1 /* 2 * Copyright (c) 2012, 2018 The Linux Foundation. All rights reserved. 3 * 4 * Previously licensed under the ISC license by Qualcomm Atheros, Inc. 5 * 6 * 7 * Permission to use, copy, modify, and/or distribute this software for 8 * any purpose with or without fee is hereby granted, provided that the 9 * above copyright notice and this permission notice appear in all 10 * copies. 11 * 12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL 13 * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED 14 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE 15 * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL 16 * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR 17 * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 18 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 19 * PERFORMANCE OF THIS SOFTWARE. 20 */ 21 22 /* 23 * This file was originally distributed by Qualcomm Atheros, Inc. 24 * under proprietary terms before Copyright ownership was assigned 25 * to the Linux Foundation. 26 */ 27 28 #ifndef __BMI_MSG_H__ 29 #define __BMI_MSG_H__ 30 31 #ifndef ATH_TARGET 32 #include "athstartpack.h" 33 #endif 34 35 /* 36 * Bootloader Messaging Interface (BMI) 37 * 38 * BMI is a very simple messaging interface used during initialization 39 * to read memory, write memory, execute code, and to define an 40 * application entry PC. 41 * 42 * It is used to download an application to AR6K, to provide 43 * patches to code that is already resident on AR6K, and generally 44 * to examine and modify state. The Host has an opportunity to use 45 * BMI only once during bootup. Once the Host issues a BMI_DONE 46 * command, this opportunity ends. 47 * 48 * The Host writes BMI requests to mailbox0, and reads BMI responses 49 * from mailbox0. BMI requests all begin with a command 50 * (see below for specific commands), and are followed by 51 * command-specific data. 52 * 53 * Flow control: 54 * The Host can only issue a command once the Target gives it a 55 * "BMI Command Credit", using AR6K Counter #4. As soon as the 56 * Target has completed a command, it issues another BMI Command 57 * Credit (so the Host can issue the next command). 58 * 59 * BMI handles all required Target-side cache flushing. 60 */ 61 62 63 /* Maximum data size used for BMI transfers */ 64 #define BMI_DATASZ_MAX 256 65 66 /* BMI Commands */ 67 68 #define BMI_NO_COMMAND 0 69 70 #define BMI_DONE 1 71 /* 72 * Semantics: Host is done using BMI 73 * Request format: 74 * A_UINT32 command (BMI_DONE) 75 * Response format: none 76 */ 77 78 #define BMI_READ_MEMORY 2 79 /* 80 * Semantics: Host reads AR6K memory 81 * Request format: 82 * A_UINT32 command (BMI_READ_MEMORY) 83 * A_UINT32 address 84 * A_UINT32 length, at most BMI_DATASZ_MAX 85 * Response format: 86 * A_UINT8 data[length] 87 */ 88 89 #define BMI_WRITE_MEMORY 3 90 /* 91 * Semantics: Host writes AR6K memory 92 * Request format: 93 * A_UINT32 command (BMI_WRITE_MEMORY) 94 * A_UINT32 address 95 * A_UINT32 length, at most BMI_DATASZ_MAX 96 * A_UINT8 data[length] 97 * Response format: none 98 */ 99 /* 100 * Capbility to write "segmented files" is provided for two reasons 101 * 1) backwards compatibility for certain situations where Hosts 102 * have limited flexibility 103 * 2) because it's darn convenient. 104 * 105 * A segmented file consists of a file header followed by an arbitrary number 106 * of segments. Each segment contains segment metadata -- a Target address and 107 * a length -- followed by "length" bytes of data. A segmented file ends with 108 * a segment that specifies length=BMI_SGMTFILE_DONE. When a segmented file 109 * is sent to the Target, firmware writes each segment to the specified address. 110 * 111 * Special cases: 112 * 1) If a segment's metadata indicates length=BMI_SGMTFILE_EXEC, then the 113 * specified address is used as a function entry point for a brief function 114 * with prototype "(void *)(void)". That function is called immediately. 115 * After execution of the function completes, firmware continues with the 116 * next segment. No data is expected when length=BMI_SGMTFILE_EXEC. 117 * 118 * 2) If a segment's metadata indicates length=BMI_SGMTFILE_BEGINADDR, then 119 * the specified address is established as the application start address 120 * so that a subsequent BMI_DONE jumps there. 