1 // SPDX-License-Identifier: ISC
3 * Copyright (c) 2013 Broadcom Corporation
7 #include <linux/kernel.h>
8 #include <linux/slab.h>
9 #include <linux/device.h>
10 #include <linux/firmware.h>
11 #include <linux/module.h>
12 #include <linux/bcm47xx_nvram.h>
13 #include <linux/ctype.h>
21 #define BRCMF_FW_MAX_NVRAM_SIZE 64000
22 #define BRCMF_FW_NVRAM_DEVPATH_LEN 19 /* devpath0=pcie/1/4/ */
23 #define BRCMF_FW_NVRAM_PCIEDEV_LEN 10 /* pcie/1/4/ + \0 */
24 #define BRCMF_FW_DEFAULT_BOARDREV "boardrev=0xff"
26 enum nvram_parser_state {
34 char saved_ccode[2] = {};
37 * struct nvram_parser - internal info for parser.
39 * @state: current parser state.
40 * @data: input buffer being parsed.
41 * @nvram: output buffer with parse result.
42 * @nvram_len: length of parse result.
43 * @line: current line.
44 * @column: current column in line.
45 * @pos: byte offset in input buffer.
46 * @entry: start position of key,value entry.
47 * @multi_dev_v1: detect pcie multi device v1 (compressed).
48 * @multi_dev_v2: detect pcie multi device v2.
49 * @boardrev_found: nvram contains boardrev information.
52 enum nvram_parser_state state;
66 * is_nvram_char() - check if char is a valid one for NVRAM entry
68 * It accepts all printable ASCII chars except for '#' which opens a comment.
69 * Please note that ' ' (space) while accepted is not a valid key name char.
71 static bool is_nvram_char(char c)
73 /* comment marker excluded */
77 /* key and value may have any other readable character */
78 return (c >= 0x20 && c < 0x7f);
81 static bool is_whitespace(char c)
83 return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
86 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
90 c = nvp->data[nvp->pos];
93 if (is_whitespace(c) || c == '\0')
97 if (is_nvram_char(c)) {
98 nvp->entry = nvp->pos;
101 brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
102 nvp->line, nvp->column);
109 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
111 enum nvram_parser_state st = nvp->state;
114 c = nvp->data[nvp->pos];
116 /* ignore RAW1 by treating as comment */
117 if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
121 if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
122 nvp->multi_dev_v1 = true;
123 if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
124 nvp->multi_dev_v2 = true;
125 if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
126 nvp->boardrev_found = true;
127 } else if (!is_nvram_char(c) || c == ' ') {
128 brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
129 nvp->line, nvp->column);
138 static enum nvram_parser_state
139 brcmf_nvram_handle_value(struct nvram_parser *nvp)
146 c = nvp->data[nvp->pos];
147 if (!is_nvram_char(c)) {
148 /* key,value pair complete */
149 ekv = (u8 *)&nvp->data[nvp->pos];
150 skv = (u8 *)&nvp->data[nvp->entry];
152 if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
154 /* copy to output buffer */
155 memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
156 nvp->nvram_len += cplen;
157 nvp->nvram[nvp->nvram_len] = '\0';
166 static enum nvram_parser_state
167 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
171 sol = (char *)&nvp->data[nvp->pos];
172 eoc = strchr(sol, '\n');
174 eoc = strchr(sol, '\0');
179 /* eat all moving to next line */
182 nvp->pos += (eoc - sol) + 1;
186 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
192 static enum nvram_parser_state
193 (*nv_parser_states[])(struct nvram_parser *nvp) = {
194 brcmf_nvram_handle_idle,
195 brcmf_nvram_handle_key,
196 brcmf_nvram_handle_value,
197 brcmf_nvram_handle_comment,
198 brcmf_nvram_handle_end
201 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
202 const u8 *data, size_t data_len)
206 memset(nvp, 0, sizeof(*nvp));
208 /* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
209 if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
210 size = BRCMF_FW_MAX_NVRAM_SIZE;
213 /* Add space for properties we may add */
214 size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
215 /* Alloc for extra 0 byte + roundup by 4 + length field */
216 size += 1 + 3 + sizeof(u32);
217 nvp->nvram = kzalloc(size, GFP_KERNEL);
226 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
227 * devices. Strip it down for one device, use domain_nr/bus_nr to determine
228 * which data is to be returned. v1 is the version where nvram is stored
229 * compressed and "devpath" maps to index for valid entries.
