1 /*
2  * Copyright (c) 2013 Broadcom Corporation
3  *
4  * Permission to use, copy, modify, and/or distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <linux/kernel.h>
18 #include <linux/slab.h>
19 #include <linux/device.h>
20 #include <linux/firmware.h>
21 #include <linux/module.h>
22 #include <linux/bcm47xx_nvram.h>
23 
24 #include "debug.h"
25 #include "firmware.h"
26 #include "core.h"
27 #include "common.h"
28 
29 #define BRCMF_FW_MAX_NVRAM_SIZE			64000
30 #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
31 #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
32 
33 enum nvram_parser_state {
34 	IDLE,
35 	KEY,
36 	VALUE,
37 	COMMENT,
38 	END
39 };
40 
41 /**
42  * struct nvram_parser - internal info for parser.
43  *
44  * @state: current parser state.
45  * @data: input buffer being parsed.
46  * @nvram: output buffer with parse result.
47  * @nvram_len: lenght of parse result.
48  * @line: current line.
49  * @column: current column in line.
50  * @pos: byte offset in input buffer.
51  * @entry: start position of key,value entry.
52  * @multi_dev_v1: detect pcie multi device v1 (compressed).
53  * @multi_dev_v2: detect pcie multi device v2.
54  */
55 struct nvram_parser {
56 	enum nvram_parser_state state;
57 	const u8 *data;
58 	u8 *nvram;
59 	u32 nvram_len;
60 	u32 line;
61 	u32 column;
62 	u32 pos;
63 	u32 entry;
64 	bool multi_dev_v1;
65 	bool multi_dev_v2;
66 };
67 
68 /**
69  * is_nvram_char() - check if char is a valid one for NVRAM entry
70  *
71  * It accepts all printable ASCII chars except for '#' which opens a comment.
72  * Please note that ' ' (space) while accepted is not a valid key name char.
73  */
74 static bool is_nvram_char(char c)
75 {
76 	/* comment marker excluded */
77 	if (c == '#')
78 		return false;
79 
80 	/* key and value may have any other readable character */
81 	return (c >= 0x20 && c < 0x7f);
82 }
83 
84 static bool is_whitespace(char c)
85 {
86 	return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
87 }
88 
89 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
90 {
91 	char c;
92 
93 	c = nvp->data[nvp->pos];
94 	if (c == '\n')
95 		return COMMENT;
96 	if (is_whitespace(c) || c == '\0')
97 		goto proceed;
98 	if (c == '#')
99 		return COMMENT;
100 	if (is_nvram_char(c)) {
101 		nvp->entry = nvp->pos;
102 		return KEY;
103 	}
104 	brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
105 		  nvp->line, nvp->column);
106 proceed:
107 	nvp->column++;
108 	nvp->pos++;
109 	return IDLE;
110 }
111 
112 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
113 {
114 	enum nvram_parser_state st = nvp->state;
115 	char c;
116 
117 	c = nvp->data[nvp->pos];
118 	if (c == '=') {
119 		/* ignore RAW1 by treating as comment */
120 		if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
121 			st = COMMENT;
122 		else
123 			st = VALUE;
124 		if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
125 			nvp->multi_dev_v1 = true;
126 		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
127 			nvp->multi_dev_v2 = true;
128 	} else if (!is_nvram_char(c) || c == ' ') {
129 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
130 			  nvp->line, nvp->column);
131 		return COMMENT;
132 	}
133 
134 	nvp->column++;
135 	nvp->pos++;
136 	return st;
137 }
138 
139 static enum nvram_parser_state
140 brcmf_nvram_handle_value(struct nvram_parser *nvp)
141 {
142 	char c;
143 	char *skv;
144 	char *ekv;
145 	u32 cplen;
146 
147 	c = nvp->data[nvp->pos];
148 	if (!is_nvram_char(c)) {
149 		/* key,value pair complete */
150 		ekv = (u8 *)&nvp->data[nvp->pos];
151 		skv = (u8 *)&nvp->data[nvp->entry];
152 		cplen = ekv - skv;
153 		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
154 			return END;
155 		/* copy to output buffer */
156 		memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
157 		nvp->nvram_len += cplen;
158 		nvp->nvram[nvp->nvram_len] = '\0';
159 		nvp->nvram_len++;
160 		return IDLE;
161 	}
162 	nvp->pos++;
163 	nvp->column++;
164 	return VALUE;
165 }
166 
167 static enum nvram_parser_state
168 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
169 {
170 	char *eoc, *sol;
171 
172 	sol = (char *)&nvp->data[nvp->pos];
173 	eoc = strchr(sol, '\n');
174 	if (!eoc) {
