1 /*****************************************************************************
3 (c) Cambridge Silicon Radio Limited 2012
4 All rights reserved and confidential information of CSR
6 Refer to LICENSE.txt included with this source for details
9 *****************************************************************************/
12 * ---------------------------------------------------------------------------
13 * FILE: csr_wifi_hip_download.c
16 * Routines for downloading firmware to UniFi.
18 * ---------------------------------------------------------------------------
20 #include <linux/slab.h>
21 #include "csr_wifi_hip_unifi.h"
22 #include "csr_wifi_hip_unifiversion.h"
23 #include "csr_wifi_hip_card.h"
24 #include "csr_wifi_hip_xbv.h"
26 #undef CSR_WIFI_IGNORE_PATCH_VERSION_MISMATCH
28 static CsrResult do_patch_download(card_t *card, void *dlpriv,
29 xbv1_t *pfwinfo, u32 boot_ctrl_addr);
31 static CsrResult do_patch_convert_download(card_t *card,
32 void *dlpriv, xbv1_t *pfwinfo);
35 * ---------------------------------------------------------------------------
38 * Find the offset of the appropriate object in the SLUT of a card
41 * card Pointer to card struct
42 * psym Pointer to symbol object.
44 * obj will be set up by this function
45 * pslut Pointer to SLUT address, if 0xffffffff then it must be
48 * CSR_RESULT_SUCCESS on success
50 * CSR_WIFI_HIP_RESULT_NOT_FOUND if not found
51 * ---------------------------------------------------------------------------
53 static CsrResult _find_in_slut(card_t *card, symbol_t *psym, u32 *pslut)
60 /* Get SLUT address */
61 if (*pslut == 0xffffffff)
63 r = card_wait_for_firmware_to_start(card, &slut_address);
64 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
68 if (r != CSR_RESULT_SUCCESS)
70 unifi_error(card->ospriv, "Firmware hasn't started\n");
73 *pslut = slut_address;
76 * Firmware has started so set the SDIO bus clock to the initial speed,
77 * faster than UNIFI_SDIO_CLOCK_SAFE_HZ, to speed up the f/w download.
79 csrResult = CsrSdioMaxBusClockFrequencySet(card->sdio_if, UNIFI_SDIO_CLOCK_INIT_HZ);
80 if (csrResult != CSR_RESULT_SUCCESS)
82 r = ConvertCsrSdioToCsrHipResult(card, csrResult);
85 card->sdio_clock_speed = UNIFI_SDIO_CLOCK_INIT_HZ;
89 slut_address = *pslut; /* Use previously discovered address */
91 unifi_trace(card->ospriv, UDBG4, "SLUT addr: 0x%lX\n", slut_address);
94 * Check the SLUT fingerprint.
95 * The slut_address is a generic pointer so we must use unifi_card_read16().
97 unifi_trace(card->ospriv, UDBG4, "Looking for SLUT finger print\n");
99 r = unifi_card_read16(card, slut_address, &finger_print);
100 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
104 if (r != CSR_RESULT_SUCCESS)
106 unifi_error(card->ospriv, "Failed to read SLUT finger print\n");
110 if (finger_print != SLUT_FINGERPRINT)
112 unifi_error(card->ospriv, "Failed to find SLUT fingerprint\n");
113 return CSR_RESULT_FAILURE;
116 /* Symbol table starts imedately after the fingerprint */
124 r = unifi_card_read16(card, slut_address, &id);
125 if (r != CSR_RESULT_SUCCESS)
131 if (id == CSR_SLT_END)
133 /* End of table reached: not found */
134 r = CSR_WIFI_HIP_RESULT_RANGE;
138 r = unifi_read32(card, slut_address, &obj);
139 if (r != CSR_RESULT_SUCCESS)
145 unifi_trace(card->ospriv, UDBG3, " found SLUT id %02d.%08lx\n", id, obj);
147 r = CSR_WIFI_HIP_RESULT_NOT_FOUND;
148 /* Found search term? */
151 unifi_trace(card->ospriv, UDBG1, " matched SLUT id %02d.%08lx\n", id, obj);
153 r = CSR_RESULT_SUCCESS;
163 * ---------------------------------------------------------------------------
164 * do_patch_convert_download
166 * Download the given firmware image to the UniFi, converting from FWDL
167 * to PTDL XBV format.
