1 /* 2 * 3 * Copyright (c) 2013, The Linux Foundation. All rights reserved. 4 * Not a Contribution. 5 * 6 * Copyright 2012 The Android Open Source Project 7 * 8 * Licensed under the Apache License, Version 2.0 (the "License"); you 9 * may not use this file except in compliance with the License. You may 10 * obtain a copy of the License at 11 * 12 * http://www.apache.org/licenses/LICENSE-2.0 13 * 14 * Unless required by applicable law or agreed to in writing, software 15 * distributed under the License is distributed on an "AS IS" BASIS, 16 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 17 * implied. See the License for the specific language governing 18 * permissions and limitations under the License. 19 * 20 */ 21 22 /****************************************************************************** 23 * 24 * Filename: hw_rome.c 25 * 26 * Description: Contains controller-specific functions, like 27 * firmware patch download 28 * low power mode operations 29 * 30 ******************************************************************************/ 31 #ifdef __cplusplus 32 extern "C" { 33 #endif 34 35 #define LOG_TAG "bt_vendor" 36 37 #include <sys/socket.h> 38 #include <utils/Log.h> 39 #include <sys/types.h> 40 #include <sys/stat.h> 41 #include <signal.h> 42 #include <time.h> 43 #include <errno.h> 44 #include <fcntl.h> 45 #include <dirent.h> 46 #include <ctype.h> 47 #include <cutils/properties.h> 48 #include <stdlib.h> 49 #include <string.h> 50 #include <termios.h> 51 #include <string.h> 52 #include <stdbool.h> 53 54 #include "bt_hci_bdroid.h" 55 #include "bt_vendor_qcom.h" 56 #include "hci_uart.h" 57 #include "hw_rome.h" 58 59 #define BT_VERSION_FILEPATH "/data/misc/bluedroid/bt_fw_version.txt" 60 #define BOARD_ID_LEN 0x5 61 #define MSB_NIBBLE_MASK 0xF0 62 #define LSB_NIBBLE_MASK 0x0F 63 64 #ifdef __cplusplus 65 } 66 #endif 67 68 #define RESERVED(p) if(p) ALOGI( "%s: reserved param", __FUNCTION__); 69 70 int read_vs_hci_event(int fd, unsigned char* buf, int size); 71 int get_boardid_req(int fd); 72 unsigned char convert2ascii(unsigned char temp); 73 74 75 /****************************************************************************** 76 ** Variables 77 ******************************************************************************/ 78 FILE *file; 79 unsigned char *phdr_buffer; 80 unsigned char *pdata_buffer = NULL; 81 patch_info rampatch_patch_info; 82 int rome_ver = ROME_VER_UNKNOWN; 83 unsigned char gTlv_type; 84 unsigned char gTlv_dwndCfg; 85 static unsigned int wipower_flag = 0; 86 static unsigned int wipower_handoff_ready = 0; 87 char *rampatch_file_path; 88 char *nvm_file_path; 89 char *fw_su_info = NULL; 90 unsigned short fw_su_offset =0; 91 extern char enable_extldo; 92 unsigned char wait_vsc_evt = TRUE; 93 bool patch_dnld_pending = FALSE; 94 int dnld_fd = -1; 95 unsigned char board_id[BOARD_ID_LEN]; 96 97 /****************************************************************************** 98 ** Extern variables 99 ******************************************************************************/ 100 extern uint8_t vnd_local_bd_addr[6]; 101 102 /***************************************************************************** 103 ** Functions 104 *****************************************************************************/ 105 int do_write(int fd, unsigned char *buf,int len) 106 { 107 int ret = 0; 108 int write_offset = 0; 109 int write_len = len; 110 do { 111 ret = write(fd,buf+write_offset,write_len); 112 if (ret < 0) 113 { 114 ALOGE("%s, write failed ret = %d err = %s",__func__,ret,strerror(errno)); 115 return -1; 116 } else if (ret == 0) { 117 ALOGE("%s, write failed with ret 0 err = %s",__func__,strerror(errno)); 118 return 0; 119 } else { 120 if (ret < write_len) { 121 ALOGD("%s, Write pending,do write ret = %d err = %s",__func__,ret, 122 strerror(errno)); 123 write_len = write_len - ret; 124 write_offset = ret; 125 } else { 126 ALOGV("Write successful"); 127 break; 128 } 129 } 130 } while(1); 131 return len; 132 } 133 134 int get_vs_hci_event(unsigned char *rsp) 135 { 136 int err = 0; 137 unsigned char paramlen = 0; 138 unsigned char EMBEDDED_MODE_CHECK = 0x02; 139 FILE *btversionfile = 0; 140 unsigned int soc_id = 0; 141 unsigned int productid = 0; 142 unsigned short patchversion = 0; 143 char build_label[255]; 144 int build_lbl_len; 145 146 if( (rsp[EVENTCODE_OFFSET] == VSEVENT_CODE) || (rsp[EVENTCODE_OFFSET] == EVT_CMD_COMPLETE)) 147 ALOGI("%s: Received HCI-Vendor Specific event", __FUNCTION__); 148 else { 149 ALOGI("%s: Failed to receive HCI-Vendor Specific event", __FUNCTION__); 150 err = -EIO; 151 goto failed; 152 } 153 154 ALOGI("%s: length 0x%x resp 0x%x type 0x%x", __FUNCTION__, paramlen = rsp[EVT_PLEN], 155 rsp[CMD_RSP_OFFSET], rsp[RSP_TYPE_OFFSET]); 156 157 /* Check the status of the operation */ 158 switch ( rsp[CMD_RSP_OFFSET] ) 159 { 160 case EDL_CMD_REQ_RES_EVT: 161 ALOGV("%s: Command Request Response", __FUNCTION__); 162 switch(rsp[RSP_TYPE_OFFSET]) 163 { 164 case EDL_PATCH_VER_RES_EVT: 165 case EDL_APP_VER_RES_EVT: 166 ALOGI("\t Current Product ID\t\t: 0x%08x", 167 productid = (unsigned int)(rsp[PATCH_PROD_ID_OFFSET +3] << 24 | 168 rsp[PATCH_PROD_ID_OFFSET+2] << 16 | 169 rsp[PATCH_PROD_ID_OFFSET+1] << 8 | 170 rsp[PATCH_PROD_ID_OFFSET] )); 171 172 /* Patch Version indicates FW patch version */ 173 ALOGI("\t Current Patch Version\t\t: 0x%04x", 174 (patchversion = (unsigned short)(rsp[PATCH_PATCH_VER_OFFSET + 1] << 8 | 175 rsp[PATCH_PATCH_VER_OFFSET] ))); 176 177 /* ROM Build Version indicates ROM build version like 1.0/1.1/2.0 */ 178 ALOGI("\t Current ROM Build Version\t: 0x%04x", rome_ver = 179 (int)(rsp[PATCH_ROM_BUILD_VER_OFFSET + 1] << 8 | 180 rsp[PATCH_ROM_BUILD_VER_OFFSET] )); 181 182 /* In case rome 1.0/1.1, there is no SOC ID version available */ 183 if (paramlen - 10) 184 { 185 ALOGI("\t Current SOC Version\t\t: 0x%08x", soc_id = 186 (unsigned int)(rsp[PATCH_SOC_VER_OFFSET +3] << 24 | 187 rsp[PATCH_SOC_VER_OFFSET+2] << 16 | 188 rsp[PATCH_SOC_VER_OFFSET+1] << 8 | 189 rsp[PATCH_SOC_VER_OFFSET] )); 190 } 191 192 if (NULL != (btversionfile = fopen(BT_VERSION_FILEPATH, "wb"))) { 193 fprintf(btversionfile, "Bluetooth Controller Product ID : 0x%08x\n", productid); 194 fprintf(btversionfile, "Bluetooth Controller Patch Version : 0x%04x\n", patchversion); 195 fprintf(btversionfile, "Bluetooth Controller Build Version : 0x%04x\n", rome_ver); 196 fprintf(btversionfile, "Bluetooth Controller SOC Version : 0x%08x\n", soc_id); 197 fclose(btversionfile); 198 }else { 199 ALOGI("Failed to dump SOC version info. Errno:%d", errno); 200 } 201 202 /* Rome Chipset Version can be decided by Patch version and SOC version, 203 Upper 2 bytes will be used for Patch version and Lower 2 bytes will be 204 used for SOC as combination for BT host driver */ 205 rome_ver = (rome_ver << 16) | (soc_id & 0x0000ffff); 206 break; 207 case EDL_TVL_DNLD_RES_EVT: 208 case EDL_CMD_EXE_STATUS_EVT: 209 switch (err = rsp[CMD_STATUS_OFFSET]) 210 { 211 case HCI_CMD_SUCCESS: 212 ALOGI("%s: Download Packet successfully!", __FUNCTION__); 213 break; 214 case PATCH_LEN_ERROR: 215 ALOGI("%s: Invalid patch length argument passed for EDL PATCH " 216 "SET REQ cmd", __FUNCTION__); 217 break; 218 case PATCH_VER_ERROR: 219 ALOGI("%s: Invalid patch version argument passed for EDL PATCH " 220 "SET REQ cmd", __FUNCTION__); 221 break; 222 case PATCH_CRC_ERROR: 223 ALOGI("%s: CRC check of patch failed!!!", __FUNCTION__); 224 break; 225 case PATCH_NOT_FOUND: 226 ALOGI("%s: Invalid patch data!!!", __FUNCTION__); 227 break; 228 case TLV_TYPE_ERROR: 229 ALOGI("%s: TLV Type Error !!!", __FUNCTION__); 230 break; 231 default: 232 ALOGI("%s: Undefined error (0x%x)", __FUNCTION__, err); 233 break; 234 } 235 break; 236 case HCI_VS_GET_BUILD_VER_EVT: 237 build_lbl_len = rsp[5]; 238 memcpy (build_label, &rsp[6], build_lbl_len); 239 *(build_label+build_lbl_len) = '\0'; 240 241 ALOGI("BT SoC FW SU Build info: %s, %d", build_label, build_lbl_len); 242 if (NULL != (btversionfile = fopen(BT_VERSION_FILEPATH, "a+b"))) { 243 fprintf(btversionfile, "Bluetooth Contoller SU Build info : %s\n", build_label); 244 fclose(btversionfile); 245 } else { 246 ALOGI("Failed to dump FW SU build info. Errno:%d", errno); 247 } 248 break; 249 case EDL_BOARD_ID_RESPONSE: 250 ALOGI("%s: board id %x %x!!", __FUNCTION__, rsp[6], rsp[7]); 251 if (rsp[6] <= 0x00) { 252 board_id[0] = convert2ascii ((rsp[7] & MSB_NIBBLE_MASK) >> 4); 253 board_id[1] = convert2ascii (rsp[7] & LSB_NIBBLE_MASK); 254 board_id[2] = '\0'; 255 } else { 256 board_id[0] = convert2ascii ((rsp[6] & MSB_NIBBLE_MASK) >> 4); 257 board_id[1] = convert2ascii (rsp[6] & LSB_NIBBLE_MASK); 258 board_id[2] = convert2ascii ((rsp[7] & MSB_NIBBLE_MASK) >> 4); 259 board_id[3] = convert2ascii (rsp[7] & LSB_NIBBLE_MASK); 260 board_id[4] = '\0'; 261 } 262 break; 263 } 264 break; 265 266 case NVM_ACCESS_CODE: 267 ALOGI("%s: NVM Access Code!!!", __FUNCTION__); 268 err = HCI_CMD_SUCCESS; 269 break; 270 case EDL_SET_BAUDRATE_RSP_EVT: 271 /* Rome 1.1 has bug with the response, so it should ignore it. */ 272 if (rsp[BAUDRATE_RSP_STATUS_OFFSET] != BAUDRATE_CHANGE_SUCCESS) 273 { 274 ALOGE("%s: Set Baudrate request failed - 0x%x", __FUNCTION__, 275 rsp[CMD_STATUS_OFFSET]); 276 err = -1; 277 } 278 break; 279 case EDL_WIP_QUERY_CHARGING_STATUS_EVT: 280 /* Query charging command has below return values 281 0 - in embedded mode not charging 282 1 - in embedded mode and charging 283 2 - hadofff completed and in normal mode 284 3 - no wipower supported on mtp. so irrepective of charging 285 handoff command has to be sent if return values are 0 or 1. 