drivers/aic8800d80
1
0
Fork 0
mirror of https://github.com/shenmintao/aic8800d80.git synced 2026-09-26 17:44:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: promote MCU1 legacy firmware profile

Browse Source
This commit is contained in:
Shen Mintao
2026-07-24 09:14:27 +08:00
parent 027a7a8662
commit cc2a888d22
3 changed files with 90 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -1
View File
@@ -1,11 +1,23 @@
# AIC8800D80 Linux Driver
This driver is for the AIC8800D80 chipset, supported by devices such as the Tenda U11 and AX913B.
> **Legacy MCU revision 1 branch:** You are viewing `legacy-mcu1`. This branch
> is only for AIC8800D80 devices that report `chip_id=7, chip_mcu_id=1` and fail
> the current V5 FMAC upload at `0x170400`. It uses the complete matched Radxa
> SDK V3 D80 firmware and loader profile validated in
> [issue #58](https://github.com/shenmintao/aic8800d80/issues/58). Use
> [`main`](https://github.com/shenmintao/aic8800d80/tree/main) for newer
> `chip_mcu_id=0` hardware or when the MCU revision is unknown. See the
> [legacy MCU1 support notes](tests/issue58-mcu1-legacy-fw/README.md) before
> installing.
Added support for devices with Vendor ID 368B (tested).
Tested on Linux kernel 6.16 with Ubuntu 25.04 and 6.1.0.27 with Debian 12.
> **Bluetooth Support**: The [`bluetooth`](https://github.com/shenmintao/aic8800d80/tree/bluetooth) branch fully supports Bluetooth. This main branch only provides Wi-Fi functionality. Please switch to the `bluetooth` branch if you need Bluetooth support.
> **Bluetooth support:** This branch initializes the integrated Bluetooth
> controller for the kernel's standard `btusb` driver. It does not contain or
> install `aic_btusb`.
### Disclaimer
I did not develop this software, The code is sourced from the Tenda U11 driver. I only made some modifications to the code to adapt it to newer kernel versions. Apart from compilation issues, I am unable to address other problems.
drivers/aic8800/aic_load_fw/aic_compat_8800d80.c
+2 -1
View File
@@ -246,7 +246,7 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){
}
chip_id = (u8)(rd_mem_addr_cfm.memdata >> 16);
printk("chip_id=%x, chip_mcu_id = %d\n", chip_id, chip_mcu_id);
printk("issue58: using Radxa SDK V3 D80 loader profile with MCU1 cache fix\n");
printk("AIC8800D80 legacy: using Radxa SDK V3 loader profile\n");
if (chip_mcu_id == 1) {
ret = rwnx_send_dbg_mem_read_req(usb_dev, cache_mem_addr, &rd_mem_addr_cfm);
if (ret) {
@@ -259,6 +259,7 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){
printk("%x write fail: %d\n", cache_mem_addr, ret);
return ret;
}
printk("AIC8800D80 MCU1: enabled Bluetooth cache fix\n");
}
#if 1
syscfg_num = sizeof(syscfg_tbl_8800d80) / sizeof(u32) / 2;
tests/issue58-mcu1-legacy-fw/README.md
+75 -91
View File
@@ -1,131 +1,115 @@
# Issue #58: V3 firmware and MCU1 Bluetooth cache test
# AIC8800D80 legacy MCU revision 1 support
This branch is an experimental build for
[issue #58](https://github.com/shenmintao/aic8800d80/issues/58). It is intended
only for AIC8800D80 devices reported as:
The `legacy-mcu1` branch is the maintained compatibility profile for the older
AIC8800D80 MCU revision tracked in
[issue #58](https://github.com/shenmintao/aic8800d80/issues/58), with related
reports in issues #14, #64, and #65. It is intended only for devices that log:
```text
chip_id=7, chip_mcu_id=1
```
Do not merge this branch as a general firmware downgrade. It replaces the
complete `fw/aic8800D80` firmware set and matches the D80 loader's FMAC patch
table and patch-buffer layout to that firmware generation. It additionally
sets bit 0 of register `0x40100020` only when `chip_mcu_id=1`, as tested in
[PR #35](https://github.com/shenmintao/aic8800d80/pull/35). The USB transport
and modern-kernel compatibility code remain current. Firmware and loader paths
for D80N, D80X2, DC, and other variants are not changed.
