1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2013 Broadcom Corporation
4  */
5 
6 #include <linux/efi.h>
7 #include <linux/kernel.h>
8 #include <linux/slab.h>
9 #include <linux/device.h>
10 #include <linux/firmware.h>
11 #include <linux/module.h>
12 #include <linux/bcm47xx_nvram.h>
13 
14 #include "debug.h"
15 #include "firmware.h"
16 #include "core.h"
17 #include "common.h"
18 #include "chip.h"
19 
20 #define BRCMF_FW_MAX_NVRAM_SIZE			64000
21 #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
22 #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
23 #define BRCMF_FW_DEFAULT_BOARDREV		"boardrev=0xff"
24 #define BRCMF_FW_MACADDR_FMT			"macaddr=%pM"
25 #define BRCMF_FW_MACADDR_LEN			(7 + ETH_ALEN * 3)
26 
27 enum nvram_parser_state {
28 	IDLE,
29 	KEY,
30 	VALUE,
31 	COMMENT,
32 	END
33 };
34 
35 /**
36  * struct nvram_parser - internal info for parser.
37  *
38  * @state: current parser state.
39  * @data: input buffer being parsed.
40  * @nvram: output buffer with parse result.
41  * @nvram_len: length of parse result.
42  * @line: current line.
43  * @column: current column in line.
44  * @pos: byte offset in input buffer.
45  * @entry: start position of key,value entry.
46  * @multi_dev_v1: detect pcie multi device v1 (compressed).
47  * @multi_dev_v2: detect pcie multi device v2.
48  * @boardrev_found: nvram contains boardrev information.
49  * @strip_mac: strip the MAC address.
50  */
51 struct nvram_parser {
52 	enum nvram_parser_state state;
53 	const u8 *data;
54 	u8 *nvram;
55 	u32 nvram_len;
56 	u32 line;
57 	u32 column;
58 	u32 pos;
59 	u32 entry;
60 	bool multi_dev_v1;
61 	bool multi_dev_v2;
62 	bool boardrev_found;
63 	bool strip_mac;
64 };
65 
66 /*
67  * is_nvram_char() - check if char is a valid one for NVRAM entry
68  *
69  * It accepts all printable ASCII chars except for '#' which opens a comment.
70  * Please note that ' ' (space) while accepted is not a valid key name char.
71  */
72 static bool is_nvram_char(char c)
73 {
74 	/* comment marker excluded */
75 	if (c == '#')
76 		return false;
77 
78 	/* key and value may have any other readable character */
79 	return (c >= 0x20 && c < 0x7f);
80 }
81 
82 static bool is_whitespace(char c)
83 {
84 	return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
85 }
86 
87 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
88 {
89 	char c;
90 
91 	c = nvp->data[nvp->pos];
92 	if (c == '\n')
93 		return COMMENT;
94 	if (is_whitespace(c) || c == '\0')
95 		goto proceed;
96 	if (c == '#')
97 		return COMMENT;
98 	if (is_nvram_char(c)) {
99 		nvp->entry = nvp->pos;
100 		return KEY;
101 	}
102 	brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
103 		  nvp->line, nvp->column);
104 proceed:
105 	nvp->column++;
106 	nvp->pos++;
107 	return IDLE;
108 }
109 
110 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
111 {
112 	enum nvram_parser_state st = nvp->state;
113 	char c;
114 
115 	c = nvp->data[nvp->pos];
116 	if (c == '=') {
117 		/* ignore RAW1 by treating as comment */
118 		if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
119 			st = COMMENT;
120 		else
121 			st = VALUE;
122 		if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
123 			nvp->multi_dev_v1 = true;
124 		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
125 			nvp->multi_dev_v2 = true;
126 		if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
127 			nvp->boardrev_found = true;
128 		/* strip macaddr if platform MAC overrides */
129 		if (nvp->strip_mac &&
130 		    strncmp(&nvp->data[nvp->entry], "macaddr", 7) == 0)
131 			st = COMMENT;
132 	} else if (!is_nvram_char(c) || c == ' ') {
133 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
134 			  nvp->line, nvp->column);
135 		return COMMENT;
136 	}
137 
138 	nvp->column++;
139 	nvp->pos++;
140 	return st;
141 }
142 
143 static enum nvram_parser_state
144 brcmf_nvram_handle_value(struct nvram_parser *nvp)
145 {
146 	char c;
147 	char *skv;
148 	char *ekv;
149 	u32 cplen;
150 
151 	c = nvp->data[nvp->pos];
152 	if (!is_nvram_char(c)) {
153 		/* key,value pair complete */
154 		ekv = (u8 *)&nvp->data[nvp->pos];
155 		skv = (u8 *)&nvp->data[nvp->entry];
156 		cplen = ekv - skv;
157 		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
158 			return END;
159 		/* copy to output buffer */
160 		memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
161 		nvp->nvram_len += cplen;
162 		nvp->nvram[nvp->nvram_len] = '\0';
163 		nvp->nvram_len++;
164 		return IDLE;
165 	}
166 	nvp->pos++;
167 	nvp->column++;
168 	return VALUE;
169 }
170 
171 static enum nvram_parser_state
172 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
