drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2013 Broadcom Corporation
   4  */
   5
   6 #include <linux/efi.h>
   7 #include <linux/kernel.h>
   8 #include <linux/slab.h>
   9 #include <linux/device.h>
  10 #include <linux/firmware.h>
  11 #include <linux/module.h>
  12 #include <linux/bcm47xx_nvram.h>
  13 #include <linux/ctype.h>
  14
  15 #include "debug.h"
  16 #include "firmware.h"
  17 #include "core.h"
  18 #include "common.h"
  19 #include "chip.h"
  20
  21 #define BRCMF_FW_MAX_NVRAM_SIZE                 64000
  22 #define BRCMF_FW_NVRAM_DEVPATH_LEN              19      /* devpath0=pcie/1/4/ */
  23 #define BRCMF_FW_NVRAM_PCIEDEV_LEN              10      /* pcie/1/4/ + \0 */
  24 #define BRCMF_FW_DEFAULT_BOARDREV               "boardrev=0xff"
  25
  26 enum nvram_parser_state {
  27         IDLE,
  28         KEY,
  29         VALUE,
  30         COMMENT,
  31         END
  32 };
  33
  34 char saved_ccode[2] = {};
  35
  36 /**
  37  * struct nvram_parser - internal info for parser.
  38  *
  39  * @state: current parser state.
  40  * @data: input buffer being parsed.
  41  * @nvram: output buffer with parse result.
  42  * @nvram_len: length of parse result.
  43  * @line: current line.
  44  * @column: current column in line.
  45  * @pos: byte offset in input buffer.
  46  * @entry: start position of key,value entry.
  47  * @multi_dev_v1: detect pcie multi device v1 (compressed).
  48  * @multi_dev_v2: detect pcie multi device v2.
  49  * @boardrev_found: nvram contains boardrev information.
  50  */
  51 struct nvram_parser {
  52         enum nvram_parser_state state;
  53         const u8 *data;
  54         u8 *nvram;
  55         u32 nvram_len;
  56         u32 line;
  57         u32 column;
  58         u32 pos;
  59         u32 entry;
  60         bool multi_dev_v1;
  61         bool multi_dev_v2;
  62         bool boardrev_found;
  63 };
  64
  65 /*
  66  * is_nvram_char() - check if char is a valid one for NVRAM entry
  67  *
  68  * It accepts all printable ASCII chars except for '#' which opens a comment.
  69  * Please note that ' ' (space) while accepted is not a valid key name char.
  70  */
  71 static bool is_nvram_char(char c)
  72 {
  73         /* comment marker excluded */
  74         if (c == '#')
  75                 return false;
  76
  77         /* key and value may have any other readable character */
  78         return (c >= 0x20 && c < 0x7f);
  79 }
  80
  81 static bool is_whitespace(char c)
  82 {
  83         return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
  84 }
  85
  86 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
  87 {
  88         char c;
  89
  90         c = nvp->data[nvp->pos];
  91         if (c == '\n')
  92                 return COMMENT;
  93         if (is_whitespace(c) || c == '\0')
  94                 goto proceed;
  95         if (c == '#')
  96                 return COMMENT;
  97         if (is_nvram_char(c)) {
  98                 nvp->entry = nvp->pos;
  99                 return KEY;
 100         }
 101         brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
 102                   nvp->line, nvp->column);
 103 proceed:
 104         nvp->column++;
 105         nvp->pos++;
 106         return IDLE;
 107 }
 108
 109 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
 110 {
 111         enum nvram_parser_state st = nvp->state;
 112         char c;
 113
 114         c = nvp->data[nvp->pos];
 115         if (c == '=') {
 116                 /* ignore RAW1 by treating as comment */
 117                 if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
 118                         st = COMMENT;
 119                 else
 120                         st = VALUE;
 121                 if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
 122                         nvp->multi_dev_v1 = true;
 123                 if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
 124                         nvp->multi_dev_v2 = true;
 125                 if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
 126                         nvp->boardrev_found = true;
 127         } else if (!is_nvram_char(c) || c == ' ') {
 128                 brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
 129                           nvp->line, nvp->column);
 130                 return COMMENT;
 131         }
 132
 133         nvp->column++;
 134         nvp->pos++;
 135         return st;
 136 }
 137
 138 static enum nvram_parser_state
 139 brcmf_nvram_handle_value(struct nvram_parser *nvp)
 140 {
 141         char c;
 142         char *skv;
 143         char *ekv;
 144         u32 cplen;
 145
 146         c = nvp->data[nvp->pos];
 147         if (!is_nvram_char(c)) {
 148                 /* key,value pair complete */
 149                 ekv = (u8 *)&nvp->data[nvp->pos];
 150                 skv = (u8 *)&nvp->data[nvp->entry];
 151                 cplen = ekv - skv;
 152                 if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
 153                         return END;
 154                 /* copy to output buffer */
 155                 memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
 156                 nvp->nvram_len += cplen;
 157                 nvp->nvram[nvp->nvram_len] = '\0';
