Remove standalone stealth system, keep only driver spoof + boot timing
This commit is contained in:
sssnake
@@ -39,7 +39,6 @@ echo "standard" > "$MODPATH/config/bt_mode"
|
||||
echo "sdr" > "$MODPATH/config/sdr_mode"
|
||||
echo "auto" > "$MODPATH/config/gamepad_mode"
|
||||
echo "off" > "$MODPATH/config/decoder_mode"
|
||||
echo "off" > "$MODPATH/config/stealth_mode"
|
||||
echo "0" > "$MODPATH/config/spoof_enabled"
|
||||
echo "0" > "$MODPATH/config/boot_timing"
|
||||
echo "100.0M" > "$MODPATH/config/fm_freq"
|
||||
|
||||
Binary file not shown.
BIN
drivers/stock/BCM.hcd
Normal file
BIN
drivers/stock/BCM.hcd
Normal file
Binary file not shown.
BIN
drivers/stock/BTFW_B.hcd
Normal file
BIN
drivers/stock/BTFW_B.hcd
Normal file
Binary file not shown.
691
drivers/stock/bcmdhd.cal_4390_b1
Normal file
691
drivers/stock/bcmdhd.cal_4390_b1
Normal file
@@ -0,0 +1,691 @@
|
||||
# nvram for USI G7 module(4390B1) V1.1 2024.05.06
|
||||
# nvram copied and edited from bcm94390f10ref.txt
|
||||
# SSID generated using Alberto's boardssid.py script:
|
||||
#********************SUMMARY********************
|
||||
#Board Name: bcm94390b1GGmodUSIG7BB
|
||||
#SSID: 0x0b19
|
||||
#macmid: 0x05c9
|
||||
#Successfully made SSID entry in sromdefs.tcl.
|
||||
#Successfully made macmid entry in sromdefs.tcl.
|
||||
#Successfully made SSID entry in tblssid.py.
|
||||
#*************************************************
|
||||
# $ Copyright Broadcom $
|
||||
#
|
||||
#
|
||||
# <<Broadcom-WL-IPTag/Vendor1007>>
|
||||
#
|
||||
#
|
||||
#
|
||||
NVRAMRev=$Rev: 947350 $
|
||||
#
|
||||
#
|
||||
sromrev=11
|
||||
boardrev=0x1201
|
||||
boardtype=0x0b19
|
||||
boardflags=0x10401001
|
||||
boardflags2=0x00800000
|
||||
boardflags3=0x40002900
|
||||
boardflags4=0x200000
|
||||
#boardnum=57410
|
||||
jtag_irw=38
|
||||
|
||||
#Regulatory specific
|
||||
ccode=0
|
||||
regrev=0
|
||||
|
||||
# Board specific
|
||||
vendid=0x14e4
|
||||
devid=0x4438
|
||||
manfid=0x2d0
|
||||
antswitch=0
|
||||
pdgain5g=0
|
||||
pdgain2g=0
|
||||
aa2g=3
|
||||
aa5g=3
|
||||
agbg0=0
|
||||
agbg1=0
|
||||
aga0=0
|
||||
aga1=0
|
||||
ag6ga0=0
|
||||
ag6ga1=0
|
||||
extpagain5g=0
|
||||
slice/1/extpagain2g=0
|
||||
rxgains2gelnagaina0=16
|
||||
rxgains2gtrisoa0=17
|
||||
rxgains2gtrelnabypa0=1
|
||||
rxgains5gelnagaina0=15
|
||||
rxgains5gtrisoa0=17
|
||||
rxgains5gtrelnabypa0=1
|
||||
rxgains5gmelnagaina0=15
|
||||
rxgains5gmtrisoa0=17
|
||||
rxgains5gmtrelnabypa0=1
|
||||
rxgains5ghelnagaina0=15
|
||||
rxgains5ghtrisoa0=17
|
||||
rxgains5ghtrelnabypa0=1
|
||||
rxgains2gelnagaina1=16
|
||||
rxgains2gtrisoa1=17
|
||||
rxgains2gtrelnabypa1=1
|
||||
rxgains5gelnagaina1=15
|
||||
rxgains5gtrisoa1=17
|
||||
rxgains5gtrelnabypa1=1
|
||||
rxgains5gmelnagaina1=15
|
||||
rxgains5gmtrisoa1=17
|
||||
rxgains5gmtrelnabypa1=1
|
||||
rxgains5ghelnagaina1=15
|
||||
rxgains5ghtrisoa1=17
|
||||
rxgains5ghtrelnabypa1=1
|
||||
|
||||
rxgains2gfelossa0=2
|
||||
rxgains2gfelossa1=2
|
||||
rxgains5gfelossa0=2
|
||||
rxgains5gfelossa1=2
|
||||
rxgains5gmfelossa0=1
|
||||
rxgains5gmfelossa1=1
|
||||
rxgains5ghfelossa0=1
|
||||
rxgains5ghfelossa1=1
|
||||
rxgains5gbkoffa0=9
|
||||
rxgains5gbkoffa1=9
|
||||
|
||||
rxgains6gelnagaina0=15
|
||||
rxgains6gtrisoa0=17
|
||||
rxgains6gtrelnabypa0=1
|
||||
rxgains6gmelnagaina0=15
|
||||
rxgains6gmtrisoa0=17
|
||||
rxgains6gmtrelnabypa0=1
|
||||
rxgains6ghelnagaina0=15
|
||||
rxgains6ghtrisoa0=17
|
||||
rxgains6ghtrelnabypa0=1
|
||||
rxgains6gfelossa0=1
|
||||
#rxgains6gbkoffa0=16
|
||||
|
||||
rxgains6gelnagaina1=15
|
||||
rxgains6gtrisoa1=17
|
||||
rxgains6gtrelnabypa1=1
|
||||
rxgains6gmelnagaina1=15
|
||||
rxgains6gmtrisoa1=17
|
||||
rxgains6gmtrelnabypa1=1
|
||||
rxgains6ghelnagaina1=15
|
||||
rxgains6ghtrisoa1=17
|
||||
rxgains6ghtrelnabypa1=1
|
||||
rxgains6gfelossa1=1
|
||||
#rxgains6gbkoffa1=16
|
||||
|
||||
#RSSI related for dedicated mode in qdBm (Calibrated on USI 60 pin EVB 2023/10/31)
|
||||
rssi_cal_freq_grp_2g=0x08,0x01,0x91,0x2a,0x23,0xb3,0xc4
|
||||
rssi_cal_rev=1
|
||||
rxgaincal_rssical=1
|
||||
rssi_delta_2gb0=1,2,2,0,1,2,2,0,0,4,2,1,0,4,2,1
|
||||
rssi_delta_2gb1=1,2,2,0,1,2,2,0,1,4,2,1,1,4,2,1
|
||||
rssi_delta_2gb2=1,2,2,0,1,2,2,0,0,4,2,1,0,4,2,1
|
||||
rssi_delta_2gb3=1,2,2,0,1,2,2,0,1,5,3,1,1,5,3,1
|
||||
rssi_delta_2gb4=1,2,2,0,1,2,2,0,1,5,3,2,1,5,3,2
|
||||
rssi_delta_2gb0_fbc=1,1,2,0,1,1,2,0,1,1,2,0,1,1,2,0
|
||||
rssi_delta_2gb1_fbc=1,1,2,0,1,1,2,0,1,1,2,0,1,1,2,0
|
||||
rssi_delta_2gb2_fbc=0,1,2,0,0,1,2,0,0,1,2,0,0,1,2,0
|
||||
rssi_delta_2gb3_fbc=1,1,2,0,1,1,2,0,1,1,2,0,1,1,2,0
|
||||
rssi_delta_2gb4_fbc=1,2,2,0,1,2,2,0,1,2,2,0,1,2,2,0
|
||||
rssi_delta_5gl=-4, 9, 5, 6, -5, 6, 2, 3, -8, 3, -1, 0, -4, 6, 2, 3, -4, 7, 8, 10, -4, 4, 4, 6, -4, 4, 4, 6, -4, 4, 4, 6
|
||||
rssi_delta_5gml=-2, 12, 9, 10, -2, 8, 5, 6, -5, 7, 2, 5, -4, 8, 5, 6, -2, 13, 9, 11, -4, 11, 7, 9, -2, 11, 7, 9, -6, 10, 5, 8
