drivers/net/wireless/ath/wil6210/fw_inc.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2014-2017 Qualcomm Atheros, Inc.
   4  * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
   5  */
   6
   7 /* Algorithmic part of the firmware download.
   8  * To be included in the container file providing framework
   9  */
  10
  11 #define wil_err_fw(wil, fmt, arg...) wil_err(wil, "ERR[ FW ]" fmt, ##arg)
  12 #define wil_dbg_fw(wil, fmt, arg...) wil_dbg(wil, "DBG[ FW ]" fmt, ##arg)
  13 #define wil_hex_dump_fw(prefix_str, prefix_type, rowsize,               \
  14                         groupsize, buf, len, ascii)                     \
  15                         print_hex_dump_debug("DBG[ FW ]" prefix_str,    \
  16                                              prefix_type, rowsize,      \
  17                                              groupsize, buf, len, ascii)
  18
  19 static bool wil_fw_addr_check(struct wil6210_priv *wil,
  20                               void __iomem **ioaddr, __le32 val,
  21                               u32 size, const char *msg)
  22 {
  23         *ioaddr = wmi_buffer_block(wil, val, size);
  24         if (!(*ioaddr)) {
  25                 wil_err_fw(wil, "bad %s: 0x%08x\n", msg, le32_to_cpu(val));
  26                 return false;
  27         }
  28         return true;
  29 }
  30
  31 /**
  32  * wil_fw_verify - verify firmware file validity
  33  *
  34  * perform various checks for the firmware file header.
  35  * records are not validated.
  36  *
  37  * Return file size or negative error
  38  */
  39 static int wil_fw_verify(struct wil6210_priv *wil, const u8 *data, size_t size)
  40 {
  41         const struct wil_fw_record_head *hdr = (const void *)data;
  42         struct wil_fw_record_file_header fh;
  43         const struct wil_fw_record_file_header *fh_;
  44         u32 crc;
  45         u32 dlen;
  46
  47         if (size % 4) {
  48                 wil_err_fw(wil, "image size not aligned: %zu\n", size);
  49                 return -EINVAL;
  50         }
  51         /* have enough data for the file header? */
  52         if (size < sizeof(*hdr) + sizeof(fh)) {
  53                 wil_err_fw(wil, "file too short: %zu bytes\n", size);
  54                 return -EINVAL;
  55         }
  56
  57         /* start with the file header? */
  58         if (le16_to_cpu(hdr->type) != wil_fw_type_file_header) {
  59                 wil_err_fw(wil, "no file header\n");
  60                 return -EINVAL;
  61         }
  62
  63         /* data_len */
  64         fh_ = (struct wil_fw_record_file_header *)&hdr[1];
  65         dlen = le32_to_cpu(fh_->data_len);
  66         if (dlen % 4) {
  67                 wil_err_fw(wil, "data length not aligned: %lu\n", (ulong)dlen);
  68                 return -EINVAL;
  69         }
  70         if (size < dlen) {
  71                 wil_err_fw(wil, "file truncated at %zu/%lu\n",
  72                            size, (ulong)dlen);
  73                 return -EINVAL;
  74         }
  75         if (dlen < sizeof(*hdr) + sizeof(fh)) {
  76                 wil_err_fw(wil, "data length too short: %lu\n", (ulong)dlen);
  77                 return -EINVAL;
  78         }
  79
  80         /* signature */
  81         if (le32_to_cpu(fh_->signature) != WIL_FW_SIGNATURE) {
  82                 wil_err_fw(wil, "bad header signature: 0x%08x\n",
  83                            le32_to_cpu(fh_->signature));
  84                 return -EINVAL;
  85         }
  86
  87         /* version */
  88         if (le32_to_cpu(fh_->version) > WIL_FW_FMT_VERSION) {
  89                 wil_err_fw(wil, "unsupported header version: %d\n",
  90                            le32_to_cpu(fh_->version));
  91                 return -EINVAL;
  92         }
  93
  94         /* checksum. ~crc32(~0, data, size) when fh.crc set to 0*/
  95         fh = *fh_;
  96         fh.crc = 0;
  97