173 {
174 	char *eoc, *sol;
175 
176 	sol = (char *)&nvp->data[nvp->pos];
177 	eoc = strchr(sol, '\n');
178 	if (!eoc) {
179 		eoc = strchr(sol, '\0');
180 		if (!eoc)
181 			return END;
182 	}
183 
184 	/* eat all moving to next line */
185 	nvp->line++;
186 	nvp->column = 1;
187 	nvp->pos += (eoc - sol) + 1;
188 	return IDLE;
189 }
190 
191 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
192 {
193 	/* final state */
194 	return END;
195 }
196 
197 static enum nvram_parser_state
198 (*nv_parser_states[])(struct nvram_parser *nvp) = {
199 	brcmf_nvram_handle_idle,
200 	brcmf_nvram_handle_key,
201 	brcmf_nvram_handle_value,
202 	brcmf_nvram_handle_comment,
203 	brcmf_nvram_handle_end
204 };
205 
206 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
207 				   const u8 *data, size_t data_len)
208 {
209 	size_t size;
210 
211 	memset(nvp, 0, sizeof(*nvp));
212 	nvp->data = data;
213 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
214 	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
215 		size = BRCMF_FW_MAX_NVRAM_SIZE;
216 	else
217 		size = data_len;
218 	/* Add space for properties we may add */
219 	size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
220 	size += BRCMF_FW_MACADDR_LEN + 1;
221 	/* Alloc for extra 0 byte + roundup by 4 + length field */
222 	size += 1 + 3 + sizeof(u32);
223 	nvp->nvram = kzalloc(size, GFP_KERNEL);
224 	if (!nvp->nvram)
225 		return -ENOMEM;
226 
227 	nvp->line = 1;
228 	nvp->column = 1;
229 	return 0;
230 }
231 
232 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
233  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
234  * which data is to be returned. v1 is the version where nvram is stored
235  * compressed and "devpath" maps to index for valid entries.
236  */
237 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
238 				    u16 bus_nr)
239 {
240 	/* Device path with a leading '=' key-value separator */
241 	char pci_path[] = "=pci/?/?";
242 	size_t pci_len;
243 	char pcie_path[] = "=pcie/?/?";
244 	size_t pcie_len;
245 
246 	u32 i, j;
247 	bool found;
248 	u8 *nvram;
249 	u8 id;
250 
251 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
252 	if (!nvram)
253 		goto fail;
254 
255 	/* min length: devpath0=pcie/1/4/ + 0:x=y */
256 	if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
257 		goto fail;
258 
259 	/* First search for the devpathX and see if it is the configuration
260 	 * for domain_nr/bus_nr. Search complete nvp
261 	 */
262 	snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
263 		 bus_nr);
264 	pci_len = strlen(pci_path);
265 	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
266 		 bus_nr);
267 	pcie_len = strlen(pcie_path);
268 	found = false;
269 	i = 0;
270 	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
271 		/* Format: devpathX=pcie/Y/Z/
272 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
273 		 */
274 		if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
275 		    (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
276 		     !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
277 			id = nvp->nvram[i + 7] - '0';
278 			found = true;
279 			break;
280 		}
281 		while (nvp->nvram[i] != 0)
282 			i++;
283 		i++;
284 	}
285 	if (!found)
286 		goto fail;
287 
288 	/* Now copy all valid entries, release old nvram and assign new one */
289 	i = 0;
290 	j = 0;
291 	while (i < nvp->nvram_len) {
292 		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
293 			i += 2;
294 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
295 				nvp->boardrev_found = true;
296 			while (nvp->nvram[i] != 0) {
297 				nvram[j] = nvp->nvram[i];
298 				i++;
299 				j++;
300 			}
301 			nvram[j] = 0;
302 			j++;
303 		}
304 		while (nvp->nvram[i] != 0)
305 			i++;
306 		i++;
307 	}
308 	kfree(nvp->nvram);
309 	nvp->nvram = nvram;
310 	nvp->nvram_len = j;
311 	return;
312 
313 fail:
314 	kfree(nvram);
315 	nvp->nvram_len = 0;
316 }
317 
318 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
319  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
320  * which data is to be returned. v2 is the version where nvram is stored
321  * uncompressed, all relevant valid entries are identified by
322  * pcie/domain_nr/bus_nr:
323  */
324 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
325 				    u16 bus_nr)
326 {
327 	char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
328 	size_t len;
329 	u32 i, j;
330 	u8 *nvram;
331 
332 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
333 	if (!nvram) {
334 		nvp->nvram_len = 0;
335 		return;
336 	}
337 
338 	/* Copy all valid entries, release old nvram and assign new one.
