Here's the #BL602 #WiFi Firmware ... Let's find out how it connects to a WiFi Access Point

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L363

#BL602 connects to #WiFi Access Point ... By notifying the WiFi Manager

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr_api.c#L40-L84

#BL602 #WiFi Manager runs as a Background Task ... Here's how we send requests to WiFi Manager

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr.c#L1332-L1343

#BL602 #WiFi Manager runs a State Machine ... That connects to the WiFi Access Point in the Background Task

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr.c#L702-L745

To connect to a #WiFi Access Point, #BL602 WiFi Manager sends a request to the Lower MAC Firmware

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/bl_msg_tx.c#L722-L804

LMAC is the Lower MAC Firmware that runs on the #BL602 Radio Hardware

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

CEVA has an interesting list of customers

https://csimarket.com/stocks/markets_glance.php?code=CEVA#:~:text=Included%20among%20our%20licensees%20are,%2C%20RDA%2C%20Renesas%2C%20Rockchip%2C

#BL602 #WiFi Manager sends Connect Request to LMAC Firmware thru another Message Queue

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/bl_msg_tx.c#L315-L371

#BL602 #WiFi Manager talks to LMAC Firmware via Message Queue ... Let's find out how it works

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

#BL602 #WiFi Driver talks to LMAC Firmware ... By writing to a Message Buffer and triggering an Interrupt

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/ipc_host.c#L139-L171

#BL602 #WiFi Driver triggers LMAC Interrupt ... By writing to Address 0x4400 0000 ... Let's see what's at 0x4400 0000

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/reg_ipc_app.h#L66-L69

But 0x4400 0000 is NOT documented in #BL602 Reference Manual! 😲 Now we know a secret ... BL602 talks to LMAC Firmware at Address 0x4400 0000 🤫

https://github.com/bouffalolab/bl_docs/blob/main/BL602_RM/en/BL602_BL604_RM_1.2_en.pdf

Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious #BL602 #WiFi Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1

#BL602 Firmware starts the #WiFi Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L729-L747

"wifi_main" lives in the mysterious #BL602 #WiFi Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L32959-L33006

#BL602 "wifi_main" calls "ke_evt_schedule" to do #WiFi Tasks ... GitHub Search shows that "ke_evt_schedule" is also defined in ... AliOS! 😲

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L28721-L28737

But does "ke_evt_schedule" really come from AliOS? Not quite ... "ke_evt_schedule" actually comes from ... CEVA RivieraWaves! 😲

https://github.com/mclown/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

Now the #BL602 #WiFi Stack gets clearer ... We're actually reading the WiFi Driver Code by CEVA RivieraWaves! 💡

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

@lupyuen

@AmpBenzScientist is it your child?

@PawelK @lupyuen The code in my repos? It's Reverse Engineered code. It's still not complete but I'm much closer now. I have 6 files that I need to get RE'd to C.

@AmpBenzScientist
Awesome.

@lupyuen

@PawelK @lupyuen I guess it is my child in some ways. Mr. Lee has been working on it too. The code is RV32IMFC on a processor that supports Rv32imafcb. He's building better firmware for it and perhaps my work will be helpful.

@lupyuen That's so much cleaner than the first version uploaded. It was also using a custom ported Processor that is also in the repository but not yet available in Ghidra. I'm just glad that you are finding it useful. Libwifi should contain 112 object files but 6 were excluded because of errors, I'll get them up when I can get them decompiled.

@AmpBenzScientist Cool thanks! 👍

@AmpBenzScientist

Ghidra fails to load them? Id like to check if llvms disassembler will be able to parse and decompile them.

@lupyuen

@PawelK @lupyuen Ghidra loads them but won't disassemble. It's an error regarding memory and my custom processor has reduced the number of errors. This is a memory issue that I need to address soon. Ghidra is a beast and 9.2.2 had the same quality code as IDA Pro on Arm. Gamiee and I had a little competition comparing the output of the two. He had to admit that it was powerful but it doesn't produce pretty code. Verbose Chainsaw is the actual test that was done. The capabilities are greatly improved in 10.0.0.

@AmpBenzScientist
Btw Benzinski some guys around llvm and clang wanna invest some effort into making their disassembler perfect. One of its targets is riscv.

@lupyuen

@AmpBenzScientist @lupyuen

If You wanted to play with llvms disassemblers, i could link you to guys from project etc. They got perfect code quality and architecture for c++ its written in.

@PawelK @lupyuen After reading deep into SLED and SLEIGH so I could port a processor, I see why Ghidra is so effective. Given the troublesome nature of RISC-V disassembly, I would recommend SLEIGH because of the flexibility of it. Even with Ghidra, I spent 3 months working on this. It took about a week to get the first results and I've been doing work on Ghidra since then.

I might have to pass as I want to get involved more with Ghidra and Rizin development.

@lupyuen

@AmpBenzScientist No worries I'm going to fork your repo and make reference to my fork ... So you can go ahead and update yours anytime

@lupyuen Thank you sir.