170 * card Pointer to card struct
171 * dlpriv Pointer to source firmware image
172 * fwinfo Pointer to source firmware info struct
175 * CSR_RESULT_SUCCESS on success, CSR error code on error
178 * ---------------------------------------------------------------------------
180 static CsrResult do_patch_convert_download(card_t *card, void *dlpriv, xbv1_t *pfwinfo)
183 u32 slut_base = 0xffffffff;
188 /* Reset the chip to guarantee that the ROM loader is running */
189 r = unifi_init(card);
190 if (r != CSR_RESULT_SUCCESS)
192 unifi_error(card->ospriv,
193 "do_patch_convert_download: failed to re-init UniFi\n");
197 /* If no unifi_helper is running, the firmware version must be read */
198 if (card->build_id == 0)
201 sym.id = CSR_SLT_BUILD_ID_NUMBER;
202 sym.obj = 0; /* To be updated by _find_in_slut() */
204 unifi_trace(card->ospriv, UDBG1, "Need f/w version\n");
206 /* Find chip build id entry in SLUT */
207 r = _find_in_slut(card, &sym, &slut_base);
208 if (r != CSR_RESULT_SUCCESS)
210 unifi_error(card->ospriv, "Failed to find CSR_SLT_BUILD_ID_NUMBER\n");
211 return CSR_RESULT_FAILURE;
214 /* Read running f/w version */
215 r = unifi_read32(card, sym.obj, &ver);
216 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
220 if (r != CSR_RESULT_SUCCESS)
222 unifi_error(card->ospriv, "Failed to read f/w id\n");
223 return CSR_RESULT_FAILURE;
225 card->build_id = ver;
228 /* Convert the ptest firmware to a patch against the running firmware */
229 pfw = xbv_to_patch(card, unifi_fw_read, dlpriv, pfwinfo, &psize);
232 unifi_error(card->ospriv, "Failed to convert f/w to patch");
233 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
238 sym.id = CSR_SLT_BOOT_LOADER_CONTROL;
239 sym.obj = 0; /* To be updated by _find_in_slut() */
241 /* Find boot loader control entry in SLUT */
242 r = _find_in_slut(card, &sym, &slut_base);
243 if (r != CSR_RESULT_SUCCESS)
245 unifi_error(card->ospriv, "Failed to find BOOT_LOADER_CONTROL\n");
247 return CSR_RESULT_FAILURE;
250 r = unifi_set_host_state(card, UNIFI_HOST_STATE_AWAKE);
251 if (r != CSR_RESULT_SUCCESS)
253 unifi_error(card->ospriv, "Failed to wake UniFi\n");
256 /* Get a dlpriv for the patch buffer so that unifi_fw_read() can
259 desc = unifi_fw_open_buffer(card->ospriv, pfw, psize);
263 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
266 /* Download the patch */
267 unifi_info(card->ospriv, "Downloading converted f/w as patch\n");
268 r = unifi_dl_patch(card, desc, sym.obj);
270 unifi_fw_close_buffer(card->ospriv, desc);
272 if (r != CSR_RESULT_SUCCESS)
274 unifi_error(card->ospriv, "Converted patch download failed\n");
279 unifi_trace(card->ospriv, UDBG1, "Converted patch downloaded\n");
282 /* This command starts the firmware */
283 r = unifi_do_loader_op(card, sym.obj + 6, UNIFI_BOOT_LOADER_RESTART);
284 if (r != CSR_RESULT_SUCCESS)
286 unifi_error(card->ospriv, "Failed to write loader restart cmd\n");
295 * ---------------------------------------------------------------------------
298 * Download the given firmware image to the UniFi.
301 * card Pointer to card struct
302 * dlpriv A context pointer from the calling function to be
303 * passed when calling unifi_fw_read().
306 * CSR_RESULT_SUCCESS on success,
307 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
308 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
309 * CSR_RESULT_FAILURE SDIO error
312 * Stops and resets the chip, does the download and runs the new
314 * ---------------------------------------------------------------------------
316 CsrResult unifi_dl_firmware(card_t *card, void *dlpriv)
321 fwinfo = kmalloc(sizeof(xbv1_t), GFP_KERNEL);
324 unifi_error(card->ospriv, "Failed to allocate memory for firmware\n");
325 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
329 * Scan the firmware file to find the TLVs we are interested in.