339 	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
340 	 * Y = bus_nr.
341 	 */
342 	snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
343 	len = strlen(prefix);
344 	i = 0;
345 	j = 0;
346 	while (i < nvp->nvram_len - len) {
347 		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
348 			i += len;
349 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
350 				nvp->boardrev_found = true;
351 			while (nvp->nvram[i] != 0) {
352 				nvram[j] = nvp->nvram[i];
353 				i++;
354 				j++;
355 			}
356 			nvram[j] = 0;
357 			j++;
358 		}
359 		while (nvp->nvram[i] != 0)
360 			i++;
361 		i++;
362 	}
363 	kfree(nvp->nvram);
364 	nvp->nvram = nvram;
365 	nvp->nvram_len = j;
366 }
367 
368 static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
369 {
370 	if (nvp->boardrev_found)
371 		return;
372 
373 	memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
374 	       strlen(BRCMF_FW_DEFAULT_BOARDREV));
375 	nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
376 	nvp->nvram[nvp->nvram_len] = '\0';
377 	nvp->nvram_len++;
378 }
379 
380 static void brcmf_fw_add_macaddr(struct nvram_parser *nvp, u8 *mac)
381 {
382 	int len;
383 
384 	len = scnprintf(&nvp->nvram[nvp->nvram_len], BRCMF_FW_MACADDR_LEN + 1,
385 			BRCMF_FW_MACADDR_FMT, mac);
386 	WARN_ON(len != BRCMF_FW_MACADDR_LEN);
387 	nvp->nvram_len += len + 1;
388 }
389 
390 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
391  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
392  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
393  * End of buffer is completed with token identifying length of buffer.
394  */
395 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
396 				  u32 *new_length, u16 domain_nr, u16 bus_nr,
397 				  struct device *dev)
398 {
399 	struct nvram_parser nvp;
400 	u32 pad;
401 	u32 token;
402 	__le32 token_le;
403 	u8 mac[ETH_ALEN];
404 
405 	if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
406 		return NULL;
407 
408 	if (eth_platform_get_mac_address(dev, mac) == 0)
409 		nvp.strip_mac = true;
410 
411 	while (nvp.pos < data_len) {
412 		nvp.state = nv_parser_states[nvp.state](&nvp);
413 		if (nvp.state == END)
414 			break;
415 	}
416 	if (nvp.multi_dev_v1) {
417 		nvp.boardrev_found = false;
418 		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
419 	} else if (nvp.multi_dev_v2) {
420 		nvp.boardrev_found = false;
421 		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
422 	}
423 
424 	if (nvp.nvram_len == 0) {
425 		kfree(nvp.nvram);
426 		return NULL;
427 	}
428 
429 	brcmf_fw_add_defaults(&nvp);
430 
431 	if (nvp.strip_mac)
432 		brcmf_fw_add_macaddr(&nvp, mac);
433 
434 	pad = nvp.nvram_len;
435 	*new_length = roundup(nvp.nvram_len + 1, 4);
436 	while (pad != *new_length) {
437 		nvp.nvram[pad] = 0;
438 		pad++;
439 	}
440 
441 	token = *new_length / 4;
442 	token = (~token << 16) | (token & 0x0000FFFF);
443 	token_le = cpu_to_le32(token);
444 
445 	memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
446 	*new_length += sizeof(token_le);
447 
448 	return nvp.nvram;
449 }
450 
451 void brcmf_fw_nvram_free(void *nvram)
452 {
453 	kfree(nvram);
454 }
455 
456 struct brcmf_fw {
457 	struct device *dev;
458 	struct brcmf_fw_request *req;
459 	u32 curpos;
460 	unsigned int board_index;
461 	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
462 };
463 
464 #ifdef CONFIG_EFI
465 /* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
466  * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
467  * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
468  * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
469  * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
470  * no-Initiate-Radiation mode. This means that we will never send on these
471  * channels without first having received valid wifi traffic on the channel.
