Topic: Support for BCM43217 PCI-ID 14e4:a8db

The content of this topic has been archived on 3 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

Niravsoft

26 Sep 2015, 12:34

When we would get support for [Chip ID bcm43217 | PCI-ID 14e4:a8db | PHY N (r17)] ?
Currently I have tested it in openwrt (trunk) for W8960N V5 / Plusnet 2704NV1 (fast2704N)

And found that:
It works perfectly well in 802.11g mode.
But it doesn't work in 802.11n mode.

On the page https://wireless.wiki.kernel.org/en/users/drivers/b43 it is mentioned that it is partially supported. It is not supported by any other driver except b43. And the use of this chip is increasing day by day AFAIK.

Please tell me if it would be supporting wireless n in future or not? If yes, what's the status of the work? Tell me if I could help in it's support.

Details:

These are some extracts from dmesg:

[    0.304000] registering PCI controller with io_map_base unset
[    0.316000] PCI host bridge to bus 0000:00
[    0.320000] pci_bus 0000:00: root bus resource [mem 0x10200000-0x102fffff]
[    0.324000] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.328000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.332000] pci 0000:00:00.0: [14e4:6318] type 01 class 0x060400
[    0.332000] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.332000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.336000] pci 0000:01:00.0: [14e4:a8db] type 00 class 0x028000
[    0.336000] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[    0.336000] pci 0000:01:00.0: supports D1 D2
[    0.336000] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.336000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.336000] pci 0000:00:00.0: BAR 8: assigned [mem 0x10200000-0x102fffff]
[    0.340000] pci 0000:01:00.0: BAR 0: assigned [mem 0x10200000-0x10207fff 64bit]
[    0.344000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.348000] pci 0000:00:00.0:   bridge window [mem 0x10200000-0x102fffff]
[    0.352000] Switched to clocksource MIPS
[    0.360000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[    0.364000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[    0.372000] bcma: bus0: Found chip with id 43217, rev 0x01 and package 0x09
[    0.376000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x27, class 0x0)
[    0.388000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1E, class 0x0)
[    0.396000] bcma: bus0: Core 2 found: PCIe (manuf 0x4BF, id 0x820, rev 0x14, class 0x0)
[    0.404000] bcma_fallback_sprom: pci bus/device num mismatch: expected 0/0, but got 1/0
[    0.424000] bcma: bus0: Bus registered

and

[   31.352000] cfg80211: Calling CRDA to update world regulatory domain
[   31.412000] cfg80211: World regulatory domain updated:
[   31.416000] cfg80211:  DFS Master region: unset
[   31.420000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   31.432000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   31.440000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   31.448000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   31.456000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   31.464000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   31.472000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   31.480000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   31.492000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   31.688000] PPP generic driver version 2.4.2
[   31.700000] NET: Registered protocol family 24
[   31.776000] b43-phy0: Broadcom 43217 WLAN found (core revision 30)
[   31.784000] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 17
[   31.792000] b43-phy0: Found Radio: Manuf 0x17F, ID 0x2057, Revision 14, Version 0
[   31.800000] Broadcom 43xx driver loaded [ Features: PNL ]
[   31.952000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'

and

[   47.844000] cfg80211: Calling CRDA for country: IN
[   47.856000] cfg80211: Regulatory domain changed to country: IN
[   47.860000] cfg80211:  DFS Master region: JP
[   47.864000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   47.876000] cfg80211:   (2402000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   47.884000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   47.892000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   47.904000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   48.200000] pppoe-wan: renamed from ppp0
[   52.852000] b43-phy0: Loading firmware version 666.2 (2011-02-23 01:15:07)
[   53.008000] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   53.088000] device wlan0 entered promiscuous mode


root@OpenWrt:~# cat /proc/bus/pci/devices 
0000    14e46318    1f                   0                   0                   0                   0                   0                   0                   0                   0                   0                   0                   0                   0                   0                   0    pcieport
0100    14e4a8db    1f            10200004                   0                   0                   0                   0                   0                   0                8001                   0                   0                   0                   0                   0                   0    bcma-pci-bridge

Is there some error with fallback SPROM?
I looked at the device patch and found that .fallback_SPROM is not present.

For further details read my ticket and all comments at https://dev.openwrt.org/ticket/20227.
Thanks in advance for your help and time taken.

