Fedora 24 and ASUS PCE AC-88

[berre]

Hello,

I'm trying to get the new Asus PCE-AC88 working on my F24 workstation without success. It's a PCI-e WiFi-adapter with a BRCM4366 chipset.

According to the information stated at kernel.org BCM4366 "14e4:43c4" is supported from version 4.4. What confuses me is that brcmfmaci is trying to load "brcmfmac4366c-pcie.bin". I can't find this firmware on the kernel-firmware repository at all, so what's up with that?. The only 4366-related firmware in my driver-dir is "brcmfmac4366b-pcie.bin".

WiFi adapter:
https://www.asus.com/Networking/PCE-AC88/

Broadcom chipset:
https://www.broadcom.com/products/wi...ss-lan/bcm4366

Anyone that can shed som light?

Kind Regards,
B

uname -a

Linux berre-unix 4.6.3-300.fc24.x86_64 #1 SMP Fri Jun 24 20:52:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

lspci output:

7:00.0 Network controller: Broadcom Corporation Device 43c3 (rev 04)
Subsystem: ASUSTeK Computer Inc. Device 86fb
Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort+ <TAbort- <MAbort- >SERR+ <PERR- INTx-
Interrupt: pin A routed to IRQ 18
Region 0: Memory at f7000000 (64-bit, non-prefetchable) [size=32K]
Region 2: Memory at f6800000 (64-bit, non-prefetchable) [size=8M]
Region 4: Memory at f2400000 (64-bit, prefetchable) [size=4M]
Capabilities: <access denied>
Kernel modules: brcmfmac

dmesg output:

[berre@berre-unix brcm]$ dmesg | grep brcm
[    4.383300] usbcore: registered new interface driver brcmfmac
[    4.485443] brcmfmac 0000:07:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.bin failed with error -2

[edgan]

I am in the same boat. I am running Fedora 24 on my desktop and just bought a PCE AC-88. I looked high and low for a copy of the firmware, but couldn't find it anywhere.

Finally I emailed the employee at Broadcom who added the support for this pci id to the kernel. He should definitely known where it is.

[berre]

I am in the same boat. I am running Fedora 24 on my desktop and just bought a PCE AC-88. I looked high and low for a copy of the firmware, but couldn't find it anywhere.

Finally I emailed the employee at Broadcom who added the support for this pci id to the kernel. He should definitely known where it is.

Hi Edgan,

It would be great if you could keep us in the loop if you hear anything from Broadcom.

/B

[edgan]

I haven't gotten a response, but I have an idea to try. I looked at the Windows driver zip(below). Looking at the inf files it looks like 4365c0rtecdc.bin may work. Not sure why it is labeled 4365c and not 4366c. There is also mention of a 4366r bin right next to it, but that file isn't in the zip. I haven't tried this yet, just found it. I plan on trying it.

There are many copies in the zip, but only two unique files. The Windows 10 directories have one copy, and the rest have another copy.

Windows driver bundle:
http://dlcdnet.asus.com/pub/ASUS/wir...-AC88_2803.zip

UT_PCE-AC88_2803/PCE-AC88_-_Driver_-_Win7/Driver/PCE-AC88/Win81/4365c0rtecdc.bin
UT_PCE-AC88_2803/PCE-AC88_-_Driver_-_Win7/Driver/PCE-AC88/Win10/4365c0rtecdc.bin

Edit:
The bin files are hiding in data1.cab.

[edgan]

I tested it, and the firmware lets me see wireless networks, but I can't connect at least to WPA2-PSK networks in 2.4ghz or 5ghz. I have since opened a ticket in bugzilla.kernel.org. Feel free to add to the ticket.

https://bugzilla.kernel.org/show_bug.cgi?id=135321

[berre]

I saw your ticket at kernel.org, good work. It seems there hasn't been any updates yet though.

I tried the same thing you did with identical results.. However, looking in bcmwdidhdpcie.inf, in addition to 4365c0rtecdc.bin it's also referring to a 4366r4rtecdc.bin which I cannot find anywhere in the cab files.

Anyway I guess all we can do is wait.