Affected adapters have been observed entering through `a69c:572f` or a similar
mass-storage ID, changing to `a69c:8d80` for firmware loading, and failing when
the SDK V5 FMAC upload reaches address `0x170400`.
## Hypothesis
## Root cause
The affected device times out when an FMAC upload reaches address `0x170400`.
With an upload base of `0x120000`, this suggests that the old MCU revision has
an FMAC RAM window of about `0x50400` (328,704) bytes.
The affected MCU revision cannot accept the complete SDK V5 FMAC image in its
available upload window. With an upload base of `0x120000`, the deterministic
failure at `0x170400` gives a limit of about `0x50400` (328,704) bytes.
| Firmware | Size | End address (exclusive) | Result relative to `0x170400` |
| Firmware | Size | End address (exclusive) | Relative to `0x170400` |
| --- | ---: | ---: | ---: |
| Current V5 FMAC | 358,072 bytes | `0x1776B8` | 29,368 bytes over |
| Legacy V3 FMAC in this branch | 327,037 bytes | `0x16FD7D` | 1,667 bytes free |
| SDK V5 FMAC on `main` | 358,072 bytes | `0x1776B8` | 29,368 bytes over |
| SDK V3 FMAC on this branch | 327,037 bytes | `0x16FD7D` | 1,667 bytes free |
This branch uses the complete matching D80 firmware set from Radxa SDK V3,
fixed at upstream commit
[`254d47e6a131dbed5ba32131972f4719f3e1c7fe`](https://github.com/radxa-pkg/aic8800/commit/254d47e6a131dbed5ba32131972f4719f3e1c7fe).
The normal FMAC file has SHA-256
`1ec680c2b63dcaa0e5d33c5fb6d1857d030f8145c05c385e243760388a61a0da`.
Replacing only the FMAC image is not sufficient. Earlier mixed-firmware tests
could enumerate but failed to provide a usable radio. This branch therefore
uses the complete matching AIC8800D80 firmware set from Radxa SDK V3, fixed at
upstream commit
[`254d47e6a131dbed5ba32131972f4719f3e1c7fe`](https://github.com/radxa-pkg/aic8800/commit/254d47e6a131dbed5ba32131972f4719f3e1c7fe),
together with its matching FMAC patch table and fixed patch-buffer layout.
Hardware testing of commit `7b2541e` proved that the matched V3 firmware and
loader upload completely without the `0x170400` timeout, re-enumerate as
`a69c:8d81`, and provide working 2.4 GHz and 5 GHz Wi-Fi. Its Bluetooth
interfaces bind to the kernel's standard `btusb` driver, but HCI initialization
fails with `Opcode 0x0c03 failed: -110`.
For `chip_mcu_id=1`, the loader also reads register `0x40100020`, sets bit 0,
and writes it back before firmware upload. This is the MCU1 Bluetooth cache fix
identified in [PR #35](https://github.com/shenmintao/aic8800d80/pull/35).
Bluetooth continues to use the kernel's standard `btusb` driver; this branch
does not contain or install `aic_btusb`.
This follow-up changes one loader behavior only: for MCU revision 1 it reads
register `0x40100020`, sets bit 0, and writes the value back before firmware
upload. PR #35 independently found that this is required for correct Bluetooth
firmware block writes on MCU1 and verified it with the system `btusb` driver.
This branch does not contain or install `aic_btusb`.
Firmware and loader paths for D80N, D80X2, DC, and other variants are unchanged.
## Install the test branch
## Hardware validation
The final profile was validated on a Steren COM-8231+ reporting
`chip_id=7, chip_mcu_id=1`. Test commit
[`027a7a8`](https://github.com/shenmintao/aic8800d80/commit/027a7a8)
demonstrated all of the following:
- the 327,037-byte FMAC uploads completely without `cmd timed-out` or
`bin upload fail: 170400`;
- the adapter completes `a69c:572f -> a69c:8d80 -> a69c:8d81` enumeration;
- 2.4 GHz and 5 GHz Wi-Fi scan, association, DHCP, and traffic work;
- USB interfaces 0 and 1 bind to system `btusb`, while interface 2 binds to
`aic8800_fdrv`;
- the earlier HCI Reset timeout `Opcode 0x0c03 failed: -110` is gone;
- Bluetooth scan and a real connection both succeed.