472  */
473 static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
474 {
475 	char *ccode;
476 
477 	ccode = strnstr((char *)data, "ccode=ALL", data_len);
478 	if (!ccode)
479 		ccode = strnstr((char *)data, "ccode=XV\r", data_len);
480 	if (!ccode)
481 		return;
482 
483 	ccode[6] = 'X';
484 	ccode[7] = '2';
485 	ccode[8] = '\r';
486 }
487 
488 static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
489 {
490 	efi_guid_t guid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61, 0xb5, 0x1f,
491 				   0x43, 0x26, 0x81, 0x23, 0xd1, 0x13);
492 	unsigned long data_len = 0;
493 	efi_status_t status;
494 	u8 *data = NULL;
495 
496 	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
497 		return NULL;
498 
499 	status = efi.get_variable(L"nvram", &guid, NULL, &data_len, NULL);
500 	if (status != EFI_BUFFER_TOO_SMALL)
501 		goto fail;
502 
503 	data = kmalloc(data_len, GFP_KERNEL);
504 	if (!data)
505 		goto fail;
506 
507 	status = efi.get_variable(L"nvram", &guid, NULL, &data_len, data);
508 	if (status != EFI_SUCCESS)
509 		goto fail;
510 
511 	brcmf_fw_fix_efi_nvram_ccode(data, data_len);
512 	brcmf_info("Using nvram EFI variable\n");
513 
514 	*data_len_ret = data_len;
515 	return data;
516 fail:
517 	kfree(data);
518 	return NULL;
519 }
520 #else
521 static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
522 #endif
523 
524 static void brcmf_fw_free_request(struct brcmf_fw_request *req)
525 {
526 	struct brcmf_fw_item *item;
527 	int i;
528 
529 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
530 		if (item->type == BRCMF_FW_TYPE_BINARY)
531 			release_firmware(item->binary);
532 		else if (item->type == BRCMF_FW_TYPE_NVRAM)
533 			brcmf_fw_nvram_free(item->nv_data.data);
534 	}
535 	kfree(req);
536 }
537 
538 static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
539 {
540 	struct brcmf_fw *fwctx = ctx;
541 	struct brcmf_fw_item *cur;
542 	bool free_bcm47xx_nvram = false;
543 	bool kfree_nvram = false;
544 	u32 nvram_length = 0;
545 	void *nvram = NULL;
546 	u8 *data = NULL;
547 	size_t data_len;
548 
549 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
550 
551 	cur = &fwctx->req->items[fwctx->curpos];
552 
553 	if (fw && fw->data) {
554 		data = (u8 *)fw->data;
555 		data_len = fw->size;
556 	} else {
557 		if ((data = bcm47xx_nvram_get_contents(&data_len)))
558 			free_bcm47xx_nvram = true;
559 		else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
560 			kfree_nvram = true;
561 		else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
562 			goto fail;
563 	}
564 
565 	if (data)
566 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
567 					     fwctx->req->domain_nr,
568 					     fwctx->req->bus_nr,
569 					     fwctx->dev);
570 
571 	if (free_bcm47xx_nvram)
572 		bcm47xx_nvram_release_contents(data);
573 	if (kfree_nvram)
574 		kfree(data);
575 
576 	release_firmware(fw);
577 	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
578 		goto fail;
579 
580 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
581 	cur->nv_data.data = nvram;
582 	cur->nv_data.len = nvram_length;
583 	return 0;
584 
585 fail:
586 	return -ENOENT;
587 }
588 
589 static int brcmf_fw_complete_request(const struct firmware *fw,
590 				     struct brcmf_fw *fwctx)
591 {
592 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
593 	int ret = 0;
594 
595 	brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
596 
597 	switch (cur->type) {
598 	case BRCMF_FW_TYPE_NVRAM:
599 		ret = brcmf_fw_request_nvram_done(fw, fwctx);