231 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
234 /* Device path with a leading '=' key-value separator */
235 char pci_path[] = "=pci/?/?";
237 char pcie_path[] = "=pcie/?/?";
245 nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
249 /* min length: devpath0=pcie/1/4/ + 0:x=y */
250 if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
253 /* First search for the devpathX and see if it is the configuration
254 * for domain_nr/bus_nr. Search complete nvp
256 snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
258 pci_len = strlen(pci_path);
259 snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
261 pcie_len = strlen(pcie_path);
264 while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
265 /* Format: devpathX=pcie/Y/Z/
266 * Y = domain_nr, Z = bus_nr, X = virtual ID
268 if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
269 (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
270 !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
271 id = nvp->nvram[i + 7] - '0';
275 while (nvp->nvram[i] != 0)
282 /* Now copy all valid entries, release old nvram and assign new one */
285 while (i < nvp->nvram_len) {
286 if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
288 if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
289 nvp->boardrev_found = true;
290 while (nvp->nvram[i] != 0) {
291 nvram[j] = nvp->nvram[i];
298 while (nvp->nvram[i] != 0)
312 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
313 * devices. Strip it down for one device, use domain_nr/bus_nr to determine
314 * which data is to be returned. v2 is the version where nvram is stored
315 * uncompressed, all relevant valid entries are identified by
316 * pcie/domain_nr/bus_nr:
318 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
321 char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
326 nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
332 /* Copy all valid entries, release old nvram and assign new one.
333 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
336 snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
337 len = strlen(prefix);
340 while (i < nvp->nvram_len - len) {
341 if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
343 if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
344 nvp->boardrev_found = true;
345 while (nvp->nvram[i] != 0) {
346 nvram[j] = nvp->nvram[i];
353 while (nvp->nvram[i] != 0)
362 static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
364 if (nvp->boardrev_found)
367 memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
368 strlen(BRCMF_FW_DEFAULT_BOARDREV));
369 nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
370 nvp->nvram[nvp->nvram_len] = '\0';
374 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
375 * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
376 * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
377 * End of buffer is completed with token identifying length of buffer.
379 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
380 u32 *new_length, u16 domain_nr, u16 bus_nr)
382 struct nvram_parser nvp;
387 if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
390 while (nvp.pos < data_len) {
391 nvp.state = nv_parser_states[nvp.state](&nvp);
392 if (nvp.state == END)
395 if (nvp.multi_dev_v1) {
396 nvp.boardrev_found = false;
397 brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
398 } else if (nvp.multi_dev_v2) {
399 nvp.boardrev_found = false;
400 brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
403 if (nvp.nvram_len == 0) {
408 brcmf_fw_add_defaults(&nvp);
411 *new_length = roundup(nvp.nvram_len + 1, 4);
412 while (pad != *new_length) {
417 token = *new_length / 4;
418 token = (~token << 16) | (token & 0x0000FFFF);
419 token_le = cpu_to_le32(token);
421 memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
422 *new_length += sizeof(token_le);
427 void brcmf_fw_nvram_free(void *nvram)
434 struct brcmf_fw_request *req;
436 void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
440 /* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
441 * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
442 * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
443 * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
444 * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
445 * no-Initiate-Radiation mode. This means that we will never send on these
446 * channels without first having received valid wifi traffic on the channel.
448 static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
452 ccode = strnstr((char *)data, "ccode=ALL", data_len);
454 ccode = strnstr((char *)data, "ccode=XV\r", data_len);
463 static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
465 const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
466 struct efivar_entry *nvram_efivar;
467 unsigned long data_len = 0;
471 nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
475 memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
476 nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
477 0xb5, 0x1f, 0x43, 0x26,
478 0x81, 0x23, 0xd1, 0x13);
480 err = efivar_entry_size(nvram_efivar, &data_len);
484 data = kmalloc(data_len, GFP_KERNEL);
488 err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
492 brcmf_fw_fix_efi_nvram_ccode(data, data_len);
493 brcmf_info("Using nvram EFI variable\n");
496 *data_len_ret = data_len;
505 static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
508 static void brcmf_fw_free_request(struct brcmf_fw_request *req)
510 struct brcmf_fw_item *item;
513 for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
514 if (item->type == BRCMF_FW_TYPE_BINARY)
515 release_firmware(item->binary);
516 else if (item->type == BRCMF_FW_TYPE_NVRAM)
517 brcmf_fw_nvram_free(item->nv_data.data);
522 static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
524 struct brcmf_fw *fwctx = ctx;
