marvell 88w8686 固件下载程序说明-USB迷|专注于互联网分享

2024年9月25日发(作者：箕嘉运)

Marvell 88w8686 Firmware Download Procedure

By WiFiMod:

Archive for the ‘Marvell WiFi Development’ Category

Marvell 88w8686 Firmware Download Procedure—–SPI Interface

Helper download / Single Stage firmware:

1. Device (boot code) writes to Command Write Base Address Register to set the location for

Firmware download.

2. Device (boot code) writes ‘1’ to CmdDnLdRdy (bit 2, Host Interrupt Cause Register) to indicate

that the device is ready for firmware download.

3. Scratch pad 1 (0×0028) should contain the number of bytes downloaded to the firmware in the

current iteration.

4. Wait for CmdDnLdRdy (bit 2) in Host Interrupt Status Register (0×005C).

5. Write the data into the Command Read / Write Port Register (0×0018).

6. Clear the CmdDnLdRdy (bit 2) of Host Interrupt Status Register (0×005C) to get the next

interrupt.

7. Interrupt the device (boot code) by setting the CmdDnLdOvr (bit 2) in Card Interrupt Status

8. Device (boot code) reads Card Interrupt Status Register to determine the interrupt cause.

9. Device (boot code) moves data from SQU to I-TCM

10. Device (boot code) writes ‘0’ to CmdDnLdOvr (bit 2) of Card Interrupt Cause Register to

re-enable interrupt.

11. Continue step 2 through 10 until all the helper image is downloaded into the card.

12. Once the helper / single stage firmware download is complete, write zero to Scratch pad 1 and

interrupt the bootloader. This will end the helper download.

Note:

? We can download upto 1024 bytes at a time in 1 iteration. (Right now using 64 bytes at a time).

? If the firmware is a single stage firmware then verify of firmware download could be done and

the 2nd stage firmware download should be skipped.

2nd Stage firmware download:

- 1 -

1. This firmware should be downloaded only after the helper image has successfully being

downloaded. When the helper firmware has been completely downloaded the host writes 0 to

Scratch Pad register 1 (0×28) to indicate that the helper-download is over.

2. Wait until a non-zero number appears in Scratch Pad register 1 (0×28). The host must poll this

3. The host verifies that the device has set the CmdDnLdRdy (bit 2) in Host Interrupt Status

4. The host reads Scratch pad register 1 (0×28) to determine how many bytes of firmware needs to

be written (e.g. len).

5. If len = 0 then end (exit) of download.

6. if len = 1 then the previous downloaded data had CRC errors. In this case download the

previous data again.

7. If len != 0 and len != 1, write the len number of bytes of data into the Command Read / Write

Port Register (0×18).

13. Clear the Host Interrupt Status Register (0×005C) to get the next interrupt.

14. Interrupt the bootloader by setting the CmdDnLdOvr (bit 2) in Card Interrupt Status Register

(0×5C).

15. Continue Step 2 through 14 until len = 0 is got.

Firmware download verification:

Verify the firmware download by reading Scratch Pad 4 Register (0×34). The value read should be

0×88888888. This would mean firmware has successfully downloaded and running.

Marvell 88w8686 Firmware Download Procedure—–SDIO Interface

Scope:

To describe the single stage and the 2 stage firmware download via SDIO interface in the Marvell

client cards.

Helper/Single Stage download:

1) Host checks if firmware has already been downloaded.

1. Reads the Scratch pad register at FN0: address 0×80fe and Scratch pad register at FN0: address

0×80ff to see if the values are 0xDC and 0xFE (FIRMWARE_READY status) respectively.

1. If yes, the firmware has already been downloaded; exit the download process.

- 2 -

2. If no, continue to the next step.

2) Host polls the IO_READY and DN_LD_CARD_RDY bits of the Card Control Register: Card

Status Register (offset: 0×20).

3) Checks if the current block is the last block

1. If so, the block length is adjusted to the exact length of the remaining bytes.

2. If it is not the last block, then the length of data that will be downloaded in this iteration=60

(2*32 bytes – 4 byte header).

4) Starts the transfer of firmware blocks.

1. Each block is currently set at 32 bytes. The download length is set to 64 bytes (2 blocks x 32

bytes/block – 4 bytes header) in each iteration for CMD53 write.

2. The CMD53 is issued with Block mode and fixed address as the arguments and by writing into

the IO port register.

5) Repeat 2-4 till the entire helper is downloaded.

6) Download the last packet of length set to 0 to indicate end of data.

7) Wait for 1 sec for the helper to be ready.

Second stage download

1 Host polls the SDIO card status register (FN1 , 0×20) to check IO_READY(bit 3) and

DN_LD_CARD_RDY(bit 0).

2 Read HOST_F1_RD_BASE_0 and HOST_F1_RD_BASE_1 (register 0×10 and 0×11 of FN1)

registers to get the data length set by helper for this iteration.

3 If the length requested by helper is larger than 512 bytes, it will be cut into multiple pieces for

CMD53 write.

4 The current download length is set to 512 bytes (16 blocks x 32 bytes per block) in each

iteration of CMD53 write.

5 Starts the download of 16 blocks of firmware (512 bytes).

6 Copies the payload to the buffer.

7 Write 16 blocks of firmware image data using CMD 53.

8 Repeat steps 5 through 7 till the firmware image data specified by the helper (step 2) for this

iteration is downloaded completely.

9 Repeat steps 2 through 8 till the entire firmware is downloaded completely.

- 3 -

Firmware download verification

1) Reads (FN0) the scratch pad register FN0 (0×80fe) and scratch pad register for FN1 (0×80ff) to

see if the values are 0xDC and 0xFE respectively.

2) This indicates that firmware has been successfully downloaded and is active.

- 4 -