RDA5981

[kissste]

The last piece has has arrived - RDA5981C+RDA5856EQ

1/ Firmware/flash is different

It has got Dueros support and playback/microphone functions

AT+H
+OK:AT - AT mode
+OK:AT+H - check AT help
+OK:AT+ECHO - open/close uart echo
+OK:AT+RST - Software Reset
+OK:AT+GMI - get factory information
+OK:AT+VER - get version
+OK:AT+UART - set/get serial baudrate
+OK:AT+USERDATA - write/read user data
+OK:AT+SLEEP - enable/disable sleep
+OK:AT+WAKESRC - set wakeup source
+OK:AT+RESTORE - restore default config
+OK:AT+WSMAC - set/get mac address
+OK:AT+WSSCAN - scan AP
+OK:AT+WSCONN - start wifi connect
+OK:AT+WSDISCONN - disconnect
+OK:AT+WDBG - adjust debug level
+OK:AT+WSC - start smart config
+OK:AT+WSFIXIP - enable/disable DHCP
+OK:AT+WAP - enable AP
+OK:AT+WAPSTOP - stop AP
+OK:AT+WAMAC - set/get softap mac address
+OK:AT+WSAK - start wechat airkiss
+OK:AT+WASTA - get joined sta info
+OK:AT+WANET - set/get AP net info
+OK:AT+NSTART - start tcp/udp client
+OK:AT+NSTOP - stop tcp/udp client
+OK:AT+NSEND - send tcp/udp data
+OK:AT+NMODE - start transparent transmission mode
+OK:AT+NCFG - net erase/query/set auto connect config param
+OK:AT+NLINK - check tcp/udp client status
+OK:AT+NPING - do ping
+OK:AT+NDNS - do dns
+OK:AT+BOOTADDR - do bootaddr
+OK:AT+SSTART - start server
+OK:AT+SSTOP - stop server
+OK:AT+SSEND - server send data to client
+OK:AT+SMODE - start server transparent transmission mode
+OK:AT+SLINK - check client status
+OK:AT+SCFG - server erase/query/set auto start/serial param
+OK:AT+FCREATE - bytetd create flash size
+OK:AT+FWRITE - bytetd write flash size
+OK:AT+FREAD - bytetd read flash size
+OK:AT+FDEL - bytetd delete flash size
+OK:AT+FSIZE - bytetd set/get flash size
+OK:AT+FLIST - bytetd list flash file
+OK:AT+FFORMAT - bytetd format flash filesys
+OK:AT+FCFG - bytetd query support max flash filenum and max flash file size
+OK:AT+BYTST - bytetd product test
+OK:AT+MSTART - mqtt start
+OK:AT+MSTOP - mqtt stop
+OK:AT+MSUB - mqtt subscribe
+OK:AT+MUSUB - mqtt unsubscribe
+OK:AT+MPUB - mqtt publish
+OK:AT+MMODE - mqtt transmode
+OK:AT+MCFG - mqtt erase/query/set auto connect config param
+OK:AT+DSKEXI - query sd/udisk dsk/file/diectory exist or not
+OK:AT+DSKRD - read sd/udisk file
+OK:AT+DSKWR - write sd/udisk file
+OK:AT+DSKDEL - delete sd/udisk file/directory
+OK:AT+DSKCR - create sd/udisk file/directory
+OK:AT+IORD - gpio read
+OK:AT+IOWR - gpio write
+OK:AT+IODIR - set/get gpio direction
+OK:AT+ADC - adc read
+OK:AT+VBAT - read vbat value
+OK:AT+PWM - pwm out
+OK:AT+BYUPDATE - bytetd module firmware update
+OK:AT+ZZVER - zzcloud version
+OK:AT+ZZREG - zzcloud register
+OK:AT+ZZACT - zzcloud activate device
+OK:AT+ZZID - query zzcloud authid
+OK:AT+ZZQR - query zzcloud qrcode
+OK:AT+ZZSTART - zzcloud start
+OK:AT+ZZSTOP - zzcloud stop
+OK:AT+ZZSEND - zzcloud send
+OK:AT+ZZSENDEX - zzcloud sendex
+OK:AT+ZZFUNC - zzcloud func
+OK:AT+DUVER - dueros version
+OK:AT+DUSTART - dueros start
+OK:AT+DUSTOP - dueros stop
+OK:AT+DUPLAY - dueros play
+OK:AT+DUVOL - dueros set volume
+OK:AT+DUREC - dueros start or stop record
+OK:AT+DUPAUSE - dueros pause or play
+OK:AT+DUNEXT - dueros play next
+OK:AT+DUPRE - dueros play previous
+OK:AT+DUREP - dueros repeat play
+OK:AT+DUNAME - dueros set/get dlna name
+OK:AT+DUCFG - dueros erase/query/set auto connect config param
+OK:AT+AUTST - audio factory test
+OK:AT+AUVER - audio version
+OK:AT+AUMODE - audio start
+OK:AT+AUPLAY - audio play
+OK:AT+AUSTOP - audio stop
+OK:AT+AUPAUSE - audio pause or resume
+OK:AT+AUVOL - audio set volume
+OK:AT+AUREC - audio record to file
+OK:AT+AUNEXT - audio next sd file
+OK:AT+AUPRE - audio previous sd file
+OK:AT+AUREP - audio repeat sd file
+OK:AT+AULIST - audio list all sd files

