Re: Offering embedded systems and low-level programming skills for LibrePhone

[Rob Savoye]

On 11/27/25 3:01 AM, Gustavo F. Paredes Delaloye - LU2JGP wrote:

  Thanks for helping debug the email list. :-) Here's some real content.

  The first step I think is to start documenting the API that is used 
to exchange data with the WPSS blobs. That's somewhat documented here, 
https://librephone.fsf.org/site/ath11k/, although that doc should be 
expanded. There's a few layers of API, we mostly want the HTT & HIF 
layer. Basically we need to know the commands the blob has to respond 
too. This can be done by just going through the kernel driver code. As 
far as disassembly goes, the blobs for the FP6 are here: 
https://librephone.fsf.org/blobs/FP6/modem/image/. The librephone git 
repo docs directory has more detail on each blob. There are 3 
architectures here, AARCH32 with Thumb, AARCH64 (on the SoC), and ATMEL 
AVR8 (on the WCN6750), plus a bunch of data files that I have no idea 
what they are used for (yet). Initial documentation on those blobs is 
here: https://librephone.fsf.org/site/wireless/.

  I haven't quite caught up with documenting the latest discovery, 
which is the low-level testing API built into the Qualcomm open source 
library for the WCN6750. That's buried in the sm7635-modules, which is 
here: 
https://github.com/ArianK16a/android_kernel_fairphone_sm7635-modules. 
This would be what a re-implemented blob would have to support. That of 
course also needs to be documented. Documenting APIs is the first step 
for clean room reverse engineering. I'll add some git issues on these 
tasks for tracking.

  I know that reading code and writing documentation is super boring, 
but since you have experience, you know this is how it gets started. :-) 
I appreciate any contributions to the existing docs, most of what I've 
been writing is a brain dump while doing the research. I'm convinced it 
is possible to re-implement the WPSS blobs as a good start towards a 
freer phone. The certs are in their own data file (wpss.b12), so it 
should be possible to replace them and load our own code.

  While librephone isn't focused on the other blobs for things like 
fingerprint sensors, touchscreen, camera, etc... we of course would 
support anyone where we can wanting to focus on those.

    - rob -