csr_wifi_hip_xbv.c

Go to the documentation of this file.

/*****************************************************************************

            (c) Cambridge Silicon Radio Limited 2012
            All rights reserved and confidential information of CSR

            Refer to LICENSE.txt included with this source for details
            on the license terms.

*****************************************************************************/

/*
 * ---------------------------------------------------------------------------
 * FILE: csr_wifi_hip_xbv.c
 *
 * PURPOSE:
 *      Routines for downloading firmware to UniFi.
 *
 *      UniFi firmware files use a nested TLV (Tag-Length-Value) format.
 *
 * ---------------------------------------------------------------------------
 */
#include <linux/slab.h>

#ifdef CSR_WIFI_XBV_TEST
/* Standalone test harness */
#include "unifi_xbv.h"
#include "csr_wifi_hip_unifihw.h"
#else
/* Normal driver build */
#include "csr_wifi_hip_unifiversion.h"
#include "csr_wifi_hip_card.h"
#define DBG_TAG(t)
#endif

#include "csr_wifi_hip_xbv.h"

#define STREAM_CHECKSUM 0x6d34        /* Sum of uint16s in each patch stream */

/* XBV sizes used in patch conversion
 */
#define PTDL_MAX_SIZE 2048            /* Max bytes allowed per PTDL */
#define PTDL_HDR_SIZE (4 + 2 + 6 + 2) /* sizeof(fw_id, sec_len, patch_cmd, csum) */

/* Struct to represent a buffer for reading firmware file */

typedef struct
{
    void      *dlpriv;
    s32   ioffset;
    fwreadfn_t iread;
} ct_t;

/* Struct to represent a TLV field */
typedef struct
{
    char t_name[4];
    u32     t_len;
} tag_t;


#define TAG_EQ(i, v)    (((i)[0] == (v)[0]) &&  \
                         ((i)[1] == (v)[1]) &&  \
                         ((i)[2] == (v)[2]) &&  \
                         ((i)[3] == (v)[3]))

/* We create a small stack on the stack that contains an enum
 * indicating the containing list segments, and the offset at which
 * those lists end.  This enables a lot more error checking. */
typedef enum
{
    xbv_xbv1,
    /*xbv_info,*/
    xbv_fw,
    xbv_vers,
    xbv_vand,
    xbv_ptch,
    xbv_other
} xbv_container;

#define XBV_STACK_SIZE 6
#define XBV_MAX_OFFS   0x7fffffff

typedef struct
{
    struct
    {
        xbv_container container;
        s32      ioffset_end;
    } s[XBV_STACK_SIZE];
    u32 ptr;
} xbv_stack_t;

static s32 read_tag(card_t *card, ct_t *ct, tag_t *tag);
static s32 read_bytes(card_t *card, ct_t *ct, void *buf, u32 len);
static s32 read_uint(card_t *card, ct_t *ct, u32 *u, u32 len);
static s32 xbv_check(xbv1_t *fwinfo, const xbv_stack_t *stack,
                          xbv_mode new_mode, xbv_container old_cont);
static s32 xbv_push(xbv1_t *fwinfo, xbv_stack_t *stack,
                         xbv_mode new_mode, xbv_container old_cont,
                         xbv_container new_cont, u32 ioff);

static u32 write_uint16(void *buf, const u32 offset,
                              const u16 val);
static u32 write_uint32(void *buf, const u32 offset,
                              const u32 val);
static u32 write_bytes(void *buf, const u32 offset,
                             const u8 *data, const u32 len);
static u32 write_tag(void *buf, const u32 offset,
                           const char *tag_str);
static u32 write_chunk(void *buf, const u32 offset,
                             const char *tag_str,
                             const u32 payload_len);
static u16 calc_checksum(void *buf, const u32 offset,
                               const u32 bytes_len);
static u32 calc_patch_size(const xbv1_t *fwinfo);

static u32 write_xbv_header(void *buf, const u32 offset,
                                  const u32 file_payload_length);
static u32 write_ptch_header(void *buf, const u32 offset,
                                   const u32 fw_id);
static u32 write_patchcmd(void *buf, const u32 offset,
                                const u32 dst_genaddr, const u16 len);
static u32 write_reset_ptdl(void *buf, const u32 offset,
                                  const xbv1_t *fwinfo, u32 fw_id);
static u32 write_fwdl_to_ptdl(void *buf, const u32 offset,
                                    fwreadfn_t readfn, const struct FWDL *fwdl,
                                    const void *fw_buf, const u32 fw_id,
                                    void *rdbuf);