|
||||
rssi_delta_5gmu=1, 13, 10, 11, 1, 13, 10, 11, 1, 13, 10, 11, 1, 13, 10, 11, -1, 14, 9, 11, -1, 14, 9, 11, -1, 14, 9, 11, -1, 14, 9, 11
|
||||
rssi_delta_5gh=1, 17, 13, 14, -2, 14, 10, 11, -4, 12, 6, 9, -4, 12, 8, 9, -8, 9, 0, 3, -10, 7, -2, 1, -11, 6, -5, 0, -12, 3, -6, -3
|
||||
rssi_delta_6gb0=3,13,17,18,1,9,13,14,1,9,13,14,2,10,14,15,-7,11,4,6,-9,8,1,3,-8,8,1,3,-11,6,-1,1
|
||||
rssi_delta_6gb1=3, 16, 18, 19, 1, 12, 14, 15, 1, 12, 14, 15, 2, 13, 15, 16, -6, 13, 5, 7, -8, 10, 2, 4, -7, 10, 2, 4, -10, 8, 0, 2
|
||||
rssi_delta_6gb2=1, 17, 12, 13, -3, 12, 7, 8, -1, 15, 10, 11, -1, 15, 10, 11, -3, 13, 13, 18, -7, 8, 6, 11, -6, 9, 6, 11, -10, 4, 1, 8
|
||||
rssi_delta_6gb3=3, 18, 17, 17, -1, 13, 12, 12, 1, 16, 15, 15, 1, 16, 15, 15, -1, 13, 11, 11, -4, 9, 7, 7, -2, 10, 8, 8, -7, 5, 3, 3
|
||||
rssi_delta_6gb4=2, 17, 12, 11, 0, 15, 10, 9, -2, 13, 8, 7, -3, 12, 7, 6, 3, 18, 11, 11, 0, 15, 8, 8, 0, 15, 8, 8, -4, 11, 4, 4
|
||||
rssi_delta_6gb5=3, 16, 12, 11, 1, 14, 10, 9, -1, 12, 8, 7, -2, 11, 7, 6, 2, 21, 18, 18, -1, 18, 15, 15, -1, 18, 15, 15, -5, 14, 11, 11
|
||||
slice/2/rssicorrnorm5g_c0=3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3
|
||||
slice/2/rssicorrnorm6g_c0=8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8,8
|
||||
slice/1/tone_to_pkt_rssi_offset=-4,-4,-4,-4
|
||||
tone_to_pkt_rssi_offset=-12,-8,-12,-8,-8,-8,-8,-4,-12,-8,-12,-8,-8,-8,-8,-4
|
||||
tone_to_pkt_rssi_offset_6g=-8,-8,-8,-8,-8,-8,-8,-4,-8,-8,-8,-8,-8,-8,-8,-4
|
||||
gain_cal_temp=36
|
||||
slice/1/rxgain_tempcoeff2g_sub=0,0,0,0,0,0,0,0,0,0
|
||||
rxgain_tempcoeff5gl=0,0
|
||||
rxgain_tempcoeff5gml=0,0
|
||||
rxgain_tempcoeff5gmu=0,0
|
||||
rxgain_tempcoeff5gh=0,0
|
||||
slice/1/rxgain_tempcoeff2g_sub_elnaoff=0,0,0,0,0,0,0,0,0,0
|
||||
rxgain_tempcoeff5gl_elnaoff=0,0
|
||||
rxgain_tempcoeff5gml_elnaoff=0,0
|
||||
rxgain_tempcoeff5gmu_elnaoff=0,0
|
||||
rxgain_tempcoeff5gh_elnaoff=0,0
|
||||
|
||||
#TSSI Related
|
||||
low_adc_rate_en=0
|
||||
slice/1/low_adc_rate_en=0
|
||||
|
||||
# UWB Coex
|
||||
uwbcx_en=1
|
||||
uwbcx_gpio_input=0xc
|
||||
uwbcx_adv_req_timer=3
|
||||
uwbcx_coex_bitmap_5g=0x03ff,0x07ff,0x7f
|
||||
uwbcx_coex_bitmap_6g=0xffff,0xffff,0xffff,0x07f
|
||||
|
||||
# 5G K values for 11AZ
|
||||
az_offset_perbw=0,0,0,0,0
|
||||
az_160mkval=8720,8128
|
||||
az_80mkval=5217,4722,5380,3534,4794,2281
|
||||
az_40mkval=8842,8985,9058,8761,9270,9697,8189,7785,7834,8229,4205,6278
|
||||
az_20mkval=46557,47339,47395,45920,45706,45803,45779,45495,47204,47225,47018,46008,45582,45156,45599,43946,45373,46311,47488,46239,42755,44839,44678,45819,47095
|
||||
az_2G20mkval=86824,84806,82990,80645,80645,80611,81678,83010,84943,86015,87934,91348,96069
|
||||
|
||||
# 6G K values for 11AZ
|
||||
az_offset_perbw_6g=0,0,0,0,0
|
||||
az_160mkval_6g=11934,13123,13924,12733,12885,12683,13646
|
||||
az_80mkval_6g=11264,10120,12236,10494,12345,12569,11055,12148,11993,9997,11304,10788,11663,12542
|
||||
az_40mkval_6g=16801,16167,16170,15865,17479,17684,16262,17341,17540,17767,17868,17605,16196,16693,17115,17208,17449,16119,16043,11076,16255,16162,15730,16880,16314,17409,17479,17230,17648
|
||||
az_low_20mkval_6g=46383,46480,46189,46308,46486,45936,45996,45044,46364,45889,46072,46213,45694,45079,45134,45380
|
||||
az_mid1_20mkval_6g=45718,46209,46671,46504,46355,46364,46738,47193,47726,45986,45813,46301,47062,45507,46178,46283
|
||||
az_mid2_20mkval_6g=46714,47566,46170,46915,47243,45630,43353,42155,46809,46838,47066,46214,46144,45543,46850,47776
|
||||
az_high_20mkval_6g=47530,46765,47751,47549,47786,48078,47854,46452,47713,47577,47577
|
||||
|
||||
# Base K Values (For the VHT case 5G 160 & 5G80/40/20/2G20)
|
||||
proxd_basekival_5g_160=14543
|
||||
proxd_basektval_5g_160=14543
|
||||
proxd_basekival=10877,16112,45295,-5932
|
||||
proxd_basektval=10877,16112,45295,-5932
|
||||
# Offsets across channels (Upper nibble for target, lower nibble for initiator - saved in hex)
|
||||
proxd_160mkval=0x0101,0x0000
|
||||
proxd_80mkval=0x0202,0x0101,0x0202,0x0101,0x0000,0x0101
|
||||
proxd_40mkval=0x0303,0x0303,0x0303,0x0202,0x0202,0x0202,0x0202,0x0202,0x0000,0x0101,0x0202,0x0202
|
||||
proxd_20mkval=0x0505,0x0505,0x0505,0x0404,0x0505,0x0303,0x0202,0x0404,0x0101,0x0202,0x0101,0x0202,0x0101,0x0202,0x0303,0x0202,0x0101,0x0000,0x0404,0x0101,0x0000,0x0202,0x0202,0x0505,0x0202
|
||||
proxd_2gkval=0x59,0x58,0x56,0x53,0x52,0x53,0x55,0x0,0x59,0x5a,0x5b,0x5e,0x63,0
|
||||
# Offsets across frame formats @ Initiator
|
||||
# Only for non-VHT frame (Leg6, Leg non-6, mcs0, non-mcs0)
|
||||
# Delta between the base values are adjusted here
|
||||
proxdi_rate80m=0,0,0,0
|
||||
proxdi_rate40m=0,0,0,0
|
||||
proxdi_rate20m=0,0,0,0
|
||||
proxdi_rate2g=0,0,0,0
|
||||
proxdi_ack=0,0,0,0
|
||||
# Offsets across frame formats @ Responder
|
||||
proxdt_rate80m=0,0,0,0
|
||||
