1
2
3
4
5
6#include <linux/efi.h>
7#include <linux/kernel.h>
8#include <linux/slab.h>
9#include <linux/device.h>
10#include <linux/firmware.h>
11#include <linux/module.h>
12#include <linux/bcm47xx_nvram.h>
13
14#include "debug.h"
15#include "firmware.h"
16#include "core.h"
17#include "common.h"
18#include "chip.h"
19
20#define BRCMF_FW_MAX_NVRAM_SIZE 64000
21#define BRCMF_FW_NVRAM_DEVPATH_LEN 19
22#define BRCMF_FW_NVRAM_PCIEDEV_LEN 10
23#define BRCMF_FW_DEFAULT_BOARDREV "boardrev=0xff"
24
25enum nvram_parser_state {
26 IDLE,
27 KEY,
28 VALUE,
29 COMMENT,
30 END
31};
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48struct nvram_parser {
49 enum nvram_parser_state state;
50 const u8 *data;
51 u8 *nvram;
52 u32 nvram_len;
53 u32 line;
54 u32 column;
55 u32 pos;
56 u32 entry;
57 bool multi_dev_v1;
58 bool multi_dev_v2;
59 bool boardrev_found;
60};
61
62
63
64
65
66
67
68static bool is_nvram_char(char c)
69{
70
71 if (c == '#')
72 return false;
73
74
75 return (c >= 0x20 && c < 0x7f);
76}
77
78static bool is_whitespace(char c)
79{
80 return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
81}
82
83static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
84{
85 char c;
86
87 c = nvp->data[nvp->pos];
88 if (c == '\n')
89 return COMMENT;
90 if (is_whitespace(c) || c == '\0')
91 goto proceed;
92 if (c == '#')
93 return COMMENT;
94 if (is_nvram_char(c)) {
95 nvp->entry = nvp->pos;
96 return KEY;
97 }
98 brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
99 nvp->line, nvp->column);
100proceed:
101 nvp->column++;
102 nvp->pos++;
103 return IDLE;
104}
105
106static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
107{
108 enum nvram_parser_state st = nvp->state;
109 char c;
110
111 c = nvp->data[nvp->pos];
112 if (c == '=') {
113
114 if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
115 st = COMMENT;
116 else
117 st = VALUE;
118 if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
119 nvp->multi_dev_v1 = true;
120 if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
121 nvp->multi_dev_v2 = true;
122 if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
123 nvp->boardrev_found = true;
124 } else if (!is_nvram_char(c) || c == ' ') {
125 brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
126 nvp->line, nvp->column);
127 return COMMENT;
128 }
129
130 nvp->column++;
131 nvp->pos++;
132 return st;
133}
134
135static enum nvram_parser_state
136brcmf_nvram_handle_value(struct nvram_parser *nvp)
137{
138 char c;
139 char *skv;
140 char *ekv;
141 u32 cplen;
142
143 c = nvp->data[nvp->pos];
144 if (!is_nvram_char(c)) {
145
146 ekv = (u8 *)&nvp->data[nvp->pos];
147 skv = (u8 *)&nvp->data[nvp->entry];
148 cplen = ekv - skv;
149 if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
150 return END;
151
152 memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
153 nvp->nvram_len += cplen;
154 nvp->nvram[nvp->nvram_len] = '\0';
155 nvp->nvram_len++;
156 return IDLE;
157 }
158 nvp->pos++;
159 nvp->column++;
160 return VALUE;
161}
162
163static enum nvram_parser_state
164brcmf_nvram_handle_comment(struct nvram_parser *nvp)
165{
166 char *eoc, *sol;
167
168 sol = (char *)&nvp->data[nvp->pos];
169 eoc = strchr(sol, '\n');
170 if (!eoc) {
171 eoc = strchr(sol, '\0');
172 if (!eoc)
173 return END;
174 }
175
176
177 nvp->line++;
178 nvp->column = 1;
179 nvp->pos += (eoc - sol) + 1;
180 return IDLE;
181}
182
183static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
184{
185
186 return END;
187}
188
189static enum nvram_parser_state
190(*nv_parser_states[])(struct nvram_parser *nvp) = {
191 brcmf_nvram_handle_idle,
192 brcmf_nvram_handle_key,
193 brcmf_nvram_handle_value,
194 brcmf_nvram_handle_comment,
195 brcmf_nvram_handle_end
196};
197
198static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
199 const u8 *data, size_t data_len)
200{
201 size_t size;
202
203 memset(nvp, 0, sizeof(*nvp));
204 nvp->data = data;
205
206 if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
207 size = BRCMF_FW_MAX_NVRAM_SIZE;
208 else
209 size = data_len;
210
211 size += 1 + 3 + sizeof(u32);
212 nvp->nvram = kzalloc(size, GFP_KERNEL);
213 if (!nvp->nvram)
214 return -ENOMEM;
215
216 nvp->line = 1;
217 nvp->column = 1;
218 return 0;
219}
220
221
222
223
224
225
226static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
227 u16 bus_nr)
228{
229
230 char pci_path[] = "=pci/?/?";