/*
 * ---------------------------------------------------------------------------
 *  parse_xbv1
 *
 *      Scan the firmware file to find the TLVs we are interested in.
 *      Actions performed:
 *        - check we support the file format version in VERF
 *      Store these TLVs if we have a firmware image:
 *        - SLTP Symbol Lookup Table Pointer
 *        - FWDL firmware download segments
 *        - FWOL firmware overlay segment
 *        - VMEQ Register probe tests to verify matching h/w
 *      Store these TLVs if we have a patch file:
 *        - FWID the firmware build ID that this file patches
 *        - PTDL The actual patches
 *
 *      The structure pointed to by fwinfo is cleared and
 *      'fwinfo->mode' is set to 'unknown'.  The 'fwinfo->mode'
 *      variable is set to 'firmware' or 'patch' once we know which
 *      sort of XBV file we have.
 *
 *  Arguments:
 *      readfn          Pointer to function to call to read from the file.
 *      dlpriv          Opaque pointer arg to pass to readfn.
 *      fwinfo          Pointer to fwinfo struct to fill in.
 *
 *  Returns:
 *      CSR_RESULT_SUCCESS on success, CSR error code on failure
 * ---------------------------------------------------------------------------
 */
CsrResult xbv1_parse(card_t *card, fwreadfn_t readfn, void *dlpriv, xbv1_t *fwinfo)
{
    ct_t ct;
    tag_t tag;
    xbv_stack_t stack;

    ct.dlpriv = dlpriv;
    ct.ioffset = 0;
    ct.iread = readfn;

    memset(fwinfo, 0, sizeof(xbv1_t));
    fwinfo->mode = xbv_unknown;

    /* File must start with XBV1 triplet */
    if (read_tag(card, &ct, &tag) <= 0)
    {
        unifi_error(NULL, "File is not UniFi firmware\n");
        return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
    }

    DBG_TAG(tag.t_name);

    if (!TAG_EQ(tag.t_name, "XBV1"))
    {
        unifi_error(NULL, "File is not UniFi firmware (%s)\n", tag.t_name);
        return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
    }

    stack.ptr = 0;
    stack.s[stack.ptr].container = xbv_xbv1;
    stack.s[stack.ptr].ioffset_end = XBV_MAX_OFFS;

    /* Now scan the file */
    while (1)
    {
        s32 n;

        n = read_tag(card, &ct, &tag);
        if (n < 0)
        {
            unifi_error(NULL, "No tag\n");
            return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
        }
        if (n == 0)
        {
            /* End of file */
            break;
        }

        DBG_TAG(tag.t_name);

        /* File format version */
        if (TAG_EQ(tag.t_name, "VERF"))
        {
            u32 version;

            if (xbv_check(fwinfo, &stack, xbv_unknown, xbv_xbv1) ||
                (tag.t_len != 2) ||
                read_uint(card, &ct, &version, 2))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }
            if (version != 0)
            {
                unifi_error(NULL, "Unsupported firmware file version: %d.%d\n",
                            version >> 8, version & 0xFF);
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }
        }
        else if (TAG_EQ(tag.t_name, "LIST"))
        {
            char name[4];
            u32 list_end;

            list_end = ct.ioffset + tag.t_len;

            if (read_bytes(card, &ct, name, 4))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            DBG_TAG(name);
            if (TAG_EQ(name, "FW  "))
            {
                if (xbv_push(fwinfo, &stack, xbv_firmware, xbv_xbv1, xbv_fw, list_end))
                {
                    return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
                }
            }
            else if (TAG_EQ(name, "VERS"))
            {
                if (xbv_push(fwinfo, &stack, xbv_firmware, xbv_fw, xbv_vers, list_end) ||
                    (fwinfo->vers.num_vand != 0))
                {
                    return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
                }
            }
            else if (TAG_EQ(name, "VAND"))
            {
                struct VAND *vand;

                if (xbv_push(fwinfo, &stack, xbv_firmware, xbv_vers, xbv_vand, list_end) ||
                    (fwinfo->vers.num_vand >= MAX_VAND))
                {
                    return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
                }