(Last edited by Niravsoft on 2 Oct 2015, 07:59)

Post #2

matty

27 Sep 2015, 13:29

Hello, I have tried 2 fallback SPROM variants with the same problem.

Here is what I adjusted for the Sagem/Plusnet router:
"/build_dir/target-mips_mips32_musl-1.1.11/linux-brcm63xx_generic/linux-4.1.6/arch/mips/bcm63xx/boards/board_bcm963xx.c" - starting at line 224.

static struct sprom_fixup __initdata FAST2704N_fixups[] = {
    { .offset = 6, .value = 0x1c00 },
    { .offset = 65, .value = 0x1255 },
    { .offset = 97, .value = 0xfe6a },
    { .offset = 98, .value = 0x168f },
    { .offset = 99, .value = 0xfa7d },
    { .offset = 113, .value = 0xfe3d },
    { .offset = 114, .value = 0x16b8 },
    { .offset = 115, .value = 0xfa43 },
    { .offset = 161, .value = 0x2222 },
    { .offset = 162, .value = 0x6644 },
    { .offset = 169, .value = 0x4422 },
    { .offset = 170, .value = 0x6644 },
    { .offset = 171, .value = 0x6644 },
    { .offset = 172, .value = 0x6666 },
    { .offset = 173, .value = 0x6644 },
    { .offset = 174, .value = 0xaa88 },
    { .offset = 175, .value = 0x6644 },
    { .offset = 176, .value = 0xaa88 },
};

static struct board_info __initdata board_FAST2704N = {
    .name                = "F@ST2704N",
    .expected_cpu_id        = 0x6318,

    .has_uart0            = 1,
    .has_pci            = 1,
    .use_fallback_sprom        = 1,

    .has_enetsw            = 1,

    .has_ohci0            = 1,
    .has_ehci0            = 1,
    .num_usbh_ports            = 1,

    .enetsw = {
        .used_ports = {
            [0] = {
                .used    = 1,
                .phy_id = 1,
                .name    = "Port 1",
            },
            [1] = {
                .used    = 1,
                .phy_id    = 2,
                .name    = "Port 2",
            },
            [2] = {
                .used    = 1,
                .phy_id    = 3,
                .name    = "Port 3",
            },
            [3] = {
                .used    = 1,
                .phy_id    = 4,
                .name    = "Port 4",
            },
        },
    },

    .fallback_sprom = {
        .type                 = SPROM_BCM43217,
        .pci_bus            = 1,
        .pci_dev            = 0,
        .board_fixups            = FAST2704N_fixups,
        .num_board_fixups        = ARRAY_SIZE(FAST2704N_fixups),
    },
};

From what I can tell, the board revision is slightly different to the other 43217 which has a different PCI ID. (0x1255 compaired to 0x1252).
Unfortunalty I do not have an answer, I can only show my test attempts. I hope it will work with someone else?

(Last edited by matty on 27 Sep 2015, 14:00)

Post #3

Niravsoft

27 Sep 2015, 17:53

@Matty, it seems that we need to work with b43 drivers to get full support for bcm43217.
As I mentioned before b43 doesn't support bcm43217 pci id 14e4:a8db fully.
If you can, please mail b43 developers so as to get help.

Post #4

matty

27 Sep 2015, 21:17

I will try...

Post #5

Niravsoft

28 Sep 2015, 06:29

> cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
Looking at my logs carefully I can find that the device bcm43217 can support 5GHz band also. Can't it? It would be great if we could figure out how.

(Last edited by Niravsoft on 28 Sep 2015, 06:35)

Post #6

Niravsoft

29 Sep 2015, 08:28

Found this online for plusnet 2704n at http://www.andremachado.org/artigos/122 … 2704n.html
In /var/tmp/bootupmessages of Original firmware:

Neither SPROM nor OTP has valid image
wl: srom / otp not programmed, using main memory mapped srom info (wombo board)
wl: loading /etc/wlan/bcm43217_vars.bin
Failed to open srom image from '/etc/wlan/bcm43217_vars.bin'.
wl: loading /etc/wlan/bcm43217_map.bin
wl0: Broadcom BCMa8db 802.11 Wireless Controller 5.100.138.200
Error: kerSysRegisterDyingGaspHandler: list head is null
Broadcom 802.1Q VLAN Interface, v0.1

It seems that it has a file called bcm43217_map.bin which is loaded for the chip to work correctly. I found this file in the GPL code for TPlink TD-8960n V5 also. We must figure out how to use it.
Also it seems that we should at least use Broadcom driver version 5.100.138.200

(Last edited by Niravsoft on 29 Sep 2015, 08:30)

Post #7

matty

29 Sep 2015, 14:50

Dont worry about the cfg80211 info, that just 'regulatory domain' info.
Regarding the SPROM, I have tried both of those files already with no luck.