  98         crc = crc32_le(~0, (unsigned char const *)hdr, sizeof(*hdr));
  99         crc = crc32_le(crc, (unsigned char const *)&fh, sizeof(fh));
 100         crc = crc32_le(crc, (unsigned char const *)&fh_[1],
 101                        dlen - sizeof(*hdr) - sizeof(fh));
 102         crc = ~crc;
 103
 104         if (crc != le32_to_cpu(fh_->crc)) {
 105                 wil_err_fw(wil, "checksum mismatch:"
 106                            " calculated for %lu bytes 0x%08x != 0x%08x\n",
 107                            (ulong)dlen, crc, le32_to_cpu(fh_->crc));
 108                 return -EINVAL;
 109         }
 110
 111         return (int)dlen;
 112 }
 113
 114 static int fw_ignore_section(struct wil6210_priv *wil, const void *data,
 115                              size_t size)
 116 {
 117         return 0;
 118 }
 119
 120 static int
 121 fw_handle_capabilities(struct wil6210_priv *wil, const void *data,
 122                        size_t size)
 123 {
 124         const struct wil_fw_record_capabilities *rec = data;
 125         size_t capa_size;
 126
 127         if (size < sizeof(*rec)) {
 128                 wil_err_fw(wil, "capabilities record too short: %zu\n", size);
 129                 /* let the FW load anyway */
 130                 return 0;
 131         }
 132
 133         capa_size = size - offsetof(struct wil_fw_record_capabilities,
 134                                     capabilities);
 135         bitmap_zero(wil->fw_capabilities, WMI_FW_CAPABILITY_MAX);
 136         memcpy(wil->fw_capabilities, rec->capabilities,
 137                min_t(size_t, sizeof(wil->fw_capabilities), capa_size));
 138         wil_hex_dump_fw("CAPA", DUMP_PREFIX_OFFSET, 16, 1,
 139                         rec->capabilities, capa_size, false);
 140         return 0;
 141 }
 142
 143 static int
 144 fw_handle_brd_file(struct wil6210_priv *wil, const void *data,
 145                    size_t size)
 146 {
 147         const struct wil_fw_record_brd_file *rec = data;
 148         u32 max_num_ent, i, ent_size;
 149
 150         if (size <= offsetof(struct wil_fw_record_brd_file, brd_info)) {
 151                 wil_err(wil, "board record too short, size %zu\n", size);
 152                 return -EINVAL;
 153         }
 154
 155         ent_size = size - offsetof(struct wil_fw_record_brd_file, brd_info);
 156         max_num_ent = ent_size / sizeof(struct brd_info);
 157
 158         if (!max_num_ent) {
 159                 wil_err(wil, "brd info entries are missing\n");
 160                 return -EINVAL;
 161         }
 162
 163         wil->brd_info = kcalloc(max_num_ent, sizeof(struct wil_brd_info),
 164                                 GFP_KERNEL);
 165         if (!wil->brd_info)
 166                 return -ENOMEM;
 167
 168         for (i = 0; i < max_num_ent; i++) {
 169                 wil->brd_info[i].file_addr =
 170                         le32_to_cpu(rec->brd_info[i].base_addr);
 171                 wil->brd_info[i].file_max_size =
 172                         le32_to_cpu(rec->brd_info[i].max_size_bytes);
 173
 174                 if (!wil->brd_info[i].file_addr)
 175                         break;
 176
 177                 wil_dbg_fw(wil,
 178                            "brd info %d: file_addr 0x%x, file_max_size %d\n",
 179                            i, wil->brd_info[i].file_addr,
 180                            wil->brd_info[i].file_max_size);
 181         }
 182
 183         wil->num_of_brd_entries = i;
 184         if (wil->num_of_brd_entries == 0) {
 185                 kfree(wil->brd_info);
 186                 wil->brd_info = NULL;
 187                 wil_dbg_fw(wil,
 188                            "no valid brd info entries, using brd file addr\n");
 189
 190         } else {
 191                 wil_dbg_fw(wil, "num of brd info entries %d\n",
 192                            wil->num_of_brd_entries);
 193         }
 194
 195         return 0;
