fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition

The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.

New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.

zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.

aports/device/fp6-vendor-blobs/30-ath11k-board-data.manifest

@@ -0,0 +1,17 @@
+# WCN6750 WLAN board data (calibration, Qualcomm/Fairphone) - taken from the
+# stock modem partition on-device instead of being shipped (fp6 repo
+# journal/base/ 2026-10-14, journal/blobs/). The device tree asks ath11k for
+# the Fairphone_Gen_6 entry; upstream linux-firmware's board-2.bin has none,
+# the driver silently falls back to generic data, and on that the FP6 Plus
+# does not associate at all (user report 2026-10-14) while the FP6's scans
+# no longer find the 5 GHz networks around it, so it associates on 2.4 GHz
+# only (dev phone A/B 2026-11-01). The container built here is upstream's
+# file with every entry kept plus the device's own bdwlan.elf under the
+# requested name; it lives in /lib/firmware/updates, which the loader
+# searches first. Active slot first, the other slot as fallback; no hash pin
+# - the ELF belongs to the stock modem image and can change with it. No
+# rebind line: the service runs before the driver loads, so a fresh install
+# has the container at the first probe and an installed phone gets it at
+# its next boot - a re-probe from a package hook would restart wifi in the
+# middle of an upgrade.
+ath11k-bdf modem_a,modem_b image/qca6750/bdwlan.elf bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6 /usr/lib/firmware/ath11k/WCN6750/hw1.0/board-2.bin.zst /usr/lib/firmware/updates/ath11k/WCN6750/hw1.0/board-2.bin

aports/device/fp6-vendor-blobs/APKBUILD

@@ -12,28 +12,33 @@
 # drops a previously-shipped blob restores the file immediately instead of
 # at the next boot (--refresh in addition for an mbn consumer: it re-derives
 # the trustlet from the active slot even if a file is present). Consumers:
-# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet).
+# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet);
+# this package's own 30-ath11k-board-data fragment (WLAN board data).
 #
 # 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally
 # verified mode for mbn, --refresh -- after two field units got no
 # fingerprint sensor from a whole-image hash pin that can only match one
 # Android build (fp6 repo journal/blobs/, journal/fingerprint/).
+# 1-r4 (2026-10-14): the ath11k-bdf directive -- the WLAN board data the
+# device tree asks for, built on-device from the stock modem partition
+# (the FP6 Plus does not associate on upstream's generic data).
 maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
 pkgname=fp6-vendor-blobs
 pkgver=1
-pkgrel=3
+pkgrel=4
 pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
 url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
 arch="noarch"
 license="GPL-3.0-only"
 # fallback mapper for when the initramfs didn't map the dynamic partitions
-depends="make-dynpart-mappings"
+depends="make-dynpart-mappings zstd"
 install="$pkgname.post-upgrade"
 options="!check"
 source="
 	fp6-vendor-blobs-extract
 	fp6-vendor-blobs.service
 	fp6-vendor-blobs.preset
+	30-ath11k-board-data.manifest
 "
 
 package() {
@@ -42,8 +47,9 @@ package() {
 	install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
 		"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
 	# enabled unconditionally: the unit is a fast no-op once every manifest
-	# dest exists, and blobs appearing on first boot must not depend on a
+	# dest exists and every ath11k-bdf override is current against its base,
-	# manual systemctl enable. sysinit = the real (pre-coldplug) run;
+	# and blobs appearing on first boot must not depend on a manual
+	# systemctl enable. sysinit = the real (pre-coldplug) run;
 	# multi-user = the post-udev retry if the early run failed (see unit)
 	mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \
 		"$pkgdir"/etc/systemd/system/multi-user.target.wants
@@ -58,11 +64,13 @@ package() {
 	# extracted, no sound card. See journal/blobs/ 2026-08-28.
 	install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \
 		"$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset
-	mkdir -p "$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d
+	install -Dm644 "$srcdir"/30-ath11k-board-data.manifest \
+		"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/30-ath11k-board-data.manifest
 }
 
 sha512sums="
-e9618b4a1ccbe0913a608b32a1a9e87337e3da79a3d7ccc7f49292ae9aaa9406d2ea9817d63b3cfff2c4346b80dd2476c10725f4f0f95c859acd17b22ec03a16  fp6-vendor-blobs-extract
+6aee5f56bc7bc960537b7ca1069305b56a5ec8da99a58298ba1715e93f002d391a2bd24be78214428b0297f9e3cfd1003a243c76a2d08397dcac63a7d800d302  fp6-vendor-blobs-extract
 b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800  fp6-vendor-blobs.service
 9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a  fp6-vendor-blobs.preset
+f13d7b384a9b577762693c6831fbf28cb9e92e4f943af1917ddeba121c582f0c85c81a3e01e8e9ff6367c3717b6c37743f019db297f75339871292cf816bfc91  30-ath11k-board-data.manifest
 "

