From 325aa0b7d45fac947da890b6a0756c12bc212594 Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Wed, 14 Oct 2026 17:38:55 +0200 Subject: [PATCH] fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition The device tree asks ath11k for the Fairphone_Gen_6 board data entry. Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so the driver silently falls back to the generic board-id 255 data: the FP6 Plus does not associate on it at all (user report 2026-10-14), and the FP6 keeps its channel list but its scans no longer find the 5 GHz networks around it (two scans found 0 and 1 5 GHz BSSes against 14 with the device's data, the home AP at -37 dBm among the missing), so it associates on 2.4 GHz only (dev phone A/B). The stock modem partition carries the device's own calibration as image/qca6750/bdwlan.elf. New manifest directive ath11k-bdf: copy that ELF and wrap it into a container under /lib/firmware/updates (searched first by the loader) that is upstream's board-2.bin with every entry kept plus one BOARD entry under the requested name. Verified structurally (ELF magic, size, the container magic), no hash pin: the ELF belongs to the stock modem image and can change with it. The sha256 of the base is kept beside the override: a changed base (a linux-firmware upgrade) rebuilds it at the next run, and a rebuild that reproduces the existing file installs nothing; an entry upstream ships under the same name is taken first by the driver, so the appended copy then goes unused. The fragment has no rebind line: the service is ordered before udev's coldplug, which loads the driver, so a fresh install builds the container before the first probe (dev phone, the override removed and rebooted: built at 7.2 s, coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first association on 5 GHz), and an installed phone gets it at its next boot; a re-probe from a package hook would restart wifi in the middle of the upgrade. zstd joins the dependencies to read the compressed base. Dev phone: the built container is byte-identical to the one hand-made from the stock image by the reporter (sha256 186202ee...); the hook's call with the override absent built it over a wifi session that stayed up, a second call installed nothing and a --refresh call left the container unchanged. --- .../30-ath11k-board-data.manifest | 17 +++ aports/device/fp6-vendor-blobs/APKBUILD | 22 ++-- .../fp6-vendor-blobs/fp6-vendor-blobs-extract | 104 +++++++++++++++++- 3 files changed, 133 insertions(+), 10 deletions(-) create mode 100644 aports/device/fp6-vendor-blobs/30-ath11k-board-data.manifest diff --git a/aports/device/fp6-vendor-blobs/30-ath11k-board-data.manifest b/aports/device/fp6-vendor-blobs/30-ath11k-board-data.manifest new file mode 100644 index 0000000..0e4be6d --- /dev/null +++ b/aports/device/fp6-vendor-blobs/30-ath11k-board-data.manifest @@ -0,0 +1,17 @@ +# WCN6750 WLAN board data (calibration, Qualcomm/Fairphone) - taken from the +# stock modem partition on-device instead of being shipped (fp6 repo +# journal/base/ 2026-10-14, journal/blobs/). The device tree asks ath11k for +# the Fairphone_Gen_6 entry; upstream linux-firmware's board-2.bin has none, +# the driver silently falls back to generic data, and on that the FP6 Plus +# does not associate at all (user report 2026-10-14) while the FP6's scans +# no longer find the 5 GHz networks around it, so it associates on 2.4 GHz +# only (dev phone A/B 2026-11-01). The container built here is upstream's +# file with every entry kept plus the device's own bdwlan.elf under the +# requested name; it lives in /lib/firmware/updates, which the loader +# searches first. Active slot first, the other slot as fallback; no hash pin +# - the ELF belongs to the stock modem image and can change