 196 }
 197
 198 static int
 199 fw_handle_concurrency(struct wil6210_priv *wil, const void *data,
 200                       size_t size)
 201 {
 202         const struct wil_fw_record_concurrency *rec = data;
 203         const struct wil_fw_concurrency_combo *combo;
 204         const struct wil_fw_concurrency_limit *limit;
 205         size_t remain, lsize;
 206         int i, n_combos;
 207
 208         if (size < sizeof(*rec)) {
 209                 wil_err_fw(wil, "concurrency record too short: %zu\n", size);
 210                 /* continue, let the FW load anyway */
 211                 return 0;
 212         }
 213
 214         n_combos = le16_to_cpu(rec->n_combos);
 215         remain = size - sizeof(struct wil_fw_record_concurrency);
 216         combo = (const struct wil_fw_concurrency_combo *)(rec + 1);
 217         for (i = 0; i < n_combos; i++) {
 218                 if (remain < sizeof(*combo))
 219                         goto out_short;
 220                 remain -= sizeof(*combo);
 221                 limit = combo->limits;
 222                 lsize = combo->n_limits * sizeof(*limit);
 223                 if (remain < lsize)
 224                         goto out_short;
 225                 remain -= lsize;
 226                 limit += combo->n_limits;
 227                 combo = (struct wil_fw_concurrency_combo *)limit;
 228         }
 229
 230         return wil_cfg80211_iface_combinations_from_fw(wil, rec);
 231 out_short:
 232         wil_err_fw(wil, "concurrency record truncated\n");
 233         return 0;
 234 }
 235
 236 static int
 237 fw_handle_comment(struct wil6210_priv *wil, const void *data,
 238                   size_t size)
 239 {
 240         const struct wil_fw_record_comment_hdr *hdr = data;
 241         u32 magic;
 242         int rc = 0;
 243
 244         if (size < sizeof(*hdr))
 245                 return 0;
 246
 247         magic = le32_to_cpu(hdr->magic);
 248
 249         switch (magic) {
 250         case WIL_FW_CAPABILITIES_MAGIC:
 251                 wil_dbg_fw(wil, "magic is WIL_FW_CAPABILITIES_MAGIC\n");
 252                 rc = fw_handle_capabilities(wil, data, size);
 253                 break;
 254         case WIL_BRD_FILE_MAGIC:
 255                 wil_dbg_fw(wil, "magic is WIL_BRD_FILE_MAGIC\n");
 256                 rc = fw_handle_brd_file(wil, data, size);
 257                 break;
 258         case WIL_FW_CONCURRENCY_MAGIC:
 259                 wil_dbg_fw(wil, "magic is WIL_FW_CONCURRENCY_MAGIC\n");
 260                 rc = fw_handle_concurrency(wil, data, size);
 261                 break;
 262         default:
 263                 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1,
 264                                 data, size, true);
 265         }
 266
 267         return rc;
 268 }
 269
 270 static int __fw_handle_data(struct wil6210_priv *wil, const void *data,
 271                             size_t size, __le32 addr)
 272 {
 273         const struct wil_fw_record_data *d = data;
 274         void __iomem *dst;
 275         size_t s = size - sizeof(*d);
 276
 277         if (size < sizeof(*d) + sizeof(u32)) {
 278                 wil_err_fw(wil, "data record too short: %zu\n", size);
 279                 return -EINVAL;
 280         }
 281
 282         if (!wil_fw_addr_check(wil, &dst, addr, s, "address"))
 283                 return -EINVAL;
 284         wil_dbg_fw(wil, "write [0x%08x] <== %zu bytes\n", le32_to_cpu(addr), s);
 285         wil_memcpy_toio_32(dst, d->data, s);
 286         wmb(); /* finish before processing next record */
 287
 288         return 0;
 289 }
 290
 291 static int fw_handle_data(struct wil6210_priv *wil, const void *data,
 292                           size_t size)
 293 {
 294         const struct wil_fw_record_data *d = data;
 295
 296         return __fw_handle_data(wil, data, size, d->addr);
 297 }
 298
 299 static int fw_handle_fill(struct wil6210_priv *wil, const void *data,