I did notice that someone was nice enough to mark the source code:
"/openwrt/build_dir/target-mips_mips32_musl-1.1.11/linux-brcm63xx_generic/compat-wireless-2015-07-21/drivers/net/wireless/b43/phy_n.c" - line 1030

if (0) /* FIXME: Is this BCM43217 specific? */
    b43_radio_set(dev, R2057_XTALPUOVR_PINCTRL, 0x2);

Unfortunately this did not help either.

I'm still slowly trying, but I'm running out of ideas...
( I think I need a Memory IO monitor, a bit like reserve engineering the driver )

(Last edited by matty on 29 Sep 2015, 15:08)

Post #8

Niravsoft

29 Sep 2015, 15:24

I am also checking this:

static void b43_radio_2057_init_post(struct b43_wldev *dev)
{
    if (0) 
        b43_radio_set(dev, R2057_XTALPUOVR_PINCTRL, 0x1);
        
    /* FIXME: Is this BCM43217 specific? */
        b43_radio_set(dev, R2057_XTALPUOVR_PINCTRL, 0x2);

    b43_radio_set(dev, R2057_RFPLL_MISC_CAL_RESETN, 0x78);
    b43_radio_set(dev, R2057_XTAL_CONFIG2, 0x80);
    mdelay(2);
    b43_radio_mask(dev, R2057_RFPLL_MISC_CAL_RESETN, ~0x78);
    b43_radio_mask(dev, R2057_XTAL_CONFIG2, ~0x80);

    if (dev->phy.do_full_init) {
        b43_radio_2057_rcal(dev);
        b43_radio_2057_rccal(dev);
    }
    b43_radio_mask(dev, R2057_RFPLL_MASTER, ~0x8);
}

After changing the location of if(0) I think I should try.
BTW I had reached this FIXME comment before but my system crashed and then I forgot the file and location of the file where I found it. Afterwards I was searching in openwrt/build_dir/target-mips_mips32_uClibc-0.9.33.2/linux-brcm63xx_generic/linux-3.18.21/drivers/net/wireless/b43 and was puzzled to find it there too.

(Last edited by Niravsoft on 29 Sep 2015, 15:25)

Post #9

matty

29 Sep 2015, 16:14

Cool, here should be the sprom fixup for a TD-8960n:

static struct sprom_fixup __initdata FAST2704N_fixups[] = {
    { .offset = 6, .value = 0x1c00 },
    { .offset = 65, .value = 0x1255 },
    { .offset = 79, .value = 0x0505 },
    { .offset = 96, .value = 0x2058 },
    { .offset = 98, .value = 0x18ac },
    { .offset = 99, .value = 0xfa2b },
    { .offset = 112, .value = 0x2058 },
    { .offset = 114, .value = 0x18d0 },
    { .offset = 115, .value = 0xfa20 },
    { .offset = 161, .value = 0x4444 },
    { .offset = 162, .value = 0x4444 },
    { .offset = 169, .value = 0x4444 },
    { .offset = 170, .value = 0x4444 },
    { .offset = 171, .value = 0x4444 },
    { .offset = 172, .value = 0x4444 },
    { .offset = 173, .value = 0x6666 },
    { .offset = 174, .value = 0x6666 },
    { .offset = 175, .value = 0x6666 },
    { .offset = 176, .value = 0x6666 },
};

static struct board_info __initdata board_FAST2704N = {
    .name                = "F@ST2704N",
    .expected_cpu_id        = 0x6318,

    .has_uart0            = 1,
    .has_pci            = 1,
    .use_fallback_sprom        = 1,

    .has_enetsw            = 1,

    .has_ohci0            = 1,
    .has_ehci0            = 1,
    .num_usbh_ports            = 1,