231 size_t pci_len;
232 char pcie_path[] = "=pcie/?/?";
233 size_t pcie_len;
234
235 u32 i, j;
236 bool found;
237 u8 *nvram;
238 u8 id;
239
240 nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
241 if (!nvram)
242 goto fail;
243
244
245 if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
246 goto fail;
247
248
249
250
251 snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
252 bus_nr);
253 pci_len = strlen(pci_path);
254 snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
255 bus_nr);
256 pcie_len = strlen(pcie_path);
257 found = false;
258 i = 0;
259 while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
260
261
262
263 if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
264 (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
265 !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
266 id = nvp->nvram[i + 7] - '0';
267 found = true;
268 break;
269 }
270 while (nvp->nvram[i] != 0)
271 i++;
272 i++;
273 }
274 if (!found)
275 goto fail;
276
277
278 i = 0;
279 j = 0;
280 while (i < nvp->nvram_len) {
281 if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
282 i += 2;
283 if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
284 nvp->boardrev_found = true;
285 while (nvp->nvram[i] != 0) {
286 nvram[j] = nvp->nvram[i];
287 i++;
288 j++;
289 }
290 nvram[j] = 0;
291 j++;
292 }
293 while (nvp->nvram[i] != 0)
294 i++;
295 i++;
296 }
297 kfree(nvp->nvram);
298 nvp->nvram = nvram;
299 nvp->nvram_len = j;
300 return;
301
302fail:
303 kfree(nvram);
304 nvp->nvram_len = 0;
305}
306
307
308
309
310
311
312
313static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
314 u16 bus_nr)
315{
316 char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
317 size_t len;
318 u32 i, j;
319 u8 *nvram;
320
321 nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
322 if (!nvram) {
323 nvp->nvram_len = 0;
324 return;
325 }
326
327
328
329
330
331 snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
332 len = strlen(prefix);
333 i = 0;
334 j = 0;
335 while (i < nvp->nvram_len - len) {
336 if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
337 i += len;
338 if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
339 nvp->boardrev_found = true;
340 while (nvp->nvram[i] != 0) {
341 nvram[j] = nvp->nvram[i];
342 i++;
343 j++;
344 }
345 nvram[j] = 0;
346 j++;
347 }
348 while (nvp->nvram[i] != 0)
349 i++;
350 i++;
351 }
352 kfree(nvp->nvram);
353 nvp->nvram = nvram;
354 nvp->nvram_len = j;
355}
356
357static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
358{
359 if (nvp->boardrev_found)
360 return;
361
362 memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
363 strlen(BRCMF_FW_DEFAULT_BOARDREV));
364 nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
365 nvp->nvram[nvp->nvram_len] = '\0';
366 nvp->nvram_len++;
367}
368
369
370
371
372
373
374static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
375 u32 *new_length, u16 domain_nr, u16 bus_nr)
376{
377 struct nvram_parser nvp;
378 u32 pad;
379 u32 token;
380 __le32 token_le;
381
382 if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
383 return NULL;
384
385 while (nvp.pos < data_len) {
386 nvp.state = nv_parser_states[nvp.state](&nvp);
387 if (nvp.state == END)
388 break;
389 }
390 if (nvp.multi_dev_v1) {
391 nvp.boardrev_found = false;
392 brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
393 } else if (nvp.multi_dev_v2) {
394 nvp.boardrev_found = false;
395 brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
396 }
397
398 if (nvp.nvram_len == 0) {
399 kfree(nvp.nvram);
400 return NULL;
401 }
402
403 brcmf_fw_add_defaults(&nvp);
404
405 pad = nvp.nvram_len;
406 *new_length = roundup(nvp.nvram_len + 1, 4);
407 while (pad != *new_length) {
408 nvp.nvram[pad] = 0;
409 pad++;
410 }
411
412 token = *new_length / 4;
413 token = (~token << 16) | (token & 0x0000FFFF);
414 token_le = cpu_to_le32(token);
415
416 memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
417 *new_length += sizeof(token_le);
418
419 return nvp.nvram;
420}
421
422void brcmf_fw_nvram_free(void *nvram)
423{
424 kfree(nvram);
425}
426
427struct brcmf_fw {
428 struct device *dev;
429 struct brcmf_fw_request *req;
430 u32 curpos;
431 void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
432};
433
434#ifdef CONFIG_EFI
435
436
437
438
439
440
441
442
443static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
444{