 300                           size_t size)
 301 {
 302         const struct wil_fw_record_fill *d = data;
 303         void __iomem *dst;
 304         u32 v;
 305         size_t s = (size_t)le32_to_cpu(d->size);
 306
 307         if (size != sizeof(*d)) {
 308                 wil_err_fw(wil, "bad size for fill record: %zu\n", size);
 309                 return -EINVAL;
 310         }
 311
 312         if (s < sizeof(u32)) {
 313                 wil_err_fw(wil, "fill size too short: %zu\n", s);
 314                 return -EINVAL;
 315         }
 316
 317         if (s % sizeof(u32)) {
 318                 wil_err_fw(wil, "fill size not aligned: %zu\n", s);
 319                 return -EINVAL;
 320         }
 321
 322         if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address"))
 323                 return -EINVAL;
 324
 325         v = le32_to_cpu(d->value);
 326         wil_dbg_fw(wil, "fill [0x%08x] <== 0x%08x, %zu bytes\n",
 327                    le32_to_cpu(d->addr), v, s);
 328         wil_memset_toio_32(dst, v, s);
 329         wmb(); /* finish before processing next record */
 330
 331         return 0;
 332 }
 333
 334 static int fw_handle_file_header(struct wil6210_priv *wil, const void *data,
 335                                  size_t size)
 336 {
 337         const struct wil_fw_record_file_header *d = data;
 338
 339         if (size != sizeof(*d)) {
 340                 wil_err_fw(wil, "file header length incorrect: %zu\n", size);
 341                 return -EINVAL;
 342         }
 343
 344         wil_dbg_fw(wil, "new file, ver. %d, %i bytes\n",
 345                    d->version, d->data_len);
 346         wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, d->comment,
 347                         sizeof(d->comment), true);
 348
 349         if (!memcmp(d->comment, WIL_FW_VERSION_PREFIX,
 350                     WIL_FW_VERSION_PREFIX_LEN))
 351                 memcpy(wil->fw_version,
 352                        d->comment + WIL_FW_VERSION_PREFIX_LEN,
 353                        min(sizeof(d->comment) - WIL_FW_VERSION_PREFIX_LEN,
 354                            sizeof(wil->fw_version) - 1));
 355
 356         return 0;
 357 }
 358
 359 static int fw_handle_direct_write(struct wil6210_priv *wil, const void *data,
 360                                   size_t size)
 361 {
 362         const struct wil_fw_record_direct_write *d = data;
 363         const struct wil_fw_data_dwrite *block = d->data;
 364         int n, i;
 365
 366         if (size % sizeof(*block)) {
 367                 wil_err_fw(wil, "record size not aligned on %zu: %zu\n",
 368                            sizeof(*block), size);
 369                 return -EINVAL;
 370         }
 371         n = size / sizeof(*block);
 372
 373         for (i = 0; i < n; i++) {
 374                 void __iomem *dst;
 375                 u32 m = le32_to_cpu(block[i].mask);
 376                 u32 v = le32_to_cpu(block[i].value);
 377                 u32 x, y;
 378
 379                 if (!wil_fw_addr_check(wil, &dst, block[i].addr, 0, "address"))
 380                         return -EINVAL;
 381
 382                 x = readl(dst);
 383                 y = (x & m) | (v & ~m);
 384                 wil_dbg_fw(wil, "write [0x%08x] <== 0x%08x "
 385                            "(old 0x%08x val 0x%08x mask 0x%08x)\n",
 386                            le32_to_cpu(block[i].addr), y, x, v, m);
 387                 writel(y, dst);
 388                 wmb(); /* finish before processing next record */
 389         }
 390
 391         return 0;
 392 }
 393
 394 static int gw_write(struct wil6210_priv *wil, void __iomem *gwa_addr,
 395                     void __iomem *gwa_cmd, void __iomem *gwa_ctl, u32 gw_cmd,
 396                     u32 a)
 397 {
 398         unsigned delay = 0;
 399
 400         writel(a, gwa_addr);
 401         writel(gw_cmd, gwa_cmd);
