fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition

The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.

New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.

zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
This commit is contained in:
Jorijn van der Graaf 2026-10-14 17:38:55 +02:00
commit 325aa0b7d4
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
3 changed files with 133 additions and 10 deletions

View file

@ -0,0 +1,17 @@
# WCN6750 WLAN board data (calibration, Qualcomm/Fairphone) - taken from the
# stock modem partition on-device instead of being shipped (fp6 repo
# journal/base/ 2026-10-14, journal/blobs/). The device tree asks ath11k for
# the Fairphone_Gen_6 entry; upstream linux-firmware's board-2.bin has none,
# the driver silently falls back to generic data, and on that the FP6 Plus
# does not associate at all (user report 2026-10-14) while the FP6's scans
# no longer find the 5 GHz networks around it, so it associates on 2.4 GHz
# only (dev phone A/B 2026-11-01). The container built here is upstream's
# file with every entry kept plus the device's own bdwlan.elf under the
# requested name; it lives in /lib/firmware/updates, which the loader
# searches first. Active slot first, the other slot as fallback; no hash pin
# - the ELF belongs to the stock modem image and can change with it. No
# rebind line: the service runs before the driver loads, so a fresh install
# has the container at the first probe and an installed phone gets it at
# its next boot - a re-probe from a package hook would restart wifi in the
# middle of an upgrade.
ath11k-bdf modem_a,modem_b image/qca6750/bdwlan.elf bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6 /usr/lib/firmware/ath11k/WCN6750/hw1.0/board-2.bin.zst /usr/lib/firmware/updates/ath11k/WCN6750/hw1.0/board-2.bin

View file

@ -12,28 +12,33 @@
# drops a previously-shipped blob restores the file immediately instead of
# at the next boot (--refresh in addition for an mbn consumer: it re-derives
# the trustlet from the active slot even if a file is present). Consumers:
# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet).
# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet);
# this package's own 30-ath11k-board-data fragment (WLAN board data).
#
# 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally
# verified mode for mbn, --refresh -- after two field units got no
# fingerprint sensor from a whole-image hash pin that can only match one
# Android build (fp6 repo journal/blobs/, journal/fingerprint/).
# 1-r4 (2026-10-14): the ath11k-bdf directive -- the WLAN board data the
# device tree asks for, built on-device from the stock modem partition
# (the FP6 Plus does not associate on upstream's generic data).
maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
pkgname=fp6-vendor-blobs
pkgver=1
pkgrel=3
pkgrel=4
pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
arch="noarch"
license="GPL-3.0-only"
# fallback mapper for when the initramfs didn't map the dynamic partitions
depends="make-dynpart-mappings"
depends="make-dynpart-mappings zstd"
install="$pkgname.post-upgrade"
options="!check"
source="
fp6-vendor-blobs-extract
fp6-vendor-blobs.service
fp6-vendor-blobs.preset
30-ath11k-board-data.manifest
"
package() {
@ -42,8 +47,9 @@ package() {
install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
# enabled unconditionally: the unit is a fast no-op once every manifest
# dest exists, and blobs appearing on first boot must not depend on a
# manual systemctl enable. sysinit = the real (pre-coldplug) run;
# dest exists and every ath11k-bdf override is current against its base,
# and blobs appearing on first boot must not depend on a manual
# systemctl enable. sysinit = the real (pre-coldplug) run;
# multi-user = the post-udev retry if the early run failed (see unit)
mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \
"$pkgdir"/etc/systemd/system/multi-user.target.wants
@ -58,11 +64,13 @@ package() {
# extracted, no sound card. See journal/blobs/ 2026-08-28.
install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \
"$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset
mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d
install -Dm644 "$srcdir"/30-ath11k-board-data.manifest \
"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/30-ath11k-board-data.manifest
}
sha512sums="
e9618b4a1ccbe0913a608b32a1a9e87337e3da79a3d7ccc7f49292ae9aaa9406d2ea9817d63b3cfff2c4346b80dd2476c10725f4f0f95c859acd17b22ec03a16 fp6-vendor-blobs-extract
6aee5f56bc7bc960537b7ca1069305b56a5ec8da99a58298ba1715e93f002d391a2bd24be78214428b0297f9e3cfd1003a243c76a2d08397dcac63a7d800d302 fp6-vendor-blobs-extract
b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service
9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset
f13d7b384a9b577762693c6831fbf28cb9e92e4f943af1917ddeba121c582f0c85c81a3e01e8e9ff6367c3717b6c37743f019db297f75339871292cf816bfc91 30-ath11k-board-data.manifest
"