[Hellacopter]

I have this card working -- took a bit of work -- had to edit wpa_supplicant's config file and add the line

p2p_disabled=1

to disable WiFi Direct (these are what all the 'p2p' errors are about if you've tried it with the windows driver firmware)

Secondly, wasn't able to use it with the windows driver's firmware .bin. I carved the chip firmware from the fw image of a router that uses the same chip (the ASUS RT-AC88U -- not sitting in a convenient .bin file, had to hexedit it out of a prebuilt driver -- dhd.ko)

The fw images for the chip seem to be built differently for different purposes -- there's a string of text near the end of the file that seems to indicate the options it was built with -- the Win10 driver's one looks like:

4365c0-roml/pcie-ag-splitrx-mbss-mfp-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-txpwr-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-msgbuf-ndis-vista-dhdoid-pktfilter-mfp-keepalive Version: 10.10.69.64 CRC: 1ee3e5a6 Date: Wed 2016-03-02 03:06:31 PST Ucode Ver: 1073.557 FWID: 01-e6c8c961

Notice 'vista', and 'ndis'

Whereas the RT-AC88U's looks like

4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr-noclminc-clm_min Version: 10.10.69.248 CRC: 9a6ac061 Date: Thu 2016-05-12 11:45:39 CST Ucode Ver: 1073.572 FWID: 01-a1b24c27

It doesn't work perfectly as its not built to work with the brcmfmac driver but it at least isn't a windows build.

Will likely need broadcom to actually release a proper brcmfmac4366c-pcie.bin for everything to work fully but I at least have reasonable functionality at the moment.

[Madtiger]

@Hellacopter

Well done! Is there any chance you might be able to put the driver online so others can also download it and get their cards working too?

Thank You

[Hellacopter]

Grab a copy of 'ASUS RT-AC88U Firmware version 3.0.0.4.380.3341' (this exact version or offsets might be different)

https://www.asus.com/us/Networking/R...Desk_Download/

And with p7zip (which handily will find and extract a squashfs)

7z X RT-AC88U_3.0.0.4_380_3341-g25420f5.trx

then grab the fw with

dd if=lib/modules/2.6.36.4brcmarm/kernel/drivers/net/dhd/dhd.ko skip=1269516 ibs=1 count=935317 of=brcmfmac4366c-pcie.bin

EDIT: replaced hex constant with decimal (I'd done the extraction from OSX, using BSD dd, turns out GNU dd doesn't support hex numbers =P)
EDIT: to make sure you got it right, the expected sha1 is 9e5af3ce7ce9c358c773873734ffa5cdf1641de5

[Madtiger]

Thank you very much for your time and effort.

Cheers

[berre]

Thanks alot Hellacopter.

I got it working using your instructions, but I had to convert the skip value to decimal when i fetched the bin file.

I noticed I'm only detecting APs in the UNII 1 lower channels on 5Ghz. Is it the same for you guys? This was not the case in the WIndows 10 drivers. But anyway, this is fine for now.

[Hellacopter]

check

iw reg get

-- you might not have your regulatory domain set

can use

iw reg set <2 letter country code>

to set it

also make sure you have crda https://apps.fedoraproject.org/packages/crda installed http://www.linuxwireless.org/en/deve...gulatory/CRDA/ so the driver can get the data on allowed freqs

[xcapement]

Hellacopter, that was amazing work! I have my card working... I've searched extensively for an answer ... I use arch, but that's besides the point.

Can I ask 2 questions?
* How did you determine the firmware was in the .ko file?
* How did you figure out the offset and extent?

I don't know the ins and outs of elf binaries, but did a quick dump of the binary using zip and didn't see the obvious place for the firmware. I'm just curious... It was an amazing find.

Thanks so much!

[Hellacopter]

I'm also on arch -- just here since I found this thread googling to see if anyone had gotten the card working

At first I was just seeing if there were any fw files sitting in the extracted filesystem -- I didn't find any..

Looking at the fw files I already had (the windows one, the 4366b one) with `strings` i'd found what looks like a build identifier string -- always near the end, finally followed by the bytes '0d 01': e.g.