with it. No +# rebind line: the service runs before the driver loads, so a fresh install +# has the container at the first probe and an installed phone gets it at +# its next boot - a re-probe from a package hook would restart wifi in the +# middle of an upgrade. +ath11k-bdf modem_a,modem_b image/qca6750/bdwlan.elf bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6 /usr/lib/firmware/ath11k/WCN6750/hw1.0/board-2.bin.zst /usr/lib/firmware/updates/ath11k/WCN6750/hw1.0/board-2.bin diff --git a/aports/device/fp6-vendor-blobs/APKBUILD b/aports/device/fp6-vendor-blobs/APKBUILD index b74bddc..f73e7e2 100644 --- a/aports/device/fp6-vendor-blobs/APKBUILD +++ b/aports/device/fp6-vendor-blobs/APKBUILD @@ -12,28 +12,33 @@ # drops a previously-shipped blob restores the file immediately instead of # at the next boot (--refresh in addition for an mbn consumer: it re-derives # the trustlet from the active slot even if a file is present). Consumers: -# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet). +# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet); +# this package's own 30-ath11k-board-data fragment (WLAN board data). # # 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally # verified mode for mbn, --refresh -- after two field units got no # fingerprint sensor from a whole-image hash pin that can only match one # Android build (fp6 repo journal/blobs/, journal/fingerprint/). +# 1-r4 (2026-10-14): the ath11k-bdf directive -- the WLAN board data the +# device tree asks for, built on-device from the stock modem partition +# (the FP6 Plus does not associate on upstream's generic data). maintainer="Jorijn van der Graaf " pkgname=fp6-vendor-blobs pkgver=1 -pkgrel=3 +pkgrel=4 pkgdesc="On-device extraction of vendor blobs from the stock Android partitions" url="https://forgejo.catcrafts.net/Catcrafts/fp6-img" arch="noarch" license="GPL-3.0-only" # fallback mapper for when the initramfs didn't map the dynamic partitions -depends="make-dynpart-mappings" +depends="make-dynpart-mappings zstd" install="$pkgname.post-upgrade" options="!check" source=" fp6-vendor-blobs-extract fp6-vendor-blobs.service fp6-vendor-blobs.preset + 30-ath11k-board-data.manifest " package() { @@ -42,8 +47,9 @@ package() { install -Dm644 "$srcdir"/fp6-vendor-blobs.service \ "$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service # enabled unconditionally: the unit is a fast no-op once every manifest - # dest exists, and blobs appearing on first boot must not depend on a - # manual systemctl enable. sysinit = the real (pre-coldplug) run; + # dest exists and every ath11k-bdf override is current against its base, + # and blobs appearing on first boot must not depend on a manual + # systemctl enable. sysinit = the real (pre-coldplug) run; # multi-user = the post-udev retry if the early run failed (see unit) mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \ "$pkgdir"/etc/systemd/system/multi-user.target.wants @@ -58,11 +64,13 @@ package() { # extracted, no sound card. See journal/blobs/ 2026-08-28. install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \ "$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset - mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d + install -Dm644 "$srcdir"/30-ath11k-board-data.manifest \ + "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/30-ath11k-board-data.manifest } sha512sums=" -e9618b4a1ccbe0913a608b32a1a9e87337e3da79a3d7ccc7f49292ae9aaa9406d2ea9817d63b3cfff2c4346b80dd2476c10725f4f0f95c859acd17b22ec03a16 fp6-vendor-blobs-extract +6aee5f56bc7bc960537b7ca1069305b56a5ec8da99a58298ba1715e93f002d391a2bd24be78214428b0297f9e3cfd1003a243c76a2d08397dcac63a7d800d302 fp6-vendor-blobs-extract b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service 