Problems with AR4100 integration

[GottiLuca]

I've developed an application using the TWR-K60N512 , TWR-SER and TWR-WIFI-AR4100 boards. On the tower system all is running well.

Then I've replicated the tower on a custom pcb and i've found that the Atheros chip ( AR4100 ) cannot be initiliazed correctly.

Reading the AR4100 datasheet ( See the following link : http://cache.freescale.com/files/wireless_comm/doc/data_sheet/AR4100_DataSheet.pdf?fpsp=1&WT_TYPE=Da... , ) , I've found the following sentence :

"The AR4100 requires additional OTP programming during integration into end systems. More specifically, customer will need to program a MAC address and several additional bytes into the AR4100. See the 'Programming the AR4100 SIP and SPI Flash on the Freescale Tower' application note."

On the Freescale siste I cannot find the above application note.

Pls give me instructions on how to program the AR4100 MAC and all the rest  in order to put the AR4100 in correct operation !!!

[GottiLuca]

Just to clarify, my only problem now is about programming the Atheros OTP data ( MAC address and other "misterious" configuration bytes ..).

For the Atheros SPI Flash programming instead, the MQX patch already solved the problem suppling a file to be loaded on K60 flash , this file is in the <MQX_ROOT>\\FirmwareUpdate\K60 . Loading and running the file atheros_reflash(.out or .afx ) allows to re-program the Atheros SPI Flash ( assuming that the connection between K60 and Atheros are the same as on the tower system ) in 5-10 seconds ..

[GottiLuca · Accepted solution]

Dear all,

Freescale support has answer as below to my service request about this topic :

"

Please go to this link:

http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=TWR-WIFI-AR4100&fpsp=1&tab=Design_Too...

And download the manufacturing files.

Basically you need to do the next procedure.

To program the OTP and burn the firmware, you need three files for K60 MQX3.7

1.           intflash_d.afx

2.           flashotp.bin

3.           host.exe

The host.exe run on the PC, you should burn the intflash_d.afx to your MCU flash. The two programs communicate with each other.

You use the host.exe pass the flashotp.bin to AR4100 through the intflash_d.afx via  UART, Then the AR4100 run the flashotp.bin to burn the firmware and otp if need.

"

I've already tried and verified that the new tool allows to put in correct operation the AR4100 chip !!!

Many thanks to freescale and Qualcomm team !!!

[int51]

This procedure only works with the AR4100 tower board though.

As soon as you go for your own design you need to recompile the Agent with your own BSP.

However it seems some files from atheros are missing (includes). in the Manufactoring support tools

archive on Freescale website.

common_api.h

bmi.h

driver_cxt.h

are  nowhere to be found AFAIK

[GottiLuca]

Dear int51,

The project to be used to recompile the Agent software is in the MQX Patch ver. 1.5.2 ( available at the same link  : http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=TWR-WIFI-AR4100&fpsp=1&tab=Design_Too... ) .In my case , for example, i've to modify the serial port to communicate with the host and i've been able to do that by using the Agent software found in MQX 3.6.2 Patch ( project is in directory : <MQX_ROOT>\demo\flash_config ).

[kcameron]

Hi Guys,

The newest version of this patch (2.1) does not seem to contain the source files for the flash agent firmware. Does anyone have any idea how I would get my hands on the source? The original version of the K60 that the pre-compiled flash agent firmware is intended for is now obsolete, so I need to re-compile it for a K60 version that I can actually purchase in order to get it to run on my custom PCB. Currently I'm programming my MAC addresses using a tower module that has the correct version of the K60, but this is not a manufacturable solution.

Cheers,

Kyle

[huishao2]

Hi Kyle,

Any progress on your MAC address programming for manufacturing? I am trying not to use host.exe or ath_console.exe in factory.

Thanks!

Hui

[kcameron]

Hi Hui,

Yes! I was able to obtain the source for the flash agent firmware here:

Dropbox - TWR_WIFI_AR4100_MQX3_8_0_Patch.exe

This is going to be a very long post, but I'll try to describe in detail how I did it.

I used the source above to add the code that communicates to host.exe to my own project. This allowed me to snoop on the communications to host.exe in order to determine the information I needed to do the flashing on my own. It turns out this involves sending commands to the AR4100 that contain an address, some data and a length that tells the AR4100 to flash it's SPI memory. Once the memory is flashed, an execute command is needed that tells the AR4100 to reprogram it's firmware.

After the AR4100 is programmed, there is another command that lets you program the MAC address.

I've designed the flashing process as follows.