AT+VER
+OK:V01.03.0320171206B028

AT+GMI
+OK:Shenzhen Bytetd Technology Co.LTD
+OK:R01C

AT+DUVER
+DUVER:V1.2.4(BETA)

AT+AUVER
+AUVER:5856-100-171020-112235-M1H31

1/a/ other version of firmware is available here, that one even does bluetooth functionality enabled

RDA5981&RDA5856软件版本更新 - 第3页 - Wi-Fi - 锐迪科技术社区 - Powered by RDA SpreadLink


2/ ROM of RDA5981A and C is identical

but dsize in bytes appears to be overflowing. Must have more flash or an additional RAM (PSRAM)

RDA Wlan Boot ROM for RDA5991H v1.0
Build Time: 07:20:54 - Jan 24 2017
RDA Microelectronics Copyright(C) 2004-2017

Enter Mcu Mode
count_left=5
count_left=4
count_left=3
count_left=2
count_left=1
Ready to boot...
Partition addr:4010901c
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x000cc000, dsize_in_b▒H▒ ▒/▒ `A ba▒▒ą▒Ą▒▒▒▒b

 

[pvvx]

Что-то диапазон напряжений мал.

Там нет StepUd/Down DC-DC, а у Flash:

К примеру у CH430:

, а что там стоит на USB-UART вы не написали.
+ Ужесточение напряжений (не ниже норматив амплитуды при USB1.1) возникает из-за наличия USB2.0 на чипе.
Вы уже проверили, как работает там BOR? Желательно, чтобы он отрабатывал до падения к 2.8В, иначе будут беды с Flash. Внутренности чипа (MCU/SRAM) всё равно питаются от 1 с копейками Вольт и им всё равно. При понижении питания падает предельная выходная мощность передатчика, но это бир-бар - пару Дб роли не играют.

 

[kissste]

HLK-M50 samples have arrived.



Unfortunately, don't work.

Two of them, both the same error message.

Missing a boot loader?

How to flash it when it does not have the Boot> MCU Mode

Electrodragon's module already have got a bootloader re-flashed.

At least UART works

 

[kissste]

SWD works on RDA5981

GPIO4 - SWDIO
GPIO5 - SWCLK

or HLK-M50 dev board it's mislabeled
D5 - (is GPIO4) - SWDIO
D6 - (is GPIO5) - SWCLK

$ ../SEGGER/JLink_V630i/JLink.exe -Device CORTEX-M4 -If SWD -Speed 4000 tools/RDA5981_Flash.JLinkScript2
SEGGER J-Link Commander V6.30i (Compiled Mar 23 2018 18:14:43)
DLL version V6.30i, compiled Mar 23 2018 18:14:24

Script file read successfully.
Processing script file...

