View source for Asus PCE-AC88 with hostapd

== Intro ==
For several years i've been using [https://w1.fi/hostapd/ hostapd] on my home server to create a Wifi access point for all my devices, but due to a recent replacement of the server's hardware, i needed to get a new Wifi adapter as the new mainboard didn't have a PCI slot anymore.

After initially buying a [https://www.tp-link.com/us/products/details/cat-11_Archer-T9E.html TP-Link Archer T9E], which needs a closed-source driver and doesn't even support master (AP) mode, i (finally!) did a bit more research and found the [https://www.asus.com/Networking/PCE-AC88/ Asus PCE-AC88] to be a worthy, albeit expensive, candidate.

The PCE-AC88 uses the Broadcom BCM4366 chip, which is supported by the open-source <code>brcmfmac</code> driver - if you feed it the proper (still proprietary) firmware. Luckily that firmware file, called <code>brcmfmac4366b-pcie.bin</code>,is readily available for Debian 9 in the <code>firmware-brcm80211</code> package - so ''what could possibly go wrong''?

Well, getting a card with a newer hardware revision (v4), which needs the firmware file <code>brcmfmac4366c-pcie.bin</code> - that's what ''could possibly go wrong''.

Fortunately i'm not the only person with issues like this, so there were other people who figured out ways how to get a firmware if there is no official source for it. So here's how i did it...


== Firmware ==
The first step is to download the current [https://www.asus.com/us/Networking/RT-AC88U/HelpDesk_Download/ firmware package] for the Asus RT-AC88U - which is the Asus Wifi router with the same chip in it. Why? It also runs Linux, so it obviously also needs the firmware for that chip! You can pick any OS (e.g. "Others") from the dropdown menu, as long as you download the file below "Firmware". For me that was version <code>3.0.0.4.384.45149</code>, released just 2 days ago.


==== Preparation ====
Download that file to a folder, make sure you have <code>p7zip</code> installed, then run the following to extract the kernel module that contains the firmware somewhere inside it:

 7z x FW_RT_AC88U_300438445149.zip
 7z x RT-AC88U/RT-AC88U_3.0.0.4_384_45149-g467037b.trx lib/modules/2.6.36.4brcmarm/kernel/drivers/net/dhd/dhd.ko
 mv lib/modules/2.6.36.4brcmarm/kernel/drivers/net/dhd/dhd.ko ./
 rm -r ./RT-AC88U ./lib

This will give you the file <code>dhd.ko</code> in the current directory. This is not the firmware, but, as mentioned before, only a kernel module containing the firmware.


==== Investigation ====
To figure out what the start of the firmware file looks like, we have a look at <code>brcmfmac4366b-pcie.bin</code> from  the <code>firmware-brcm80211</code> package to get the first four hex bytes:

 $ xxd /lib/firmware/brcm/brcmfmac4366b-pcie.bin | head -n1
 00000000: 00f2 3eb8 04f2 b0bf 04f2 bbbf 04f2 c6bf  ..>.............

Now that we know that we're looking for the bytes <code>00 F2 3E B8</code>, we can use <code>binwalk</code> to look for the position of those bytes in the kernel module:

 $ binwalk -R "\x00\xf2\x3e\xb8\x04\xf2" dhd.ko
 <nowiki>
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
256904        0x3EB88         \x00\xf2\x3e\xb8
256936        0x3EBA8         \x00\xf2\x3e\xb8
</nowiki>

Let's do it once more and grab that offset to put it into an environment variable:
 $ OFFSET=$(binwalk -R "\x00\xf2\x3e\xb8\x04\xf2" dhd.ko | sed '4!d' | awk '{print $1}')
 $ echo ${OFFSET}
 256904

So now we know at what offset the firmware starts, but where does it end? This gets a bit tricky, but stay with me: Kernel modules are ELF files (which you can verify by running <code>file dhd.ko</code>), so we can use <code>readelf</code> to get some information about the kernel module's structure, especially the objects (ko = kernel object) inside it:
 $ readelf -s dhd.ko | grep OBJECT
 ...
   484: 00004220     4 OBJECT  GLOBAL DEFAULT   35 dhd_radio_up
   487: 0000442c    20 OBJECT  GLOBAL DEFAULT   35 dlimagedate_4366c0
   521: 00000654     4 OBJECT  GLOBAL DEFAULT   35 dhd_download_fw_on_driver
   526: 00004448 0x10b351 OBJECT  GLOBAL DEFAULT   35 dlarray_4366c0
   527: 00004210     4 OBJECT  GLOBAL DEFAULT   35 dhd_console_ms
   544: 00001058     4 OBJECT  GLOBAL DEFAULT   45 dhd_found
   545: 00004218     4 OBJECT  GLOBAL DEFAULT   35 dhd_master_mode
 ...

