1 /*****************************************************************************
3 (c) Cambridge Silicon Radio Limited 2012
4 All rights reserved and confidential information of CSR
6 Refer to LICENSE.txt included with this source for details
9 *****************************************************************************/
12 * ---------------------------------------------------------------------------
13 * FILE: csr_wifi_hip_download.c
16 * Routines for downloading firmware to UniFi.
18 * ---------------------------------------------------------------------------
20 #include <linux/slab.h>
21 #include "csr_wifi_hip_unifi.h"
22 #include "csr_wifi_hip_unifiversion.h"
23 #include "csr_wifi_hip_card.h"
24 #include "csr_wifi_hip_xbv.h"
26 #undef CSR_WIFI_IGNORE_PATCH_VERSION_MISMATCH
28 static CsrResult do_patch_download(card_t *card, void *dlpriv,
29 xbv1_t *pfwinfo, u32 boot_ctrl_addr);
31 static CsrResult do_patch_convert_download(card_t *card,
32 void *dlpriv, xbv1_t *pfwinfo);
35 * ---------------------------------------------------------------------------
38 * Find the offset of the appropriate object in the SLUT of a card
41 * card Pointer to card struct
42 * psym Pointer to symbol object.
44 * obj will be set up by this function
45 * pslut Pointer to SLUT address, if 0xffffffff then it must be
48 * CSR_RESULT_SUCCESS on success
50 * CSR_WIFI_HIP_RESULT_NOT_FOUND if not found
51 * ---------------------------------------------------------------------------
53 static CsrResult _find_in_slut(card_t *card, symbol_t *psym, u32 *pslut)
60 /* Get SLUT address */
61 if (*pslut == 0xffffffff)
63 r = card_wait_for_firmware_to_start(card, &slut_address);
64 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
68 if (r != CSR_RESULT_SUCCESS)
70 unifi_error(card->ospriv, "Firmware hasn't started\n");
74 *pslut = slut_address;
77 * Firmware has started so set the SDIO bus clock to the initial speed,
78 * faster than UNIFI_SDIO_CLOCK_SAFE_HZ, to speed up the f/w download.
80 csrResult = CsrSdioMaxBusClockFrequencySet(card->sdio_if, UNIFI_SDIO_CLOCK_INIT_HZ);
81 if (csrResult != CSR_RESULT_SUCCESS)
83 r = ConvertCsrSdioToCsrHipResult(card, csrResult);
87 card->sdio_clock_speed = UNIFI_SDIO_CLOCK_INIT_HZ;
91 slut_address = *pslut; /* Use previously discovered address */
93 unifi_trace(card->ospriv, UDBG4, "SLUT addr: 0x%lX\n", slut_address);
96 * Check the SLUT fingerprint.
97 * The slut_address is a generic pointer so we must use unifi_card_read16().
99 unifi_trace(card->ospriv, UDBG4, "Looking for SLUT finger print\n");
101 r = unifi_card_read16(card, slut_address, &finger_print);
102 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
106 if (r != CSR_RESULT_SUCCESS)
108 unifi_error(card->ospriv, "Failed to read SLUT finger print\n");
113 if (finger_print != SLUT_FINGERPRINT)
115 unifi_error(card->ospriv, "Failed to find SLUT fingerprint\n");
116 func_exit_r(CSR_RESULT_FAILURE);
117 return CSR_RESULT_FAILURE;
120 /* Symbol table starts imedately after the fingerprint */
128 r = unifi_card_read16(card, slut_address, &id);
129 if (r != CSR_RESULT_SUCCESS)
136 if (id == CSR_SLT_END)
138 /* End of table reached: not found */
139 r = CSR_WIFI_HIP_RESULT_RANGE;
143 r = unifi_read32(card, slut_address, &obj);
144 if (r != CSR_RESULT_SUCCESS)
151 unifi_trace(card->ospriv, UDBG3, " found SLUT id %02d.%08lx\n", id, obj);
153 r = CSR_WIFI_HIP_RESULT_NOT_FOUND;
154 /* Found search term? */
157 unifi_trace(card->ospriv, UDBG1, " matched SLUT id %02d.%08lx\n", id, obj);
159 r = CSR_RESULT_SUCCESS;
170 * ---------------------------------------------------------------------------
171 * do_patch_convert_download
173 * Download the given firmware image to the UniFi, converting from FWDL
174 * to PTDL XBV format.
