Ashin Walpola
33c4ec5998
- Firmware: rewrite obu-firmware TX loop to be serial-driven (no on-chip timer), add promiscuous RX + GeoNetworking/BTP unwrap (gn_unwrap.c), add binary UART framing to the phone (serial_link.c/.h). Drop local cam_encode() - CAM is now built on the phone. - Kotlin: byte-exact UPER CAM encoder/decoder ported from cam.c (BitWriter/BitReader/CamUperCodec), matching SerialFrame codec, real UsbSerialTransport (usb-serial-for-android), CamTransmitLoop (1Hz base rate, event/geofence boost, ESP32-C5-only), wired into CamUseCaseRepository for RX and TripRecordingService for TX. - Add V2X message retention: persist all CAM (own+remote) to Room while recording, drop otherwise (DB v2 -> v3 migration). - Add jitpack repo + usb-serial-for-android dependency. Fixes: UsbSerialTransport now uses SerialInputOutputManager.start()/stop() (this lib version manages its own thread internally) instead of manual Runnable/Thread submission, which didn't compile.
50 lines
2.7 KiB
C
50 lines
2.7 KiB
C
#include <stdint.h>
|
|
|
|
// RETIRED - no longer built (removed from main/CMakeLists.txt SRCS), kept only
|
|
// for history. Confirmed not to work: linked cleanly with -Wl,-zmuldefs but
|
|
// the QoS-frame rejection persisted identically. Also turned out to be based
|
|
// on the wrong function signature - the real ieee80211_raw_frame_sanity_check
|
|
// takes (wifi_interface_t ifx, const void *buffer, int32_t len, bool
|
|
// en_sys_seq), confirmed from opentrafficmap/its-g5-receiver-firmware_txenabled's
|
|
// main/tx_custom.c, not the 3x int32_t guessed below. Superseded by
|
|
// tx_custom.c, which bypasses esp_wifi_80211_tx() (and the function that
|
|
// calls this check) entirely instead of trying to neutralize the check.
|
|
// See docs/04-transmit-setup.md.
|
|
|
|
// Overrides a function inside the closed-source WiFi library that gates
|
|
// which raw 802.11 frame types esp_wifi_80211_tx() will accept. By default
|
|
// it only allows beacon/probe-request/probe-response/action and non-QoS
|
|
// data frames - it explicitly rejects QoS Data (subtype 8), which is what
|
|
// real ITS-G5/802.11p hardware actually transmits and expects.
|
|
//
|
|
// This is the same technique used by ESP32 WiFi-security tools (deauther/
|
|
// injection projects) to unlock raw frame injection: define a function with
|
|
// the exact same name as the library's gate, and link with -Wl,-zmuldefs
|
|
// (see CMakeLists.txt) so the linker accepts having two definitions of the
|
|
// same symbol instead of erroring with "multiple definition of
|
|
// `ieee80211_raw_frame_sanity_check'" - and takes this one instead of the
|
|
// library's.
|
|
//
|
|
// Confirmed present for THIS target/IDF version: `nm` on
|
|
// components/esp_wifi/lib/esp32c5/libnet80211.a (IDF v5.5.4) shows
|
|
// `ieee80211_raw_frame_sanity_check` as a normal (non-weak) global text
|
|
// symbol in ieee80211_node.o. The exact argument count/meaning is
|
|
// reverse-engineered from community ESP32 (Xtensa) deauther tools, not
|
|
// confirmed byte-for-byte against esp32c5's actual implementation - if
|
|
// frames still get rejected, or this crashes, the real signature may take
|
|
// different arguments than assumed here.
|
|
//
|
|
// Real risk, not just an inconvenience: this disables ALL sanity checking
|
|
// on raw frames going through esp_wifi_80211_tx(), not just the QoS-type
|
|
// gate. Whatever else that check validates (frame length bounds, etc.) is
|
|
// now unchecked. Malformed frames from a bug elsewhere in this codebase
|
|
// could behave worse (silent corruption, crash) than they would have with
|
|
// the check in place, where they'd have just been rejected cleanly.
|
|
int ieee80211_raw_frame_sanity_check(int32_t arg1, int32_t arg2, int32_t arg3)
|
|
{
|
|
(void)arg1;
|
|
(void)arg2;
|
|
(void)arg3;
|
|
return 0; // 0 = "frame is sane" - always pass
|
|
}
|