600 		break;
601 	case BRCMF_FW_TYPE_BINARY:
602 		if (fw)
603 			cur->binary = fw;
604 		else
605 			ret = -ENOENT;
606 		break;
607 	default:
608 		/* something fishy here so bail out early */
609 		brcmf_err("unknown fw type: %d\n", cur->type);
610 		release_firmware(fw);
611 		ret = -EINVAL;
612 	}
613 
614 	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
615 }
616 
617 static char *brcm_alt_fw_path(const char *path, const char *board_type)
618 {
619 	char base[BRCMF_FW_NAME_LEN];
620 	const char *suffix;
621 	char *ret;
622 
623 	if (!board_type)
624 		return NULL;
625 
626 	suffix = strrchr(path, '.');
627 	if (!suffix || suffix == path)
628 		return NULL;
629 
630 	/* strip extension at the end */
631 	strscpy(base, path, BRCMF_FW_NAME_LEN);
632 	base[suffix - path] = 0;
633 
634 	ret = kasprintf(GFP_KERNEL, "%s.%s%s", base, board_type, suffix);
635 	if (!ret)
636 		brcmf_err("out of memory allocating firmware path for '%s'\n",
637 			  path);
638 
639 	brcmf_dbg(TRACE, "FW alt path: %s\n", ret);
640 
641 	return ret;
642 }
643 
644 static int brcmf_fw_request_firmware(const struct firmware **fw,
645 				     struct brcmf_fw *fwctx)
646 {
647 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
648 	unsigned int i;
649 	int ret;
650 
651 	/* Files can be board-specific, first try board-specific paths */
652 	for (i = 0; i < ARRAY_SIZE(fwctx->req->board_types); i++) {
653 		char *alt_path;
654 
655 		if (!fwctx->req->board_types[i])
656 			goto fallback;
657 		alt_path = brcm_alt_fw_path(cur->path,
658 					    fwctx->req->board_types[i]);
659 		if (!alt_path)
660 			goto fallback;
661 
662 		ret = firmware_request_nowarn(fw, alt_path, fwctx->dev);
663 		kfree(alt_path);
664 		if (ret == 0)
665 			return ret;
666 	}
667 
668 fallback:
669 	return request_firmware(fw, cur->path, fwctx->dev);
670 }
671 
672 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
673 {
674 	struct brcmf_fw *fwctx = ctx;
675 	int ret;
676 
677 	ret = brcmf_fw_complete_request(fw, fwctx);
678 
679 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
680 		brcmf_fw_request_firmware(&fw, fwctx);
681 		ret = brcmf_fw_complete_request(fw, ctx);
682 	}
683 
684 	if (ret) {
685 		brcmf_fw_free_request(fwctx->req);
686 		fwctx->req = NULL;
687 	}
688 	fwctx->done(fwctx->dev, ret, fwctx->req);
689 	kfree(fwctx);
690 }
691 
692 static void brcmf_fw_request_done_alt_path(const struct firmware *fw, void *ctx)
693 {
694 	struct brcmf_fw *fwctx = ctx;
695 	struct brcmf_fw_item *first = &fwctx->req->items[0];
696 	const char *board_type, *alt_path;
697 	int ret = 0;
698 
699 	if (fw) {
700 		brcmf_fw_request_done(fw, ctx);
701 		return;
702 	}
703 
704 	/* Try next board firmware */
705 	if (fwctx->board_index < ARRAY_SIZE(fwctx->req->board_types)) {
706 		board_type = fwctx->req->board_types[fwctx->board_index++];
707 		if (!board_type)
708 			goto fallback;
709 		alt_path = brcm_alt_fw_path(first->path, board_type);
710 		if (!alt_path)
711 			goto fallback;
712 
713 		ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
714 					      fwctx->dev, GFP_KERNEL, fwctx,
715 					      brcmf_fw_request_done_alt_path);
716 		kfree(alt_path);
717 
718 		if (ret < 0)
719 			brcmf_fw_request_done(fw, ctx);
720 		return;
721 	}
722 
723 fallback:
724 	/* Fall back to canonical path if board firmware not found */
725 	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
726 				      fwctx->dev, GFP_KERNEL, fwctx,
727 				      brcmf_fw_request_done);