175 		eoc = strchr(sol, '\0');
176 		if (!eoc)
177 			return END;
178 	}
179 
180 	/* eat all moving to next line */
181 	nvp->line++;
182 	nvp->column = 1;
183 	nvp->pos += (eoc - sol) + 1;
184 	return IDLE;
185 }
186 
187 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
188 {
189 	/* final state */
190 	return END;
191 }
192 
193 static enum nvram_parser_state
194 (*nv_parser_states[])(struct nvram_parser *nvp) = {
195 	brcmf_nvram_handle_idle,
196 	brcmf_nvram_handle_key,
197 	brcmf_nvram_handle_value,
198 	brcmf_nvram_handle_comment,
199 	brcmf_nvram_handle_end
200 };
201 
202 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
203 				   const u8 *data, size_t data_len)
204 {
205 	size_t size;
206 
207 	memset(nvp, 0, sizeof(*nvp));
208 	nvp->data = data;
209 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
210 	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
211 		size = BRCMF_FW_MAX_NVRAM_SIZE;
212 	else
213 		size = data_len;
214 	/* Alloc for extra 0 byte + roundup by 4 + length field */
215 	size += 1 + 3 + sizeof(u32);
216 	nvp->nvram = kzalloc(size, GFP_KERNEL);
217 	if (!nvp->nvram)
218 		return -ENOMEM;
219 
220 	nvp->line = 1;
221 	nvp->column = 1;
222 	return 0;
223 }
224 
225 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
226  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
227  * which data is to be returned. v1 is the version where nvram is stored
228  * compressed and "devpath" maps to index for valid entries.
229  */
230 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
231 				    u16 bus_nr)
232 {
233 	/* Device path with a leading '=' key-value separator */
234 	char pci_path[] = "=pci/?/?";
235 	size_t pci_len;
236 	char pcie_path[] = "=pcie/?/?";
237 	size_t pcie_len;
238 
239 	u32 i, j;
240 	bool found;
241 	u8 *nvram;
242 	u8 id;
243 
244 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
245 	if (!nvram)
246 		goto fail;
247 
248 	/* min length: devpath0=pcie/1/4/ + 0:x=y */
249 	if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
250 		goto fail;
251 
252 	/* First search for the devpathX and see if it is the configuration
253 	 * for domain_nr/bus_nr. Search complete nvp
254 	 */
255 	snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
256 		 bus_nr);
257 	pci_len = strlen(pci_path);
258 	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
259 		 bus_nr);
260 	pcie_len = strlen(pcie_path);
261 	found = false;
262 	i = 0;
263 	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
264 		/* Format: devpathX=pcie/Y/Z/
265 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
266 		 */
267 		if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
268 		    (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
269 		     !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
270 			id = nvp->nvram[i + 7] - '0';
271 			found = true;
272 			break;
273 		}
274 		while (nvp->nvram[i] != 0)
275 			i++;
276 		i++;
277 	}
278 	if (!found)
279 		goto fail;
280 
281 	/* Now copy all valid entries, release old nvram and assign new one */
282 	i = 0;
283 	j = 0;
284 	while (i < nvp->nvram_len) {
285 		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
286 			i += 2;
287 			while (nvp->nvram[i] != 0) {
288 				nvram[j] = nvp->nvram[i];
289 				i++;
290 				j++;
291 			}
292 			nvram[j] = 0;
293 			j++;
294 		}
295 		while (nvp->nvram[i] != 0)
296 			i++;
297 		i++;
298 	}
299 	kfree(nvp->nvram);
300 	nvp->nvram = nvram;
301 	nvp->nvram_len = j;
302 	return;
303 
304 fail:
305 	kfree(nvram);
306 	nvp->nvram_len = 0;
307 }
308 
309 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
310  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
311  * which data is to be returned. v2 is the version where nvram is stored
312  * uncompressed, all relevant valid entries are identified by
313  * pcie/domain_nr/bus_nr:
314  */
315 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
316 				    u16 bus_nr)
317 {
318 	char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
319 	size_t len;
320 	u32 i, j;
321 	u8 *nvram;
322 
323 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
324 	if (!nvram)
325 		goto fail;
326 
327 	/* Copy all valid entries, release old nvram and assign new one.