proxdt_rate40m=0,0,0,0
|
||||
proxdt_rate20m=0,0,0,0
|
||||
proxdt_rate2g=0,0,0,0
|
||||
proxdt_ack=0,0,0,0
|
||||
# Offsets for sub-bands (VHT, Leg6, Leg non-6, mcs0, non-mcs0)
|
||||
proxd_sub80m40m=0,0,0,0,0
|
||||
proxd_sub80m20m=0,0,0,0,0
|
||||
proxd_sub40m20m=0,0,0,0,0
|
||||
proxd_sub80m40m_ch_off=-12,3190,3793,3699,5693,-58
|
||||
proxd_sub80m20m_ch_off=-13,6960,8249,7058,8788,-2
|
||||
proxd_sub40m20m_ch_off=2,-72,-1859,-2406,-1544,-1181,-1929,-1509,-1567,-162,1
|
||||
proxd_sub160m80m_ch_off=2246,1955
|
||||
proxd_sub160m40m_ch_off=5957,6033
|
||||
proxd_sub160m20m_ch_off=11753,10841
|
||||
|
||||
|
||||
nocrc=1
|
||||
otpimagesize=502
|
||||
|
||||
xtalfreq=76800
|
||||
|
||||
txchain=3
|
||||
rxchain=3
|
||||
|
||||
## --- 11b ANT selection Diversity ---
|
||||
cck_onecore_tx=1
|
||||
|
||||
cckdigfilttype=0
|
||||
|
||||
bandcap=6
|
||||
slice/1/bandcap=1
|
||||
slice/3/bandcap=1
|
||||
|
||||
|
||||
#FDSS Related
|
||||
fdss_level_5g=0,0
|
||||
fdss_level_6g=0,0
|
||||
slice/1/fdss_level_2g=0,0
|
||||
slice/1/fdss_bandedge_2g_en=1
|
||||
slice/1/fdss_profile_2g=7,0,0,5,17,28,36,47,59,152,-90,-320,-140,0,140,320,90,128
|
||||
slice/1/fdss_profile_2g_ch13=8,0,0,5,17,24,28,36,47,59,151,-90,-320,-140,132,-136,140,320,90,128
|
||||
slice/1/fdss_profile_11ax_2g=7,0,0,28,88,120,136,168,228,147,-20,-64,-32,0,32,64,20,128,128
|
||||
slice/1/fdss_profile_11ax_2g_ch13=8,0,0,28,88,112,128,136,168,228,147,-20,-64,8,120,-392,32,64,20,128,128
|
||||
|
||||
paprdis=1
|
||||
slice/1/paprdis=1
|
||||
|
||||
slice/1/txshaper_en=1
|
||||
|
||||
#Tempsense Related
|
||||
tempthresh=255
|
||||
tempoffset=32
|
||||
rawtempsense=0x1ff
|
||||
phycal_tempdelta=15
|
||||
temps_period=15
|
||||
temps_hysteresis=0xf
|
||||
|
||||
#olpc
|
||||
olpc_idx_in_use=1
|
||||
disable_olpc=1
|
||||
olpc_thresh5g=40
|
||||
olpc_anchor5g=40
|
||||
olpc_anchor6g=40
|
||||
olpc_thresh6g=40
|
||||
slice/1/olpc_idx_in_use=1
|
||||
slice/1/disable_olpc=1
|
||||
slice/1/olpc_thresh2g=40
|
||||
slice/1/olpc_anchor2g=40
|
||||
slice/1/olpc_thresh2g_hi=0x7f7f
|
||||
|
||||
# olpc temp offset
|
||||
slice/1/olpc_tempslope2g=-78,-78
|
||||
olpc_tempslope5g=-78,-78
|
||||
olpc_tempslope6g=-78,-78
|
||||
|
||||
# 20231218 Updated on the module socket board
|
||||
hwolpc_offset_c0=0x00,0x03FFFF01,0x03FF0001,0x02FEFF00,0x02FF0101
|
||||
hwolpc_offset6g_c0=0x00FE0000,0x04000000,0x01000001,0x02FF0100,0x02FF0000,0x03FF0000
|
||||
hwolpc_offset_c1=0xFF,0x02FF0000,0x02FEFF00,0x03FF0000,0x02FF0001
|
||||
hwolpc_offset6g_c1=0x02FF0100,0x04000001,0x02FFFFFF,0x04000201,0x03000101,0x03FF0101
|
||||
# Disable Idle TSSI for both Aux and Main slice
|
||||
idletssi_disable=1
|
||||
disable_tpc=0
|
||||
|
||||
### To delay TSSI sampling, in nvram:
|
||||
tssisampledelayen=1
|
||||
|
||||
tssipos2g=1
|
||||
tssipos5g=0
|
||||
|
||||
etssi_inv_gain=357,357,300,300
|
||||
AvVmid_c0=0,178,0,178,0,179,0,185,0,191
|
||||
AvVmid_c1=0,180,0,180,0,181,0,186,0,191
|
||||
AvVmid_6g_c0=0,194,0,199,0,200,0,200,0,202,0,202
|
||||
AvVmid_6g_c1=0,194,0,200,0,200,0,201,0,205,0,203
|
||||
slice/1/AvVmid_c0=0,158
|
||||
slice/1/AvVmid_c1=0,165
|
||||
|
||||
pacalver_nvram=0x1
|
||||
pacal_pwroffseta0=0,-3,-5,-7,-2,1,3,2,5,1,3
|
||||
pacal_pwroffseta1=0,-1,1,-2,-1,3,2,-3,-1,6,4
|
||||
|
||||
# 20231211 adjust PA slope by BRCM
|
||||
## 2024/01/22 Shifted
|
||||
slice/1/pa2ga0=117,9077,-1054
|
||||
slice/1/pa2ga1=56,9311,-1072
|
||||
|
||||
# 2024/01/22 Shifted
|
||||
pa5ga0=77,8030,-1137,76,8056,-1168,88,8380,-1128,67,8226,-1122
|
||||
pa5ga1=80,8208,-1136,99,8327,-1173,94,8390,-1137,82,8359,-1133
|
||||
|
||||
# 2024/01/22 Shifted
|
||||
pa6ga0=94,8381,-1118,87,8380,-1132,96,8390,-1110,102,8419,-1131,94,8384,-1118,100,8267,-1149
|
||||
pa6ga1=134,8548,-1117,112,8512,-1147,94,8347,-1132,92,8472,-1133,101,8328,-1150,75,8149,-1152
|
||||
|
||||
# TPC offset for 11ax ajustments
|
||||
slice/1/tpc_shaper_offset_mcs3_below=0
|
||||
# Max power and offsets
|
||||
slice/1/powoffs2gtna0=0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
slice/1/powoffs2gtna1=0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
# 20231218 updated
|
||||
slice/1/pdoffsetcckma0=0x04
|
||||
slice/1/pdoffsetcckma1=0x04
|
||||
slice/1/cckpwroffset0=-2
|
||||
slice/1/cckpwroffset1=-2
|
||||
|
||||
maxp2ga0=101
|
||||
maxp2ga1=101
|
||||
maxp5ga0=99,103,100,99
|
||||
maxp5ga1=96,94,95,96
|
||||
maxp6ga0=95,97,96,96,91,96
|
||||
maxp6ga1=91,89,91,92,86,86
|
||||
subband5gver=0x4
|
||||
subband6gver=0x3
|
||||
paparambwver=3
|
||||
|
||||
## 20231218 updated
|
||||
pdoffset40ma0=0x6777
|
||||
pdoffset80ma0=0x3566
|
||||
pdoffset160ma0=0x6777
|
||||
pdoffset40ma1=0x6677
|
||||
pdoffset80ma1=0x4666
|
||||
pdoffset160ma1=0x6776
|
||||
pdoffset6g40ma0=0x666677
|
||||
pdoffset6g80ma0=0x554444
|
||||
pdoffset6g160ma0=0x775555
|
||||
pdoffset6g40ma1=0x445566
|
||||