177 * card Pointer to card struct
178 * dlpriv Pointer to source firmware image
179 * fwinfo Pointer to source firmware info struct
182 * CSR_RESULT_SUCCESS on success, CSR error code on error
185 * ---------------------------------------------------------------------------
187 static CsrResult do_patch_convert_download(card_t *card, void *dlpriv, xbv1_t *pfwinfo)
190 u32 slut_base = 0xffffffff;
195 /* Reset the chip to guarantee that the ROM loader is running */
196 r = unifi_init(card);
197 if (r != CSR_RESULT_SUCCESS)
199 unifi_error(card->ospriv,
200 "do_patch_convert_download: failed to re-init UniFi\n");
204 /* If no unifi_helper is running, the firmware version must be read */
205 if (card->build_id == 0)
208 sym.id = CSR_SLT_BUILD_ID_NUMBER;
209 sym.obj = 0; /* To be updated by _find_in_slut() */
211 unifi_trace(card->ospriv, UDBG1, "Need f/w version\n");
213 /* Find chip build id entry in SLUT */
214 r = _find_in_slut(card, &sym, &slut_base);
215 if (r != CSR_RESULT_SUCCESS)
217 unifi_error(card->ospriv, "Failed to find CSR_SLT_BUILD_ID_NUMBER\n");
218 return CSR_RESULT_FAILURE;
221 /* Read running f/w version */
222 r = unifi_read32(card, sym.obj, &ver);
223 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
227 if (r != CSR_RESULT_SUCCESS)
229 unifi_error(card->ospriv, "Failed to read f/w id\n");
230 return CSR_RESULT_FAILURE;
232 card->build_id = ver;
235 /* Convert the ptest firmware to a patch against the running firmware */
236 pfw = xbv_to_patch(card, unifi_fw_read, dlpriv, pfwinfo, &psize);
239 unifi_error(card->ospriv, "Failed to convert f/w to patch");
240 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
245 sym.id = CSR_SLT_BOOT_LOADER_CONTROL;
246 sym.obj = 0; /* To be updated by _find_in_slut() */
248 /* Find boot loader control entry in SLUT */
249 r = _find_in_slut(card, &sym, &slut_base);
250 if (r != CSR_RESULT_SUCCESS)
252 unifi_error(card->ospriv, "Failed to find BOOT_LOADER_CONTROL\n");
254 return CSR_RESULT_FAILURE;
257 r = unifi_set_host_state(card, UNIFI_HOST_STATE_AWAKE);
258 if (r != CSR_RESULT_SUCCESS)
260 unifi_error(card->ospriv, "Failed to wake UniFi\n");
263 /* Get a dlpriv for the patch buffer so that unifi_fw_read() can
266 desc = unifi_fw_open_buffer(card->ospriv, pfw, psize);
270 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
273 /* Download the patch */
274 unifi_info(card->ospriv, "Downloading converted f/w as patch\n");
275 r = unifi_dl_patch(card, desc, sym.obj);
277 unifi_fw_close_buffer(card->ospriv, desc);
279 if (r != CSR_RESULT_SUCCESS)
281 unifi_error(card->ospriv, "Converted patch download failed\n");
287 unifi_trace(card->ospriv, UDBG1, "Converted patch downloaded\n");
290 /* This command starts the firmware */
291 r = unifi_do_loader_op(card, sym.obj + 6, UNIFI_BOOT_LOADER_RESTART);
292 if (r != CSR_RESULT_SUCCESS)
294 unifi_error(card->ospriv, "Failed to write loader restart cmd\n");
304 * ---------------------------------------------------------------------------
307 * Download the given firmware image to the UniFi.
310 * card Pointer to card struct
311 * dlpriv A context pointer from the calling function to be
312 * passed when calling unifi_fw_read().
315 * CSR_RESULT_SUCCESS on success,
316 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
317 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
318 * CSR_RESULT_FAILURE SDIO error
321 * Stops and resets the chip, does the download and runs the new
323 * ---------------------------------------------------------------------------
325 CsrResult unifi_dl_firmware(card_t *card, void *dlpriv)
332 fwinfo = kmalloc(sizeof(xbv1_t), GFP_KERNEL);
335 unifi_error(card->ospriv, "Failed to allocate memory for firmware\n");
336 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
340 * Scan the firmware file to find the TLVs we are interested in.