 402         wmb(); /* finish before activate gw */
 403
 404         writel(WIL_FW_GW_CTL_RUN, gwa_ctl); /* activate gw */
 405         do {
 406                 udelay(1); /* typical time is few usec */
 407                 if (delay++ > 100) {
 408                         wil_err_fw(wil, "gw timeout\n");
 409                         return -EINVAL;
 410                 }
 411         } while (readl(gwa_ctl) & WIL_FW_GW_CTL_BUSY); /* gw done? */
 412
 413         return 0;
 414 }
 415
 416 static int fw_handle_gateway_data(struct wil6210_priv *wil, const void *data,
 417                                   size_t size)
 418 {
 419         const struct wil_fw_record_gateway_data *d = data;
 420         const struct wil_fw_data_gw *block = d->data;
 421         void __iomem *gwa_addr;
 422         void __iomem *gwa_val;
 423         void __iomem *gwa_cmd;
 424         void __iomem *gwa_ctl;
 425         u32 gw_cmd;
 426         int n, i;
 427
 428         if (size < sizeof(*d) + sizeof(*block)) {
 429                 wil_err_fw(wil, "gateway record too short: %zu\n", size);
 430                 return -EINVAL;
 431         }
 432
 433         if ((size - sizeof(*d)) % sizeof(*block)) {
 434                 wil_err_fw(wil, "gateway record data size"
 435                            " not aligned on %zu: %zu\n",
 436                            sizeof(*block), size - sizeof(*d));
 437                 return -EINVAL;
 438         }
 439         n = (size - sizeof(*d)) / sizeof(*block);
 440
 441         gw_cmd = le32_to_cpu(d->command);
 442
 443         wil_dbg_fw(wil, "gw write record [%3d] blocks, cmd 0x%08x\n",
 444                    n, gw_cmd);
 445
 446         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 447                                "gateway_addr_addr") ||
 448             !wil_fw_addr_check(wil, &gwa_val, d->gateway_value_addr, 0,
 449                                "gateway_value_addr") ||
 450             !wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 451                                "gateway_cmd_addr") ||
 452             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 453                                "gateway_ctrl_address"))
 454                 return -EINVAL;
 455
 456         wil_dbg_fw(wil, "gw addresses: addr 0x%08x val 0x%08x"
 457                    " cmd 0x%08x ctl 0x%08x\n",
 458                    le32_to_cpu(d->gateway_addr_addr),
 459                    le32_to_cpu(d->gateway_value_addr),
 460                    le32_to_cpu(d->gateway_cmd_addr),
 461                    le32_to_cpu(d->gateway_ctrl_address));
 462
 463         for (i = 0; i < n; i++) {
 464                 int rc;
 465                 u32 a = le32_to_cpu(block[i].addr);
 466                 u32 v = le32_to_cpu(block[i].value);
 467
 468                 wil_dbg_fw(wil, "  gw write[%3d] [0x%08x] <== 0x%08x\n",
 469                            i, a, v);
 470
 471                 writel(v, gwa_val);
 472                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 473                 if (rc)
 474                         return rc;
 475         }
 476
 477         return 0;
 478 }
 479
 480 static int fw_handle_gateway_data4(struct wil6210_priv *wil, const void *data,
 481                                    size_t size)
 482 {
 483         const struct wil_fw_record_gateway_data4 *d = data;
 484         const struct wil_fw_data_gw4 *block = d->data;
 485         void __iomem *gwa_addr;
 486         void __iomem *gwa_val[ARRAY_SIZE(block->value)];
 487         void __iomem *gwa_cmd;
 488         void __iomem *gwa_ctl;
 489         u32 gw_cmd;
 490         int n, i, k;
 491
 492         if (size < sizeof(*d) + sizeof(*block)) {
 493                 wil_err_fw(wil, "gateway4 record too short: %zu\n", size);
 494                 return -EINVAL;
 495         }
 496
 497         if ((size - sizeof(*d)) % sizeof(*block)) {
