | FW_CODE_START=0x8c0000 12 | FW_CODE_SIZE=0x40000 13 | FW_CODE_PARTITION=1 14 | 15 | FW_DATA_FILE=wil6210.fw_data 16 | FW_DATA_START=UNDEF 17 | FW_DATA_SIZE=0x8000 18 | FW_DATA_PARTITION=2 19 | 20 | UC_CODE_FILE=wil6210.uc_code 21 | UC_CODE_START=0x920000 22 | UC_CODE_SIZE=0x20000 23 | UC_CODE_PARTITION=3 24 | 25 | UC_DATA_FILE=wil6210.uc_data 26 | UC_DATA_START=UNDEF 27 | UC_DATA_SIZE=0x4000 28 | UC_DATA_PARTITION=4 29 | 30 | FW_PATCH_START_OFFSET=0x35200 31 | FW_PATCH_START=$$(($(FW_CODE_START) + $(FW_PATCH_START_OFFSET))) 32 | FW_PATCH_SIZE=$$(($(FW_CODE_SIZE) - $(FW_PATCH_START_OFFSET))) 33 | 34 | UC_PATCH_START_OFFSET=0x18700 35 | UC_PATCH_STATIC_DATA=0x3000 36 | UC_PATCH_START=$$(($(UC_CODE_START) + $(UC_PATCH_START_OFFSET))) 37 | UC_PATCH_SIZE=$$(($(UC_CODE_SIZE) - $(UC_PATCH_START_OFFSET) - $(UC_PATCH_STATIC_DATA))) 38 | 39 | 40 | -------------------------------------------------------------------------------- /firmwares/wil6210/4-1-0_55/structs.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef STRUCTS_H 36 | #define STRUCTS_H 37 | 38 | #ifndef PAD 39 | #define _PADLINE(line) pad ## line 40 | #define _XSTR(line) _PADLINE(line) 41 | #define PAD _XSTR(__LINE__) 42 | #endif 43 | 44 | #include "../structs.common.h" 45 | 46 | #endif /*STRUCTS_H */ 47 | -------------------------------------------------------------------------------- /firmwares/wil6210/5-2-0_18/definitions.mk: -------------------------------------------------------------------------------- 1 | NEXMON_CHIP=CHIP_VER_WIL6210 2 | NEXMON_CHIP_NUM=`$(NEXMON_ROOT)/buildtools/scripts/getdefine.sh $(NEXMON_CHIP)` 3 | NEXMON_FW_VERSION=FW_VER_520_18 4 | NEXMON_FW_VERSION_NUM=`$(NEXMON_ROOT)/buildtools/scripts/getdefine.sh $(NEXMON_FW_VERSION)` 5 | 6 | NEXMON_ARCH=arc600 7 | 8 | FW_FILE=wil6210.fw 9 | 10 | FW_CODE_FILE=wil6210.fw_code 11 | FW_CODE_START=0x8c0000 12 | FW_CODE_SIZE=0x40000 13 | FW_CODE_PARTITION=1 14 | 15 | FW_DATA_FILE=wil6210.fw_data 16 | FW_DATA_START=UNDEF 17 | FW_DATA_SIZE=0x8000 18 | FW_DATA_PARTITION=2 19 | 20 | UC_CODE_FILE=wil6210.uc_code 21 | UC_CODE_START=0x920000 22 | UC_CODE_SIZE=0x20000 23 | UC_CODE_PARTITION=3 24 | 25 | UC_DATA_FILE=wil6210.uc_data 26 | UC_DATA_START=UNDEF 27 | UC_DATA_SIZE=0x4000 28 | UC_DATA_PARTITION=4 29 | 30 | FW_PATCH_START_OFFSET=0x3cd00 31 | FW_PATCH_START=$$(($(FW_CODE_START) + $(FW_PATCH_START_OFFSET))) 32 | FW_PATCH_SIZE=$$(($(FW_CODE_SIZE) - $(FW_PATCH_START_OFFSET))) 33 | 34 | UC_PATCH_START_OFFSET=0x1b700 35 | UC_PATCH_STATIC_DATA=0x3000 36 | UC_PATCH_START=$$(($(UC_CODE_START) + $(UC_PATCH_START_OFFSET))) 37 | UC_PATCH_SIZE=$$(($(UC_CODE_SIZE) - $(UC_PATCH_START_OFFSET) - $(UC_PATCH_STATIC_DATA))) 38 | -------------------------------------------------------------------------------- /firmwares/wil6210/5-2-0_18/structs.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef STRUCTS_H 36 | #define STRUCTS_H 37 | 38 | #ifndef PAD 39 | #define _PADLINE(line) pad ## line 40 | #define _XSTR(line) _PADLINE(line) 41 | #define PAD _XSTR(__LINE__) 42 | #endif 43 | 44 | #include "../structs.common.h" 45 | 46 | #endif /*STRUCTS_H */ 47 | -------------------------------------------------------------------------------- /firmwares/wil6210/structs.common.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef STRUCTS_COMMON_H 36 | #define STRUCTS_COMMON_H 37 | 38 | //TODO 39 | 40 | #endif /*STRUCTS_COMMON_H */ 41 | -------------------------------------------------------------------------------- /logos/crisp.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/crisp.jpg -------------------------------------------------------------------------------- /logos/crossing.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/crossing.jpg -------------------------------------------------------------------------------- /logos/cysec.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/cysec.jpg -------------------------------------------------------------------------------- /logos/maki.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/maki.png -------------------------------------------------------------------------------- /logos/nicer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/nicer.png -------------------------------------------------------------------------------- /logos/seemoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/seemoo.png -------------------------------------------------------------------------------- /logos/talon.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/talon.png -------------------------------------------------------------------------------- /logos/tudarmstadt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/seemoo-lab/nexmon-arc/16cf3b7544db0a14a2d7d3e69c52017cfee36dff/logos/tudarmstadt.png -------------------------------------------------------------------------------- /patches/.gitignore: -------------------------------------------------------------------------------- 1 | .* 2 | !.gitignore 3 | obj 4 | log 5 | gen 6 | *.o 7 | *.elf 8 | -------------------------------------------------------------------------------- /patches/common/header.mk: -------------------------------------------------------------------------------- 1 | header: FORCE 2 | @printf "\n\n" 3 | @printf " ########### ########### \033[0;33m ########## ########## \033[0m \n" 4 | @printf " ############ ############ \033[0;33m ############ ############ \033[0m \n" 5 | @printf " ## ## \033[0;33m ## ## ## ## ## \033[0m \n" 6 | @printf " ## ## \033[0;33m ## ## ## ## ## \033[0m \n" 7 | @printf " ########### #### ###### \033[0;33m ## ## ## ## ###### \033[0m \n" 8 | @printf " ########### #### # \033[0;33m ## ## ## ## # # \033[0m \n" 9 | @printf " ## ## ###### \033[0;33m ## ## ## ## # # \033[0m \n" 10 | @printf " ## ## # \033[0;33m ## ## ## ## # # \033[0m \n" 11 | @printf " ############ ##### ###### \033[0;33m ## ## ## ##### ###### \033[0m \n" 12 | @printf " ########### ########### \033[0;33m ## ## ## ########## \033[0m \n" 13 | @printf "\n" 14 | @printf " S E C U R E M O B I L E N E T W O R K I N G \n" 15 | @printf "\n\n" 16 | @printf " presents: \n" 17 | @printf "\n" 18 | @printf " # ### ### \033[0;34m# \033[0;31m #\033[0m # ### ### ### # ### \n" 19 | @printf " ## # # # \033[0;34m # \033[0;31m# \033[0m ## ## # # # ## # \n" 20 | @printf " # # ##### \033[0;32m # \033[0m # # # # # # # \n" 21 | @printf " # # # \033[0;33m # \033[0;32m# \033[0m # # # # # # # \n" 22 | @printf " # # #### \033[0;33m# \033[0;32m #\033[0m # # # ### # # \n" 23 | @printf "\n" 24 | @printf " The C-based Firmware Patching Framework \n" 25 | @printf "\n\n" 26 | @printf " \033[0;31m!!! WARNING !!!\033[0m \n" 27 | @printf " Our software may damage your hardware and may void your hardware’s \n" 28 | @printf " warranty! You use our tools at your own risk and responsibility \n" 29 | @printf "\n\n" 30 | ifeq ("$(wildcard $(NEXMON_ROOT)/DISABLE_STATISTICS)","") 31 | @printf "\033[0;31m COLLECTING STATISTICS\033[0m read $(NEXMON_ROOT)/STATISTICS.md for more information\n" 32 | @make -s -f $(NEXMON_ROOT)/patches/common/statistics.mk 33 | else 34 | @printf "\033[0;31m STATISTICS DISABLED\033[0m to enable: delete $(NEXMON_ROOT)/DISABLE_STATATISTICS\n" 35 | endif 36 | 37 | 38 | 39 | FORCE: 40 | -------------------------------------------------------------------------------- /patches/common/helper.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | __attribute__((naked)) 36 | unsigned int 37 | get_SP(void) 38 | { 39 | asm( 40 | "mov r0, sp\n" 41 | "j [blink]\n" 42 | ); 43 | } 44 | 45 | __attribute__((naked,noinline)) 46 | unsigned int 47 | get_IDENTITY(void) 48 | { 49 | asm( 50 | "lr r0, [identity]\n" 51 | "j [blink]\n" 52 | ); 53 | } 54 | 55 | __attribute__((naked,noinline)) 56 | unsigned int 57 | get_DEBUG(void) 58 | { 59 | asm( 60 | "lr r0, [debug]\n" 61 | "j [blink]\n" 62 | ); 63 | } 64 | 65 | __attribute__((naked,noinline)) 66 | unsigned int 67 | get_PC(void) 68 | { 69 | asm( 70 | "lr r0, [pc]\n" 71 | "j [blink]\n" 72 | ); 73 | } 74 | 75 | __attribute__((naked,noinline)) 76 | unsigned int 77 | get_STATUS32(void) 78 | { 79 | asm( 80 | "lr r0, [status32]\n" 81 | "j [blink]\n" 82 | ); 83 | } 84 | -------------------------------------------------------------------------------- /patches/common/hexdump.c: -------------------------------------------------------------------------------- 1 | #pragma NEXMON targetregion "fwpatch" 2 | #pragma NEXMON targetregion "ucpatch" 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | int 10 | printf(const char *fmt, ...); 11 | 12 | void 13 | hexdump(char *desc, void *addr, int len) 14 | { 15 | int i; 16 | unsigned char buff[17]; 17 | unsigned char *pc = (unsigned char*)addr; 18 | 19 | // Output description if given. 20 | if (desc != 0) 21 | printf ("%s:\n", desc); 22 | 23 | // Process every byte in the data. 24 | for (i = 0; i < len; i++) { 25 | // Multiple of 16 means new line (with line offset). 26 | 27 | if ((i % 16) == 0) { 28 | // Just don't print ASCII for the zeroth line. 29 | if (i != 0) 30 | printf (" %s\n", buff); 31 | 32 | // Output the offset. 33 | printf (" %04x ", i); 34 | } 35 | 36 | // Now the hex code for the specific character. 37 | printf (" %02x", pc[i]); 38 | 39 | // And store a printable ASCII character for later. 40 | if ((pc[i] < 0x20) || (pc[i] > 0x7e)) 41 | buff[i % 16] = '.'; 42 | else 43 | buff[i % 16] = pc[i]; 44 | buff[(i % 16) + 1] = '\0'; 45 | } 46 | 47 | // Pad out last line if not exactly 16 characters. 48 | while ((i % 16) != 0) { 49 | printf (" "); 50 | i++; 51 | } 52 | 53 | // And print the final ASCII bit. 54 | printf (" %s\n", buff); 55 | } -------------------------------------------------------------------------------- /patches/common/printf.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (c) 2004,2012 Kustaa Nyholm / SpareTimeLabs 3 | * 4 | * All rights reserved. 5 | * 6 | * Redistribution and use in source and binary forms, with or without modification, 7 | * are permitted provided that the following conditions are met: 8 | * 9 | * Redistributions of source code must retain the above copyright notice, this list 10 | * of conditions and the following disclaimer. 11 | * 12 | * Redistributions in binary form must reproduce the above copyright notice, this 13 | * list of conditions and the following disclaimer in the documentation and/or other 14 | * materials provided with the distribution. 15 | * 16 | * Neither the name of the Kustaa Nyholm or SpareTimeLabs nor the names of its 17 | * contributors may be used to endorse or promote products derived from this software 18 | * without specific prior written permission. 19 | * 20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 22 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 | * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 24 | * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, 26 | * OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 27 | * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 29 | * OF SUCH DAMAGE. 30 | */ 31 | 32 | #pragma NEXMON targetregion "fwpatch" 33 | #pragma NEXMON targetregion "ucpatch" 34 | 35 | #include 36 | #include 37 | 38 | typedef void (*putcf) (void*,char); 39 | 40 | extern void putc(char c); 41 | 42 | static void 43 | putf_wrapper(void *x, char c) { 44 | putc(c); 45 | } 46 | 47 | static putcf stdout_putf = putf_wrapper; 48 | static void* stdout_putp = 0; 49 | 50 | static void 51 | ui2a(unsigned int num, unsigned int base, int uc, char *bf) 52 | { 53 | int n=0; 54 | unsigned int d=1; 55 | while (num/d >= base) 56 | d*=base; 57 | while (d!=0) { 58 | int dgt = num / d; 59 | num%= d; 60 | d/=base; 61 | if (n || dgt>0 || d==0) { 62 | *bf++ = dgt+(dgt<10 ? '0' : (uc ? 'A' : 'a')-10); 63 | ++n; 64 | } 65 | } 66 | *bf=0; 67 | } 68 | 69 | static void 70 | i2a(int num, char *bf) 71 | { 72 | if (num<0) { 73 | num=-num; 74 | *bf++ = '-'; 75 | } 76 | ui2a(num,10,0,bf); 77 | } 78 | 79 | static int 80 | a2d(char ch) 81 | { 82 | if (ch>='0' && ch<='9') 83 | return ch-'0'; 84 | else if (ch>='a' && ch<='f') 85 | return ch-'a'+10; 86 | else if (ch>='A' && ch<='F') 87 | return ch-'A'+10; 88 | else return -1; 89 | } 90 | 91 | static char 92 | a2i(char ch, const char** src, int base, int *nump) 93 | { 94 | const char* p = *src; 95 | int num = 0; 96 | int digit; 97 | while ((digit = a2d(ch)) >= 0) { 98 | if( digit > base ) break; 99 | num = num * base + digit; 100 | ch = *p++; 101 | } 102 | *src = p; 103 | *nump = num; 104 | return ch; 105 | } 106 | 107 | static void 108 | putchw(void *putp, putcf putf, int n, char z, char *bf) 109 | { 110 | char fc = z ? '0' : ' '; 111 | char ch; 112 | char *p = bf; 113 | while (*p++ && n-- > 0); 114 | while (n-- > 0) 115 | putf(putp,fc); 116 | while ((ch= *bf++)) 117 | putf(putp,ch); 118 | } 119 | 120 | static void 121 | putchwl(void *putp, putcf putf,int n, char z, void* bf) 122 | { 123 | char fc=z? '0' : ' '; 124 | wchar_t *p = bf ; 125 | while (*p++ && n > 0) { 126 | n--; 127 | } 128 | while (n-- > 0) { 129 | putf(putp,fc); 130 | } 131 | p = bf ; 132 | while(1) { 133 | wchar_t c = *p++ ; 134 | if( c == 0 ) { 135 | break ; 136 | } 137 | putf(putp,c); 138 | } 139 | } 140 | 141 | static void 142 | tfp_format(void* putp, putcf putf, const char *fmt, va_list va) 143 | { 144 | char bf[12]; 145 | char ch; 146 | 147 | while ((ch=*(fmt++))) { 148 | if (ch!='%') 149 | putf(putp,ch); 150 | else { 151 | char lz=0; 152 | int w=0; 153 | ch=*(fmt++); 154 | if (ch=='0') { 155 | ch=*(fmt++); 156 | lz=1; 157 | } 158 | if (ch>='0' && ch<='9') { 159 | ch=a2i(ch,&fmt,10,&w); // a2i(char ch, const char** src, int base, int *nump) 160 | } 161 | switch (ch) { 162 | case 0: 163 | goto abort; 164 | case 'u' : 165 | ui2a(va_arg(va, unsigned int),10,0,bf); 166 | putchw(putp,putf,w,lz,bf); 167 | break; 168 | 169 | case 'd' : 170 | i2a(va_arg(va, int),bf); 171 | putchw(putp,putf,w,lz,bf); 172 | break; 173 | 174 | case 'x' : 175 | case 'X' : 176 | ui2a(va_arg(va, unsigned int),16,(ch=='X'),bf); 177 | putchw(putp,putf,w,lz,bf); // putchw(void *putp, putcf putf, int n, char z, char *bf) 178 | break; 179 | 180 | case 'c' : 181 | putf(putp,(char)(va_arg(va, int))); 182 | break; 183 | 184 | case 's' : 185 | putchw(putp,putf,w,0,va_arg(va, char*)); 186 | break; 187 | 188 | case 'S' : 189 | putchwl(putp,putf,w,0,va_arg(va, char*)); 190 | break; 191 | 192 | case '%' : 193 | putf(putp,ch); 194 | default: 195 | break; 196 | } 197 | } 198 | } 199 | abort:; 200 | } 201 | 202 | static void 203 | putcp(void* p, char c) 204 | { 205 | *(*((char**) p))++ = c; 206 | } 207 | 208 | void 209 | printf(char *fmt, ...) 210 | { 211 | va_list va; 212 | va_start(va,fmt); 213 | tfp_format(stdout_putp,stdout_putf,fmt,va); 214 | va_end(va); 215 | } 216 | 217 | void 218 | sprintf(char* s, char *fmt, ...) 