342 * - check we support the file format version in VERF
343 * - SLTP Symbol Lookup Table Pointer
344 * - FWDL firmware download segments
345 * - FWOV firmware overlay segment
346 * - VMEQ Register probe tests to verify matching h/w
348 r = xbv1_parse(card, unifi_fw_read, dlpriv, fwinfo);
349 if (r != CSR_RESULT_SUCCESS || fwinfo->mode != xbv_firmware)
351 unifi_error(card->ospriv, "File type is %s, expected firmware.\n",
352 fwinfo->mode == xbv_patch?"patch" : "unknown");
354 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
357 /* UF6xxx doesn't accept firmware, only patches. Therefore we convert
358 * the file to patch format with version numbers matching the current
359 * running firmware, and then download via the patch mechanism.
360 * The sole purpose of this is to support production test firmware across
361 * different ROM releases, the test firmware being provided in non-patch
364 if (card->chip_id > SDIO_CARD_ID_UNIFI_2)
366 unifi_info(card->ospriv, "Must convert f/w to patch format\n");
367 r = do_patch_convert_download(card, dlpriv, fwinfo);
371 /* Older UniFi chips allowed firmware to be directly loaded onto the
372 * chip, which is no longer supported.
374 unifi_error(card->ospriv, "Only patch downloading supported\n");
375 r = CSR_WIFI_HIP_RESULT_INVALID_VALUE;
381 } /* unifi_dl_firmware() */
385 * ---------------------------------------------------------------------------
388 * Load the given patch set into UniFi.
391 * card Pointer to card struct
392 * dlpriv The os specific handle to the firmware file.
393 * boot_ctrl The address of the boot loader control structure.
396 * CSR_RESULT_SUCCESS on success,
397 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
398 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
399 * CSR_RESULT_FAILURE SDIO error
402 * This ends up telling UniFi to restart.
403 * ---------------------------------------------------------------------------
405 CsrResult unifi_dl_patch(card_t *card, void *dlpriv, u32 boot_ctrl)
412 unifi_info(card->ospriv, "unifi_dl_patch %p %08x\n", dlpriv, boot_ctrl);
414 fwinfo = kmalloc(sizeof(xbv1_t), GFP_KERNEL);
417 unifi_error(card->ospriv, "Failed to allocate memory for patches\n");
419 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
423 * Scan the firmware file to find the TLVs we are interested in.
425 * - check we support the file format version in VERF
426 * - FWID The build ID of the ROM that we can patch
427 * - PTDL patch download segments
429 r = xbv1_parse(card, unifi_fw_read, dlpriv, fwinfo);
430 if (r != CSR_RESULT_SUCCESS || fwinfo->mode != xbv_patch)
433 unifi_error(card->ospriv, "Failed to read in patch file\n");
435 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
439 * We have to check the build id read from the SLUT against that
440 * for the patch file. They have to match exactly.
441 * "card->build_id" == XBV1.PTCH.FWID
443 if (card->build_id != fwinfo->build_id)
445 unifi_error(card->ospriv, "Wrong patch file for chip (chip = %lu, file = %lu)\n",
446 card->build_id, fwinfo->build_id);
448 #ifndef CSR_WIFI_IGNORE_PATCH_VERSION_MISMATCH
450 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
454 return CSR_RESULT_SUCCESS;
458 r = do_patch_download(card, dlpriv, fwinfo, boot_ctrl);
459 if (r != CSR_RESULT_SUCCESS)
461 unifi_error(card->ospriv, "Failed to patch image\n");
468 } /* unifi_dl_patch() */
471 void* unifi_dl_fw_read_start(card_t *card, s8 is_fw)
473 card_info_t card_info;
475 unifi_card_info(card, &card_info);
476 unifi_trace(card->ospriv, UDBG5,
477 "id=%d, ver=0x%x, fw_build=%u, fw_hip=0x%x, block_size=%d\n",
478 card_info.chip_id, card_info.chip_version,
479 card_info.fw_build, card_info.fw_hip_version,
480 card_info.sdio_block_size);
482 return unifi_fw_read_start(card->ospriv, is_fw, &card_info);
487 * ---------------------------------------------------------------------------
488 * safe_read_shared_location
490 * Read a shared memory location repeatedly until we get two readings
494 * card Pointer to card context struct.
