search

seemoo-lab / mobisys2018_nexmon_software_defined_radio

Proof of concept project for operating Broadcom Wi-Fi chips as arbitrary signal transmitters similar to software-defined radios (SDRs)
Other
766 stars 69 forks source link

Query on Raspberry Pi #2

Open CreativeWolf opened 6 years ago

CreativeWolf commented 6 years ago

Hi,

Can this patch be applied for BCM43143 that's on Raspberry Pi 3?

Thanks

matthiasseemoo commented 6 years ago

No, but to the wifi chip of the new rpi3+ after some adjustments. The only thing you need is an 802.11ac phy from broadcom.

Am 15.03.2018 9:13 nachm. schrieb "CreativeWolf" notifications@github.com:

Hi,

Can this patch be applied for BCM43143 that's on Raspberry Pi 3?

Thanks

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/issues/2, or mute the thread https://github.com/notifications/unsubscribe-auth/ALP_7q2keCr_C_Ntu2rFxXHj7Co8CA2Xks5testxgaJpZM4Ss0BK .

F5OEO commented 6 years ago

As a brief understanding, I/Q are sent through ioctl to RAM. Is it possible to feed I/Q samples continuously. If yes, what could be the samplerate which can be achieved ? Thanks for this project which could open large SDR applications.

matthiasseemoo commented 6 years ago

Not just to RAM but to template ram, which is part of the d11 core. Writing to template ram directly from the arm core is quite slow, as the template ram is not memorymapped into the arm's address space and you have to write through a register interface.

There is however the dma controller used to send wifi frames to the d11 core. I did not figure out in detail how to configure it, but i observed that the first few transmitted frames end up in template ram, but this specific section is never overwritten by new frames, only when we restart the d11 core. Hence, continuous transmissions require more reverse engineering and research.

Additionally the minimum sdr tx sample rate is 40 MSps, with 32 bit per sample, which means 160 MBps or 1280 Mbps transferrate into the wifi chip, which is quite high and likely not supported by sdio connected chips. So we need pcie connected chips such as the bcm4358 on a nexus 6p.

Am 16.03.2018 11:38 schrieb "F5OEO" notifications@github.com:

As a brief understanding, I/Q are sent through ioctl to RAM. Is it possible to feed I/Q samples continuously. If yes, what could be the samplerate which can be achieved ? Thanks for this project which could open large SDR applications.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/issues/2#issuecomment-373673898, or mute the thread https://github.com/notifications/unsubscribe-auth/ALP_7nVTDQI1CgVCFOD44bttC10FvasDks5te5YHgaJpZM4Ss0BK .

E3V3A commented 6 years ago

Hi, Sorry to repeat the question,

Q: Can this patch be applied for BCM43143 that's on Raspberry Pi 3? A: No, but to the wifi chip of the new rpi3+ after some adjustments. The only thing you need is an 802.11ac phy from broadcom.

What is the reason for this? Is it a HW limitation or just that you didn't reverse for the RPi3?

matthiasseemoo commented 6 years ago

You need an 802.11ac phy, so its a hw limitation.

Am 16.03.2018 14:11 schrieb "E:V:A" notifications@github.com:

Hi, Sorry to repeat the question,

Q: Can this patch be applied for BCM43143 that's on Raspberry Pi 3? A: No, but to the wifi chip of the new rpi3+ after some adjustments. The only thing you need is an 802.11ac phy from broadcom.

What is the reason for this? Is it a HW limitation or just that you didn't reverse for the RPi3?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/issues/2#issuecomment-373708497, or mute the thread https://github.com/notifications/unsubscribe-auth/ALP_7r8R06Sk7-QVnFNiPy0o9861hPnWks5te7nmgaJpZM4Ss0BK .

F5OEO commented 6 years ago

@matthiasseemoo Thank you for all these info. I wait for Rpi3B+ and could maybe use DMA to fill template RAM. However I have surely to wait for a patch of your work on Raspberry. Congrat again for this great work.

E3V3A commented 6 years ago

Here is a very nice document explaining all bout the 802.11ac phy standard.

802 11ac1

garci66 commented 6 years ago

Quick question. For the Rpi3b+, Will it be possible at all to receive the raw I/Q data? or any way of doing proper spectrum analysis on the wifi bands? Thanks!

matthiasseemoo commented 6 years ago

Reception should be possible. For spectrum analysis you either need a more advanced chip or you have to calculate the fft on your own.

Diego Garcia del Rio notifications@github.com schrieb am So., 15. Apr. 2018, 06:14:

Quick question. For the Rpi3b+, Will it be possible at all to receive the raw I/Q data? or any way of doing proper spectrum analysis on the wifi bands? Thanks!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/issues/2#issuecomment-381378893, or mute the thread https://github.com/notifications/unsubscribe-auth/ALP_7la1SXpw8ERPB28y2kZeSPl8vOziks5toskHgaJpZM4Ss0BK .

guysoft commented 6 years ago

Hey, quiet follower - FFT should not be a challenge right?

garci66 commented 6 years ago

Indeed, I think FFT should be manageable. I need to look a bit more in detail on how one would do the receiving, etc. But the initial cofirmation is encouraging.