J-Link connection not established yet but required for command.
Connecting to J-Link via USB...O.K.
Firmware: J-Link STLink V2 compiled Jun 26 2017 10:34:41
Hardware version: V1.00
VTref = 3.300V
Target connection not established yet but required for command.
Device "CORTEX-M4" selected.


Connecting to target via SWD
Found SW-DP with ID 0x4BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
Cortex-M4 identified.
PC = 18004AE6, CycleCnt = 00000000
R0 = 00000000, R1 = 00000000, R2 = E000ED00, R3 = 00000000
R4 = 001000A0, R5 = 00000000, R6 = 401094B0, R7 = 0011FFC8
R8 = 00000000, R9 = 00000000, R10= 00110000, R11= 00000000
R12= 00000000
SP(R13)= 00103058, MSP= 0011FFC8, PSP= 00103058, R14(LR) = 18002FD5
XPSR = 61000000: APSR = nZCvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 02000000, CONTROL = 02, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 00000000, FPS15= 00000000
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 00000000

 

[A_D]

SWD works on RDA5981

GPIO4 - SWDIO
GPIO5 - SWCLK

or HLK-M50 dev board it's mislabeled
D5 - (is GPIO4) - SWDIO
D6 - (is GPIO5) - SWCLK

I tried SWD too (module RDA5981X1), but need connect RESET also.
Here is, how i tried to flash.

Call JLink.exe with this command:

JLink.exe -Device CORTEX-M4 -If SWD -Speed 4000 tools\RDA5981_Flash.JLinkScript

In tools\RDA5981_Flash.JLinkScript :

h
loadbin Debug/bin/firmware.bin 0x00100000
verifybin Debug/bin/firmware.bin, 0x00100000
r
g
q

Log of Jlink.exe:

SEGGER J-Link Commander V6.22a (Compiled Nov 28 2017 17:56:48)
DLL version V6.22a, compiled Nov 28 2017 17:56:10


Script file read successfully.
Processing script file...

J-Link connection not established yet but required for command.
Connecting to J-Link via USB...O.K.
Firmware: J-Link STLink V2 compiled Jun 26 2017 10:34:41
Hardware version: V1.00
S/N: 774212709
VTref = 3.300V
Target connection not established yet but required for command.
Device "CORTEX-M4" selected.


Connecting to target via SWD
Found SW-DP with ID 0x4BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
Cortex-M4 identified.
PC = 18009D46, CycleCnt = 00000000
R0 = 00000000, R1 = 00000000, R2 = E000ED00, R3 = 00000000
R4 = 001000AC, R5 = 00000000, R6 = 401094B0, R7 = 0011FFC8
R8 = 00000000, R9 = 00000000, R10= 00110000, R11= 00000000
R12= 00000000
SP(R13)= 001006F8, MSP= 0011FFC8, PSP= 001006F8, R14(LR) = 180027D1
XPSR = 61000000: APSR = nZCvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 02000000, CONTROL = 02, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 47435000, FPS15= 00000865
FPS16= 3F5C28ED, FPS17= 00000000, FPS18= 3C23D70A, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 80000010

Downloading file [Debug/bin/firmware.bin]...
O.K.

Loading binary file Debug/bin/firmware.bin
Reading 44644 bytes data from target memory @ 0x00100000.
Verify successful.

Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
Reset: CPU may have not been reset (DHCSR.S_RESET_ST never gets set).
Reset: Using fallback: Reset pin.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via reset pin
Reset: VC_CORERESET did not halt CPU. (Debug logic also reset by reset pin?).
Reset: Reconnecting and manually halting CPU.
Found SW-DP with ID 0x4BA01477
AP map detection skipped. Manually configured AP map found.
AP[0]: AHB-AP (IDR: Not set)
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.