495 * unifi_addr UniFi shared-data-memory address to access.
496 * pdata Pointer to a byte variable for the value read.
500 * CSR_RESULT_SUCCESS on success, CSR error code on failure
501 * ---------------------------------------------------------------------------
503 static CsrResult safe_read_shared_location(card_t *card, u32 address, u8 *pdata)
511 r = unifi_read_8_or_16(card, address, &b);
512 if (r != CSR_RESULT_SUCCESS)
519 r = unifi_read_8_or_16(card, address, &b2);
520 if (r != CSR_RESULT_SUCCESS)
525 /* When we have a stable value, return it */
529 return CSR_RESULT_SUCCESS;
535 return CSR_RESULT_FAILURE;
536 } /* safe_read_shared_location() */
540 * ---------------------------------------------------------------------------
543 * Send a loader / boot_loader command to the UniFi and wait for
547 * card Pointer to card context struct.
548 * op_addr The address of the loader operation control word.
549 * opcode The operation to perform.
552 * CSR_RESULT_SUCCESS on success
553 * CSR_RESULT_FAILURE SDIO error or SDIO/XAP timeout
554 * ---------------------------------------------------------------------------
558 * Ideally instead of sleeping, we want to busy wait.
559 * Currently there is no framework API to do this. When it becomes available,
560 * we can use it to busy wait using usecs
562 #define OPERATION_TIMEOUT_LOOPS (100) /* when OPERATION_TIMEOUT_DELAY==1, (500) otherwise */
563 #define OPERATION_TIMEOUT_DELAY 1 /* msec, or 200usecs */
565 CsrResult unifi_do_loader_op(card_t *card, u32 op_addr, u8 opcode)
570 unifi_trace(card->ospriv, UDBG4, "Loader cmd 0x%0x -> 0x%08x\n", opcode, op_addr);
572 /* Set the Operation command byte to the opcode */
573 r = unifi_write_8_or_16(card, op_addr, opcode);
574 if (r != CSR_RESULT_SUCCESS)
576 unifi_error(card->ospriv, "Failed to write loader copy command\n");
580 /* Wait for Operation command byte to be Idle */
581 /* Typically takes ~100us */
583 r = CSR_RESULT_SUCCESS;
589 * Read the memory location until two successive reads give
593 r = safe_read_shared_location(card, op_addr, &op);
594 if (r != CSR_RESULT_SUCCESS)
596 unifi_error(card->ospriv, "Failed to read loader status\n");
600 if (op == UNIFI_LOADER_IDLE)
608 unifi_error(card->ospriv, "Error reported by loader: 0x%X\n", op);
609 r = CSR_RESULT_FAILURE;
613 /* Allow 500us timeout */
614 if (++op_retries >= OPERATION_TIMEOUT_LOOPS)
616 unifi_error(card->ospriv, "Timeout waiting for loader to ack transfer\n");
617 /* Stop XAPs to aid post-mortem */
618 r = unifi_card_stop_processor(card, UNIFI_PROC_BOTH);
619 if (r != CSR_RESULT_SUCCESS)
621 unifi_error(card->ospriv, "Failed to stop UniFi processors\n");
625 r = CSR_RESULT_FAILURE;
629 CsrThreadSleep(OPERATION_TIMEOUT_DELAY);
630 } /* Loop exits with r != CSR_RESULT_SUCCESS on error */
633 } /* unifi_do_loader_op() */
637 * ---------------------------------------------------------------------------
640 * Copy a patch block from userland to the UniFi.