121 * 122 * 3) If a segment's metadata indicates length=BMI_SGMTFILE_BDDATA, then 123 * the specified address is used as the (possibly compressed) length of board 124 * data, which is loaded into the proper Target address as specified by 125 * hi_board_data. In addition, the hi_board_data_initialized flag is set. 126 * 127 * A segmented file is sent to the Target using a sequence of 1 or more 128 * BMI_WRITE_MEMORY commands. The first such command must have 129 * address=BMI_SEGMENTED_WRITE_ADDR. Subsequent BMI_WRITE_MEMORY commands 130 * can use an arbitrary address. In each BMI_WRITE_MEMORY command, the 131 * length specifies the number of data bytes transmitted (except for the 132 * special cases listed above). 133 * 134 * Alternatively, a segmented file may be sent to the Target using a 135 * BMI_LZ_STREAM_START command with address=BMI_SEGMENTED_WRITE_ADDR 136 * followed by a series of BMI_LZ_DATA commands that each send the next portion 137 * of the segmented file. 138 * 139 * The data segments may be lz77 compressed. In this case, the segmented file 140 * header flag, BMI_SGMTFILE_FLAG_COMPRESS, must be set. Note that segmented 141 * file METAdata is never compressed; only the data segments themselves are 142 * compressed. There is no way to mix compressed and uncompressed data segments 143 * in a single segmented file. Compressed (or uncompressed) segments are handled 144 * by both BMI_WRITE_MEMORY and by BMI_LZ_DATA commands. (Compression is an 145 * attribute of the segmented file rather than of the command used to transmit 146 * it.) 147 */ 148 #define BMI_SEGMENTED_WRITE_ADDR 0x1234 149 150 /* File header for a segmented file */ 151 struct bmi_segmented_file_header { 152 A_UINT32 magic_num; 153 A_UINT32 file_flags; 154 }; 155 #define BMI_SGMTFILE_MAGIC_NUM 0x544d4753 /* "SGMT" */ 156 #define BMI_SGMTFILE_FLAG_COMPRESS 1 157 158 /* Metadata for a segmented file segment */ 159 struct bmi_segmented_metadata { 160 A_UINT32 addr; 161 A_UINT32 length; 162 }; 163 /* Special values for bmi_segmented_metadata.length (all have high bit set) */ 164 #define BMI_SGMTFILE_DONE 0xffffffff /* end of segmented data */ 165 #define BMI_SGMTFILE_BDDATA 0xfffffffe /* Board Data segment */ 166 #define BMI_SGMTFILE_BEGINADDR 0xfffffffd /* set beginning address */ 167 #define BMI_SGMTFILE_EXEC 0xfffffffc /* immediate function execution */ 168 169 #define BMI_EXECUTE 4 170 /* 171 * Semantics: Causes AR6K to execute code 172 * Request format: 173 * A_UINT32 command (BMI_EXECUTE) 174 * A_UINT32 address 175 * A_UINT32 parameter 176 * Response format: 177 * A_UINT32 return value 178 */ 179 /* 180 * Note: In order to support the segmented file feature 181 * (see BMI_WRITE_MEMORY), when the address specified in a 182 * BMI_EXECUTE command matches (same physical address) 183 * BMI_SEGMENTED_WRITE_ADDR, it is ignored. Instead, execution 184 * begins at the address specified by hi_app_start. 185 */ 186 187 #define BMI_SET_APP_START 5 188 /* 189 * Semantics: Set Target application starting address 190 * Request format: 191 * A_UINT32 command (BMI_SET_APP_START) 192 * A_UINT32 address 193 * Response format: none 194 */ 195 196 #define BMI_READ_SOC_REGISTER 6 197 #define BMI_READ_SOC_WORD 6 198 /* 199 * Semantics: Read a 32-bit Target SOC word. 200 * Request format: 201 * A_UINT32 command (BMI_READ_REGISTER) 202 * A_UINT32 address 203 * Response format: 204 * A_UINT32 value 205 */ 206 207 #define BMI_WRITE_SOC_REGISTER 7 208 #define BMI_WRITE_SOC_WORD 7 209 /* 210 * Semantics: Write a 32-bit Target SOC word. 211 * Request format: 212 * A_UINT32 command (BMI_WRITE_REGISTER) 213 * A_UINT32 address 214 * A_UINT32 value 215 * 216 * Response format: none 217 */ 218 219 #define BMI_GET_TARGET_ID 8 220 #define BMI_GET_TARGET_INFO 8 221 /* 222 * Semantics: Fetch the 4-byte Target information 223 * Request format: 224 * A_UINT32 command (BMI_GET_TARGET_ID/INFO) 225 * 226 * Response format1 (old firmware): 227 * A_UINT32 TargetVersionID 228 * 229 * Response format2 (intermediate firmware, during transition): 230 * A_UINT32 TARGET_VERSION_SENTINAL 231 * struct bmi_target_info; 232 * 233 * Response format3 (newest firmware) 234 * struct bmi_target_info; 235 */ 236 237 PREPACK struct bmi_target_info { 238 A_UINT32 target_info_byte_count; /* size of this structure */ 239 A_UINT32 target_ver; /* Target Version ID */ 240 A_UINT32 target_type; /* Target type */ 241 } POSTPACK; 242 #define TARGET_VERSION_SENTINAL 0xffffffff 