CarlinKit 5.0 CPC200-2air Wifi wont start

[imedium3]

userspace.log
Hi,
I recently purchased a CarlinKit 5.0 CPC200-2air, which initially worked well for a couple of months. Now, the device is experiencing problems: it no longer starts Android Auto, and it can't connect to Wi‑Fi. Although the Bluetooth connection remains stable, Android Auto fails to link with the car system. I attempted both downgrading and upgrading the firmware—including testing a custom firmware version (2024.01.18.1053)—but the issue persists. The logs reveal that while the Wi‑Fi device is detected, it fails to start, suggesting a possible driver problem. I can debug the kit via USB and am seeking assistance to resolve these issues.

Explanation of the Problem:

Device Background:
The CarlinKit 5.0 CPC200-2air initially functioned properly for several months after purchase.

Current Symptoms:
    Android Auto Issue: The system no longer launches Android Auto, preventing its normal operation with the car.
    Wi‑Fi Connectivity Issue: The device fails to access Wi‑Fi, even though the hardware seems to be recognized.
    Bluetooth Functionality: Bluetooth remains operational, indicating that the issue is likely isolated to Wi‑Fi and Android Auto functions.

Troubleshooting Attempts:
    Firmware Changes: Both downgrading and upgrading the firmware have been tried, including the installation of a custom firmware version.
    Log Insights: The logs show that the Wi‑Fi device is found, but it cannot start—this points to a driver issue.
    Debugging Capability: USB debugging is available for further investigation.

Likely Cause:
The consistent error with the Wi‑Fi startup, as indicated by the logs, suggests that a problematic driver may be preventing both Wi‑Fi connectivity and, consequently, Android Auto from functioning properly.

Enclosed userspace.log

[Zubastic]

nl80211 driver initialization failed.
wlan0: interface state UNINITIALIZED->DISABLED
wlan0: AP-DISABLED 
wlan0: CTRL-EVENT-TERMINATING 
hostapd_free_hapd_data: Interface wlan0 wasn't started

Something with drivers. Maybe hardware problem.

I compared with my working U2AC device. Different Card ID: your - 0x4358 Mine - 0xb822.

Save your device id and flash image from repo.

Why u not asking carlinkit support? Maybe they just replace your device with new one?

[Zubastic]

I think it is hardware problem and replacing drivers will change nothing.

[imedium3]

It is a bit strange, first when it was UA2C firmware it worked for a while after purchase, stopped, i contacted carlinkit support they send firmwares after several attempts it worked fine for a couple months now it is running UA2W, i will keep playing with it and share results, if you have a recent dump of a V5 version please share it, the dump in the repo didn't work for me.
Thank you!

[imedium3]

Hi there,

I tried adding the 0x4758 ID in init script for BT and Wifi, the Bluetooth worked fine and wifi chip is powered on, enumerated but the driver cant support it.

bcmdhd.ko
Start load Bluetooth!!!
[ 2.847750] Bluetooth: HCI UART driver ver 2.2
[ 2.847778] Bluetooth: HCI H4 protocol initialized
[ 2.847787] Bluetooth: HCI Three-wire UART (H5) protocol initialized
[ 3.042514] dhd_module_init in
[ 3.043109] Power-up adapter 'DHD generic adapter'
[ 3.053148] wifi_platform_set_power: Onwifi_platform_bus_enumerate device present 1
[ 3.079887] F1 signature OK, socitype:0x1 chip:0x4758 rev:0x3 pkg:0x3
[ 3.079912] dhdsdio_probe_attach: unsupported chip: 0x4758
[ 3.079930] dhdsdio_probe: dhdsdio_probe_attach failed
[ 3.080356] bcmsdh_sdmmc: probe of mmc0:0001:2 failed with error -12

Did this log put away the hardware problem?

[Zubastic]

Google bcmsdh_sdmmc: probe of mmc0:0001:2 failed with error -12. Some threads at e2e.ti.com, maybe it would help.

[imedium3]

the boxis checking the devie id using this command
sdioCardID=cat /sys/bus/sdio/devices/mmc0:0001:1/device
echo "BT WIFI Card Device ID: $sdioCardID"
as result: BT WIFI Card Device ID: 0x4758

the driver is doing the same check but inside bcmdhd.ko
then getting this device ID which is unsupported by the driver.
[ 2.888397] F1 signature OK, socitype:0x1 chip:0x4358 rev:0x3 pkg:0x2

i'm stacked with this step o cant recompile the driver to trick it to initiate when 0x4758

[imedium3]

Hi There,

🔧 Custom Firmware Recovery Summary –
🎯 Goal:
Restore Wi-Fi functionality on a device originally working with BCM4358 and firmware V5, which after being flashed with V4 dumps, only boots correctly with MX25L12835F_FW_20230715_V4.bin — but detects the chip incorrectly as 0x4758, causing driver issues.

🧠 Driver Trick via IDA Reverse Engineering
Main obstacle: The Broadcom driver bcmdhd.ko rejects the Wi-Fi chip ID 0x4758 as unsupported.