286 These change include logic to enable generic BT turn on sequence.*/ 287 if (rsp[4] < EMBEDDED_MODE_CHECK) 288 { 289 ALOGI("%s: WiPower Charging in Embedded Mode!!!", __FUNCTION__); 290 wipower_handoff_ready = rsp[4]; 291 wipower_flag = 1; 292 } 293 break; 294 case EDL_WIP_START_HANDOFF_TO_HOST_EVENT: 295 /*TODO: rsp code 00 mean no charging 296 this is going to change in FW soon*/ 297 if (rsp[4] == NON_WIPOWER_MODE) 298 { 299 ALOGE("%s: WiPower Charging hand off not ready!!!", __FUNCTION__); 300 } 301 break; 302 case HCI_VS_GET_ADDON_FEATURES_EVENT: 303 if ((rsp[4] & ADDON_FEATURES_EVT_WIPOWER_MASK)) 304 { 305 ALOGD("%s: WiPower feature supported!!", __FUNCTION__); 306 property_set("persist.bluetooth.a4wp", "true"); 307 } 308 break; 309 case HCI_VS_STRAY_EVT: 310 /* WAR to handle stray Power Apply EVT during patch download */ 311 ALOGD("%s: Stray HCI VS EVENT", __FUNCTION__); 312 if (patch_dnld_pending && dnld_fd != -1) 313 { 314 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 315 memset(rsp, 0x00, HCI_MAX_EVENT_SIZE); 316 read_vs_hci_event(dnld_fd, rsp, HCI_MAX_EVENT_SIZE); 317 } 318 else 319 { 320 ALOGE("%s: Not a valid status!!!", __FUNCTION__); 321 err = -1; 322 } 323 break; 324 default: 325 ALOGE("%s: Not a valid status!!!", __FUNCTION__); 326 err = -1; 327 break; 328 } 329 330 failed: 331 return err; 332 } 333 334 335 /* 336 * Read an VS HCI event from the given file descriptor. 337 */ 338 int read_vs_hci_event(int fd, unsigned char* buf, int size) 339 { 340 int remain, r; 341 int count = 0, i; 342 343 if (size <= 0) { 344 ALOGE("Invalid size arguement!"); 345 return -1; 346 } 347 348 ALOGI("%s: Wait for HCI-Vendor Specfic Event from SOC", __FUNCTION__); 349 350 /* The first byte identifies the packet type. For HCI event packets, it 351 * should be 0x04, so we read until we get to the 0x04. */ 352 /* It will keep reading until find 0x04 byte */ 353 while (1) { 354 r = read(fd, buf, 1); 355 if (r <= 0) 356 return -1; 357 if (buf[0] == 0x04) 358 break; 359 } 360 count++; 361 362 /* The next two bytes are the event code and parameter total length. */ 363 while (count < 3) { 364 r = read(fd, buf + count, 3 - count); 365 if ((r <= 0) || (buf[1] != 0xFF )) { 366 ALOGE("It is not VS event !! ret: %d, EVT: %d", r, buf[1]); 367 return -1; 368 } 369 count += r; 370 } 371 372 /* Now we read the parameters. */ 373 if (buf[2] < (size - 3)) 374 remain = buf[2]; 375 else 376 remain = size - 3; 377 378 while ((count - 3) < remain) { 379 r = read(fd, buf + count, remain - (count - 3)); 380 if (r <= 0) 381 return -1; 382 count += r; 383 } 384 385 /* Check if the set patch command is successful or not */ 386 if(get_vs_hci_event(buf) != HCI_CMD_SUCCESS) 387 return -1; 388 389 return count; 390 } 391 392 /* 393 * For Hand-Off related Wipower commands, Command complete arrives first and 394 * the followd with VS event 395 * 396 */ 397 int hci_send_wipower_vs_cmd(int fd, unsigned char *cmd, unsigned char *rsp, int size) 398 { 399 int ret = 0; 400 int err = 0; 401 402 /* Send the HCI command packet to UART for transmission */ 403 ret = do_write(fd, cmd, size); 404 if (ret != size) { 405 ALOGE("%s: WP Send failed with ret value: %d", __FUNCTION__, ret); 406 goto failed; 407 } 408 409 /* Wait for command complete event */ 410 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 411 if ( err < 0) { 412 ALOGE("%s: Failed to charging status cmd on Controller", __FUNCTION__); 413 goto failed; 414 } 415 416 ALOGI("%s: WP Received HCI command complete Event from SOC", __FUNCTION__); 417 failed: 418 return ret; 419 } 420 421 422 int hci_send_vs_cmd(int fd, unsigned char *cmd, unsigned char *rsp, int size) 423 { 424 int ret = 0; 425 426 /* Send the HCI command packet to UART for transmission */ 427 ret = do_write(fd, cmd, size); 428 if (ret != size) { 429 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, ret); 430 goto failed; 431 } 432 433 if (wait_vsc_evt) { 434 /* Check for response from the Controller */ 435 if (read_vs_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE) < 0) { 436 ret = -ETIMEDOUT; 437 ALOGI("%s: Failed to get HCI-VS Event from SOC", __FUNCTION__); 438 goto failed; 439 } 440 ALOGI("%s: Received HCI-Vendor Specific Event from SOC", __FUNCTION__); 441 } 442 443 failed: 444 return ret; 445 } 446 447 void frame_hci_cmd_pkt( 448 unsigned char *cmd, 449 int edl_cmd, unsigned int p_base_addr, 450 int segtNo, int size 451 ) 452 { 453 int offset = 0; 454 hci_command_hdr *cmd_hdr; 455 456 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 457 458 cmd_hdr = (void *) (cmd + 1); 459 460 cmd[0] = HCI_COMMAND_PKT; 461 cmd_hdr->opcode = cmd_opcode_pack(HCI_VENDOR_CMD_OGF, HCI_PATCH_CMD_OCF); 462 cmd_hdr->plen = size; 463 cmd[4] = edl_cmd; 464 465 switch (edl_cmd) 466 { 467 case EDL_PATCH_SET_REQ_CMD: 468 /* Copy the patch header info as CMD params */ 469 memcpy(&cmd[5], phdr_buffer, PATCH_HDR_LEN); 470 ALOGD("%s: Sending EDL_PATCH_SET_REQ_CMD", __FUNCTION__); 471 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 472 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 473 break; 474 case EDL_PATCH_DLD_REQ_CMD: 475 offset = ((segtNo - 1) * MAX_DATA_PER_SEGMENT); 476 p_base_addr += offset; 477 cmd_hdr->plen = (size + 6); 478 cmd[5] = (size + 4); 479 cmd[6] = EXTRACT_BYTE(p_base_addr, 0); 480 cmd[7] = EXTRACT_BYTE(p_base_addr, 1); 481 cmd[8] = EXTRACT_BYTE(p_base_addr, 2); 482 cmd[9] = EXTRACT_BYTE(p_base_addr, 3); 483 memcpy(&cmd[10], (pdata_buffer + offset), size); 484 485 ALOGD("%s: Sending EDL_PATCH_DLD_REQ_CMD: size: %d bytes", 486 __FUNCTION__, size); 487 ALOGV("HCI-CMD %d:\t0x%x\t0x%x\t0x%x\t0x%x\t0x%x\t0x%x\t0x%x\t" 488 "0x%x\t0x%x\t0x%x\t\n", segtNo, cmd[0], cmd[1], cmd[2], 489 cmd[3], cmd[4], cmd[5], cmd[6], cmd[7], cmd[8], cmd[9]); 490 break; 491 case EDL_PATCH_ATCH_REQ_CMD: 492 ALOGD("%s: Sending EDL_PATCH_ATTACH_REQ_CMD", __FUNCTION__); 493 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 494 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 495 break; 496 case EDL_PATCH_RST_REQ_CMD: 497 ALOGD("%s: Sending EDL_PATCH_RESET_REQ_CMD", __FUNCTION__); 498 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 499 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 500 break; 501 case EDL_PATCH_VER_REQ_CMD: 502 ALOGD("%s: Sending EDL_PATCH_VER_REQ_CMD", __FUNCTION__); 503 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 504 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 505 break; 506 case EDL_PATCH_TLV_REQ_CMD: 507 ALOGD("%s: Sending EDL_PATCH_TLV_REQ_CMD", __FUNCTION__); 508 /* Parameter Total Length */ 509 cmd[3] = size +2; 510 511 /* TLV Segment Length */ 512 cmd[5] = size; 513 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 514 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4], cmd[5]); 515 offset = (segtNo * MAX_SIZE_PER_TLV_SEGMENT); 516 memcpy(&cmd[6], (pdata_buffer + offset), size); 517 break; 518 case EDL_GET_BUILD_INFO: 519 ALOGD("%s: Sending EDL_GET_BUILD_INFO", __FUNCTION__); 520 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 521 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 522 break; 523 case EDL_GET_BOARD_ID: 524 ALOGD("%s: Sending EDL_GET_BOARD_ID", __FUNCTION__); 525 ALOGV("HCI-CMD %d:\t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", 526 segtNo, cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 527 break; 528 default: 529 ALOGE("%s: Unknown EDL CMD !!!", __FUNCTION__); 530 } 531 } 532 533 void rome_extract_patch_header_info(unsigned char *buf) 534 { 535 int index; 536 537 /* Extract patch id */ 538 for (index = 0; index < 4; index++) 539 rampatch_patch_info.patch_id |= 540 (LSH(buf[index + P_ID_OFFSET], (index * 8))); 541 542 /* Extract (ROM and BUILD) version information */ 543 for (index = 0; index < 2; index++) 544 rampatch_patch_info.patch_ver.rom_version |= 545 (LSH(buf[index + P_ROME_VER_OFFSET], (index * 8))); 546 547 for (index = 0; index < 2; index++) 548 rampatch_patch_info.patch_ver.build_version |= 549 (LSH(buf[index + P_BUILD_VER_OFFSET], (index * 8))); 550 551 /* Extract patch base and entry addresses */ 552 for (index = 0; index < 4; index++) 553 rampatch_patch_info.patch_base_addr |= 554 (LSH(buf[index + P_BASE_ADDR_OFFSET], (index * 8))); 555 556 /* Patch BASE & ENTRY addresses are same */ 557 rampatch_patch_info.patch_entry_addr = rampatch_patch_info.patch_base_addr; 558 559 /* Extract total length of the patch payload */ 560 for (index = 0; index < 4; index++) 561 rampatch_patch_info.patch_length |= 562 (LSH(buf[index + P_LEN_OFFSET], (index * 8))); 563 564 /* Extract the CRC checksum of the patch payload */ 565 for (index = 0; index < 4; index++) 566 rampatch_patch_info.patch_crc |= 567 (LSH(buf[index + P_CRC_OFFSET], (index * 8))); 568 569 /* Extract patch control value */ 570 for (index = 0; index < 4; index++) 571 rampatch_patch_info.patch_ctrl |= 572 (LSH(buf[index + P_CONTROL_OFFSET], (index * 8))); 573 574 ALOGI("PATCH_ID\t : 0x%x", rampatch_patch_info.patch_id); 575 ALOGI("ROM_VERSION\t : 0x%x", rampatch_patch_info.patch_ver.rom_version); 576 ALOGI("BUILD_VERSION\t : 0x%x", rampatch_patch_info.patch_ver.build_version); 577 ALOGI("PATCH_LENGTH\t : 0x%x", rampatch_patch_info.patch_length); 578 ALOGI("PATCH_CRC\t : 0x%x", rampatch_patch_info.patch_crc); 579 ALOGI("PATCH_CONTROL\t : 0x%x\n", rampatch_patch_info.patch_ctrl); 580 ALOGI("PATCH_BASE_ADDR\t : 0x%x\n", rampatch_patch_info.patch_base_addr); 581 582 } 583 584 int rome_edl_set_patch_request(int fd) 585 { 586 int size, err; 587 unsigned char cmd[HCI_MAX_CMD_SIZE]; 588 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 589 590 /* Frame the HCI CMD to be sent to the Controller */ 591 frame_hci_cmd_pkt(cmd, EDL_PATCH_SET_REQ_CMD, 0, 592 -1, PATCH_HDR_LEN + 1); 593 594 /* Total length of the packet to be sent to the Controller */ 595 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + cmd[PLEN]); 596 597 /* Send HCI Command packet to Controller */ 598 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 599 if ( err != size) { 600 ALOGE("Failed to set the patch info to the Controller!"); 601 goto error; 602 } 603 604 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 605 if ( err < 0) { 606 ALOGE("%s: Failed to set patch info on Controller", __FUNCTION__); 607 goto error; 608 } 609 ALOGI("%s: Successfully set patch info on the Controller", __FUNCTION__); 610 error: 611 return err; 612 } 613 614 int rome_edl_patch_download_request(int fd) 615 { 616 int no_of_patch_segment; 617 int index = 1, err = 0, size = 0; 618 unsigned int p_base_addr; 619 unsigned char cmd[HCI_MAX_CMD_SIZE]; 620 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 621 622 no_of_patch_segment = (rampatch_patch_info.patch_length / 623 MAX_DATA_PER_SEGMENT); 624 ALOGI("%s: %d patch segments to be d'loaded from patch base addr: 0x%x", 625 __FUNCTION__, no_of_patch_segment, 626 rampatch_patch_info.patch_base_addr); 627 628 /* Initialize the patch base address from the one read from bin file */ 629 p_base_addr = rampatch_patch_info.patch_base_addr; 630 631 /* 632 * Depending upon size of the patch payload, download the patches in 633 * segments with a max. size of 239 bytes 634 */ 635 for (index = 1; index <= no_of_patch_segment; index++) { 636 637 ALOGI("%s: Downloading patch segment: %d", __FUNCTION__, index); 638 639 /* Frame the HCI CMD PKT to be sent to Controller*/ 640 frame_hci_cmd_pkt(cmd, EDL_PATCH_DLD_REQ_CMD, p_base_addr, 641 index, MAX_DATA_PER_SEGMENT); 642 643 /* Total length of the packet to be sent to the Controller */ 644 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + cmd[PLEN]); 645 646 /* Initialize the RSP packet everytime to 0 */ 647 memset(rsp, 0x0, HCI_MAX_EVENT_SIZE); 648 649 /* Send HCI Command packet to Controller */ 650 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 651 if ( err != size) { 652 ALOGE("Failed to send the patch payload to the Controller!"); 653 goto error; 654 } 655 656 /* Read Command Complete Event */ 657 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 658 if ( err < 0) { 659 ALOGE("%s: Failed to downlaod patch segment: %d!", 660 __FUNCTION__, index); 661 goto error; 662 } 663 ALOGI("%s: Successfully downloaded patch segment: %d", 664 __FUNCTION__, index); 665 } 666 667 /* Check if any pending patch data to be sent */ 668 size = (rampatch_patch_info.patch_length < MAX_DATA_PER_SEGMENT) ? 669 rampatch_patch_info.patch_length : 670 (rampatch_patch_info.patch_length % MAX_DATA_PER_SEGMENT); 671 672 if (size) 673 { 674 /* Frame the HCI CMD PKT to be sent to Controller*/ 675 frame_hci_cmd_pkt(cmd, EDL_PATCH_DLD_REQ_CMD, p_base_addr, index, size); 676 677 /* Initialize the RSP packet everytime to 0 */ 678 memset(rsp, 0x0, HCI_MAX_EVENT_SIZE); 679 680 /* Total length of the packet to be sent to the Controller */ 681 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + cmd[PLEN]); 682 683 /* Send HCI Command packet to Controller */ 684 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 685 if ( err != size) { 686 ALOGE("Failed to send the patch payload to the Controller!"); 687 goto error; 688 } 689 690 /* Read Command Complete Event */ 691 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 692 if ( err < 0) { 693 ALOGE("%s: Failed to downlaod patch segment: %d!", 694 __FUNCTION__, index); 695 goto error; 696 } 697 698 ALOGI("%s: Successfully downloaded patch segment: %d", 699 __FUNCTION__, index); 700 } 701 702 error: 703 return err; 704 } 705 706 static int rome_download_rampatch(int fd) 707 { 708 int c, tmp, size, index, ret = -1; 709 710 ALOGI("%s: ", __FUNCTION__); 711 712 /* Get handle to the RAMPATCH binary file */ 713 ALOGI("%s: Getting handle to the RAMPATCH binary file from %s", __FUNCTION__, ROME_FW_PATH); 714 file = fopen(ROME_FW_PATH, "r"); 715 if (file == NULL) { 716 ALOGE("%s: Failed to get handle to the RAMPATCH bin file!", 717 __FUNCTION__); 718 return -ENFILE; 719 } 720 721 /* Allocate memory for the patch headder info */ 722 ALOGI("%s: Allocating memory for the patch header", __FUNCTION__); 723 phdr_buffer = (unsigned char *) malloc(PATCH_HDR_LEN + 1); 724 if (phdr_buffer == NULL) { 725 ALOGE("%s: Failed to allocate memory for patch header", 726 __FUNCTION__); 727 goto phdr_alloc_failed; 728 } 729 for (index = 0; index < PATCH_HDR_LEN + 1; index++) 730 phdr_buffer[index] = 0x0; 731 732 /* Read 28 bytes of patch header information */ 733 ALOGI("%s: Reading patch header info", __FUNCTION__); 734 index = 0; 735 do { 736 c = fgetc (file); 737 phdr_buffer[index++] = (unsigned char)c; 738 } while (index != PATCH_HDR_LEN); 739 740 /* Save the patch header info into local structure */ 741 ALOGI("%s: Saving patch hdr. info", __FUNCTION__); 742 rome_extract_patch_header_info((unsigned char *)phdr_buffer); 743 744 /* Set the patch header info onto the Controller */ 745 ret = rome_edl_set_patch_request(fd); 746 if (ret < 0) { 747 ALOGE("%s: Error setting the patchheader info!", __FUNCTION__); 748 goto pdata_alloc_failed; 749 } 750 751 /* Allocate memory for the patch payload */ 752 ALOGI("%s: Allocating memory for patch payload", __FUNCTION__); 753 size = rampatch_patch_info.patch_length; 754 pdata_buffer = (unsigned char *) malloc(size+1); 755 if (pdata_buffer == NULL) { 756 ALOGE("%s: Failed to allocate memory for patch payload", 757 __FUNCTION__); 758 goto pdata_alloc_failed; 759 } 760 for (index = 0; index < size+1; index++) 761 pdata_buffer[index] = 0x0; 762 763 /* Read the patch data from Rampatch binary image */ 764 ALOGI("%s: Reading patch payload from RAMPATCH file", __FUNCTION__); 765 index = 0; 766 do { 767 c = fgetc (file); 768 pdata_buffer[index++] = (unsigned char)c; 769 } while (c != EOF); 770 771 /* Downloading patches in segments to controller */ 772 ret = rome_edl_patch_download_request(fd); 773 if (ret < 0) { 774 ALOGE("%s: Error downloading patch segments!", __FUNCTION__); 775 goto cleanup; 776 } 777 cleanup: 778 free(pdata_buffer); 779 pdata_alloc_failed: 780 free(phdr_buffer); 781 phdr_alloc_failed: 782 fclose(file); 783 error: 784 return ret; 785 } 786 787 int rome_attach_rampatch(int fd) 788 { 789 int size, err; 790 unsigned char cmd[HCI_MAX_CMD_SIZE]; 791 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 792 793 /* Frame the HCI CMD to be sent to the Controller */ 794 frame_hci_cmd_pkt(cmd, EDL_PATCH_ATCH_REQ_CMD, 0, 795 -1, EDL_PATCH_CMD_LEN); 796 797 /* Total length of the packet to be sent to the Controller */ 798 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + cmd[PLEN]); 799 800 /* Send HCI Command packet to Controller */ 801 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 802 if ( err != size) { 803 ALOGE("Failed to attach the patch payload to the Controller!"); 804 goto error; 805 } 806 807 /* Read Command Complete Event */ 808 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 809 if ( err < 0) { 810 ALOGE("%s: Failed to attach the patch segment(s)", __FUNCTION__); 811 goto error; 812 } 813 error: 814 return err; 815 } 816 817 int rome_rampatch_reset(int fd) 818 { 819 int size, err = 0, flags; 820 unsigned char cmd[HCI_MAX_CMD_SIZE]; 821 struct timespec tm = { 0, 100*1000*1000 }; /* 100 ms */ 822 823 /* Frame the HCI CMD to be sent to the Controller */ 824 frame_hci_cmd_pkt(cmd, EDL_PATCH_RST_REQ_CMD, 0, 825 -1, EDL_PATCH_CMD_LEN); 826 827 /* Total length of the packet to be sent to the Controller */ 828 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_PATCH_CMD_LEN); 829 830 /* Send HCI Command packet to Controller */ 831 err = do_write(fd, cmd, size); 832 if (err != size) { 833 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, err); 834 goto error; 835 } 836 837 /* 838 * Controller doesn't sends any response for the patch reset 839 * command. HOST has to wait for 100ms before proceeding. 840 */ 841 nanosleep(&tm, NULL); 842 843 error: 844 return err; 845 } 846 847 int rome_get_tlv_file(char *file_path) 848 { 849 FILE * pFile; 850 long fileSize; 851 int readSize, err = 0, total_segment, remain_size, nvm_length, nvm_index, i; 852 unsigned short nvm_tag_len; 853 tlv_patch_info *ptlv_header; 854 tlv_nvm_hdr *nvm_ptr; 855 unsigned char data_buf[PRINT_BUF_SIZE]={0,}; 856 unsigned char *nvm_byte_ptr; 857 858 ALOGI("File Open (%s)", file_path); 859 pFile = fopen ( file_path , "r" ); 860 if (pFile==NULL) {; 861 ALOGE("%s File Open Fail", file_path); 862 return -1; 863 } 864 865 /* Get File Size */ 866 fseek (pFile , 0 , SEEK_END); 867 fileSize = ftell (pFile); 868 rewind (pFile); 869 870 pdata_buffer = (unsigned char*) malloc (sizeof(char)*fileSize); 871 if (pdata_buffer == NULL) { 872 ALOGE("Allocated Memory failed"); 873 fclose (pFile); 874 return -1; 875 } 876 877 /* Copy file into allocated buffer */ 878 readSize = fread (pdata_buffer,1,fileSize,pFile); 879 880 /* File Close */ 881 fclose (pFile); 882 883 if (readSize != fileSize) { 884 ALOGE("Read file size(%d) not matched with actual file size (%ld bytes)",readSize,fileSize); 885 return -1; 886 } 887 888 ptlv_header = (tlv_patch_info *) pdata_buffer; 889 890 /* To handle different event between rampatch and NVM */ 891 gTlv_type = ptlv_header->tlv_type; 892 gTlv_dwndCfg = ptlv_header->tlv.patch.dwnd_cfg; 893 894 if(ptlv_header->tlv_type == TLV_TYPE_PATCH){ 895 ALOGI("===================================================="); 896 ALOGI("TLV Type\t\t\t : 0x%x", ptlv_header->tlv_type); 897 ALOGI("Length\t\t\t : %d bytes", (ptlv_header->tlv_length1) | 898 (ptlv_header->tlv_length2 << 8) | 899 (ptlv_header->tlv_length3 << 16)); 900 ALOGI("Total Length\t\t\t : %d bytes", ptlv_header->tlv.patch.tlv_data_len); 901 ALOGI("Patch Data Length\t\t\t : %d bytes",ptlv_header->tlv.patch.tlv_patch_data_len); 902 ALOGI("Signing Format Version\t : 0x%x", ptlv_header->tlv.patch.sign_ver); 903 ALOGI("Signature Algorithm\t\t : 0x%x", ptlv_header->tlv.patch.sign_algorithm); 904 ALOGI("Event Handling\t\t\t : 0x%x", ptlv_header->tlv.patch.dwnd_cfg); 905 ALOGI("Reserved\t\t\t : 0x%x", ptlv_header->tlv.patch.reserved1); 906 ALOGI("Product ID\t\t\t : 0x%04x\n", ptlv_header->tlv.patch.prod_id); 907 ALOGI("Rom Build Version\t\t : 0x%04x\n", ptlv_header->tlv.patch.build_ver); 908 ALOGI("Patch Version\t\t : 0x%04x\n", ptlv_header->tlv.patch.patch_ver); 909 ALOGI("Reserved\t\t\t : 0x%x\n", ptlv_header->tlv.patch.reserved2); 910 ALOGI("Patch Entry Address\t\t : 0x%x\n", (ptlv_header->tlv.patch.patch_entry_addr)); 911 ALOGI("===================================================="); 912 913 } else if(ptlv_header->tlv_type == TLV_TYPE_NVM) { 914 ALOGV("===================================================="); 915 ALOGI("TLV Type\t\t\t : 0x%x", ptlv_header->tlv_type); 916 ALOGI("Length\t\t\t : %d bytes", nvm_length = (ptlv_header->tlv_length1) | 917 (ptlv_header->tlv_length2 << 8) | 918 (ptlv_header->tlv_length3 << 16)); 919 920 if(nvm_length <= 0) 921 return readSize; 922 923 for(nvm_byte_ptr=(unsigned char *)(nvm_ptr = &(ptlv_header->tlv.nvm)), nvm_index=0; 924 nvm_index < nvm_length ; nvm_ptr = (tlv_nvm_hdr *) nvm_byte_ptr) 925 { 926 ALOGV("TAG ID\t\t\t : %d", nvm_ptr->tag_id); 927 ALOGV("TAG Length\t\t\t : %d", nvm_tag_len = nvm_ptr->tag_len); 928 ALOGV("TAG Pointer\t\t\t : %d", nvm_ptr->tag_ptr); 929 ALOGV("TAG Extended Flag\t\t : %d", nvm_ptr->tag_ex_flag); 930 931 /* Increase nvm_index to NVM data */ 932 nvm_index+=sizeof(tlv_nvm_hdr); 933 nvm_byte_ptr+=sizeof(tlv_nvm_hdr); 934 935 /* Write BD Address */ 936 if(nvm_ptr->tag_id == TAG_NUM_2){ 937 memcpy(nvm_byte_ptr, vnd_local_bd_addr, 6); 938 ALOGV("BD Address: %.02x:%.02x:%.02x:%.02x:%.02x:%.02x", 939 *nvm_byte_ptr, *(nvm_byte_ptr+1), *(nvm_byte_ptr+2), 940 *(nvm_byte_ptr+3), *(nvm_byte_ptr+4), *(nvm_byte_ptr+5)); 941 } 942 943 for(i =0;(i<nvm_ptr->tag_len && (i*3 + 2) <PRINT_BUF_SIZE);i++) 944 snprintf((char *) data_buf, PRINT_BUF_SIZE, "%s%.02x ", (char *)data_buf, *(nvm_byte_ptr + i)); 945 946 ALOGV("TAG Data\t\t\t : %s", data_buf); 947 948 /* Clear buffer */ 949 memset(data_buf, 0x0, PRINT_BUF_SIZE); 950 951 /* increased by tag_len */ 952 nvm_index+=nvm_ptr->tag_len; 953 nvm_byte_ptr +=nvm_ptr->tag_len; 954 } 955 956 ALOGV("===================================================="); 957 958 } else { 959 ALOGI("TLV Header type is unknown (%d) ", ptlv_header->tlv_type); 960 } 961 962 return readSize; 963 } 964 965 int rome_tlv_dnld_segment(int fd, int index, int seg_size, unsigned char wait_cc_evt) 966 { 967 int size=0, err = -1; 968 unsigned char cmd[HCI_MAX_CMD_SIZE]; 969 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 970 971 ALOGV("%s: Downloading TLV Patch segment no.%d, size:%d", __FUNCTION__, index, seg_size); 972 973 /* Frame the HCI CMD PKT to be sent to Controller*/ 974 frame_hci_cmd_pkt(cmd, EDL_PATCH_TLV_REQ_CMD, 0, index, seg_size); 975 976 /* Total length of the packet to be sent to the Controller */ 977 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + cmd[PLEN]); 978 979 /* Initialize the RSP packet everytime to 0 */ 980 memset(rsp, 0x0, HCI_MAX_EVENT_SIZE); 981 982 /* Send HCI Command packet to Controller */ 983 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 984 if ( err != size) { 985 ALOGE("Failed to send the patch payload to the Controller! 0x%x", err); 986 return err; 987 } 988 989 if(wait_cc_evt) { 990 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 991 if ( err < 0) { 992 ALOGE("%s: Failed to downlaod patch segment: %d!", __FUNCTION__, index); 993 return err; 994 } 995 } 996 997 ALOGI("%s: Successfully downloaded patch segment: %d", __FUNCTION__, index); 998 return err; 999 } 1000 1001 int rome_tlv_dnld_req(int fd, int tlv_size) 1002 { 1003 int total_segment, remain_size, i, err = -1; 1004 unsigned char wait_cc_evt = TRUE; 1005 1006 total_segment = tlv_size/MAX_SIZE_PER_TLV_SEGMENT; 1007 remain_size = (tlv_size < MAX_SIZE_PER_TLV_SEGMENT)?