Come join me (the "monster" 😂) as we dive deep into the #WiFi Code inside #RISCV #BL602 (the "wifi chip" 😂)

https://lupyuen.github.io/articles/pinecone#notes

Many thanks to this hilarious (but truthful) comment on #BL602 😂

https://qoto.org/@lupyuen/106454770223645891

Here's the #BL602 #WiFi Firmware ... Let's find out how it connects to a WiFi Access Point

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L363

#BL602 connects to #WiFi Access Point ... By notifying the WiFi Manager

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr_api.c#L40-L84

#BL602 #WiFi Manager runs as a Background Task ... Here's how we send requests to WiFi Manager

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr.c#L1332-L1343

#BL602 #WiFi Manager runs a State Machine ... That connects to the WiFi Access Point in the Background Task

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/wifi_mgmr.c#L702-L745

To connect to a #WiFi Access Point, #BL602 WiFi Manager sends a request to the Lower MAC Firmware

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/bl_msg_tx.c#L722-L804

LMAC is the Lower MAC Firmware that runs on the #BL602 Radio Hardware

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

CEVA has an interesting list of customers

https://csimarket.com/stocks/markets_glance.php?code=CEVA#:~:text=Included%20among%20our%20licensees%20are,%2C%20RDA%2C%20Renesas%2C%20Rockchip%2C

#BL602 #WiFi Manager sends Connect Request to LMAC Firmware thru another Message Queue

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/bl_msg_tx.c#L315-L371

#BL602 #WiFi Manager talks to LMAC Firmware via Message Queue ... Let's find out how it works

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

#BL602 #WiFi Driver talks to LMAC Firmware ... By writing to a Message Buffer and triggering an Interrupt

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/ipc_host.c#L139-L171

#BL602 #WiFi Driver triggers LMAC Interrupt ... By writing to Address 0x4400 0000 ... Let's see what's at 0x4400 0000

https://github.com/lupyuen/bl_iot_sdk/blob/master/components/bl602/bl602_wifidrv/bl60x_wifi_driver/reg_ipc_app.h#L66-L69

But 0x4400 0000 is NOT documented in #BL602 Reference Manual! 😲 Now we know a secret ... BL602 talks to LMAC Firmware at Address 0x4400 0000 🤫

https://github.com/bouffalolab/bl_docs/blob/main/BL602_RM/en/BL602_BL604_RM_1.2_en.pdf

Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious #BL602 #WiFi Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1

#BL602 Firmware starts the #WiFi Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L729-L747

"wifi_main" lives in the mysterious #BL602 #WiFi Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L32959-L33006

@lupyuen That's so much cleaner than the first version uploaded. It was also using a custom ported Processor that is also in the repository but not yet available in Ghidra. I'm just glad that you are finding it useful. Libwifi should contain 112 object files but 6 were excluded because of errors, I'll get them up when I can get them decompiled.

@AmpBenzScientist

Ghidra fails to load them? Id like to check if llvms disassembler will be able to parse and decompile them.

@lupyuen

@PawelK @lupyuen Ghidra loads them but won't disassemble. It's an error regarding memory and my custom processor has reduced the number of errors. This is a memory issue that I need to address soon. Ghidra is a beast and 9.2.2 had the same quality code as IDA Pro on Arm. Gamiee and I had a little competition comparing the output of the two. He had to admit that it was powerful but it doesn't produce pretty code. Verbose Chainsaw is the actual test that was done. The capabilities are greatly improved in 10.0.0.