## Install
From an existing clone:
```bash
git fetch origin
git switch test/issue-58-mcu1-v3-fw-cache
git switch legacy-mcu1
git pull --ff-only
sudo ./install.sh
sudo reboot
```
Disconnect and reconnect the USB device after installation. Reboot if the
device does not re-enumerate cleanly.
The installer replaces the installed AIC firmware. Switching Git branches
without rerunning `install.sh` does not change the active firmware.
The expected V3 FMAC can be confirmed with:
```bash
stat -c '%s bytes' /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin
sha256sum /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin
```
Expected output:
```text
327037 bytes
1ec680c2b63dcaa0e5d33c5fb6d1857d030f8145c05c385e243760388a61a0da
```
## Verify
First save the complete kernel log and confirm that the V3 loader profile is
active, firmware upload passes the old failure address, and the adapter
re-enumerates after `a69c:8d80`:
After reboot or a physical disconnect/reconnect, check the complete device:
```bash
sudo dmesg -C
# Disconnect and reconnect the device, then wait for initialization.
sudo dmesg | tee issue58-v3-cache-dmesg.txt
sudo dmesg | grep -iE 'aic|issue58|chip_id|chip_mcu_id|fmacfw|bin upload|cmd timed-out|Bluetooth|btusb|0x0c03|error -110'
lsusb
sudo dmesg | grep -iE 'AIC8800D80|chip_id|chip_mcu_id|fmacfw|bin upload|cmd timed-out|Bluetooth|0x0c03|error -110'
lsusb -t
iw dev
bluetoothctl list
```
The log must contain:
The initialization log should contain:
```text
issue58: using Radxa SDK V3 D80 loader profile with MCU1 cache fix
AIC8800D80 legacy: using Radxa SDK V3 loader profile
AIC8800D80 MCU1: enabled Bluetooth cache fix
```
Please report all of the following, even if an earlier item fails:
`lsusb -t` should show Bluetooth interfaces using `btusb` and the Wi-Fi
interface using `aic8800_fdrv`. Verify traffic through the AIC network interface
rather than an onboard Wi-Fi adapter or phone/RNDIS connection.
1. The `chip_id` and `chip_mcu_id` lines, and whether firmware upload completes.
2. Whether the adapter re-enumerates and creates an interface owned by
`aic8800_fdrv`.
3. Whether nearby SSIDs can be scanned through that AIC interface.
4. Whether Wi-Fi association succeeds through that interface.
5. Whether the interface receives an address by DHCP.
6. Whether the gateway and an Internet address can be pinged, and whether real
traffic works.
7. Whether both Bluetooth interfaces are bound to the kernel's standard
`btusb` driver and the earlier HCI Reset timeout is gone.
8. Whether Bluetooth can scan, pair, and establish a real connection. This
test does not install or use `aic_btusb`.
## Return to current firmware
Useful commands:
```bash
iw dev
nmcli device status
nmcli device wifi list
ip address
ip route
lsusb -t
bluetoothctl list
bluetoothctl show
bluetoothctl scan on
```
Identify the new AIC interface with `iw dev`, then replace `wlan0` below with
that interface name. Confirm its driver before treating scan or traffic from
another onboard adapter as a successful result:
```bash
readlink -f /sys/class/net/wlan0/device/driver
sudo iw dev wlan0 scan | grep SSID
ip route show dev wlan0
ping -I wlan0 -c 4 1.1.1.1
```
The driver path should end in `/aic8800_fdrv`.
## Return to the current V5 firmware
The installer replaces the firmware under `/lib/firmware`, so merely switching
Git branches is not enough. Reinstall after returning to `main`:
Newer `chip_mcu_id=0` hardware should use `main`. Reinstall after switching so
that the V5 firmware is restored under `/lib/firmware`:
```bash
git switch main