243 #define TARGET_TYPE_UNKNOWN 0 244 #define TARGET_TYPE_AR6001 1 245 #define TARGET_TYPE_AR6002 2 246 #define TARGET_TYPE_AR6003 3 247 #define TARGET_TYPE_AR6004 5 248 #define TARGET_TYPE_AR6006 6 249 #define TARGET_TYPE_AR9888 7 250 #define TARGET_TYPE_AR6320 8 251 #define TARGET_TYPE_AR900B 9 252 /* For attach Peregrine 2.0 board target_reg_tbl only */ 253 #define TARGET_TYPE_AR9888V2 10 254 /* For attach Rome1.0 target_reg_tbl only*/ 255 #define TARGET_TYPE_AR6320V1 11 256 /* For Rome2.0/2.1 target_reg_tbl ID*/ 257 #define TARGET_TYPE_AR6320V2 12 258 /* For Rome3.0 target_reg_tbl ID*/ 259 #define TARGET_TYPE_AR6320V3 13 260 /* For Tufello1.0 target_reg_tbl ID*/ 261 #define TARGET_TYPE_QCA9377V1 14 262 #define TARGET_TYPE_QCA9984 15 /* cascade */ 263 #define TARGET_TYPE_IPQ4019 16 /* dakota */ 264 #define TARGET_TYPE_QCA9888 17 /* besra */ 265 266 #define BMI_ROMPATCH_INSTALL 9 267 /* 268 * Semantics: Install a ROM Patch. 269 * Request format: 270 * A_UINT32 command (BMI_ROMPATCH_INSTALL) 271 * A_UINT32 Target ROM Address 272 * A_UINT32 Target RAM Address or Value (depending on Target Type) 273 * A_UINT32 Size, in bytes 274 * A_UINT32 Activate? 1-->activate; 275 * 0-->install but do not activate 276 * Response format: 277 * A_UINT32 PatchID 278 */ 279 280 #define BMI_ROMPATCH_UNINSTALL 10 281 /* 282 * Semantics: Uninstall a previously-installed ROM Patch, 283 * automatically deactivating, if necessary. 284 * Request format: 285 * A_UINT32 command (BMI_ROMPATCH_UNINSTALL) 286 * A_UINT32 PatchID 287 * 288 * Response format: none 289 */ 290 291 #define BMI_ROMPATCH_ACTIVATE 11 292 /* 293 * Semantics: Activate a list of previously-installed ROM Patches. 294 * Request format: 295 * A_UINT32 command (BMI_ROMPATCH_ACTIVATE) 296 * A_UINT32 rompatch_count 297 * A_UINT32 PatchID[rompatch_count] 298 * 299 * Response format: none 300 */ 301 302 #define BMI_ROMPATCH_DEACTIVATE 12 303 /* 304 * Semantics: Deactivate a list of active ROM Patches. 305 * Request format: 306 * A_UINT32 command (BMI_ROMPATCH_DEACTIVATE) 307 * A_UINT32 rompatch_count 308 * A_UINT32 PatchID[rompatch_count] 309 * 310 * Response format: none 311 */ 312 313 314 #define BMI_LZ_STREAM_START 13 315 /* 316 * Semantics: Begin an LZ-compressed stream of input 317 * which is to be uncompressed by the Target to an 318 * output buffer at address. The output buffer must 319 * be sufficiently large to hold the uncompressed 320 * output from the compressed input stream. This BMI 321 * command should be followed by a series of 1 or more 322 * BMI_LZ_DATA commands. 323 * A_UINT32 command (BMI_LZ_STREAM_START) 324 * A_UINT32 address 325 * Note: Not supported on all versions of ROM firmware. 326 */ 327 328 #define BMI_LZ_DATA 14 329 /* 330 * Semantics: Host writes AR6K memory with LZ-compressed 331 * data which is uncompressed by the Target. This command 332 * must be preceded by a BMI_LZ_STREAM_START command. A series 333 * of BMI_LZ_DATA commands are considered part of a single 334 * input stream until another BMI_LZ_STREAM_START is issued. 335 * Request format: 336 * A_UINT32 command (BMI_LZ_DATA) 337 * A_UINT32 length (of compressed data), 338 * at most BMI_DATASZ_MAX 339 * A_UINT8 CompressedData[length] 340 * Response format: none 341 * Note: Not supported on all versions of ROM firmware. 342 */ 343 344 #define BMI_NVRAM_PROCESS 15 345 #define BMI_NVRAM_SEG_NAME_SZ 16 346 /* 347 * Semantics: Cause Target to search NVRAM (if any) for a 348 * segment with the specified name and process it according 349 * to NVRAM metadata. 350 * Request format: 351 * A_UINT32 command (BMI_NVRAM_PROCESS) 352 * A_UCHAR name[BMI_NVRAM_SEG_NAME_SZ] name (LE format) 353 * Response format: 354 * A_UINT32 0, if nothing was executed; 355 * otherwise the value returned from the 356 * last NVRAM segment that was executed 357 */ 358 359 #define BMI_SIGN_STREAM_START 17 360 /* 361 * Semantics: Trigger target start/end binary signature verification 362 * flow. 363 * Request format: 364 * A_UINT32 command (BMI_SIGN_STREAM_START) 365 * A_UINT32 address 366 * A_UINT32 length, at most BMI_DATASZ_MAX 367 * A_UINT8 data[length] 368 * Response format: none 369 */ 370 371 372 #ifndef ATH_TARGET 373 #include "athendpack.h" 374 #endif 375 376 /* TBDXXX: Need a better place for these */ 377 #define BMI_CE_NUM_TO_TARG 0 378 #define BMI_CE_NUM_TO_HOST 1 379 380 #endif /* __BMI_MSG_H__ */ 381