219 | { 220 | va_list va; 221 | va_start(va, fmt); 222 | tfp_format(&s, putcp, fmt, va); 223 | putcp(&s, 0); 224 | va_end(va); 225 | } 226 | -------------------------------------------------------------------------------- /patches/common/putc.c: -------------------------------------------------------------------------------- 1 | #pragma NEXMON targetregion "fwpatch" 2 | #pragma NEXMON targetregion "ucpatch" 3 | 4 | #include 5 | 6 | #define LOG_BUF_LEN (2*1024) 7 | #define NULL 0 8 | 9 | typedef unsigned int uint; 10 | typedef unsigned int size_t; 11 | 12 | typedef struct { 13 | char *buf; 14 | uint buf_size; 15 | uint idx; 16 | } hndrte_log_t; 17 | 18 | static char console_buf[LOG_BUF_LEN] = {0}; 19 | 20 | // uc console 21 | __attribute__((at(0x935ff4, "", CHIP_VER_WIL6210, FW_VER_7759))) 22 | // fw console 23 | __attribute__((at(0x8ffff0, "", CHIP_VER_WIL6210, FW_VER_7759))) 24 | // uc console 25 | __attribute__((at(0x935ff4, "", CHIP_VER_WIL6210, FW_VER_7780))) 26 | // fw console 27 | __attribute__((at(0x8ffff0, "", CHIP_VER_WIL6210, FW_VER_7780))) 28 | // uc console 29 | __attribute__((at(0x9386f4, "", CHIP_VER_WIL6210, FW_VER_410_55))) 30 | // fw console 31 | __attribute__((at(0x8ffff0, "", CHIP_VER_WIL6210, FW_VER_410_55))) 32 | // uc console 33 | __attribute__((at(0x93cff0, "", CHIP_VER_WIL6210, FW_VER_520_18))) 34 | // fw console 35 | __attribute__((at(0x8ffff0, "", CHIP_VER_WIL6210, FW_VER_520_18))) 36 | static hndrte_log_t active_log = { 37 | .buf = console_buf, 38 | .buf_size = LOG_BUF_LEN, 39 | .idx = 0 40 | }; 41 | 42 | void 43 | clearconsole(void) 44 | { 45 | int i = 0; 46 | for (i = 0; i < LOG_BUF_LEN; i++) { 47 | console_buf[i] = 0; 48 | } 49 | 50 | active_log.idx = 0; 51 | } 52 | 53 | void 54 | putc(int c) 55 | { 56 | hndrte_log_t *log = &active_log; 57 | 58 | /* CR before LF */ 59 | if (c == '\n') 60 | putc('\r'); 61 | 62 | if (log->buf != NULL) { 63 | int idx = log->idx; 64 | 65 | /* Store in log buffer */ 66 | log->buf[idx] = (char)c; 67 | log->idx = (idx + 1) % LOG_BUF_LEN; 68 | } 69 | } 70 | -------------------------------------------------------------------------------- /patches/common/statistics.mk: -------------------------------------------------------------------------------- 1 | STAT_WGET := $(shell command -v wget 2> /dev/null) 2 | STAT_CURL := $(shell command -v curl 2> /dev/null) 3 | ifneq ("$(wildcard $(NEXMON_ROOT)/.UUID)","") 4 | STAT_UUID := $(shell cat $(NEXMON_ROOT)/.UUID | base64) 5 | else 6 | STAT_UUID := $(shell cat /dev/urandom | LC_ALL=C tr -dc A-Z0-9 | head -c32 > $(NEXMON_ROOT)/.UUID && cat $(NEXMON_ROOT)/.UUID | base64) 7 | endif 8 | STAT_UNAME := $(shell uname -srmp | base64) 9 | STAT_PATH := $(shell git rev-parse --show-prefix | base64) 10 | ifeq ("$(STAT_PATH)","Cg==") 11 | STAT_PATH := $(shell echo $$(cd .. && git rev-parse --show-prefix)$$(basename `pwd`) | base64) 12 | endif 13 | STAT_GIT_VERSION := $(shell git describe --abbrev=8 --dirty --always --tags | base64) 14 | STAT_GIT_REMOTE := $(shell git config --get remote.origin.url | base64) 15 | #STAT_URL := http://172.16.121.1:8888/statistics/ 16 | STAT_URL := https://nexmon.org/statistics/ 17 | STAT_DATA := "uuid=$(STAT_UUID)&uname=$(STAT_UNAME)&path=$(STAT_PATH)&version=$(STAT_GIT_VERSION)&remote=$(STAT_GIT_REMOTE)" 18 | 19 | statistics: FORCE 20 | ifdef STAT_WGET 21 | $(Q)$(STAT_WGET) --user-agent="Nexmon" --post-data=$(STAT_DATA) --quiet --background --delete-after --no-check-certificate $(STAT_URL) > /dev/null 2> /dev/null 22 | else 23 | ifdef STAT_CURL 24 | $(Q)$(STAT_CURL) -A "Nexmon" --data $(STAT_DATA) $(STAT_URL) > /dev/null 2> /dev/null & 25 | endif 26 | endif 27 | 28 | FORCE: 29 | -------------------------------------------------------------------------------- /patches/common/wrapper.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef WRAPPER_C 36 | #define WRAPPER_C 37 | 38 | #include 39 | #include 40 | #include 41 | #include 42 | 43 | #ifndef WRAPPER_H 44 | // if this file is not included in the wrapper.h file, create dummy functions 45 | #define VOID_DUMMY { ; } 46 | #define RETURN_DUMMY { ; return 0; } 47 | 48 | #define AT(CHIPVER, FWVER, ADDR) __attribute__((at(ADDR, "dummy", CHIPVER, FWVER))) 49 | #else 50 | // if this file is included in the wrapper.h file, create prototypes 51 | #define VOID_DUMMY ; 52 | #define RETURN_DUMMY ; 53 | #define AT(CHIPVER, FWVER, ADDR) 54 | #endif 55 | 56 | AT(CHIP_VER_WIL6210, FW_VER_410_55, FW_ADDR(0x28828)) 57 | void 58 | sub_28828(void) 59 | VOID_DUMMY 60 | 61 | AT(CHIP_VER_WIL6210, FW_VER_520_18, FW_ADDR(0x30040)) 62 | void 63 | sub_30040(void) 64 | VOID_DUMMY 65 | 66 | AT(CHIP_VER_WIL6210, FW_VER_410_55, UC_ADDR(0x1604)) 67 | void 68 | sub_1604(void) 69 | VOID_DUMMY 70 | 71 | AT(CHIP_VER_WIL6210, FW_VER_520_18, UC_ADDR(0x8bc)) 72 | void 73 | sub_8bc(void) 74 | VOID_DUMMY 75 | 76 | AT(CHIP_VER_WIL6210, FW_VER_520_18, UC_ADDR(0x7e60)) 77 | int16_t 78 | sub_7e60(void) 79 | RETURN_DUMMY 80 | 81 | AT(CHIP_VER_WIL6210, FW_VER_410_55, UC_ADDR(0xA170)) 82 | void 83 | sub_A170() 84 | VOID_DUMMY 85 | 86 | AT(CHIP_VER_WIL6210, FW_VER_410_55, FW_ADDR(0x2B8)) 87 | void 88 | store_r13_to_r17(void) 89 | VOID_DUMMY 90 | 91 | #undef VOID_DUMMY 92 | #undef RETURN_DUMMY 93 | #undef AT 94 | 95 | #endif /*WRAPPER_C*/ 96 | -------------------------------------------------------------------------------- /patches/include/bcmcdc.h: -------------------------------------------------------------------------------- 1 | /* 2 | * CDC network driver ioctl/indication encoding 3 | * Broadcom 802.11abg Networking Device Driver 4 | * 5 | * Definitions subject to change without notice. 6 | * 7 | * Copyright (C) 1999-2013, Broadcom Corporation 8 | * 9 | * Unless you and Broadcom execute a separate written software license 10 | * agreement governing use of this software, this software is licensed to you 11 | * under the terms of the GNU General Public License version 2 (the "GPL"), 12 | * available at http://www.broadcom.com/licenses/GPLv2.php, with the 13 | * following added to such license: 14 | * 15 | * As a special exception, the copyright holders of this software give you 16 | * permission to link this software with independent modules, and to copy and 17 | * distribute the resulting executable under terms of your choice, provided that 18 | * you also meet, for each linked independent module, the terms and conditions of 19 | * the license of that module. An independent module is a module which is not 20 | * derived from this software. The special exception does not apply to any 21 | * modifications of the software. 22 | * 23 | * Notwithstanding the above, under no circumstances may you combine this 24 | * software in any way with any other Broadcom software provided under a license 25 | * other than the GPL, without Broadcom's express prior written consent. 26 | * 27 | * $Id: bcmcdc.h 318308 2012-03-02 02:23:42Z $ 28 | */ 29 | #ifndef _bcmcdc_h_ 30 | #define _bcmcdc_h_ 31 | //#include 32 | 33 | typedef struct cdc_ioctl { 34 | uint32 cmd; /* ioctl command value */ 35 | uint32 len; /* lower 16: output buflen; upper 16: input buflen (excludes header) */ 36 | uint32 flags; /* flag defns given below */ 37 | uint32 status; /* status code returned from the device */ 38 | } cdc_ioctl_t; 39 | 40 | /* Max valid buffer size that can be sent to the dongle */ 41 | #define CDC_MAX_MSG_SIZE ETHER_MAX_LEN 42 | 43 | /* len field is divided into input and output buffer lengths */ 44 | #define CDCL_IOC_OUTLEN_MASK 0x0000FFFF /* maximum or expected response length, */ 45 | /* excluding IOCTL header */ 46 | #define CDCL_IOC_OUTLEN_SHIFT 0 47 | #define CDCL_IOC_INLEN_MASK 0xFFFF0000 /* input buffer length, excluding IOCTL header */ 48 | #define CDCL_IOC_INLEN_SHIFT 16 49 | 50 | /* CDC flag definitions */ 51 | #define CDCF_IOC_ERROR 0x01 /* 0=success, 1=ioctl cmd failed */ 52 | #define CDCF_IOC_SET 0x02 /* 0=get, 1=set cmd */ 53 | #define CDCF_IOC_OVL_IDX_MASK 0x3c /* overlay region index mask */ 54 | #define CDCF_IOC_OVL_RSV 0x40 /* 1=reserve this overlay region */ 55 | #define CDCF_IOC_OVL 0x80 /* 1=this ioctl corresponds to an overlay */ 56 | #define CDCF_IOC_ACTION_MASK 0xfe /* SET/GET, OVL_IDX, OVL_RSV, OVL mask */ 57 | #define CDCF_IOC_ACTION_SHIFT 1 /* SET/GET, OVL_IDX, OVL_RSV, OVL shift */ 58 | #define CDCF_IOC_IF_MASK 0xF000 /* I/F index */ 59 | #define CDCF_IOC_IF_SHIFT 12 60 | #define CDCF_IOC_ID_MASK 0xFFFF0000 /* used to uniquely id an ioctl req/resp pairing */ 61 | #define CDCF_IOC_ID_SHIFT 16 /* # of bits of shift for ID Mask */ 62 | 63 | #define CDC_IOC_IF_IDX(flags) (((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT) 64 | #define CDC_IOC_ID(flags) (((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT) 65 | 66 | #define CDC_GET_IF_IDX(hdr) \ 67 | ((int)((((hdr)->flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)) 68 | #define CDC_SET_IF_IDX(hdr, idx) \ 69 | ((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT))) 70 | 71 | /* 72 | * BDC header 73 | * 74 | * The BDC header is used on data packets to convey priority across USB. 75 | */ 76 | 77 | struct bdc_header { 78 | uint8 flags; /* Flags */ 79 | uint8 priority; /* 802.1d Priority 0:2 bits, 4:7 USB flow control info */ 80 | uint8 flags2; 81 | uint8 dataOffset; /* Offset from end of BDC header to packet data, in 82 | * 4-byte words. Leaves room for optional headers. 83 | */ 84 | }; 85 | 86 | #define BDC_HEADER_LEN 4 87 | 88 | /* flags field bitmap */ 89 | #define BDC_FLAG_80211_PKT 0x01 /* Packet is in 802.11 format (dongle -> host) */ 90 | #define BDC_FLAG_SUM_GOOD 0x04 /* Dongle has verified good RX checksums */ 91 | #define BDC_FLAG_SUM_NEEDED 0x08 /* Dongle needs to do TX checksums: host->device */ 92 | #define BDC_FLAG_EVENT_MSG 0x08 /* Payload contains an event msg: device->host */ 93 | #define BDC_FLAG_VER_MASK 0xf0 /* Protocol version mask */ 94 | #define BDC_FLAG_VER_SHIFT 4 /* Protocol version shift */ 95 | 96 | /* priority field bitmap */ 97 | #define BDC_PRIORITY_MASK 0x07 98 | #define BDC_PRIORITY_FC_MASK 0xf0 /* flow control info mask */ 99 | #define BDC_PRIORITY_FC_SHIFT 4 /* flow control info shift */ 100 | 101 | /* flags2 field bitmap */ 102 | #define BDC_FLAG2_IF_MASK 0x0f /* interface index (host <-> dongle) */ 103 | #define BDC_FLAG2_IF_SHIFT 0 104 | #define BDC_FLAG2_FC_FLAG 0x10 /* flag to indicate if pkt contains */ 105 | /* FLOW CONTROL info only */ 106 | 107 | /* version numbers */ 108 | #define BDC_PROTO_VER_1 1 /* Old Protocol version */ 109 | #define BDC_PROTO_VER 2 /* Protocol version */ 110 | 111 | /* flags2.if field access macros */ 112 | #define BDC_GET_IF_IDX(hdr) \ 113 | ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT)) 114 | #define BDC_SET_IF_IDX(hdr, idx) \ 115 | ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT))) 116 | 117 | #define BDC_FLAG2_PAD_MASK 0xf0 118 | #define BDC_FLAG_PAD_MASK 0x03 119 | #define BDC_FLAG2_PAD_SHIFT 2 120 | #define BDC_FLAG_PAD_SHIFT 0 121 | #define BDC_FLAG2_PAD_IDX 0x3c 122 | #define BDC_FLAG_PAD_IDX 0x03 123 | #define BDC_GET_PAD_LEN(hdr) \ 124 | ((int)(((((hdr)->flags2) & BDC_FLAG2_PAD_MASK) >> BDC_FLAG2_PAD_SHIFT) | \ 125 | ((((hdr)->flags) & BDC_FLAG_PAD_MASK) >> BDC_FLAG_PAD_SHIFT))) 126 | #define BDC_SET_PAD_LEN(hdr, idx) \ 127 | ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_PAD_MASK) | \ 128 | (((idx) & BDC_FLAG2_PAD_IDX) << BDC_FLAG2_PAD_SHIFT))); \ 129 | ((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \ 130 | (((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT))) 131 | 132 | #endif /* _bcmcdc_h_ */ 133 | -------------------------------------------------------------------------------- /patches/include/bcmwifi_channels.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Misc utility routines for WL and Apps 3 | * This header file housing the define and function prototype use by 4 | * both the wl driver, tools & Apps. 5 | * 6 | * Copyright (C) 1999-2013, Broadcom Corporation 7 | * 8 | * Unless you and Broadcom execute a separate written software license 9 | * agreement governing use of this software, this software is licensed to you 10 | * under the terms of the GNU General Public License version 2 (the "GPL"), 11 | * available at http://www.broadcom.com/licenses/GPLv2.php, with the 12 | * following added to such license: 13 | * 14 | * As a special exception, the copyright holders of this software give you 15 | * permission to link this software with independent modules, and to copy and 16 | * distribute the resulting executable under terms of your choice, provided that 17 | * you also meet, for each linked independent module, the terms and conditions of 18 | * the license of that module. An independent module is a module which is not 19 | * derived from this software. The special exception does not apply to any 20 | * modifications of the software. 21 | * 22 | * Notwithstanding the above, under no circumstances may you combine this 23 | * software in any way with any other Broadcom software provided under a license 24 | * other than the GPL, without Broadcom's express prior written consent. 25 | * 26 | * $Id: bcmwifi_channels.h 309193 2012-01-19 00:03:57Z $ 27 | */ 28 | 29 | #ifndef _bcmwifi_channels_h_ 30 | #define _bcmwifi_channels_h_ 31 | 32 | 33 | /* A chanspec holds the channel number, band, bandwidth and control sideband */ 34 | typedef uint16 chanspec_t; 35 | 36 | /* channel defines */ 37 | #define CH_UPPER_SB 0x01 38 | #define CH_LOWER_SB 0x02 39 | #define CH_EWA_VALID 0x04 40 | #define CH_80MHZ_APART 16 41 | #define CH_40MHZ_APART 8 42 | #define CH_20MHZ_APART 4 43 | #define CH_10MHZ_APART 2 44 | #define CH_5MHZ_APART 1 /* 2G band channels are 5 Mhz apart */ 45 | #define CH_MAX_2G_CHANNEL 14 /* Max channel in 2G band */ 46 | #define MAXCHANNEL 224 /* max # supported channels. The max channel no is 216, 47 | * this is that + 1 rounded up to a multiple of NBBY (8). 48 | * DO NOT MAKE it > 255: channels are uint8's all over 49 | */ 50 | #define CHSPEC_CTLOVLP(sp1, sp2, sep) (ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < \ 51 | (sep)) 52 | 53 | /* All builds use the new 11ac ratespec/chanspec */ 54 | #undef D11AC_IOTYPES 55 | #define D11AC_IOTYPES 56 | 57 | #ifndef D11AC_IOTYPES 58 | 59 | #define WL_CHANSPEC_CHAN_MASK 0x00ff 60 | #define WL_CHANSPEC_CHAN_SHIFT 0 61 | 62 | #define WL_CHANSPEC_CTL_SB_MASK 0x0300 63 | #define WL_CHANSPEC_CTL_SB_SHIFT 8 64 | #define WL_CHANSPEC_CTL_SB_LOWER 0x0100 65 | #define WL_CHANSPEC_CTL_SB_UPPER 0x0200 66 | #define WL_CHANSPEC_CTL_SB_NONE 0x0300 67 | 68 | #define WL_CHANSPEC_BW_MASK 0x0C00 69 | #define WL_CHANSPEC_BW_SHIFT 10 70 | #define WL_CHANSPEC_BW_10 0x0400 71 | #define WL_CHANSPEC_BW_20 0x0800 72 | #define WL_CHANSPEC_BW_40 0x0C00 73 | 74 | #define WL_CHANSPEC_BAND_MASK 0xf000 75 | #define WL_CHANSPEC_BAND_SHIFT 12 76 | #ifdef WL_CHANSPEC_BAND_5G 77 | #undef WL_CHANSPEC_BAND_5G 78 | #endif 79 | #ifdef WL_CHANSPEC_BAND_2G 80 | #undef WL_CHANSPEC_BAND_2G 81 | #endif 82 | #define WL_CHANSPEC_BAND_5G 0x1000 83 | #define WL_CHANSPEC_BAND_2G 0x2000 84 | #define INVCHANSPEC 255 85 | 86 | /* channel defines */ 87 | #define LOWER_20_SB(channel) (((channel) > CH_10MHZ_APART) ? ((channel) - CH_10MHZ_APART) : 0) 88 | #define UPPER_20_SB(channel) (((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \ 89 | ((channel) + CH_10MHZ_APART) : 0) 90 | 91 | #define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0) 92 | #define UU_20_SB(channel) (((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \ 93 | ((channel) + 3 * CH_10MHZ_APART) : 0) 94 | #define LU_20_SB(channel) LOWER_20_SB(channel) 95 | #define UL_20_SB(channel) UPPER_20_SB(channel) 96 | 97 | #define CHSPEC_WLCBANDUNIT(chspec) (CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX) 98 | #define CH20MHZ_CHSPEC(channel) (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \ 99 | WL_CHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \ 100 | WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G)) 101 | #define NEXT_20MHZ_CHAN(channel) (((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \ 102 | ((channel) + CH_20MHZ_APART) : 0) 103 | #define CH40MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \ 104 | ((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \ 105 | ((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \ 106 | WL_CHANSPEC_BAND_5G)) 107 | #define CHSPEC_CHANNEL(chspec) ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK)) 108 | #define CHSPEC_BAND(chspec) ((chspec) & WL_CHANSPEC_BAND_MASK) 109 | 110 | /* chanspec stores radio channel & flags to indicate control channel location, i.e. upper/lower */ 111 | #define CHSPEC_CTL_SB(chspec) ((chspec) & WL_CHANSPEC_CTL_SB_MASK) 112 | #define CHSPEC_BW(chspec) ((chspec) & WL_CHANSPEC_BW_MASK) 113 | 114 | #ifdef WL11N_20MHZONLY 115 | 116 | #define CHSPEC_IS10(chspec) 0 117 | #define CHSPEC_IS20(chspec) 1 118 | #ifndef CHSPEC_IS40 119 | #define CHSPEC_IS40(chspec) 0 120 | #endif 121 | 122 | #else /* !WL11N_20MHZONLY */ 123 | 124 | #define CHSPEC_IS10(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10) 125 | #define CHSPEC_IS20(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20) 126 | #ifndef CHSPEC_IS40 127 | #define CHSPEC_IS40(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40) 128 | #endif 129 | 130 | #endif /* !WL11N_20MHZONLY */ 131 | 132 | #define CHSPEC_IS5G(chspec) (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G) 133 | #define CHSPEC_IS2G(chspec) (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G) 134 | #define CHSPEC_SB_NONE(chspec) (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_NONE) 135 | #define CHSPEC_SB_UPPER(chspec) (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) 136 | #define CHSPEC_SB_LOWER(chspec) (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) 137 | #define CHSPEC_CTL_CHAN(chspec) ((CHSPEC_SB_LOWER(chspec)) ? \ 