 498                 wil_err_fw(wil, "gateway4 record data size"
 499                            " not aligned on %zu: %zu\n",
 500                            sizeof(*block), size - sizeof(*d));
 501                 return -EINVAL;
 502         }
 503         n = (size - sizeof(*d)) / sizeof(*block);
 504
 505         gw_cmd = le32_to_cpu(d->command);
 506
 507         wil_dbg_fw(wil, "gw4 write record [%3d] blocks, cmd 0x%08x\n",
 508                    n, gw_cmd);
 509
 510         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 511                                "gateway_addr_addr"))
 512                 return -EINVAL;
 513         for (k = 0; k < ARRAY_SIZE(block->value); k++)
 514                 if (!wil_fw_addr_check(wil, &gwa_val[k],
 515                                        d->gateway_value_addr[k],
 516                                        0, "gateway_value_addr"))
 517                         return -EINVAL;
 518         if (!wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 519                                "gateway_cmd_addr") ||
 520             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 521                                "gateway_ctrl_address"))
 522                 return -EINVAL;
 523
 524         wil_dbg_fw(wil, "gw4 addresses: addr 0x%08x cmd 0x%08x ctl 0x%08x\n",
 525                    le32_to_cpu(d->gateway_addr_addr),
 526                    le32_to_cpu(d->gateway_cmd_addr),
 527                    le32_to_cpu(d->gateway_ctrl_address));
 528         wil_hex_dump_fw("val addresses: ", DUMP_PREFIX_NONE, 16, 4,
 529                         d->gateway_value_addr, sizeof(d->gateway_value_addr),
 530                         false);
 531
 532         for (i = 0; i < n; i++) {
 533                 int rc;
 534                 u32 a = le32_to_cpu(block[i].addr);
 535                 u32 v[ARRAY_SIZE(block->value)];
 536
 537                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 538                         v[k] = le32_to_cpu(block[i].value[k]);
 539
 540                 wil_dbg_fw(wil, "  gw4 write[%3d] [0x%08x] <==\n", i, a);
 541                 wil_hex_dump_fw("    val ", DUMP_PREFIX_NONE, 16, 4, v,
 542                                 sizeof(v), false);
 543
 544                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 545                         writel(v[k], gwa_val[k]);
 546                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 547                 if (rc)
 548                         return rc;
 549         }
 550
 551         return 0;
 552 }
 553
 554 static const struct {
 555         int type;
 556         int (*load_handler)(struct wil6210_priv *wil, const void *data,
 557                             size_t size);
 558         int (*parse_handler)(struct wil6210_priv *wil, const void *data,
 559                              size_t size);
 560 } wil_fw_handlers[] = {
 561         {wil_fw_type_comment, fw_handle_comment, fw_handle_comment},
 562         {wil_fw_type_data, fw_handle_data, fw_ignore_section},
 563         {wil_fw_type_fill, fw_handle_fill, fw_ignore_section},
 564         /* wil_fw_type_action */
 565         /* wil_fw_type_verify */
 566         {wil_fw_type_file_header, fw_handle_file_header,
 567                 fw_handle_file_header},
 568         {wil_fw_type_direct_write, fw_handle_direct_write, fw_ignore_section},
 569         {wil_fw_type_gateway_data, fw_handle_gateway_data, fw_ignore_section},
 570         {wil_fw_type_gateway_data4, fw_handle_gateway_data4,
 571                 fw_ignore_section},
 572 };
 573
 574 static int wil_fw_handle_record(struct wil6210_priv *wil, int type,
 575                                 const void *data, size_t size, bool load)
 576 {
 577         int i;
 578
 579         for (i = 0; i < ARRAY_SIZE(wil_fw_handlers); i++)
 580                 if (wil_fw_handlers[i].type == type)
 581                         return load ?
