1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2013 Broadcom Corporation
4  */
5 
6 #include <linux/efi.h>
7 #include <linux/kernel.h>
8 #include <linux/slab.h>
9 #include <linux/device.h>
10 #include <linux/firmware.h>
11 #include <linux/module.h>
12 #include <linux/bcm47xx_nvram.h>
13 
14 #include "debug.h"
15 #include "firmware.h"
16 #include "core.h"
17 #include "common.h"
18 #include "chip.h"
19 
20 #define BRCMF_FW_MAX_NVRAM_SIZE			64000
21 #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
22 #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
23 #define BRCMF_FW_DEFAULT_BOARDREV		"boardrev=0xff"
24 
25 enum nvram_parser_state {
26 	IDLE,
27 	KEY,
28 	VALUE,
29 	COMMENT,
30 	END
31 };
32 
33 /**
34  * struct nvram_parser - internal info for parser.
35  *
36  * @state: current parser state.
37  * @data: input buffer being parsed.
38  * @nvram: output buffer with parse result.
39  * @nvram_len: length of parse result.
40  * @line: current line.
41  * @column: current column in line.
42  * @pos: byte offset in input buffer.
43  * @entry: start position of key,value entry.
44  * @multi_dev_v1: detect pcie multi device v1 (compressed).
45  * @multi_dev_v2: detect pcie multi device v2.
46  * @boardrev_found: nvram contains boardrev information.
47  */
48 struct nvram_parser {
49 	enum nvram_parser_state state;
50 	const u8 *data;
51 	u8 *nvram;
52 	u32 nvram_len;
53 	u32 line;
54 	u32 column;
55 	u32 pos;
56 	u32 entry;
57 	bool multi_dev_v1;
58 	bool multi_dev_v2;
59 	bool boardrev_found;
60 };
61 
62 /*
63  * is_nvram_char() - check if char is a valid one for NVRAM entry
64  *
65  * It accepts all printable ASCII chars except for '#' which opens a comment.
66  * Please note that ' ' (space) while accepted is not a valid key name char.
67  */
is_nvram_char(char c)68 static bool is_nvram_char(char c)
69 {
70 	/* comment marker excluded */
71 	if (c == '#')
72 		return false;
73 
74 	/* key and value may have any other readable character */
75 	return (c >= 0x20 && c < 0x7f);
76 }
77 
is_whitespace(char c)78 static bool is_whitespace(char c)
79 {
80 	return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
81 }
82 
brcmf_nvram_handle_idle(struct nvram_parser *nvp)83 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
84 {
85 	char c;
86 
87 	c = nvp->data[nvp->pos];
88 	if (c == '\n')
89 		return COMMENT;
90 	if (is_whitespace(c) || c == '\0')
91 		goto proceed;
92 	if (c == '#')
93 		return COMMENT;
94 	if (is_nvram_char(c)) {
95 		nvp->entry = nvp->pos;
96 		return KEY;
97 	}
98 	brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
99 		  nvp->line, nvp->column);
100 proceed:
101 	nvp->column++;
102 	nvp->pos++;
103 	return IDLE;
104 }
105 
brcmf_nvram_handle_key(struct nvram_parser *nvp)106 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
107 {
108 	enum nvram_parser_state st = nvp->state;
109 	char c;
110 
111 	c = nvp->data[nvp->pos];
112 	if (c == '=') {
113 		/* ignore RAW1 by treating as comment */
114 		if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
115 			st = COMMENT;
116 		else
117 			st = VALUE;
118 		if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
119 			nvp->multi_dev_v1 = true;
