#BL602 #WiFi Manager sends Connect Request to LMAC Firmware thru another Message Queue

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/bl_msg_tx.c#L315-L371

#BL602 #WiFi Manager talks to LMAC Firmware via Message Queue ... Let's find out how it works

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

#BL602 #WiFi Driver talks to LMAC Firmware ... By writing to a Message Buffer and triggering an Interrupt

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/ipc_host.c#L139-L171

#BL602 #WiFi Driver triggers LMAC Interrupt ... By writing to Address 0x4400 0000 ... Let's see what's at 0x4400 0000

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/reg_ipc_app.h#L66-L69

But 0x4400 0000 is NOT documented in #BL602 Reference Manual! 😲 Now we know a secret ... BL602 talks to LMAC Firmware at Address 0x4400 0000 🤫

https://github.com/bouffalolab/bl_docs/blob/main/BL602_RM/en/BL602_BL604_RM_1.2_en.pdf

Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious #BL602 #WiFi Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1

#BL602 Firmware starts the #WiFi Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L729-L747

"wifi_main" lives in the mysterious #BL602 #WiFi Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L32959-L33006

#BL602 "wifi_main" calls "ke_evt_schedule" to do #WiFi Tasks ... GitHub Search shows that "ke_evt_schedule" is also defined in ... AliOS! 😲

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L28721-L28737

But does "ke_evt_schedule" really come from AliOS? Not quite ... "ke_evt_schedule" actually comes from ... CEVA RivieraWaves! 😲

https://github.com/mclown/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

Now the #BL602 #WiFi Stack gets clearer ... We're actually reading the WiFi Driver Code by CEVA RivieraWaves! 💡

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

Lesson Learnt: GitHub Search is our very good friend for Reverse Engineering! 👍

https://github.com/search?l=C&o=asc&q=ke_evt_schedule&s=indexed&type=Code

The AliOS / RivieraWaves code we saw earlier was for Beken BK7231U WiFi + BLE SoC ... Is it related to #BL602? 🤔

http://www.bekencorp.com/en/goods/detail/cid/13.html

AliOS for Beken BK7231U WiFi SoC contains LMAC Firmware Code ... Is this the same LMAC Firmware that runs on #BL602's #WiFi Radio? 🤔 Super Exciting!

https://github.com/lupyuen/AliOS-Things/tree/master/platform/mcu/bk7231u/beken/ip/lmac/src

From Now On: We shall read and understand the AliOS / RivieraWaves Source Code ... While comparing it with the Decompiled Code for #BL602 libwifi ... Just to be sure that they are the same 🤝

https://github.com/lupyuen/AliOS-Things/tree/master/platform/mcu/bk7231u/beken/ip/ke

Back to ke_evt_schedule, the function in #BL602 #WiFi Driver Kernel that handles every WiFi Event ... Let's hunt for ke_evt_hdlr and discover the WiFi Events

https://github.com/lupyuen/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

Here are the #WiFi Event Handlers for #BL602 WiFi Kernel ... txl_payload_handle looks interesting ... Let's hunt for it

https://github.com/lupyuen/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L78-L138

txl_payload_handle handles #BL602 #WiFi Payloads by doing ... nothing! But txl_payload_handle_backup seems to be the right function that handles WiFi Payloads 🤔

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L20203-L20398

@lupyuen

@AmpBenzScientist is it your child?

@PawelK @lupyuen The code in my repos? It's Reverse Engineered code. It's still not complete but I'm much closer now. I have 6 files that I need to get RE'd to C.

@AmpBenzScientist
Awesome.

@lupyuen

@PawelK @lupyuen I guess it is my child in some ways. Mr. Lee has been working on it too. The code is RV32IMFC on a processor that supports Rv32imafcb. He's building better firmware for it and perhaps my work will be helpful.