pdoffset6g80ma1=0x444444
|
||||
pdoffset6g160ma1=0x554455
|
||||
|
||||
slice/1/pdoffset20mRU_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
slice/1/pdoffset20mRU_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset20mRU_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset20mRU_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset40mRU_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset40mRU_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset80mRUset1_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset80mRUset2_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset80mRUset1_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset80mRUset2_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g20mRU_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g20mRU_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g40mRU_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g40mRU_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g80mRUset1_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g80mRUset2_c0=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g80mRUset1_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
pdoffset6g80mRUset2_c1=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
# 5G power offset per channel for band edge channel
|
||||
powoffs5g20mtna0=0,0,0,0,0,0,0
|
||||
powoffs5g20mtna1=0,0,0,0,0,0,0
|
||||
powoffs5g40mtna0=0,0,0,0,0
|
||||
powoffs5g40mtna1=0,0,0,0,0
|
||||
powoffs5g80mtna0=0,0,0,0,0
|
||||
powoffs5g80mtna1=0,0,0,0,0
|
||||
#2G/5G related PPR params
|
||||
cckbw202gpo=0x1111
|
||||
mcsbw202gpo=0xECA97754
|
||||
dot11agofdmhrbw202gpo=0x7642
|
||||
ofdmlrbw202gpo=0x2022
|
||||
mcs1024qam2gpo=0x00
|
||||
|
||||
mcsbw205glpo=0xCA875421
|
||||
mcsbw405glpo=0x98654222
|
||||
mcsbw805glpo=0xB9766444
|
||||
mcsbw1605glpo=0xCAAA9666
|
||||
mcsbw205gmpo=0xCB986543
|
||||
mcsbw405gmpo=0xA9766433
|
||||
mcsbw805gmpo=0xB9888555
|
||||
mcsbw1605gmpo=0xCCCCB999
|
||||
mcsbw205ghpo=0xCB987543
|
||||
mcsbw405ghpo=0x98655322
|
||||
mcsbw805ghpo=0xA9777444
|
||||
mcsbw1605ghpo=0xBAAA9878
|
||||
mcs1024qam5glpo=0xFFDDCCED
|
||||
mcs1024qam5gmpo=0xEEDDCCEE
|
||||
mcs1024qam5ghpo=0xEDDDBBEE
|
||||
mcs4096qam5glpo=0x22111100
|
||||
mcs4096qam5gmpo=0x22003121
|
||||
mcs4096qam5ghpo=0x11112000
|
||||
mcs10poexp=0x00000001
|
||||
mcs11poexp=0x00000001
|
||||
mcs12poexp=0xffffffff
|
||||
mcs13poexp=0xffffffff
|
||||
## 6G related PPR params
|
||||
mcsbw206gb1po=0xDCA97655
|
||||
mcsbw206gb2po=0xDCA97655
|
||||
mcsbw206gb3po=0xCCA98655
|
||||
mcsbw206gb4po=0xCCA98655
|
||||
mcsbw206gb5po=0xFDCA8766
|
||||
mcsbw206gb6po=0xFDCA8766
|
||||
mcsbw406gb1po=0xA9876555
|
||||
mcsbw406gb2po=0xA9876555
|
||||
mcsbw406gb3po=0xBA886544
|
||||
mcsbw406gb4po=0xBA886544
|
||||
mcsbw406gb5po=0xB9775444
|
||||
mcsbw406gb6po=0xB9775444
|
||||
mcsbw806gb1po=0xB9777555
|
||||
mcsbw806gb2po=0xB9777555
|
||||
mcsbw806gb3po=0xA8777555
|
||||
mcsbw806gb4po=0xA8777555
|
||||
mcsbw806gb5po=0xB9766444
|
||||
mcsbw806gb6po=0xB9766444
|
||||
mcsbw1606gb1po=0xCCBBA888
|
||||
mcsbw1606gb2po=0xCCBBA888
|
||||
mcsbw1606gb3po=0xCBBB9888
|
||||
mcsbw1606gb4po=0xCBBB9888
|
||||
mcsbw1606gb5po=0xBAAA8777
|
||||
mcsbw1606gb6po=0xBAAA8777
|
||||
mcs1024qam6gb1po=0xEEDDDDFF
|
||||
mcs1024qam6gb2po=0xEEDDDDFF
|
||||
mcs1024qam6gb3po=0xEEEEEEEE
|
||||
mcs1024qam6gb4po=0xEEEEEEEE
|
||||
mcs1024qam6gb5po=0xDDDDDDFF
|
||||
mcs1024qam6gb6po=0xDDDDDDFF
|
||||
mcs4096qam6gb1po=0x22110011
|
||||
mcs4096qam6gb2po=0x22210011
|
||||
mcs4096qam6gb3po=0x22001100
|
||||
mcs4096qam6gb4po=0x22001100
|
||||
mcs4096qam6gb5po=0x22001122
|
||||
mcs4096qam6gb6po=0x22001122
|
||||
mcs10poexp6g=0x00000000
|
||||
mcs11poexp6g=0x00000000
|
||||
mcs12poexp6g=0xffffffff
|
||||
mcs13poexp6g=0xffffffff
|
||||
|
||||
## ULOFDMA Board limit PPRs for 2g20 ##
|
||||
ruppr2g20bpsk=0x208294a5,0x08145208
|
||||
ruppr2g20qpsk=0x208318c6,0x08186208
|
||||
ruppr2g20qam16=0x20839ce7,0x081c7208
|
||||
ruppr2g20qam64=0x2085294a,0x0828a208
|
||||
ruppr2g20qam256=0x2087bdef,0x083cf208
|
||||
ruppr2g20qam1024=0x20894a52,0x08492208
|
||||
ruppr2g20qam4096=0x20842108,0x08208208
|
||||
## ULOFDMA Board limit PPRs for 5g20 ##
|
||||
ruppr5g20bpsk=0x08210842,0x02082082
|
||||
ruppr5g20qpsk=0x08218c63,0x020c3082
|
||||
ruppr5g20qam16=0x08221084,0x02104082
|
||||
ruppr5g20qam64=0x08242108,0x02208082
|
||||
ruppr5g20qam256=0x0826318c,0x0230c082
|
||||
ruppr5g20qam1024=0x0827bdef,0x023cf082
|
||||
ruppr5g20qam4096=0x0828c631,0x02451082
|
||||
## ULOFDMA Board limit PPRs for 5g40 ##
|
||||
ruppr5g40bpsk=0x08421084,0x03104082
|
||||
ruppr5g40qpsk=0x085294a5,0x04145082
|
||||
ruppr5g40qam16=0x086318c6,0x05186082
|
||||
ruppr5g40qam64=0x0894a529,0x08249082
|
||||
ruppr5g40qam256=0x08d6b5ad,0x0b34d082
|
||||
ruppr5g40qam1024=0x08f7bdef,0x0d3cf082
|
||||
ruppr5g40qam4096=0x0918c631,0x12451082
|
||||
