bcm43455c0: added ioctl 511 to execute dump functions. Use the follow…

…ing command to call every available dump function: nexutil -g511 -l1500 -r
seemoo-lab · Jul 24, 2019 · 89c3464 · 89c3464
1 parent 67c8b24
commit 89c3464
Show file tree

Hide file tree

Showing 3 changed files with 55 additions and 10 deletions.
diff --git a/firmwares/bcm43455c0/structs.common.h b/firmwares/bcm43455c0/structs.common.h
@@ -665,6 +665,22 @@ struct wlc_if {
     struct wlc_if_stats  _cnt;
 };
 
+struct bcmstrbuf {
+    char *buf;
+    unsigned int size;
+    char *origbuf;
+    unsigned int origsize;
+};
+
+typedef int (*dump_fn_t)(void *handle, struct bcmstrbuf *b);
+
+typedef struct dumpcb_s {
+    const char *name;
+    dump_fn_t dump_fn;
+    void *dump_fn_arg;
+    struct dumpcb_s *next;
+} dumpcb_t;
+
 struct wlc_info {
     struct wlc_pub *pub;                /* 0x000 */
     struct osl_info *osh;               /* 0x004 */
@@ -851,7 +867,7 @@ struct wlc_info {
     int PAD;                            /* 0x2CC */
     int PAD;                            /* 0x2D0 */
     int PAD;                            /* 0x2D4 */
-    int PAD;                            /* 0x2D8 */
+    dumpcb_t *dumpcb_head;              /* 0x2D8 */
     int PAD;                            /* 0x2DC */
     int PAD;                            /* 0x2E0 */
     int PAD;                            /* 0x2E4 */

diff --git a/patches/bcm43455c0/7_45_189/nexmon/src/ioctl.c b/patches/bcm43455c0/7_45_189/nexmon/src/ioctl.c
@@ -45,24 +45,42 @@
 #include <version.h>            // version information
 #include <argprintf.h>          // allows to execute argprintf to print into the arg buffer
 
+#define NULL 0
+
 int 
 wlc_ioctl_hook(struct wlc_info *wlc, int cmd, char *arg, int len, void *wlc_if)
 {
     int ret = IOCTL_ERROR;
     argprintf_init(arg, len);
 
-    switch (cmd) {
-        case 500:
+    switch(cmd) {
+        case 510:
         {
-            if (len >= 4) {
-                memcpy(arg, "\x11\x22\x33\x44", 4);
-                ret = IOCTL_SUCCESS;
-            } 
+            argprintf("%s\n", __FUNCTION__);
+            ret = IOCTL_SUCCESS;
+            break;
         }
-        default:
+
+        case 511:
         {
-            ret = wlc_ioctl(wlc, cmd, arg, len, wlc_if);    
-        }    
+            dumpcb_t *d;
+            struct bcmstrbuf b;
+            int err;
+
+            bcm_binit(&b, arg, len);
+
+            for (d = wlc->dumpcb_head; d != NULL; d = d->next) {
+                bcm_bprintf(&b, "%s\n", d->name);
+                err = d->dump_fn(d->dump_fn_arg, &b);
+                if (err) bcm_bprintf(&b, "ERR: %d\n", err);
+                bcm_bprintf(&b, "\n");
+            }
+            ret = IOCTL_SUCCESS;
+            break;
+        }
+
+        default:
+            ret = wlc_ioctl(wlc, cmd, arg, len, wlc_if);
     }
 
     return ret;

diff --git a/patches/common/wrapper.c b/patches/common/wrapper.c
@@ -57,6 +57,16 @@ int
 ai_setcoreidx(void *sii, unsigned int coreidx)
 RETURN_DUMMY
 
+AT(CHIP_VER_BCM43455c0, FW_VER_ALL, 0x3D20)
+void
+bcm_binit(void *b, char *buf, uint size)
+VOID_DUMMY
+
+AT(CHIP_VER_BCM43455c0, FW_VER_ALL, 0x3D4C)
+int
+bcm_bprintf(void *b, const char *fmt, ...)
+RETURN_DUMMY
+
 AT(CHIP_VER_BCM4339, FW_VER_ALL, 0x1B8C4)
 int
 bus_binddev_rom(void *sdiodev, void *d11dev)
@@ -467,6 +477,7 @@ AT(CHIP_VER_BCM4358, FW_VER_ALL, 0x39AC)
 AT(CHIP_VER_BCM4356, FW_VER_ALL, 0x3210)
 AT(CHIP_VER_BCM43451b1, FW_VER_ALL, 0x2748)
 AT(CHIP_VER_BCM43430a1, FW_VER_ALL, 0x803dc0)
+AT(CHIP_VER_BCM43455c0, FW_VER_ALL, 0x3A94)
 int
 vsnprintf(char *buf, unsigned int n, const char *format, va_list ap)
 RETURN_DUMMY