Show older

The Protocol is explained in this thread: Encryption, Receive Window, Duty Cycle, ...

qoto.org/@lupyuen/105874847933

Curiously, our Driver includes a Command-Line Interface (bottom) that Transmits and Receives LoRa Packets ... Directly calling the SX1276 Driver 🤔

github.com/lupyuen/bl_iot_sdk/

What's an Mbuf? Why is it used by our Driver? Mbufs are Chains of Fixed-Size Blocks ... Works great with little RAM (no fragmentation) ... Created for BSD Unix in 1983!

mynewt.apache.org/latest/os/co

...Which explains why so many folks at STMicro are now reading this Thread

😉

Yep "pbuf" from the Lightweight IP Stack can be used instead of Mbuf ... We just need to shift the Header / Payload Pointer to work on Packets

github.com/lupyuen/bl_iot_sdk/

Reference Implementation of Semtech Stack is here ... Includes drivers for SX1262 and SX1276

github.com/Lora-net/LoRaMac-no

Bought the RAKwireless Gateway: Developer D4H ... Will benchmark this with LoRa Gateway (Also based on RAKwireless RAK2287)

docs.rakwireless.com/Product-C

on RAKwireless can generate random Application Keys for Over-The-Air Activation (OTAA) ... We shall use keys to activate our and devices wirelessly

thethingsindustries.com/docs/d

Something (or Someone) is transmitting Packets every minute ... Signal Strength (RSSI) shows that they're a few hundred metres away

gist.github.com/lupyuen/8dacf0

Based on earlier Coverage Testing (with and ) ... High chance that our Mystery Transmitter is at the nearby Subway Station 🤔

lupyuen.github.io/articles/wis

Someday I might walk around with RAKwireless to find the Mystery Transmitter ... But for now let's test WisGate with WisBlock and BL602!

docs.rakwireless.com/Product-C

After transmitting a packet, a Device () will open a short "Receive Window" ... To receive a Response Packet (if any) from the LoRaWAN Gateway ()

github.com/lupyuen/wisblock-lo

When hunts for the next Frequency Channel to transmit (Spread Spectrum) ... It listens to the airwaves to check whether the channel is in use ... Let's find out whether BL602 is doing Carrier Sensing correctly 🤔

github.com/lupyuen/bl_iot_sdk/

Oops Mynewt's Carrier Sensing implementation is outdated ... Semtech's LoRaWAN Reference Implementation does NOT require Carrier Sensing outside Japan and South Korea ... So we disable Carrier Sensing and use a random LoRa Frequency Channel

github.com/lupyuen/bl_iot_sdk/

After disabling Carrier Sensing ... hits an Exception while transmitting the Join Network Request ... Let's lookup these addresses in the RISC-V Disassembly

github.com/lupyuen/bl_iot_sdk/

According to our RISC-V Disassembly, Driver hits a Null Pointer Exception here ... Seems like non-essential logging code ... So let's disable this code

github.com/lupyuen/bl_iot_sdk/

is now transmitting the Join Network Request ... But doesn't receive any response from our LoRaWAN Gateway (WisGate) ... Let's check the WisGate LoRaWAN Log

github.com/lupyuen/bl_iot_sdk/

Sadly our Gateway didn't receive any LoRaWAN Packets transmitted by ... Let's look inside the transmitted packets ... And verify the transmission with Airspy SDR

github.com/lupyuen/bl_iot_sdk/

Here's the "Join Network" Chirp ... Recorded by Airspy SDR with CubicSDR

youtu.be/7a4rfaI_zV4

"Join Network" Packet transmitted by ... Looks similar to the one transmitted by BL602 ... Nonce and Message Integrity Code will differ of course

github.com/lupyuen/wisblock-lo

Here are the Packets transmitted by RAKwireless ... Captured by Airspy SDR and CubicSDR

youtu.be/xdyi6XCo8Z8

vs : Join Network Request ... Let's check the Nonce and Message Integrity Code ... Wonder if we can retransmit the BL602 packet from WisBlock 🤔

github.com/lupyuen/bl_iot_sdk/

Let's copy the Join Network Request generated by ... And retransmit with ... Surprise: the Join Request succeeds! 😲 Which proves the Nonce and Message Integrity Code are OK ... Probably the BL602 Power Amplifier setting is wrong 🤔

github.com/lupyuen/bl_iot_sdk/

But wait: Will allow replayed "Join Network" Requests? 😲 Nope it doesn't! will reject Replayed Requests because the Nonce needs to be unique ... Here's how we find Nonce Errors in RAKwireless WisGate

github.com/lupyuen/bl_iot_sdk/

Show newer

@lupyuen
You rock Prof. If You needed adopting clang or fixing that 1bytedma transfers i got some spare resources.

@lupyuen you could use a bloom filter or similar, but then how would you time them out?

Sign in to participate in the conversation
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.