 158                 nvp->nvram_len++;
 159                 return IDLE;
 160         }
 161         nvp->pos++;
 162         nvp->column++;
 163         return VALUE;
 164 }
 165
 166 static enum nvram_parser_state
 167 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
 168 {
 169         char *eoc, *sol;
 170
 171         sol = (char *)&nvp->data[nvp->pos];
 172         eoc = strchr(sol, '\n');
 173         if (!eoc) {
 174                 eoc = strchr(sol, '\0');
 175                 if (!eoc)
 176                         return END;
 177         }
 178
 179         /* eat all moving to next line */
 180         nvp->line++;
 181         nvp->column = 1;
 182         nvp->pos += (eoc - sol) + 1;
 183         return IDLE;
 184 }
 185
 186 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
 187 {
 188         /* final state */
 189         return END;
 190 }
 191
 192 static enum nvram_parser_state
 193 (*nv_parser_states[])(struct nvram_parser *nvp) = {
 194         brcmf_nvram_handle_idle,
 195         brcmf_nvram_handle_key,
 196         brcmf_nvram_handle_value,
 197         brcmf_nvram_handle_comment,
 198         brcmf_nvram_handle_end
 199 };
 200
 201 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
 202                                    const u8 *data, size_t data_len)
 203 {
 204         size_t size;
 205
 206         memset(nvp, 0, sizeof(*nvp));
 207         nvp->data = data;
 208         /* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
 209         if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
 210                 size = BRCMF_FW_MAX_NVRAM_SIZE;
 211         else
 212                 size = data_len;
 213         /* Add space for properties we may add */
 214         size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
 215         /* Alloc for extra 0 byte + roundup by 4 + length field */
 216         size += 1 + 3 + sizeof(u32);
 217         nvp->nvram = kzalloc(size, GFP_KERNEL);
 218         if (!nvp->nvram)
 219                 return -ENOMEM;
 220
 221         nvp->line = 1;
 222         nvp->column = 1;
 223         return 0;
 224 }
 225
 226 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
 227  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
 228  * which data is to be returned. v1 is the version where nvram is stored
 229  * compressed and "devpath" maps to index for valid entries.
 230  */
 231 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
 232                                     u16 bus_nr)
 233 {
 234         /* Device path with a leading '=' key-value separator */
 235         char pci_path[] = "=pci/?/?";
 236         size_t pci_len;
 237         char pcie_path[] = "=pcie/?/?";
 238         size_t pcie_len;
 239
 240         u32 i, j;
 241         bool found;
 242         u8 *nvram;
 243         u8 id;
 244
 245         nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
 246         if (!nvram)
 247                 goto fail;
 248
 249         /* min length: devpath0=pcie/1/4/ + 0:x=y */
 250         if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
 251                 goto fail;
 252
 253         /* First search for the devpathX and see if it is the configuration
 254          * for domain_nr/bus_nr. Search complete nvp
 255          */
 256         snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
 257                  bus_nr);
 258         pci_len = strlen(pci_path);
 259         snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
 260                  bus_nr);
 261         pcie_len = strlen(pcie_path);
 262         found = false;
 263         i = 0;
 264         while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
 265                 /* Format: devpathX=pcie/Y/Z/
 266                  * Y = domain_nr, Z = bus_nr, X = virtual ID
 267                  */
 268                 if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
 269                     (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
 270                      !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
 271                         id = nvp->nvram[i + 7] - '0';
 272                         found = true;
 273                         break;
 274                 }
 275                 while (nvp->nvram[i] != 0)
 276                         i++;
 277                 i++;
 278         }
 279         if (!found)
 280                 goto fail;
 281
 282         /* Now copy all valid entries, release old nvram and assign new one */
 283         i = 0;
 284         j = 0;
 285         while (i < nvp->nvram_len) {
 286                 if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
 287                         i += 2;
 288                         if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
 289                                 nvp->boardrev_found = true;
 290                         while (nvp->nvram[i] != 0) {
 291                                 nvram[j] = nvp->nvram[i];
 292                                 i++;
 293                                 j++;
 294                         }
 295                         nvram[j] = 0;
 296                         j++;
 297                 }
 298                 while (nvp->nvram[i] != 0)
 299                         i++;
 300                 i++;
 301         }
