3

I want to work on Access Point (AP) and Power Saving Mode (PSM) behaviour with a Nexus 5, which has a BCM4339 wireless chipset.

Currently, there are 4 drivers (1 experimental) available for Broadcom chipsets:

  • broadcom-iw (proprietary). Firmware, so no change possible.
  • brcm80211 (broadcom open-source mac80211-based). No support for AP mode.
  • b43 (reverse engineered). Best choice, because it support AP, Power Saving Mode (PSM), Master Mode (or Monitor Mode).
  • bcmon (experimental brcm80211-based driver). Supports AP and Monitor Mode, could be modified to support Power Saving Mode.

As documentation is kind of blurry concerning this particular chipset, my questions are:

  • What is the "default" wireless driver used on Nexus 5 ?
  • Is b43 supported by BCM4339 ? According to this page, Broadcom - BCM43xx, it should, but it is not listed on this page B43 - Known PCI devices.
  • If b43 is indeed supported, what is the procedure to switch to b43 driver ?

EDIT: I found out that my chipset had an SDIO interface, so the driver used is a FullMAC driver (brcmfmac). If I understand correctly, it means that I cannot do any modifications on it since the MAC layer is coded in hardware ... Anyone to corroborate that ? Any alternatives ?

JahMyst
  • 1,616
  • 3
  • 20
  • 39

3 Answers3

3

Even though the BCM4339 is a FullMAC or HardMAC chip, that handles all PHY and MAC layer processing in an ARM Cortex-R4 processor that is included in the BCM4339 system on chip, it is possible to change the firmware running on that microcontroller.

To do this, we developed a C-based patching framework, that allows to write patches to the original firmware in C. We used it to enable monitor mode on the BCM4339. If you are interested in the project, please take a look at our nexmon project at https://seemoo.tu-darmstadt.de/nexmon

Matthias Schulz
  • 46
  • 3
2

To answer my own questions:

BCM4339 (chip inside Nexus 5) has an SDIO interface, which means that it has a driver implemented in HARDWARE (these devices are commonly named HardMAC device).

The driver that support the BCM4339 is brcmfmac (the SoftMAC version of the driver being brcmfsmac). This driver is NOT modifiable, because it is a proprietary firmware.

If you want to modify source code (for experimentation), you CANNOT do it with this chip. You will need another wireless chipset (preferably Atheros chipset, supported by open-source driver ath9k).

My option was to add an USB Network Adapter to my Android device and use the Atheros chipset present on it. I programmed modifications through the driver ath9k.

JahMyst
  • 1,616
  • 3
  • 20
  • 39
2

As far as I know, TI chipsets also allow you to modify source code (for experiments). Atheros also does the job as you mentioned.

Boann
  • 48,794
  • 16
  • 117
  • 146
spencerJANG
  • 340
  • 3
  • 8