Script processing completed.

Log of RDA5981A:

RDA Wlan Boot ROM for RDA5991H v1.0
Build Time: 07:20:54 - Jan 24 2017
RDA Microelectronics Copyright(C) 2004-2017

Enter Mcu Mode
count_left=5
count_left=4
count_left=3
count_left=2
count_left=1
Ready to boot...
Partition addr:4010901c
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x0000b000, dsize_in?÷·)´:…ûÎlŽ'CC9)i1PkÊ

After reboot, RDA5981 loading OLD firmware, what i loaded in it before with UART....
If i load by UART and Flashtool NEW firmware *.bin it works fine.
I something doing not right, but i don't know what...

 

[kissste]

After reboot, RDA5981 loading OLD firmware, what i loaded in it before with UART....
If i load by UART and Flashtool NEW firmware *.bin it works fine.
I something doing not right, but i don't know what...

The flashtool writes to 0x18001000 FLASH
But, your jlink script writes to 0x00100000 I_SRAM, after that, you will have execute some code that will copy/write to the flash at 0x18001000.

There a code that does exactly that in the boot loader, after it receives the data using x/y/z-modem, I guess saves it to RAM and then flashes it to then flash.

Boot >flash
Usage:
flash
- flash - update flash 4KB partition info
1: param load
2:data load
3:write flash
4:index select
5:set param - flag size newest_index p_num buf_addr
6:set partition - flag version p_addr r_addr p_size d_size
7:flash erase - addr sizCommand handler do not well, ret = -1

or even better, take a look what this does (minus the x/y modem)

Boot >loadx
## Ready for binary (xmodem) download to 0x18001000 at 921600 bps...
CC

Boot >loady
## Ready for binary (ymodem) download to 0x18001000 at 921600 bps...
CCCCCCCCCCTimed out
xyzModem - Cksum mode, 0(SOH)/0(STX)/0(CAN) packets, 20 retries
## Total Size = 0x00000000 = 0 Bytes

 

[kissste]

HLK-M50 samples have got a different version of ROM:

RDA Boot ROM for RDA5991H r550
Build Time: 15:50:19 - May 10 2017
RDA Microelectronics Copyright(C) 2004-2017

Electrodragon's X01A:

RDA Wlan Boot ROM for RDA5991H v1.0
Build Time: 07:20:54 - Jan 24 2017
RDA Microelectronics Copyright(C) 2004-2017

 

[A_D]

The flashtool writes to 0x18001000 FLASH
But, your jlink script writes to 0x00100000 I_SRAM, after that, you will have execute some code that will copy/write to the flash at 0x18001000.

There a code that does exactly that in the boot loader, after it receives the data using x/y/z-modem, I guess saves it to RAM and then flashes it to then flash.

Thanks for answer!
Intresting, address 0x18001000 it's is I-CACHE, not Flash:

Or i'm something missed? If i try to execute RDA5981_Flash.JLinkScript :

h
loadbin Debug/bin/firmware.bin 0x18001000
verifybin Debug/bin/firmware.bin, 0x18001000
r
g
q

I have verify error.

P.s. Address 0x00100000 i found in Keil uVision test project in SDK or additional info about RDA5981, just for test quickly create JLinkScript and tried - not working.

 

[pvvx]

HLK-M50 samples have got a different version of ROM:

RDA Boot ROM for RDA5991H r550
Build Time: 15:50:19 - May 10 2017
RDA Microelectronics Copyright(C) 2004-2017

Electrodragon's X01A:

RDA Wlan Boot ROM for RDA5991H v1.0
Build Time: 07:20:54 - Jan 24 2017
RDA Microelectronics Copyright(C) 2004-2017

Это второй фактор, по чему пока воздерживаюсь покупать модули RDA.
RDA Microelectronics официально ещё не заявили о готовности чипов...
Ещё не видно применения DA5891, пока там так мало RAM. Если подключат psRAM и будет всё нормально с ней - тогда можно подумать.