## ULOFDMA Board limit PPRs for 5g80 ##
|
||||
ruppr5g80bpsk=0x186318c6,0x06186082
|
||||
ruppr5g80qpsk=0x186318c6,0x06186082
|
||||
ruppr5g80qam16=0x1c739ce7,0x071c7082
|
||||
ruppr5g80qam64=0x28a5294a,0x0a28a082
|
||||
ruppr5g80qam256=0x34d6b5ad,0x0d34d082
|
||||
ruppr5g80qam1024=0x3cf7bdef,0x0f3cf082
|
||||
ruppr5g80qam4096=0x49294a52,0x12492082
|
||||
## ULOFDMA Board limit PPRs for 5g160 ##
|
||||
ruppr5g160bpsk=0x2494a529,0x09249089,0x02082249
|
||||
ruppr5g160qpsk=0x2494a529,0x09249089,0x02082249
|
||||
ruppr5g160qam16=0x28a5294a,0x0a28a08a,0x0208228a
|
||||
ruppr5g160qam64=0x30c6318c,0x0c30c08c,0x0208230c
|
||||
ruppr5g160qam256=0x3cf7bdef,0x0f3cf08f,0x020823cf
|
||||
ruppr5g160qam1024=0x4518c631,0x11451091,0x02082451
|
||||
ruppr5g160qam4096=0x4d39ce73,0x134d3093,0x020824d3
|
||||
## ULOFDMA Board limit PPRs for 6g20 ##
|
||||
ruppr6g20bpsk=0x0c3294a5,0x051450c3
|
||||
ruppr6g20qpsk=0x0c3294a5,0x051450c3
|
||||
ruppr6g20qam16=0x0c339ce7,0x071c70c3
|
||||
ruppr6g20qam64=0x0c35ad6b,0x0b2cb0c3
|
||||
ruppr6g20qam256=0x0c3739ce,0x0e38e0c3
|
||||
ruppr6g20qam1024=0x0c38c631,0x114510c3
|
||||
ruppr6g20qam4096=0x0c39ce73,0x134d30c3
|
||||
## ULOFDMA Board limit PPRs for 6g40 ##
|
||||
ruppr6g40bpsk=0x0c739ce7,0x071c70c3
|
||||
ruppr6g40qpsk=0x0c739ce7,0x071c70c3
|
||||
ruppr6g40qam16=0x0c94a529,0x092490c3
|
||||
ruppr6g40qam64=0x0cb5ad6b,0x0b2cb0c3
|
||||
ruppr6g40qam256=0x0ce739ce,0x0e38e0c3
|
||||
ruppr6g40qam1024=0x0d18c631,0x114510c3
|
||||
ruppr6g40qam4096=0x0d39ce73,0x134d30c3
|
||||
## ULOFDMA Board limit PPRs for 6g80 ##
|
||||
ruppr6g80bpsk=0x1c739ce7,0x071c70c3
|
||||
ruppr6g80qpsk=0x1c739ce7,0x071c70c3
|
||||
ruppr6g80qam16=0x2494a529,0x092490c3
|
||||
ruppr6g80qam64=0x30c6318c,0x0c30c0c3
|
||||
ruppr6g80qam256=0x38e739ce,0x0e38e0c3
|
||||
ruppr6g80qam1024=0x4518c631,0x114510c3
|
||||
ruppr6g80qam4096=0x514a5294,0x145140c3
|
||||
## ULOFDMA Board limit PPRs for 6g160 ##
|
||||
ruppr6g160bpsk=0x2494a529,0x092490c9,0x030c3249
|
||||
ruppr6g160qpsk=0x2494a529,0x092490c9,0x030c3249
|
||||
ruppr6g160qam16=0x2cb5ad6b,0x0b2cb0cb,0x030c32cb
|
||||
ruppr6g160qam64=0x34d6b5ad,0x0d34d0cd,0x030c334d
|
||||
ruppr6g160qam256=0x3cf7bdef,0x0f3cf0cf,0x030c33cf
|
||||
ruppr6g160qam1024=0x4518c631,0x114510d1,0x030c3451
|
||||
ruppr6g160qam4096=0x514a5294,0x145140d4,0x030c3514
|
||||
#OOB params
|
||||
#device_wake_opt=1
|
||||
host_wake_opt=0
|
||||
# temporarily disable deepsleep health check
|
||||
ds_hc_enable=0
|
||||
|
||||
# SWCTRL Format - TXHEc1TXHEc0(16+16 bits), TXHLc1TXHLc0(16+16 bits),
|
||||
# RXHGc1RXHGc0(16+16 bits), RXBYPc1RXBYPc0(16+16 bits), Mask(16 bits)
|
||||
# SWCTRL Ext Format - TXHEc1TXHEc0(4+4 bits), TXHLc1TXHLc0(4+4 bits), RXHGc1RXHGc0(4+4 bits),
|
||||
# RXBYPc1RXBYPc0(4+4 bits), Mask(4 bits)
|
||||
|
||||
# 5G Main SWCTRL
|
||||
swctrlmap_5g=0x00000020,0x00000020,0x00000020,0x00040024,0xFFFF
|
||||
swctrlmapext_5g=0x11,0x11,0x11,0x00,0xF
|
||||
|
||||
# 6G Main SWCTRL
|
||||
swctrlmap_6g=0x00000020,0x00000020,0x00000020,0x00040024,0xFFFF
|
||||
swctrlmapext_6g=0x11,0x11,0x11,0x00,0xF
|
||||
|
||||
# 2G Aux SWCTRL
|
||||
slice/1/swctrlmap_2g=0x80008000,0x80008000,0x80008000,0x00010001,0xFFFF
|
||||
slice/1/swctrlmapext_2g=0x0,0x0,0x0,0x00,0xF
|
||||
|
||||
# 5G WL Scan SWCTRL
|
||||
slice/2/swctrlmap_5g=0x00000000,0x00000000,0x00000020,0x00040024,0xFFFF
|
||||
slice/2/swctrlmapext_5g=0x11,0x11,0x11,0x00,0xF
|
||||
|
||||
# 6G WL Scan SWCTRL
|
||||
slice/2/swctrlmap_6g=0x00000000,0x00000000,0x00000020,0x00040024,0xFFFF
|
||||
slice/2/swctrlmapext_6g=0x11,0x11,0x11,0x00,0xF
|
||||
|
||||
# 2G WL Scan SWCTRL
|
||||
slice/2/swctrlmap_2g=0x00000000,0x00000000,0x80008000,0x00010001,0xFFFF
|
||||
slice/2/swctrlmapext_2g=0x0,0x0,0x0,0x00,0xF
|
||||
|
||||
# Init (default) values for FEM Control LUT Entries - 2G, 5G, 6G
|
||||
fem_table_init_val=0x00010001,0x00000020,0x00000020
|
||||
fem_table_init_val_ext=0x00,0x11,0x11
|
||||
|
||||
# Slice0=WLMain, Slice1=Aux, Slice2=WLScan
|
||||
clb5gslice0core0=0x10024
|
||||
clb5gslice0core1=0x10024
|
||||
clb5gslice2core0=0x10024
|
||||
clb5gslice2core1=0x10024
|
||||
|
||||
clb2gslice1core0=0x08001
|
||||
clb2gslice1core1=0x08001
|
||||
clb2gslice2core0=0x08001
|
||||
clb2gslice2core1=0x08001
|
||||
|
||||
# rfem CMAPT
|
||||
rFEM_hw_mppc_en_2g=1
|
||||
rFEM_cmapt_swpt_pwr_thresh_qdBm_2g=-128,20
|
||||
slice/1/mppc_gaindelta_pa1=41
|
||||
|
||||
rFEM_hw_mppc_en_5g=1
|
||||
rFEM_cmapt_swpt_pwr_thresh_qdBm_5g=-128,12
|
||||
mppc_gaindelta_pa1=0,29,29,31,29,26,25,25,24,27,27
|
||||
|
||||
# Gen9 5G/6G rFEM States:
|
||||
# OFFc1_OFFc0_TX1c1_TX1c0, TX2c1_TX2c0_TX4c1_TX4c0, TX5c1_TX5c0_TX10c1_TX10c0,
|
||||
# RX1c1_RX1c0_RX2Bc1_RX2Bc0, RX2c1_RX2c0_TX3c1_TX3c0, TX7c1_TX7c0_TX8c1_TX8c0,
|
||||
# IDLEc1_IDLEc0_TEMPc1_TEMPc0, SISOc1_SISOc0_BTNc1_BTNc0, TX6c1_TX6c0_TX9c1_TX9c0
|
||||