138 | (LOWER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))) : \ 139 | (UPPER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK)))) 140 | #define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G) 141 | 142 | #define CHANSPEC_STR_LEN 8 143 | 144 | #else /* D11AC_IOTYPES */ 145 | 146 | #define WL_CHANSPEC_CHAN_MASK 0x00ff 147 | #define WL_CHANSPEC_CHAN_SHIFT 0 148 | #define WL_CHANSPEC_CHAN1_MASK 0x000f 149 | #define WL_CHANSPEC_CHAN1_SHIFT 0 150 | #define WL_CHANSPEC_CHAN2_MASK 0x00f0 151 | #define WL_CHANSPEC_CHAN2_SHIFT 4 152 | 153 | #define WL_CHANSPEC_CTL_SB_MASK 0x0700 154 | #define WL_CHANSPEC_CTL_SB_SHIFT 8 155 | #define WL_CHANSPEC_CTL_SB_LLL 0x0000 156 | #define WL_CHANSPEC_CTL_SB_LLU 0x0100 157 | #define WL_CHANSPEC_CTL_SB_LUL 0x0200 158 | #define WL_CHANSPEC_CTL_SB_LUU 0x0300 159 | #define WL_CHANSPEC_CTL_SB_ULL 0x0400 160 | #define WL_CHANSPEC_CTL_SB_ULU 0x0500 161 | #define WL_CHANSPEC_CTL_SB_UUL 0x0600 162 | #define WL_CHANSPEC_CTL_SB_UUU 0x0700 163 | #define WL_CHANSPEC_CTL_SB_LL WL_CHANSPEC_CTL_SB_LLL 164 | #define WL_CHANSPEC_CTL_SB_LU WL_CHANSPEC_CTL_SB_LLU 165 | #define WL_CHANSPEC_CTL_SB_UL WL_CHANSPEC_CTL_SB_LUL 166 | #define WL_CHANSPEC_CTL_SB_UU WL_CHANSPEC_CTL_SB_LUU 167 | #define WL_CHANSPEC_CTL_SB_L WL_CHANSPEC_CTL_SB_LLL 168 | #define WL_CHANSPEC_CTL_SB_U WL_CHANSPEC_CTL_SB_LLU 169 | #define WL_CHANSPEC_CTL_SB_LOWER WL_CHANSPEC_CTL_SB_LLL 170 | #define WL_CHANSPEC_CTL_SB_UPPER WL_CHANSPEC_CTL_SB_LLU 171 | 172 | #define WL_CHANSPEC_BW_MASK 0x3800 173 | #define WL_CHANSPEC_BW_SHIFT 11 174 | #define WL_CHANSPEC_BW_5 0x0000 175 | #define WL_CHANSPEC_BW_10 0x0800 176 | #define WL_CHANSPEC_BW_20 0x1000 177 | #define WL_CHANSPEC_BW_40 0x1800 178 | #define WL_CHANSPEC_BW_80 0x2000 179 | #define WL_CHANSPEC_BW_160 0x2800 180 | #define WL_CHANSPEC_BW_8080 0x3000 181 | 182 | #define WL_CHANSPEC_BAND_MASK 0xc000 183 | #define WL_CHANSPEC_BAND_SHIFT 14 184 | #define WL_CHANSPEC_BAND_2G 0x0000 185 | #define WL_CHANSPEC_BAND_3G 0x4000 186 | #define WL_CHANSPEC_BAND_4G 0x8000 187 | #define WL_CHANSPEC_BAND_5G 0xc000 188 | #define INVCHANSPEC 255 189 | 190 | /* channel defines */ 191 | #define LOWER_20_SB(channel) (((channel) > CH_10MHZ_APART) ? \ 192 | ((channel) - CH_10MHZ_APART) : 0) 193 | #define UPPER_20_SB(channel) (((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \ 194 | ((channel) + CH_10MHZ_APART) : 0) 195 | 196 | #define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0) 197 | #define UU_20_SB(channel) (((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \ 198 | ((channel) + 3 * CH_10MHZ_APART) : 0) 199 | #define LU_20_SB(channel) LOWER_20_SB(channel) 200 | #define UL_20_SB(channel) UPPER_20_SB(channel) 201 | 202 | #define LOWER_40_SB(channel) ((channel) - CH_20MHZ_APART) 203 | #define UPPER_40_SB(channel) ((channel) + CH_20MHZ_APART) 204 | #define CHSPEC_WLCBANDUNIT(chspec) (CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX) 205 | #define CH20MHZ_CHSPEC(channel) (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \ 206 | (((channel) <= CH_MAX_2G_CHANNEL) ? \ 207 | WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G)) 208 | #define NEXT_20MHZ_CHAN(channel) (((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \ 209 | ((channel) + CH_20MHZ_APART) : 0) 210 | #define CH40MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \ 211 | ((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \ 212 | ((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \ 213 | WL_CHANSPEC_BAND_5G)) 214 | #define CH80MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \ 215 | ((channel) | (ctlsb) | \ 216 | WL_CHANSPEC_BW_80 | WL_CHANSPEC_BAND_5G) 217 | #define CH160MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \ 218 | ((channel) | (ctlsb) | \ 219 | WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G) 220 | 221 | /* simple MACROs to get different fields of chanspec */ 222 | #define CHSPEC_CHANNEL(chspec) ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK)) 223 | #define CHSPEC_CHAN1(chspec) ((chspec) & WL_CHANSPEC_CHAN1_MASK) 224 | #define CHSPEC_CHAN2(chspec) ((chspec) & WL_CHANSPEC_CHAN2_MASK) 225 | #define CHSPEC_BAND(chspec) ((chspec) & WL_CHANSPEC_BAND_MASK) 226 | #define CHSPEC_CTL_SB(chspec) ((chspec) & WL_CHANSPEC_CTL_SB_MASK) 227 | #define CHSPEC_BW(chspec) ((chspec) & WL_CHANSPEC_BW_MASK) 228 | 229 | #ifdef WL11N_20MHZONLY 230 | 231 | #define CHSPEC_IS10(chspec) 0 232 | #define CHSPEC_IS20(chspec) 1 233 | #ifndef CHSPEC_IS40 234 | #define CHSPEC_IS40(chspec) 0 235 | #endif 236 | #ifndef CHSPEC_IS80 237 | #define CHSPEC_IS80(chspec) 0 238 | #endif 239 | #ifndef CHSPEC_IS160 240 | #define CHSPEC_IS160(chspec) 0 241 | #endif 242 | #ifndef CHSPEC_IS8080 243 | #define CHSPEC_IS8080(chspec) 0 244 | #endif 245 | 246 | #else /* !WL11N_20MHZONLY */ 247 | 248 | #define CHSPEC_IS10(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10) 249 | #define CHSPEC_IS20(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20) 250 | #ifndef CHSPEC_IS40 251 | #define CHSPEC_IS40(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40) 252 | #endif 253 | #ifndef CHSPEC_IS80 254 | #define CHSPEC_IS80(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80) 255 | #endif 256 | #ifndef CHSPEC_IS160 257 | #define CHSPEC_IS160(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160) 258 | #endif 259 | #ifndef CHSPEC_IS8080 260 | #define CHSPEC_IS8080(chspec) (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080) 261 | #endif 262 | 263 | #endif /* !WL11N_20MHZONLY */ 264 | 265 | #define CHSPEC_IS5G(chspec) (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G) 266 | #define CHSPEC_IS2G(chspec) (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G) 267 | #define CHSPEC_SB_UPPER(chspec) \ 268 | ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) && \ 269 | (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)) 270 | #define CHSPEC_SB_LOWER(chspec) \ 271 | ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) && \ 272 | (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)) 273 | #define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G) 274 | 275 | /** 276 | * Number of chars needed for wf_chspec_ntoa() destination character buffer. 277 | */ 278 | #define CHANSPEC_STR_LEN 20 279 | 280 | 281 | /* Legacy Chanspec defines 282 | * These are the defines for the previous format of the chanspec_t 283 | */ 284 | #define WL_LCHANSPEC_CHAN_MASK 0x00ff 285 | #define WL_LCHANSPEC_CHAN_SHIFT 0 286 | 287 | #define WL_LCHANSPEC_CTL_SB_MASK 0x0300 288 | #define WL_LCHANSPEC_CTL_SB_SHIFT 8 289 | #define WL_LCHANSPEC_CTL_SB_LOWER 0x0100 290 | #define WL_LCHANSPEC_CTL_SB_UPPER 0x0200 291 | #define WL_LCHANSPEC_CTL_SB_NONE 0x0300 292 | 293 | #define WL_LCHANSPEC_BW_MASK 0x0C00 294 | #define WL_LCHANSPEC_BW_SHIFT 10 295 | #define WL_LCHANSPEC_BW_10 0x0400 296 | #define WL_LCHANSPEC_BW_20 0x0800 297 | #define WL_LCHANSPEC_BW_40 0x0C00 298 | 299 | #define WL_LCHANSPEC_BAND_MASK 0xf000 300 | #define WL_LCHANSPEC_BAND_SHIFT 12 301 | #define WL_LCHANSPEC_BAND_5G 0x1000 302 | #define WL_LCHANSPEC_BAND_2G 0x2000 303 | 304 | #define LCHSPEC_CHANNEL(chspec) ((uint8)((chspec) & WL_LCHANSPEC_CHAN_MASK)) 305 | #define LCHSPEC_BAND(chspec) ((chspec) & WL_LCHANSPEC_BAND_MASK) 306 | #define LCHSPEC_CTL_SB(chspec) ((chspec) & WL_LCHANSPEC_CTL_SB_MASK) 307 | #define LCHSPEC_BW(chspec) ((chspec) & WL_LCHANSPEC_BW_MASK) 308 | #define LCHSPEC_IS10(chspec) (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_10) 309 | #define LCHSPEC_IS20(chspec) (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_20) 310 | #define LCHSPEC_IS40(chspec) (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40) 311 | #define LCHSPEC_IS5G(chspec) (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_5G) 312 | #define LCHSPEC_IS2G(chspec) (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_2G) 313 | 314 | #define LCHSPEC_CREATE(chan, band, bw, sb) ((uint16)((chan) | (sb) | (bw) | (band))) 315 | 316 | #define CH20MHZ_LCHSPEC(channel) \ 317 | (chanspec_t)((chanspec_t)(channel) | WL_LCHANSPEC_BW_20 | \ 318 | WL_LCHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \ 319 | WL_LCHANSPEC_BAND_2G : WL_LCHANSPEC_BAND_5G)) 320 | 321 | #endif /* D11AC_IOTYPES */ 322 | 323 | /* 324 | * WF_CHAN_FACTOR_* constants are used to calculate channel frequency 325 | * given a channel number. 326 | * chan_freq = chan_factor * 500Mhz + chan_number * 5 327 | */ 328 | 329 | /** 330 | * Channel Factor for the starting frequence of 2.4 GHz channels. 331 | * The value corresponds to 2407 MHz. 332 | */ 333 | #define WF_CHAN_FACTOR_2_4_G 4814 /* 2.4 GHz band, 2407 MHz */ 334 | 335 | /** 336 | * Channel Factor for the starting frequence of 5 GHz channels. 337 | * The value corresponds to 5000 MHz. 338 | */ 339 | #define WF_CHAN_FACTOR_5_G 10000 /* 5 GHz band, 5000 MHz */ 340 | 341 | /** 342 | * Channel Factor for the starting frequence of 4.9 GHz channels. 343 | * The value corresponds to 4000 MHz. 344 | */ 345 | #define WF_CHAN_FACTOR_4_G 8000 /* 4.9 GHz band for Japan */ 346 | 347 | #define WLC_2G_25MHZ_OFFSET 5 /* 2.4GHz band channel offset */ 348 | 349 | /** 350 | * Convert chanspec to ascii string 351 | * 352 | * @param chspec chanspec format 353 | * @param buf ascii string of chanspec 354 | * 355 | * @return pointer to buf with room for at least CHANSPEC_STR_LEN bytes 356 | * 357 | * @see CHANSPEC_STR_LEN 358 | */ 359 | extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf); 360 | 361 | /** 362 | * Convert ascii string to chanspec 363 | * 364 | * @param a pointer to input string 365 | * 366 | * @return >= 0 if successful or 0 otherwise 367 | */ 368 | extern chanspec_t wf_chspec_aton(const char *a); 369 | 370 | /** 371 | * Verify the chanspec fields are valid. 372 | * 373 | * Verify the chanspec is using a legal set field values, i.e. that the chanspec 374 | * specified a band, bw, ctl_sb and channel and that the combination could be 375 | * legal given some set of circumstances. 376 | * 377 | * @param chanspec input chanspec to verify 378 | * 379 | * @return TRUE if the chanspec is malformed, FALSE if it looks good. 380 | */ 381 | extern bool wf_chspec_malformed(chanspec_t chanspec); 382 | 383 | /** 384 | * Verify the chanspec specifies a valid channel according to 802.11. 385 | * 386 | * @param chanspec input chanspec to verify 387 | * 388 | * @return TRUE if the chanspec is a valid 802.11 channel 389 | */ 390 | extern bool wf_chspec_valid(chanspec_t chanspec); 391 | 392 | /** 393 | * Return the primary (control) channel. 394 | * 395 | * This function returns the channel number of the primary 20MHz channel. For 396 | * 20MHz channels this is just the channel number. For 40MHz or wider channels 397 | * it is the primary 20MHz channel specified by the chanspec. 398 | * 399 | * @param chspec input chanspec 400 | * 401 | * @return Returns the channel number of the primary 20MHz channel 402 | */ 403 | extern uint8 wf_chspec_ctlchan(chanspec_t chspec); 404 | 405 | /** 406 | * Return the primary (control) chanspec. 407 | * 408 | * This function returns the chanspec of the primary 20MHz channel. For 20MHz 409 | * channels this is just the chanspec. For 40MHz or wider channels it is the 410 | * chanspec of the primary 20MHZ channel specified by the chanspec. 411 | * 412 | * @param chspec input chanspec 413 | * 414 | * @return Returns the chanspec of the primary 20MHz channel 415 | */ 416 | extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec); 417 | 418 | /** 419 | * Return a channel number corresponding to a frequency. 420 | * 421 | * This function returns the chanspec for the primary 40MHz of an 80MHz channel. 422 | * The control sideband specifies the same 20MHz channel that the 80MHz channel is using 423 | * as the primary 20MHz channel. 424 | */ 425 | extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec); 426 | 427 | /* 428 | * Return the channel number for a given frequency and base frequency. 429 | * The returned channel number is relative to the given base frequency. 430 | * If the given base frequency is zero, a base frequency of 5 GHz is assumed for 431 | * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz. 432 | * 433 | * Frequency is specified in MHz. 434 | * The base frequency is specified as (start_factor * 500 kHz). 435 | * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for 436 | * 2.4 GHz and 5 GHz bands. 437 | * 438 | * The returned channel will be in the range [1, 14] in the 2.4 GHz band 439 | * and [0, 200] otherwise. 440 | * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the 441 | * frequency is not a 2.4 GHz channel, or if the frequency is not and even 442 | * multiple of 5 MHz from the base frequency to the base plus 1 GHz. 443 | * 444 | * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2 445 | * 446 | * @param freq frequency in MHz 447 | * @param start_factor base frequency in 500 kHz units, e.g. 10000 for 5 GHz 448 | * 449 | * @return Returns a channel number 450 | * 451 | * @see WF_CHAN_FACTOR_2_4_G 452 | * @see WF_CHAN_FACTOR_5_G 453 | */ 454 | extern int wf_mhz2channel(uint freq, uint start_factor); 455 | 456 | /** 457 | * Return the center frequency in MHz of the given channel and base frequency. 458 | * 459 | * Return the center frequency in MHz of the given channel and base frequency. 460 | * The channel number is interpreted relative to the given base frequency. 461 | * 462 | * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise. 463 | * The base frequency is specified as (start_factor * 500 kHz). 464 | * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for 465 | * 2.4 GHz and 5 GHz bands. 466 | * The channel range of [1, 14] is only checked for a start_factor of 467 | * WF_CHAN_FACTOR_2_4_G (4814). 468 | * Odd start_factors produce channels on .5 MHz boundaries, in which case 469 | * the answer is rounded down to an integral MHz. 470 | * -1 is returned for an out of range channel. 471 | * 472 | * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2 473 | * 474 | * @param channel input channel number 475 | * @param start_factor base frequency in 500 kHz units, e.g. 10000 for 5 GHz 476 | * 477 | * @return Returns a frequency in MHz 478 | * 479 | * @see WF_CHAN_FACTOR_2_4_G 480 | * @see WF_CHAN_FACTOR_5_G 481 | */ 482 | extern int wf_channel2mhz(uint channel, uint start_factor); 483 | 484 | /** 485 | * Convert ctl chan and bw to chanspec 486 | * 487 | * @param ctl_ch channel 488 | * @param bw bandwidth 489 | * 490 | * @return > 0 if successful or 0 otherwise 491 | * 492 | */ 493 | extern uint16 wf_channel2chspec(uint ctl_ch, uint bw); 494 | 495 | extern uint wf_channel2freq(uint channel); 496 | extern uint wf_freq2channel(uint freq); 497 | 498 | 499 | #endif /* _bcmwifi_channels_h_ */ 500 | -------------------------------------------------------------------------------- /patches/include/capabilities.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | // external definition to define the capabilities 36 | extern int capabilities; 37 | 38 | // Capabilities of the Nexmon Patch 39 | #define NEX_CAP_MONITOR_MODE (1 << 0) 40 | #define NEX_CAP_MONITOR_MODE_RADIOTAP (1 << 1) 41 | #define NEX_CAP_FRAME_INJECTION (1 << 2) 42 | -------------------------------------------------------------------------------- /patches/include/firmware_version.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef FIRMWARE_VERSION_H 36 | #define FIRMWARE_VERSION_H 37 | 38 | #define CHIP_VER_ALL 0 39 | #define CHIP_VER_BCM4339 1 40 | #define CHIP_VER_BCM4330 2 41 | #define CHIP_VER_BCM4358 3 42 | #define CHIP_VER_BCM43438 4 43 | #define CHIP_VER_FITBIT 5 44 | #define CHIP_VER_WIL6210 6 45 | 46 | #define FW_VER_ALL 0 47 | 48 | // for CHIP_VER_BCM4339 49 | #define FW_VER_6_37_32_RC23_34_40_r581243 10 50 | #define FW_VER_6_37_32_RC23_34_43_r639704 11 51 | 52 | // for CHIP_VER_BCM4330 53 | #define FW_VER_5_90_195_114 20 54 | #define FW_VER_5_90_100_41 21 55 | 56 | // for CHIP_VER_BCM4358 57 | #define FW_VER_7_112_200_17 30 58 | 59 | // for CHIP_VER_BCM43438 60 | #define FW_VER_7_45_41_26_r640327 40 61 | 62 | #define FW_VER_FITBIT 50 63 | 64 | #define FW_VER_7759 60 65 | #define FW_VER_7780 61 66 | #define FW_VER_410_55 62 67 | #define FW_VER_520_18 63 68 | 69 | 70 | #endif /*FIRMWARE_VERSION_H*/ 71 | -------------------------------------------------------------------------------- /patches/include/helper.