 

[kissste]

Thanks for answer!
Intresting, address 0x18001000 it's is I-CACHE, not Flash:

Or i'm something missed? If i try to execute RDA5981_Flash.JLinkScript :

P.s. Address 0x00100000 i found in Keil uVision test project in SDK or additional info about RDA5981, just for test quickly create JLinkScript and tried - not working.

I'm puzzled, the same way as you are.

My guess is, the Keil uVision test project has loaded to RAM, to run/test.

Look at Debug/bin/firmware.lst:

This is where the code - assembly goes:

Disassembly of section .text:
18001000

This is where the RAM/variables are

Disassembly of section .data:
00100080

 

[kissste]

0x1800 0000 is Flash
0x1800 0000 to 0x1800 0FFF (4k) is reserved for WIFI smartconfig, SSID, password and other user custom data
starting 0x1800 1000 is what bootrom will start executing upon a reboot after it will do its initialization stuff.

Programs to run that write to flash are here:
1/ the bootrom - in the code of 'loadx' and 'loady' functions. My guess is, after receiving 4k (or 64k) it erase flash and writes it and continue till the modem upload has concluded.

and as well as here:

2/ in the file: Keil_v5\ARM\flash\RDA5991H_CE2.FLM that is FirstStep.zip file

see page 4 and 5
Edragon/RDA5981

this code, in the FLM file gets loaded to RAM 0x0010 0000 and then runs to flash 0x1800 0000

and as well as here:

3/ one of the .a/ .ar files
int rda5981_erase_flash(unsigned int addr, unsigned int len);
int rda5981_write_flash(unsigned int addr, char *buf, unsigned int len);
int rda5981_read_flash(unsigned int addr, char *buf, unsigned int len);

 

[kissste]

I have checked what "rda5981_write_flash function and it does look like, there is nothing special to flash. It calls __aeabi_memcpy, in the same way as if it was RAM. I need to debug, maybe there is something at the very end, after it's copied over or perhaps CPU does it automatically, for example, by marking that it has been erased and when "writing" when memcpy finishes the page.

 

[kissste]

Do you have Keil_v5\ARM\flash\RDA5991H_CE2.FLM that is FirstStep.zip file by any chance?
I was not able to find it in any of RDA zip files.

 

[A_D]

Do you have Keil_v5\ARM\flash\RDA5991H_CE2.FLM that is FirstStep.zip file by any chance?
I was not able to find it in any of RDA zip files.

Unfortunately no, don't found ... and i register at RDA forum, but i can't write messages there - all my posts are in moderation for more than a month (probably it's necessary to write only in Chinese, I wrote in English).

 

[kissste]

... I register at RDA forum, but i can't write messages there - all my posts are in moderation for more than a month (probably it's necessary to write only in Chinese, I wrote in English).

The same here, registered, posted something and waiting and waiting...
One exception, they approved one of my posts. It took about a week, but they have approved it
RDA5981 flash dump tool in python - linux - Wi-Fi - 锐迪科技术社区 - Powered by RDA SpreadLink

My other posts are still in a review and it has been multiple weeks.

 

[kissste]

Electro_Dragon's RDA5981 X01 module's Boot ROM version is U02.
hlktech's HLK-M50 ship chips with Boot ROM version U04.