@lupyuen That's so much cleaner than the first version uploaded. It was also using a custom ported Processor that is also in the repository but not yet available in Ghidra. I'm just glad that you are finding it useful. Libwifi should contain 112 object files but 6 were excluded because of errors, I'll get them up when I can get them decompiled.

@AmpBenzScientist Cool thanks! 👍

@AmpBenzScientist

Ghidra fails to load them? Id like to check if llvms disassembler will be able to parse and decompile them.

@lupyuen

@PawelK @lupyuen Ghidra loads them but won't disassemble. It's an error regarding memory and my custom processor has reduced the number of errors. This is a memory issue that I need to address soon. Ghidra is a beast and 9.2.2 had the same quality code as IDA Pro on Arm. Gamiee and I had a little competition comparing the output of the two. He had to admit that it was powerful but it doesn't produce pretty code. Verbose Chainsaw is the actual test that was done. The capabilities are greatly improved in 10.0.0.

@AmpBenzScientist
Out of mem err or out of bounds write or read mem err?

I could be willing to get Your and Gaimees disassembler test harmess to contribute to llvm if it would be ok with You Two.

@lupyuen

@PawelK @lupyuen Unloaded memory errors. This is likely due to the fun way the chip handles memory. I'm working on it and have the specs.

@AmpBenzScientist
Aaah. Arch specific buggy buggy. Ok.

@lupyuen

@PawelK @lupyuen Gamiee and I just decompiled a few ARM bins for the test. IDA Pro doesn't support RISC-V I don't think.

@AmpBenzScientist
Btw Benzinski some guys around llvm and clang wanna invest some effort into making their disassembler perfect. One of its targets is riscv.

@lupyuen

@AmpBenzScientist @lupyuen

If You wanted to play with llvms disassemblers, i could link you to guys from project etc. They got perfect code quality and architecture for c++ its written in.

@PawelK @lupyuen After reading deep into SLED and SLEIGH so I could port a processor, I see why Ghidra is so effective. Given the troublesome nature of RISC-V disassembly, I would recommend SLEIGH because of the flexibility of it. Even with Ghidra, I spent 3 months working on this. It took about a week to get the first results and I've been doing work on Ghidra since then.

I might have to pass as I want to get involved more with Ghidra and Rizin development.

@AmpBenzScientist
Mkay. I wished ghidra and llvm got more synchronized. Llvms speed and low mem reqs kick ass. But we could try to use archspecs (isnt it whats sleight used for?) in sleigh and friends into llvm.

@lupyuen

@PawelK @lupyuen I've had to defend Ghidra in the past and my work with it. It was developed by NSA Research for use by NSA Agents. It's not simple to use and I've not explored all of it fully. It's amazing and I want to port more processors to it. I actually have a theory that I want to try to test but it's hard to explain.

@AmpBenzScientist

My theory is llvm backend could be switched into ghidra and You wouldnt need to feel the difference other than faster speed lower load amd disassembly times and lower mem use. I liked using it though. Mere tiny screech was different flow when jumping through code than in ida due to switch imho.

@lupyuen

@PawelK @lupyuen Perhaps but I've intentionally loaded the wrong arch for disassembly and I still got results with Ghidra. X86 and an ARM binary. It's amazing how it can handle things like this.

@AmpBenzScientist
Yea feels quite robust. Btw reminds me there was source code of binary that runs on three architectures. Contains smart ways to jump over other archs code and runs with same result on all three or so.

@lupyuen

@AmpBenzScientist
Oh my, i just learned sleigh was introed partly or contributed to by one and only cristina cifuentes.

Oh my. I still have her dissertation somewhere. I was intoxicating myself in early childhood with reading it.

@lupyuen

@lupyuen

@lupyuen

is #BL602 the same on #PINE64?

https://hackaday.com/2020/11/20/new-part-day-bouffalo-labs-bl602-risc-v-wi-fi-bluetooth-soc/

@granmogul Yep Pine64 PineCone runs on BL602: https://lupyuen.github.io/articles/pinecone