    .enetsw = {
        .used_ports = {
            [0] = {
                .used    = 1,
                .phy_id = 1,
                .name    = "Port 1",
            },
            [1] = {
                .used    = 1,
                .phy_id    = 2,
                .name    = "Port 2",
            },
            [2] = {
                .used    = 1,
                .phy_id    = 3,
                .name    = "Port 3",
            },
            [3] = {
                .used    = 1,
                .phy_id    = 4,
                .name    = "Port 4",
            },
        },
    },

    .fallback_sprom = {
        .type                 = SPROM_BCM43217,
        .pci_bus            = 1,
        .pci_dev            = 0,
        .board_fixups            = FAST2704N_fixups,
        .num_board_fixups        = ARRAY_SIZE(FAST2704N_fixups),
    },
};

I compaired the GPL source bcm43217_map.bin file to this one:
/openwrt/build_dir/target-mips_mips32_musl-1.1.11/linux-brcm63xx_generic/linux-4.1.6/arch/mips/bcm63xx/sprom.c - line 228 ?
(please check my results)

Hopefully they will remove linux-3.18 soon and just stick with linux-4.1.

(Last edited by matty on 29 Sep 2015, 16:21)

Post #10

matty

29 Sep 2015, 16:45

hmmm, are you using the trunk? or something else?

Post #11

matty

30 Sep 2015, 03:27

I managed to extract the wlan micro-codes from the firmware. It did not help me, but it might help you?
https://drive.google.com/open?id=0B4-Ln … mZXN1pZeGM

Post #12

Niravsoft

30 Sep 2015, 06:56

I have ported Fast2704N to Chaos Calmer on my system. Trunk builds are not much stable and sometimes can't be successfully built. It happened few times and then I decided to work with Chaos calmer buildroot to make the patch. Afterwards it can be easily ported to trunk. Don't worry, I also have the trunk buildroot on my system.
I will check your result and report ASAP.

(Last edited by Niravsoft on 30 Sep 2015, 07:38)

Post #13

Niravsoft

30 Sep 2015, 10:32

@Matty I compiled your sprom for 8960n succesfully and flashed it on my router. Still no benefit. I am not sure how to push the firmware into openwrt router (the .fw file) and how to apply it.
Now I am trying to patch mac80211 driver stack. The FIXME comment part.
And I have also checked SPROM_BCM43217 in the sprom.c file. It is same in both the kernel.

(Last edited by Niravsoft on 30 Sep 2015, 10:34)

Post #14

Niravsoft

30 Sep 2015, 12:53

There was no benefit patching FIXME in mac80211. However it was patched successfully but on second boot the wifi failed, so I am reverting back.

I found the registers for N phy at this site http://bcm-v4.sipsolutions.net/802.11/PHY/Registers Hope it helps.
Looking at the specs on this site I can find that the chip is capable of 4 SSIDs simultanuously.

For tools for Reverse Engineering you can use Rec Studio 4(worked for me in kernel 2.6 only) or to Reverse Engineer as well as for embeding in GPL code to trace I/O you can use capstone: http://www.capstone-engine.org/embed.html

You can find the portable code for broadcom drives here:
http://svn.dd-wrt.com/browser/src/linux … rcm/arm/wl
I know they are for arm processor but it seems that they could be easily ported as most of the binary are OS independent
They can be compared with the git of brcm80211 softmac drivers found at https://github.com/Broadcom/brcm80211
and also in the linux kernel. And changes can be foundout between the revisions and brcm802.11 softmac drivers can be updated to support bcm43217. The bcm80211 is older revision in the kernel and the version in the dd-wrt is newer.

(Last edited by Niravsoft on 1 Oct 2015, 08:02)

Post #15

matty

1 Oct 2015, 17:38

Good info, thanks. I'll need time to understand capstone.
Regarding the .fw file. I manually copied it across after I swapped the firmware. (then rebooted)

(Last edited by matty on 1 Oct 2015, 17:40)

Post #16

Niravsoft

2 Oct 2015, 07:47

In case you have not already done so and want to compile the GPL code for TD-W8960N V5 or may be TD-W8968 V3, you will need linux kernel 2.6 i386 for which I use Fedora 12 which when installed with all features works easily. https://archives.fedoraproject.org/pub/ … /i386/iso/ And please don't update the kernel. We are using this distribution because we want that particular (2.6 32-bit) kernel.

TD-W8960N V5 firmware has more free space (>3 MB) while the TD-W8968N V3 firmware has additional USB support but has negligible free space (even if it has any). Everything else is same in both of them. Anyone of them would work.