120 		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
121 			nvp->multi_dev_v2 = true;
122 		if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
123 			nvp->boardrev_found = true;
124 	} else if (!is_nvram_char(c) || c == ' ') {
125 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
126 			  nvp->line, nvp->column);
127 		return COMMENT;
128 	}
129 
130 	nvp->column++;
131 	nvp->pos++;
132 	return st;
133 }
134 
135 static enum nvram_parser_state
brcmf_nvram_handle_value(struct nvram_parser *nvp)136 brcmf_nvram_handle_value(struct nvram_parser *nvp)
137 {
138 	char c;
139 	char *skv;
140 	char *ekv;
141 	u32 cplen;
142 
143 	c = nvp->data[nvp->pos];
144 	if (!is_nvram_char(c)) {
145 		/* key,value pair complete */
146 		ekv = (u8 *)&nvp->data[nvp->pos];
147 		skv = (u8 *)&nvp->data[nvp->entry];
148 		cplen = ekv - skv;
149 		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
150 			return END;
151 		/* copy to output buffer */
152 		memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
153 		nvp->nvram_len += cplen;
154 		nvp->nvram[nvp->nvram_len] = '\0';
155 		nvp->nvram_len++;
156 		return IDLE;
157 	}
158 	nvp->pos++;
159 	nvp->column++;
160 	return VALUE;
161 }
162 
163 static enum nvram_parser_state
brcmf_nvram_handle_comment(struct nvram_parser *nvp)164 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
165 {
166 	char *eoc, *sol;
167 
168 	sol = (char *)&nvp->data[nvp->pos];
169 	eoc = strchr(sol, '\n');
170 	if (!eoc) {
171 		eoc = strchr(sol, '\0');
172 		if (!eoc)
173 			return END;
174 	}
175 
176 	/* eat all moving to next line */
177 	nvp->line++;
178 	nvp->column = 1;
179 	nvp->pos += (eoc - sol) + 1;
180 	return IDLE;
181 }
182 
brcmf_nvram_handle_end(struct nvram_parser *nvp)183 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
184 {
185 	/* final state */
186 	return END;
187 }
188 
189 static enum nvram_parser_state
190 (*nv_parser_states[])(struct nvram_parser *nvp) = {
191 	brcmf_nvram_handle_idle,
192 	brcmf_nvram_handle_key,
193 	brcmf_nvram_handle_value,
194 	brcmf_nvram_handle_comment,
195 	brcmf_nvram_handle_end
196 };
197 
brcmf_init_nvram_parser(struct nvram_parser *nvp, const u8 *data, size_t data_len)198 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
199 				   const u8 *data, size_t data_len)
200 {
201 	size_t size;
202 
203 	memset(nvp, 0, sizeof(*nvp));
204 	nvp->data = data;
205 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
206 	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
207 		size = BRCMF_FW_MAX_NVRAM_SIZE;
208 	else
209 		size = data_len;
210 	/* Add space for properties we may add */
211 	size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
212 	/* Alloc for extra 0 byte + roundup by 4 + length field */
213 	size += 1 + 3 + sizeof(u32);
214 	nvp->nvram = kzalloc(size, GFP_KERNEL);
215 	if (!nvp->nvram)
216 		return -ENOMEM;
217 
218 	nvp->line = 1;
219 	nvp->column = 1;
220 	return 0;
221 }
222 
223 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
224  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
225  * which data is to be returned. v1 is the version where nvram is stored
226  * compressed and "devpath" maps to index for valid entries.
227  */
brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr, u16 bus_nr)228 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
229 				    u16 bus_nr)
230 {
231 	/* Device path with a leading '=' key-value separator */
232 	char pci_path[] = "=pci/?/?";
233 	size_t pci_len;
234 	char pcie_path[] = "=pcie/?/?";
235 	size_t pcie_len;
236 
237 	u32 i, j;
238 	bool found;
239 	u8 *nvram;
240 	u8 id;
241 
242 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
243 	if (!nvram)
244 		goto fail;
245 
246 	/* min length: devpath0=pcie/1/4/ + 0:x=y */
247 	if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
248 		goto fail;
249 
250 	/* First search for the devpathX and see if it is the configuration
251 	 * for domain_nr/bus_nr. Search complete nvp
252 	 */
253 	snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
254 		 bus_nr);
255 	pci_len = strlen(pci_path);
256 	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
257 		 bus_nr);
258 	pcie_len = strlen(pcie_path);
259 	found = false;
260 	i = 0;
261 	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
262 		/* Format: devpathX=pcie/Y/Z/
263 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
264 		 */
265 		if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
266 		    (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
267 		     !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
268 			id = nvp->nvram[i + 7] - '0';
269 			found = true;
270 			break;
271 		}
272 		while (nvp->nvram[i] != 0)
273 			i++;
274 		i++;
275 	}
276 	if (!found)
277 		goto fail;
278 
279 	/* Now copy all valid entries, release old nvram and assign new one */
280 	i = 0;
281 	j = 0;
282 	while (i < nvp->nvram_len) {
283 		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
284 			i += 2;
285 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
286 				nvp->boardrev_found = true;
287 			while (nvp->nvram[i] != 0) {
288 				nvram[j] = nvp->nvram[i];
289 				i++;
290 				j++;
291 			}
292 			nvram[j] = 0;
293 			j++;
294 		}
295 		while (nvp->nvram[i] != 0)
296 			i++;
297 		i++;
298 	}
299 	kfree(nvp->nvram);
300 	nvp->nvram = nvram;
301 	nvp->nvram_len = j;
302 	return;
303 
304 fail:
305 	kfree(nvram);
306 	nvp->nvram_len = 0;
307 }
308 
309 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
310  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
311  * which data is to be returned. v2 is the version where nvram is stored
312  * uncompressed, all relevant valid entries are identified by
313  * pcie/domain_nr/bus_nr:
314  */
brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr, u16 bus_nr)315 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
316 				    u16 bus_nr)
317 {
318 	char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
319 	size_t len;
320 	u32 i, j;
321 	u8 *nvram;
322 
323 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
324 	if (!nvram)
325 		goto fail;
326 
327 	/* Copy all valid entries, release old nvram and assign new one.
328 	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
329 	 * Y = bus_nr.
330 	 */
331 	snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
332 	len = strlen(prefix);
333 	i = 0;
334 	j = 0;
335 	while (i < nvp->nvram_len - len) {
336 		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
337 			i += len;
338 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
339 				nvp->boardrev_found = true;
340 			while (nvp->nvram[i] != 0) {
341 				nvram[j] = nvp->nvram[i];
342 				i++;
343 				j++;
344 			}
345 			nvram[j] = 0;
346 			j++;
347 		}
348 		while (nvp->nvram[i] != 0)
349 			i++;
350 		i++;
351 	}
352 	kfree(nvp->nvram);
353 	nvp->nvram = nvram;
354 	nvp->nvram_len = j;
355 	return;
356 fail:
357 	kfree(nvram);
358 	nvp->nvram_len = 0;
359 }
360 
brcmf_fw_add_defaults(struct nvram_parser *nvp)361 static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
362 {
363 	if (nvp->boardrev_found)
364 		return;
365 
366 	memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
367 	       strlen(BRCMF_FW_DEFAULT_BOARDREV));
368 	nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
369 	nvp->nvram[nvp->nvram_len] = '\0';
370 	nvp->nvram_len++;
371 }
372 
373 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
374  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
375  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
376  * End of buffer is completed with token identifying length of buffer.
377  */
brcmf_fw_nvram_strip(const u8 *data, size_t data_len, u32 *new_length, u16 domain_nr, u16 bus_nr)378 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
379 				  u32 *new_length, u16 domain_nr, u16 bus_nr)
380 {
381 	struct nvram_parser nvp;
382 	u32 pad;
383 	u32 token;
384 	__le32 token_le;
385 
386 	if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
387 		return NULL;
388 
389 	while (nvp.pos < data_len) {
390 		nvp.state = nv_parser_states[nvp.state](&nvp);
391 		if (nvp.state == END)
392 			break;
393 	}
394 	if (nvp.multi_dev_v1) {
395 		nvp.boardrev_found = false;
396 		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
397 	} else if (nvp.multi_dev_v2) {
398 		nvp.boardrev_found = false;
399 		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
400 	}
401 
402 	if (nvp.nvram_len == 0) {
403 		kfree(nvp.nvram);
404 		return NULL;
405 	}
406 
407 	brcmf_fw_add_defaults(&nvp);
408 
409 	pad = nvp.nvram_len;
410 	*new_length = roundup(nvp.nvram_len + 1, 4);
411 	while (pad != *new_length) {
412 		nvp.nvram[pad] = 0;
413 		pad++;
414 	}
415 
416 	token = *new_length / 4;
417 	token = (~token << 16) | (token & 0x0000FFFF);
418 	token_le = cpu_to_le32(token);
419 
420 	memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
421 	*new_length += sizeof(token_le);
422 
423 	return nvp.nvram;
424 }
425 
brcmf_fw_nvram_free(void *nvram)426 void brcmf_fw_nvram_free(void *nvram)
427 {
428 	kfree(nvram);
429 }
430 
431 struct brcmf_fw {
432 	struct device *dev;
433 	struct brcmf_fw_request *req;
434 	u32 curpos;
435 	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
436 };
437 
438 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
439 
440 #ifdef CONFIG_EFI
441 /* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
442  * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
443  * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
444  * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
445  * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
446  * no-Initiate-Radiation mode. This means that we will never send on these
447  * channels without first having received valid wifi traffic on the channel.
448  */
brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)449 static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
450 {
451 	char *ccode;
452 
453 	ccode = strnstr((char *)data, "ccode=ALL", data_len);
454 	if (!ccode)
455 		ccode = strnstr((char *)data, "ccode=XV\r", data_len);
456 	if (!ccode)
457 		return;
458 
459 	ccode[6] = 'X';
460 	ccode[7] = '2';
461 	ccode[8] = '\r';
462 }
463 
brcmf_fw_nvram_from_efi(size_t *data_len_ret)464 static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
465 {
466 	const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
467 	struct efivar_entry *nvram_efivar;
468 	unsigned long data_len = 0;
469 	u8 *data = NULL;
470 	int err;
471 
472 	nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
473 	if (!nvram_efivar)
474 		return NULL;
475 
476 	memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
477 	nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
478 						0xb5, 0x1f, 0x43, 0x26,
479 						0x81, 0x23, 0xd1, 0x13);
480 
481 	err = efivar_entry_size(nvram_efivar, &data_len);
482 	if (err)
483 		goto fail;
484 
485 	data = kmalloc(data_len, GFP_KERNEL);
486 	if (!data)
487 		goto fail;
488 
489 	err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
490 	if (err)
491 		goto fail;
492 
493 	brcmf_fw_fix_efi_nvram_ccode(data, data_len);
494 	brcmf_info("Using nvram EFI variable\n");
495 
496 	kfree(nvram_efivar);
497 	*data_len_ret = data_len;
498 	return data;
499 
500 fail:
501 	kfree(data);
502 	kfree(nvram_efivar);
503 	return NULL;
504 }
505 #else
brcmf_fw_nvram_from_efi(size_t *data_len)506 static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
507 #endif
508 
brcmf_fw_free_request(struct brcmf_fw_request *req)509 static void brcmf_fw_free_request(struct brcmf_fw_request *req)
510 {
511 	struct brcmf_fw_item *item;
512 	int i;
513 
514 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
515 		if (item->type == BRCMF_FW_TYPE_BINARY)
516 			release_firmware(item->binary);
517 		else if (item->type == BRCMF_FW_TYPE_NVRAM)
518 			brcmf_fw_nvram_free(item->nv_data.data);
519 	}
520 	kfree(req);
521 }
522 
brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)523 static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
524 {
525 	struct brcmf_fw *fwctx = ctx;
526 	struct brcmf_fw_item *cur;
527 	bool free_bcm47xx_nvram = false;
528 	bool kfree_nvram = false;
529 	u32 nvram_length = 0;
530 	void *nvram = NULL;
531 	u8 *data = NULL;
532 	size_t data_len;
533 
534 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
535 
536 	cur = &fwctx->req->items[fwctx->curpos];
537 
538 	if (fw && fw->data) {
539 		data = (u8 *)fw->data;
540 		data_len = fw->size;
541 	} else {
542 		if ((data = bcm47xx_nvram_get_contents(&data_len)))
543 			free_bcm47xx_nvram = true;
544 		else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
545 			kfree_nvram = true;
546 		else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
547 			goto fail;
548 	}
549 
550 	if (data)
551 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
552 					     fwctx->req->domain_nr,
553 					     fwctx->req->bus_nr);
554 
555 	if (free_bcm47xx_nvram)
556 		bcm47xx_nvram_release_contents(data);
557 	if (kfree_nvram)
558 		kfree(data);
559 
560 	release_firmware(fw);
561 	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
562 		goto fail;
563 
564 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
565 	cur->nv_data.data = nvram;
566 	cur->nv_data.len = nvram_length;
567 	return 0;
568 
569 fail:
570 	return -ENOENT;
571 }
572 
brcmf_fw_complete_request(const struct firmware *fw, struct brcmf_fw *fwctx)573 static int brcmf_fw_complete_request(const struct firmware *fw,
574 				     struct brcmf_fw *fwctx)
575 {
576 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
577 	int ret = 0;
578 
579 	brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
580 
581 	switch (cur->type) {
582 	case BRCMF_FW_TYPE_NVRAM:
583 		ret = brcmf_fw_request_nvram_done(fw, fwctx);
584 		break;
585 	case BRCMF_FW_TYPE_BINARY:
586 		if (fw)
587 			cur->binary = fw;
588 		else
589 			ret = -ENOENT;
590 		break;
591 	default:
592 		/* something fishy here so bail out early */
593 		brcmf_err("unknown fw type: %d\n", cur->type);
594 		release_firmware(fw);
595 		ret = -EINVAL;
596 	}
597 
598 	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
599 }
600 
brcmf_fw_request_firmware(const struct firmware **fw, struct brcmf_fw *fwctx)601 static int brcmf_fw_request_firmware(const struct firmware **fw,
602 				     struct brcmf_fw *fwctx)
603 {
604 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
605 	int ret;
606 
607 	/* nvram files are board-specific, first try a board-specific path */
608 	if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
609 		char alt_path[BRCMF_FW_NAME_LEN];
610 
611 		strlcpy(alt_path, cur->path, BRCMF_FW_NAME_LEN);
612 		/* strip .txt at the end */
613 		alt_path[strlen(alt_path) - 4] = 0;
614 		strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
615 		strlcat(alt_path, fwctx->req->board_type, BRCMF_FW_NAME_LEN);
616 		strlcat(alt_path, ".txt", BRCMF_FW_NAME_LEN);
617 
618 		ret = request_firmware(fw, alt_path, fwctx->dev);
619 		if (ret == 0)
620 			return ret;
621 	}
622 
623 	return request_firmware(fw, cur->path, fwctx->dev);
624 }
625 
brcmf_fw_request_done(const struct firmware *fw, void *ctx)626 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
627 {
628 	struct brcmf_fw *fwctx = ctx;
629 	int ret;