We see a long list of tiny objects (the third column is the size), but one that sticks out because of its size, and the name <code>dlarray_4366c0</code> also implies that we have found the object we are looking for - and its size.

So let's do that again, and also grab the size and put it into an environment variable:
 $ SIZE=$(readelf -s dhd.ko | grep dlarray_4366c0 | awk '{print $3}' | xargs printf "%d\n")
 $ echo ${SIZE}
 1094481


==== Extraction ====
We have the kernel module, we know where the firmware starts, and we know the size of it, so now we can use <code>dd</code> to extract the section that we think is is the firmware from the kernel module: 
 $ dd if=dhd.ko skip=${OFFSET} ibs=1 count=${SIZE} of=brcmfmac4366c-pcie.bin

This is not necessary, but let's get the full details about the firmware we just extracted:
 $ strings brcmfmac4366c-pcie.bin_10.10.122.47 | grep Version
 4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-stamon-hostpmac-murx-splitassoc-hostmemucode-dyn160-txpwr-stamon Version: 10.10.122.47 CRC: 13f8b3a1 Date: Tue 2018-08-14 10:45:51 CST FWID 01-ef91d5ac

Or in a more readable format:
{| class="wikitable"
|-
| Features || pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-stamon-hostpmac-murx-splitassoc-hostmemucode-dyn160-txpwr-stamon
|-
| Version || 10.10.122.47
|-
| CRC || 13f8b3a1 
|-
| Date || Tue 2018-08-14 10:45:51 CST 
|- 
| FWID || 01-ef91d5ac
|}


==== Installation ====
The <code>brcmfmac</code> module is looking for its firmware files in a specific folder, so you need to copy the extracted firmware there:
  $ cp brcmfmac4366c-pcie.bin /lib/firmware/brcm/brcmfmac4366c-pcie.bin


==== Initialization ====
You probably have the <code>brcmfmac</code> module still loaded, so let's unload and reload it:
 $ modprobe -r brcmfmac
 $ modprobe brcmfmac

If everything went well, <code>dmesg</code> should show you that it was able to initialize the chip with the firmware, even though it complains about <code>brcm/brcmfmac4366c-pcie.txt</code> and <code>brcm/brcmfmac4366c-pcie.clm_blob</code>:
 <nowiki>
[62448.893550] usbcore: registered new interface driver brcmfmac
[62449.000758] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[62449.002127] brcmfmac 0000:42:00.0: firmware: direct-loading firmware brcm/brcmfmac4366c-pcie.bin
[62449.002137] brcmfmac 0000:42:00.0: firmware: failed to load brcm/brcmfmac4366c-pcie.txt (-2)
[62449.002330] brcmfmac 0000:42:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.txt failed with error -2
[62449.753733] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[62449.753749] brcmfmac 0000:42:00.0: firmware: failed to load brcm/brcmfmac4366c-pcie.clm_blob (-2)
[62449.753926] brcmfmac 0000:42:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.clm_blob failed with error -2
[62449.753928] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[62449.754055] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4366/4 wl0: Sep 12 2016 13:26:44 version 10.10.69.6908 (r658761) FWID 01-fed440e1
[62449.767104] brcmfmac 0000:42:00.0 wlp66s0: renamed from wlan0</nowiki>