331 * - check we support the file format version in VERF
332 * - SLTP Symbol Lookup Table Pointer
333 * - FWDL firmware download segments
334 * - FWOV firmware overlay segment
335 * - VMEQ Register probe tests to verify matching h/w
337 r = xbv1_parse(card, unifi_fw_read, dlpriv, fwinfo);
338 if (r != CSR_RESULT_SUCCESS || fwinfo->mode != xbv_firmware)
340 unifi_error(card->ospriv, "File type is %s, expected firmware.\n",
341 fwinfo->mode == xbv_patch?"patch" : "unknown");
343 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
346 /* UF6xxx doesn't accept firmware, only patches. Therefore we convert
347 * the file to patch format with version numbers matching the current
348 * running firmware, and then download via the patch mechanism.
349 * The sole purpose of this is to support production test firmware across
350 * different ROM releases, the test firmware being provided in non-patch
353 if (card->chip_id > SDIO_CARD_ID_UNIFI_2)
355 unifi_info(card->ospriv, "Must convert f/w to patch format\n");
356 r = do_patch_convert_download(card, dlpriv, fwinfo);
360 /* Older UniFi chips allowed firmware to be directly loaded onto the
361 * chip, which is no longer supported.
363 unifi_error(card->ospriv, "Only patch downloading supported\n");
364 r = CSR_WIFI_HIP_RESULT_INVALID_VALUE;
369 } /* unifi_dl_firmware() */
373 * ---------------------------------------------------------------------------
376 * Load the given patch set into UniFi.
379 * card Pointer to card struct
380 * dlpriv The os specific handle to the firmware file.
381 * boot_ctrl The address of the boot loader control structure.
384 * CSR_RESULT_SUCCESS on success,
385 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
386 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
387 * CSR_RESULT_FAILURE SDIO error
390 * This ends up telling UniFi to restart.
391 * ---------------------------------------------------------------------------
393 CsrResult unifi_dl_patch(card_t *card, void *dlpriv, u32 boot_ctrl)
398 unifi_info(card->ospriv, "unifi_dl_patch %p %08x\n", dlpriv, boot_ctrl);
400 fwinfo = kmalloc(sizeof(xbv1_t), GFP_KERNEL);
403 unifi_error(card->ospriv, "Failed to allocate memory for patches\n");
404 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
408 * Scan the firmware file to find the TLVs we are interested in.
410 * - check we support the file format version in VERF
411 * - FWID The build ID of the ROM that we can patch
412 * - PTDL patch download segments
414 r = xbv1_parse(card, unifi_fw_read, dlpriv, fwinfo);
415 if (r != CSR_RESULT_SUCCESS || fwinfo->mode != xbv_patch)
418 unifi_error(card->ospriv, "Failed to read in patch file\n");
419 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
423 * We have to check the build id read from the SLUT against that
424 * for the patch file. They have to match exactly.
425 * "card->build_id" == XBV1.PTCH.FWID
427 if (card->build_id != fwinfo->build_id)
429 unifi_error(card->ospriv, "Wrong patch file for chip (chip = %lu, file = %lu)\n",
430 card->build_id, fwinfo->build_id);
432 #ifndef CSR_WIFI_IGNORE_PATCH_VERSION_MISMATCH
433 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
437 return CSR_RESULT_SUCCESS;
441 r = do_patch_download(card, dlpriv, fwinfo, boot_ctrl);
442 if (r != CSR_RESULT_SUCCESS)
444 unifi_error(card->ospriv, "Failed to patch image\n");
450 } /* unifi_dl_patch() */
453 void* unifi_dl_fw_read_start(card_t *card, s8 is_fw)
455 card_info_t card_info;
457 unifi_card_info(card, &card_info);
458 unifi_trace(card->ospriv, UDBG5,
459 "id=%d, ver=0x%x, fw_build=%u, fw_hip=0x%x, block_size=%d\n",
460 card_info.chip_id, card_info.chip_version,
461 card_info.fw_build, card_info.fw_hip_version,
462 card_info.sdio_block_size);
464 return unifi_fw_read_start(card->ospriv, is_fw, &card_info);
469 * ---------------------------------------------------------------------------
470 * safe_read_shared_location
472 * Read a shared memory location repeatedly until we get two readings
476 * card Pointer to card context struct.
477 * unifi_addr UniFi shared-data-memory address to access.
478 * pdata Pointer to a byte variable for the value read.