 302         kfree(nvp->nvram);
 303         nvp->nvram = nvram;
 304         nvp->nvram_len = j;
 305         return;
 306
 307 fail:
 308         kfree(nvram);
 309         nvp->nvram_len = 0;
 310 }
 311
 312 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
 313  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
 314  * which data is to be returned. v2 is the version where nvram is stored
 315  * uncompressed, all relevant valid entries are identified by
 316  * pcie/domain_nr/bus_nr:
 317  */
 318 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
 319                                     u16 bus_nr)
 320 {
 321         char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
 322         size_t len;
 323         u32 i, j;
 324         u8 *nvram;
 325
 326         nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
 327         if (!nvram) {
 328                 nvp->nvram_len = 0;
 329                 return;
 330         }
 331
 332         /* Copy all valid entries, release old nvram and assign new one.
 333          * Valid entries are of type pcie/X/Y/ where X = domain_nr and
 334          * Y = bus_nr.
 335          */
 336         snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
 337         len = strlen(prefix);
 338         i = 0;
 339         j = 0;
 340         while (i < nvp->nvram_len - len) {
 341                 if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
 342                         i += len;
 343                         if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
 344                                 nvp->boardrev_found = true;
 345                         while (nvp->nvram[i] != 0) {
 346                                 nvram[j] = nvp->nvram[i];
 347                                 i++;
 348                                 j++;
 349                         }
 350                         nvram[j] = 0;
 351                         j++;
 352                 }
 353                 while (nvp->nvram[i] != 0)
 354                         i++;
 355                 i++;
 356         }
 357         kfree(nvp->nvram);
 358         nvp->nvram = nvram;
 359         nvp->nvram_len = j;
 360 }
 361
 362 static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
 363 {
 364         if (nvp->boardrev_found)
 365                 return;
 366
 367         memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
 368                strlen(BRCMF_FW_DEFAULT_BOARDREV));
 369         nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
 370         nvp->nvram[nvp->nvram_len] = '\0';
 371         nvp->nvram_len++;
 372 }
 373
 374 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
 375  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
 376  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
 377  * End of buffer is completed with token identifying length of buffer.
 378  */
 379 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
 380                                   u32 *new_length, u16 domain_nr, u16 bus_nr)
 381 {
 382         struct nvram_parser nvp;
 383         u32 pad;
 384         u32 token;
 385         __le32 token_le;
 386
 387         if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
 388                 return NULL;
 389
 390         while (nvp.pos < data_len) {
 391                 nvp.state = nv_parser_states[nvp.state](&nvp);
 392                 if (nvp.state == END)
 393                         break;
 394         }
 395         if (nvp.multi_dev_v1) {
 396                 nvp.boardrev_found = false;
 397                 brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
 398         } else if (nvp.multi_dev_v2) {
 399                 nvp.boardrev_found = false;
 400                 brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
 401         }
 402
 403         if (nvp.nvram_len == 0) {
 404                 kfree(nvp.nvram);
 405                 return NULL;
 406         }
 407
 408         brcmf_fw_add_defaults(&nvp);
 409
 410         pad = nvp.nvram_len;
 411         *new_length = roundup(nvp.nvram_len + 1, 4);
 412         while (pad != *new_length) {
 413                 nvp.nvram[pad] = 0;
 414                 pad++;
 415         }
 416
 417         token = *new_length / 4;
 418         token = (~token << 16) | (token & 0x0000FFFF);
 419         token_le = cpu_to_le32(token);
 420
 421         memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
 422         *new_length += sizeof(token_le);
 423
 424         return nvp.nvram;
 425 }
 426
 427 void brcmf_fw_nvram_free(void *nvram)
 428 {
 429         kfree(nvram);
 430 }
 431
 432 struct brcmf_fw {
 433         struct device *dev;
 434         struct brcmf_fw_request *req;
 435         u32 curpos;
 436         void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
 437 };
 438
 439 #ifdef CONFIG_EFI
 440 /* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
 441  * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
 442  * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
 443  * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
 444  * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
 445  * no-Initiate-Radiation mode. This means that we will never send on these
 446  * channels without first having received valid wifi traffic on the channel.
 447  */
 448 static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
 449 {
 450         char *ccode;
 451
 452         ccode = strnstr((char *)data, "ccode=ALL", data_len);
 453         if (!ccode)
 454                 ccode = strnstr((char *)data, "ccode=XV\r", data_len);
 455         if (!ccode)
 456                 return;
 457
 458         ccode[6] = 'X';
 459         ccode[7] = '2';
 460         ccode[8] = '\r';
 461 }
 462
 463 static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
 464 {
 465         const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
 466         struct efivar_entry *nvram_efivar;
 467         unsigned long data_len = 0;
 468         u8 *data = NULL;
 469         int err;
 470
 471         nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
 472         if (!nvram_efivar)
 473                 return NULL;
 474
 475         memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
 476         nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
 477                                                 0xb5, 0x1f, 0x43, 0x26,
 478                                                 0x81, 0x23, 0xd1, 0x13);
 479
 480         err = efivar_entry_size(nvram_efivar, &data_len);
 481         if (err)
 482                 goto fail;
 483
 484         data = kmalloc(data_len, GFP_KERNEL);
 485         if (!data)
 486                 goto fail;
 487
 488         err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
 489         if (err)
 490                 goto fail;
 491
 492         brcmf_fw_fix_efi_nvram_ccode(data, data_len);
 493         brcmf_info("Using nvram EFI variable\n");
 494
 495         kfree(nvram_efivar);
 496         *data_len_ret = data_len;
 497         return data;
 498
 499 fail:
 500         kfree(data);
 501         kfree(nvram_efivar);
 502         return NULL;
 503 }
 504 #else
 505 static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
 506 #endif
 507
 508 static void brcmf_fw_free_request(struct brcmf_fw_request *req)
 509 {
 510         struct brcmf_fw_item *item;
 511         int i;
 512
 513         for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
 514                 if (item->type == BRCMF_FW_TYPE_BINARY)
 515                         release_firmware(item->binary);
 516                 else if (item->type == BRCMF_FW_TYPE_NVRAM)
 517                         brcmf_fw_nvram_free(item->nv_data.data);
 518         }
 519         kfree(req);
 520 }
 521
 522 static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 523 {
 524         struct brcmf_fw *fwctx = ctx;
 525         struct brcmf_fw_item *cur;
 526         bool free_bcm47xx_nvram = false;
 527         bool kfree_nvram = false;
 528         u32 nvram_length = 0;
 529         void *nvram = NULL;
 530         u8 *data = NULL;
 531         size_t data_len;
 532
 533         brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
 534
 535         cur = &fwctx->req->items[fwctx->curpos];
 536
 537         if (fw && fw->data) {
 538                 data = (u8 *)fw->data;
 539                 data_len = fw->size;
 540         } else {
 541                 if ((data = bcm47xx_nvram_get_contents(&data_len)))
 542                         free_bcm47xx_nvram = true;
 543                 else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
 544                         kfree_nvram = true;
 545                 else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
 546                         goto fail;
 547         }
 548
 549         if (data) {
 550                 char *ccode = strnstr((char *)data, "ccode=", data_len);
 551                 /* Ensure this is a whole token */
 552                 if (ccode && ((void *)ccode == (void *)data || isspace(ccode[-1]))) {
 553                         /* Comment out the line */
 554                         ccode[0] = '#';
 555                         ccode += 6;
 556                         if (isupper(ccode[0]) && isupper(ccode[1]) &&
 557                             isspace(ccode[2])) {
 558                                 pr_debug("brcmfmac: intercepting ccode=%c%c\n",
 559                                          ccode[0], ccode[1]);
 560                                 saved_ccode[0] = ccode[0];
 561                                 saved_ccode[1] = ccode[1];
 562                         }
 563                 };
 564
 565                 nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
 566                                              fwctx->req->domain_nr,
 567                                              fwctx->req->bus_nr);
 568         }
 569
 570         if (free_bcm47xx_nvram)
 571                 bcm47xx_nvram_release_contents(data);
 572         if (kfree_nvram)
 573                 kfree(data);
 574
 575         release_firmware(fw);
 576         if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
 577                 goto fail;
 578
 579         brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
 580         cur->nv_data.data = nvram;
 581         cur->nv_data.len = nvram_length;
 582         return 0;
 583
 584 fail:
 585         return -ENOENT;
 586 }
 587
 588 static int brcmf_fw_complete_request(const struct firmware *fw,
 589                                      struct brcmf_fw *fwctx)
 590 {
 591         struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
 592         int ret = 0;
 593
 594         brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
 595
 596         switch (cur->type) {
 597         case BRCMF_FW_TYPE_NVRAM:
 598                 ret = brcmf_fw_request_nvram_done(fw, fwctx);
 599                 break;
 600         case BRCMF_FW_TYPE_BINARY:
 601                 if (fw)
 602                         cur->binary = fw;
 603                 else
 604                         ret = -ENOENT;
 605                 break;
 606         default:
 607                 /* something fishy here so bail out early */
 608                 brcmf_err("unknown fw type: %d\n", cur->type);
 609                 release_firmware(fw);
 610                 ret = -EINVAL;
 611         }
 612
 613         return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
 614 }
 615
 616 static char *brcm_alt_fw_path(const char *path, const char *board_type)
 617 {
 618         char alt_path[BRCMF_FW_NAME_LEN];
 619         char suffix[5];
 620
 621         strscpy(alt_path, path, BRCMF_FW_NAME_LEN);
 622         /* At least one character + suffix */
 623         if (strlen(alt_path) < 5)
 624                 return NULL;
 625
 626         /* strip .txt or .bin at the end */
 627         strscpy(suffix, alt_path + strlen(alt_path) - 4, 5);
 628         alt_path[strlen(alt_path) - 4] = 0;
 629         strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
 630         strlcat(alt_path, board_type, BRCMF_FW_NAME_LEN);
 631         strlcat(alt_path, suffix, BRCMF_FW_NAME_LEN);
 632
 633         return kstrdup(alt_path, GFP_KERNEL);
 634 }
 635
 636 static int brcmf_fw_request_firmware(const struct firmware **fw,
 637                                      struct brcmf_fw *fwctx)
 638 {
 639         struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
 640         int ret;
 641
 642         /* Files can be board-specific, first try a board-specific path */
 643         if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
 644                 char *alt_path;
 645
 646                 alt_path = brcm_alt_fw_path(cur->path, fwctx->req->board_type);
 647                 if (!alt_path)
 648                         goto fallback;
 649
 650                 ret = firmware_request_nowarn(fw, alt_path, fwctx->dev);
 651                 kfree(alt_path);
 652                 if (ret == 0)
 653                         return ret;
 654         }
 655
 656 fallback:
 657         return request_firmware(fw, cur->path, fwctx->dev);
 658 }
 659
 660 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
 661 {
 662         struct brcmf_fw *fwctx = ctx;
 663         int ret;
 664
 665         ret = brcmf_fw_complete_request(fw, fwctx);
 666
 667         while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
 668                 brcmf_fw_request_firmware(&fw, fwctx);
 669                 ret = brcmf_fw_complete_request(fw, ctx);
 670         }
 671
 672         if (ret) {
 673                 brcmf_fw_free_request(fwctx->req);
 674                 fwctx->req = NULL;
 675         }
 676         fwctx->done(fwctx->dev, ret, fwctx->req);
 677         kfree(fwctx);
 678 }
 679
 680 static void brcmf_fw_request_done_alt_path(const struct firmware *fw, void *ctx)
 681 {
 682         struct brcmf_fw *fwctx = ctx;
 683         struct brcmf_fw_item *first = &fwctx->req->items[0];
 684         int ret = 0;
 685
 686         /* Fall back to canonical path if board firmware not found */
 687         if (!fw)
 688                 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
 689                                               fwctx->dev, GFP_KERNEL, fwctx,
 690                                               brcmf_fw_request_done);
 691
 692         if (fw || ret < 0)
 693                 brcmf_fw_request_done(fw, ctx);
 694 }
 695
 696 static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
 697 {
 698         struct brcmf_fw_item *item;
 699         int i;
 700
 701         if (!req->n_items)
 702                 return false;
 703
 704         for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
 705                 if (!item->path)
 706                         return false;
 707         }
 708         return true;
 709 }
 710
 711 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
 712                            void (*fw_cb)(struct device *dev, int err,
 713                                          struct brcmf_fw_request *req))
 714 {
 715         struct brcmf_fw_item *first = &req->items[0];
 716         struct brcmf_fw *fwctx;
 717         char *alt_path = NULL;
 718         int ret;
 719
 720         brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
 721         if (!fw_cb)
 722                 return -EINVAL;
 723
 724         if (!brcmf_fw_request_is_valid(req))
 725                 return -EINVAL;
 726
 727         fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
 728         if (!fwctx)
 729                 return -ENOMEM;
 730
 731         fwctx->dev = dev;
 732         fwctx->req = req;
 733         fwctx->done = fw_cb;
 734
 735         /* First try alternative board-specific path if any */
 736         if (fwctx->req->board_type)
 737                 alt_path = brcm_alt_fw_path(first->path,
 738                                             fwctx->req->board_type);
 739         if (alt_path) {
 740                 ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
 741                                               fwctx->dev, GFP_KERNEL, fwctx,
 742                                               brcmf_fw_request_done_alt_path);
 743                 kfree(alt_path);
 744         } else {
 745                 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
 746                                               fwctx->dev, GFP_KERNEL, fwctx,
 747                                               brcmf_fw_request_done);
 748         }
 749         if (ret < 0)
 750                 brcmf_fw_request_done(NULL, fwctx);
 751
 752         return 0;
 753 }
 754
 755 struct brcmf_fw_request *
 756 brcmf_fw_alloc_request(u32 chip, u32 chiprev,
 757                        const struct brcmf_firmware_mapping mapping_table[],
 758                        u32 table_size, struct brcmf_fw_name *fwnames,
 759                        u32 n_fwnames)
 760 {
 761         struct brcmf_fw_request *fwreq;
 762         char chipname[12];
 763         const char *mp_path;
 764         size_t mp_path_len;
 765         u32 i, j;
 766         char end = '\0';
 767
 768         for (i = 0; i < table_size; i++) {
 769                 if (mapping_table[i].chipid == chip &&
 770                     mapping_table[i].revmask & BIT(chiprev))
 771                         break;
 772         }
 773
 774         brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
 775
 776         if (i == table_size) {
 777                 brcmf_err("Unknown chip %s\n", chipname);
 778                 return NULL;
 779         }
 780
 781         fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
 782         if (!fwreq)
 783                 return NULL;
 784
 785         brcmf_info("using %s for chip %s\n",
 786                    mapping_table[i].fw_base, chipname);
 787
 788         mp_path = brcmf_mp_global.firmware_path;
 789         mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
 790         if (mp_path_len)
 791                 end = mp_path[mp_path_len - 1];
 792
 793         fwreq->n_items = n_fwnames;
 794
 795         for (j = 0; j < n_fwnames; j++) {
 796                 fwreq->items[j].path = fwnames[j].path;
 797                 fwnames[j].path[0] = '\0';
 798                 /* check if firmware path is provided by module parameter */
 799                 if (brcmf_mp_global.firmware_path[0] != '\0') {
 800                         strlcpy(fwnames[j].path, mp_path,
 801                                 BRCMF_FW_NAME_LEN);
 802
 803                         if (end != '/') {
 804                                 strlcat(fwnames[j].path, "/",
 805                                         BRCMF_FW_NAME_LEN);
 806                         }
 807                 }
 808                 strlcat(fwnames[j].path, mapping_table[i].fw_base,
 809                         BRCMF_FW_NAME_LEN);
 810                 strlcat(fwnames[j].path, fwnames[j].extension,
 811                         BRCMF_FW_NAME_LEN);
 812                 fwreq->items[j].path = fwnames[j].path;
 813         }
 814
 815         return fwreq;
 816 }