1. When my application boots, it looks for a location in SRAM to see if it is FF (which it will be after a fresh install of your application).
2. If it sees FF, it boots the AR4100 in BMI mode which is needed in order to send the commands to flash the SPI memory on the AR4100
3. After booting into BMI mode, I look for the presence of a .bin file I created (attached) that is a modified version of the "flashotp.bin" file Freescale provides.
4. If the .bin file exists, it proceeds to read from it and send the data it contains to the SPI memory on the AR4100 via the flash commands
5. After the programming is complete, it sends the execute command
6. After the execute completes, the location in SRAM is cleared and the processor is rebooted.
7. After booting into normal mode, the MAC address is programmed by sending the appropriate command to the AR4100

All of the commands I'm talking about are sent using functions I had to define in RTCS.c, which I have modified to suit my needs.

Now, to handle booting into BMI mode or normal mode, modify your "initialize_networking()" function in RTCS.c to look like the following. The key things to note are lines 32-41 where I decide how to boot the AR4100, then lines 57-65 where I either setup RTCS normally, or call the "handle_wifi_flash()" function. You'll need to add the attached file entitled "atheros_wifi_init.c" to your application's source directory.

/*FUNCTION*--------------------------------------------------------------------
 *
 * Function Name   : initialize_networking()
 * Returned Value  : void
 * Comments        : Sets up the TCP/IP stack, Wi-Fi device, Telnet and FTP
 *END*------------------------------------------------------------------------*/
void initialize_networking(boolean mode)
{
    int_32 error = RTCS_ERROR;
    _enet_address IPCFG_default_enet_address = BSP_DEFAULT_ENET_OUI;
    uint_32 IPCFG_default_enet_device = BSP_DEFAULT_ENET_DEVICE;
    _ip_address IPCFG_default_ip_address = DEFAULT_IP_ADDRESS;

#if RTCS_MINIMUM_FOOTPRINT
    /* runtime RTCS configuration for devices with small RAM, for others the default BSP setting is used */
    _RTCSPCB_init          =  4;
    _RTCSPCB_grow          =  2;
    _RTCSPCB_max           =  6;                                
    _RTCS_msgpool_init     =  4;
    _RTCS_msgpool_grow     =  2;
    _RTCS_msgpool_max      =  6;                                
    _RTCS_socket_part_init =  4;
    _RTCS_socket_part_grow =  2;
    _RTCS_socket_part_max  =  6;                                
    _RTCSTASK_stacksize    = 1900; // TODO: (KDC) this was 3000
    _RTCSTASK_priority     = 6;
#endif

    error = (int_32)RTCS_create();
    if (error == RTCS_OK)
    {
        if (mode == NORMAL_MODE)
        {
            // Set up the driver to boot the AR4100 normally
            atheros_driver_init();
        }
        else
        {
            // Set up the driver to boot the AR4100 in BMI mode (used for programming the firmware)
            atheros_driver_init_bmi();
        }

        ENET_get_mac_address(IPCFG_default_enet_device,IPCFG_default_ip_address, IPCFG_default_enet_address);

        error = (int_32)ipcfg_init_device_wifi(IPCFG_default_enet_device, IPCFG_default_enet_address);

        /* ENET_initialize is already called from within ipcfg_init_device.  We call it again
         * so that we can get a handle to the driver allowing this code to make direct driver
         * calls as needed. */
        error = (int_32)ENET_initialize_wifi(IPCFG_default_enet_device,IPCFG_default_enet_address,0,&handle);
        if (error != ENETERR_INITIALIZED_DEVICE)
        {
            debug_printf("Failed to initialize Wi-Fi...\n");
            SPIN_FOREVER;
        }

        if (mode == NORMAL_MODE)
        {
            // Set things up like you normally would here
        }
        else
        {
            // Now that we're in BMI mode and the driver is initialized, program the SPI flash for the AR4100
            handle_wifi_flash();
        }
    }
    else
    { // if the rtcs doesn't create
        printf("\nRTCS_Create failed !\n");
        _task_block();
    }
}

This is the implementation of the handle_wifi_flash() function. I'm assuming you have an SD card to save "wifi_flash_img.bin" to - if you don't have an SD card you'll have to figure something else out.