641 * This function reads data, 2K at a time, from userland and writes
645 * card A pointer to the card structure
646 * dlpriv The os specific handle for the firmware file
647 * ptdl A pointer ot the PTDL block
648 * handle The buffer handle to use for the xfer
649 * op_addr The address of the loader operation control word
652 * Number of bytes sent (Positive) or negative value indicating
654 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
655 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
656 * CSR_RESULT_FAILURE SDIO error
657 * ---------------------------------------------------------------------------
659 static CsrResult send_ptdl_to_unifi(card_t *card, void *dlpriv,
660 const struct PTDL *ptdl, u32 handle,
668 const u16 buf_size = 2 * 1024;
670 offset = ptdl->dl_offset;
671 data_len = ptdl->dl_size;
673 if (data_len > buf_size)
675 unifi_error(card->ospriv, "PTDL block is too large (%u)\n",
677 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
680 buf = kmalloc(buf_size, GFP_KERNEL);
683 unifi_error(card->ospriv, "Failed to allocate transfer buffer for firmware download\n");
684 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
687 r = CSR_RESULT_SUCCESS;
689 if (unifi_fw_read(card->ospriv, dlpriv, offset, buf, data_len) != data_len)
691 unifi_error(card->ospriv, "Failed to read from file\n");
695 /* We can always round these if the host wants to */
696 if (card->sdio_io_block_pad)
698 write_len = (data_len + (card->sdio_io_block_size - 1)) &
699 ~(card->sdio_io_block_size - 1);
701 /* Zero out the rest of the buffer (This isn't needed, but it
702 * makes debugging things later much easier). */
703 memset(buf + data_len, 0, write_len - data_len);
707 write_len = data_len;
710 r = unifi_bulk_rw_noretry(card, handle, buf, write_len, UNIFI_SDIO_WRITE);
711 if (r != CSR_RESULT_SUCCESS)
713 unifi_error(card->ospriv, "CMD53 failed writing %d bytes to handle %ld\n",
719 * Can change the order of things to overlap read from file
722 r = unifi_do_loader_op(card, op_addr, UNIFI_BOOT_LOADER_PATCH);
728 if (r != CSR_RESULT_SUCCESS && r != CSR_WIFI_HIP_RESULT_NO_DEVICE)
730 unifi_error(card->ospriv, "Failed to copy block of %u bytes to UniFi\n",
735 } /* send_ptdl_to_unifi() */
739 * ---------------------------------------------------------------------------
742 * This function downloads a set of patches to UniFi and then
743 * causes it to restart.
746 * card Pointer to card struct.
747 * dlpriv A context pointer from the calling function to be
748 * used when reading the XBV file. This can be NULL
749 * in which case not patches are applied.
750 * pfwinfo Pointer to a fwinfo struct describing the f/w
752 * boot_ctrl_addr The address of the boot loader control structure.
755 * 0 on success, or an error code
756 * CSR_WIFI_HIP_RESULT_INVALID_VALUE for a bad laoader version number
757 * ---------------------------------------------------------------------------
759 static CsrResult do_patch_download(card_t *card, void *dlpriv, xbv1_t *pfwinfo, u32 boot_ctrl_addr)
768 * Read info from the SDIO Loader Control Data Structure
770 /* Check the loader version */
771 r = unifi_card_read16(card, boot_ctrl_addr, &loader_version);
772 if (r != CSR_RESULT_SUCCESS)
774 unifi_error(card->ospriv, "Patch download: Failed to read loader version\n");
777 unifi_trace(card->ospriv, UDBG2, "Patch download: boot loader version 0x%04X\n", loader_version);
778 switch (loader_version)
784 unifi_error(card->ospriv, "Patch loader version (0x%04X) is not supported by this driver\n",
786 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
789 /* Retrieve the handle to use with CMD53 */
790 r = unifi_card_read16(card, boot_ctrl_addr + 4, &handle);
791 if (r != CSR_RESULT_SUCCESS)
793 unifi_error(card->ospriv, "Patch download: Failed to read loader handle\n");
797 /* Set the mask of LEDs to flash */
798 if (card->loader_led_mask)
800 r = unifi_card_write16(card, boot_ctrl_addr + 2,
801 (u16)card->loader_led_mask);
802 if (r != CSR_RESULT_SUCCESS)
804 unifi_error(card->ospriv, "Patch download: Failed to write LED mask\n");
811 /* Copy download data to UniFi memory */
812 for (i = 0; i < pfwinfo->num_ptdl; i++)
814 unifi_trace(card->ospriv, UDBG3, "Patch download: %d Downloading for %d from offset %d\n",
816 pfwinfo->ptdl[i].dl_size,
817 pfwinfo->ptdl[i].dl_offset);
819 r = send_ptdl_to_unifi(card, dlpriv, &pfwinfo->ptdl[i],
820 handle, boot_ctrl_addr + 6);
821 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
825 if (r != CSR_RESULT_SUCCESS)
827 unifi_error(card->ospriv, "Patch failed after %u bytes\n",
831 total_bytes += pfwinfo->ptdl[i].dl_size;
834 return CSR_RESULT_SUCCESS;
835 } /* do_patch_download() */