\ 1008 tlv_size: (tlv_size%MAX_SIZE_PER_TLV_SEGMENT); 1009 1010 ALOGI("%s: TLV size: %d, Total Seg num: %d, remain size: %d", 1011 __FUNCTION__,tlv_size, total_segment, remain_size); 1012 1013 if (gTlv_type == TLV_TYPE_PATCH) { 1014 /* Prior to Rome version 3.2(including inital few rampatch release of Rome 3.2), the event 1015 * handling mechanism is ROME_SKIP_EVT_NONE. After few release of rampatch for Rome 3.2, the 1016 * mechamism is changed to ROME_SKIP_EVT_VSE_CC. Rest of the mechanism is not used for now 1017 */ 1018 switch(gTlv_dwndCfg) 1019 { 1020 case ROME_SKIP_EVT_NONE: 1021 wait_vsc_evt = TRUE; 1022 wait_cc_evt = TRUE; 1023 ALOGI("Event handling type: ROME_SKIP_EVT_NONE"); 1024 break; 1025 case ROME_SKIP_EVT_VSE_CC: 1026 wait_vsc_evt = FALSE; 1027 wait_cc_evt = FALSE; 1028 ALOGI("Event handling type: ROME_SKIP_EVT_VSE_CC"); 1029 break; 1030 /* Not handled for now */ 1031 case ROME_SKIP_EVT_VSE: 1032 case ROME_SKIP_EVT_CC: 1033 default: 1034 ALOGE("Unsupported Event handling: %d", gTlv_dwndCfg); 1035 break; 1036 } 1037 } else { 1038 wait_vsc_evt = TRUE; 1039 wait_cc_evt = TRUE; 1040 } 1041 1042 for(i=0;i<total_segment ;i++){ 1043 if ((i+1) == total_segment) { 1044 if ((rome_ver >= ROME_VER_1_1) && (rome_ver < ROME_VER_3_2) && (gTlv_type == TLV_TYPE_PATCH)) { 1045 /* If the Rome version is from 1.1 to 3.1 1046 * 1. No CCE for the last command segment but all other segment 1047 * 2. All the command segments get VSE including the last one 1048 */ 1049 wait_cc_evt = !remain_size ? FALSE: TRUE; 1050 } else if ((rome_ver == ROME_VER_3_2) && (gTlv_type == TLV_TYPE_PATCH)) { 1051 /* If the Rome version is 3.2 1052 * 1. None of the command segments receive CCE 1053 * 2. No command segments receive VSE except the last one 1054 * 3. If gTlv_dwndCfg is ROME_SKIP_EVT_NONE then the logic is 1055 * same as Rome 2.1, 2.2, 3.0 1056 */ 1057 if (gTlv_dwndCfg == ROME_SKIP_EVT_NONE) { 1058 wait_cc_evt = !remain_size ? FALSE: TRUE; 1059 } else if (gTlv_dwndCfg == ROME_SKIP_EVT_VSE_CC) { 1060 wait_vsc_evt = !remain_size ? TRUE: FALSE; 1061 } 1062 } 1063 } 1064 1065 patch_dnld_pending = TRUE; 1066 if((err = rome_tlv_dnld_segment(fd, i, MAX_SIZE_PER_TLV_SEGMENT, wait_cc_evt )) < 0) 1067 goto error; 1068 patch_dnld_pending = FALSE; 1069 } 1070 1071 if ((rome_ver >= ROME_VER_1_1) && (rome_ver < ROME_VER_3_2) && (gTlv_type == TLV_TYPE_PATCH)) { 1072 /* If the Rome version is from 1.1 to 3.1 1073 * 1. No CCE for the last command segment but all other segment 1074 * 2. All the command segments get VSE including the last one 1075 */ 1076 wait_cc_evt = remain_size ? FALSE: TRUE; 1077 } else if ((rome_ver == ROME_VER_3_2) && (gTlv_type == TLV_TYPE_PATCH)) { 1078 /* If the Rome version is 3.2 1079 * 1. None of the command segments receive CCE 1080 * 2. No command segments receive VSE except the last one 1081 * 3. If gTlv_dwndCfg is ROME_SKIP_EVT_NONE then the logic is 1082 * same as Rome 2.1, 2.2, 3.0 1083 */ 1084 if (gTlv_dwndCfg == ROME_SKIP_EVT_NONE) { 1085 wait_cc_evt = remain_size ? FALSE: TRUE; 1086 } else if (gTlv_dwndCfg == ROME_SKIP_EVT_VSE_CC) { 1087 wait_vsc_evt = remain_size ? TRUE: FALSE; 1088 } 1089 } 1090 1091 patch_dnld_pending = TRUE; 1092 if(remain_size) err =rome_tlv_dnld_segment(fd, i, remain_size, wait_cc_evt); 1093 patch_dnld_pending = FALSE; 1094 error: 1095 if(patch_dnld_pending) patch_dnld_pending = FALSE; 1096 return err; 1097 } 1098 1099 int rome_download_tlv_file(int fd) 1100 { 1101 int tlv_size, err = -1; 1102 char nvm_file_path_bid[32] = { 0,}; 1103 1104 memcpy(nvm_file_path_bid, nvm_file_path, strlen(nvm_file_path) - 2); 1105 1106 /* Rampatch TLV file Downloading */ 1107 pdata_buffer = NULL; 1108 if((tlv_size = rome_get_tlv_file(rampatch_file_path)) < 0) 1109 goto error; 1110 1111 if((err =rome_tlv_dnld_req(fd, tlv_size)) <0 ) 1112 goto error; 1113 1114 if (pdata_buffer != NULL){ 1115 free (pdata_buffer); 1116 pdata_buffer = NULL; 1117 } 1118 if (get_boardid_req(fd) < 0) { 1119 ALOGE("%s: failed to get board id(0x%x)", __FUNCTION__, err); 1120 goto default_download; 1121 } 1122 1123 strlcat(nvm_file_path_bid, board_id, sizeof(nvm_file_path_bid)); 1124 1125 if((tlv_size = rome_get_tlv_file(nvm_file_path_bid)) < 0) { 1126 ALOGI("%s: %s: file doesn't exist, falling back to default file", __FUNCTION__, nvm_file_path_bid); 1127 default_download: 1128 /* NVM TLV file Downloading */ 1129 if((tlv_size = rome_get_tlv_file(nvm_file_path)) < 0) 1130 goto error; 1131 } 1132 1133 if((err =rome_tlv_dnld_req(fd, tlv_size)) <0 ) 1134 goto error; 1135 1136 error: 1137 if (pdata_buffer != NULL) 1138 free (pdata_buffer); 1139 1140 return err; 1141 } 1142 1143 int rome_1_0_nvm_tag_dnld(int fd) 1144 { 1145 int i, size, err = 0; 1146 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1147 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1148 1149 #if (NVM_VERSION >= ROME_1_0_100019) 1150 unsigned char cmds[MAX_TAG_CMD][HCI_MAX_CMD_SIZE] = 1151 { 1152 /* Tag 2 */ /* BD Address */ 1153 { /* Packet Type */HCI_COMMAND_PKT, 1154 /* Opcode */ 0x0b,0xfc, 1155 /* Total Len */ 9, 1156 /* NVM CMD */ NVM_ACCESS_SET, 1157 /* Tag Num */ 2, 1158 /* Tag Len */ 6, 1159 /* Tag Value */ 0x77,0x78,0x23,0x01,0x56,0x22 1160 }, 1161 /* Tag 6 */ /* Bluetooth Support Features */ 1162 { /* Packet Type */HCI_COMMAND_PKT, 1163 /* Opcode */ 0x0b,0xfc, 1164 /* Total Len */ 11, 1165 /* NVM CMD */ NVM_ACCESS_SET, 1166 /* Tag Num */ 6, 1167 /* Tag Len */ 8, 1168 /* Tag Value */ 0xFF,0xFE,0x8B,0xFE,0xD8,0x3F,0x5B,0x8B 1169 }, 1170 /* Tag 17 */ /* HCI Transport Layer Setting */ 1171 { /* Packet Type */HCI_COMMAND_PKT, 1172 /* Opcode */ 0x0b,0xfc, 1173 /* Total Len */ 11, 1174 /* NVM CMD */ NVM_ACCESS_SET, 1175 /* Tag Num */ 17, 1176 /* Tag Len */ 8, 1177 /* Tag Value */ 0x82,0x01,0x0E,0x08,0x04,0x32,0x0A,0x00 1178 }, 1179 /* Tag 35 */ 1180 { /* Packet Type */HCI_COMMAND_PKT, 1181 /* Opcode */ 0x0b,0xfc, 1182 /* Total Len */ 58, 1183 /* NVM CMD */ NVM_ACCESS_SET, 1184 /* Tag Num */ 35, 1185 /* Tag Len */ 55, 1186 /* Tag Value */ 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x58, 0x59, 1187 0x0E, 0x0E, 0x16, 0x16, 0x16, 0x1E, 0x26, 0x5F, 0x2F, 0x5F, 1188 0x0E, 0x0E, 0x16, 0x16, 0x16, 0x1E, 0x26, 0x5F, 0x2F, 0x5F, 1189 0x0C, 0x18, 0x14, 0x24, 0x40, 0x4C, 0x70, 0x80, 0x80, 0x80, 1190 0x0C, 0x18, 0x14, 0x24, 0x40, 0x4C, 0x70, 0x80, 0x80, 0x80, 1191 0x1B, 0x14, 0x01, 0x04, 0x48 1192 }, 1193 /* Tag 36 */ 1194 { /* Packet Type */HCI_COMMAND_PKT, 1195 /* Opcode */ 0x0b,0xfc, 1196 /* Total Len */ 15, 1197 /* NVM CMD */ NVM_ACCESS_SET, 1198 /* Tag Num */ 36, 1199 /* Tag Len */ 12, 1200 /* Tag Value */ 0x0F,0x00,0x03,0x03,0x03,0x03,0x00,0x00,0x03,0x03,0x04,0x00 1201 }, 1202 /* Tag 39 */ 1203 { /* Packet Type */HCI_COMMAND_PKT, 1204 /* Opcode */ 0x0b,0xfc, 1205 /* Total Len */ 7, 1206 /* NVM CMD */ NVM_ACCESS_SET, 1207 /* Tag Num */ 39, 1208 /* Tag Len */ 4, 1209 /* Tag Value */ 0x12,0x00,0x00,0x00 1210 }, 1211 /* Tag 41 */ 1212 { /* Packet Type */HCI_COMMAND_PKT, 1213 /* Opcode */ 0x0b,0xfc, 1214 /* Total Len */ 91, 1215 /* NVM CMD */ NVM_ACCESS_SET, 1216 /* Tag Num */ 41, 1217 /* Tag Len */ 88, 1218 /* Tag Value */ 0x15, 0x00, 0x00, 0x00, 0xF6, 0x02, 0x00, 0x00, 0x76, 0x00, 1219 0x1E, 0x00, 0x29, 0x02, 0x1F, 0x00, 0x61, 0x00, 0x1A, 0x00, 1220 0x76, 0x00, 0x1E, 0x00, 0x7D, 0x00, 0x40, 0x00, 0x91, 0x00, 1221 0x06, 0x00, 0x92, 0x00, 0x03, 0x00, 0xA6, 0x01, 0x50, 0x00, 1222 0xAA, 0x01, 0x15, 0x00, 0xAB, 0x01, 0x0A, 0x00, 0xAC, 0x01, 1223 0x00, 0x00, 0xB0, 0x01, 0xC5, 0x00, 0xB3, 0x01, 0x03, 0x00, 1224 0xB4, 0x01, 0x13, 0x00, 0xB5, 0x01, 0x0C, 0x00, 0xC5, 0x01, 1225 0x0D, 0x00, 0xC6, 0x01, 0x10, 0x00, 0xCA, 0x01, 0x2B, 0x00, 1226 0xCB, 0x01, 0x5F, 0x00, 0xCC, 0x01, 0x48, 0x00 1227 }, 1228 /* Tag 42 */ 1229 { /* Packet Type */HCI_COMMAND_PKT, 1230 /* Opcode */ 0x0b,0xfc, 1231 /* Total Len */ 63, 1232 /* NVM CMD */ NVM_ACCESS_SET, 1233 /* Tag Num */ 42, 1234 /* Tag Len */ 60, 1235 /* Tag Value */ 0xD7, 0xC0, 0x00, 0x00, 0x8F, 0x5C, 0x02, 0x00, 0x80, 0x47, 1236 0x60, 0x0C, 0x70, 0x4C, 0x00, 0x00, 0x00, 0x01, 0x1F, 0x01, 1237 0x42, 0x01, 0x69, 0x01, 0x95, 0x01, 0xC7, 0x01, 0xFE, 0x01, 1238 0x3D, 0x02, 0x83, 0x02, 0xD1, 0x02, 0x29, 0x03, 0x00, 0x0A, 1239 0x10, 0x00, 0x1F, 0x00, 0x3F, 0x00, 0x7F, 0x00, 0xFD, 0x00, 1240 0xF9, 0x01, 0xF1, 0x03, 0xDE, 0x07, 0x00, 0x00, 0x9A, 0x01 1241 }, 1242 /* Tag 84 */ 1243 { /* Packet Type */HCI_COMMAND_PKT, 1244 /* Opcode */ 0x0b,0xfc, 1245 /* Total Len */ 153, 1246 /* NVM CMD */ NVM_ACCESS_SET, 1247 /* Tag Num */ 84, 1248 /* Tag Len */ 150, 1249 /* Tag Value */ 0x7C, 0x6A, 0x59, 0x47, 0x19, 0x36, 0x35, 0x25, 0x25, 0x28, 1250 0x2C, 0x2B, 0x2B, 0x28, 0x2C, 0x28, 0x29, 0x28, 0x29, 0x28, 1251 0x29, 0x29, 0x2C, 0x29, 0x2C, 0x29, 0x2C, 0x28, 0x29, 0x28, 1252 0x29, 0x28, 0x29, 0x2A, 0x00, 0x00, 