(Last edited by Niravsoft on 3 Oct 2015, 07:38)

Post #17

Niravsoft

2 Oct 2015, 17:34

After swapping the .fw file and rebooting the wifi stopped working, so had to revert back.

Post #18

matty

2 Oct 2015, 17:35

I'm using ubuntu with GPL TD-W8960N v5.

P.S. I think I'm going to give up soon. I can not find a program/solution to monitor anything usefull. I know there are programs to trace stuff. But they do not trace any variables, only functions.
Also I dont know the jtag pinout.

Post #19

matty

2 Oct 2015, 18:54

oh I have a quick question. does your TD-W8960N have a jtag?
if so... are you able to take 2 righ-resolution photos of the PCB (front & back). So I can see where the jtag pins lead in-to the cpu?

Post #20

Niravsoft

3 Oct 2015, 07:33

No, mine (TD-W8960N V5) doesn't have a JTAG. At least I couldn't find it. But you can program the SPI flash directly as mentioned in the Plusnet2704n wiki. But you probabely would't need to. It is only needed if you corrupt the CFE. What I do to reflash is mentioned below:
1. Press and hold the reset button.
2. Switch off the router by removing the power. Wait for some 5 seconds.
3. Turn on the router. Wait for about 30 seconds. Release the reset button.
4. Open 192.168.1.1 in a browser.
5. Click browse and upload the Firmware.
Note: Keep the reset button pressed during steps 1 to 3. If the Router boots normally you might need to do this again.

If you have a working openwrt firmware running you can flash it with any firmware.

> I think I'm going to give up soon.
PLEASE don't give up. At least until my next response. We must see the possiblilities we have open.

> I'm using ubuntu with GPL TD-W8960N v5.
Ubuntu with GPL won't work AFAIK. Better if you use Fedora 12 in a virtual machine. Read this https://forum.openwrt.org/viewtopic.php … 89#p294289

> I know there are programs to trace stuff. But they do not trace any variables, only functions.
Since you are dealing with binaries on a router, you can only monitor functions. You can't trace variables (at least in the router firmware). You should find out which functions use the variables and their addresses and debug that way.
I am not sure but IDA Pro might be able to do what you want, but it (sadly) it isn't free. I am researching on IDA Pro especially to RE the drivers and to integrate it to the firmware.

(Last edited by Niravsoft on 4 Jan 2016, 15:55)

Post #21

matty

3 Oct 2015, 21:04

well, ejtag is more than just flashing firmware. its a hardware level debugging tool. e.g. halt the processor... access registers...
> Ubuntu with GPL won't work AFAIK
? odd, it works with no problems for me?

try http://www.radare.org/, its like a free IDA. (but a pain to remember the commands)
Also, my main computer Mobo has failed yesterday, so I'm afraid I'm going quiet for a couple of weeks. Sorry.

Post #22

Niravsoft

30 Oct 2015, 05:19

Any updates?

Post #23

Niravsoft

2 Nov 2015, 12:15

I Recently found a driver called bcmdhd. It is open source and built for android.
https://android.googlesource.com/kernel … ess/bcmdhd

If we are able to port it to openwrt, then it might solve our problem and could be a boon for broadcom based devices.
May be that it is a FullMac driver, but it seems to work with bcm43217 And as android phones have tethering built-in it would be supporting AP mode.

Can somebody help to calculate offsets for bcm43217 chip with this source so, as to support it in b43 (if possible)?
https://android.googlesource.com/kernel … /sbchipc.h Reads:
/* 43217 Chip specific ChipControl register bits */
#define CCTRL43217_EXTPA_C0 (1<<13) /* core0 extPA in ChipControl 1, bit 13 */
#define CCTRL43217_EXTPA_C1 (1<<8) /* core1 extPA in ChipControl 1, bit 8 */

Post #24

edifanze

16 Aug 2016, 12:05

@Niravsoft I have fast2704n router, is adsl working properly or you do some modification

Post #25

Niravsoft

19 Aug 2016, 14:52

@edifanze
This router has broadcom ADSL and hence it won't work. The fault is with broadcom not providing any drivers.
If you run openwrt the modem portion (ADSL) won't work, but you can still use it as a wifi router by using one LAN port as WAN.

The discussion might have continued from here.

Page 1 of 1