525 struct brcmf_fw_item *cur;
526 bool free_bcm47xx_nvram = false;
527 bool kfree_nvram = false;
528 u32 nvram_length = 0;
533 brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
535 cur = &fwctx->req->items[fwctx->curpos];
537 if (fw && fw->data) {
538 data = (u8 *)fw->data;
541 if ((data = bcm47xx_nvram_get_contents(&data_len)))
542 free_bcm47xx_nvram = true;
543 else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
545 else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
550 char *ccode = strnstr((char *)data, "ccode=", data_len);
551 /* Ensure this is a whole token */
552 if (ccode && ((void *)ccode == (void *)data || isspace(ccode[-1]))) {
553 /* Comment out the line */
556 if (isupper(ccode[0]) && isupper(ccode[1]) &&
558 pr_debug("brcmfmac: intercepting ccode=%c%c\n",
560 saved_ccode[0] = ccode[0];
561 saved_ccode[1] = ccode[1];
565 nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
566 fwctx->req->domain_nr,
570 if (free_bcm47xx_nvram)
571 bcm47xx_nvram_release_contents(data);
575 release_firmware(fw);
576 if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
579 brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
580 cur->nv_data.data = nvram;
581 cur->nv_data.len = nvram_length;
588 static int brcmf_fw_complete_request(const struct firmware *fw,
589 struct brcmf_fw *fwctx)
591 struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
594 brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
597 case BRCMF_FW_TYPE_NVRAM:
598 ret = brcmf_fw_request_nvram_done(fw, fwctx);
600 case BRCMF_FW_TYPE_BINARY:
607 /* something fishy here so bail out early */
608 brcmf_err("unknown fw type: %d\n", cur->type);
609 release_firmware(fw);
613 return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
616 static char *brcm_alt_fw_path(const char *path, const char *board_type)
618 char alt_path[BRCMF_FW_NAME_LEN];
621 strscpy(alt_path, path, BRCMF_FW_NAME_LEN);
622 /* At least one character + suffix */
623 if (strlen(alt_path) < 5)
626 /* strip .txt or .bin at the end */
627 strscpy(suffix, alt_path + strlen(alt_path) - 4, 5);
628 alt_path[strlen(alt_path) - 4] = 0;
629 strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
630 strlcat(alt_path, board_type, BRCMF_FW_NAME_LEN);
631 strlcat(alt_path, suffix, BRCMF_FW_NAME_LEN);
633 return kstrdup(alt_path, GFP_KERNEL);
636 static int brcmf_fw_request_firmware(const struct firmware **fw,
637 struct brcmf_fw *fwctx)
639 struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
642 /* Files can be board-specific, first try a board-specific path */
643 if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
646 alt_path = brcm_alt_fw_path(cur->path, fwctx->req->board_type);
650 ret = firmware_request_nowarn(fw, alt_path, fwctx->dev);
657 return request_firmware(fw, cur->path, fwctx->dev);
660 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
662 struct brcmf_fw *fwctx = ctx;
665 ret = brcmf_fw_complete_request(fw, fwctx);
667 while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
668 brcmf_fw_request_firmware(&fw, fwctx);
669 ret = brcmf_fw_complete_request(fw, ctx);
673 brcmf_fw_free_request(fwctx->req);
676 fwctx->done(fwctx->dev, ret, fwctx->req);
680 static void brcmf_fw_request_done_alt_path(const struct firmware *fw, void *ctx)
682 struct brcmf_fw *fwctx = ctx;
683 struct brcmf_fw_item *first = &fwctx->req->items[0];
686 /* Fall back to canonical path if board firmware not found */
688 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
689 fwctx->dev, GFP_KERNEL, fwctx,
690 brcmf_fw_request_done);
693 brcmf_fw_request_done(fw, ctx);
696 static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
698 struct brcmf_fw_item *item;
704 for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
711 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
712 void (*fw_cb)(struct device *dev, int err,
713 struct brcmf_fw_request *req))
715 struct brcmf_fw_item *first = &req->items[0];
716 struct brcmf_fw *fwctx;
717 char *alt_path = NULL;
720 brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
724 if (!brcmf_fw_request_is_valid(req))
727 fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
735 /* First try alternative board-specific path if any */
736 if (fwctx->req->board_type)
737 alt_path = brcm_alt_fw_path(first->path,
738 fwctx->req->board_type);
740 ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
741 fwctx->dev, GFP_KERNEL, fwctx,
742 brcmf_fw_request_done_alt_path);
745 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
746 fwctx->dev, GFP_KERNEL, fwctx,
747 brcmf_fw_request_done);
750 brcmf_fw_request_done(NULL, fwctx);
755 struct brcmf_fw_request *
756 brcmf_fw_alloc_request(u32 chip, u32 chiprev,
757 const struct brcmf_firmware_mapping mapping_table[],
758 u32 table_size, struct brcmf_fw_name *fwnames,
761 struct brcmf_fw_request *fwreq;
768 for (i = 0; i < table_size; i++) {
769 if (mapping_table[i].chipid == chip &&
770 mapping_table[i].revmask & BIT(chiprev))
774 brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
776 if (i == table_size) {
777 brcmf_err("Unknown chip %s\n", chipname);
781 fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
785 brcmf_info("using %s for chip %s\n",
786 mapping_table[i].fw_base, chipname);
788 mp_path = brcmf_mp_global.firmware_path;
789 mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
791 end = mp_path[mp_path_len - 1];
793 fwreq->n_items = n_fwnames;
795 for (j = 0; j < n_fwnames; j++) {
796 fwreq->items[j].path = fwnames[j].path;
797 fwnames[j].path[0] = '\0';
798 /* check if firmware path is provided by module parameter */
799 if (brcmf_mp_global.firmware_path[0] != '\0') {
800 strlcpy(fwnames[j].path, mp_path,
804 strlcat(fwnames[j].path, "/",
808 strlcat(fwnames[j].path, mapping_table[i].fw_base,
810 strlcat(fwnames[j].path, fwnames[j].extension,
812 fwreq->items[j].path = fwnames[j].path;