#define AR4100_FLASH_FILENAME "wifi_flash_img.bin"
#define WIFI_FLASH_START_ADDR 0x1234
#define FLASH_BUFF_SZ  100
#define WIFI_FLASH_LOAD_ADDR 0x946E00

/*FUNCTION*-------------------------------------------------------------
 *
 * Function Name   : handle_wifi_flash()
 * Returned Value  : This function never returns.
 * Comments        : Programs the SPI flash memory for the AR4100
 *
 *END*-----------------------------------------------------------------*/
void handle_wifi_flash(void)
{
    ATH_PROGRAM_FLASH_STRUCT flashMsg;
    ATH_IOCTL_PARAM_STRUCT   inout_param;
    uint_32       error = A_ERROR;
    LWGPIO_STRUCT led;
    boolean       led_blink = FALSE;
    MQX_FILE_PTR  file_handle;
    char          file_name[FILENAME_SIZE + 1]  = MAIN_ROOT_FILE_PATH;
    uint_8        buffer[FLASH_BUFF_SZ];

    printf("-------- AR4100 Flash Start\n");

    // Let the SD card task startup so we'll be able to access the file system
    _time_delay(2000);

    printf("Opening flash file on SD card ... ");

    // Open image file on SD card
    strncat((char *)file_name, AR4100_FLASH_FILENAME, strlen(AR4100_FLASH_FILENAME));
    file_handle = fopen(file_name, "r");
    if(NULL == file_handle)
    {
        printf("Could not open flash file.\n");
        return;
    }

    printf("Done!\n");

    printf("Sending flash commands to AR4100. The LED will blink for each command ... ");

    // Set the initial address
    flashMsg.load_addr = WIFI_FLASH_START_ADDR;

    // Point the buffer pointer at the buffer we'll be using to read in data
    flashMsg.buffer = buffer;

    // Read the first <length> bytes of the image file
    flashMsg.length = (A_UINT16)read(file_handle, buffer, FLASH_BUFF_SZ);

    //send flash command
    inout_param.cmd_id = ATH_PROGRAM_FLASH;
    inout_param.data = &flashMsg;
    inout_param.length = sizeof(flashMsg);

    error = handle_ioctl(&inout_param);
    if(A_ERROR == error)
    {
        printf("Flash command failed.\n");
        _task_block();
    }

    _time_delay(10);

    while(flashMsg.length == FLASH_BUFF_SZ)
    {
        // Increment the address
        flashMsg.load_addr += flashMsg.length;

        // Read the next <length> bytes of data from the file
        //Note: Might reach the end of the file, in which case the read length will be less than the requested read length
        flashMsg.length = (A_UINT16)read(file_handle, buffer, FLASH_BUFF_SZ);

        // Set the length again in case it changed
        inout_param.length = sizeof(flashMsg);

        // Send flash command
        error = handle_ioctl(&inout_param);
        if(A_ERROR == error)
        {
            printf("Flash command failed.\n");
            _task_block();
        }

        _time_delay(10);
    }

    // Close the file now that we're done with it
    fclose(file_handle);

    printf("Done!\n");

    // Tell AR4100 to execute from the location we programmed.
    flashMsg.load_addr = WIFI_FLASH_LOAD_ADDR;
    flashMsg.length = 0;
    flashMsg.result = WIFI_FLASH_OPTIONS;
    flashMsg.buffer = NULL;

    inout_param.cmd_id = ATH_EXECUTE_FLASH;
    inout_param.data = &flashMsg;
    inout_param.length = sizeof(flashMsg);

    printf("Sending execute command to AR4100. This will take ~30 seconds to complete ... ");

    error = handle_ioctl(&inout_param);
    if(A_ERROR == error)
    {
        printf("Execute command failed.\n");
        _task_block();
    }

    printf("Done!\n");
    printf("Rebooting into normal mode.\n");

    // Clear the flash in SRAM here!

    _time_delay(2000);

    // Reset the processor here!
}

Then, this is how I program the MAC address once I've flashed wifi.

/*FUNCTION*-------------------------------------------------------------
 *
 * Function Name   : set_wifi_mac_address()
 * Returned Value  : A_OK if wifi MAC set successfully else ERROR CODE
 * Comments        : Sets the Wi-Fi MAC using the lower level Atheros API
 *
 *END*-----------------------------------------------------------------*/
uint_32 set_wifi_mac_address(uint_8* address)
{
    ATH_IOCTL_PARAM_STRUCT inout_param;
    ATH_PROGRAM_MAC_ADDR_PARAM  mac_addr_struct;
    uint_32 error = A_ERROR;
    uint_8 current_mac[6];

    //Check to see if the value we are trying to program is already programmed.
    get_wifi_mac_address(current_mac);

    if (address[0] == current_mac[0] &&
       address[1] == current_mac[1] &&
       address[2] == current_mac[2] &&
       address[3] == current_mac[3] &&
       address[4] == current_mac[4] &&
       address[5] == current_mac[5])
    {
        printf("MAC address already programmed.\n");
        return A_OK;
    }
    else
    {
        mac_addr_struct.addr[0] = address[0];
        mac_addr_struct.addr[1] = address[1];
        mac_addr_struct.addr[2] = address[2];
        mac_addr_struct.addr[3] = address[3];
        mac_addr_struct.addr[4] = address[4];
        mac_addr_struct.addr[5] = address[5];

        inout_param.cmd_id = ATH_PROGRAM_MAC_ADDR;
        inout_param.data = &mac_addr_struct;
        inout_param.length = sizeof(mac_addr_struct);

        if (is_driver_initialized() != A_OK)
        {
            return A_ERROR;
        }

        error = handle_ioctl(&inout_param);

        if (error == A_OK)
        {
            uint_32 read_value = SCB_AIRCR;