aports/device/fp6-vendor-blobs/fp6-vendor-blobs-extract

@@ -11,6 +11,7 @@
 #
 #   file <partition[,partition...]> <path-in-partition> <dest> <sha256>
 #   mbn  <partition[,partition...]> <dir-in-partition> <name> <dest> <sha256|->
+#   ath11k-bdf <partition[,partition...]> <path-in-partition> <entry-name> <base> <dest>
 #   rebind <bus> <device>
 #
 # Partition lists are tried in the order written, except that on an A/B
@@ -47,6 +48,24 @@
 #   itself and refuses a damaged or foreign image (one flipped byte ->
 #   ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03). The sha256 of what was
 #   installed is logged either way.
+# ath11k-bdf: the WLAN board data (calibration) the device tree asks ath11k
+#   for by name, e.g. bus=ahb,qmi-chip-id=1,qmi-board-id=255,variant=Fairphone_Gen_6.
+#   Upstream linux-firmware's board-2.bin carries no Fairphone entry, so the
+#   driver silently falls back to the generic board-id data; the FP6 Plus does
+#   not associate on it (user report 2026-10-14, fp6 repo journal/base/). The
+#   stock modem partition has the device's own file (image/qca6750/bdwlan.elf).
+#   This directive copies it and wraps it into a container at <dest> (the
+#   loader searches /lib/firmware/updates first): <base> (board-2.bin or
+#   board-2.bin.zst, every upstream entry kept byte for byte) + one BOARD
+#   entry named <entry-name> holding the ELF. Verified structurally (ELF
+#   magic, sane size, the container's own magic), never by a pinned hash:
+#   the ELF belongs to the stock modem image and can change with it.
+#   The driver takes the first BOARD entry whose name matches, so an entry
+#   upstream ships under the same name is used before the appended copy.
+#   The sha256 of the <base> used is kept in <dest>.fp6-base: a <base> that
+#   changed since (a linux-firmware upgrade) rebuilds <dest> at the next
+#   run, and so does --refresh. A rebuild that reproduces the existing
+#   <dest> byte for byte installs nothing and does not count as extracted.
 # rebind: if this fragment's run extracted at least one file, unbind and
 #   re-probe <device> on <bus> so the consuming driver picks the file up
 #   in the same boot. Unconditional on purpose: a still-bound consumer may
@@ -64,8 +83,9 @@
 # --if-device: exit 0 quietly when no stock super partition is visible
 #   (apk post-install scripts run inside build/CI chroots too; on images
 #   built there the first-boot service does the real extraction).
-# --refresh: re-derive every mbn dest even if it exists, replacing it only
+# --refresh: re-derive every mbn and ath11k-bdf dest even if it exists,
-#   with an image that verifies (a failed refresh leaves the old file). For
+#   replacing it only with an image that verifies (a failed refresh leaves
+#   the old file). For
 #   the consumer's post-install/post-upgrade: a fresh 'apk add' gets its
 #   trustlet without a reboot, and a trustlet that was hand-placed or pinned
 #   to another build is replaced by the active slot's on the next upgrade.
@@ -257,6 +277,76 @@ extract_mbn() { # <partition,...> <dir-in-partition> <name> <dest> <sha256|->
 	fail "no listed partition ($parts) yields $rname with sha256 $want - $dest NOT installed$kept"
 }
 