View file

@ -11,6 +11,7 @@
#
# file <partition[,partition...]> <path-in-partition> <dest> <sha256>
# mbn <partition[,partition...]> <dir-in-partition> <name> <dest> <sha256|->
# ath11k-bdf <partition[,partition...]> <path-in-partition> <entry-name> <base> <dest>
# rebind <bus> <device>
#
# Partition lists are tried in the order written, except that on an A/B
@ -47,6 +48,24 @@
# itself and refuses a damaged or foreign image (one flipped byte ->
# ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03). The sha256 of what was
# installed is logged either way.
# ath11k-bdf: the WLAN board data (calibration) the device tree asks ath11k
# for by name, e.g. bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6.
# Upstream linux-firmware's board-2.bin carries no Fairphone entry, so the
# driver silently falls back to the generic board-id data; the FP6 Plus does
# not associate on it (user report 2026-10-14, fp6 repo journal/base/). The
# stock modem partition has the device's own file (image/qca6750/bdwlan.elf).
# This directive copies it and wraps it into a container at <dest> (the
# loader searches /lib/firmware/updates first): <base> (board-2.bin or
# board-2.bin.zst, every upstream entry kept byte for byte) + one BOARD
# entry named <entry-name> holding the ELF. Verified structurally (ELF
# magic, sane size, the container's own magic), never by a pinned hash:
# the ELF belongs to the stock modem image and can change with it.
# The driver takes the first BOARD entry whose name matches, so an entry
# upstream ships under the same name is used before the appended copy.
# The sha256 of the <base> used is kept in <dest>.fp6-base: a <base> that
# changed since (a linux-firmware upgrade) rebuilds <dest> at the next
# run, and so does --refresh. A rebuild that reproduces the existing
# <dest> byte for byte installs nothing and does not count as extracted.
# rebind: if this fragment's run extracted at least one file, unbind and
# re-probe <device> on <bus> so the consuming driver picks the file up
# in the same boot. Unconditional on purpose: a still-bound consumer may
@ -64,8 +83,9 @@
# --if-device: exit 0 quietly when no stock super partition is visible
# (apk post-install scripts run inside build/CI chroots too; on images
# built there the first-boot service does the real extraction).
# --refresh: re-derive every mbn dest even if it exists, replacing it only
# with an image that verifies (a failed refresh leaves the old file). For
# --refresh: re-derive every mbn and ath11k-bdf dest even if it exists,
# replacing it only with an image that verifies (a failed refresh leaves
# the old file). For
# the consumer's post-install/post-upgrade: a fresh 'apk add' gets its
# trustlet without a reboot, and a trustlet that was hand-placed or pinned
# to another build is replaced by the active slot's on the next upgrade.
@ -257,6 +277,76 @@ extract_mbn() { # <partition,...> <dir-in-partition> <name> <dest> <sha256|->
fail "no listed partition ($parts) yields $rname with sha256 $want - $dest NOT installed$kept"
}
# One little-endian u32 as four raw bytes (busybox printf, octal escapes).
le32() { # <value>
printf "\\$(printf %03o $(($1 & 255)))\\$(printf %03o $((($1 >> 8) & 255)))\\$(printf %03o $((($1 >> 16) & 255)))\\$(printf %03o $((($1 >> 24) & 255)))"
}
pad4() { # <length> -> bytes of zero padding to the next multiple of 4, on stdout
n=$(( (4 - $1 % 4) % 4 ))
[ "$n" -gt 0 ] && head -c "$n" /dev/zero
return 0
}
# <dest>.fp6-base records the sha256 of the <base> <dest> was built from.
bdf_base_id() { sha256sum "$1" | awk '{print $1}'; }
bdf_current() { # <base> <dest> - true when <dest> exists and was built from this <base>
[ -f "$1" ] && [ -e "$2" ] && [ -f "$2.fp6-base" ] || return 1
read -r bh bs < "$2.fp6-base"
[ "$bh" = "$(bdf_base_id "$1")" ]
}
extract_ath11k_bdf() { # <partition,...> <path-in-partition> <entry-name> <base> <dest>
parts=$1 bsrc=$2 bname=$3 bbase=$4 bdest=$5
[ -f "$bbase" ] || fail "ath11k-bdf: base container $bbase missing"
bid=$(bdf_base_id "$bbase")
braw="$bdest.fp6-raw.$$"
mkdir -p "${bdest%/*}" || fail "cannot create ${bdest%/*}"
case "$bbase" in
*.zst) zstd -dcq "$bbase" > "$braw" 2>/dev/null || { rm -f "$braw"; fail "ath11k-bdf: cannot decompress $bbase"; } ;;
*) cp "$bbase" "$braw" || { rm -f "$braw"; fail "ath11k-bdf: cannot read $bbase"; } ;;
esac
[ "$(head -c 16 "$braw")" = "QCA-ATH11K-BOARD" ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is not a QCA-ATH11K-BOARD container"; }
# the driver walks the entries 4-byte aligned; an entry appended to an
# unaligned base would be misread and the generic data used silently
bsz=$(fsize "$braw")
[ $(( bsz % 4 )) -eq 0 ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is $bsz bytes, not a multiple of 4"; }
for part in $(order_parts "$parts"); do
mount_part "$part" || { log "$part: not mountable, trying next"; continue; }
elf="$MNT/$bsrc"
[ -f "$elf" ] || { log "$part: no $bsrc, trying next"; continue; }
esz=$(fsize "$elf")
[ "$(hex4 "$elf")" = 7f454c46 ] || { log "$part:$bsrc: not an ELF image, trying next"; continue; }
[ "$esz" -ge 4096 ] && [ "$esz" -le $((1024 * 1024)) ] || { log "$part:$bsrc: $esz bytes is not a board data file, trying next"; continue; }
nlen=${#bname}
npad=$(( (nlen + 3) / 4 * 4 ))
dpad=$(( (esz + 3) / 4 * 4 ))
tmp="$bdest.fp6-extract.$$"
# container = base + BOARD IE { NAME IE, DATA IE }, each IE padded to 4
{
cat "$braw"
le32 0; le32 $((8 + npad + 8 + dpad))
le32 0; le32 "$nlen"; printf '%s' "$bname"; pad4 "$nlen"
le32 1; le32 "$esz"; cat "$elf"; pad4 "$esz"
} > "$tmp" 2>/dev/null || { rm -f "$tmp"; fail "ath11k-bdf: writing $tmp failed"; }
want=$(( $(fsize "$braw") + 8 + 8 + npad + 8 + dpad ))
tsz=$(fsize "$tmp")
[ "$tsz" -eq "$want" ] || { rm -f "$tmp" "$braw"; fail "ath11k-bdf: $tmp is $tsz bytes, expected $want"; }
got=$(sha256sum "$tmp" | awk '{print $1}')
if [ -e "$bdest" ] && [ "$(sha256sum "$bdest" | awk '{print $1}')" = "$got" ]; then
rm -f "$tmp" "$braw"
echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base"
log "ath11k-bdf: $bdest is already $bbase + $bname from $part:$bsrc (sha256 $got) - unchanged"
return 2
fi
chmod 644 "$tmp" && mv "$tmp" "$bdest" || { rm -f "$tmp" "$braw"; fail "installing $bdest failed"; }
echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base"
rm -f "$braw"
log "built $bdest = $bbase + $bname from $part:$bsrc ($esz bytes, sha256 $got)"
return 0
done
rm -f "$braw"
kept=
[ -e "$bdest" ] && kept=" (the existing file is left in place)"
fail "no listed partition ($parts) yields a well-formed $bsrc - $bdest NOT installed$kept"
}
extract() { # <partition,...> <path-in-partition> <dest> <sha256>
parts=$1 src=$2 dest=$3 want=$4
for part in $(order_parts "$parts"); do
@ -312,7 +402,8 @@ fi
[ -d "$MANIFEST_DIR" ] || exit 0
# fast path for every boot after the first: all dests already present
# fast path for every boot after the first: every file/mbn dest present and
# every ath11k-bdf dest current against its base (bdf_current)
missing=
for f in "$MANIFEST_DIR"/*.manifest; do
[ -e "$f" ] || continue
@ -320,6 +411,7 @@ for f in "$MANIFEST_DIR"/*.manifest; do
case "$kind" in
file) [ -e "$c" ] || missing=1 ;;
mbn) [ -e "$d" ] && [ -z "$REFRESH" ] || missing=1 ;;
ath11k-bdf) [ -z "$REFRESH" ] && bdf_current "$d" "$e" || missing=1 ;;
esac
done < "$f"
done
@ -345,6 +437,12 @@ for f in "$MANIFEST_DIR"/*.manifest; do
extract_mbn "$a" "$b" "$c" "$d" "$e" </dev/null
extracted=1
;;
ath11k-bdf)
[ -n "$e" ] || fail "$f: malformed ath11k-bdf line"
[ -z "$REFRESH" ] && bdf_current "$d" "$e" && continue
extract_ath11k_bdf "$a" "$b" "$c" "$d" "$e" </dev/null
[ $? -eq 0 ] && extracted=1
;;
rebind)
[ -n "$b" ] || fail "$f: malformed rebind line"
rebinds="$rebinds $a/$b"