# BRCM rFEM EMLSR - Link0 uses TX1,TX4,TX7 config, Link1 uses TX2,TX5,TX8 config
|
||||
remoteFEMlut_5g=0x93938181, 0xA0A08484, 0xA1A18A8A, 0x8B8B8D8D, 0x8C8C8383, 0x8484A1A1, 0x8E8E8F8F, 0x90909191, 0x86868989
|
||||
|
||||
# Gen9 2G rFEM States:
|
||||
# OFFc1_OFFc0_TX1c1_TX1c0, 00_00_TX2c1_TX2c0, 00_00_BTTX1c1_BTTX1c0, RXHGc1_RXHGc0_RXHGSCANc1_RXHGSCANc0,
|
||||
# 00_00_00_00, TX3c1_TX3c0_00_00, 00_00_TEMPc1_TEMPc0, 00_00_BTNc1_BTNc0, 00_00_00_00
|
||||
remoteFEMlut_2g=0x80808181, 0x00008383, 0x00008787, 0x85858686, 0x00000000, 0x83830000, 0x00008484, 0x00008A8A, 0x00000000
|
||||
|
||||
# rFEM Type: 1 = BRCM rFEMs, 2 = BRCM Gen9 rFEMs, 3 = Gen8 Murata/Skyworks rFEMs, 4 = Gen9 Murata/Skyworks rFEMs
|
||||
rFEM_2G_type=2
|
||||
rFEM_5G_type=2
|
||||
|
||||
# RFFE VIO SWCTRL Number: 5GC1,5GC0,2GC1,2GC0
|
||||
# 23 is actual line but GCI needs 23+4
|
||||
# 22 is actual line but GCI needs 22+4
|
||||
rFEM_VIO_swctrl=27,10,26,9
|
||||
|
||||
# Drives strength of core 0,1 rffe pads at attach
|
||||
rffe_drive_strength_init=0x2
|
||||
|
||||
muxenab=1
|
||||
|
||||
# [31:24] - rts; [23:16] - cts; [15:8] - Tx; [7:0] - Rx;
|
||||
fuart_sig2pin_map=0x0b0a0908
|
||||
|
||||
###Comment out BT section for initial bringup
|
||||
#BT Coex
|
||||
btc_mode=0x1
|
||||
#btc_params82=0x1a0
|
||||
# BT shared ant configuration
|
||||
btc_prisel_ant_mask=0x0
|
||||
btc_prisel_mask=0x1
|
||||
clb_swctrl_smask_ant0=0x18025
|
||||
clb_swctrl_smask_ant1=0x18025
|
||||
|
||||
# energy detect threshold
|
||||
ed_thresh2g=-63
|
||||
ed_thresh5g=-63
|
||||
ed_thresh6g=-64,-64
|
||||
ed_thresh_sec5g=-72
|
||||
ed_thresh_sec6g=-68,-68
|
||||
# energy detect threshold for EU
|
||||
eu_edthresh2g=-56
|
||||
eu_edthresh5g=-62
|
||||
eu_edthresh6g=-68,-57
|
||||
eu_edthresh_sec5g=-67
|
||||
eu_edthresh_sec6g=-69,-70
|
||||
|
||||
#Feature flags
|
||||
femctrl=17
|
||||
|
||||
# FE Loss comp parameters
|
||||
slice/1/felossTx2ga0=10,10,10,10,11,11,11,11,11,11,11,12,12,12
|
||||
slice/1/felossTx2ga1=11,11,11,11,10,10,10,10,10,9,11,11,11,11
|
||||
slice/1/felossRx2ga0=14,14,14,14,14,11,12,11,12,13,14,14,14,14
|
||||
slice/1/felossRx2ga1=12,11,11,10,11,11,12,12,13,14,14,15,14,14
|
||||
felossTx5ga0=19,17,16,13
|
||||
felossTx5ga1=16,12,11,10
|
||||
felossRx5ga0=19,15,14,12
|
||||
felossRx5ga1=15,10,6,20
|
||||
felossTx6ga0=11,13,14,14,11,16
|
||||
felossTx6ga1=7,5,9,10,6,6
|
||||
felossRx6ga0=10,11,12,13,14,17
|
||||
felossRx6ga1=20,21,14,15,12,10
|
||||
slice/2/felossRx2ga0=0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
slice/2/felossRx2ga1=0,0,0,0,0,0,0,0,0,0,0,0,0,0
|
||||
slice/2/felossRx5ga0=0,0,0,0
|
||||
slice/2/felossRx5ga1=0,0,0,0
|
||||
slice/2/felossRx6ga0=0,0,0,0,0,0
|
||||
slice/2/felossRx6ga1=0,0,0,0,0,0
|
||||
|
||||
# Spur canceller DTX spurs for some channels in Main slice
|
||||
txspurcan_en=1
|
||||
slice/1/txspurcan_en=0
|
||||
|
||||
# ABUCK Votage mapping check (BCM4397_switcher_tbls in pmu.tcl)
|
||||
# 0 --> 0.87V, 1--> 0.88V, 2-->0.89V,..,5-->0.92V.,.., 15 --> 1.02V
|
||||
# -1 --> 0.86V, -2 --> 0.85V, -3 --> 0.67V, -4 --> 0.66V,.. -16 --> 0.54
|
||||
abuck_volt=5
|
||||
slice/1/abuck_volt=5
|
||||
slice/2/abuck_volt=5
|
||||
# CBUCK Votage mapping check (BCM4397_switcher_tbls in pmu.tcl)
|
||||
# 0 --> 0.60V, 1--> 0.61V, 2-->0.62V,...., 15 --> 0.75V, 16 --> 0.76V
|
||||
# 31 --> 0.59V, 30 --> 0.58V, 29 --> 0.57V, 28 --> 0.56V,.. 22 --> 0.50V
|
||||
# 21 --> 0.83V, 20 --> 0.81V, 19 --> 0.79V, 18 --> 0.78V, 17 --> 0.77V
|
||||
#cbuck_volt=21
|
||||
|
||||
##Dynamic SAR related Params
|
||||
dynsar_fcc_rev=0x4
|
||||
|
||||
###LPC EPABYPASS MODE
|
||||
lpc_epabypass_en=1
|
||||
lpc_epabypass_maxpwr=-10
|
||||
lpc_epagain=60
|
||||
|
||||
#LESI desense
|
||||
lesi_desoffset=49,48,48
|
||||
lesi_desoffset_20MHzextra=1,1,1
|
||||
|
||||
#tvpm params
|
||||
tvpm=1
|
||||
slice/1/tvpm=1
|
||||
tvpm_dc_cltm=100,100,90,90,80,80,70,70,60,60,50,50,40,40,30,30,20,20,1,1
|
||||
|
||||
## List of duty cycle temperature thresholds in descending order (num = 3)
|
||||
tvpm_dc_temp_threshold=110,105,100
|
||||
slice/1/tvpm_dc_temp_threshold=110,105,100
|
||||
BIN
drivers/stock/bcmdhd_clm.blob_4390_b1
Normal file
BIN
drivers/stock/bcmdhd_clm.blob_4390_b1
Normal file
Binary file not shown.
BIN
drivers/stock/bcmdhd_txcap.blob_4390_b1
Normal file
BIN
drivers/stock/bcmdhd_txcap.blob_4390_b1
Normal file
Binary file not shown.
BIN
drivers/stock/fw_bcmdhd.bin
Normal file
BIN
drivers/stock/fw_bcmdhd.bin
Normal file
Binary file not shown.
BIN
drivers/stock/fw_bcmdhd.bin_4390_a0
Normal file
BIN
drivers/stock/fw_bcmdhd.bin_4390_a0
Normal file
Binary file not shown.
BIN
drivers/stock/fw_bcmdhd.bin_4390_b0
Normal file
BIN
drivers/stock/fw_bcmdhd.bin_4390_b0
Normal file
Binary file not shown.
BIN
drivers/stock/fw_bcmdhd.bin_4390_b1
Normal file
BIN
drivers/stock/fw_bcmdhd.bin_4390_b1
Normal file
Binary file not shown.
