Skip to content

bcm4375: added firmware patch for version 18.41.117#663

Open
0xIO32 wants to merge 1 commit into
seemoo-lab:masterfrom
0xIO32:bcm4375b1_18_41_117_patch
Open

bcm4375: added firmware patch for version 18.41.117#663
0xIO32 wants to merge 1 commit into
seemoo-lab:masterfrom
0xIO32:bcm4375b1_18_41_117_patch

Conversation

@0xIO32

@0xIO32 0xIO32 commented Jun 5, 2025

Copy link
Copy Markdown
Contributor

Adds the firmware patch for bcm4375b1 for the version 18.41.117.

Its based on the 18.41.8.9 patch.

@0xIO32 0xIO32 force-pushed the bcm4375b1_18_41_117_patch branch from ba6c2ca to fd117f4 Compare June 6, 2025 19:19
@0xIO32 0xIO32 marked this pull request as ready for review June 6, 2025 20:50
@0xIO32

0xIO32 commented Jun 6, 2025

Copy link
Copy Markdown
Contributor Author

Maybe worth mentioning, I needed libnexmon.so for management frame injection. It didn't work through libfakeioctl, but I think the same issue exists on 18.41.8.9.

@mariocjun

Copy link
Copy Markdown

Nice work on the 18_41_117 port. Working on the CSI side for the same target (4375b1 / 18.41.117 from a Note 10+ Exynos N975F). Already reproduced your monitor-mode build locally for both 18_41_8_9 and 18_41_117 - remapped the 10 RAM-resident addresses in local_wrapper.c via prologue pattern matching across versions. Deltas non-linear, range -0x850 to +0x76B4 - mostly +0x73C4-0x76B4 of forward shift between the two versions plus a couple of functions that actually shrunk (pkt_buf_get_skb / pkt_buf_free_skb -0x850).

For the CSI ucode patch I'm hitting the dual-ucode question. Pattern-matched the bcm43455c0 0x836-0x83B PhyRxStatus_0..5 cluster against 4375b1 ucode1 and ucode2 - zero hits in 0x800-0x8FF (only 7 sparse stores total there, vs 28 stores in bcm43455c0 including the dense block at 0x836). Looks like the Wi-Fi 6 RX header doesn't land in SHM the same way - probably DMA-direct now.

Did anything in your monitor-mode work give hints about where the RX header is materialized in 4375b1, or which of the two ucodes carries the rx_handler that writes it? I'll keep digging either way. Thanks for the base.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants