From cc2a888d22129b35f45fefece1f3010ed5f7abcd Mon Sep 17 00:00:00 2001 From: Shen Mintao Date: Fri, 24 Jul 2026 09:14:27 +0800 Subject: [PATCH] docs: promote MCU1 legacy firmware profile --- README.md | 14 +- .../aic8800/aic_load_fw/aic_compat_8800d80.c | 3 +- tests/issue58-mcu1-legacy-fw/README.md | 166 ++++++++---------- 3 files changed, 90 insertions(+), 93 deletions(-) diff --git a/README.md b/README.md index 3b5916b..39102eb 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,23 @@ # AIC8800D80 Linux Driver This driver is for the AIC8800D80 chipset, supported by devices such as the Tenda U11 and AX913B. +> **Legacy MCU revision 1 branch:** You are viewing `legacy-mcu1`. This branch +> is only for AIC8800D80 devices that report `chip_id=7, chip_mcu_id=1` and fail +> the current V5 FMAC upload at `0x170400`. It uses the complete matched Radxa +> SDK V3 D80 firmware and loader profile validated in +> [issue #58](https://github.com/shenmintao/aic8800d80/issues/58). Use +> [`main`](https://github.com/shenmintao/aic8800d80/tree/main) for newer +> `chip_mcu_id=0` hardware or when the MCU revision is unknown. See the +> [legacy MCU1 support notes](tests/issue58-mcu1-legacy-fw/README.md) before +> installing. + Added support for devices with Vendor ID 368B (tested). Tested on Linux kernel 6.16 with Ubuntu 25.04 and 6.1.0.27 with Debian 12. -> **Bluetooth Support**: The [`bluetooth`](https://github.com/shenmintao/aic8800d80/tree/bluetooth) branch fully supports Bluetooth. This main branch only provides Wi-Fi functionality. Please switch to the `bluetooth` branch if you need Bluetooth support. +> **Bluetooth support:** This branch initializes the integrated Bluetooth +> controller for the kernel's standard `btusb` driver. It does not contain or +> install `aic_btusb`. ### Disclaimer I did not develop this software, The code is sourced from the Tenda U11 driver. I only made some modifications to the code to adapt it to newer kernel versions. Apart from compilation issues, I am unable to address other problems. diff --git a/drivers/aic8800/aic_load_fw/aic_compat_8800d80.c b/drivers/aic8800/aic_load_fw/aic_compat_8800d80.c index 8bcb022..f80596c 100644 --- a/drivers/aic8800/aic_load_fw/aic_compat_8800d80.c +++ b/drivers/aic8800/aic_load_fw/aic_compat_8800d80.c @@ -246,7 +246,7 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){ } chip_id = (u8)(rd_mem_addr_cfm.memdata >> 16); printk("chip_id=%x, chip_mcu_id = %d\n", chip_id, chip_mcu_id); - printk("issue58: using Radxa SDK V3 D80 loader profile with MCU1 cache fix\n"); + printk("AIC8800D80 legacy: using Radxa SDK V3 loader profile\n"); if (chip_mcu_id == 1) { ret = rwnx_send_dbg_mem_read_req(usb_dev, cache_mem_addr, &rd_mem_addr_cfm); if (ret) { @@ -259,6 +259,7 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){ printk("%x write fail: %d\n", cache_mem_addr, ret); return ret; } + printk("AIC8800D80 MCU1: enabled Bluetooth cache fix\n"); } #if 1 syscfg_num = sizeof(syscfg_tbl_8800d80) / sizeof(u32) / 2; diff --git a/tests/issue58-mcu1-legacy-fw/README.md b/tests/issue58-mcu1-legacy-fw/README.md index e92baf6..de1b45f 100644 --- a/tests/issue58-mcu1-legacy-fw/README.md +++ b/tests/issue58-mcu1-legacy-fw/README.md @@ -1,131 +1,115 @@ -# Issue #58: V3 firmware and MCU1 Bluetooth cache test +# AIC8800D80 legacy MCU revision 1 support -This branch is an experimental build for -[issue #58](https://github.com/shenmintao/aic8800d80/issues/58). It is intended -only for AIC8800D80 devices reported as: +The `legacy-mcu1` branch is the maintained compatibility profile for the older +AIC8800D80 MCU revision tracked in +[issue #58](https://github.com/shenmintao/aic8800d80/issues/58), with related +reports in issues #14, #64, and #65. It is intended only for devices that log: ```text chip_id=7, chip_mcu_id=1 ``` -Do not merge this branch as a general firmware downgrade. It replaces the -complete `fw/aic8800D80` firmware set and matches the D80 loader's FMAC patch -table and patch-buffer layout to that firmware generation. It additionally -sets bit 0 of register `0x40100020` only when `chip_mcu_id=1`, as tested in -[PR #35](https://github.com/shenmintao/aic8800d80/pull/35). The USB transport -and modern-kernel compatibility code remain current. Firmware and loader paths -for D80N, D80X2, DC, and other variants are not changed. +Affected adapters have been observed entering through `a69c:572f` or a similar +mass-storage ID, changing to `a69c:8d80` for firmware loading, and failing when +the SDK V5 FMAC upload reaches address `0x170400`. -## Hypothesis +## Root cause -The affected device times out when an FMAC upload reaches address `0x170400`. -With an upload base of `0x120000`, this suggests that the old MCU revision has -an FMAC RAM window of about `0x50400` (328,704) bytes. +The affected MCU revision cannot accept the complete SDK V5 FMAC image in its +available upload window. With an upload base of `0x120000`, the deterministic +failure at `0x170400` gives a limit of about `0x50400` (328,704) bytes. -| Firmware | Size | End address (exclusive) | Result relative to `0x170400` | +| Firmware | Size | End address (exclusive) | Relative to `0x170400` | | --- | ---: | ---: | ---: | -| Current V5 FMAC | 358,072 bytes | `0x1776B8` | 29,368 bytes over | -| Legacy V3 FMAC in this branch | 327,037 bytes | `0x16FD7D` | 1,667 bytes free | +| SDK V5 FMAC on `main` | 358,072 bytes | `0x1776B8` | 29,368 bytes over | +| SDK V3 FMAC on this branch | 327,037 bytes | `0x16FD7D` | 1,667 bytes free | -This branch uses the complete matching D80 firmware set from Radxa SDK V3, -fixed at upstream commit -[`254d47e6a131dbed5ba32131972f4719f3e1c7fe`](https://github.com/radxa-pkg/aic8800/commit/254d47e6a131dbed5ba32131972f4719f3e1c7fe). -The normal FMAC file has SHA-256 -`1ec680c2b63dcaa0e5d33c5fb6d1857d030f8145c05c385e243760388a61a0da`. +Replacing only the FMAC image is not sufficient. Earlier mixed-firmware tests +could enumerate but failed to provide a usable radio. This branch therefore +uses the complete matching AIC8800D80 firmware set from Radxa SDK V3, fixed at +upstream commit +[`254d47e6a131dbed5ba32131972f4719f3e1c7fe`](https://github.com/radxa-pkg/aic8800/commit/254d47e6a131dbed5ba32131972f4719f3e1c7fe), +together with its matching FMAC patch table and fixed patch-buffer layout. -Hardware testing of commit `7b2541e` proved that the matched V3 firmware and -loader upload completely without the `0x170400` timeout, re-enumerate as -`a69c:8d81`, and provide working 2.4 GHz and 5 GHz Wi-Fi. Its Bluetooth -interfaces bind to the kernel's standard `btusb` driver, but HCI initialization -fails with `Opcode 0x0c03 failed: -110`. +For `chip_mcu_id=1`, the loader also reads register `0x40100020`, sets bit 0, +and writes it back before firmware upload. This is the MCU1 Bluetooth cache fix +identified in [PR #35](https://github.com/shenmintao/aic8800d80/pull/35). +Bluetooth continues to use the kernel's standard `btusb` driver; this branch +does not contain or install `aic_btusb`. -This follow-up changes one loader behavior only: for MCU revision 1 it reads -register `0x40100020`, sets bit 0, and writes the value back before firmware -upload. PR #35 independently found that this is required for correct Bluetooth -firmware block writes on MCU1 and verified it with the system `btusb` driver. -This branch does not contain or install `aic_btusb`. +Firmware and loader paths for D80N, D80X2, DC, and other variants are unchanged. -## Install the test branch +## Hardware validation + +The final profile was validated on a Steren COM-8231+ reporting +`chip_id=7, chip_mcu_id=1`. Test commit +[`027a7a8`](https://github.com/shenmintao/aic8800d80/commit/027a7a8) +demonstrated all of the following: + +- the 327,037-byte FMAC uploads completely without `cmd timed-out` or + `bin upload fail: 170400`; +- the adapter completes `a69c:572f -> a69c:8d80 -> a69c:8d81` enumeration; +- 