328 	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
329 	 * Y = bus_nr.
330 	 */
331 	snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
332 	len = strlen(prefix);
333 	i = 0;
334 	j = 0;
335 	while (i < nvp->nvram_len - len) {
336 		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
337 			i += len;
338 			while (nvp->nvram[i] != 0) {
339 				nvram[j] = nvp->nvram[i];
340 				i++;
341 				j++;
342 			}
343 			nvram[j] = 0;
344 			j++;
345 		}
346 		while (nvp->nvram[i] != 0)
347 			i++;
348 		i++;
349 	}
350 	kfree(nvp->nvram);
351 	nvp->nvram = nvram;
352 	nvp->nvram_len = j;
353 	return;
354 fail:
355 	kfree(nvram);
356 	nvp->nvram_len = 0;
357 }
358 
359 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
360  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
361  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
362  * End of buffer is completed with token identifying length of buffer.
363  */
364 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
365 				  u32 *new_length, u16 domain_nr, u16 bus_nr)
366 {
367 	struct nvram_parser nvp;
368 	u32 pad;
369 	u32 token;
370 	__le32 token_le;
371 
372 	if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
373 		return NULL;
374 
375 	while (nvp.pos < data_len) {
376 		nvp.state = nv_parser_states[nvp.state](&nvp);
377 		if (nvp.state == END)
378 			break;
379 	}
380 	if (nvp.multi_dev_v1)
381 		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
382 	else if (nvp.multi_dev_v2)
383 		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
384 
385 	if (nvp.nvram_len == 0) {
386 		kfree(nvp.nvram);
387 		return NULL;
388 	}
389 
390 	pad = nvp.nvram_len;
391 	*new_length = roundup(nvp.nvram_len + 1, 4);
392 	while (pad != *new_length) {
393 		nvp.nvram[pad] = 0;
394 		pad++;
395 	}
396 
397 	token = *new_length / 4;
398 	token = (~token << 16) | (token & 0x0000FFFF);
399 	token_le = cpu_to_le32(token);
400 
401 	memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
402 	*new_length += sizeof(token_le);
403 
404 	return nvp.nvram;
405 }
406 
407 void brcmf_fw_nvram_free(void *nvram)
408 {
409 	kfree(nvram);
410 }
411 
412 struct brcmf_fw {
413 	struct device *dev;
414 	u16 flags;
415 	const struct firmware *code;
416 	const char *nvram_name;
417 	u16 domain_nr;
418 	u16 bus_nr;
419 	void (*done)(struct device *dev, const struct firmware *fw,
420 		     void *nvram_image, u32 nvram_len);
421 };
422 
423 static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
424 {
425 	struct brcmf_fw *fwctx = ctx;
426 	u32 nvram_length = 0;
427 	void *nvram = NULL;
428 	u8 *data = NULL;
429 	size_t data_len;
430 	bool raw_nvram;
431 
432 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
433 	if (fw && fw->data) {
434 		data = (u8 *)fw->data;
435 		data_len = fw->size;
436 		raw_nvram = false;
437 	} else {
438 		data = bcm47xx_nvram_get_contents(&data_len);
439 		if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
440 			goto fail;
441 		raw_nvram = true;
442 	}
443 
444 	if (data)
445 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
446 					     fwctx->domain_nr, fwctx->bus_nr);
447 
448 	if (raw_nvram)
449 		bcm47xx_nvram_release_contents(data);
450 	release_firmware(fw);
451 	if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
452 		goto fail;
453 
454 	fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
455 	kfree(fwctx);
456 	return;
457 
458 fail:
459 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
460 	release_firmware(fwctx->code);
461 	device_release_driver(fwctx->dev);
462 	kfree(fwctx);