0x2C, 0x2A, 0x2C, 0x18, 1253 0x98, 0x98, 0x98, 0x98, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 1254 0x1E, 0x13, 0x1E, 0x1E, 0x1E, 0x1E, 0x13, 0x13, 0x11, 0x13, 1255 0x1E, 0x1E, 0x13, 0x12, 0x12, 0x12, 0x11, 0x12, 0x1F, 0x12, 1256 0x12, 0x12, 0x10, 0x0C, 0x18, 0x0D, 0x01, 0x01, 0x01, 0x01, 1257 0x01, 0x01, 0x01, 0x0C, 0x01, 0x01, 0x01, 0x01, 0x0D, 0x0D, 1258 0x0E, 0x0D, 0x01, 0x01, 0x0D, 0x0D, 0x0D, 0x0D, 0x0F, 0x0D, 1259 0x10, 0x0D, 0x0D, 0x0D, 0x0D, 0x10, 0x05, 0x10, 0x03, 0x00, 1260 0x7E, 0x7B, 0x7B, 0x72, 0x71, 0x50, 0x50, 0x50, 0x00, 0x40, 1261 0x60, 0x60, 0x30, 0x08, 0x02, 0x0F, 0x00, 0x01, 0x00, 0x00, 1262 0x00, 0x00, 0x00, 0x00, 0x08, 0x16, 0x16, 0x08, 0x08, 0x00, 1263 0x00, 0x00, 0x1E, 0x34, 0x2B, 0x1B, 0x23, 0x2B, 0x15, 0x0D 1264 }, 1265 /* Tag 85 */ 1266 { /* Packet Type */HCI_COMMAND_PKT, 1267 /* Opcode */ 0x0b,0xfc, 1268 /* Total Len */ 119, 1269 /* NVM CMD */ NVM_ACCESS_SET, 1270 /* Tag Num */ 85, 1271 /* Tag Len */ 116, 1272 /* Tag Value */ 0x03, 0x00, 0x38, 0x00, 0x45, 0x77, 0x00, 0xE8, 0x00, 0x59, 1273 0x01, 0xCA, 0x01, 0x3B, 0x02, 0xAC, 0x02, 0x1D, 0x03, 0x8E, 1274 0x03, 0x00, 0x89, 0x01, 0x0E, 0x02, 0x5C, 0x02, 0xD7, 0x02, 1275 0xF8, 0x08, 0x01, 0x00, 0x1F, 0x00, 0x0A, 0x02, 0x55, 0x02, 1276 0x00, 0x35, 0x00, 0x00, 0x00, 0x00, 0x2A, 0xD7, 0x00, 0x00, 1277 0x00, 0x1E, 0xDE, 0x00, 0x00, 0x00, 0x14, 0x0F, 0x0A, 0x0F, 1278 0x0A, 0x0C, 0x0C, 0x0C, 0x0C, 0x04, 0x04, 0x04, 0x0C, 0x0C, 1279 0x0C, 0x0C, 0x06, 0x06, 0x00, 0x02, 0x02, 0x02, 0x02, 0x02, 1280 0x01, 0x00, 0x02, 0x02, 0x02, 0x02, 0x01, 0x00, 0x00, 0x00, 1281 0x06, 0x0F, 0x14, 0x05, 0x47, 0xCF, 0x77, 0x00, 0x00, 0x00, 1282 0x00, 0x00, 0x00, 0xAC, 0x7C, 0xFF, 0x40, 0x00, 0x00, 0x00, 1283 0x12, 0x04, 0x04, 0x01, 0x04, 0x03 1284 }, 1285 {TAG_END} 1286 }; 1287 #elif (NVM_VERSION == ROME_1_0_6002) 1288 unsigned char cmds[MAX_TAG_CMD][HCI_MAX_CMD_SIZE] = 1289 { 1290 /* Tag 2 */ 1291 { /* Packet Type */HCI_COMMAND_PKT, 1292 /* Opcode */ 0x0b,0xfc, 1293 /* Total Len */ 9, 1294 /* NVM CMD */ NVM_ACCESS_SET, 1295 /* Tag Num */ 2, 1296 /* Tag Len */ 6, 1297 /* Tag Value */ 0x77,0x78,0x23,0x01,0x56,0x22 /* BD Address */ 1298 }, 1299 /* Tag 6 */ 1300 { /* Packet Type */HCI_COMMAND_PKT, 1301 /* Opcode */ 0x0b,0xfc, 1302 /* Total Len */ 11, 1303 /* NVM CMD */ NVM_ACCESS_SET, 1304 /* Tag Num */ 6, 1305 /* Tag Len */ 8, 1306 /* Tag Value */ 0xFF,0xFE,0x8B,0xFE,0xD8,0x3F,0x5B,0x8B 1307 }, 1308 /* Tag 17 */ 1309 { /* Packet Type */HCI_COMMAND_PKT, 1310 /* Opcode */ 0x0b,0xfc, 1311 /* Total Len */ 11, 1312 /* NVM CMD */ NVM_ACCESS_SET, 1313 /* Tag Num */ 17, 1314 /* Tag Len */ 8, 1315 /* Tag Value */ 0x82,0x01,0x0E,0x08,0x04,0x32,0x0A,0x00 1316 }, 1317 /* Tag 36 */ 1318 { /* Packet Type */HCI_COMMAND_PKT, 1319 /* Opcode */ 0x0b,0xfc, 1320 /* Total Len */ 15, 1321 /* NVM CMD */ NVM_ACCESS_SET, 1322 /* Tag Num */ 36, 1323 /* Tag Len */ 12, 1324 /* Tag Value */ 0x0F,0x00,0x03,0x03,0x03,0x03,0x00,0x00,0x03,0x03,0x04,0x00 1325 }, 1326 1327 /* Tag 39 */ 1328 { /* Packet Type */HCI_COMMAND_PKT, 1329 /* Opcode */ 0x0b,0xfc, 1330 /* Total Len */ 7, 1331 /* NVM CMD */ NVM_ACCESS_SET, 1332 /* Tag Num */ 39, 1333 /* Tag Len */ 4, 1334 /* Tag Value */ 0x12,0x00,0x00,0x00 1335 }, 1336 1337 /* Tag 41 */ 1338 { /* Packet Type */HCI_COMMAND_PKT, 1339 /* Opcode */ 0x0b,0xfc, 1340 /* Total Len */ 199, 1341 /* NVM CMD */ NVM_ACCESS_SET, 1342 /* Tag Num */ 41, 1343 /* Tag Len */ 196, 1344 /* Tag Value */ 0x30,0x00,0x00,0x00,0xD5,0x00,0x0E,0x00,0xD6,0x00,0x0E,0x00, 1345 0xD7,0x00,0x16,0x00,0xD8,0x00,0x16,0x00,0xD9,0x00,0x16,0x00, 1346 0xDA,0x00,0x1E,0x00,0xDB,0x00,0x26,0x00,0xDC,0x00,0x5F,0x00, 1347 0xDD,0x00,0x2F,0x00,0xDE,0x00,0x5F,0x00,0xE0,0x00,0x0E,0x00, 1348 0xE1,0x00,0x0E,0x00,0xE2,0x00,0x16,0x00,0xE3,0x00,0x16,0x00, 1349 0xE4,0x00,0x16,0x00,0xE5,0x00,0x1E,0x00,0xE6,0x00,0x26,0x00, 1350 0xE7,0x00,0x5F,0x00,0xE8,0x00,0x2F,0x00,0xE9,0x00,0x5F,0x00, 1351 0xEC,0x00,0x0C,0x00,0xED,0x00,0x08,0x00,0xEE,0x00,0x14,0x00, 1352 0xEF,0x00,0x24,0x00,0xF0,0x00,0x40,0x00,0xF1,0x00,0x4C,0x00, 1353 0xF2,0x00,0x70,0x00,0xF3,0x00,0x80,0x00,0xF4,0x00,0x80,0x00, 1354 0xF5,0x00,0x80,0x00,0xF8,0x00,0x0C,0x00,0xF9,0x00,0x18,0x00, 1355 0xFA,0x00,0x14,0x00,0xFB,0x00,0x24,0x00,0xFC,0x00,0x40,0x00, 1356 0xFD,0x00,0x4C,0x00,0xFE,0x00,0x70,0x00,0xFF,0x00,0x80,0x00, 1357 0x00,0x01,0x80,0x00,0x01,0x01,0x80,0x00,0x04,0x01,0x1B,0x00, 1358 0x05,0x01,0x14,0x00,0x06,0x01,0x01,0x00,0x07,0x01,0x04,0x00, 1359 0x08,0x01,0x00,0x00,0x09,0x01,0x00,0x00,0x0A,0x01,0x03,0x00, 1360 0x0B,0x01,0x03,0x00 1361 }, 1362 1363 /* Tag 44 */ 1364 { /* Packet Type */HCI_COMMAND_PKT, 1365 /* Opcode */ 0x0b,0xfc, 1366 /* Total Len */ 44, 1367 /* NVM CMD */ NVM_ACCESS_SET, 1368 /* Tag Num */ 44, 1369 /* Tag Len */ 41, 1370 /* Tag Value */ 0x6F,0x0A,0x00,0x00,0x00,0x00,0x00,0x50,0xFF,0x10,0x02,0x02, 1371 0x01,0x00,0x14,0x01,0x06,0x28,0xA0,0x62,0x03,0x64,0x01,0x01, 1372 0x0A,0x00,0x00,0x00,0x00,0x00,0x00,0xA0,0xFF,0x10,0x02,0x01, 1373 0x00,0x14,0x01,0x02,0x03 1374 }, 1375 {TAG_END} 1376 }; 1377 #endif 1378 1379 ALOGI("%s: Start sending NVM Tags (ver: 0x%x)", __FUNCTION__, (unsigned int) NVM_VERSION); 1380 1381 for (i=0; (i < MAX_TAG_CMD) && (cmds[i][0] != TAG_END); i++) 1382 { 1383 /* Write BD Address */ 1384 if(cmds[i][TAG_NUM_OFFSET] == TAG_NUM_2){ 1385 memcpy(&cmds[i][TAG_BDADDR_OFFSET], vnd_local_bd_addr, 6); 1386 ALOGI("BD Address: %.2x:%.2x:%.2x:%.2x:%.2x:%.2x", 1387 cmds[i][TAG_BDADDR_OFFSET ], cmds[i][TAG_BDADDR_OFFSET + 1], 1388 cmds[i][TAG_BDADDR_OFFSET + 2], cmds[i][TAG_BDADDR_OFFSET + 3], 1389 cmds[i][TAG_BDADDR_OFFSET + 4], cmds[i][TAG_BDADDR_OFFSET + 5]); 1390 } 1391 size = cmds[i][3] + HCI_COMMAND_HDR_SIZE + 1; 1392 /* Send HCI Command packet to Controller */ 1393 err = hci_send_vs_cmd(fd, (unsigned char *)&cmds[i][0], rsp, size); 1394 if ( err != size) { 1395 ALOGE("Failed to attach the patch payload to the Controller!"); 1396 goto error; 1397 } 1398 1399 /* Read Command Complete Event - This is extra routine for ROME 1.0. From ROM 2.0, it should be removed. */ 1400 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1401 if ( err < 0) { 1402 ALOGE("%s: Failed to get patch version(s)", __FUNCTION__); 1403 goto error; 1404 } 1405 } 1406 1407 error: 1408 return err; 1409 } 1410 1411 1412 1413 int rome_patch_ver_req(int fd) 1414 { 1415 int size, err = 0; 1416 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1417 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1418 1419 /* Frame the HCI CMD to be sent to the Controller */ 1420 frame_hci_cmd_pkt(cmd, EDL_PATCH_VER_REQ_CMD, 0, 1421 -1, EDL_PATCH_CMD_LEN); 1422 1423 /* Total length of the packet to be sent to the Controller */ 1424 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_PATCH_CMD_LEN); 1425 1426 /* Send HCI Command packet to Controller */ 1427 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1428 if ( err != size) { 1429 ALOGE("Failed to attach the patch payload to the Controller!"); 1430 goto error; 1431 } 1432 1433 /* Read Command Complete Event - This is extra routine for ROME 1.0. From ROM 2.0, it should be removed. */ 1434 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1435 if ( err < 0) { 1436 ALOGE("%s: Failed to get patch version(s)", __FUNCTION__); 1437 goto error; 1438 } 1439 error: 1440 return err; 1441 1442 } 1443 1444 int rome_get_build_info_req(int fd) 1445 { 1446 int size, err = 0; 1447 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1448 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1449 1450 /* Frame the HCI CMD to be sent to the Controller */ 1451 frame_hci_cmd_pkt(cmd, EDL_GET_BUILD_INFO, 0, 1452 -1, EDL_PATCH_CMD_LEN); 1453 1454 /* Total length of the packet to be sent to the Controller */ 1455 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_PATCH_CMD_LEN); 1456 1457 /* Send HCI Command packet to Controller */ 1458 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1459 if ( err != size) { 1460 ALOGE("Failed to send get build info cmd to the SoC!"); 1461 goto error; 1462 } 1463 1464 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1465 if ( err < 0) { 1466 ALOGE("%s: Failed to get build info", __FUNCTION__); 1467 goto error; 1468 } 1469 error: 1470 return err; 1471 1472 } 1473 1474 1475 int rome_set_baudrate_req(int fd) 1476 { 1477 int size, err = 0; 1478 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1479 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1480 hci_command_hdr *cmd_hdr; 1481 int flags; 1482 1483 