[inline]
#if defined (UNO_81A_U04) || defined (UNO_81AM_U04)|| defined (UNO_81C_U04)
#define FLASH_ERASE_FUN_ADDR 0x2221//smartlink_erase_for_mbed
#define FLASH_WRITE_FUN_ADDR 0x2271//smartlink_write_for_mbed
#define FLASH_READ_FUN_ADDR 0x2273//smartlink_read_for_mbed
#define SPI_FLASH_READ_DATA_FOR_MBED_ADDR 0x2037//spi_flash_read_data_for_mbed
#define UART_SEND_BYTE_ADDR 0x1be5//uart_send_byte
#define UART_RECV_BYTE_ADDR 0x1ca7//uart_recv_byte
#define BOOT_ADDR 0xabf5//void boot(u32 addr)
#define CRC32_ADDR 0x8e33//u32 crc32(const u8 *p, size_t len)
#define spi_flash_erase_4KB_sector_addr 0x23d3
#define spi_wip_reset_addr 0x1dbb
#define spi_write_reset_addr 0x1dcf
#define wait_busy_down_addr 0x1db1
//#elif defined RDA5991H_U02
#elif defined (UNO_81A_U02) || defined (UNO_81AM_U02)|| defined (UNO_81C_U02)
#define FLASH_ERASE_FUN_ADDR 0x21f1//smartlink_erase_for_mbed
#define FLASH_WRITE_FUN_ADDR 0x2241//smartlink_write_for_mbed
#define FLASH_READ_FUN_ADDR 0x2243//smartlink_read_for_mbed
#define SPI_FLASH_READ_DATA_FOR_MBED_ADDR 0x2007//spi_flash_read_data_for_mbed
#define UART_SEND_BYTE_ADDR 0x1bb5//uart_send_byte
#define UART_RECV_BYTE_ADDR 0x1c77//uart_recv_byte
#define BOOT_ADDR 0xab93//void boot(u32 addr)
#define CRC32_ADDR 0x8dff//u32 crc32(const u8 *p, size_t len)
#define spi_flash_erase_4KB_sector_addr 0x23a3
#define spi_wip_reset_addr 0x1d8b
#define spi_write_reset_addr 0x1d9f
#define wait_busy_down_addr 0x1d81
#else
#define FLASH_ERASE_FUN_ADDR 0x21f3//smartlink_erase_for_mbed
#define FLASH_WRITE_FUN_ADDR 0x225d//smartlink_write_for_mbed
#define FLASH_READ_FUN_ADDR 0x225f//smartlink_read_for_mbed
#define SPI_FLASH_READ_DATA_FOR_MBED_ADDR 0x1fd9//spi_flash_read_data_for_mbed
#define UART_SEND_BYTE_ADDR 0x1bab//uart_send_byte
#define UART_RECV_BYTE_ADDR 0x1c6d//uart_recv_byte
#define BOOT_ADDR 0xaafb//void boot(u32 addr)
#define CRC32_ADDR 0x8d67//u32 crc32(const u8 *p, size_t len)
#endif
[/inline]

and some more in wland_flash.h
[inline]
#define FLASH_ERASE_FUN_ADDR 0x21f1//smartlink_erase_for_mbed
#define FLASH_WRITE_FUN_ADDR 0x2241//smartlink_write_for_mbed
#define FLASH_READ_FUN_ADDR 0x2243//smartlink_read_for_mbed
#define FLASH_ERASE_PARTITION_FUN_ADDR 0x2139//spi_flash_erase_partition
#define SPI_FLASH_READ_DATA_FOR_MBED_ADDR 0x2007//spi_flash_read_data_for_mbed
#define spi_flash_disable_cache_addr 0x1eb7//spi_flash_disable_cache
#define spi_flash_flush_cache_addr 0x1ecd//spi_flash_flush_cache
#define spi_flash_cfg_cache_addr 0x1e9f//spi_flash_cfg_cache
#define spi_flash_erase_4KB_sector_addr 0x23a3
#define spi_wip_reset_addr 0x1d8b
#define spi_write_reset_addr 0x1d9f
#define wait_busy_down_addr 0x1d81
[/inline]

 

[kissste]

I'm looking for RSSI associated with the captured packet.

rda5981_enable_sniffer(my_smartconfig_handler);
int my_smartconfig_handler(unsigned short data_len, void *data)

The 'data' does not contain it. It contains FRAME only, unlike in case of ESP8266 or RTL8710.

Any ideas where to get RSSI? Thank you.