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef HELPER_H 36 | #define HELPER_H 37 | 38 | #include "types.h" 39 | 40 | void 41 | hexdump(char *desc, void *addr, int len); 42 | 43 | int 44 | printf(const char *fmt, ...); 45 | 46 | void 47 | clearconsole(void); 48 | 49 | #endif /* HELPER_H */ 50 | -------------------------------------------------------------------------------- /patches/include/ieee80211_radiotap.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright (c) 2003, 2004 David Young. All rights reserved. 3 | * 4 | * Redistribution and use in source and binary forms, with or without 5 | * modification, are permitted provided that the following conditions 6 | * are met: 7 | * 1. Redistributions of source code must retain the above copyright 8 | * notice, this list of conditions and the following disclaimer. 9 | * 2. Redistributions in binary form must reproduce the above copyright 10 | * notice, this list of conditions and the following disclaimer in the 11 | * documentation and/or other materials provided with the distribution. 12 | * 3. The name of David Young may not be used to endorse or promote 13 | * products derived from this software without specific prior 14 | * written permission. 15 | * 16 | * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY 17 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 18 | * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 19 | * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID 20 | * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 21 | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 22 | * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 24 | * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25 | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 27 | * OF SUCH DAMAGE. 28 | */ 29 | 30 | /* 31 | * Modifications to fit into the linux IEEE 802.11 stack, 32 | * Mike Kershaw (dragorn@kismetwireless.net) 33 | */ 34 | 35 | #ifndef IEEE80211RADIOTAP_H 36 | #define IEEE80211RADIOTAP_H 37 | 38 | #include 39 | 40 | /* Base version of the radiotap packet header data */ 41 | #define PKTHDR_RADIOTAP_VERSION 0 42 | 43 | /* A generic radio capture format is desirable. There is one for 44 | * Linux, but it is neither rigidly defined (there were not even 45 | * units given for some fields) nor easily extensible. 46 | * 47 | * I suggest the following extensible radio capture format. It is 48 | * based on a bitmap indicating which fields are present. 49 | * 50 | * I am trying to describe precisely what the application programmer 51 | * should expect in the following, and for that reason I tell the 52 | * units and origin of each measurement (where it applies), or else I 53 | * use sufficiently weaselly language ("is a monotonically nondecreasing 54 | * function of...") that I cannot set false expectations for lawyerly 55 | * readers. 56 | */ 57 | 58 | struct tsf { 59 | unsigned int tsf_l; 60 | unsigned int tsf_h; 61 | } __attribute__((packed)); 62 | 63 | /* 64 | * The radio capture header precedes the 802.11 header. 65 | * All data in the header is little endian on all platforms. 66 | */ 67 | struct ieee80211_radiotap_header { 68 | uint8 it_version; /* Version 0. Only increases 69 | * for drastic changes, 70 | * introduction of compatible 71 | * new fields does not count. 72 | */ 73 | uint8 it_pad; 74 | uint16 it_len; /* length of the whole 75 | * header in bytes, including 76 | * it_version, it_pad, 77 | * it_len, and data fields. 78 | */ 79 | uint32 it_present; /* A bitmap telling which 80 | * fields are present. Set bit 31 81 | * (0x80000000) to extend the 82 | * bitmap by another 32 bits. 83 | * Additional extensions are made 84 | * by setting bit 31. 85 | */ 86 | } __attribute__((packed)); 87 | 88 | struct nexmon_radiotap_header { 89 | struct ieee80211_radiotap_header header; 90 | struct tsf tsf; 91 | char flags; 92 | unsigned char data_rate; 93 | unsigned short chan_freq; 94 | unsigned short chan_flags; 95 | char dbm_antsignal; 96 | char dbm_antnoise; 97 | #ifdef RADIOTAP_MCS 98 | char mcs[3]; 99 | char PAD; 100 | #endif 101 | #ifdef RADIOTAP_VHT 102 | unsigned short vht_known; 103 | unsigned char vht_flags; 104 | unsigned char vht_bandwidth; 105 | unsigned char vht_mcs_nss[4]; 106 | unsigned char vht_coding; 107 | unsigned char vht_group_id; 108 | unsigned short vht_partial_aid; 109 | #endif 110 | #ifdef RADIOTAP_VENDOR 111 | unsigned char vendor_oui[3]; 112 | unsigned char vendor_sub_namespace; 113 | unsigned short vendor_skip_length; 114 | #endif 115 | } __attribute__((packed)); 116 | 117 | /* Name Data type Units 118 | * ---- --------- ----- 119 | * 120 | * IEEE80211_RADIOTAP_TSFT __le64 microseconds 121 | * 122 | * Value in microseconds of the MAC's 64-bit 802.11 Time 123 | * Synchronization Function timer when the first bit of the 124 | * MPDU arrived at the MAC. For received frames, only. 125 | * 126 | * IEEE80211_RADIOTAP_CHANNEL 2 x __le16 MHz, bitmap 127 | * 128 | * Tx/Rx frequency in MHz, followed by flags (see below). 129 | * 130 | * IEEE80211_RADIOTAP_FHSS __le16 see below 131 | * 132 | * For frequency-hopping radios, the hop set (first byte) 133 | * and pattern (second byte). 134 | * 135 | * IEEE80211_RADIOTAP_RATE u8 500kb/s 136 | * 137 | * Tx/Rx data rate 138 | * 139 | * IEEE80211_RADIOTAP_DBM_ANTSIGNAL s8 decibels from 140 | * one milliwatt (dBm) 141 | * 142 | * RF signal power at the antenna, decibel difference from 143 | * one milliwatt. 144 | * 145 | * IEEE80211_RADIOTAP_DBM_ANTNOISE s8 decibels from 146 | * one milliwatt (dBm) 147 | * 148 | * RF noise power at the antenna, decibel difference from one 149 | * milliwatt. 150 | * 151 | * IEEE80211_RADIOTAP_DB_ANTSIGNAL u8 decibel (dB) 152 | * 153 | * RF signal power at the antenna, decibel difference from an 154 | * arbitrary, fixed reference. 155 | * 156 | * IEEE80211_RADIOTAP_DB_ANTNOISE u8 decibel (dB) 157 | * 158 | * RF noise power at the antenna, decibel difference from an 159 | * arbitrary, fixed reference point. 160 | * 161 | * IEEE80211_RADIOTAP_LOCK_QUALITY __le16 unitless 162 | * 163 | * Quality of Barker code lock. Unitless. Monotonically 164 | * nondecreasing with "better" lock strength. Called "Signal 165 | * Quality" in datasheets. (Is there a standard way to measure 166 | * this?) 167 | * 168 | * IEEE80211_RADIOTAP_TX_ATTENUATION __le16 unitless 169 | * 170 | * Transmit power expressed as unitless distance from max 171 | * power set at factory calibration. 0 is max power. 172 | * Monotonically nondecreasing with lower power levels. 173 | * 174 | * IEEE80211_RADIOTAP_DB_TX_ATTENUATION __le16 decibels (dB) 175 | * 176 | * Transmit power expressed as decibel distance from max power 177 | * set at factory calibration. 0 is max power. Monotonically 178 | * nondecreasing with lower power levels. 179 | * 180 | * IEEE80211_RADIOTAP_DBM_TX_POWER s8 decibels from 181 | * one milliwatt (dBm) 182 | * 183 | * Transmit power expressed as dBm (decibels from a 1 milliwatt 184 | * reference). This is the absolute power level measured at 185 | * the antenna port. 186 | * 187 | * IEEE80211_RADIOTAP_FLAGS u8 bitmap 188 | * 189 | * Properties of transmitted and received frames. See flags 190 | * defined below. 191 | * 192 | * IEEE80211_RADIOTAP_ANTENNA u8 antenna index 193 | * 194 | * Unitless indication of the Rx/Tx antenna for this packet. 195 | * The first antenna is antenna 0. 196 | * 197 | * IEEE80211_RADIOTAP_RX_FLAGS __le16 bitmap 198 | * 199 | * Properties of received frames. See flags defined below. 200 | * 201 | * IEEE80211_RADIOTAP_TX_FLAGS __le16 bitmap 202 | * 203 | * Properties of transmitted frames. See flags defined below. 204 | * 205 | * IEEE80211_RADIOTAP_RTS_RETRIES u8 data 206 | * 207 | * Number of rts retries a transmitted frame used. 208 | * 209 | * IEEE80211_RADIOTAP_DATA_RETRIES u8 data 210 | * 211 | * Number of unicast retries a transmitted frame used. 212 | * 213 | * IEEE80211_RADIOTAP_MCS u8, u8, u8 unitless 214 | * 215 | * Contains a bitmap of known fields/flags, the flags, and 216 | * the MCS index. 217 | * 218 | * IEEE80211_RADIOTAP_AMPDU_STATUS u32, u16, u8, u8 unitless 219 | * 220 | * Contains the AMPDU information for the subframe. 221 | * 222 | * IEEE80211_RADIOTAP_VHT u16, u8, u8, u8[4], u8, u8, u16 223 | * 224 | * Contains VHT information about this frame. 225 | */ 226 | enum ieee80211_radiotap_type { 227 | IEEE80211_RADIOTAP_TSFT = 0, 228 | IEEE80211_RADIOTAP_FLAGS = 1, 229 | IEEE80211_RADIOTAP_RATE = 2, 230 | IEEE80211_RADIOTAP_CHANNEL = 3, 231 | IEEE80211_RADIOTAP_FHSS = 4, 232 | IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5, 233 | IEEE80211_RADIOTAP_DBM_ANTNOISE = 6, 234 | IEEE80211_RADIOTAP_LOCK_QUALITY = 7, 235 | IEEE80211_RADIOTAP_TX_ATTENUATION = 8, 236 | IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9, 237 | IEEE80211_RADIOTAP_DBM_TX_POWER = 10, 238 | IEEE80211_RADIOTAP_ANTENNA = 11, 239 | IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12, 240 | IEEE80211_RADIOTAP_DB_ANTNOISE = 13, 241 | IEEE80211_RADIOTAP_RX_FLAGS = 14, 242 | IEEE80211_RADIOTAP_TX_FLAGS = 15, 243 | IEEE80211_RADIOTAP_RTS_RETRIES = 16, 244 | IEEE80211_RADIOTAP_DATA_RETRIES = 17, 245 | 246 | IEEE80211_RADIOTAP_MCS = 19, 247 | IEEE80211_RADIOTAP_AMPDU_STATUS = 20, 248 | IEEE80211_RADIOTAP_VHT = 21, 249 | 250 | /* valid in every it_present bitmap, even vendor namespaces */ 251 | IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29, 252 | IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30, 253 | IEEE80211_RADIOTAP_EXT = 31 254 | }; 255 | 256 | /* Channel flags. */ 257 | #define IEEE80211_CHAN_TURBO 0x0010 /* Turbo channel */ 258 | #define IEEE80211_CHAN_CCK 0x0020 /* CCK channel */ 259 | #define IEEE80211_CHAN_OFDM 0x0040 /* OFDM channel */ 260 | #define IEEE80211_CHAN_2GHZ 0x0080 /* 2 GHz spectrum channel. */ 261 | #define IEEE80211_CHAN_5GHZ 0x0100 /* 5 GHz spectrum channel */ 262 | #define IEEE80211_CHAN_PASSIVE 0x0200 /* Only passive scan allowed */ 263 | #define IEEE80211_CHAN_DYN 0x0400 /* Dynamic CCK-OFDM channel */ 264 | #define IEEE80211_CHAN_GFSK 0x0800 /* GFSK channel (FHSS PHY) */ 265 | #define IEEE80211_CHAN_GSM 0x1000 /* GSM (900 MHz) */ 266 | #define IEEE80211_CHAN_STURBO 0x2000 /* Static Turbo */ 267 | #define IEEE80211_CHAN_HALF 0x4000 /* Half channel (10 MHz wide) */ 268 | #define IEEE80211_CHAN_QUARTER 0x8000 /* Quarter channel (5 MHz wide) */ 269 | 270 | /* For IEEE80211_RADIOTAP_FLAGS */ 271 | #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received 272 | * during CFP 273 | */ 274 | #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received 275 | * with short 276 | * preamble 277 | */ 278 | #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received 279 | * with WEP encryption 280 | */ 281 | #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received 282 | * with fragmentation 283 | */ 284 | #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */ 285 | #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between 286 | * 802.11 header and payload 287 | * (to 32-bit boundary) 288 | */ 289 | #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* bad FCS */ 290 | 291 | /* For IEEE80211_RADIOTAP_RX_FLAGS */ 292 | #define IEEE80211_RADIOTAP_F_RX_BADPLCP 0x0002 /* frame has bad PLCP */ 293 | 294 | /* For IEEE80211_RADIOTAP_TX_FLAGS */ 295 | #define IEEE80211_RADIOTAP_F_TX_FAIL 0x0001 /* failed due to excessive 296 | * retries */ 297 | #define IEEE80211_RADIOTAP_F_TX_CTS 0x0002 /* used cts 'protection' */ 298 | #define IEEE80211_RADIOTAP_F_TX_RTS 0x0004 /* used rts/cts handshake */ 299 | #define IEEE80211_RADIOTAP_F_TX_NOACK 0x0008 /* don't expect an ack */ 300 | 301 | 302 | /* For IEEE80211_RADIOTAP_MCS */ 303 | #define IEEE80211_RADIOTAP_MCS_HAVE_BW 0x01 304 | #define IEEE80211_RADIOTAP_MCS_HAVE_MCS 0x02 305 | #define IEEE80211_RADIOTAP_MCS_HAVE_GI 0x04 306 | #define IEEE80211_RADIOTAP_MCS_HAVE_FMT 0x08 307 | #define IEEE80211_RADIOTAP_MCS_HAVE_FEC 0x10 308 | #define IEEE80211_RADIOTAP_MCS_HAVE_STBC 0x20 309 | 310 | #define IEEE80211_RADIOTAP_MCS_BW_MASK 0x03 311 | #define IEEE80211_RADIOTAP_MCS_BW_20 0 312 | #define IEEE80211_RADIOTAP_MCS_BW_40 1 313 | #define IEEE80211_RADIOTAP_MCS_BW_20L 2 314 | #define IEEE80211_RADIOTAP_MCS_BW_20U 3 315 | #define IEEE80211_RADIOTAP_MCS_SGI 0x04 316 | #define IEEE80211_RADIOTAP_MCS_FMT_GF 0x08 317 | #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10 318 | #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60 319 | #define IEEE80211_RADIOTAP_MCS_STBC_1 1 320 | #define IEEE80211_RADIOTAP_MCS_STBC_2 2 321 | #define IEEE80211_RADIOTAP_MCS_STBC_3 3 322 | 323 | #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5 324 | 325 | /* For IEEE80211_RADIOTAP_AMPDU_STATUS */ 326 | #define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN 0x0001 327 | #define IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN 0x0002 328 | #define IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN 0x0004 329 | #define IEEE80211_RADIOTAP_AMPDU_IS_LAST 0x0008 330 | #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR 0x0010 331 | #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN 0x0020 332 | 333 | /* For IEEE80211_RADIOTAP_VHT */ 334 | #define IEEE80211_RADIOTAP_VHT_KNOWN_STBC 0x0001 335 | #define IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA 0x0002 336 | #define IEEE80211_RADIOTAP_VHT_KNOWN_GI 0x0004 337 | #define IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS 0x0008 338 | #define IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM 0x0010 339 | #define IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED 0x0020 340 | #define IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH 0x0040 341 | #define IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID 0x0080 342 | #define IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID 0x0100 343 | 344 | #define IEEE80211_RADIOTAP_VHT_FLAG_STBC 0x01 345 | #define IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA 0x02 346 | #define IEEE80211_RADIOTAP_VHT_FLAG_SGI 0x04 347 | #define IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9 0x08 348 | #define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM 0x10 349 | #define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED 0x20 350 | 351 | #define IEEE80211_RADIOTAP_CODING_LDPC_USER0 0x01 352 | #define IEEE80211_RADIOTAP_CODING_LDPC_USER1 0x02 353 | #define IEEE80211_RADIOTAP_CODING_LDPC_USER2 0x04 354 | #define IEEE80211_RADIOTAP_CODING_LDPC_USER3 0x08 355 | 356 | /** 357 | * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args 358 | * @rtheader: pointer to the radiotap header we are walking through 359 | * @max_length: length of radiotap header in cpu byte ordering 360 | * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg 361 | * @this_arg: pointer to current radiotap arg 362 | * @arg_index: internal next argument index 363 | * @arg: internal next argument pointer 364 | * @next_bitmap: internal pointer to next present u32 365 | * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present 366 | */ 367 | 368 | struct ieee80211_radiotap_iterator { 369 | struct ieee80211_radiotap_header *rtheader; 370 | int max_length; 371 | int this_arg_index; 372 | uint8 *this_arg; 373 | 374 | int arg_index; 375 | uint8 *arg; 376 | uint32 *next_bitmap; 377 | uint32 bitmap_shifter; 378 | }; 379 | 380 | extern int ieee80211_radiotap_iterator_init(struct ieee80211_radiotap_iterator *iterator, struct ieee80211_radiotap_header *radiotap_header, int max_length); 381 | extern int ieee80211_radiotap_iterator_next(struct ieee80211_radiotap_iterator *iterator); 382 | 383 | #endif /* IEEE80211_RADIOTAP_H */ 384 | -------------------------------------------------------------------------------- /patches/include/nexioctls.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #define IOCTL_ERROR -23 36 | #define IOCTL_SUCCESS 0 37 | 38 | // IOCTLs used by Nexmon 39 | #define NEX_GET_CAPABILITIES 400 40 | #define NEX_WRITE_TO_CONSOLE 401 41 | #define NEX_CT_EXPERIMENTS 402 42 | #define NEX_GET_CONSOLE 403 43 | #define NEX_GET_PHYREG 404 44 | #define NEX_SET_PHYREG 405 45 | #define NEX_READ_OBJMEM 406 46 | #define NEX_WRITE_OBJMEM 407 47 | -------------------------------------------------------------------------------- /patches/include/objmem.