                /* Get a new VAND */
                vand = fwinfo->vand + fwinfo->vers.num_vand++;

                /* Fill it in */
                vand->first = fwinfo->num_vmeq;
                vand->count = 0;
            }
            else if (TAG_EQ(name, "PTCH"))
            {
                if (xbv_push(fwinfo, &stack, xbv_patch, xbv_xbv1, xbv_ptch, list_end))
                {
                    return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
                }
            }
            else
            {
                /* Skip over any other lists.  We dont bother to push
                 * the new list type now as we would only pop it at
                 * the end of the outer loop. */
                ct.ioffset += tag.t_len - 4;
            }
        }
        else if (TAG_EQ(tag.t_name, "SLTP"))
        {
            u32 addr;

            if (xbv_check(fwinfo, &stack, xbv_firmware, xbv_fw) ||
                (tag.t_len != 4) ||
                (fwinfo->slut_addr != 0) ||
                read_uint(card, &ct, &addr, 4))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            fwinfo->slut_addr = addr;
        }
        else if (TAG_EQ(tag.t_name, "FWDL"))
        {
            u32 addr;
            struct FWDL *fwdl;

            if (xbv_check(fwinfo, &stack, xbv_firmware, xbv_fw) ||
                (fwinfo->num_fwdl >= MAX_FWDL) ||
                (read_uint(card, &ct, &addr, 4)))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            fwdl = fwinfo->fwdl + fwinfo->num_fwdl++;

            fwdl->dl_size = tag.t_len - 4;
            fwdl->dl_addr = addr;
            fwdl->dl_offset = ct.ioffset;

            ct.ioffset += tag.t_len - 4;
        }
        else if (TAG_EQ(tag.t_name, "FWOV"))
        {
            if (xbv_check(fwinfo, &stack, xbv_firmware, xbv_fw) ||
                (fwinfo->fwov.dl_size != 0) ||
                (fwinfo->fwov.dl_offset != 0))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            fwinfo->fwov.dl_size = tag.t_len;
            fwinfo->fwov.dl_offset = ct.ioffset;

            ct.ioffset += tag.t_len;
        }
        else if (TAG_EQ(tag.t_name, "VMEQ"))
        {
            u32 temp[3];
            struct VAND *vand;
            struct VMEQ *vmeq;

            if (xbv_check(fwinfo, &stack, xbv_firmware, xbv_vand) ||
                (fwinfo->num_vmeq >= MAX_VMEQ) ||
                (fwinfo->vers.num_vand == 0) ||
                (tag.t_len != 8) ||
                read_uint(card, &ct, &temp[0], 4) ||
                read_uint(card, &ct, &temp[1], 2) ||
                read_uint(card, &ct, &temp[2], 2))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            /* Get the last VAND */
            vand = fwinfo->vand + (fwinfo->vers.num_vand - 1);

            /* Get a new VMEQ */
            vmeq = fwinfo->vmeq + fwinfo->num_vmeq++;

            /* Note that this VAND contains another VMEQ */
            vand->count++;

            /* Fill in the VMEQ */
            vmeq->addr = temp[0];
            vmeq->mask = (u16)temp[1];
            vmeq->value = (u16)temp[2];
        }
        else if (TAG_EQ(tag.t_name, "FWID"))
        {
            u32 build_id;

            if (xbv_check(fwinfo, &stack, xbv_patch, xbv_ptch) ||
                (tag.t_len != 4) ||
                (fwinfo->build_id != 0) ||
                read_uint(card, &ct, &build_id, 4))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            fwinfo->build_id = build_id;
        }
        else if (TAG_EQ(tag.t_name, "PTDL"))
        {
            struct PTDL *ptdl;

            if (xbv_check(fwinfo, &stack, xbv_patch, xbv_ptch) ||
                (fwinfo->num_ptdl >= MAX_PTDL))
            {
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }

            /* Allocate a new PTDL */
            ptdl = fwinfo->ptdl + fwinfo->num_ptdl++;

            ptdl->dl_size = tag.t_len;
            ptdl->dl_offset = ct.ioffset;

            ct.ioffset += tag.t_len;
        }
        else
        {
            /*
             * If we get here it is a tag we are not interested in,
             * just skip over it.
             */
            ct.ioffset += tag.t_len;
        }