9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset +f13d7b384a9b577762693c6831fbf28cb9e92e4f943af1917ddeba121c582f0c85c81a3e01e8e9ff6367c3717b6c37743f019db297f75339871292cf816bfc91 30-ath11k-board-data.manifest " diff --git a/aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract b/aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract index 7f5b940..650d7cc 100644 --- a/aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract +++ b/aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract @@ -11,6 +11,7 @@ # # file # mbn +# ath11k-bdf # rebind # # Partition lists are tried in the order written, except that on an A/B @@ -47,6 +48,24 @@ # itself and refuses a damaged or foreign image (one flipped byte -> # ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03). The sha256 of what was # installed is logged either way. +# ath11k-bdf: the WLAN board data (calibration) the device tree asks ath11k +# for by name, e.g. bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6. +# Upstream linux-firmware's board-2.bin carries no Fairphone entry, so the +# driver silently falls back to the generic board-id data; the FP6 Plus does +# not associate on it (user report 2026-10-14, fp6 repo journal/base/). The +# stock modem partition has the device's own file (image/qca6750/bdwlan.elf). +# This directive copies it and wraps it into a container at (the +# loader searches /lib/firmware/updates first): (board-2.bin or +# board-2.bin.zst, every upstream entry kept byte for byte) + one BOARD +# entry named holding the ELF. Verified structurally (ELF +# magic, sane size, the container's own magic), never by a pinned hash: +# the ELF belongs to the stock modem image and can change with it. +# The driver takes the first BOARD entry whose name matches, so an entry +# upstream ships under the same name is used before the appended copy. +# The sha256 of the used is kept in .fp6-base: a that +# changed since (a linux-firmware upgrade) rebuilds at the next +# run, and so does --refresh. A rebuild that reproduces the existing +# byte for byte installs nothing and does not count as extracted. # rebind: if this fragment's run extracted at least one file, unbind and # re-probe on so the consuming driver picks the file up # in the same boot. Unconditional on purpose: a still-bound consumer may @@ -64,8 +83,9 @@ # --if-device: exit 0 quietly when no stock super partition is visible # (apk post-install scripts run inside build/CI chroots too; on images # built there the first-boot service does the real extraction). -# --refresh: re-derive every mbn dest even if it exists, replacing it only -# with an image that verifies (a failed refresh leaves the old file). For +# --refresh: re-derive every mbn and ath11k-bdf dest even if it exists, +# replacing it only with an image that verifies (a failed refresh leaves +# the old file). For # the consumer's post-install/post-upgrade: a fresh 'apk add' gets its # trustlet without a reboot, and a trustlet that was hand-placed or pinned # to another build is replaced by the active slot's on the next upgrade. @@ -257,6 +277,76 @@ extract_mbn() { # fail "no listed partition ($parts) yields $rname with sha256 $want - $dest NOT installed$kept" } +# One little-endian u32 as four raw bytes (busybox printf, octal escapes). +le32() { # + printf "\\$(printf %03o $(($1 & 255)))\\$(printf %03o $((($1 >> 8) & 255)))\\$(printf %03o $((($1 >> 16) & 255)))\\$(printf %03o $((($1 >> 24) & 255)))" +} +pad4() { # -> bytes of zero padding to the next multiple of 4, on stdout + n=$(( (4 - $1 % 4) % 4 )) + [ "$n" -gt 0 ] && head -c "$n" /dev/zero + return 0 +} +# .fp6-base records the sha256 of the was built from. +bdf_base_id() { sha256sum "$1" | awk '{print $1}'; } +bdf_current() { # - true when exists and was built from this + [ -f "$1" ] && [ -e "$2" ] && [ -f "$2.fp6-base" ] || return 1 + read -r bh bs < "$2.fp6-base" + [ "$bh" = "$(bdf_base_id "$1")" ] +} +extract_ath11k_bdf() { # + parts=$1 bsrc=$2 bname=$3 bbase=$4 bdest=$5 + [ -f "$bbase" ] || fail "ath11k-bdf: base container $bbase missing" + bid=$(bdf_base_id "$bbase") + braw="$bdest.fp6-raw.