 582                                 wil_fw_handlers[i].load_handler(
 583                                         wil, data, size) :
 584                                 wil_fw_handlers[i].parse_handler(
 585                                         wil, data, size);
 586
 587         wil_err_fw(wil, "unknown record type: %d\n", type);
 588         return -EINVAL;
 589 }
 590
 591 /**
 592  * wil_fw_process - process section from FW file
 593  * if load is true: Load the FW and uCode code and data to the
 594  * corresponding device memory regions,
 595  * otherwise only parse and look for capabilities
 596  *
 597  * Return error code
 598  */
 599 static int wil_fw_process(struct wil6210_priv *wil, const void *data,
 600                           size_t size, bool load)
 601 {
 602         int rc = 0;
 603         const struct wil_fw_record_head *hdr;
 604         size_t s, hdr_sz;
 605
 606         for (hdr = data;; hdr = (const void *)hdr + s, size -= s) {
 607                 if (size < sizeof(*hdr))
 608                         break;
 609                 hdr_sz = le32_to_cpu(hdr->size);
 610                 s = sizeof(*hdr) + hdr_sz;
 611                 if (s > size)
 612                         break;
 613                 if (hdr_sz % 4) {
 614                         wil_err_fw(wil, "unaligned record size: %zu\n",
 615                                    hdr_sz);
 616                         return -EINVAL;
 617                 }
 618                 rc = wil_fw_handle_record(wil, le16_to_cpu(hdr->type),
 619                                           &hdr[1], hdr_sz, load);
 620                 if (rc)
 621                         return rc;
 622         }
 623         if (size) {
 624                 wil_err_fw(wil, "unprocessed bytes: %zu\n", size);
 625                 if (size >= sizeof(*hdr)) {
 626                         wil_err_fw(wil, "Stop at offset %ld"
 627                                    " record type %d [%zd bytes]\n",
 628                                    (long)((const void *)hdr - data),
 629                                    le16_to_cpu(hdr->type), hdr_sz);
 630                 }
 631                 return -EINVAL;
 632         }
 633
 634         return rc;
 635 }
 636
 637 /**
 638  * wil_request_firmware - Request firmware
 639  *
 640  * Request firmware image from the file
 641  * If load is true, load firmware to device, otherwise
 642  * only parse and extract capabilities
 643  *
 644  * Return error code
 645  */
 646 int wil_request_firmware(struct wil6210_priv *wil, const char *name,
 647                          bool load)
 648 {
 649         int rc, rc1;
 650         const struct firmware *fw;
 651         size_t sz;
 652         const void *d;
 653
 654         rc = request_firmware(&fw, name, wil_to_dev(wil));
 655         if (rc) {
 656                 wil_err_fw(wil, "Failed to load firmware %s rc %d\n", name, rc);
 657                 return rc;
 658         }
 659         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, fw->size);
 660
 661         /* re-initialize board info params */
 662         wil->num_of_brd_entries = 0;
 663         kfree(wil->brd_info);
 664         wil->brd_info = NULL;
 665
 666         for (sz = fw->size, d = fw->data; sz; sz -= rc1, d += rc1) {
 667                 rc1 = wil_fw_verify(wil, d, sz);
 668                 if (rc1 < 0) {
 669                         rc = rc1;
 670                         goto out;
 671                 }
 672                 rc = wil_fw_process(wil, d, rc1, load);
 673                 if (rc < 0)
 674                         goto out;
 675         }
 676
 677 out:
 678         release_firmware(fw);
 679         if (rc)
 680                 wil_err_fw(wil, "Loading <%s> failed, rc %d\n", name, rc);
 681         return rc;
 682 }
 683
 684 /**
 685  * wil_brd_process - process section from BRD file
 686  *
 687  * Return error code
 688  */
 689 static int wil_brd_process(struct wil6210_priv *wil, const void *data,
 690                            size_t size)
 691 {
 692         int rc = 0;
 693         const struct wil_fw_record_head *hdr = data;
 694         size_t s, hdr_sz = 0;
 695         u16 type;
 696         int i = 0;
 697
 698         /* Assuming the board file includes only one file header
 699          * and one or several data records.
 700          * Each record starts with wil_fw_record_head.