        /* Check to see if we are at the end of the currently stacked
         * segment.  We could finish more than one list at a time. */
        while (ct.ioffset >= stack.s[stack.ptr].ioffset_end)
        {
            if (ct.ioffset > stack.s[stack.ptr].ioffset_end)
            {
                unifi_error(NULL,
                            "XBV file has overrun stack'd segment %d (%d > %d)\n",
                            stack.ptr, ct.ioffset, stack.s[stack.ptr].ioffset_end);
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }
            if (stack.ptr <= 0)
            {
                unifi_error(NULL, "XBV file has underrun stack pointer\n");
                return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
            }
            stack.ptr--;
        }
    }

    if (stack.ptr != 0)
    {
        unifi_error(NULL, "Last list of XBV is not complete.\n");
        return CSR_WIFI_HIP_RESULT_INVALID_VALUE;
    }

    return CSR_RESULT_SUCCESS;
} /* xbv1_parse() */


/* Check the the XBV file is of a consistant sort (either firmware or
 * patch) and that we are in the correct containing list type. */
static s32 xbv_check(xbv1_t *fwinfo, const xbv_stack_t *stack,
                          xbv_mode new_mode, xbv_container old_cont)
{
    /* If the new file mode is unknown the current packet could be in
     * either (any) type of XBV file, and we cant make a decission at
     * this time. */
    if (new_mode != xbv_unknown)
    {
        if (fwinfo->mode == xbv_unknown)
        {
            fwinfo->mode = new_mode;
        }
        else if (fwinfo->mode != new_mode)
        {
            return -1;
        }
    }
    /* If the current stack top doesn't match what we expect then the
     * file is corrupt. */
    if (stack->s[stack->ptr].container != old_cont)
    {
        return -1;
    }
    return 0;
}


/* Make checks as above and then enter a new list */
static s32 xbv_push(xbv1_t *fwinfo, xbv_stack_t *stack,
                         xbv_mode new_mode, xbv_container old_cont,
                         xbv_container new_cont, u32 new_ioff)
{
    if (xbv_check(fwinfo, stack, new_mode, old_cont))
    {
        return -1;
    }

    /* Check that our stack won't overflow. */
    if (stack->ptr >= (XBV_STACK_SIZE - 1))
    {
        return -1;
    }

    /* Add the new list element to the top of the stack. */
    stack->ptr++;
    stack->s[stack->ptr].container = new_cont;
    stack->s[stack->ptr].ioffset_end = new_ioff;

    return 0;
}


static u32 xbv2uint(u8 *ptr, s32 len)
{
    u32 u = 0;
    s16 i;

    for (i = 0; i < len; i++)
    {
        u32 b;
        b = ptr[i];
        u += b << (i * 8);
    }
    return u;
}


static s32 read_tag(card_t *card, ct_t *ct, tag_t *tag)
{
    u8 buf[8];
    s32 n;

    n = (*ct->iread)(card->ospriv, ct->dlpriv, ct->ioffset, buf, 8);
    if (n <= 0)
    {
        return n;
    }

    /* read the tag and length */
    if (n != 8)
    {
        return -1;
    }

    /* get section tag */
    memcpy(tag->t_name, buf, 4);

    /* get section length */
    tag->t_len = xbv2uint(buf + 4, 4);

    ct->ioffset += 8;

    return 8;
} /* read_tag() */


static s32 read_bytes(card_t *card, ct_t *ct, void *buf, u32 len)
{
    /* read the tag value */
    if ((*ct->iread)(card->ospriv, ct->dlpriv, ct->ioffset, buf, len) != (s32)len)
    {
        return -1;
    }

    ct->ioffset += len;

    return 0;
} /* read_bytes() */


static s32 read_uint(card_t *card, ct_t *ct, u32 *u, u32 len)
{
    u8 buf[4];