70987
drivers/stock/fw_bcmdhd.map_4390_b1
Normal file
70987
drivers/stock/fw_bcmdhd.map_4390_b1
Normal file
File diff suppressed because it is too large
Load Diff
@@ -29,8 +29,6 @@ CONFDIR="$MODDIR/config"
|
||||
LOGFILE="$MODDIR/driver-manager.log"
|
||||
|
||||
mlog() {
|
||||
STEALTH=$(cat "$CONFDIR/stealth_mode" 2>/dev/null || echo "off")
|
||||
[ "$STEALTH" = "full" ] && return
|
||||
echo "$(date '+%Y-%m-%d %H:%M:%S') [boot_timing] $1" >> "$LOGFILE"
|
||||
}
|
||||
|
||||
@@ -103,12 +101,6 @@ apply_after_pi() {
|
||||
mlog "Driver spoofs applied"
|
||||
fi
|
||||
|
||||
# Apply stealth
|
||||
STEALTH_MODE=$(cat "$CONFDIR/stealth_mode" 2>/dev/null || echo "off")
|
||||
if [ "$STEALTH_MODE" != "off" ]; then
|
||||
mlog "Stealth mode active: $STEALTH_MODE"
|
||||
fi
|
||||
|
||||
# Set non-stock props that we held back during PI window
|
||||
# These are the props that root detectors look for
|
||||
resetprop input.gamepad.enabled true
|
||||
|
||||
@@ -29,8 +29,6 @@ STOCKDIR="$MODDIR/drivers/.stock_meta"
|
||||
mkdir -p "$DRIVERDIR" "$STOCKDIR"
|
||||
|
||||
mlog() {
|
||||
STEALTH=$(cat "$CONFDIR/stealth_mode" 2>/dev/null || echo "off")
|
||||
[ "$STEALTH" = "full" ] && return
|
||||
echo "$(date '+%Y-%m-%d %H:%M:%S') [spoof] $1" >> "$LOGFILE"
|
||||
}
|
||||
|
||||
|
||||
@@ -12,33 +12,17 @@ LOGFILE="$MODDIR/driver-manager.log"
|
||||
PIDDIR="$MODDIR/run"
|
||||
STREAMDIR="$MODDIR/streams"
|
||||
|
||||
# Use stealth wrappers if available, otherwise Termux direct
|
||||
STEALTH_BIN=$(cat "$CONFDIR/stealth_bin_path" 2>/dev/null)
|
||||
if [ -n "$STEALTH_BIN" ] && [ -d "$STEALTH_BIN" ]; then
|
||||
TERMUX="$STEALTH_BIN"
|
||||
# Map stealth names back to real tool names for this script
|
||||
RTL_TCP="$STEALTH_BIN/mediastream"
|
||||
RTL_FM="$STEALTH_BIN/audioservice"
|
||||
RTL_ADSB="$STEALTH_BIN/locationd"
|
||||
RTL_POWER="$STEALTH_BIN/powermanager"
|
||||
HACKRF="$STEALTH_BIN/usb_mtp"
|
||||
else
|
||||
TERMUX="/data/data/com.termux/files/usr/bin"
|
||||
RTL_TCP="$TERMUX/rtl_tcp"
|
||||
RTL_FM="$TERMUX/rtl_fm"
|
||||
RTL_ADSB="$TERMUX/rtl_adsb"
|
||||
RTL_POWER="$TERMUX/rtl_power"
|
||||
HACKRF="$TERMUX/hackrf_transfer"
|
||||
fi
|
||||
TERMUX="/data/data/com.termux/files/usr/bin"
|
||||
RTL_TCP="$TERMUX/rtl_tcp"
|
||||
RTL_FM="$TERMUX/rtl_fm"
|
||||
RTL_ADSB="$TERMUX/rtl_adsb"
|
||||
RTL_POWER="$TERMUX/rtl_power"
|
||||
HACKRF="$TERMUX/hackrf_transfer"
|
||||
|
||||
mkdir -p "$PIDDIR" "$STREAMDIR"
|
||||
|
||||
# Stealth-aware logging — skip logcat in stealth mode
|
||||
STEALTH_MODE=$(cat "$CONFDIR/stealth_mode" 2>/dev/null || echo "off")
|
||||
mlog() {
|
||||
[ "$STEALTH_MODE" = "full" ] && return
|
||||
echo "$(date '+%Y-%m-%d %H:%M:%S') [rtl_switch] $1" >> "$LOGFILE"
|
||||
[ "$STEALTH_MODE" = "off" ] && log -t DriverManager "$1" 2>/dev/null
|
||||
}
|
||||
|
||||
# Kill any running RTL process that holds the dongle
|
||||
@@ -61,11 +45,6 @@ kill_rtl() {
|
||||
pkill -f rtl_power 2>/dev/null
|
||||
pkill -f dvbt_rx 2>/dev/null
|
||||
pkill -f sdr_tv 2>/dev/null
|
||||
pkill -f mediastream 2>/dev/null
|
||||
pkill -f audioservice 2>/dev/null
|
||||
pkill -f locationd 2>/dev/null
|
||||
pkill -f powermanager 2>/dev/null
|
||||
pkill -f usb_mtp 2>/dev/null
|
||||
sleep 1
|
||||
}
|
||||
|
||||
|
||||
136
service.sh
136
service.sh
@@ -366,140 +366,4 @@ if [ "$SPOOF_ENABLED" = "1" ] && [ "$BOOT_TIMING" != "1" ]; then
|
||||
mlog "Driver spoofing applied (immediate mode)"
|
||||
fi
|
||||
|
||||
# ============================================================
|
||||
# STEALTH — Hide module, mask processes, clean traces
|
||||
# ============================================================
|
||||
|
||||
STEALTH_MODE=$(cat "$CONFDIR/stealth_mode" 2>/dev/null || echo "off")
|
||||
|
||||
stealth_apply() {
|
||||
mlog "Stealth: applying ($STEALTH_MODE)"
|
||||
|
||||
# --- Hide module from detection ---
|
||||
# Remove module ID from the KernelSU module list that apps can read
|
||||
# KernelSU stores module state in /data/adb/modules/
|
||||
# Some root detectors scan this directory
|
||||
MODNAME=$(basename "$MODDIR")
|
||||
|
||||
# Bind-mount an empty directory over the module dir to hide it from
|
||||
# non-root processes. Root (KernelSU shell) can still access via
|
||||
# the real path. This hides us from Play Integrity, banking apps, etc.
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "hide_module" ]; then
|
||||
HIDEDIR="$MODDIR/.hidden"
|
||||
mkdir -p "$HIDEDIR"
|
||||
# Don't hide from ourselves — only hide the module listing
|
||||
# KernelSU's own SU list hiding handles the rest
|
||||
mlog "Stealth: module directory concealed"
|
||||
fi
|
||||
|
||||
# --- Mask process names ---
|
||||
# Rename SDR and pentest tool processes so they don't appear
|
||||
# as obvious hacking tools in /proc or ps output
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "mask_procs" ]; then
|
||||
# Create wrapper scripts that exec under innocent names
|
||||
WRAPDIR="$MODDIR/.wrappers"
|
||||
mkdir -p "$WRAPDIR"
|
||||
|
||||
# Map real tool names to innocent process names
|
||||
create_wrapper() {
|
||||
REAL_BIN="$1"
|
||||
FAKE_NAME="$2"
|
||||
WRAPPER="$WRAPDIR/$FAKE_NAME"
|
||||
if [ -x "$REAL_BIN" ]; then
|
||||
cat > "$WRAPPER" << WEOF
|
||||
#!/system/bin/sh
|
||||
exec "$REAL_BIN" "\$@"
|
||||
WEOF
|
||||
chmod 755 "$WRAPPER"
|
||||
fi
|
||||
}
|
||||
|
||||
TERMUX="/data/data/com.termux/files/usr/bin"
|
||||
create_wrapper "$TERMUX/rtl_tcp" "mediastream"
|
||||
create_wrapper "$TERMUX/rtl_fm" "audioservice"
|
||||
create_wrapper "$TERMUX/rtl_adsb" "locationd"
|
||||
create_wrapper "$TERMUX/rtl_power" "powermanager"
|
||||
create_wrapper "$TERMUX/hackrf_transfer" "usb_mtp"
|
||||
|
||||
# Export wrapper path so rtl_mode_switch.sh uses them
|
||||
echo "$WRAPDIR" > "$CONFDIR/stealth_bin_path"
|
||||
mlog "Stealth: process name wrappers created"
|
||||
fi
|
||||
|
||||
# --- Clean logcat traces ---
|
||||
# Remove our log tag from logcat so forensic tools don't see it
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "clean_logs" ]; then
|
||||
# Replace our log tag with a generic Android one
|
||||
# Note: logcat -c clears ALL logs which is suspicious
|
||||
# Instead we just stop logging to logcat going forward
|
||||
LOG_CLEAN=1
|
||||
mlog "Stealth: logcat logging disabled"
|
||||
fi
|
||||
|
||||
# --- Hide modified system properties ---
|
||||
# Some root/mod detectors check for non-stock props
|
||||
# Use resetprop --delete to remove props that aren't on stock
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "hide_props" ]; then
|
||||
# These props don't exist on stock Pixel — remove them so
|
||||
# detectors don't flag them as evidence of modification
|
||||
resetprop --delete input.gamepad.enabled 2>/dev/null
|
||||
resetprop --delete persist.sys.usb.otg 2>/dev/null
|
||||
resetprop --delete vendor.powervr.opencl.allowfp16 2>/dev/null
|
||||
resetprop --delete vendor.powervr.opencl.profiling 2>/dev/null
|
||||
resetprop --delete bluetooth.le.no_location_permission_scan 2>/dev/null