482 * CSR_RESULT_SUCCESS on success, CSR error code on failure
483 * ---------------------------------------------------------------------------
485 static CsrResult safe_read_shared_location(card_t *card, u32 address, u8 *pdata)
493 r = unifi_read_8_or_16(card, address, &b);
494 if (r != CSR_RESULT_SUCCESS)
501 r = unifi_read_8_or_16(card, address, &b2);
502 if (r != CSR_RESULT_SUCCESS)
507 /* When we have a stable value, return it */
511 return CSR_RESULT_SUCCESS;
517 return CSR_RESULT_FAILURE;
518 } /* safe_read_shared_location() */
522 * ---------------------------------------------------------------------------
525 * Send a loader / boot_loader command to the UniFi and wait for
529 * card Pointer to card context struct.
530 * op_addr The address of the loader operation control word.
531 * opcode The operation to perform.
534 * CSR_RESULT_SUCCESS on success
535 * CSR_RESULT_FAILURE SDIO error or SDIO/XAP timeout
536 * ---------------------------------------------------------------------------
540 * Ideally instead of sleeping, we want to busy wait.
541 * Currently there is no framework API to do this. When it becomes available,
542 * we can use it to busy wait using usecs
544 #define OPERATION_TIMEOUT_LOOPS (100) /* when OPERATION_TIMEOUT_DELAY==1, (500) otherwise */
545 #define OPERATION_TIMEOUT_DELAY 1 /* msec, or 200usecs */
547 CsrResult unifi_do_loader_op(card_t *card, u32 op_addr, u8 opcode)
552 unifi_trace(card->ospriv, UDBG4, "Loader cmd 0x%0x -> 0x%08x\n", opcode, op_addr);
554 /* Set the Operation command byte to the opcode */
555 r = unifi_write_8_or_16(card, op_addr, opcode);
556 if (r != CSR_RESULT_SUCCESS)
558 unifi_error(card->ospriv, "Failed to write loader copy command\n");
562 /* Wait for Operation command byte to be Idle */
563 /* Typically takes ~100us */
565 r = CSR_RESULT_SUCCESS;
571 * Read the memory location until two successive reads give
575 r = safe_read_shared_location(card, op_addr, &op);
576 if (r != CSR_RESULT_SUCCESS)
578 unifi_error(card->ospriv, "Failed to read loader status\n");
582 if (op == UNIFI_LOADER_IDLE)
590 unifi_error(card->ospriv, "Error reported by loader: 0x%X\n", op);
591 r = CSR_RESULT_FAILURE;
595 /* Allow 500us timeout */
596 if (++op_retries >= OPERATION_TIMEOUT_LOOPS)
598 unifi_error(card->ospriv, "Timeout waiting for loader to ack transfer\n");
599 /* Stop XAPs to aid post-mortem */
600 r = unifi_card_stop_processor(card, UNIFI_PROC_BOTH);
601 if (r != CSR_RESULT_SUCCESS)
603 unifi_error(card->ospriv, "Failed to stop UniFi processors\n");
607 r = CSR_RESULT_FAILURE;
611 CsrThreadSleep(OPERATION_TIMEOUT_DELAY);
612 } /* Loop exits with r != CSR_RESULT_SUCCESS on error */
615 } /* unifi_do_loader_op() */
619 * ---------------------------------------------------------------------------
622 * Copy a patch block from userland to the UniFi.