    /* Integer cannot be more than 4 bytes */
    if (len > 4)
    {
        return -1;
    }

    if (read_bytes(card, ct, buf, len))
    {
        return -1;
    }

    *u = xbv2uint(buf, len);

    return 0;
} /* read_uint() */


static u32 write_uint16(void *buf, const u32 offset, const u16 val)
{
    u8 *dst = (u8 *)buf + offset;
    *dst++ = (u8)(val & 0xff); /* LSB first */
    *dst = (u8)(val >> 8);
    return sizeof(u16);
}


static u32 write_uint32(void *buf, const u32 offset, const u32 val)
{
    (void)write_uint16(buf, offset + 0, (u16)(val & 0xffff));
    (void)write_uint16(buf, offset + 2, (u16)(val >> 16));
    return sizeof(u32);
}


static u32 write_bytes(void *buf, const u32 offset, const u8 *data, const u32 len)
{
    u32 i;
    u8 *dst = (u8 *)buf + offset;

    for (i = 0; i < len; i++)
    {
        *dst++ = *((u8 *)data + i);
    }
    return len;
}


static u32 write_tag(void *buf, const u32 offset, const char *tag_str)
{
    u8 *dst = (u8 *)buf + offset;
    memcpy(dst, tag_str, 4);
    return 4;
}


static u32 write_chunk(void *buf, const u32 offset, const char *tag_str, const u32 payload_len)
{
    u32 written = 0;
    written += write_tag(buf, offset, tag_str);
    written += write_uint32(buf, written + offset, (u32)payload_len);

    return written;
}


static u16 calc_checksum(void *buf, const u32 offset, const u32 bytes_len)
{
    u32 i;
    u8 *src = (u8 *)buf + offset;
    u16 sum = 0;
    u16 val;

    for (i = 0; i < bytes_len / 2; i++)
    {
        /* Contents copied to file is LE, host might not be */
        val = (u16) * src++;         /* LSB */
        val += (u16)(*src++) << 8;   /* MSB */
        sum += val;
    }

    /* Total of uint16s in the stream plus the stored check value
     * should equal STREAM_CHECKSUM when decoded.
     */
    return (STREAM_CHECKSUM - sum);
}


#define PTDL_RESET_DATA_SIZE  20  /* Size of reset vectors PTDL */

static u32 calc_patch_size(const xbv1_t *fwinfo)
{
    s16 i;
    u32 size = 0;

    /*
     * Work out how big an equivalent patch format file must be for this image.
     * This only needs to be approximate, so long as it's large enough.
     */
    if (fwinfo->mode != xbv_firmware)
    {
        return 0;
    }

    /* Payload (which will get put into a series of PTDLs) */
    for (i = 0; i < fwinfo->num_fwdl; i++)
    {
        size += fwinfo->fwdl[i].dl_size;
    }

    /* Another PTDL at the end containing reset vectors */
    size += PTDL_RESET_DATA_SIZE;

    /* PTDL headers. Add one for remainder, one for reset vectors */
    size += ((fwinfo->num_fwdl / PTDL_MAX_SIZE) + 2) * PTDL_HDR_SIZE;

    /* Another 1K sufficient to cover miscellaneous headers */
    size += 1024;

    return size;
}


static u32 write_xbv_header(void *buf, const u32 offset, const u32 file_payload_length)
{
    u32 written = 0;

    /* The length value given to the XBV chunk is the length of all subsequent
     * contents of the file, excluding the 8 byte size of the XBV1 header itself
     * (The added 6 bytes thus accounts for the size of the VERF)
     */
    written += write_chunk(buf, offset + written, (char *)"XBV1", file_payload_length + 6);

    written += write_chunk(buf, offset + written, (char *)"VERF", 2);
    written += write_uint16(buf,  offset + written, 0);      /* File version */

    return written;
}


static u32 write_ptch_header(void *buf, const u32 offset, const u32 fw_id)
{
    u32 written = 0;

    /* LIST is written with a zero length, to be updated later */
    written += write_chunk(buf, offset + written, (char *)"LIST", 0);
    written += write_tag(buf, offset + written, (char *)"PTCH");        /* List type */

    written += write_chunk(buf, offset + written, (char *)"FWID", 4);
    written += write_uint32(buf, offset + written, fw_id);


    return written;
}


#define UF_REGION_PHY  1
#define UF_REGION_MAC  2
#define UF_MEMPUT_MAC  0x0000
#define UF_MEMPUT_PHY  0x1000

static u32 write_patchcmd(void *buf, const u32 offset, const u32 dst_genaddr, const u16 len)
{
    u32 written = 0;
    u32 region = (dst_genaddr >> 28);
    u16 cmd_and_len = UF_MEMPUT_MAC;

    if (region == UF_REGION_PHY)
    {
        cmd_and_len = UF_MEMPUT_PHY;
    }
    else if (region != UF_REGION_MAC)
    {
        return 0; /* invalid */
    }