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1484 1485 cmd_hdr = (void *) (cmd + 1); 1486 cmd[0] = HCI_COMMAND_PKT; 1487 cmd_hdr->opcode = cmd_opcode_pack(HCI_VENDOR_CMD_OGF, EDL_SET_BAUDRATE_CMD_OCF); 1488 cmd_hdr->plen = VSC_SET_BAUDRATE_REQ_LEN; 1489 cmd[4] = BAUDRATE_3000000; 1490 1491 /* Total length of the packet to be sent to the Controller */ 1492 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + VSC_SET_BAUDRATE_REQ_LEN); 1493 tcflush(fd,TCIOFLUSH); 1494 /* Flow off during baudrate change */ 1495 if ((err = userial_vendor_ioctl(USERIAL_OP_FLOW_OFF , &flags)) < 0) 1496 { 1497 ALOGE("%s: HW Flow-off error: 0x%x\n", __FUNCTION__, err); 1498 goto error; 1499 } 1500 1501 /* Send the HCI command packet to UART for transmission */ 1502 err = do_write(fd, cmd, size); 1503 if (err != size) { 1504 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, err); 1505 goto error; 1506 } 1507 1508 /* Change Local UART baudrate to high speed UART */ 1509 userial_vendor_set_baud(USERIAL_BAUD_3M); 1510 1511 /* Flow on after changing local uart baudrate */ 1512 if ((err = userial_vendor_ioctl(USERIAL_OP_FLOW_ON , &flags)) < 0) 1513 { 1514 ALOGE("%s: HW Flow-on error: 0x%x \n", __FUNCTION__, err); 1515 return err; 1516 } 1517 1518 /* Check for response from the Controller */ 1519 if ((err =read_vs_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE)) < 0) { 1520 ALOGE("%s: Failed to get HCI-VS Event from SOC", __FUNCTION__); 1521 goto error; 1522 } 1523 1524 ALOGI("%s: Received HCI-Vendor Specific Event from SOC", __FUNCTION__); 1525 1526 /* Wait for command complete event */ 1527 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1528 if ( err < 0) { 1529 ALOGE("%s: Failed to set patch info on Controller", __FUNCTION__); 1530 goto error; 1531 } 1532 1533 error: 1534 return err; 1535 1536 } 1537 1538 1539 int rome_hci_reset_req(int fd) 1540 { 1541 int size, err = 0; 1542 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1543 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1544 hci_command_hdr *cmd_hdr; 1545 int flags; 1546 1547 ALOGI("%s: HCI RESET ", __FUNCTION__); 1548 1549 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1550 1551 cmd_hdr = (void *) (cmd + 1); 1552 cmd[0] = HCI_COMMAND_PKT; 1553 cmd_hdr->opcode = HCI_RESET; 1554 cmd_hdr->plen = 0; 1555 1556 /* Total length of the packet to be sent to the Controller */ 1557 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE); 1558 1559 /* Flow off during baudrate change */ 1560 if ((err = userial_vendor_ioctl(USERIAL_OP_FLOW_OFF , &flags)) < 0) 1561 { 1562 ALOGE("%s: HW Flow-off error: 0x%x\n", __FUNCTION__, err); 1563 goto error; 1564 } 1565 1566 /* Send the HCI command packet to UART for transmission */ 1567 ALOGI("%s: HCI CMD: 0x%x 0x%x 0x%x 0x%x\n", __FUNCTION__, cmd[0], cmd[1], cmd[2], cmd[3]); 1568 err = do_write(fd, cmd, size); 1569 if (err != size) { 1570 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, err); 1571 goto error; 1572 } 1573 1574 /* Change Local UART baudrate to high speed UART */ 1575 userial_vendor_set_baud(USERIAL_BAUD_3M); 1576 1577 /* Flow on after changing local uart baudrate */ 1578 if ((err = userial_vendor_ioctl(USERIAL_OP_FLOW_ON , &flags)) < 0) 1579 { 1580 ALOGE("%s: HW Flow-on error: 0x%x \n", __FUNCTION__, err); 1581 return err; 1582 } 1583 1584 /* Wait for command complete event */ 1585 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1586 if ( err < 0) { 1587 ALOGE("%s: Failed to set patch info on Controller", __FUNCTION__); 1588 goto error; 1589 } 1590 1591 error: 1592 return err; 1593 1594 } 1595 1596 1597 int rome_hci_reset(int fd) 1598 { 1599 int size, err = 0; 1600 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1601 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1602 hci_command_hdr *cmd_hdr; 1603 int flags; 1604 1605 ALOGI("%s: HCI RESET ", __FUNCTION__); 1606 1607 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1608 1609 cmd_hdr = (void *) (cmd + 1); 1610 cmd[0] = HCI_COMMAND_PKT; 1611 cmd_hdr->opcode = HCI_RESET; 1612 cmd_hdr->plen = 0; 1613 1614 /* Total length of the packet to be sent to the Controller */ 1615 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE); 1616 err = do_write(fd, cmd, size); 1617 if (err != size) { 1618 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, err); 1619 err = -1; 1620 goto error; 1621 } 1622 1623 /* Wait for command complete event */ 1624 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1625 if ( err < 0) { 1626 ALOGE("%s: Failed to set patch info on Controller", __FUNCTION__); 1627 goto error; 1628 } 1629 1630 error: 1631 return err; 1632 1633 } 1634 1635 int rome_wipower_current_charging_status_req(int fd) 1636 { 1637 int size, err = 0; 1638 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1639 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1640 hci_command_hdr *cmd_hdr; 1641 int flags; 1642 1643 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1644 1645 cmd_hdr = (void *) (cmd + 1); 1646 cmd[0] = HCI_COMMAND_PKT; 1647 cmd_hdr->opcode = cmd_opcode_pack(HCI_VENDOR_CMD_OGF, EDL_WIPOWER_VS_CMD_OCF); 1648 cmd_hdr->plen = EDL_WIP_QUERY_CHARGING_STATUS_LEN; 1649 cmd[4] = EDL_WIP_QUERY_CHARGING_STATUS_CMD; 1650 1651 /* Total length of the packet to be sent to the Controller */ 1652 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_WIP_QUERY_CHARGING_STATUS_LEN); 1653 1654 ALOGD("%s: Sending EDL_WIP_QUERY_CHARGING_STATUS_CMD", __FUNCTION__); 1655 ALOGD("HCI-CMD: \t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 1656 1657 err = hci_send_wipower_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1658 if ( err != size) { 1659 ALOGE("Failed to send EDL_WIP_QUERY_CHARGING_STATUS_CMD command!"); 1660 goto error; 1661 } 1662 1663 /* Check for response from the Controller */ 1664 if (read_vs_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE) < 0) { 1665 err = -ETIMEDOUT; 1666 ALOGI("%s: WP Failed to get HCI-VS Event from SOC", __FUNCTION__); 1667 goto error; 1668 } 1669 1670 /* Read Command Complete Event - This is extra routine for ROME 1.0. From ROM 2.0, it should be removed. */ 1671 if (rsp[4] >= NON_WIPOWER_MODE) { 1672 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1673 if (err < 0) { 1674 ALOGE("%s: Failed to get charging status", __FUNCTION__); 1675 goto error; 1676 } 1677 } 1678 1679 error: 1680 return err; 1681 } 1682 1683 int get_boardid_req(int fd) 1684 { 1685 int size, err = 0; 1686 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1687 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1688 bool cmd_supported = TRUE; 1689 1690 /* Frame the HCI CMD to be sent to the Controller */ 1691 frame_hci_cmd_pkt(cmd, EDL_GET_BOARD_ID, 0, 1692 -1, EDL_PATCH_CMD_LEN); 1693 /* Total length of the packet to be sent to the Controller */ 1694 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_PATCH_CMD_LEN); 1695 1696 ALOGI("%s: Sending EDL_GET_BOARD_ID", __FUNCTION__); 1697 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1698 if ( err != size) { 1699 ALOGE("Failed to send EDL_GET_BOARD_ID command!"); 1700 cmd_supported = FALSE; 1701 } 1702 1703 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1704 if (err < 0) { 1705 ALOGE("%s: Failed to get feature request", __FUNCTION__); 1706 goto error; 1707 } 1708 error: 1709 return (cmd_supported == TRUE? err: -1); 1710 } 1711 1712 1713 int addon_feature_req(int fd) 1714 { 1715 int size, err = 0; 1716 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1717 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1718 hci_command_hdr *cmd_hdr; 1719 int flags; 1720 1721 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1722 1723 cmd_hdr = (void *) (cmd + 1); 1724 cmd[0] = HCI_COMMAND_PKT; 1725 cmd_hdr->opcode = cmd_opcode_pack(HCI_VENDOR_CMD_OGF, HCI_VS_GET_ADDON_FEATURES_SUPPORT); 1726 cmd_hdr->plen = 0x00; 1727 1728 /* Total length of the packet to be sent to the Controller */ 1729 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE); 1730 1731 ALOGD("%s: Sending HCI_VS_GET_ADDON_FEATURES_SUPPORT", __FUNCTION__); 1732 ALOGD("HCI-CMD: \t0x%x \t0x%x \t0x%x \t0x%x", cmd[0], cmd[1], cmd[2], cmd[3]); 1733 err = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1734 if ( err != size) { 1735 ALOGE("Failed to send HCI_VS_GET_ADDON_FEATURES_SUPPORT command!"); 1736 goto error; 1737 } 1738 1739 err = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1740 if (err < 0) { 1741 