623 * This function reads data, 2K at a time, from userland and writes
627 * card A pointer to the card structure
628 * dlpriv The os specific handle for the firmware file
629 * ptdl A pointer ot the PTDL block
630 * handle The buffer handle to use for the xfer
631 * op_addr The address of the loader operation control word
634 * Number of bytes sent (Positive) or negative value indicating
636 * CSR_WIFI_HIP_RESULT_NO_MEMORY memory allocation failed
637 * CSR_WIFI_HIP_RESULT_INVALID_VALUE error in XBV file
638 * CSR_RESULT_FAILURE SDIO error
639 * ---------------------------------------------------------------------------
641 static CsrResult send_ptdl_to_unifi(card_t *card, void *dlpriv,
642 const struct PTDL *ptdl, u32 handle,
650 const u16 buf_size = 2 * 1024;
652 offset = ptdl->dl_offset;
653 data_len = ptdl->dl_size;
655 if (data_len > buf_size)
657 unifi_error(card->ospriv, "PTDL block is too large (%u)\n",
659 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
662 buf = kmalloc(buf_size, GFP_KERNEL);
665 unifi_error(card->ospriv, "Failed to allocate transfer buffer for firmware download\n");
666 return CSR_WIFI_HIP_RESULT_NO_MEMORY;
669 r = CSR_RESULT_SUCCESS;
671 if (unifi_fw_read(card->ospriv, dlpriv, offset, buf, data_len) != data_len)
673 unifi_error(card->ospriv, "Failed to read from file\n");
677 /* We can always round these if the host wants to */
678 if (card->sdio_io_block_pad)
680 write_len = (data_len + (card->sdio_io_block_size - 1)) &
681 ~(card->sdio_io_block_size - 1);
683 /* Zero out the rest of the buffer (This isn't needed, but it
684 * makes debugging things later much easier). */
685 memset(buf + data_len, 0, write_len - data_len);
689 write_len = data_len;
692 r = unifi_bulk_rw_noretry(card, handle, buf, write_len, UNIFI_SDIO_WRITE);
693 if (r != CSR_RESULT_SUCCESS)
695 unifi_error(card->ospriv, "CMD53 failed writing %d bytes to handle %ld\n",
701 * Can change the order of things to overlap read from file
704 r = unifi_do_loader_op(card, op_addr, UNIFI_BOOT_LOADER_PATCH);
710 if (r != CSR_RESULT_SUCCESS && r != CSR_WIFI_HIP_RESULT_NO_DEVICE)
712 unifi_error(card->ospriv, "Failed to copy block of %u bytes to UniFi\n",
717 } /* send_ptdl_to_unifi() */
721 * ---------------------------------------------------------------------------
724 * This function downloads a set of patches to UniFi and then
725 * causes it to restart.
728 * card Pointer to card struct.
729 * dlpriv A context pointer from the calling function to be
730 * used when reading the XBV file. This can be NULL
731 * in which case not patches are applied.
732 * pfwinfo Pointer to a fwinfo struct describing the f/w
734 * boot_ctrl_addr The address of the boot loader control structure.
737 * 0 on success, or an error code
738 * CSR_WIFI_HIP_RESULT_INVALID_VALUE for a bad laoader version number
739 * ---------------------------------------------------------------------------
741 static CsrResult do_patch_download(card_t *card, void *dlpriv, xbv1_t *pfwinfo, u32 boot_ctrl_addr)
750 * Read info from the SDIO Loader Control Data Structure
752 /* Check the loader version */
753 r = unifi_card_read16(card, boot_ctrl_addr, &loader_version);
754 if (r != CSR_RESULT_SUCCESS)
756 unifi_error(card->ospriv, "Patch download: Failed to read loader version\n");
759 unifi_trace(card->ospriv, UDBG2, "Patch download: boot loader version 0x%04X\n", loader_version);
760 switch (loader_version)
766 unifi_error(card->ospriv, "Patch loader version (0x%04X) is not supported by this driver\n",
768 return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
771 /* Retrieve the handle to use with CMD53 */
772 r = unifi_card_read16(card, boot_ctrl_addr + 4, &handle);
773 if (r != CSR_RESULT_SUCCESS)
775 unifi_error(card->ospriv, "Patch download: Failed to read loader handle\n");
779 /* Set the mask of LEDs to flash */
780 if (card->loader_led_mask)
782 r = unifi_card_write16(card, boot_ctrl_addr + 2,
783 (u16)card->loader_led_mask);
784 if (r != CSR_RESULT_SUCCESS)
786 unifi_error(card->ospriv, "Patch download: Failed to write LED mask\n");
793 /* Copy download data to UniFi memory */
794 for (i = 0; i < pfwinfo->num_ptdl; i++)
796 unifi_trace(card->ospriv, UDBG3, "Patch download: %d Downloading for %d from offset %d\n",
798 pfwinfo->ptdl[i].dl_size,
799 pfwinfo->ptdl[i].dl_offset);
801 r = send_ptdl_to_unifi(card, dlpriv, &pfwinfo->ptdl[i],
802 handle, boot_ctrl_addr + 6);
803 if (r == CSR_WIFI_HIP_RESULT_NO_DEVICE)
807 if (r != CSR_RESULT_SUCCESS)
809 unifi_error(card->ospriv, "Patch failed after %u bytes\n",
813 total_bytes += pfwinfo->ptdl[i].dl_size;
816 return CSR_RESULT_SUCCESS;
817 } /* do_patch_download() */