    /* Write the command and data length */
    cmd_and_len |= len;
    written += write_uint16(buf, offset + written, cmd_and_len);

    /* Write the destination generic address */
    written += write_uint16(buf, offset + written, (u16)(dst_genaddr >> 16));
    written += write_uint16(buf, offset + written, (u16)(dst_genaddr & 0xffff));

    /* The data payload should be appended to the command */
    return written;
}


static u32 write_fwdl_to_ptdl(void *buf, const u32 offset, fwreadfn_t readfn,
                                    const struct FWDL *fwdl, const void *dlpriv,
                                    const u32 fw_id, void *fw_buf)
{
    u32 written = 0;
    s16 chunks = 0;
    u32 left = fwdl->dl_size;      /* Bytes left in this fwdl */
    u32 dl_addr = fwdl->dl_addr;   /* Target address of fwdl image on XAP */
    u32 dl_offs = fwdl->dl_offset; /* Offset of fwdl image data in source */
    u16 csum;
    u32 csum_start_offs;           /* first offset to include in checksum */
    u32 sec_data_len;              /* section data byte count */
    u32 sec_len;                   /* section data + header byte count */

    /* FWDL maps to one or more PTDLs, as max size for a PTDL is 1K words */
    while (left)
    {
        /* Calculate amount to be transferred */
        sec_data_len = CSRMIN(left, PTDL_MAX_SIZE - PTDL_HDR_SIZE);
        sec_len = sec_data_len + PTDL_HDR_SIZE;

        /* Write PTDL header + entire PTDL size */
        written += write_chunk(buf, offset + written, (char *)"PTDL", sec_len);
        /* bug digest implies 4 bytes of padding here, but that seems wrong */

        /* Checksum starts here */
        csum_start_offs = offset + written;

        /* Patch-chunk header: fw_id. Note that this is in XAP word order */
        written += write_uint16(buf, offset + written, (u16)(fw_id >> 16));
        written += write_uint16(buf, offset + written, (u16)(fw_id & 0xffff));

        /* Patch-chunk header: section length in uint16s */
        written += write_uint16(buf, offset + written, (u16)(sec_len / 2));


        /* Write the appropriate patch command for the data's destination ptr */
        written += write_patchcmd(buf, offset + written, dl_addr, (u16)(sec_data_len / 2));

        /* Write the data itself (limited to the max chunk length) */
        if (readfn(NULL, (void *)dlpriv, dl_offs, fw_buf, sec_data_len) < 0)
        {
            return 0;
        }

        written += write_bytes(buf,
                               offset + written,
                               fw_buf,
                               sec_data_len);

        /* u16 checksum calculated over data written */
        csum = calc_checksum(buf, csum_start_offs, written - (csum_start_offs - offset));
        written += write_uint16(buf, offset + written, csum);

        left -= sec_data_len;
        dl_addr += sec_data_len;
        dl_offs += sec_data_len;
        chunks++;
    }

    return written;
}


#define SEC_CMD_LEN         ((4 + 2) * 2) /* sizeof(cmd, vector) per XAP */
#define PTDL_VEC_HDR_SIZE   (4 + 2 + 2)   /* sizeof(fw_id, sec_len, csum) */
#define UF_MAC_START_VEC    0x00c00000    /* Start address of image on MAC */
#define UF_PHY_START_VEC    0x00c00000    /* Start address of image on PHY */
#define UF_MAC_START_CMD    0x6000        /* MAC "Set start address" command */
#define UF_PHY_START_CMD    0x7000        /* PHY "Set start address" command */

static u32 write_reset_ptdl(void *buf, const u32 offset, const xbv1_t *fwinfo, u32 fw_id)
{
    u32 written = 0;
    u16 csum;
    u32 csum_start_offs;                 /* first offset to include in checksum */
    u32 sec_len;                         /* section data + header byte count */

    sec_len = SEC_CMD_LEN + PTDL_VEC_HDR_SIZE; /* Total section byte length */

    /* Write PTDL header + entire PTDL size */
    written += write_chunk(buf, offset + written, (char *)"PTDL", sec_len);