Using IDA, we reverse engineered the module and bypassed the dhdsdio_probe_attach chip whitelist to trick the driver into accepting the 0x4758 chip.

✅ Result:
The chip becomes responsive, indicating no major hardware fault.

❌ Remaining issue:
Boot still crashes due to secondary driver-level errors, including:

dhdsdio_probe_attach failed

bcmsdh_sdmmc: probe of mmc0:0001:2 failed with error -12

Possible NULL pointer dereference during probe or SDIO registration

🧪 Custom Firmware Build Strategy
To regain V5-level rootfs functionality without bootloader conflicts:

I injected:

Bootloader & Kernel from
MX25L12835F_FW_20230715_V4.bin

RootFS from
rootfs_v5_packed.jffs2 (extracted from MX25L12835F_04_01_2025_Neoprogrammer.bin)

Command used:

dd if=rootfs_v5_packed.jffs2 of=MX25L12835F_FW_20230715_V4.bin bs=1 seek=$((0x380000)) conv=notrunc status=progress
✅ Result: Device boots successfully and loads the V5 rootfs.

The kit acceped U2AC original and custom firmware.

⚠️ Open Questions & Next Steps
Early Chip Detection:

The kernel still detects chip 0x4758 early, likely in bcmdhd.ko init or probe.

Is there a way to bypass or override this chip ID detection earlier — perhaps via a fake NVRAM patch, init script, or driver stub?

System now reaches up to driver stage — can we insert a firmware redirect or a patched initrd?

@Zubastic , if you're reading:

Any insight on forcing BCM drivers to tolerate 0x4758 beyond probe?

Thank you.

[imedium3]

PS: cat /sys/bus/sdio/devices/mmc0:0001:1/vendor what response would be?
0x0290
cat /sys/bus/sdio/devices/mmc0:0001:1/device
0x4758

Kernel: 3.14.52+g94d07bb, ARMv7

[imedium3]

tried rebuilding the driver, i encountered several difficulties and couldn't have a vlid bcmdhd.ko

[ 2.736103] bcmdhd: disagrees about version of symbol module_layout
insmod: can't insert '/tmp/bcmdhd.ko': invalid module format

[imedium3]

Best result with IDA and HEX editing to force the chip verification to accept the 0x4758
I think the driver is still having difficulties to digest the chip ID i couldn' find where with IDA.

bcmdhd.ko
hci_uart.ko
[ 2.709736] dhd_module_init in
[ 2.710336] Power-up adapter 'DHD generic adapter'
[ 2.721976] wifi_platform_set_power: Onwifi_platform_bus_enumerate device present 1
[ 2.743438] F1 signature OK, socitype:0x1 chip:0x4758 rev:0x3 pkg:0x3
[ 2.743478] wifi_platform_get_mac_addr
[ 2.743724] CFG80211-ERROR) wl_setup_wiphy : Registering Vendor80211)
[ 2.747778] CFG80211-ERROR) wl_cfg80211_reg_notifier : reg_notifier for intiator:0 not supported : set default
[ 2.747807] CFG80211-ERROR) wl_cfg80211_reg_notifier : Set country code 00 from User
[ 2.747820] CFG80211-ERROR) wl_cfg80211_reg_notifier : bcmcfg_to_prmry_wdev (null)
[ 2.757695] wl_create_event_handler(): thread:wl_event_handler:5f started
[ 2.757880] CFG80211-ERROR) wl_event_handler : tsk Enter, tsk = 0x84c813fc
[ 2.762478] dhd_attach(): thread:dhd_watchdog_thread:60 started
[ 2.762619] dhd_attach(): thread:dhd_dpc:61 started
[ 2.762748] dhd_attach(): thread:dhd_rxf:62 started
[ 2.762775] dhd_deferred_work_init: work queue initialized
[ 2.948750] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
[ 2.949779] dhd_bus_start, dhd_bus_init failed -2067628032
[ 2.949793] dhdsdio_probe: dhd_bus_start failed
[ 2.949818] dhd_wlfc_deinit():3254, Already disabled!
[ 2.977343] dhd_detach(): thread:dhd_watchdog_thread:60 terminated OK
[ 2.977417] dhd_detach(): thread:dhd_rxf:62 terminated OK
[ 2.977438] dhd_dpc_thread: Unexpected up_cnt 0
[ 2.977479] dhd_detach(): thread:dhd_dpc:61 terminated OK
[ 2.977514] CFG80211-ERROR) wl_event_handler : was terminated
[ 2.977559] wl_destroy_event_handler(): thread:wl_event_handler:5f terminated OK
[ 3.025851] bcmsdh_sdmmc: probe of mmc0:0001:2 failed with error -12
[ 15.027249] dhd_wifi_platform_load_sdio: sdio_register_driver timeout or error
[ 15.027870] wifi_platform_set_power: Offwifi_platform_bus_enumerate device present 0
[ 15.027966] bcmdhd_wlan: probe of bcmdhd_wlan.13 failed with error -62
wl: wl driver adapter not found