ALOGE("%s: Failed to get feature request", __FUNCTION__); 1742 goto error; 1743 } 1744 error: 1745 return err; 1746 } 1747 1748 1749 int check_embedded_mode(int fd) { 1750 int err = 0; 1751 1752 wipower_flag = 0; 1753 /* Get current wipower charging status */ 1754 if ((err = rome_wipower_current_charging_status_req(fd)) < 0) 1755 { 1756 ALOGI("%s: Wipower status req failed (0x%x)", __FUNCTION__, err); 1757 } 1758 usleep(500); 1759 1760 ALOGE("%s: wipower_flag: %d", __FUNCTION__, wipower_flag); 1761 1762 return wipower_flag; 1763 } 1764 1765 int rome_get_addon_feature_list(int fd) { 1766 int err = 0; 1767 1768 /* Get addon features that are supported by FW */ 1769 if ((err = addon_feature_req(fd)) < 0) 1770 { 1771 ALOGE("%s: failed (0x%x)", __FUNCTION__, err); 1772 } 1773 return err; 1774 } 1775 1776 int rome_wipower_forward_handoff_req(int fd) 1777 { 1778 int size, err = 0; 1779 unsigned char cmd[HCI_MAX_CMD_SIZE]; 1780 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1781 hci_command_hdr *cmd_hdr; 1782 int flags; 1783 1784 memset(cmd, 0x0, HCI_MAX_CMD_SIZE); 1785 1786 cmd_hdr = (void *) (cmd + 1); 1787 cmd[0] = HCI_COMMAND_PKT; 1788 cmd_hdr->opcode = cmd_opcode_pack(HCI_VENDOR_CMD_OGF, EDL_WIPOWER_VS_CMD_OCF); 1789 cmd_hdr->plen = EDL_WIP_START_HANDOFF_TO_HOST_LEN; 1790 cmd[4] = EDL_WIP_START_HANDOFF_TO_HOST_CMD; 1791 1792 /* Total length of the packet to be sent to the Controller */ 1793 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_WIP_START_HANDOFF_TO_HOST_LEN); 1794 1795 ALOGD("%s: Sending EDL_WIP_START_HANDOFF_TO_HOST_CMD", __FUNCTION__); 1796 ALOGD("HCI-CMD: \t0x%x \t0x%x \t0x%x \t0x%x \t0x%x", cmd[0], cmd[1], cmd[2], cmd[3], cmd[4]); 1797 err = hci_send_wipower_vs_cmd(fd, (unsigned char *)cmd, rsp, size); 1798 if ( err != size) { 1799 ALOGE("Failed to send EDL_WIP_START_HANDOFF_TO_HOST_CMD command!"); 1800 goto error; 1801 } 1802 1803 /* Check for response from the Controller */ 1804 if (read_vs_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE) < 0) { 1805 err = -ETIMEDOUT; 1806 ALOGI("%s: WP Failed to get HCI-VS Event from SOC", __FUNCTION__); 1807 goto error; 1808 } 1809 1810 error: 1811 return err; 1812 } 1813 1814 1815 void enable_controller_log (int fd, unsigned char wait_for_evt) 1816 { 1817 int ret = 0; 1818 /* VS command to enable controller logging to the HOST. By default it is disabled */ 1819 unsigned char cmd[6] = {0x01, 0x17, 0xFC, 0x02, 0x00, 0x00}; 1820 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1821 char value[PROPERTY_VALUE_MAX] = {'\0'}; 1822 1823 property_get("persist.service.bdroid.soclog", value, "false"); 1824 1825 // value at cmd[5]: 1 - to enable, 0 - to disable 1826 ret = (strcmp(value, "true") == 0) ? cmd[5] = 0x01: 0; 1827 ALOGI("%s: %d", __func__, ret); 1828 /* Ignore vsc evt if wait_for_evt is true */ 1829 if (wait_for_evt) wait_vsc_evt = FALSE; 1830 1831 ret = hci_send_vs_cmd(fd, (unsigned char *)cmd, rsp, 6); 1832 if (ret != 6) { 1833 ALOGE("%s: command failed", __func__); 1834 } 1835 /*Ignore hci_event if wait_for_evt is true*/ 1836 if (wait_for_evt) 1837 goto end; 1838 ret = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1839 if (ret < 0) { 1840 ALOGE("%s: Failed to get CC for enable SoC log", __FUNCTION__); 1841 } 1842 end: 1843 wait_vsc_evt = TRUE; 1844 return; 1845 } 1846 1847 1848 static int disable_internal_ldo(int fd) 1849 { 1850 int ret = 0; 1851 if (enable_extldo) { 1852 unsigned char cmd[5] = {0x01, 0x0C, 0xFC, 0x01, 0x32}; 1853 unsigned char rsp[HCI_MAX_EVENT_SIZE]; 1854 1855 ALOGI(" %s ", __FUNCTION__); 1856 ret = do_write(fd, cmd, 5); 1857 if (ret != 5) { 1858 ALOGE("%s: Send failed with ret value: %d", __FUNCTION__, ret); 1859 ret = -1; 1860 } else { 1861 /* Wait for command complete event */ 1862 ret = read_hci_event(fd, rsp, HCI_MAX_EVENT_SIZE); 1863 if ( ret < 0) { 1864 ALOGE("%s: Failed to get response from controller", __FUNCTION__); 1865 } 1866 } 1867 } 1868 return ret; 1869 } 1870 1871 int rome_soc_init(int fd, char *bdaddr) 1872 { 1873 int err = -1, size = 0; 1874 dnld_fd = fd; 1875 ALOGI(" %s ", __FUNCTION__); 1876 RESERVED(bdaddr); 1877 1878 /* If wipower charging is going on in embedded mode then start hand off req */ 1879 if (wipower_flag == WIPOWER_IN_EMBEDDED_MODE && wipower_handoff_ready != NON_WIPOWER_MODE) 1880 { 1881 wipower_flag = 0; 1882 wipower_handoff_ready = 0; 1883 if ((err = rome_wipower_forward_handoff_req(fd)) < 0) 1884 { 1885 ALOGI("%s: Wipower handoff failed (0x%x)", __FUNCTION__, err); 1886 } 1887 } 1888 1889 /* Get Rome version information */ 1890 if((err = rome_patch_ver_req(fd)) <0){ 1891 ALOGI("%s: Fail to get Rome Version (0x%x)", __FUNCTION__, err); 1892 goto error; 1893 } 1894 1895 ALOGI("%s: Rome Version (0x%08x)", __FUNCTION__, rome_ver); 1896 1897 switch (rome_ver){ 1898 case ROME_VER_1_0: 1899 { 1900 /* Set and Download the RAMPATCH */ 1901 ALOGI("%s: Setting Patch Header & Downloading Patches", __FUNCTION__); 1902 err = rome_download_rampatch(fd); 1903 if (err < 0) { 1904 ALOGE("%s: DOWNLOAD RAMPATCH failed!", __FUNCTION__); 1905 goto error; 1906 } 1907 ALOGI("%s: DOWNLOAD RAMPTACH complete", __FUNCTION__); 1908 1909 /* Attach the RAMPATCH */ 1910 ALOGI("%s: Attaching the patches", __FUNCTION__); 1911 err = rome_attach_rampatch(fd); 1912 if (err < 0) { 1913 ALOGE("%s: ATTACH RAMPATCH failed!", __FUNCTION__); 1914 goto error; 1915 } 1916 ALOGI("%s: ATTACH RAMPTACH complete", __FUNCTION__); 1917 1918 /* Send Reset */ 1919 size = (HCI_CMD_IND + HCI_COMMAND_HDR_SIZE + EDL_PATCH_CMD_LEN); 1920 err = rome_rampatch_reset(fd); 1921 if ( err < 0 ) { 1922 ALOGE("Failed to RESET after RAMPATCH upgrade!"); 1923 goto error; 1924 } 1925 1926 /* NVM download */ 1927 ALOGI("%s: Downloading NVM", __FUNCTION__); 1928 err = rome_1_0_nvm_tag_dnld(fd); 1929 if ( err <0 ) { 1930 ALOGE("Downloading NVM Failed !!"); 1931 goto error; 1932 } 1933 1934 /* Change baud rate 115.2 kbps to 3Mbps*/ 1935 err = rome_hci_reset_req(fd); 1936 if (err < 0) { 1937 ALOGE("HCI Reset Failed !!"); 1938 goto error; 1939 } 1940 1941 ALOGI("HCI Reset is done\n"); 1942 } 1943 break; 1944 case ROME_VER_1_1: 1945 rampatch_file_path = ROME_RAMPATCH_TLV_PATH; 1946 nvm_file_path = ROME_NVM_TLV_PATH; 1947 goto download; 1948 case ROME_VER_1_3: 1949 rampatch_file_path = ROME_RAMPATCH_TLV_1_0_3_PATH; 1950 nvm_file_path = ROME_NVM_TLV_1_0_3_PATH; 1951 goto download; 1952 case ROME_VER_2_1: 1953 rampatch_file_path = ROME_RAMPATCH_TLV_2_0_1_PATH; 1954 nvm_file_path = ROME_NVM_TLV_2_0_1_PATH; 1955 goto download; 1956 case ROME_VER_3_0: 1957 rampatch_file_path = ROME_RAMPATCH_TLV_3_0_0_PATH; 1958 nvm_file_path = ROME_NVM_TLV_3_0_0_PATH; 1959 fw_su_info = ROME_3_1_FW_SU; 1960 fw_su_offset = ROME_3_1_FW_SW_OFFSET; 1961 goto download; 1962 case ROME_VER_3_2: 1963 rampatch_file_path = ROME_RAMPATCH_TLV_3_0_2_PATH; 1964 nvm_file_path = ROME_NVM_TLV_3_0_2_PATH; 1965 fw_su_info = ROME_3_2_FW_SU; 1966 fw_su_offset = ROME_3_2_FW_SW_OFFSET; 1967 1968 download: 1969 /* Change baud rate 115.2 kbps to 3Mbps*/ 1970 err = rome_set_baudrate_req(fd); 1971 if (err < 0) { 1972 ALOGE("%s: Baud rate change failed!", __FUNCTION__); 1973 goto error; 1974 } 1975 ALOGI("%s: Baud rate changed successfully ", __FUNCTION__); 1976 /* Donwload TLV files (rampatch, NVM) */ 1977 err = rome_download_tlv_file(fd); 1978 if (err < 0) { 1979 ALOGE("%s: Download TLV file failed!", __FUNCTION__); 1980 goto error; 1981 } 1982 ALOGI("%s: Download TLV file successfully ", __FUNCTION__); 1983 1984 /* Get SU FM label information */ 1985 if((err = rome_get_build_info_req(fd)) <0){ 1986 ALOGI("%s: Fail to get Rome FW SU Build info (0x%x)", __FUNCTION__, err); 1987 //Ignore the failure of ROME FW SU label information 1988 err = 0; 1989 } 1990 1991 /* Disable internal LDO to use external LDO instead*/ 1992 err = disable_internal_ldo(fd); 1993 1994 /* Send HCI Reset */ 1995 err = rome_hci_reset(fd); 1996 if ( err <0 ) { 1997 ALOGE("HCI Reset Failed !!"); 1998 goto error; 1999 } 2000 2001 ALOGI("HCI Reset is done\n"); 2002 2003 break; 2004 case ROME_VER_UNKNOWN: 2005 default: 2006 ALOGI("%s: Detected unknown ROME version", __FUNCTION__); 2007 err = -1; 2008 break; 2009 } 2010 2011 error: 2012 dnld_fd = -1; 2013 return err; 2014 } 2015 2016 unsigned char convert2ascii(unsigned char temp) 2017 { 2018 unsigned char n = temp; 2019 if ( n >= 0 && n <= 9) 2020 n = n + 0x30; 2021 else 2022 n = n + 0x57; 2023 return n; 2024 } 2025