    /* Checksum starts here */
    csum_start_offs = offset + written;

    /* Patch-chunk header: fw_id. Note that this is in XAP word order */
    written += write_uint16(buf, offset + written, (u16)(fw_id >> 16));
    written += write_uint16(buf, offset + written, (u16)(fw_id & 0xffff));

    /* Patch-chunk header: section length in uint16s */
    written += write_uint16(buf, offset + written, (u16)(sec_len / 2));

    /*
     * Restart addresses to be executed on subsequent loader restart command.
     */

    /* Setup the MAC start address, note word ordering */
    written += write_uint16(buf, offset + written, UF_MAC_START_CMD);
    written += write_uint16(buf, offset + written, (UF_MAC_START_VEC >> 16));
    written += write_uint16(buf, offset + written, (UF_MAC_START_VEC & 0xffff));

    /* Setup the PHY start address, note word ordering */
    written += write_uint16(buf, offset + written, UF_PHY_START_CMD);
    written += write_uint16(buf, offset + written, (UF_PHY_START_VEC >> 16));
    written += write_uint16(buf, offset + written, (UF_PHY_START_VEC & 0xffff));

    /* u16 checksum calculated over data written */
    csum = calc_checksum(buf, csum_start_offs, written - (csum_start_offs - offset));
    written += write_uint16(buf, offset + written, csum);

    return written;
}


/*
 * ---------------------------------------------------------------------------
 *  read_slut
 *
 *      desc
 *
 *  Arguments:
 *      readfn          Pointer to function to call to read from the file.
 *      dlpriv          Opaque pointer arg to pass to readfn.
 *      addr            Offset into firmware image of SLUT.
 *      fwinfo          Pointer to fwinfo struct to fill in.
 *
 *  Returns:
 *      Number of SLUT entries in the f/w, or -1 if the image was corrupt.
 * ---------------------------------------------------------------------------
 */
s32 xbv1_read_slut(card_t *card, fwreadfn_t readfn, void *dlpriv, xbv1_t *fwinfo,
                        symbol_t *slut, u32 slut_len)
{
    s16 i;
    s32 offset;
    u32 magic;
    u32 count = 0;
    ct_t ct;

    if (fwinfo->mode != xbv_firmware)
    {
        return -1;
    }

    /* Find the d/l segment containing the SLUT */
    /* This relies on the SLUT being entirely contained in one segment */
    offset = -1;
    for (i = 0; i < fwinfo->num_fwdl; i++)
    {
        if ((fwinfo->slut_addr >= fwinfo->fwdl[i].dl_addr) &&
            (fwinfo->slut_addr < (fwinfo->fwdl[i].dl_addr + fwinfo->fwdl[i].dl_size)))
        {
            offset = fwinfo->fwdl[i].dl_offset +
                     (fwinfo->slut_addr - fwinfo->fwdl[i].dl_addr);
        }
    }
    if (offset < 0)
    {
        return -1;
    }

    ct.dlpriv = dlpriv;
    ct.ioffset = offset;
    ct.iread = readfn;

    if (read_uint(card, &ct, &magic, 2))
    {
        return -1;
    }
    if (magic != SLUT_FINGERPRINT)
    {
        return -1;
    }

    while (count < slut_len)
    {
        u32 id, obj;

        /* Read Symbol Id */
        if (read_uint(card, &ct, &id, 2))
        {
            return -1;
        }

        /* Check for end of table marker */
        if (id == CSR_SLT_END)
        {
            break;
        }