$ xxd /lib/firmware/brcm/brcmfmac4366b-pcie.bin | tail -n 30
000f1700: 9dfd 0a9b 4046 0093 04f1 f803 0193 04f1  ....@F..........
000f1710: fc03 0293 2946 3a46 3346 e0f7 5ffa c4f8  ....)F:F3F.._...
000f1720: f400 28b9 1748 1549 0b25 13f7 07fb 1ee0  ..(..H.I.%......
000f1730: 0022 40f6 1201 0025 22f5 26fb c4f8 0001  ."@....%".&.....
000f1740: 40f6 1201 d4f8 f400 22f5 06fa c4f8 e800  @.......".......
000f1750: 2046 51f7 8dfb 0c21 0022 2046 51f7 94fb   FQ....!." FQ...
000f1760: 2046 4df7 69f8 d4f8 f400 dff7 d1fe 2046   FM.i......... F
000f1770: 1ff5 16ff 2846 04b0 bde8 f081 8817 2f00  ....(F......../.
000f1780: 971b 2a00 e2f1 2900 776c 635f 626d 6163  ..*...).wlc_bmac
000f1790: 5f70 726f 6365 7373 5f75 636f 6465 5f73  _process_ucode_s
000f17a0: 7200 0000 8473 3bb4 0a0a 45ed 3d22 9056  r....s;...E.=".V
000f17b0: 0000 0700 0000 0000 0000 0000 0000 00a4  ................
000f17c0: 917a c413 01bd 3208 0100 3433 3636 6231  .z....2...4366b1
000f17d0: 2d72 6f6d 6c2f 7063 6965 2d61 672d 7370  -roml/pcie-ag-sp
000f17e0: 6c69 7472 782d 6664 6170 2d6d 6273 732d  litrx-fdap-mbss-
000f17f0: 6d66 702d 776e 6d2d 6f73 656e 2d77 6c31  mfp-wnm-osen-wl1
000f1800: 316b 2d77 6c31 3175 2d74 7862 662d 706b  1k-wl11u-txbf-pk
000f1810: 7463 7478 2d61 6d73 6475 7478 2d61 6d70  tctx-amsdutx-amp
000f1820: 6475 7265 7472 792d 6368 6b64 3268 646d  duretry-chkd2hdm
000f1830: 612d 7072 6f70 7478 7374 6174 7573 2d31  a-proptxstatus-1
000f1840: 316e 7072 6f70 2d6f 6273 732d 6462 7773  1nprop-obss-dbws
000f1850: 772d 7269 6e67 6572 2d64 6d61 696e 6465  w-ringer-dmainde
000f1860: 7831 362d 6267 6466 7320 5665 7273 696f  x16-bgdfs Versio
000f1870: 6e3a 2031 302e 3130 2e36 392e 3233 3720  n: 10.10.69.237 
000f1880: 4352 433a 2034 6263 3438 6337 6220 4461  CRC: 4bc48c7b Da
000f1890: 7465 3a20 4672 6920 3230 3136 2d30 312d  te: Fri 2016-01-
000f18a0: 3038 2031 323a 3535 3a32 3520 5053 5420  08 12:55:25 PST 
000f18b0: 5563 6f64 6520 5665 723a 2031 3037 332e  Ucode Ver: 1073.
000f18c0: 3533 3120 4657 4944 3a20 3031 2d63 3437  531 FWID: 01-c47
000f18d0: 6139 3161 340a 000d 01                   a91a4....

So I just grepped for something I expected be in all of them -- luckily it wasn't compressed or anything and I found something:

$ grep -r 'Ucode Ver' .
Binary file ./lib/modules/2.6.36.4brcmarm/kernel/drivers/net/dhd/dhd.ko matches

Which points at dhd.ko, the driver itself. Then check to see where in the file these strings live:

$ strings -a -t x ./lib/modules/2.6.36.4brcmarm/kernel/drivers/net/dhd/dhd.ko | grep 'Ucode Ver'
 12fb5e 4366b1-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr-noclminc-clm_min Version: 10.10.69.250 CRC: 98a7a77b Date: Tue 2016-07-26 12:15:00 CST Ucode Ver: 1073.577 FWID: 01-71cde488
 20e98a 4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr-noclminc-clm_min Version: 10.10.69.250 CRC: 28f6758e Date: Tue 2016-07-26 12:15:09 CST Ucode Ver: 1073.577 FWID: 01-d475d474
 20eb70 43602a1-roml/pcie-ag-splitrx-fdap-mbss-mfp-osen-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-ringer-dmaindex16 Version: 7.35.4.11 CRC: e098a77 Date: Fri 2016-06-17 03:37:50 PDT Ucode Ver: 986.139 FWID: 01-b27ea103
 2aa73e 43602a1-roml/pcie-ag-splitrx-fdap-mbss-mfp-osen-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-ringer-dmaindex16 Version: 7.35.4.11 CRC: e098a77 Date: Fri 2016-06-17 03:37:50 PDT Ucode Ver: 986.139 FWID: 01-b27ea10

Actually found a few firmware images living inside this driver. The fw image would always end two bytes after the build string so at this point I know where the fw images *end* -- and wound up finding the beginning of the f/w by accident when checking out the file in Hopper https://www.hopperapp.com/ -- noticed that there were symbols 'dlarray_4366c0', 'dlarray_4366b1' that pointed to the beginning of the fws.

Also found later which would have made some things a bit more obvious that some versions of the 'dhd' driver have been used in android, which the source code can be found for: https://android.googlesource.com/ker...dhd/dhd_pcie.c where it can be seen a bit more easily how f/w images are handled -- the router seems to be slightly modified from that code which can only embed *one* image to embed a few and decide which one to use -- possibly so the same image can work on different h/w revs of a router? Not sure.

[xcapement]

Thank you so much for taking the time to explain this to me. It makes sense. When I looked at the elf dump, I didn't see any obvious place that matched. Using your info, I'm going to look into the individual elf sections and try to find it.

This is inspiring me to learn more about elf layout and some assembly language.