445 char *ccode;
446
447 ccode = strnstr((char *)data, "ccode=ALL", data_len);
448 if (!ccode)
449 ccode = strnstr((char *)data, "ccode=XV\r", data_len);
450 if (!ccode)
451 return;
452
453 ccode[6] = 'X';
454 ccode[7] = '2';
455 ccode[8] = '\r';
456}
457
458static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
459{
460 const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
461 struct efivar_entry *nvram_efivar;
462 unsigned long data_len = 0;
463 u8 *data = NULL;
464 int err;
465
466 nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
467 if (!nvram_efivar)
468 return NULL;
469
470 memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
471 nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
472 0xb5, 0x1f, 0x43, 0x26,
473 0x81, 0x23, 0xd1, 0x13);
474
475 err = efivar_entry_size(nvram_efivar, &data_len);
476 if (err)
477 goto fail;
478
479 data = kmalloc(data_len, GFP_KERNEL);
480 if (!data)
481 goto fail;
482
483 err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
484 if (err)
485 goto fail;
486
487 brcmf_fw_fix_efi_nvram_ccode(data, data_len);
488 brcmf_info("Using nvram EFI variable\n");
489
490 kfree(nvram_efivar);
491 *data_len_ret = data_len;
492 return data;
493
494fail:
495 kfree(data);
496 kfree(nvram_efivar);
497 return NULL;
498}
499#else
500static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
501#endif
502
503static void brcmf_fw_free_request(struct brcmf_fw_request *req)
504{
505 struct brcmf_fw_item *item;
506 int i;
507
508 for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
509 if (item->type == BRCMF_FW_TYPE_BINARY)
510 release_firmware(item->binary);
511 else if (item->type == BRCMF_FW_TYPE_NVRAM)
512 brcmf_fw_nvram_free(item->nv_data.data);
513 }
514 kfree(req);
515}
516
517static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
518{
519 struct brcmf_fw *fwctx = ctx;
520 struct brcmf_fw_item *cur;
521 bool free_bcm47xx_nvram = false;
522 bool kfree_nvram = false;
523 u32 nvram_length = 0;
524 void *nvram = NULL;
525 u8 *data = NULL;
526 size_t data_len;
527
528 brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
529
530 cur = &fwctx->req->items[fwctx->curpos];
531
532 if (fw && fw->data) {
533 data = (u8 *)fw->data;
534 data_len = fw->size;
535 } else {
536 if ((data = bcm47xx_nvram_get_contents(&data_len)))
537 free_bcm47xx_nvram = true;
538 else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
539 kfree_nvram = true;
540 else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
541 goto fail;
542 }
543
544 if (data)
545 nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
546 fwctx->req->domain_nr,
547 fwctx->req->bus_nr);
548
549 if (free_bcm47xx_nvram)
550 bcm47xx_nvram_release_contents(data);
551 if (kfree_nvram)
552 kfree(data);
553
554 release_firmware(fw);
555 if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
556 goto fail;
557
558 brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
559 cur->nv_data.data = nvram;
560 cur->nv_data.len = nvram_length;
561 return 0;
562
563fail:
564 return -ENOENT;
565}
566
567static int brcmf_fw_complete_request(const struct firmware *fw,
568 struct brcmf_fw *fwctx)
569{
570 struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
571 int ret = 0;
572
573 brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
574
575 switch (cur->type) {
576 case BRCMF_FW_TYPE_NVRAM:
577 ret = brcmf_fw_request_nvram_done(fw, fwctx);
578 break;
579 case BRCMF_FW_TYPE_BINARY:
580 if (fw)
581 cur->binary = fw;
582 else
583 ret = -ENOENT;
584 break;
585 default:
586
587 brcmf_err("unknown fw type: %d\n", cur->type);
588 release_firmware(fw);
589 ret = -EINVAL;
590 }
591
592 return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
593}
594
595static char *brcm_alt_fw_path(const char *path, const char *board_type)
596{
597 char alt_path[BRCMF_FW_NAME_LEN];
598 char suffix[5];
599
600 strscpy(alt_path, path, BRCMF_FW_NAME_LEN);
601
602 if (strlen(alt_path) < 5)
603 return NULL;
604
605
606 strscpy(suffix, alt_path + strlen(alt_path) - 4, 5);
607 alt_path[strlen(alt_path) - 4] = 0;
608 strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
609 strlcat(alt_path, board_type, BRCMF_FW_NAME_LEN);
610 strlcat(alt_path, suffix, BRCMF_FW_NAME_LEN);
611
612 return kstrdup(alt_path, GFP_KERNEL);
613}
614
615static int brcmf_fw_request_firmware(const struct firmware **fw,
616 struct brcmf_fw *fwctx)