2.4 GHz and 5 GHz Wi-Fi scan, association, DHCP, and traffic work; +- USB interfaces 0 and 1 bind to system `btusb`, while interface 2 binds to + `aic8800_fdrv`; +- the earlier HCI Reset timeout `Opcode 0x0c03 failed: -110` is gone; +- Bluetooth scan and a real connection both succeed. + +## Install From an existing clone: ```bash git fetch origin -git switch test/issue-58-mcu1-v3-fw-cache +git switch legacy-mcu1 git pull --ff-only sudo ./install.sh +sudo reboot ``` -Disconnect and reconnect the USB device after installation. Reboot if the -device does not re-enumerate cleanly. +The installer replaces the installed AIC firmware. Switching Git branches +without rerunning `install.sh` does not change the active firmware. + +The expected V3 FMAC can be confirmed with: + +```bash +stat -c '%s bytes' /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin +sha256sum /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin +``` + +Expected output: + +```text +327037 bytes +1ec680c2b63dcaa0e5d33c5fb6d1857d030f8145c05c385e243760388a61a0da +``` ## Verify -First save the complete kernel log and confirm that the V3 loader profile is -active, firmware upload passes the old failure address, and the adapter -re-enumerates after `a69c:8d80`: +After reboot or a physical disconnect/reconnect, check the complete device: ```bash -sudo dmesg -C -# Disconnect and reconnect the device, then wait for initialization. -sudo dmesg | tee issue58-v3-cache-dmesg.txt -sudo dmesg | grep -iE 'aic|issue58|chip_id|chip_mcu_id|fmacfw|bin upload|cmd timed-out|Bluetooth|btusb|0x0c03|error -110' -lsusb +sudo dmesg | grep -iE 'AIC8800D80|chip_id|chip_mcu_id|fmacfw|bin upload|cmd timed-out|Bluetooth|0x0c03|error -110' lsusb -t +iw dev +bluetoothctl list ``` -The log must contain: +The initialization log should contain: ```text -issue58: using Radxa SDK V3 D80 loader profile with MCU1 cache fix +AIC8800D80 legacy: using Radxa SDK V3 loader profile +AIC8800D80 MCU1: enabled Bluetooth cache fix ``` -Please report all of the following, even if an earlier item fails: +`lsusb -t` should show Bluetooth interfaces using `btusb` and the Wi-Fi +interface using `aic8800_fdrv`. Verify traffic through the AIC network interface +rather than an onboard Wi-Fi adapter or phone/RNDIS connection. -1. The `chip_id` and `chip_mcu_id` lines, and whether firmware upload completes. -2. Whether the adapter re-enumerates and creates an interface owned by - `aic8800_fdrv`. -3. Whether nearby SSIDs can be scanned through that AIC interface. -4. Whether Wi-Fi association succeeds through that interface. -5. Whether the interface receives an address by DHCP. -6. Whether the gateway and an Internet address can be pinged, and whether real - traffic works. -7. Whether both Bluetooth interfaces are bound to the kernel's standard - `btusb` driver and the earlier HCI Reset timeout is gone. -8. Whether Bluetooth can scan, pair, and establish a real connection. This - test does not install or use `aic_btusb`. +## Return to current firmware -Useful commands: - -```bash -iw dev -nmcli device status -nmcli device wifi list -ip address -ip route -lsusb -t -bluetoothctl list -bluetoothctl show -bluetoothctl scan on -``` - -Identify the new AIC interface with `iw dev`, then replace `wlan0` below with -that interface name. Confirm its driver before treating scan or traffic from -another onboard adapter as a successful result: - -```bash -readlink -f /sys/class/net/wlan0/device/driver -sudo iw dev wlan0 scan | grep SSID -ip route show dev wlan0 -ping -I wlan0 -c 4 1.1.1.1 -``` - -The driver path should end in `/aic8800_fdrv`. - -## Return to the current V5 firmware - -The installer replaces the firmware under `/lib/firmware`, so merely switching -Git branches is not enough. Reinstall after returning to `main`: +Newer `chip_mcu_id=0` hardware should use `main`. Reinstall after switching so +that the V5 firmware is restored under `/lib/firmware`: ```bash git switch main