+# One little-endian u32 as four raw bytes (busybox printf, octal escapes).
+le32() { # <value>
+	printf "\\$(printf %03o $(($1 & 255)))\\$(printf %03o $((($1 >> 8) & 255)))\\$(printf %03o $((($1 >> 16) & 255)))\\$(printf %03o $((($1 >> 24) & 255)))"
+}
+pad4() { # <length> -> bytes of zero padding to the next multiple of 4, on stdout
+	n=$(( (4 - $1 % 4) % 4 ))
+	[ "$n" -gt 0 ] && head -c "$n" /dev/zero
+	return 0
+}
+# <dest>.fp6-base records the sha256 of the <base> <dest> was built from.
+bdf_base_id() { sha256sum "$1" | awk '{print $1}'; }
+bdf_current() { # <base> <dest> - true when <dest> exists and was built from this <base>
+	[ -f "$1" ] && [ -e "$2" ] && [ -f "$2.fp6-base" ] || return 1
+	read -r bh bs < "$2.fp6-base"
+	[ "$bh" = "$(bdf_base_id "$1")" ]
+}
+extract_ath11k_bdf() { # <partition,...> <path-in-partition> <entry-name> <base> <dest>
+	parts=$1 bsrc=$2 bname=$3 bbase=$4 bdest=$5
+	[ -f "$bbase" ] || fail "ath11k-bdf: base container $bbase missing"
+	bid=$(bdf_base_id "$bbase")
+	braw="$bdest.fp6-raw.$$"
+	mkdir -p "${bdest%/*}" || fail "cannot create ${bdest%/*}"
+	case "$bbase" in
+	*.zst) zstd -dcq "$bbase" > "$braw" 2>/dev/null || { rm -f "$braw"; fail "ath11k-bdf: cannot decompress $bbase"; } ;;
+	*) cp "$bbase" "$braw" || { rm -f "$braw"; fail "ath11k-bdf: cannot read $bbase"; } ;;
+	esac
+	[ "$(head -c 16 "$braw")" = "QCA-ATH11K-BOARD" ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is not a QCA-ATH11K-BOARD container"; }
+	# the driver walks the entries 4-byte aligned; an entry appended to an
+	# unaligned base would be misread and the generic data used silently
+	bsz=$(fsize "$braw")
+	[ $(( bsz % 4 )) -eq 0 ] || { rm -f "$braw"; fail "ath11k-bdf: $bbase is $bsz bytes, not a multiple of 4"; }
+	for part in $(order_parts "$parts"); do
+		mount_part "$part" || { log "$part: not mountable, trying next"; continue; }
+		elf="$MNT/$bsrc"
+		[ -f "$elf" ] || { log "$part: no $bsrc, trying next"; continue; }
+		esz=$(fsize "$elf")
+		[ "$(hex4 "$elf")" = 7f454c46 ] || { log "$part:$bsrc: not an ELF image, trying next"; continue; }
+		[ "$esz" -ge 4096 ] && [ "$esz" -le $((1024 * 1024)) ] || { log "$part:$bsrc: $esz bytes is not a board data file, trying next"; continue; }
+		nlen=${#bname}
+		npad=$(( (nlen + 3) / 4 * 4 ))
+		dpad=$(( (esz + 3) / 4 * 4 ))
+		tmp="$bdest.fp6-extract.$$"
+		# container = base + BOARD IE { NAME IE, DATA IE }, each IE padded to 4
+		{
+			cat "$braw"
+			le32 0; le32 $((8 + npad + 8 + dpad))
+			le32 0; le32 "$nlen"; printf '%s' "$bname"; pad4 "$nlen"
+			le32 1; le32 "$esz"; cat "$elf"; pad4 "$esz"
+		} > "$tmp" 2>/dev/null || { rm -f "$tmp"; fail "ath11k-bdf: writing $tmp failed"; }
+		want=$(( $(fsize "$braw") + 8 + 8 + npad + 8 + dpad ))
+		tsz=$(fsize "$tmp")
+		[ "$tsz" -eq "$want" ] || { rm -f "$tmp" "$braw"; fail "ath11k-bdf: $tmp is $tsz bytes, expected $want"; }
+		got=$(sha256sum "$tmp" | awk '{print $1}')
+		if [ -e "$bdest" ] && [ "$(sha256sum "$bdest" | awk '{print $1}')" = "$got" ]; then
+			rm -f "$tmp" "$braw"
+			echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base"
+			log "ath11k-bdf: $bdest is already $bbase + $bname from $part:$bsrc (sha256 $got) - unchanged"
+			return 2
+		fi
+		chmod 644 "$tmp" && mv "$tmp" "$bdest" || { rm -f "$tmp" "$braw"; fail "installing $bdest failed"; }
+		echo "$bid" > "$bdest.fp6-base" || fail "ath11k-bdf: cannot write $bdest.fp6-base"
+		rm -f "$braw"
+		log "built $bdest = $bbase + $bname from $part:$bsrc ($esz bytes, sha256 $got)"
+		return 0
+	done
+	rm -f "$braw"
+	kept=
+	[ -e "$bdest" ] && kept=" (the existing file is left in place)"
+	fail "no listed partition ($parts) yields a well-formed $bsrc - $bdest NOT installed$kept"
+}
 extract() { # <partition,...> <path-in-partition> <dest> <sha256>
 	parts=$1 src=$2 dest=$3 want=$4
 	for part in $(order_parts "$parts"); do
@@ -312,7 +402,8 @@ fi
 
 [ -d "$MANIFEST_DIR" ] || exit 0
 
-# fast path for every boot after the first: all dests already present
+# fast path for every boot after the first: every file/mbn dest present and
+# every ath11k-bdf dest current against its base (bdf_current)
 missing=
 for f in "$MANIFEST_DIR"/*.manifest; do
 	[ -e "$f" ] || continue
@@ -320,6 +411,7 @@ for f in "$MANIFEST_DIR"/*.manifest; do
 		case "$kind" in
 		file) [ -e "$c" ] || missing=1 ;;
 		mbn)  [ -e "$d" ] && [ -z "$REFRESH" ] || missing=1 ;;
+		ath11k-bdf) [ -z "$REFRESH" ] && bdf_current "$d" "$e" || missing=1 ;;
 		esac
 	done < "$f"
 done
@@ -345,6 +437,12 @@ for f in "$MANIFEST_DIR"/*.manifest; do
 			extract_mbn "$a" "$b" "$c" "$d" "$e" </dev/null
 			extracted=1
 			;;
+		ath11k-bdf)
+			[ -n "$e" ] || fail "$f: malformed ath11k-bdf line"
+			[ -z "$REFRESH" ] && bdf_current "$d" "$e" && continue
+			extract_ath11k_bdf "$a" "$b" "$c" "$d" "$e" </dev/null
+			[ $? -eq 0 ] && extracted=1
+			;;
 		rebind)
 			[ -n "$b" ] || fail "$f: malformed rebind line"
 			rebinds="$rebinds $a/$b"