[imedium3]

Hello,

My last progress using IDA to make the driver accept the device from 0x4758 to 0x4358
I partially succeded to stub the driver where it detected the device and followed some CMP to initiate the device
But still have some minor errors.

bcmdhd.ko
hci_uart.ko
[ 2.701224] dhd_module_init in
[ 2.701821] Power-up adapter 'DHD generic adapter'
[ 2.713871] wifi_platform_set_power: Onwifi_platform_bus_enumerate device present 1
[ 2.737918] F1 signature OK, socitype:0x1 chip:0x4358 rev:0x3 pkg:0x3
[ 2.738708] DHD: dongle ram size is set to 786432(orig 786432) at 0x180000
[ 2.738830] wifi_platform_get_mac_addr
[ 2.739085] CFG80211-ERROR) wl_setup_wiphy : Registering Vendor80211)
[ 2.746563] CFG80211-ERROR) wl_cfg80211_reg_notifier : reg_notifier for intiator:0 not supported : set default
[ 2.746591] CFG80211-ERROR) wl_cfg80211_reg_notifier : Set country code 00 from User
[ 2.746604] CFG80211-ERROR) wl_cfg80211_reg_notifier : bcmcfg_to_prmry_wdev (null)
[ 2.755172] wl_create_event_handler(): thread:wl_event_handler:5f started
[ 2.755317] CFG80211-ERROR) wl_event_handler : tsk Enter, tsk = 0x84c813fc
[ 2.755362] dhd_attach(): thread:dhd_watchdog_thread:60 started
[ 2.755448] dhd_attach(): thread:dhd_dpc:61 started
[ 2.755564] dhd_attach(): thread:dhd_rxf:62 started
[ 2.755588] dhd_deferred_work_init: work queue initialized
[ 2.987429] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
[ 12.017622] dhd_bus_init: enable 0x06, ready 0x02 (waited 3006383us)
[ 12.017946]
[ 12.017946] Dongle Host Driver, version 1.141.72 (r)
[ 12.017946] Compiled from
[ 12.037049] Register interface [wlan0] MAC: 00:90:4c:11:22:33
[ 12.037049]
wl: wl driver adapter not found
[ 21.197618] dhd_bus_init: enable 0x06, ready 0x02 (waited 3006383us)
ifconfig: SIOCSIFFLAGS: Operation not permitted
[ 21.439855] dhd_set_mac_addr_handler: MACID is overwritten
[ 21.440060] mmc0: sdhci_data_irq SDHCI_INT_DATA_CRC
[ 21.440113] dhd_bcmsdh_send_buf: sdio error -1, abort command and terminate frame.
[ 21.440243] dhdcdc_set_ioctl: dhdcdc_msg failed w/status -5
[ 21.440257] wlan0: set cur_etheraddr failed
[ 21.440267] dhd_set_mac_addr_handler: _dhd_set_mac_address() failed
Setting Wi-Fi MAC address: 00:E0:4C:25:CD:E6
Start load Bluetooth!!!
[ 21.627792] Bluetooth: HCI UART driver ver 2.2
[ 21.627819] Bluetooth: HCI H4 protocol initialized
[ 21.627829] Bluetooth: HCI Three-wire UART (H5) protocol initialized
[ 21.696877] dhd_set_mac_addr_handler: MACID is overwritten
[ 21.697089] mmc0: sdhci_data_irq SDHCI_INT_DATA_CRC
[ 21.697142] dhd_bcmsdh_send_buf: sdio error -1, abort command and terminate frame.
[ 21.697271] dhdcdc_set_ioctl: dhdcdc_msg failed w/status -5
[ 21.697286] wlan0: set cur_etheraddr failed
[ 21.697297] dhd_set_mac_addr_handler: _dhd_set_mac_address() failed

wlan0 is there but not up yet.

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

ncm0 Link encap:Ethernet HWaddr C2:8E:30:52:E9:A3
inet6 addr: fe80::c08e:30ff:fe52:e9a3/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

wlan0 Link encap:Ethernet HWaddr 00:90:4C:11:22:33
inet addr:192.168.50.2 Bcast:192.168.50.255 Mask:255.255.255.0
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

ifconfig: SIOCSIFFLAGS: Operation not permitted

Any help please?
It would be great to help get the correct kernel and kernel config file, as rebuilding the driver will give me more options.
Kernel: 3.14.52+g94d07bb, ARMv7
Thank you.

[imedium3]

Hi Zubastic,
I'm trying to load a bcmdhd.ko module on my Kit, but I'm getting an invalid module format error. The module's vermagic is 3.14.52+g94d07bb, which matches the running kernel, but I suspect the issue is due to a missing or mismatched kernel config and Module.symvers. Could you help me with the exact .config and Module.symvers used to build this kernel?
Thank you!

[ 3.006479] bcmdhd: no symbol version for module_layout
insmod: can't insert '/tmp/bcmdhd.ko': invalid module format
wl: wl driver adapter not found