463 }
464 
465 static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
466 {
467 	struct brcmf_fw *fwctx = ctx;
468 	int ret;
469 
470 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
471 	if (!fw)
472 		goto fail;
473 
474 	/* only requested code so done here */
475 	if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
476 		fwctx->done(fwctx->dev, fw, NULL, 0);
477 		kfree(fwctx);
478 		return;
479 	}
480 	fwctx->code = fw;
481 	ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
482 				      fwctx->dev, GFP_KERNEL, fwctx,
483 				      brcmf_fw_request_nvram_done);
484 
485 	if (!ret)
486 		return;
487 
488 	brcmf_fw_request_nvram_done(NULL, fwctx);
489 	return;
490 
491 fail:
492 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
493 	device_release_driver(fwctx->dev);
494 	kfree(fwctx);
495 }
496 
497 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
498 				const char *code, const char *nvram,
499 				void (*fw_cb)(struct device *dev,
500 					      const struct firmware *fw,
501 					      void *nvram_image, u32 nvram_len),
502 				u16 domain_nr, u16 bus_nr)
503 {
504 	struct brcmf_fw *fwctx;
505 
506 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
507 	if (!fw_cb || !code)
508 		return -EINVAL;
509 
510 	if ((flags & BRCMF_FW_REQUEST_NVRAM) && !nvram)
511 		return -EINVAL;
512 
513 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
514 	if (!fwctx)
515 		return -ENOMEM;
516 
517 	fwctx->dev = dev;
518 	fwctx->flags = flags;
519 	fwctx->done = fw_cb;
520 	if (flags & BRCMF_FW_REQUEST_NVRAM)
521 		fwctx->nvram_name = nvram;
522 	fwctx->domain_nr = domain_nr;
523 	fwctx->bus_nr = bus_nr;
524 
525 	return request_firmware_nowait(THIS_MODULE, true, code, dev,
526 				       GFP_KERNEL, fwctx,
527 				       brcmf_fw_request_code_done);
528 }
529 
530 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
531 			   const char *code, const char *nvram,
532 			   void (*fw_cb)(struct device *dev,
533 					 const struct firmware *fw,
534 					 void *nvram_image, u32 nvram_len))
535 {
536 	return brcmf_fw_get_firmwares_pcie(dev, flags, code, nvram, fw_cb, 0,
537 					   0);
538 }
539 
540 int brcmf_fw_map_chip_to_name(u32 chip, u32 chiprev,
541 			      struct brcmf_firmware_mapping mapping_table[],
542 			      u32 table_size, char fw_name[BRCMF_FW_NAME_LEN],
543 			      char nvram_name[BRCMF_FW_NAME_LEN])
544 {
545 	u32 i;
546 	char end;
547 
548 	for (i = 0; i < table_size; i++) {
549 		if (mapping_table[i].chipid == chip &&
550 		    mapping_table[i].revmask & BIT(chiprev))
551 			break;
552 	}
553 
554 	if (i == table_size) {
555 		brcmf_err("Unknown chipid %d [%d]\n", chip, chiprev);
556 		return -ENODEV;
557 	}
558 
559 	/* check if firmware path is provided by module parameter */
560 	if (brcmf_mp_global.firmware_path[0] != '\0') {
561 		strlcpy(fw_name, brcmf_mp_global.firmware_path,
562 			BRCMF_FW_NAME_LEN);
563 		if ((nvram_name) && (mapping_table[i].nvram))
564 			strlcpy(nvram_name, brcmf_mp_global.firmware_path,
565 				BRCMF_FW_NAME_LEN);
566 
567 		end = brcmf_mp_global.firmware_path[
568 				strlen(brcmf_mp_global.firmware_path) - 1];
569 		if (end != '/') {
570 			strlcat(fw_name, "/", BRCMF_FW_NAME_LEN);
571 			if ((nvram_name) && (mapping_table[i].nvram))
572 				strlcat(nvram_name, "/", BRCMF_FW_NAME_LEN);
573 		}
574 	}
575 	strlcat(fw_name, mapping_table[i].fw, BRCMF_FW_NAME_LEN);
576 	if ((nvram_name) && (mapping_table[i].nvram))
577 		strlcat(nvram_name, mapping_table[i].nvram, BRCMF_FW_NAME_LEN);
578 
579 	return 0;
580 }
581 
582