728 
729 	if (ret < 0)
730 		brcmf_fw_request_done(fw, ctx);
731 }
732 
733 static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
734 {
735 	struct brcmf_fw_item *item;
736 	int i;
737 
738 	if (!req->n_items)
739 		return false;
740 
741 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
742 		if (!item->path)
743 			return false;
744 	}
745 	return true;
746 }
747 
748 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
749 			   void (*fw_cb)(struct device *dev, int err,
750 					 struct brcmf_fw_request *req))
751 {
752 	struct brcmf_fw_item *first = &req->items[0];
753 	struct brcmf_fw *fwctx;
754 	char *alt_path = NULL;
755 	int ret;
756 
757 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
758 	if (!fw_cb)
759 		return -EINVAL;
760 
761 	if (!brcmf_fw_request_is_valid(req))
762 		return -EINVAL;
763 
764 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
765 	if (!fwctx)
766 		return -ENOMEM;
767 
768 	fwctx->dev = dev;
769 	fwctx->req = req;
770 	fwctx->done = fw_cb;
771 
772 	/* First try alternative board-specific path if any */
773 	if (fwctx->req->board_types[0])
774 		alt_path = brcm_alt_fw_path(first->path,
775 					    fwctx->req->board_types[0]);
776 	if (alt_path) {
777 		fwctx->board_index++;
778 		ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
779 					      fwctx->dev, GFP_KERNEL, fwctx,
780 					      brcmf_fw_request_done_alt_path);
781 		kfree(alt_path);
782 	} else {
783 		ret = request_firmware_nowait(THIS_MODULE, true, first->path,
784 					      fwctx->dev, GFP_KERNEL, fwctx,
785 					      brcmf_fw_request_done);
786 	}
787 	if (ret < 0)
788 		brcmf_fw_request_done(NULL, fwctx);
789 
790 	return 0;
791 }
792 
793 struct brcmf_fw_request *
794 brcmf_fw_alloc_request(u32 chip, u32 chiprev,
795 		       const struct brcmf_firmware_mapping mapping_table[],
796 		       u32 table_size, struct brcmf_fw_name *fwnames,
797 		       u32 n_fwnames)
798 {
799 	struct brcmf_fw_request *fwreq;
800 	char chipname[12];
801 	const char *mp_path;
802 	size_t mp_path_len;
803 	u32 i, j;
804 	char end = '\0';
805 
806 	for (i = 0; i < table_size; i++) {
807 		if (mapping_table[i].chipid == chip &&
808 		    mapping_table[i].revmask & BIT(chiprev))
809 			break;
810 	}
811 
812 	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
813 
814 	if (i == table_size) {
815 		brcmf_err("Unknown chip %s\n", chipname);
816 		return NULL;
817 	}
818 
819 	fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
820 	if (!fwreq)
821 		return NULL;
822 
823 	brcmf_info("using %s for chip %s\n",
824 		   mapping_table[i].fw_base, chipname);
825 
826 	mp_path = brcmf_mp_global.firmware_path;
827 	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
828 	if (mp_path_len)
829 		end = mp_path[mp_path_len - 1];
830 
831 	fwreq->n_items = n_fwnames;
832 
833 	for (j = 0; j < n_fwnames; j++) {
834 		fwreq->items[j].path = fwnames[j].path;
835 		fwnames[j].path[0] = '\0';
836 		/* check if firmware path is provided by module parameter */
837 		if (brcmf_mp_global.firmware_path[0] != '\0') {
838 			strscpy(fwnames[j].path, mp_path,
839 				BRCMF_FW_NAME_LEN);
840 
841 			if (end != '/') {
842 				strlcat(fwnames[j].path, "/",
843 					BRCMF_FW_NAME_LEN);
844 			}
845 		}
846 		strlcat(fwnames[j].path, mapping_table[i].fw_base,
847 			BRCMF_FW_NAME_LEN);
848 		strlcat(fwnames[j].path, fwnames[j].extension,
849 			BRCMF_FW_NAME_LEN);
850 		fwreq->items[j].path = fwnames[j].path;
851 	}
852 
853 	return fwreq;
854 }
855