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #include // structures that are used by the code in the firmware 36 | 37 | void wlc_bmac_read_objmem32_objaddr(struct wlc_hw_info *wlc_hw, unsigned int objaddr, unsigned int *val); 38 | void wlc_bmac_read_objmem32(struct wlc_hw_info *wlc_hw, unsigned int offset, unsigned int *val, int sel); 39 | void wlc_bmac_read_objmem64_objaddr(struct wlc_hw_info *wlc_hw, unsigned int objaddr, unsigned int *val_low, unsigned int *val_high); 40 | void wlc_bmac_read_objmem64(struct wlc_hw_info *wlc_hw, unsigned int offset, unsigned int *val_low, unsigned int *val_high, int sel); 41 | void wlc_bmac_write_objmem64_objaddr(struct wlc_hw_info *wlc_hw, unsigned int objaddr, unsigned int val_low, unsigned int val_high); 42 | void wlc_bmac_write_objmem64(struct wlc_hw_info *wlc_hw, unsigned int offset, unsigned int val_low, unsigned int val_high, int sel); 43 | void wlc_bmac_write_objmem32_objaddr(struct wlc_hw_info *wlc_hw, unsigned int objaddr, unsigned int value); 44 | void wlc_bmac_write_objmem32(struct wlc_hw_info *wlc_hw, unsigned int offset, unsigned int value, int sel); 45 | void wlc_bmac_write_objmem_byte(struct wlc_hw_info *wlc_hw, unsigned int offset, unsigned char value, int sel); 46 | unsigned char wlc_bmac_read_objmem_byte(struct wlc_hw_info *wlc_hw, unsigned int offset, int sel); 47 | -------------------------------------------------------------------------------- /patches/include/patcher.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #define FW_ADDR(addr) (0x8C0000 + addr) 36 | #define UC_ADDR(addr) (0x920000 + addr) 37 | 38 | #define BLPatch(name, func) \ 39 | __attribute__((naked)) void \ 40 | bl_ ## name(void) { asm("bl " #func "\n"); } 41 | 42 | #define BLDPatch(name, func, delay_ins) \ 43 | __attribute__((naked)) void \ 44 | bl_ ## name(void) { asm("bl.d " #func "\n" delay_ins "\n"); } 45 | 46 | #define BPatch(name, func) \ 47 | __attribute__((naked)) void \ 48 | b_ ## name(void) { asm("b " #func "\n"); } 49 | 50 | #define BLNEPatch(name, func) \ 51 | __attribute__((naked)) void \ 52 | bl_ ## name(void) { asm("blne " #func "\n"); } 53 | 54 | #define BDPatch(name, func, delay_ins) \ 55 | __attribute__((naked)) void \ 56 | b_ ## name(void) { asm("b.d " #func "\n" delay_ins "\n"); } 57 | 58 | #define JPatch(name, func) \ 59 | __attribute__((naked)) void \ 60 | j_ ## name(void) { asm("j " #func "\n"); } 61 | 62 | #define GenericPatch4(name, val) \ 63 | const unsigned int gp4_ ## name = (unsigned int) (val); 64 | 65 | #define GenericPatch2(name, val) \ 66 | unsigned short gp2_ ## name = (unsigned short) (val); 67 | 68 | #define GenericPatch1(name, val) \ 69 | unsigned char gp1_ ## name = (unsigned char) (val); 70 | 71 | #define StringPatch(name, val) \ 72 | __attribute__((naked)) \ 73 | void str_ ## name(void) { asm(".ascii \"" val "\"\n.byte 0x00"); } 74 | 75 | #define Dummy(name) \ 76 | void dummy_ ## name(void) { ; } 77 | -------------------------------------------------------------------------------- /patches/include/patcher.h.arm: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #define BLPatch(name, func) \ 36 | __attribute__((naked)) void \ 37 | bl_ ## name(void) { asm("bl " #func "\n"); } 38 | 39 | #define BPatch(name, func) \ 40 | __attribute__((naked)) void \ 41 | b_ ## name(void) { asm("b " #func "\n"); } 42 | 43 | #define HookPatch4(name, func, inst) \ 44 | void b_ ## name(void); \ 45 | __attribute__((naked)) void \ 46 | hook_ ## name(void) \ 47 | { \ 48 | asm( \ 49 | "push {r0-r3,lr}\n" \ 50 | "bl " #func "\n" \ 51 | "pop {r0-r3,lr}\n" \ 52 | inst "\n" \ 53 | "b b_" #name " + 4\n" \ 54 | ); \ 55 | } \ 56 | __attribute__((naked)) void \ 57 | b_ ## name(void) { asm("b hook_" #name "\n"); } 58 | 59 | #define GenericPatch4(name, val) \ 60 | const unsigned int gp4_ ## name = (unsigned int) (val); 61 | 62 | #define GenericPatch2(name, val) \ 63 | unsigned short gp2_ ## name = (unsigned short) (val); 64 | 65 | #define GenericPatch1(name, val) \ 66 | unsigned char gp1_ ## name = (unsigned char) (val); 67 | 68 | #define StringPatch(name, val) \ 69 | __attribute__((naked)) \ 70 | void str_ ## name(void) { asm(".ascii \"" val "\"\n.byte 0x00"); } 71 | 72 | #define Dummy(name) \ 73 | void dummy_ ## name(void) { ; } 74 | -------------------------------------------------------------------------------- /patches/include/rates.h: -------------------------------------------------------------------------------- 1 | #ifndef RATES_H 2 | #define RATES_H 3 | 4 | /* Rate Defines */ 5 | 6 | /* Valid rates for the Supported Rates and Extended Supported Rates IEs. 7 | * Encoding is the rate in 500kbps units, rouding up for fractional values. 8 | * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values. 9 | * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates. 10 | * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27}, 11 | * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices. 12 | */ 13 | 14 | #define RATES_RATE_1M 2 /* 1 Mbps in 500kbps units DSSS */ 15 | #define RATES_RATE_2M 4 /* 2 Mbps in 500kbps units DSSS */ 16 | #define RATES_RATE_5M5 11 /* 5.5 Mbps in 500kbps units DSSS */ 17 | #define RATES_RATE_11M 22 /* 11 Mbps in 500kbps units DSSS */ 18 | #define RATES_RATE_6M 12 /* 6 Mbps in 500kbps units OFDM */ 19 | #define RATES_RATE_9M 18 /* 9 Mbps in 500kbps units OFDN */ 20 | #define RATES_RATE_12M 24 /* 12 Mbps in 500kbps units OFDM */ 21 | #define RATES_RATE_18M 36 /* 18 Mbps in 500kbps units OFDM */ 22 | #define RATES_RATE_24M 48 /* 24 Mbps in 500kbps units OFDM */ 23 | #define RATES_RATE_36M 72 /* 36 Mbps in 500kbps units OFDM */ 24 | #define RATES_RATE_48M 96 /* 48 Mbps in 500kbps units OFDM */ 25 | #define RATES_RATE_54M 108 /* 54 Mbps in 500kbps units OFDM */ 26 | #define RATES_RATE_MAX 108 /* highest rate (54 Mbps) in 500kbps units */ 27 | 28 | #define RATES_RATE_MASK 0x000000FF 29 | #define RATES_VHT_MCS_MASK 0x0000000F 30 | #define RATES_VHT_NSS_MASK 0x000000F0 31 | #define RATES_VHT_NSS_SHIFT 4 32 | 33 | #define RATES_HT_MCS_MASK 0x00000007 34 | #define RATES_HT_NSS_MASK 0x00000078 35 | #define RATES_HT_NSS_SHIFT 3 36 | 37 | #define RATES_TXEXP_MASK 0x00000300 38 | #define RATES_TXEXP_SHIFT 8 39 | 40 | #define RATES_BW_MASK 0x00070000 41 | #define RATES_BW_SHIFT 16 42 | 43 | #define RATES_STBC 0x00100000 44 | #define RATES_TXBF 0x00200000 45 | #define RATES_LDPC_CODING 0x00400000 46 | #define RATES_SHORT_GI 0x00800000 47 | #define RATES_SHORT_PREAMBLE 0x00800000 48 | #define RATES_ENCODING_MASK 0x03000000 49 | #define RATES_OVERRIDE_RATE 0x40000000 50 | #define RATES_OVERRIDE_MODE 0x80000000 51 | 52 | #define RATES_ENCODE_RATE 0x00000000 53 | #define RATES_ENCODE_HT 0x01000000 54 | #define RATES_ENCODE_VHT 0x02000000 55 | 56 | #define BW_20MHZ 1 57 | #define BW_40MHZ 2 58 | #define BW_80MHZ 3 59 | #define BW_160MHZ 4 60 | 61 | #define RATES_BW_UNSPECIFIED 0x00000000 62 | #define RATES_BW_20MHZ (BW_20MHZ << RATES_BW_SHIFT) 63 | #define RATES_BW_40MHZ (BW_40MHZ << RATES_BW_SHIFT) 64 | #define RATES_BW_80MHZ (BW_80MHZ << RATES_BW_SHIFT) 65 | #define RATES_BW_160MHZ (BW_160MHZ << RATES_BW_SHIFT) 66 | 67 | #endif /* RATES_H */ 68 | -------------------------------------------------------------------------------- /patches/include/sendframe.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef SENDFRAME_H 36 | #define SENDFRAME_H 37 | 38 | #include 39 | 40 | void sendframe(struct wlc_info *wlc, struct sk_buff *p, unsigned int fifo, unsigned int rate); 41 | 42 | #endif /* SENDFRAME_H */ 43 | -------------------------------------------------------------------------------- /patches/include/types.h: -------------------------------------------------------------------------------- 1 | #ifndef TYPES_H 2 | #define TYPES_H 3 | 4 | typedef unsigned char byte; 5 | typedef unsigned short word; 6 | typedef unsigned int dword; 7 | typedef unsigned char bool; 8 | typedef signed char int8_t; 9 | typedef unsigned char uint8_t; 10 | typedef signed short int int16_t; 11 | typedef unsigned short int uint16_t; 12 | typedef signed int int32_t; 13 | typedef unsigned int uint32_t; 14 | typedef unsigned long long uint64_t; 15 | typedef long long int64_t; 16 | typedef int8_t int8; 17 | typedef uint8_t uint8; 18 | typedef int16_t int16; 19 | typedef uint16_t uint16; 20 | typedef int32_t int32; 21 | typedef uint32_t uint32; 22 | typedef int64_t int64; 23 | typedef uint64_t uint64; 24 | typedef unsigned char uchar_t; 25 | typedef uint32_t wchar_t; 26 | typedef uint32_t size_t; 27 | typedef uint32_t addr_t; 28 | typedef int32_t pid_t; 29 | typedef uint32_t uint; 30 | 31 | #endif 32 | -------------------------------------------------------------------------------- /patches/include/wrapper.h: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2016 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #ifndef WRAPPER_H 36 | #define WRAPPER_H 37 | 38 | #include "../common/wrapper.c" // wrapper definitions for functions that already exist in the firmware 39 | 40 | #endif /*WRAPPER_H*/ 41 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/hello_world/Makefile: -------------------------------------------------------------------------------- 1 | QFIM=../../../../buildtools/qfim.py 2 | FW_PATH=$(NEXMON_ROOT)/firmwares/wil6210/4-1-0_55 3 | include $(FW_PATH)/definitions.mk 4 | 5 | LOCAL_SRCS=$(wildcard src/*.c) 6 | COMMON_SRCS=$(wildcard $(NEXMON_ROOT)/patches/common/*.c) 7 | FW_SRCS=$(wildcard $(FW_PATH)/*.c) 8 | 9 | OBJS=$(addprefix obj/,$(notdir $(LOCAL_SRCS:.c=.o)) $(notdir $(COMMON_SRCS:.c=.o)) $(notdir $(FW_SRCS:.c=.o))) 10 | 11 | CFLAGS= \ 12 | -fplugin=$(CCPLUGIN) \ 13 | -fplugin-arg-nexmon-objfile=$@ \ 14 | -fplugin-arg-nexmon-prefile=gen/nexmon.pre \ 15 | -fplugin-arg-nexmon-chipver=$(NEXMON_CHIP_NUM) \ 16 | -fplugin-arg-nexmon-fwver=$(NEXMON_FW_VERSION_NUM) \ 17 | -DNEXMON_CHIP=$(NEXMON_CHIP) \ 18 | -DNEXMON_FW_VERSION=$(NEXMON_FW_VERSION) \ 19 | -Wall -Werror -O2 -nostdlib -nostartfiles -ffreestanding -mcpu=$(NEXMON_ARCH) \ 20 | -ffunction-sections -fdata-sections -msize-level=3 -mno-sdata \ 21 | -I$(NEXMON_ROOT)/patches/include \ 22 | -I$(FW_PATH) \ 23 | -Isrc 24 | 25 | all: $(FW_FILE) 26 | 27 | init: FORCE 28 | $(Q)make -s -f $(NEXMON_ROOT)/patches/common/header.mk 29 | $(Q)mkdir -p obj gen log libgcc 30 | 31 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 32 | obj/%.o: src/%.c 33 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 34 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 35 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 36 | 37 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 38 | obj/%.o: $(NEXMON_ROOT)/patches/common/%.c 39 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 40 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 41 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 42 | 43 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 44 | obj/%.o: $(FW_PATH)/%.c 45 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 46 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 47 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 48 | 49 | libgcc: FORCE 50 | @printf "\033[0;31m EXTRACTING LIBGCC\033[0m %s => libgcc/...\n" $< 51 | $(Q)cd libgcc && $(CC)ar -xv `$(CC)gcc -mcpu=$(NEXMON_ARCH) -print-libgcc-file-name` >> /dev/null 52 | 53 | gen/fw.ld: $(OBJS) libgcc 54 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 55 | $(Q)ls -1 libgcc | gawk '{ print "fwpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 56 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 57 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 58 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/fw.ld.awk > $@ 59 | 60 | gen/uc.ld: $(OBJS) libgcc 61 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 62 | $(Q)ls -1 libgcc | gawk '{ print "ucpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 63 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 64 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 65 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/uc.ld.awk > $@ 66 | 67 | gen/fw.mk: $(OBJS) $(FW_PATH)/definitions.mk 68 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 69 | $(Q)printf "gen/$(FW_CODE_FILE): gen/fw_patch.elf FORCE\n" > $@ 70 | $(Q)sort gen/nexmon.pre | \ 71 | gawk -v src_file=gen/fw_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.1.awk 2>>log/compiler.log | \ 72 | gawk -v ramstart=$(FW_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.2.awk >> $@ 2>>log/compiler.log 73 | $(Q)printf "\nFORCE:\n" >> $@ 74 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 75 | 76 | gen/uc.mk: $(OBJS) $(FW_PATH)/definitions.mk 77 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 78 | $(Q)printf "gen/$(UC_CODE_FILE): gen/uc_patch.elf FORCE\n" > $@ 79 | $(Q)sort gen/nexmon.pre | \ 80 | gawk -v src_file=gen/uc_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.1.awk 2>>log/compiler.log | \ 81 | gawk -v ramstart=$(UC_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.2.awk >> $@ 2>>log/compiler.log 82 | $(Q)printf "\nFORCE:\n" >> $@ 83 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 84 | 85 | gen/memory.ld: $(FW_PATH)/definitions.mk 86 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m %s\n" $@ 87 | $(Q)printf "fwcode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_CODE_START) $(FW_CODE_SIZE) >> $@ 88 | $(Q)printf "uccode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_CODE_START) $(UC_CODE_SIZE) >> $@ 89 | $(Q)printf "fwpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_PATCH_START) $(FW_PATCH_SIZE) >> $@ 90 | $(Q)printf "ucpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_PATCH_START) $(UC_PATCH_SIZE) >> $@ 91 | 92 | gen/fw_patch.elf: fw_patch.ld gen/fw.ld gen/memory.ld $(OBJS) 93 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 94 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 95 | 96 | gen/uc_patch.elf: uc_patch.ld gen/uc.ld gen/memory.ld $(OBJS) 97 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 98 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 99 | 100 | gen/$(FW_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/fw_patch.elf gen/fw.mk 101 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 102 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d $@ >>log/qfim.log 103 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/fw.mk => %s (details: log/fw_patches.log)\n" $@ 104 | $(Q)make -f gen/fw.mk >>log/fw_patches.log 2>>log/fw_patches.err 105 | 106 | gen/$(UC_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/uc_patch.elf gen/uc.mk 107 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 108 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_CODE_PARTITION) -d $@ >>log/qfim.log 109 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/uc.mk => %s (details: log/uc_patches.log)\n" $@ 110 | $(Q)make -f gen/uc.mk >>log/uc_patches.log 2>>log/uc_patches.err 111 | 112 | gen/$(FW_DATA_FILE): $(FW_PATH)/$(FW_FILE) 113 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 114 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d $@ >>log/qfim.log 115 | 116 | gen/$(UC_DATA_FILE): $(FW_PATH)/$(FW_FILE) 117 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 118 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_DATA_PARTITION) -d $@ >>log/qfim.log 119 | 120 | # WARNING qfim set data does override the contents of 'filein' in case it gets called multiple times 121 | $(FW_FILE): init gen/$(FW_CODE_FILE) gen/$(UC_CODE_FILE) gen/$(FW_DATA_FILE) gen/$(UC_DATA_FILE) 122 | $(Q)cp $(FW_PATH)/$(FW_FILE) . 