617{
618 struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
619 int ret;
620
621
622 if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
623 char *alt_path;
624
625 alt_path = brcm_alt_fw_path(cur->path, fwctx->req->board_type);
626 if (!alt_path)
627 goto fallback;
628
629 ret = request_firmware(fw, alt_path, fwctx->dev);
630 kfree(alt_path);
631 if (ret == 0)
632 return ret;
633 }
634
635fallback:
636 return request_firmware(fw, cur->path, fwctx->dev);
637}
638
639static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
640{
641 struct brcmf_fw *fwctx = ctx;
642 int ret;
643
644 ret = brcmf_fw_complete_request(fw, fwctx);
645
646 while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
647 brcmf_fw_request_firmware(&fw, fwctx);
648 ret = brcmf_fw_complete_request(fw, ctx);
649 }
650
651 if (ret) {
652 brcmf_fw_free_request(fwctx->req);
653 fwctx->req = NULL;
654 }
655 fwctx->done(fwctx->dev, ret, fwctx->req);
656 kfree(fwctx);
657}
658
659static void brcmf_fw_request_done_alt_path(const struct firmware *fw, void *ctx)
660{
661 struct brcmf_fw *fwctx = ctx;
662 struct brcmf_fw_item *first = &fwctx->req->items[0];
663 int ret = 0;
664
665
666 if (!fw)
667 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
668 fwctx->dev, GFP_KERNEL, fwctx,
669 brcmf_fw_request_done);
670
671 if (fw || ret < 0)
672 brcmf_fw_request_done(fw, ctx);
673}
674
675static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
676{
677 struct brcmf_fw_item *item;
678 int i;
679
680 if (!req->n_items)
681 return false;
682
683 for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
684 if (!item->path)
685 return false;
686 }
687 return true;
688}
689
690int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
691 void (*fw_cb)(struct device *dev, int err,
692 struct brcmf_fw_request *req))
693{
694 struct brcmf_fw_item *first = &req->items[0];
695 struct brcmf_fw *fwctx;
696 char *alt_path;
697 int ret;
698
699 brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
700 if (!fw_cb)
701 return -EINVAL;
702
703 if (!brcmf_fw_request_is_valid(req))
704 return -EINVAL;
705
706 fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
707 if (!fwctx)
708 return -ENOMEM;
709
710 fwctx->dev = dev;
711 fwctx->req = req;
712 fwctx->done = fw_cb;
713
714
715 alt_path = brcm_alt_fw_path(first->path, fwctx->req->board_type);
716 if (alt_path) {
717 ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
718 fwctx->dev, GFP_KERNEL, fwctx,
719 brcmf_fw_request_done_alt_path);
720 kfree(alt_path);
721 } else {
722 ret = request_firmware_nowait(THIS_MODULE, true, first->path,
723 fwctx->dev, GFP_KERNEL, fwctx,
724 brcmf_fw_request_done);
725 }
726 if (ret < 0)
727 brcmf_fw_request_done(NULL, fwctx);
728
729 return 0;
730}
731
732struct brcmf_fw_request *
733brcmf_fw_alloc_request(u32 chip, u32 chiprev,
734 const struct brcmf_firmware_mapping mapping_table[],
735 u32 table_size, struct brcmf_fw_name *fwnames,
736 u32 n_fwnames)
737{
738 struct brcmf_fw_request *fwreq;
739 char chipname[12];
740 const char *mp_path;
741 size_t mp_path_len;
742 u32 i, j;
743 char end = '\0';
744
745 for (i = 0; i < table_size; i++) {
746 if (mapping_table[i].chipid == chip &&
747 mapping_table[i].revmask & BIT(chiprev))
748 break;
749 }
750
751 brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
752
753 if (i == table_size) {
754 brcmf_err("Unknown chip %s\n", chipname);
755 return NULL;
756 }
757
758 fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
759 if (!fwreq)
760 return NULL;
761
762 brcmf_info("using %s for chip %s\n",
763 mapping_table[i].fw_base, chipname);
764
765 mp_path = brcmf_mp_global.firmware_path;
766 mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
767 if (mp_path_len)
768 end = mp_path[mp_path_len - 1];
769
770 fwreq->n_items = n_fwnames;
771
772 for (j = 0; j < n_fwnames; j++) {
773 fwreq->items[j].path = fwnames[j].path;
774 fwnames[j].path[0] = '\0';
775
776 if (brcmf_mp_global.firmware_path[0] != '\0') {
777 strlcpy(fwnames[j].path, mp_path,
778 BRCMF_FW_NAME_LEN);
779
780 if (end != '/') {
781 strlcat(fwnames[j].path, "/",
782 BRCMF_FW_NAME_LEN);
783 }
784 }
785 strlcat(fwnames[j].path, mapping_table[i].fw_base,
786 BRCMF_FW_NAME_LEN);
787 strlcat(fwnames[j].path, fwnames[j].extension,
788 BRCMF_FW_NAME_LEN);
789 fwreq->items[j].path = fwnames[j].path;
790 }
791
792 return fwreq;
793}
794