|
||||
mlog "Stealth: non-stock props removed"
|
||||
fi
|
||||
|
||||
# --- MAC address randomization ---
|
||||
# Force MAC randomization on WiFi to prevent device tracking
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "mac_random" ]; then
|
||||
settings put global wifi_connected_mac_randomization_enabled 1 2>/dev/null
|
||||
settings put global wifi_p2p_mac_randomization_enabled 1 2>/dev/null
|
||||
# Bluetooth MAC randomization
|
||||
settings put global bluetooth_addr_randomization_enabled 1 2>/dev/null
|
||||
mlog "Stealth: WiFi + BT MAC randomization enabled"
|
||||
fi
|
||||
|
||||
# --- Hide USB device access ---
|
||||
# When SDR hardware is plugged in, the USB device shows in
|
||||
# lsusb and /sys/bus/usb/. We can't hide the hardware but
|
||||
# we can set permissions tightly so only our processes see it
|
||||
if [ "$STEALTH_MODE" = "full" ] || [ "$STEALTH_MODE" = "hide_usb" ]; then
|
||||
# Instead of chmod 666 (world readable), restrict SDR devices
|
||||
# to root + our specific group
|
||||
for dev in /dev/bus/usb/*/*; do
|
||||
[ -e "$dev" ] || continue
|
||||
VENDOR=$(cat "$(dirname "$(readlink -f "$dev")")/idVendor" 2>/dev/null)
|
||||
case "$VENDOR" in
|
||||
0bda|1d50|0403|04b4|1df7)
|
||||
chmod 660 "$dev" 2>/dev/null
|
||||
chown root:root "$dev" 2>/dev/null
|
||||
;;
|
||||
esac
|
||||
done
|
||||
mlog "Stealth: USB SDR devices restricted to root"
|
||||
fi
|
||||
|
||||
# --- Disable logging entirely in full stealth ---
|
||||
if [ "$STEALTH_MODE" = "full" ]; then
|
||||
# Truncate our log file
|
||||
echo "" > "$LOGFILE"
|
||||
# Redirect future mlog calls to /dev/null
|
||||
LOGFILE="/dev/null"
|
||||
mlog "Stealth: full mode active, logs purged"
|
||||
fi
|
||||
}
|
||||
|
||||
# Override mlog if log cleaning is active
|
||||
if [ "$STEALTH_MODE" != "off" ]; then
|
||||
# Replace mlog to skip logcat (log -t) in stealth modes
|
||||
mlog() {
|
||||
if [ "$STEALTH_MODE" = "full" ]; then
|
||||
return
|
||||
fi
|
||||
echo "$(date '+%Y-%m-%d %H:%M:%S') $1" >> "$LOGFILE"
|
||||
}
|
||||
stealth_apply
|
||||
fi
|
||||
|
||||
mlog "Driver Manager service complete"
|
||||
|
||||
@@ -415,44 +415,6 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Stealth -->
|
||||
<div class="card">
|
||||
<div class="card-title"><span class="dot" id="stealthDot"></span> Stealth</div>
|
||||
<div class="row">
|
||||
<div>
|
||||
<div class="row-label">Stealth Mode</div>
|
||||
<div class="row-desc">Hide module, mask processes, clean traces</div>
|
||||
</div>
|
||||
<select class="sel" id="stealthMode" onchange="setStealthMode(this.value)">
|
||||
<option value="off">Off</option>
|
||||
<option value="hide_module">Hide Module</option>
|
||||
<option value="mask_procs">Mask Processes</option>
|
||||
<option value="hide_props">Hide Props</option>
|
||||
<option value="mac_random">MAC Randomization</option>
|
||||
<option value="hide_usb">Hide USB Devices</option>
|
||||
<option value="clean_logs">Clean Logs</option>
|
||||
<option value="full">Full Stealth</option>
|
||||
</select>
|
||||
</div>
|
||||
<div class="row">
|
||||
<div>
|
||||
<div class="row-label">Stealth Status</div>
|
||||
<div class="row-desc" id="stealthStatus">Inactive</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="row">
|
||||
<div>
|
||||
<div class="row-label">MAC Randomization</div>
|
||||
<div class="row-desc">WiFi + Bluetooth address randomization</div>
|
||||
</div>
|
||||
<div class="row-value" id="macStatus">—</div>
|
||||
</div>
|
||||
<div class="btn-row">
|
||||
<button class="btn" onclick="purgeTraces()">Purge All Traces</button>
|
||||
<button class="btn btn-primary" onclick="applyStealthNow()">Apply Now</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Log -->
|
||||
<div class="card">
|
||||
<div class="card-title">Log</div>
|
||||
@@ -585,74 +547,6 @@
|
||||
}
|
||||
}
|
||||
|
||||
async function setStealthMode(mode) {
|
||||
log('Setting stealth: ' + mode);
|
||||
await exec('echo "' + mode + '" > ' + MODDIR + '/config/stealth_mode');
|
||||
log('Stealth mode set to: ' + mode + '. Apply or reboot to activate.');
|
||||
await loadStealthStatus();
|
||||
}
|
||||
|
||||
async function applyStealthNow() {
|
||||
log('Applying stealth...');
|
||||
await exec('sh ' + MODDIR + '/service.sh &');
|
||||
setTimeout(async () => {
|
||||
await loadStealthStatus();
|
||||
log('Stealth applied');
|
||||
}, 3000);
|
||||
}
|
||||
|
||||
async function purgeTraces() {
|
||||
log('Purging all traces...');
|
||||
// Clear module logs
|
||||
await exec('echo "" > ' + MODDIR + '/driver-manager.log');
|
||||
// Clear logcat entries from our tags
|
||||
await exec('logcat -b all -c 2>/dev/null');
|
||||
// Remove stealth wrappers (recreated on next apply)
|
||||
await exec('rm -rf ' + MODDIR + '/.wrappers');
|
||||
// Clear run state
|
||||
await exec('rm -f ' + MODDIR + '/run/*.pid');
|
||||
// Clear stream data
|
||||
await exec('rm -f ' + MODDIR + '/streams/*');
|
||||
// Clear spectrum/adsb output
|
||||
await exec('rm -f ' + MODDIR + '/spectrum_data.csv ' + MODDIR + '/adsb_output.txt');
|
||||
document.getElementById('logArea').textContent = 'Traces purged.';
|
||||
log('All traces purged');
|
||||
await loadStealthStatus();
|
||||
}
|
||||
|
||||
async function loadStealthStatus() {
|
||||
const mode = (await exec('cat ' + MODDIR + '/config/stealth_mode 2>/dev/null')).stdout.trim();
|
||||
if (mode) document.getElementById('stealthMode').value = mode;
|
||||
|
||||
const dot = document.getElementById('stealthDot');
|
||||
const status = document.getElementById('stealthStatus');
|
||||
|
||||
if (mode === 'full') {
|
||||
dot.className = 'dot';
|
||||
status.textContent = 'Full stealth active — logs disabled, processes masked, props hidden';
|
||||
} else if (mode && mode !== 'off') {
|
||||
dot.className = 'dot warn';
|
||||
status.textContent = 'Partial: ' + mode;
|
||||
} else {
|
||||
dot.className = 'dot off';
|
||||
status.textContent = 'Inactive';
|
||||
}
|
||||
|
||||
// MAC randomization status
|
||||
const wifiMac = (await exec('settings get global wifi_connected_mac_randomization_enabled 2>/dev/null')).stdout.trim();
|
||||
const btMac = (await exec('settings get global bluetooth_addr_randomization_enabled 2>/dev/null')).stdout.trim();
|
||||
const macEl = document.getElementById('macStatus');
|
||||
if (wifiMac === '1' && btMac === '1') {
|
||||
macEl.textContent = 'WiFi + BT';
|
||||
} else if (wifiMac === '1') {
|
||||
macEl.textContent = 'WiFi only';
|
||||
} else if (btMac === '1') {
|
||||
macEl.textContent = 'BT only';
|
||||
} else {
|
||||
macEl.textContent = 'off';
|
||||
}
|
||||
}
|
||||
|
||||
async function setMode(file, value) {
|
||||
log('Setting ' + file + ' = ' + value);
|
||||
await exec('echo "' + value + '" > ' + MODDIR + '/config/' + file);
|
||||
@@ -743,7 +637,6 @@
|
||||
await loadRtlStatus();
|
||||
await loadBootStatus();
|
||||
await loadSpoofStatus();
|
||||
await loadStealthStatus();
|
||||
log('Done');
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user