123 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_DATA_FILE) $@ 124 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_DATA_FILE) --dsize $$(($(FW_DATA_SIZE))) >>log/qfim.log 125 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_CODE_FILE) $@ 126 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_CODE_FILE) --dsize $$(($(FW_CODE_SIZE))) >>log/qfim.log 127 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_CODE_FILE) $@ 128 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_CODE_FILE) --dsize $$(($(UC_CODE_SIZE))) >>log/qfim.log 129 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_DATA_FILE) $@ 130 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_DATA_FILE) --dsize $$(($(UC_DATA_SIZE))) >>log/qfim.log 131 | @printf "\033[0;31m SETTING CAPABILITIES\033[0m 64 => %s (details: log/qfim.log)\n" $@ 132 | $(Q)$(QFIM) set capabilities --filein wil6210.fw --fileout wil6210.fw -c 64 >>log/qfim.log 133 | 134 | gen/$(basename $(FW_CODE_FILE)).fw_code.elf: $(FW_PATH)/$(FW_FILE) Makefile 135 | $(Q)mkdir -p gen log 136 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 137 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d gen/tmp >>log/qfim.log 138 | @printf "\033[0;31m CREATING TEXT SECTION\033[0m %s => %s\n" gen/tmp $@ 139 | $(Q)$(CC)objcopy --rename-section .data=.text --set-section-flags .text=code,alloc,load,readonly -O elf32-littlearc -Barc600 -I binary gen/tmp $@ 140 | 141 | gen/$(basename $(FW_CODE_FILE)).fw_data.elf: $(FW_PATH)/$(FW_FILE) Makefile 142 | $(Q)mkdir -p gen log 143 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 144 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d gen/tmp >>log/qfim.log 145 | @printf "\033[0;31m CREATING DATA SECTION\033[0m %s => %s\n" gen/tmp $@ 146 | $(Q)$(CC)objcopy -O elf32-littlearc -Barc700 -I binary gen/tmp $@ 147 | 148 | $(basename $(FW_CODE_FILE)).elf: gen/$(basename $(FW_CODE_FILE)).fw_code.elf gen/$(basename $(FW_CODE_FILE)).fw_data.elf Makefile 149 | @printf "\033[0;31m COPYING FILE\033[0m %s => %s\n" gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 150 | $(Q)cp gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 151 | @printf "\033[0;31m CHANGING DATA SECTION ADDRESS\033[0m to %s\n" "0x800000" 152 | $(Q)$(CC)objcopy --change-section-address .data=0x800000 --add-section .data=gen/wil6210.fw_data.elf $@ 153 | 154 | gdb: $(basename $(FW_CODE_FILE)).elf 155 | @printf "\033[0;31m STARTING nSIM SIMULATOR\033[0m on port 1234\n" 156 | $(Q)$(NEXMON_ROOT)/buildtools/nSIM/bin/nsimdrv -gdb -port 1234 -props prop=1,nsim_isa_family=a700,nsim_trace=1,trace_enabled=1 & 157 | @printf "\033[0;31m STARTING GDB\033[0m with %s\n" $< 158 | $(Q)$(CC)gdb -ex "target remote 127.0.0.1:1234" -ex "load" $< 159 | 160 | ################################################################### 161 | 162 | check-nexmon-setup-env: 163 | ifndef NEXMON_SETUP_ENV 164 | $(error run 'source setup_env.sh' first in the repository\'s root directory) 165 | endif 166 | 167 | clean: FORCE 168 | @printf "\033[0;31m CLEANING\033[0m\n" 169 | $(Q)rm -fr $(FW_FILE) obj gen log libgcc $(FW_FILE) $(basename $(FW_CODE_FILE)).elf 170 | 171 | FORCE: 172 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/hello_world/fw_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/fw.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/hello_world/src/fw_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2017 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "fwpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | /* 43 | * Hook the initialization function and print debug output 44 | */ 45 | void 46 | fw_hook() { 47 | printf("FW: INITIALIZED\n"); 48 | sub_28828(); 49 | } 50 | 51 | __attribute__((at(FW_ADDR(0x180A), "", CHIP_VER_WIL6210, FW_VER_410_55))) 52 | BLPatch(fw_hook, fw_hook); 53 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/hello_world/src/uc_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2017 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "ucpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | /* 43 | * Hook the initialization function and print debug output 44 | */ 45 | void 46 | uc_hook() { 47 | printf("UC: INITIALIZED\n"); 48 | sub_1604(); 49 | } 50 | 51 | __attribute__((at(UC_ADDR(0x1590), "", CHIP_VER_WIL6210, FW_VER_410_55))) 52 | BLPatch(uc_hook, uc_hook); 53 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/hello_world/uc_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/uc.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/Makefile: -------------------------------------------------------------------------------- 1 | QFIM=../../../../buildtools/qfim.py 2 | FW_PATH=$(NEXMON_ROOT)/firmwares/wil6210/4-1-0_55 3 | include $(FW_PATH)/definitions.mk 4 | 5 | LOCAL_SRCS=$(wildcard src/*.c) 6 | COMMON_SRCS=$(wildcard $(NEXMON_ROOT)/patches/common/*.c) 7 | FW_SRCS=$(wildcard $(FW_PATH)/*.c) 8 | 9 | OBJS=$(addprefix obj/,$(notdir $(LOCAL_SRCS:.c=.o)) $(notdir $(COMMON_SRCS:.c=.o)) $(notdir $(FW_SRCS:.c=.o))) 10 | 11 | CFLAGS= \ 12 | -fplugin=$(CCPLUGIN) \ 13 | -fplugin-arg-nexmon-objfile=$@ \ 14 | -fplugin-arg-nexmon-prefile=gen/nexmon.pre \ 15 | -fplugin-arg-nexmon-chipver=$(NEXMON_CHIP_NUM) \ 16 | -fplugin-arg-nexmon-fwver=$(NEXMON_FW_VERSION_NUM) \ 17 | -DNEXMON_CHIP=$(NEXMON_CHIP) \ 18 | -DNEXMON_FW_VERSION=$(NEXMON_FW_VERSION) \ 19 | -Wall -Werror -O2 -nostdlib -nostartfiles -ffreestanding -mcpu=$(NEXMON_ARCH) \ 20 | -ffunction-sections -fdata-sections -msize-level=3 -mno-sdata \ 21 | -I$(NEXMON_ROOT)/patches/include \ 22 | -I$(FW_PATH) \ 23 | -Isrc 24 | 25 | all: $(FW_FILE) 26 | 27 | init: FORCE 28 | $(Q)make -s -f $(NEXMON_ROOT)/patches/common/header.mk 29 | $(Q)mkdir -p obj gen log libgcc 30 | 31 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 32 | obj/%.o: src/%.c 33 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 34 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 35 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 36 | 37 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 38 | obj/%.o: $(NEXMON_ROOT)/patches/common/%.c 39 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 40 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 41 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 42 | 43 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 44 | obj/%.o: $(FW_PATH)/%.c 45 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 46 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 47 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 48 | 49 | libgcc: FORCE 50 | @printf "\033[0;31m EXTRACTING LIBGCC\033[0m %s => libgcc/...\n" $< 51 | $(Q)cd libgcc && $(CC)ar -xv `$(CC)gcc -mcpu=$(NEXMON_ARCH) -print-libgcc-file-name` >> /dev/null 52 | 53 | gen/fw.ld: $(OBJS) libgcc 54 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 55 | $(Q)ls -1 libgcc | gawk '{ print "fwpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 56 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 57 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 58 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/fw.ld.awk > $@ 59 | 60 | gen/uc.ld: $(OBJS) libgcc 61 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 62 | $(Q)ls -1 libgcc | gawk '{ print "ucpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 63 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 64 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 65 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/uc.ld.awk > $@ 66 | 67 | gen/fw.mk: $(OBJS) $(FW_PATH)/definitions.mk 68 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 69 | $(Q)printf "gen/$(FW_CODE_FILE): gen/fw_patch.elf FORCE\n" > $@ 70 | $(Q)sort gen/nexmon.pre | \ 71 | gawk -v src_file=gen/fw_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.1.awk 2>>log/compiler.log | \ 72 | gawk -v ramstart=$(FW_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.2.awk >> $@ 2>>log/compiler.log 73 | $(Q)printf "\nFORCE:\n" >> $@ 74 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 75 | 76 | gen/uc.mk: $(OBJS) $(FW_PATH)/definitions.mk 77 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 78 | $(Q)printf "gen/$(UC_CODE_FILE): gen/uc_patch.elf FORCE\n" > $@ 79 | $(Q)sort gen/nexmon.pre | \ 80 | gawk -v src_file=gen/uc_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.1.awk 2>>log/compiler.log | \ 81 | gawk -v ramstart=$(UC_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.2.awk >> $@ 2>>log/compiler.log 82 | $(Q)printf "\nFORCE:\n" >> $@ 83 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 84 | 85 | gen/memory.ld: $(FW_PATH)/definitions.mk 86 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m %s\n" $@ 87 | $(Q)printf "fwcode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_CODE_START) $(FW_CODE_SIZE) >> $@ 88 | $(Q)printf "uccode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_CODE_START) $(UC_CODE_SIZE) >> $@ 89 | $(Q)printf "fwpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_PATCH_START) $(FW_PATCH_SIZE) >> $@ 90 | $(Q)printf "ucpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_PATCH_START) $(UC_PATCH_SIZE) >> $@ 91 | 92 | gen/fw_patch.elf: fw_patch.ld gen/fw.ld gen/memory.ld $(OBJS) 93 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 94 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 95 | 96 | gen/uc_patch.elf: uc_patch.ld gen/uc.ld gen/memory.ld $(OBJS) 97 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 98 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 99 | 100 | gen/$(FW_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/fw_patch.elf gen/fw.mk 101 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 102 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d $@ >>log/qfim.log 103 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/fw.mk => %s (details: log/fw_patches.log)\n" $@ 104 | $(Q)make -f gen/fw.mk >>log/fw_patches.log 2>>log/fw_patches.err 105 | 106 | gen/$(UC_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/uc_patch.elf gen/uc.mk 107 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 108 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_CODE_PARTITION) -d $@ >>log/qfim.log 109 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/uc.mk => %s (details: log/uc_patches.log)\n" $@ 110 | $(Q)make -f gen/uc.mk >>log/uc_patches.log 2>>log/uc_patches.err 111 | 112 | gen/$(FW_DATA_FILE): $(FW_PATH)/$(FW_FILE) 113 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 114 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d $@ >>log/qfim.log 115 | 116 | gen/$(UC_DATA_FILE): $(FW_PATH)/$(FW_FILE) 117 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 118 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_DATA_PARTITION) -d $@ >>log/qfim.log 119 | 120 | # WARNING qfim set data does override the contents of 'filein' in case it gets called multiple times 121 | $(FW_FILE): init gen/$(FW_CODE_FILE) gen/$(UC_CODE_FILE) gen/$(FW_DATA_FILE) gen/$(UC_DATA_FILE) 122 | $(Q)cp $(FW_PATH)/$(FW_FILE) . 123 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_DATA_FILE) $@ 124 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_DATA_FILE) --dsize $$(($(FW_DATA_SIZE))) >>log/qfim.log 125 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_CODE_FILE) $@ 126 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_CODE_FILE) --dsize $$(($(FW_CODE_SIZE))) >>log/qfim.log 127 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_CODE_FILE) $@ 128 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_CODE_FILE) --dsize $$(($(UC_CODE_SIZE))) >>log/qfim.log 129 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_DATA_FILE) $@ 130 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_DATA_FILE) --dsize $$(($(UC_DATA_SIZE))) >>log/qfim.log 131 | @printf "\033[0;31m SETTING CAPABILITIES\033[0m 64 => %s (details: log/qfim.log)\n" $@ 132 | $(Q)$(QFIM) set capabilities --filein wil6210.fw --fileout wil6210.fw -c 64 >>log/qfim.log 133 | 134 | gen/$(basename $(FW_CODE_FILE)).fw_code.elf: $(FW_PATH)/$(FW_FILE) Makefile 135 | $(Q)mkdir -p gen log 136 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 137 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d gen/tmp >>log/qfim.log 138 | @printf "\033[0;31m CREATING TEXT SECTION\033[0m %s => %s\n" gen/tmp $@ 139 | $(Q)$(CC)objcopy --rename-section .data=.text --set-section-flags .text=code,alloc,load,readonly -O elf32-littlearc -Barc600 -I binary gen/tmp $@ 140 | 141 | gen/$(basename $(FW_CODE_FILE)).fw_data.elf: $(FW_PATH)/$(FW_FILE) Makefile 142 | $(Q)mkdir -p gen log 143 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 144 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d gen/tmp >>log/qfim.log 145 | @printf "\033[0;31m CREATING DATA SECTION\033[0m %s => %s\n" gen/tmp $@ 146 | $(Q)$(CC)objcopy -O elf32-littlearc -Barc700 -I binary gen/tmp $@ 147 | 148 | $(basename $(FW_CODE_FILE)).elf: gen/$(basename $(FW_CODE_FILE)).fw_code.elf gen/$(basename $(FW_CODE_FILE)).fw_data.elf Makefile 149 | @printf "\033[0;31m COPYING FILE\033[0m %s => %s\n" gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 150 | $(Q)cp gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 151 | @printf "\033[0;31m CHANGING DATA SECTION ADDRESS\033[0m to %s\n" "0x800000" 152 | $(Q)$(CC)objcopy --change-section-address .data=0x800000 --add-section .data=gen/wil6210.fw_data.elf $@ 153 | 154 | gdb: $(basename $(FW_CODE_FILE)).elf 155 | @printf "\033[0;31m STARTING nSIM SIMULATOR\033[0m on port 1234\n" 156 | $(Q)$(NEXMON_ROOT)/buildtools/nSIM/bin/nsimdrv -gdb -port 1234 -props prop=1,nsim_isa_family=a700,nsim_trace=1,trace_enabled=1 & 157 | @printf "\033[0;31m STARTING GDB\033[0m with %s\n" $< 158 | $(Q)$(CC)gdb -ex "target remote 127.0.0.1:1234" -ex "load" $< 159 | 160 | ################################################################### 161 | 162 | check-nexmon-setup-env: 163 | ifndef NEXMON_SETUP_ENV 164 | $(error run 'source setup_env.sh' first in the repository\'s root directory) 165 | endif 166 | 167 | clean: FORCE 168 | @printf "\033[0;31m CLEANING\033[0m\n" 169 | $(Q)rm -fr $(FW_FILE) obj gen log libgcc $(FW_FILE) $(basename $(FW_CODE_FILE)).elf 170 | 171 | FORCE: 172 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/fw_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/fw.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/src/fw_patch.c: -------------------------------------------------------------------------------- 1 | #pragma NEXMON targetregion "fwpatch" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #define WMI_CMD_HDR_LEN 8 9 | 10 | void 11 | wmi_handler_hook(unsigned short wmi_id, unsigned short data_len, int *data) { 12 | data_len = data_len - WMI_CMD_HDR_LEN; 13 | 14 | printf("wmi_handler_hook() wmi_id: 0x%x, data len: %d\n", wmi_id, data_len); 15 | } 16 | 17 | __attribute__((naked)) 18 | void 19 | naked_main(void) { 20 | asm ( 21 | "push blink\n" 22 | "push r0\n" 23 | "push r1\n" 24 | "push r2\n" 25 | "push r3\n" 26 | "push r4\n" 27 | "push r5\n" 28 | "push r6\n" 29 | "push r7\n" 30 | "push r8\n" 31 | "push r9\n" 32 | "push r10\n" 33 | "push r11\n" 34 | "push r12\n" 35 | "push r13\n" 36 | "push r14\n" 37 | "push r15\n" 38 | "push r16\n" 39 | "push r17\n" 40 | "push r18\n" 41 | "mov r17, r1\n" 42 | //move wmi id to argument 1 43 | "ldw r3, [r17, 0xA]\n" 44 | "mov r0, r3\n" 45 | //data len 46 | "ldw r3, [r17, 0x2]\n" 47 | "mov r1, r3\n" 48 | //data start 49 | "add r2, r17, 0x10\n" 50 | 51 | "bl wmi_handler_hook\n" 52 | 53 | "pop r18\n" 54 | "pop r17\n" 55 | "pop r16\n" 56 | "pop r15\n" 57 | "pop r14\n" 58 | "pop r13\n" 59 | "pop r12\n" 60 | "pop r11\n" 61 | "pop r10\n" 62 | "pop r9\n" 63 | "pop r8\n" 64 | "pop r7\n" 65 | "pop r6\n" 66 | "pop r5\n" 67 | "pop r4\n" 68 | "pop r3\n" 69 | "pop r2\n" 70 | "pop r1\n" 71 | "pop r0\n" 72 | "pop blink\n" 73 | 74 | "b store_r13_to_r17\n" 75 | ); 76 | } 77 | 78 | __attribute__((at(FW_ADDR(0x1A672), "", CHIP_VER_WIL6210, FW_VER_410_55))) 79 | BLPatch(naked_main, naked_main); 80 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/src/sweep_info.h: -------------------------------------------------------------------------------- 1 | #ifndef SWEEP_INFO_H_ 2 | #define SWEEP_INFO_H_ 3 | 4 | #define SWEEP_DUMP_SIZE 256 5 | #define FEEDBACK_OVERWRITE_SIZE 1 6 | 7 | typedef struct { 8 | uint16_t sector_id; 9 | int16_t snr; 10 | uint32_t rssi; 11 | uint8_t macaddr[6]; 12 | uint8_t flags[2]; 13 | } sector_info_t; 14 | 15 | typedef struct { 16 | uint32_t cur_pos; 17 | uint32_t ctr_pkts; 18 | uint32_t ctr_swps; 19 | sector_info_t dump[SWEEP_DUMP_SIZE]; 20 | } sweep_dump_t; 21 | 22 | #define PTR_MEM_SWEEP_CUR_FEEDBACK 0x93D000 23 | #define PTR_MEM_SWEEP_DUMP 0x93D018 24 | 25 | #define PTR_SEL_SWEEP_SECTOR_INFO 0x800F1C 26 | #define PTR_CUR_SWEEP_SECTOR_INFO 0x801038 27 | #define PTR_CUR_FRAME_BUFFER 0x804010 28 | 29 | #endif /* SWEEP_INFO_H_ */ 30 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/src/uc_sweep_info.c: -------------------------------------------------------------------------------- 1 | #pragma NEXMON targetregion "ucpatch" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include "sweep_info.h" 8 | 9 | #define PTR_CUR_SWEEP_SECTOR_INFO 0x801038 10 | #define PTR_SWEEP_VALIDITY 0x80073D 11 | 12 | // --------------------------------------------------------------------------- 13 | // Global fixed variables 14 | // --------------------------------------------------------------------------- 15 | 16 | // The history of sweep packets in a dump 17 | __attribute__((at(PTR_MEM_SWEEP_DUMP, "", CHIP_VER_WIL6210, FW_VER_410_55))) 18 | sweep_dump_t sweep_dump = {0}; 19 | 20 | // Use printf for debugging 21 | int printf(const char *fmt, ...); 22 | 23 | int* const cur_sector_info = (int*) PTR_CUR_SWEEP_SECTOR_INFO; 24 | uint32* const cur_pos = &(sweep_dump.cur_pos); 25 | static uint16 last_id = 0; 26 | 27 | typedef struct { 28 | uint32 rssi; 29 | int32 snr; 30 | uint32 sid; 31 | bool valid; 32 | } sector_info_buffer_t; 33 | sector_info_buffer_t sector_info_buffer = {0}; 34 | 35 | void store_sweep_info_to_buffer(int passed_snr) { 36 | //sector_info_buffer.snr = cur_sector_info[2]; 37 | sector_info_buffer.snr = (int16) passed_snr; 38 | sector_info_buffer.rssi = cur_sector_info[1]; 39 | sector_info_buffer.sid = cur_sector_info[0]; 40 | sector_info_buffer.valid = 1; 41 | } 42 | 43 | void dump_sweep_info() { 44 | // At this point in time, the measurements taken for SNR and RSSI 45 | // are more up to date then the the sector ID and the frame buffer 46 | // To overcome this timing issue, we use a buffer to store the measurements 47 | 48 | sector_info_t* cur_dump; 49 | uint8* cur_frame_ssw_field = (uint8*) PTR_CUR_FRAME_BUFFER + 0x10; 50 | uint8* cur_src_addr = (uint8*) (PTR_CUR_FRAME_BUFFER + 0x0A); 51 | 52 | // Extract the current Frame Control Field from Frame Buffer 53 | uint16* cur_frame_control_field = (uint16*) PTR_CUR_FRAME_BUFFER; 54 | 55 | if (*cur_frame_control_field == 0x0864) { 56 | 57 | // Received a sector sweep frame 58 | if (last_id > cur_sector_info[0]){ 59 | // Increase the sweep counter 60 | sweep_dump.ctr_swps ++; 61 | } 62 | 63 | cur_dump = &sweep_dump.dump[(*cur_pos)]; 64 | cur_dump->sector_id = cur_frame_ssw_field[1] >> 2; 65 | 66 | if (sector_info_buffer.valid) { 67 | 68 | // Add current information to dump 69 | cur_dump->rssi = sector_info_buffer.rssi; 70 | cur_dump->snr = sector_info_buffer.snr; 71 | } else { 72 | // Measurement was incomplete 73 | cur_dump->rssi = 0; 74 | cur_dump->snr = 0; 75 | } 76 | 77 | // Copy the SRC MAC addr 78 | cur_dump->macaddr[0] = cur_src_addr[0]; 79 | cur_dump->macaddr[1] = cur_src_addr[1]; 80 | cur_dump->macaddr[2] = cur_src_addr[2]; 81 | cur_dump->macaddr[3] = cur_src_addr[3]; 82 | cur_dump->macaddr[4] = cur_src_addr[4]; 83 | cur_dump->macaddr[5] = cur_src_addr[5]; 84 | 85 | cur_dump->flags[0] = 0; 86 | cur_dump->flags[1] = 0; 87 | last_id = cur_sector_info[0]; 88 | 89 | // Increase the counter 90 | sweep_dump.ctr_pkts ++; 91 | (*cur_pos) = ((*cur_pos) + 1) % SWEEP_DUMP_SIZE; 92 | } 93 | 94 | // Mark the buffer invalid 95 | sector_info_buffer.valid = 0; 96 | } 97 | __attribute__((at(UC_ADDR(0xD32E), "", CHIP_VER_WIL6210, FW_VER_410_55))) 98 | BLPatch(dump_sweep_info, dump_sweep_info); 99 | 100 | //Hook the processing sweep frame function 101 | __attribute__((naked)) 102 | void 103 | naked_store_sweep_frame_hook(void){ 104 | asm ( 105 | "push blink\n" 106 | "bl sub_A170\n" // Call original function 107 | "mov r0, r5\n" 108 | "bl store_sweep_info_to_buffer\n" // Dump the sweep info 109 | "pop blink\n" 110 | "j [blink]\n" 111 | ); 112 | } 113 | __attribute__((at(UC_ADDR(0xD374), "", CHIP_VER_WIL6210, FW_VER_410_55))) 114 | BLNEPatch(naked_store_sweep_frame_hook, naked_store_sweep_frame_hook); 115 | -------------------------------------------------------------------------------- /patches/wil6210/4-1-0_55/sweep_info/uc_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/uc.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/hello_world/Makefile: -------------------------------------------------------------------------------- 1 | QFIM=../../../../buildtools/qfim.py 2 | FW_PATH=$(NEXMON_ROOT)/firmwares/wil6210/5-2-0_18 3 | include $(FW_PATH)/definitions.mk 4 | 5 | LOCAL_SRCS=$(wildcard src/*.c) 6 | COMMON_SRCS=$(wildcard $(NEXMON_ROOT)/patches/common/*.c) 7 | FW_SRCS=$(wildcard $(FW_PATH)/*.c) 8 | 9 | OBJS=$(addprefix obj/,$(notdir $(LOCAL_SRCS:.c=.o)) $(notdir $(COMMON_SRCS:.c=.o)) $(notdir $(FW_SRCS:.c=.o))) 10 | 11 | CFLAGS= \ 12 | -fplugin=$(CCPLUGIN) \ 13 | -fplugin-arg-nexmon-objfile=$@ \ 14 | -fplugin-arg-nexmon-prefile=gen/nexmon.pre \ 15 | -fplugin-arg-nexmon-chipver=$(NEXMON_CHIP_NUM) \ 16 | -fplugin-arg-nexmon-fwver=$(NEXMON_FW_VERSION_NUM) \ 17 | -DNEXMON_CHIP=$(NEXMON_CHIP) \ 18 | -DNEXMON_FW_VERSION=$(NEXMON_FW_VERSION) \ 19 | -Wall -Werror -O2 -nostdlib -nostartfiles -ffreestanding -mcpu=$(NEXMON_ARCH) \ 20 | -ffunction-sections -fdata-sections -msize-level=3 -mno-sdata \ 21 | -I$(NEXMON_ROOT)/patches/include \ 22 | -I$(FW_PATH) \ 23 | -Isrc 24 | 25 | all: $(FW_FILE) 26 | 27 | init: FORCE 28 | $(Q)make -s -f $(NEXMON_ROOT)/patches/common/header.mk 29 | $(Q)mkdir -p obj gen log libgcc 30 | 31 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 32 | obj/%.o: src/%.c 33 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 34 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 35 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 36 | 37 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 38 | obj/%.o: $(NEXMON_ROOT)/patches/common/%.c 39 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 40 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 41 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 42 | 43 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 44 | obj/%.o: $(FW_PATH)/%.c 45 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 46 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 47 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 48 | 49 | libgcc: FORCE 50 | @printf "\033[0;31m EXTRACTING LIBGCC\033[0m %s => libgcc/...\n" $< 51 | $(Q)cd libgcc && $(CC)ar -xv `$(CC)gcc -mcpu=$(NEXMON_ARCH) -print-libgcc-file-name` >> /dev/null 52 | 53 | gen/fw.ld: $(OBJS) libgcc 54 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 55 | $(Q)ls -1 libgcc | gawk '{ print "fwpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 56 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 57 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 58 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/fw.ld.awk > $@ 59 | 60 | gen/uc.ld: $(OBJS) libgcc 61 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 62 | $(Q)ls -1 libgcc | gawk '{ print "ucpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 63 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 64 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 65 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/uc.ld.awk > $@ 66 | 67 | gen/fw.mk: $(OBJS) $(FW_PATH)/definitions.mk 68 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 69 | $(Q)printf "gen/$(FW_CODE_FILE): gen/fw_patch.elf FORCE\n" > $@ 70 | $(Q)sort gen/nexmon.pre | \ 71 | gawk -v src_file=gen/fw_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.1.awk 2>>log/compiler.log | \ 72 | gawk -v ramstart=$(FW_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.2.awk >> $@ 2>>log/compiler.log 73 | $(Q)printf "\nFORCE:\n" >> $@ 74 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 75 | 76 | gen/uc.mk: $(OBJS) $(FW_PATH)/definitions.mk 77 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 78 | $(Q)printf "gen/$(UC_CODE_FILE): gen/uc_patch.elf FORCE\n" > $@ 79 | $(Q)sort gen/nexmon.pre | \ 80 | gawk -v src_file=gen/uc_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.1.awk 2>>log/compiler.log | \ 81 | gawk -v ramstart=$(UC_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.2.awk >> $@ 2>>log/compiler.log 82 | $(Q)printf "\nFORCE:\n" >> $@ 83 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 84 | 85 | gen/memory.ld: $(FW_PATH)/definitions.mk 86 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m %s\n" $@ 87 | $(Q)printf "fwcode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_CODE_START) $(FW_CODE_SIZE) >> $@ 88 | $(Q)printf "uccode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_CODE_START) $(UC_CODE_SIZE) >> $@ 89 | $(Q)printf "fwpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_PATCH_START) $(FW_PATCH_SIZE) >> $@ 90 | $(Q)printf "ucpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_PATCH_START) $(UC_PATCH_SIZE) >> $@ 91 | 92 | gen/fw_patch.elf: fw_patch.ld gen/fw.ld gen/memory.ld $(OBJS) 93 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 94 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 95 | 96 | gen/uc_patch.elf: uc_patch.ld gen/uc.ld gen/memory.ld $(OBJS) 97 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 98 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 99 | 100 | gen/$(FW_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/fw_patch.elf gen/fw.mk 101 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 102 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d $@ >>log/qfim.log 103 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/fw.mk => %s (details: log/fw_patches.log)\n" $@ 104 | $(Q)make -f gen/fw.mk >>log/fw_patches.log 2>>log/fw_patches.err 105 | 106 | gen/$(UC_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/uc_patch.elf gen/uc.mk 107 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 108 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_CODE_PARTITION) -d $@ >>log/qfim.log 109 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/uc.mk => %s (details: log/uc_patches.log)\n" $@ 110 | $(Q)make -f gen/uc.mk >>log/uc_patches.log 2>>log/uc_patches.err 111 | 112 | gen/$(FW_DATA_FILE): $(FW_PATH)/$(FW_FILE) 113 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 114 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d $@ >>log/qfim.log 115 | 116 | gen/$(UC_DATA_FILE): $(FW_PATH)/$(FW_FILE) 117 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 118 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_DATA_PARTITION) -d $@ >>log/qfim.log 119 | 120 | # WARNING qfim set data does override the contents of 'filein' in case it gets called multiple times 121 | $(FW_FILE): init gen/$(FW_CODE_FILE) gen/$(UC_CODE_FILE) gen/$(FW_DATA_FILE) gen/$(UC_DATA_FILE) 122 | $(Q)cp $(FW_PATH)/$(FW_FILE) . 123 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_DATA_FILE) $@ 124 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_DATA_FILE) --dsize $$(($(FW_DATA_SIZE))) >>log/qfim.log 125 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_CODE_FILE) $@ 126 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_CODE_FILE) --dsize $$(($(FW_CODE_SIZE))) >>log/qfim.log 127 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_CODE_FILE) $@ 128 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_CODE_FILE) --dsize $$(($(UC_CODE_SIZE))) >>log/qfim.log 129 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_DATA_FILE) $@ 130 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_DATA_FILE) --dsize $$(($(UC_DATA_SIZE))) >>log/qfim.log 131 | @printf "\033[0;31m SETTING CAPABILITIES\033[0m 64 => %s (details: log/qfim.log)\n" $@ 132 | $(Q)$(QFIM) set capabilities --filein wil6210.fw --fileout wil6210.fw -c 64 >>log/qfim.log 133 | 134 | gen/$(basename $(FW_CODE_FILE)).fw_code.elf: $(FW_PATH)/$(FW_FILE) Makefile 135 | $(Q)mkdir -p gen log 136 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 137 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d gen/tmp >>log/qfim.log 138 | @printf "\033[0;31m CREATING TEXT SECTION\033[0m %s => %s\n" gen/tmp $@ 139 | $(Q)$(CC)objcopy --rename-section .data=.text --set-section-flags .text=code,alloc,load,readonly -O elf32-littlearc -Barc600 -I binary gen/tmp $@ 140 | 141 | gen/$(basename $(FW_CODE_FILE)).fw_data.elf: $(FW_PATH)/$(FW_FILE) Makefile 142 | $(Q)mkdir -p gen log 143 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 144 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d gen/tmp >>log/qfim.log 145 | @printf "\033[0;31m CREATING DATA SECTION\033[0m %s => %s\n" gen/tmp $@ 146 | $(Q)$(CC)objcopy -O elf32-littlearc -Barc700 -I binary gen/tmp $@ 147 | 148 | $(basename $(FW_CODE_FILE)).elf: gen/$(basename $(FW_CODE_FILE)).fw_code.elf gen/$(basename $(FW_CODE_FILE)).fw_data.elf Makefile 149 | @printf "\033[0;31m COPYING FILE\033[0m %s => %s\n" gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 150 | $(Q)cp gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 151 | @printf "\033[0;31m CHANGING DATA SECTION ADDRESS\033[0m to %s\n" "0x800000" 152 | $(Q)$(CC)objcopy --change-section-address .data=0x800000 --add-section .data=gen/wil6210.fw_data.elf $@ 153 | 154 | gdb: $(basename $(FW_CODE_FILE)).elf 155 | @printf "\033[0;31m STARTING nSIM SIMULATOR\033[0m on port 1234\n" 156 | $(Q)$(NEXMON_ROOT)/buildtools/nSIM/bin/nsimdrv -gdb -port 1234 -props prop=1,nsim_isa_family=a700,nsim_trace=1,trace_enabled=1 & 157 | @printf "\033[0;31m STARTING GDB\033[0m with %s\n" $< 158 | $(Q)$(CC)gdb -ex "target remote 127.0.0.1:1234" -ex "load" $< 159 | 160 | ################################################################### 161 | 162 | check-nexmon-setup-env: 163 | ifndef NEXMON_SETUP_ENV 164 | $(error run 'source setup_env.sh' first in the repository\'s root directory) 165 | endif 166 | 167 | clean: FORCE 168 | @printf "\033[0;31m CLEANING\033[0m\n" 169 | $(Q)rm -fr $(FW_FILE) obj gen log libgcc $(FW_FILE) $(basename $(FW_CODE_FILE)).elf 170 | 171 | FORCE: 172 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/hello_world/fw_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/fw.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/hello_world/src/fw_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2017 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "fwpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | /* 43 | * Hook the initialization function and print debug output 44 | */ 45 | void 46 | fw_hook() { 47 | printf("FW: INITIALIZED\n"); 48 | sub_30040(); 49 | } 50 | 51 | __attribute__((at(FW_ADDR(0x1624), "", CHIP_VER_WIL6210, FW_VER_520_18))) 52 | BLPatch(fw_hook, fw_hook); 53 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/hello_world/src/uc_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2017 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "ucpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | /* 43 | * Hook the initialization function and print debug output 44 | */ 45 | void 46 | uc_hook() { 47 | printf("UC: INITIALIZED\n"); 48 | sub_8bc(); 49 | } 50 | 51 | __attribute__((at(UC_ADDR(0x82c), "", CHIP_VER_WIL6210, FW_VER_520_18))) 52 | BLPatch(uc_hook, uc_hook); 53 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/hello_world/uc_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/uc.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/sweep_info/Makefile: -------------------------------------------------------------------------------- 1 | QFIM=../../../../buildtools/qfim.py 2 | FW_PATH=$(NEXMON_ROOT)/firmwares/wil6210/5-2-0_18 3 | include $(FW_PATH)/definitions.mk 4 | 5 | LOCAL_SRCS=$(wildcard src/*.c) 6 | COMMON_SRCS=$(wildcard $(NEXMON_ROOT)/patches/common/*.c) 7 | FW_SRCS=$(wildcard $(FW_PATH)/*.c) 8 | 9 | OBJS=$(addprefix obj/,$(notdir $(LOCAL_SRCS:.c=.o)) $(notdir $(COMMON_SRCS:.c=.o)) $(notdir $(FW_SRCS:.c=.o))) 10 | 11 | CFLAGS= \ 12 | -fplugin=$(CCPLUGIN) \ 13 | -fplugin-arg-nexmon-objfile=$@ \ 14 | -fplugin-arg-nexmon-prefile=gen/nexmon.pre \ 15 | -fplugin-arg-nexmon-chipver=$(NEXMON_CHIP_NUM) \ 16 | -fplugin-arg-nexmon-fwver=$(NEXMON_FW_VERSION_NUM) \ 17 | -DNEXMON_CHIP=$(NEXMON_CHIP) \ 18 | -DNEXMON_FW_VERSION=$(NEXMON_FW_VERSION) \ 19 | -Wall -Werror -O2 -nostdlib -nostartfiles -ffreestanding -mcpu=$(NEXMON_ARCH) \ 20 | -ffunction-sections -fdata-sections -msize-level=3 -mno-sdata \ 21 | -I$(NEXMON_ROOT)/patches/include \ 22 | -I$(FW_PATH) \ 23 | -Isrc 24 | 25 | all: $(FW_FILE) 26 | 27 | init: FORCE 28 | $(Q)make -s -f $(NEXMON_ROOT)/patches/common/header.mk 29 | $(Q)mkdir -p obj gen log libgcc 30 | 31 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 32 | obj/%.o: src/%.c 33 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 34 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 35 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 36 | 37 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 38 | obj/%.o: $(NEXMON_ROOT)/patches/common/%.c 39 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 40 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 41 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 42 | 43 | #$(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 44 | obj/%.o: $(FW_PATH)/%.c 45 | @printf "\033[0;31m COMPILING\033[0m %s => %s (details: log/compiler.log)\n" $< $@ 46 | $(Q)cat gen/nexmon.pre 2>>log/error.log | gawk '{ if ($$3 != "$@") print; }' > tmp && mv tmp gen/nexmon.pre 47 | $(Q)$(CC)gcc $(CFLAGS) -c $< -o $@ >>log/compiler.log 48 | 49 | libgcc: FORCE 50 | @printf "\033[0;31m EXTRACTING LIBGCC\033[0m %s => libgcc/...