==== Verification ====
Run the command below, and if you get a similar output you now have a working PCE-AC88.
 <nowiki>
$ iw phy#0 info
Wiphy phy0
        max # scan SSIDs: 10
        max scan IEs length: 2048 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        max # scan plans: 1
        max scan plan interval: -1
        max scan plan iterations: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports roaming.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * CMAC (00-0f-ac:6)
        Available Antennas: TX 0 RX 0
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * P2P-client
                 * P2P-GO
                 * P2P-device
        Band 1:
                Capabilities: 0x1022
                        HT20/HT40
                        Static SM Power Save
                        RX HT20 SGI
                        No RX STBC
                        Max AMSDU length: 3839 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 16 usec (0x07)
                HT TX/RX MCS rate indexes supported: 0-31
                Bitrates (non-HT):
                        * 1.0 Mbps
                        * 2.0 Mbps (short preamble supported)
                        * 5.5 Mbps (short preamble supported)
                        * 11.0 Mbps (short preamble supported)
                        * 6.0 Mbps
                        * 9.0 Mbps
                        * 12.0 Mbps
                        * 18.0 Mbps
                        * 24.0 Mbps
                        * 36.0 Mbps
                        * 48.0 Mbps
                        * 54.0 Mbps
                Frequencies:
                        * 2412 MHz [1] (20.0 dBm)
                        * 2417 MHz [2] (20.0 dBm)
                        * 2422 MHz [3] (20.0 dBm)
                        * 2427 MHz [4] (20.0 dBm)
                        * 2432 MHz [5] (20.0 dBm)
                        * 2437 MHz [6] (20.0 dBm)
                        * 2442 MHz [7] (20.0 dBm)
                        * 2447 MHz [8] (20.0 dBm)
                        * 2452 MHz [9] (20.0 dBm)
                        * 2457 MHz [10] (20.0 dBm)
                        * 2462 MHz [11] (20.0 dBm)
                        * 2467 MHz [12] (20.0 dBm)
                        * 2472 MHz [13] (20.0 dBm)
                        * 2484 MHz [14] (disabled)
        Band 2:
                Capabilities: 0x1062
                        HT20/HT40
                        Static SM Power Save
                        RX HT20 SGI
                        RX HT40 SGI
                        No RX STBC
                        Max AMSDU length: 3839 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 16 usec (0x07)
                HT TX/RX MCS rate indexes supported: 0-31
                VHT Capabilities (0x0c1b4064):
                        Max MPDU length: 3895
                        Supported Channel Width: 160 MHz
                        short GI (80 MHz)
                        short GI (160/80+80 MHz)
                        MU Beamformer
                        MU Beamformee
                VHT RX MCS set:
                        1 streams: MCS 0-9
                        2 streams: MCS 0-9
                        3 streams: MCS 0-9
                        4 streams: MCS 0-9
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT RX highest supported: 0 Mbps
                VHT TX MCS set:
                        1 streams: MCS 0-9
                        2 streams: MCS 0-9
                        3 streams: MCS 0-9
                        4 streams: MCS 0-9
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT TX highest supported: 0 Mbps
                Bitrates (non-HT):
                        * 6.0 Mbps
                        * 9.0 Mbps
                        * 12.0 Mbps
                        * 18.0 Mbps
                        * 24.0 Mbps
                        * 36.0 Mbps
                        * 48.0 Mbps
                        * 54.0 Mbps
                Frequencies:
                        * 5170 MHz [34] (disabled)
                        * 5180 MHz [36] (20.0 dBm)
                        * 5190 MHz [38] (disabled)
                        * 5200 MHz [40] (20.0 dBm)
                        * 5210 MHz [42] (disabled)
                        * 5220 MHz [44] (20.0 dBm)
                        * 5230 MHz [46] (disabled)
                        * 5240 MHz [48] (20.0 dBm)
                        * 5260 MHz [52] (disabled)
                        * 5280 MHz [56] (disabled)
                        * 5300 MHz [60] (disabled)
                        * 5320 MHz [64] (disabled)
                        * 5500 MHz [100] (disabled)
                        * 5520 MHz [104] (disabled)
                        * 5540 MHz [108] (disabled)
                        * 5560 MHz [112] (disabled)
                        * 5580 MHz [116] (disabled)
                        * 5600 MHz [120] (disabled)
                        * 5620 MHz [124] (disabled)
                        * 5640 MHz [128] (disabled)
                        * 5660 MHz [132] (disabled)
                        * 5680 MHz [136] (disabled)
                        * 5700 MHz [140] (disabled)
                        * 5720 MHz [144] (disabled)
                        * 5745 MHz [149] (disabled)
                        * 5765 MHz [153] (disabled)
                        * 5785 MHz [157] (disabled)
                        * 5805 MHz [161] (disabled)
                        * 5825 MHz [165] (disabled)
        Supported commands:
                 * new_interface
                 * set_interface
                 * new_key
                 * start_ap
                 * join_ibss
                 * set_pmksa
                 * del_pmksa
                 * flush_pmksa
                 * remain_on_channel
                 * frame
                 * set_wiphy_netns
                 * set_channel
                 * start_p2p_device
                 * connect
                 * disconnect
                 * crit_protocol_start
                 * crit_protocol_stop
                 * Unknown command (122)
        Supported TX frame types:
                 * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
                 * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
        Supported RX frame types:
                 * managed: 0x40 0xd0
                 * P2P-client: 0x40 0xd0
                 * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
                 * P2P-device: 0x40 0xd0
        WoWLAN support:
                 * wake up on disconnect
                 * wake up on magic packet
                 * wake up on pattern match, up to 8 patterns of 1-128 bytes,
                   maximum packet offset 1500 bytes
        software interface modes (can always be added):
        valid interface combinations:
                 * #{ managed } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,
                   total <= 3, #channels <= 1
                 * #{ managed } <= 1, #{ AP } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,
                   total <= 4, #channels <= 1
                 * #{ AP } <= 4,
                   total <= 4, #channels <= 1, STA/AP BI must match
        Device supports scan flush.
</nowiki>