        /* Read Symbol Value */
        if (read_uint(card, &ct, &obj, 4))
        {
            return -1;
        }

        slut[count].id  = (u16)id;
        slut[count].obj = obj;
        count++;
    }

    return count;
} /* read_slut() */


/*
 * ---------------------------------------------------------------------------
 *  xbv_to_patch
 *
 *      Convert (the relevant parts of) a firmware xbv file into a patch xbv
 *
 *  Arguments:
 *      card
 *      fw_buf - pointer to xbv firmware image
 *      fwinfo - structure describing the firmware image
 *      size   - pointer to location into which size of f/w is written.
 *
 *  Returns:
 *      Pointer to firmware image, or NULL on error. Caller must free this
 *      buffer via kfree() once it's finished with.
 *
 *  Notes:
 *      The input fw_buf should have been checked via xbv1_parse prior to
 *      calling this function, so the input image is assumed valid.
 * ---------------------------------------------------------------------------
 */
#define PTCH_LIST_SIZE 16         /* sizeof PTCH+FWID chunk in LIST header */

void* xbv_to_patch(card_t *card, fwreadfn_t readfn,
                   const void *fw_buf, const xbv1_t *fwinfo, u32 *size)
{
    void *patch_buf = NULL;
    u32 patch_buf_size;
    u32 payload_offs = 0;           /* Start of XBV payload */
    s16 i;
    u32 patch_offs = 0;
    u32 list_len_offs = 0;          /* Offset of PTDL LIST length parameter */
    u32 ptdl_start_offs = 0;        /* Offset of first PTDL chunk */
    u32 fw_id;
    void *rdbuf;

    if (!fw_buf || !fwinfo || !card)
    {
        return NULL;
    }

    if (fwinfo->mode != xbv_firmware)
    {
        unifi_error(NULL, "Not a firmware file\n");
        return NULL;
    }

    /* Pre-allocate read buffer for chunk conversion */
    rdbuf = kmalloc(PTDL_MAX_SIZE, GFP_KERNEL);
    if (!rdbuf)
    {
        unifi_error(card, "Couldn't alloc conversion buffer\n");
        return NULL;
    }

    /* Loader requires patch file's build ID to match the running firmware's */
    fw_id = card->build_id;

    /* Firmware XBV1 contains VERF, optional INFO, SLUT(s), FWDL(s)          */
    /* Other chunks should get skipped.                                      */
    /* VERF should be sanity-checked against chip version                    */

    /* Patch    XBV1 contains VERF, optional INFO, PTCH                      */
    /*          PTCH contains FWID, optional INFO, PTDL(s), PTDL(start_vec)  */
    /* Each FWDL is split into PTDLs (each is 1024 XAP words max)            */
    /* Each PTDL contains running ROM f/w version, and checksum              */
    /* MAC/PHY reset addresses (known) are added into a final PTDL           */

    /* The input image has already been parsed, and loaded into fwinfo, so we
     * can use that to build the output image
     */
    patch_buf_size = calc_patch_size(fwinfo);

    patch_buf = kmalloc(patch_buf_size, GFP_KERNEL);
    if (!patch_buf)
    {
        kfree(rdbuf);
        unifi_error(NULL, "Can't malloc buffer for patch conversion\n");
        return NULL;
    }

    memset(patch_buf, 0xdd, patch_buf_size);

    /* Write XBV + VERF headers */
    patch_offs += write_xbv_header(patch_buf, patch_offs, 0);
    payload_offs = patch_offs;

    /* Write patch (LIST) header */
    list_len_offs = patch_offs + 4;    /* Save LIST.length offset for later update */
    patch_offs += write_ptch_header(patch_buf, patch_offs, fw_id);

    /* Save start offset of the PTDL chunks */
    ptdl_start_offs = patch_offs;

    /* Write LIST of firmware PTDL blocks */
    for (i = 0; i < fwinfo->num_fwdl; i++)
    {
        patch_offs += write_fwdl_to_ptdl(patch_buf,
                                         patch_offs,
                                         readfn,
                                         &fwinfo->fwdl[i],
                                         fw_buf,
                                         fw_id,
                                         rdbuf);
    }

    /* Write restart-vector PTDL last */
    patch_offs += write_reset_ptdl(patch_buf, patch_offs, fwinfo, fw_id);

    /* Now the length is known, update the LIST.length */
    (void)write_uint32(patch_buf, list_len_offs,
                       (patch_offs - ptdl_start_offs) + PTCH_LIST_SIZE);

    /* Re write XBV headers just to fill in the correct file size */
    (void)write_xbv_header(patch_buf, 0, (patch_offs - payload_offs));

    unifi_trace(card->ospriv, UDBG1, "XBV:PTCH size %u, fw_id %u\n",
                patch_offs, fw_id);
    if (size)
    {
        *size = patch_offs;
    }
    kfree(rdbuf);

    return patch_buf;
}