            // Bring Wi-Fi down
            set_wifi_chip_state(WIFI_DOWN);

            // Wait for the AR4100 and driver to go down
            _time_delay(100);

            // Reset K60
            read_value &= ~SCB_AIRCR_VECTKEY_MASK;
            read_value |= SCB_AIRCR_VECTKEY(0x05FA);
            read_value |= SCB_AIRCR_SYSRESETREQ_MASK;
            _int_disable();
            SCB_AIRCR = read_value;
            while (1){}
        }
    }
    return error;
}

You'll need these functions also - they're called within the functions I've got above.

typedef enum
{
    WIFI_DOWN,
    WIFI_UP
} Wifi_Up_Down_State_t;

/*FUNCTION*-------------------------------------------------------------
 *
 * Function Name   : wifi_chip_state()
 * Returned Value  : A_OK if wifi chip state set successfully else A_ERROR
 * Comments        : Special command to bring driver + wifi device up or down without
 *                   officially shutting down the driver. This allows a task to shutdown the chip
 *                   but prevents other tasks from having invalid enet_ptr's.
 *
 *END*-----------------------------------------------------------------*/
static uint_32 set_wifi_chip_state(Wifi_Up_Down_State_t desired_up_Down_state)
{
    static LWGPIO_STRUCT   wifi_chip_pwd_pin;
    static boolean         wifi_chip_pwd_pin__is_initialised = FALSE;
    ATH_IOCTL_PARAM_STRUCT inout_param;
    uint_32                data_val;
    uint_32                error = A_ERROR;

    // initialise the WiFi chip power-down pin, once
    if (wifi_chip_pwd_pin__is_initialised == FALSE)
    {
        if (lwgpio_init(&wifi_chip_pwd_pin, WIFI_CHIP_PWD__GPIO_PIN, LWGPIO_DIR_OUTPUT, LWGPIO_VALUE_NOCHANGE) == FALSE)
        {
            debug_printf("Initialising PWD GPIO as output failed.\n");
            _task_block();
        }
        // switch pin functionality (MUX) to GPIO mode
        lwgpio_set_functionality(&wifi_chip_pwd_pin, WIFI_CHIP_PWD__GPIO_MUX);
        wifi_chip_pwd_pin__is_initialised = TRUE;
    }

    if (desired_up_Down_state == WIFI_DOWN)
    {
        // This is to prevent unhandled interrupts in the TCP/IP task
        ipcfg_unbind(BSP_DEFAULT_ENET_DEVICE);
        data_val = 0;
    }
    else 
    {
          data_val = 1;
    }

    inout_param.cmd_id = ATH_CHIP_STATE;
    inout_param.data   = &data_val;
    inout_param.length = sizeof(data_val);

    // Send chip state command to AR4100
    error = handle_ioctl(&inout_param);

    if (error == A_OK)
    {
        if (desired_up_Down_state == WIFI_DOWN)
        {
            // De-assert PWD pin to keep AR4100 down. If this isn't done PWD will be floating after the driver goes down and the wifi power will cycle randomly.
            lwgpio_set_value(&wifi_chip_pwd_pin, LWGPIO_VALUE_LOW);
        }
    }
    else
    {
        // There was an error returned when we tried to send the command to the AR4100
        printf("Wi-Fi chip state could not be set...\n");
    }

    return error;
}

/*FUNCTION*--------------------------------------------------------------------
 *
 * Function Name   : handle_ioctl()
 * Returned Value  : A_OK if mode set successful else A_ERROR or A_EBUSY
 * Comments        : Sends a vendor specific command to the Wi-Fi device
 *END*------------------------------------------------------------------------*/
static A_STATUS handle_ioctl(ATH_IOCTL_PARAM_STRUCT* inout_param)
{
    A_STATUS status = A_OK;

    uint_32 error = ENET_mediactl(handle, ENET_MEDIACTL_VENDOR_SPECIFIC, inout_param);

    if (ENET_OK != error)
    {
        status = (error == ENETERR_INPROGRESS) ? A_EBUSY : A_ERROR;
    }

    return status;
}

I hope this help! I spent probably 40 or more hours trying to figure this out, so hopefully I've saved you a bunch of time.

Kyle