==== Versions ====
The first line is the version reported in dmesg, the second line the strings in the firmware:
 <nowiki>
 $ ls -1 brcmfmac4366c-pcie.bin* | xargs -i% strings % | grep -P '\d+\.\d+\.\d+\.\d+'
10.10.122.303 (r666429)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-stamon-hostpmac-murx-splitassoc-hostmemucode-dyn160-txpwr-stamon Version: 10.10.122.47 CRC: 9ebbf2e1 Date: Wed 2017-07-26 14:44:35 CST FWID 01-fb27523d
10.10.122.303 (r666429)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-stamon-hostpmac-murx-splitassoc-hostmemucode-dyn160-txpwr-stamon Version: 10.10.122.47 CRC: 13f8b3a1 Date: Tue 2018-08-14 10:45:51 CST FWID 01-ef91d5ac
10.10.69.6908 (r658761)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr Version: 10.10.69.252 CRC: 9fa88ab1 Date: Mon 2016-09-12 13:28:49 CST Ucode Ver: 1073.579 FWID: 01-fed440e1
10.10.69.69017 (r730013)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr-stamon Version: 10.10.69.69017 (r730013) CRC: cf0b5621 Date: Tue 2017-11-07 12:34:00 CST Ucode Ver: 1073.579 FWID: 01-e258597c
10.10.69.69027 (r766943)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac-txpwr-stamon Version: 10.10.69.69027 (r766943) CRC: 9055790c Date: Thu 2018-08-23 14:36:02 CST Ucode Ver: 1073.579 FWID: 01-15a952d6
10.10.69.69 (r625687)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfp-wnm-osen-wl11k-wl11u-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-proptxstatus-11nprop-obss-dbwsw-ringer-dmaindex16-bgdfs-hostpmac Version: 10.10.69.69 CRC: 34d30c8c Date: Tue 2016-08-23 17:31:24 PDT FWID 01-8438621f
10.10.69.74 (r629731 WLTEST)
4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfgtest-seqcmds-phydbg-phydump-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-11nprop-dbgam-dbgams-ringer-dmaindex16-bgdfs-hostpmac Version: 10.10.69.74 CRC: a6268b76 Date: Mon 2016-09-12 16:39:23 CST FWID 01-5c0166fa
</nowiki>

== hostapd ==
 <nowiki>
interface=wlp66s0
bridge=br0
driver=nl80211

ctrl_interface=/var/run/hostapd
ctrl_interface_group=0

##### IEEE 802.11
ssid=ThisIsMySSID
country_code=DE
ieee80211d=1
ieee80211h=1
hw_mode=a
channel=60
auth_algs=1
wmm_enabled=1

##### IEEE 802.11n
ieee80211n=1
ht_capab=[HT40-] [SHORT-GI-40] [DSSS_CCK-40]

##### IEEE 802.11ac
ieee80211ac=1
vht_capab=[VHT160] [SHORT-GI-80] [SHORT-GI-160] [BF-ANTENNA-4] [SOUNDING-DIMENSION-4] [MU-BEAMFORMER] [MU-BEAMFORMEE]
vht_oper_chwidth=1
vht_oper_centr_freq_seg0_idx=66

##### WPA/IEEE 802.11i
wpa=2
wpa_passphrase=ThisIsMyPassword
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
</nowiki>