 701          */
 702         if (size < sizeof(*hdr))
 703                 return -EINVAL;
 704         s = sizeof(*hdr) + le32_to_cpu(hdr->size);
 705         if (s > size)
 706                 return -EINVAL;
 707
 708         /* Skip the header record and handle the data records */
 709         size -= s;
 710
 711         for (hdr = data + s;; hdr = (const void *)hdr + s, size -= s, i++) {
 712                 if (size < sizeof(*hdr))
 713                         break;
 714
 715                 if (i >= wil->num_of_brd_entries) {
 716                         wil_err_fw(wil,
 717                                    "Too many brd records: %d, num of expected entries %d\n",
 718                                    i, wil->num_of_brd_entries);
 719                         break;
 720                 }
 721
 722                 hdr_sz = le32_to_cpu(hdr->size);
 723                 s = sizeof(*hdr) + hdr_sz;
 724                 if (wil->brd_info[i].file_max_size &&
 725                     hdr_sz > wil->brd_info[i].file_max_size)
 726                         return -EINVAL;
 727                 if (sizeof(*hdr) + hdr_sz > size)
 728                         return -EINVAL;
 729                 if (hdr_sz % 4) {
 730                         wil_err_fw(wil, "unaligned record size: %zu\n",
 731                                    hdr_sz);
 732                         return -EINVAL;
 733                 }
 734                 type = le16_to_cpu(hdr->type);
 735                 if (type != wil_fw_type_data) {
 736                         wil_err_fw(wil,
 737                                    "invalid record type for board file: %d\n",
 738                                    type);
 739                         return -EINVAL;
 740                 }
 741                 if (hdr_sz < sizeof(struct wil_fw_record_data)) {
 742                         wil_err_fw(wil, "data record too short: %zu\n", hdr_sz);
 743                         return -EINVAL;
 744                 }
 745
 746                 wil_dbg_fw(wil,
 747                            "using info from fw file for record %d: addr[0x%08x], max size %d\n",
 748                            i, wil->brd_info[i].file_addr,
 749                            wil->brd_info[i].file_max_size);
 750
 751                 rc = __fw_handle_data(wil, &hdr[1], hdr_sz,
 752                                       cpu_to_le32(wil->brd_info[i].file_addr));
 753                 if (rc)
 754                         return rc;
 755         }
 756
 757         if (size) {
 758                 wil_err_fw(wil, "unprocessed bytes: %zu\n", size);
 759                 if (size >= sizeof(*hdr)) {
 760                         wil_err_fw(wil,
 761                                    "Stop at offset %ld record type %d [%zd bytes]\n",
 762                                    (long)((const void *)hdr - data),
 763                                    le16_to_cpu(hdr->type), hdr_sz);
 764                 }
 765                 return -EINVAL;
 766         }
 767
 768         return 0;
 769 }
 770
 771 /**
 772  * wil_request_board - Request board file
 773  *
 774  * Request board image from the file
 775  * board file address and max size are read from FW file
 776  * during initialization.
 777  * brd file shall include one header and one data section.
 778  *
 779  * Return error code
 780  */
 781 int wil_request_board(struct wil6210_priv *wil, const char *name)
 782 {
 783         int rc, dlen;
 784         const struct firmware *brd;
 785
 786         rc = request_firmware(&brd, name, wil_to_dev(wil));
 787         if (rc) {
 788                 wil_err_fw(wil, "Failed to load brd %s\n", name);
 789                 return rc;
 790         }
 791         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, brd->size);
 792
 793         /* Verify the header */
 794         dlen = wil_fw_verify(wil, brd->data, brd->size);
 795         if (dlen < 0) {
 796                 rc = dlen;
 797                 goto out;
 798         }
 799
 800         /* Process the data records */
 801         rc = wil_brd_process(wil, brd->data, dlen);
 802
 803 out:
 804         release_firmware(brd);
 805         if (rc)
 806                 wil_err_fw(wil, "Loading <%s> failed, rc %d\n", name, rc);
 807         return rc;
 808 }
 809
 810 /**
 811  * wil_fw_verify_file_exists - checks if firmware file exist
 812  *
 813  * @wil: driver context
 814  * @name: firmware file name
 815  *
 816  * return value - boolean, true for success, false for failure
 817  */
 818 bool wil_fw_verify_file_exists(struct wil6210_priv *wil, const char *name)
 819 {
 820         const struct firmware *fw;
 821         int rc;
 822
 823         rc = request_firmware(&fw, name, wil_to_dev(wil));
 824         if (!rc)
 825                 release_firmware(fw);
 826         else
 827                 wil_dbg_fw(wil, "<%s> not available: %d\n", name, rc);
 828         return !rc;
 829 }