\n" $< 51 | $(Q)cd libgcc && $(CC)ar -xv `$(CC)gcc -mcpu=$(NEXMON_ARCH) -print-libgcc-file-name` >> /dev/null 52 | 53 | gen/fw.ld: $(OBJS) libgcc 54 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 55 | $(Q)ls -1 libgcc | gawk '{ print "fwpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 56 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 57 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 58 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/fw.ld.awk > $@ 59 | 60 | gen/uc.ld: $(OBJS) libgcc 61 | @printf "\033[0;31m ADDING LIBGCC\033[0m => gen/nexmon.pre\n" 62 | $(Q)ls -1 libgcc | gawk '{ print "ucpatch TARGETREGION libgcc/" $$1; }' >> gen/nexmon.pre 63 | $(Q)gawk '!a[$$0]++' gen/nexmon.pre > tmp && mv tmp gen/nexmon.pre 64 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m gen/nexmon.pre => %s\n" $@ 65 | $(Q)sort gen/nexmon.pre | gawk -f $(NEXMON_ROOT)/buildtools/scripts/uc.ld.awk > $@ 66 | 67 | gen/fw.mk: $(OBJS) $(FW_PATH)/definitions.mk 68 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 69 | $(Q)printf "gen/$(FW_CODE_FILE): gen/fw_patch.elf FORCE\n" > $@ 70 | $(Q)sort gen/nexmon.pre | \ 71 | gawk -v src_file=gen/fw_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.1.awk 2>>log/compiler.log | \ 72 | gawk -v ramstart=$(FW_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/fw.mk.2.awk >> $@ 2>>log/compiler.log 73 | $(Q)printf "\nFORCE:\n" >> $@ 74 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 75 | 76 | gen/uc.mk: $(OBJS) $(FW_PATH)/definitions.mk 77 | @printf "\033[0;31m GENERATING MAKE FILE\033[0m gen/nexmon.pre => %s (details: log/compiler.log)\n" $@ 78 | $(Q)printf "gen/$(UC_CODE_FILE): gen/uc_patch.elf FORCE\n" > $@ 79 | $(Q)sort gen/nexmon.pre | \ 80 | gawk -v src_file=gen/uc_patch.elf -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.1.awk 2>>log/compiler.log | \ 81 | gawk -v ramstart=$(UC_CODE_START) -f $(NEXMON_ROOT)/buildtools/scripts/uc.mk.2.awk >> $@ 2>>log/compiler.log 82 | $(Q)printf "\nFORCE:\n" >> $@ 83 | $(Q)gawk '!a[$$0]++' $@ > tmp && mv tmp $@ 84 | 85 | gen/memory.ld: $(FW_PATH)/definitions.mk 86 | @printf "\033[0;31m GENERATING LINKER FILE\033[0m %s\n" $@ 87 | $(Q)printf "fwcode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_CODE_START) $(FW_CODE_SIZE) >> $@ 88 | $(Q)printf "uccode : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_CODE_START) $(UC_CODE_SIZE) >> $@ 89 | $(Q)printf "fwpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(FW_PATCH_START) $(FW_PATCH_SIZE) >> $@ 90 | $(Q)printf "ucpatch : ORIGIN = 0x%08x, LENGTH = 0x%08x\n" $(UC_PATCH_START) $(UC_PATCH_SIZE) >> $@ 91 | 92 | gen/fw_patch.elf: fw_patch.ld gen/fw.ld gen/memory.ld $(OBJS) 93 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 94 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 95 | 96 | gen/uc_patch.elf: uc_patch.ld gen/uc.ld gen/memory.ld $(OBJS) 97 | @printf "\033[0;31m LINKING OBJECTS\033[0m => %s (details: log/linker.log, log/linker.err)\n" $@ 98 | $(Q)$(CC)ld -T $< -o $@ --gc-sections --print-gc-sections -M >>log/linker.log 2>>log/linker.err 99 | 100 | gen/$(FW_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/fw_patch.elf gen/fw.mk 101 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 102 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d $@ >>log/qfim.log 103 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/fw.mk => %s (details: log/fw_patches.log)\n" $@ 104 | $(Q)make -f gen/fw.mk >>log/fw_patches.log 2>>log/fw_patches.err 105 | 106 | gen/$(UC_CODE_FILE): $(FW_PATH)/$(FW_FILE) gen/uc_patch.elf gen/uc.mk 107 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 108 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_CODE_PARTITION) -d $@ >>log/qfim.log 109 | @printf "\033[0;31m APPLYING PATCHES\033[0m gen/uc.mk => %s (details: log/uc_patches.log)\n" $@ 110 | $(Q)make -f gen/uc.mk >>log/uc_patches.log 2>>log/uc_patches.err 111 | 112 | gen/$(FW_DATA_FILE): $(FW_PATH)/$(FW_FILE) 113 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 114 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d $@ >>log/qfim.log 115 | 116 | gen/$(UC_DATA_FILE): $(FW_PATH)/$(FW_FILE) 117 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) $@ 118 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(UC_DATA_PARTITION) -d $@ >>log/qfim.log 119 | 120 | # WARNING qfim set data does override the contents of 'filein' in case it gets called multiple times 121 | $(FW_FILE): init gen/$(FW_CODE_FILE) gen/$(UC_CODE_FILE) gen/$(FW_DATA_FILE) gen/$(UC_DATA_FILE) 122 | $(Q)cp $(FW_PATH)/$(FW_FILE) . 123 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_DATA_FILE) $@ 124 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_DATA_FILE) --dsize $$(($(FW_DATA_SIZE))) >>log/qfim.log 125 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(FW_CODE_FILE) $@ 126 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(FW_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(FW_CODE_FILE) --dsize $$(($(FW_CODE_SIZE))) >>log/qfim.log 127 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_CODE_FILE) $@ 128 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_CODE_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_CODE_FILE) --dsize $$(($(UC_CODE_SIZE))) >>log/qfim.log 129 | @printf "\033[0;31m INSERTING\033[0m %s => %s (details: log/qfim.log)\n" gen/$(UC_DATA_FILE) $@ 130 | $(Q)$(QFIM) set data --filein $(FW_FILE) -r $(UC_DATA_PARTITION) --fileout $(FW_FILE) -d gen/$(UC_DATA_FILE) --dsize $$(($(UC_DATA_SIZE))) >>log/qfim.log 131 | @printf "\033[0;31m SETTING CAPABILITIES\033[0m 64 => %s (details: log/qfim.log)\n" $@ 132 | $(Q)$(QFIM) set capabilities --filein wil6210.fw --fileout wil6210.fw -c 64 >>log/qfim.log 133 | 134 | gen/$(basename $(FW_CODE_FILE)).fw_code.elf: $(FW_PATH)/$(FW_FILE) Makefile 135 | $(Q)mkdir -p gen log 136 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 137 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_CODE_PARTITION) -d gen/tmp >>log/qfim.log 138 | @printf "\033[0;31m CREATING TEXT SECTION\033[0m %s => %s\n" gen/tmp $@ 139 | $(Q)$(CC)objcopy --rename-section .data=.text --set-section-flags .text=code,alloc,load,readonly -O elf32-littlearc -Barc600 -I binary gen/tmp $@ 140 | 141 | gen/$(basename $(FW_CODE_FILE)).fw_data.elf: $(FW_PATH)/$(FW_FILE) Makefile 142 | $(Q)mkdir -p gen log 143 | @printf "\033[0;31m EXTRACTING\033[0m %s => %s (details: log/qfim.log)\n" $(FW_PATH)/$(FW_FILE) gen/tmp 144 | $(Q)$(QFIM) get data --filein $(FW_PATH)/$(FW_FILE) -r $(FW_DATA_PARTITION) -d gen/tmp >>log/qfim.log 145 | @printf "\033[0;31m CREATING DATA SECTION\033[0m %s => %s\n" gen/tmp $@ 146 | $(Q)$(CC)objcopy -O elf32-littlearc -Barc700 -I binary gen/tmp $@ 147 | 148 | $(basename $(FW_CODE_FILE)).elf: gen/$(basename $(FW_CODE_FILE)).fw_code.elf gen/$(basename $(FW_CODE_FILE)).fw_data.elf Makefile 149 | @printf "\033[0;31m COPYING FILE\033[0m %s => %s\n" gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 150 | $(Q)cp gen/$(basename $(FW_CODE_FILE)).fw_code.elf $@ 151 | @printf "\033[0;31m CHANGING DATA SECTION ADDRESS\033[0m to %s\n" "0x800000" 152 | $(Q)$(CC)objcopy --change-section-address .data=0x800000 --add-section .data=gen/wil6210.fw_data.elf $@ 153 | 154 | gdb: $(basename $(FW_CODE_FILE)).elf 155 | @printf "\033[0;31m STARTING nSIM SIMULATOR\033[0m on port 1234\n" 156 | $(Q)$(NEXMON_ROOT)/buildtools/nSIM/bin/nsimdrv -gdb -port 1234 -props prop=1,nsim_isa_family=a700,nsim_trace=1,trace_enabled=1 & 157 | @printf "\033[0;31m STARTING GDB\033[0m with %s\n" $< 158 | $(Q)$(CC)gdb -ex "target remote 127.0.0.1:1234" -ex "load" $< 159 | 160 | ################################################################### 161 | 162 | check-nexmon-setup-env: 163 | ifndef NEXMON_SETUP_ENV 164 | $(error run 'source setup_env.sh' first in the repository\'s root directory) 165 | endif 166 | 167 | clean: FORCE 168 | @printf "\033[0;31m CLEANING\033[0m\n" 169 | $(Q)rm -fr $(FW_FILE) obj gen log libgcc $(FW_FILE) $(basename $(FW_CODE_FILE)).elf 170 | 171 | FORCE: 172 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/sweep_info/fw_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/fw.ld 9 | } 10 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/sweep_info/src/fw_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2018 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "fwpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | /* 43 | * Hook the initialization function and print debug output 44 | */ 45 | void 46 | fw_hook() { 47 | printf("FW: INITIALIZED\n"); 48 | sub_30040(); 49 | } 50 | 51 | __attribute__((at(FW_ADDR(0x1624), "", CHIP_VER_WIL6210, FW_VER_520_18))) 52 | BLPatch(fw_hook, fw_hook); 53 | 54 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/sweep_info/src/uc_patch.c: -------------------------------------------------------------------------------- 1 | /*************************************************************************** 2 | * * 3 | * ########### ########### ########## ########## * 4 | * ############ ############ ############ ############ * 5 | * ## ## ## ## ## ## ## * 6 | * ## ## ## ## ## ## ## * 7 | * ########### #### ###### ## ## ## ## ###### * 8 | * ########### #### # ## ## ## ## # # * 9 | * ## ## ###### ## ## ## ## # # * 10 | * ## ## # ## ## ## ## # # * 11 | * ############ ##### ###### ## ## ## ##### ###### * 12 | * ########### ########### ## ## ## ########## * 13 | * * 14 | * S E C U R E M O B I L E N E T W O R K I N G * 15 | * * 16 | * This file is part of NexMon. * 17 | * * 18 | * Copyright (c) 2018 NexMon Team * 19 | * * 20 | * NexMon is free software: you can redistribute it and/or modify * 21 | * it under the terms of the GNU General Public License as published by * 22 | * the Free Software Foundation, either version 3 of the License, or * 23 | * (at your option) any later version. * 24 | * * 25 | * NexMon is distributed in the hope that it will be useful, * 26 | * but WITHOUT ANY WARRANTY; without even the implied warranty of * 27 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * 28 | * GNU General Public License for more details. * 29 | * * 30 | * You should have received a copy of the GNU General Public License * 31 | * along with NexMon. If not, see . * 32 | * * 33 | **************************************************************************/ 34 | 35 | #pragma NEXMON targetregion "ucpatch" 36 | 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | #define PTR_CUR_FRAME_BUFFER 0x804010 43 | #define SWEEP_DUMP_SIZE 256 44 | 45 | typedef struct { 46 | uint8_t src[6]; 47 | uint8_t swp[3]; 48 | int16_t snr; 49 | uint16_t ctr; 50 | uint16_t flags; 51 | } sector_info_t; 52 | 53 | typedef struct { 54 | uint32_t cur_pos; 55 | uint32_t ctr_pkts; 56 | uint32_t ctr_swps; 57 | sector_info_t dump[SWEEP_DUMP_SIZE]; 58 | } sweep_dump_t; 59 | 60 | int16_t snr_buffer = 0; 61 | uint8_t snr_buffer_val = 0; 62 | uint8_t lst_cdown = 0; 63 | 64 | #define PTR_MEM_SWEEP_DUMP 0x93D018 65 | 66 | // The history of sweep packets in a dump 67 | __attribute__((at(PTR_MEM_SWEEP_DUMP, "", CHIP_VER_WIL6210, FW_VER_520_18))) 68 | sweep_dump_t sweep_dump = {0}; 69 | uint32* const cur_pos = &(sweep_dump.cur_pos); 70 | 71 | /* 72 | * Hook the initialization function and print debug output 73 | */ 74 | void 75 | uc_hook() { 76 | printf("UC: INITIALIZED\n"); 77 | sub_8bc(); 78 | } 79 | __attribute__((at(UC_ADDR(0x82c), "", CHIP_VER_WIL6210, FW_VER_520_18))) 80 | BLPatch(uc_hook, uc_hook); 81 | 82 | 83 | /* 84 | * Hook the incoming sweep frames 85 | */ 86 | void 87 | rx_sweep_frame() { 88 | sector_info_t* cur_dump; 89 | uint16* frame_control_field = (uint16*) PTR_CUR_FRAME_BUFFER; 90 | uint8* frame_src_addr = (uint8*) (PTR_CUR_FRAME_BUFFER + 0x0A); 91 | uint8* frame_ssw_field = (uint8*) PTR_CUR_FRAME_BUFFER + 0x10; 92 | uint8 cur_cdown; 93 | 94 | if (*frame_control_field == 0x0864) { 95 | // Received Sector Sweep Frame 96 | if (snr_buffer_val == 1) { 97 | // Add current sweep to dump 98 | cur_dump = &sweep_dump.dump[(*cur_pos)]; 99 | 100 | // Check the CDOWN value 101 | cur_cdown = (frame_ssw_field[0] >> 1) + ((frame_ssw_field[1] & 0x03) << 7); 102 | if (cur_cdown >= lst_cdown){ 103 | sweep_dump.ctr_swps ++; 104 | } 105 | lst_cdown = cur_cdown; 106 | 107 | // Use SNR value 108 | cur_dump->snr = snr_buffer; 109 | 110 | // Copy the SRC MAC addr 111 | cur_dump->src[0] = frame_src_addr[0]; 112 | cur_dump->src[1] = frame_src_addr[1]; 113 | cur_dump->src[2] = frame_src_addr[2]; 114 | cur_dump->src[3] = frame_src_addr[3]; 115 | cur_dump->src[4] = frame_src_addr[4]; 116 | cur_dump->src[5] = frame_src_addr[5]; 117 | 118 | cur_dump->swp[0] = frame_ssw_field[0]; 119 | cur_dump->swp[1] = frame_ssw_field[1]; 120 | cur_dump->swp[2] = frame_ssw_field[2]; 121 | 122 | cur_dump->flags = 0; 123 | cur_dump->ctr = sweep_dump.ctr_swps; 124 | 125 | // Increase the counter 126 | sweep_dump.ctr_pkts ++; 127 | (*cur_pos) = ((*cur_pos) + 1) % SWEEP_DUMP_SIZE; 128 | } 129 | } 130 | else if (*frame_control_field == 0x0a64 || *frame_control_field == 0x0964) { 131 | // Received Acknowledgement or Feedback 132 | printf("SWP Feedback (type %04x) from %02x:%02x:%02x:%02x:%02x:%02x sec: %d, snr: %02d dB\n", 133 | *frame_control_field, frame_src_addr[0], frame_src_addr[1], 134 | frame_src_addr[2], frame_src_addr[3], frame_src_addr[4], 135 | frame_src_addr[5], frame_ssw_field[0] & 0x3F, 136 | frame_ssw_field[1]/4+19); 137 | } 138 | else if (*frame_control_field == 0x0464 || *frame_control_field == 0x0764) { 139 | // Received Grant 140 | printf("SWP Grant (type %04x) from %02x:%02x:%02x:%02x:%02x:%02x\n", 141 | *frame_control_field, frame_src_addr[0], frame_src_addr[1], 142 | frame_src_addr[2], frame_src_addr[3], frame_src_addr[4], 143 | frame_src_addr[5]); 144 | } 145 | snr_buffer_val = 0; 146 | } 147 | __attribute__((at(UC_ADDR(0xF486), "", CHIP_VER_WIL6210, FW_VER_520_18))) 148 | BLPatch(rx_sweep_frame, rx_sweep_frame); 149 | 150 | int16_t 151 | hook_cache(){ 152 | snr_buffer = sub_7e60(); 153 | snr_buffer_val = 1; 154 | return snr_buffer; 155 | } 156 | __attribute__((at(UC_ADDR(0xF4D4), "", CHIP_VER_WIL6210, FW_VER_520_18))) 157 | BLDPatch(hook_cache, hook_cache, "stw r3, [gp,0x66]\n"); 158 | -------------------------------------------------------------------------------- /patches/wil6210/5-2-0_18/sweep_info/uc_patch.ld: -------------------------------------------------------------------------------- 1 | MEMORY 2 | { 3 | INCLUDE gen/memory.ld 4 | } 5 | 6 | SECTIONS 7 | { 8 | INCLUDE gen/uc.ld 9 | } 10 | -------------------------------------------------------------------------------- /setup_env.sh: -------------------------------------------------------------------------------- 1 | OLD_PWD=$(pwd) 2 | cd $(dirname ${BASH_SOURCE[0]}) 3 | 4 | export KERNEL=kernel7 5 | 6 | export HOSTUNAME=$(uname -s) 7 | export PLATFORMUNAME=$(uname -m) 8 | 9 | export NEXMON_ROOT=$(pwd) 10 | 11 | if [ $HOSTUNAME == "Darwin" ]; then 12 | export CC=$NEXMON_ROOT/buildtools/arc_gnu_bin/bin/arc-elf32- 13 | export CCPLUGIN=$NEXMON_ROOT/buildtools/gcc-nexmon-plugin-osx/nexmon.so 14 | export ZLIBFLATE="openssl zlib" 15 | else if [ $HOSTUNAME == "Linux" ] && [ $PLATFORMUNAME == "x86_64" ]; then 16 | export CC=$NEXMON_ROOT/buildtools/arc_gnu_bin/bin/arc-elf32- 17 | export CCPLUGIN=$NEXMON_ROOT/buildtools/gcc-nexmon-plugin/nexmon.so 18 | export ZLIBFLATE="zlib-flate -compress" 19 | else 20 | echo "Platform not supported!" 21 | fi 22 | fi 23 | 24 | export Q=@ 25 | export NEXMON_SETUP_ENV=1 26 | 27 | cd "$OLD_PWD" 28 | --------------------------------------------------------------------------------