$$" + mkdir -p "${bdest%/*}" || fail "cannot create ${bdest%/*}" + case "$bbase" in + *.zst) zstd -dcq "$bbase" > "$braw" 2>/dev/null || { rm -f "$braw"; fail "ath11k-bdf: cannot decompress $bbase"; } ;; + *) cp "$bbase" "$braw" || { rm -f "$braw"; fail "ath11k-bdf: cannot read $bbase"; } ;; + esac + [ "$(head -c 16 "$braw")" = "QCA-ATH11K-BOARD" ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is not a QCA-ATH11K-BOARD container"; } + # the driver walks the entries 4-byte aligned; an entry appended to an + # unaligned base would be misread and the generic data used silently + bsz=$(fsize "$braw") + [ $(( bsz % 4 )) -eq 0 ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is $bsz bytes, not a multiple of 4"; } + for part in $(order_parts "$parts"); do + mount_part "$part" || { log "$part: not mountable, trying next"; continue; } + elf="$MNT/$bsrc" + [ -f "$elf" ] || { log "$part: no $bsrc, trying next"; continue; } + esz=$(fsize "$elf") + [ "$(hex4 "$elf")" = 7f454c46 ] || { log "$part:$bsrc: not an ELF image, trying next"; continue; } + [ "$esz" -ge 4096 ] && [ "$esz" -le $((1024 * 1024)) ] || { log "$part:$bsrc: $esz bytes is not a board data file, trying next"; continue; } + nlen=${#bname} + npad=$(( (nlen + 3) / 4 * 4 )) + dpad=$(( (esz + 3) / 4 * 4 )) + tmp="$bdest.fp6-extract.$$" + # container = base + BOARD IE { NAME IE, DATA IE }, each IE padded to 4 + { + cat "$braw" + le32 0; le32 $((8 + npad + 8 + dpad)) + le32 0; le32 "$nlen"; printf '%s' "$bname"; pad4 "$nlen" + le32 1; le32 "$esz"; cat "$elf"; pad4 "$esz" + } > "$tmp" 2>/dev/null || { rm -f "$tmp"; fail "ath11k-bdf: writing $tmp failed"; } + want=$(( $(fsize "$braw") + 8 + 8 + npad + 8 + dpad )) + tsz=$(fsize "$tmp") + [ "$tsz" -eq "$want" ] || { rm -f "$tmp" "$braw"; fail "ath11k-bdf: $tmp is $tsz bytes, expected $want"; } + got=$(sha256sum "$tmp" | awk '{print $1}') + if [ -e "$bdest" ] && [ "$(sha256sum "$bdest" | awk '{print $1}')" = "$got" ]; then + rm -f "$tmp" "$braw" + echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base" + log "ath11k-bdf: $bdest is already $bbase + $bname from $part:$bsrc (sha256 $got) - unchanged" + return 2 + fi + chmod 644 "$tmp" && mv "$tmp" "$bdest" || { rm -f "$tmp" "$braw"; fail "installing $bdest failed"; } + echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base" + rm -f "$braw" + log "built $bdest = $bbase + $bname from $part:$bsrc ($esz bytes, sha256 $got)" + return 0 + done + rm -f "$braw" + kept= + [ -e "$bdest" ] && kept=" (the existing file is left in place)" + fail "no listed partition ($parts) yields a well-formed $bsrc - $bdest NOT installed$kept" +} extract() { # parts=$1 src=$2 dest=$3 want=$4 for part in $(order_parts "$parts"); do @@ -312,7 +402,8 @@ fi [ -d "$MANIFEST_DIR" ] || exit 0 -# fast path for every boot after the first: all dests already present +# fast path for every boot after the first: every file/mbn dest present and +# every ath11k-bdf dest current against its base (bdf_current) missing= for f in "$MANIFEST_DIR"/*.manifest; do [ -e "$f" ] || continue @@ -320,6 +411,7 @@ for f in "$MANIFEST_DIR"/*.manifest; do case "$kind" in file) [ -e "$c" ] || missing=1 ;; mbn) [ -e "$d" ] && [ -z "$REFRESH" ] || missing=1 ;; + ath11k-bdf) [ -z "$REFRESH" ] && bdf_current "$d" "$e" || missing=1 ;; esac done < "$f" done @@ -345,6 +437,12 @@ for f in "$MANIFEST_DIR"/*.manifest; do extract_mbn "$a" "$b" "$c" "$d" "$e"