630 
631 	ret = brcmf_fw_complete_request(fw, fwctx);
632 
633 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
634 		brcmf_fw_request_firmware(&fw, fwctx);
635 		ret = brcmf_fw_complete_request(fw, ctx);
636 	}
637 
638 	if (ret) {
639 		brcmf_fw_free_request(fwctx->req);
640 		fwctx->req = NULL;
641 	}
642 	fwctx->done(fwctx->dev, ret, fwctx->req);
643 	kfree(fwctx);
644 }
645 
brcmf_fw_request_is_valid(struct brcmf_fw_request *req)646 static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
647 {
648 	struct brcmf_fw_item *item;
649 	int i;
650 
651 	if (!req->n_items)
652 		return false;
653 
654 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
655 		if (!item->path)
656 			return false;
657 	}
658 	return true;
659 }
660 
brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req, void (*fw_cb)(struct device *dev, int err, struct brcmf_fw_request *req))661 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
662 			   void (*fw_cb)(struct device *dev, int err,
663 					 struct brcmf_fw_request *req))
664 {
665 	struct brcmf_fw_item *first = &req->items[0];
666 	struct brcmf_fw *fwctx;
667 	int ret;
668 
669 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
670 	if (!fw_cb)
671 		return -EINVAL;
672 
673 	if (!brcmf_fw_request_is_valid(req))
674 		return -EINVAL;
675 
676 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
677 	if (!fwctx)
678 		return -ENOMEM;
679 
680 	fwctx->dev = dev;
681 	fwctx->req = req;
682 	fwctx->done = fw_cb;
683 
684 	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
685 				      fwctx->dev, GFP_KERNEL, fwctx,
686 				      brcmf_fw_request_done);
687 	if (ret < 0)
688 		brcmf_fw_request_done(NULL, fwctx);
689 
690 	return 0;
691 }
692 
693 struct brcmf_fw_request *
brcmf_fw_alloc_request(u32 chip, u32 chiprev, const struct brcmf_firmware_mapping mapping_table[], u32 table_size, struct brcmf_fw_name *fwnames, u32 n_fwnames)694 brcmf_fw_alloc_request(u32 chip, u32 chiprev,
695 		       const struct brcmf_firmware_mapping mapping_table[],
696 		       u32 table_size, struct brcmf_fw_name *fwnames,
697 		       u32 n_fwnames)
698 {
699 	struct brcmf_fw_request *fwreq;
700 	char chipname[12];
701 	const char *mp_path;
702 	size_t mp_path_len;
703 	u32 i, j;
704 	char end = '\0';
705 
706 	if (chiprev >= BITS_PER_TYPE(u32)) {
707 		brcmf_err("Invalid chip revision %u\n", chiprev);
708 		return NULL;
709 	}
710 
711 	for (i = 0; i < table_size; i++) {
712 		if (mapping_table[i].chipid == chip &&
713 		    mapping_table[i].revmask & BIT(chiprev))
714 			break;
715 	}
716 
717 	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
718 
719 	if (i == table_size) {
720 		brcmf_err("Unknown chip %s\n", chipname);
721 		return NULL;
722 	}
723 
724 	fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
725 	if (!fwreq)
726 		return NULL;
727 
728 	brcmf_info("using %s for chip %s\n",
729 		   mapping_table[i].fw_base, chipname);
730 
731 	mp_path = brcmf_mp_global.firmware_path;
732 	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
733 	if (mp_path_len)
734 		end = mp_path[mp_path_len - 1];
735 
736 	fwreq->n_items = n_fwnames;
737 
738 	for (j = 0; j < n_fwnames; j++) {
739 		fwreq->items[j].path = fwnames[j].path;
740 		fwnames[j].path[0] = '\0';
741 		/* check if firmware path is provided by module parameter */
742 		if (brcmf_mp_global.firmware_path[0] != '\0') {
743 			strlcpy(fwnames[j].path, mp_path,
744 				BRCMF_FW_NAME_LEN);
745 
746 			if (end != '/') {
747 				strlcat(fwnames[j].path, "/",
748 					BRCMF_FW_NAME_LEN);
749 			}
750 		}
751 		strlcat(fwnames[j].path, mapping_table[i].fw_base,
752 			BRCMF_FW_NAME_LEN);
753 		strlcat(fwnames[j].path, fwnames[j].extension,
754 			BRCMF_FW_NAME_LEN);
755 		fwreq->items[j].path = fwnames[j].path;
756 	}
757 
758 	return fwreq;
759 }
760