drivers/net/wireless/ath/wil6210/fw_inc.c

   1 /*
   2  * Copyright (c) 2014-2017 Qualcomm Atheros, Inc.
   3  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /* Algorithmic part of the firmware download.
  19  * To be included in the container file providing framework
  20  */
  21
  22 #define wil_err_fw(wil, fmt, arg...) wil_err(wil, "ERR[ FW ]" fmt, ##arg)
  23 #define wil_dbg_fw(wil, fmt, arg...) wil_dbg(wil, "DBG[ FW ]" fmt, ##arg)
  24 #define wil_hex_dump_fw(prefix_str, prefix_type, rowsize,               \
  25                         groupsize, buf, len, ascii)                     \
  26                         print_hex_dump_debug("DBG[ FW ]" prefix_str,    \
  27                                              prefix_type, rowsize,      \
  28                                              groupsize, buf, len, ascii)
  29
  30 static bool wil_fw_addr_check(struct wil6210_priv *wil,
  31                               void __iomem **ioaddr, __le32 val,
  32                               u32 size, const char *msg)
  33 {
  34         *ioaddr = wmi_buffer_block(wil, val, size);
  35         if (!(*ioaddr)) {
  36                 wil_err_fw(wil, "bad %s: 0x%08x\n", msg, le32_to_cpu(val));
  37                 return false;
  38         }
  39         return true;
  40 }
  41
  42 /**
  43  * wil_fw_verify - verify firmware file validity
  44  *
  45  * perform various checks for the firmware file header.
  46  * records are not validated.
  47  *
  48  * Return file size or negative error
  49  */
  50 static int wil_fw_verify(struct wil6210_priv *wil, const u8 *data, size_t size)
  51 {
  52         const struct wil_fw_record_head *hdr = (const void *)data;
  53         struct wil_fw_record_file_header fh;
  54         const struct wil_fw_record_file_header *fh_;
  55         u32 crc;
  56         u32 dlen;
  57
  58         if (size % 4) {
  59                 wil_err_fw(wil, "image size not aligned: %zu\n", size);
  60                 return -EINVAL;
  61         }
  62         /* have enough data for the file header? */
  63         if (size < sizeof(*hdr) + sizeof(fh)) {
  64                 wil_err_fw(wil, "file too short: %zu bytes\n", size);
  65                 return -EINVAL;
  66         }
  67
  68         /* start with the file header? */
  69         if (le16_to_cpu(hdr->type) != wil_fw_type_file_header) {
  70                 wil_err_fw(wil, "no file header\n");
  71                 return -EINVAL;
  72         }
  73
  74         /* data_len */
  75         fh_ = (struct wil_fw_record_file_header *)&hdr[1];
  76         dlen = le32_to_cpu(fh_->data_len);
  77         if (dlen % 4) {
  78                 wil_err_fw(wil, "data length not aligned: %lu\n", (ulong)dlen);
  79                 return -EINVAL;
  80         }
  81         if (size < dlen) {
  82                 wil_err_fw(wil, "file truncated at %zu/%lu\n",
  83                            size, (ulong)dlen);
  84                 return -EINVAL;
  85         }
  86         if (dlen < sizeof(*hdr) + sizeof(fh)) {
  87                 wil_err_fw(wil, "data length too short: %lu\n", (ulong)dlen);
  88                 return -EINVAL;
  89         }
  90
  91         /* signature */
  92         if (le32_to_cpu(fh_->signature) != WIL_FW_SIGNATURE) {
  93                 wil_err_fw(wil, "bad header signature: 0x%08x\n",
  94                            le32_to_cpu(fh_->signature));
  95                 return -EINVAL;
  96         }
  97
  98         /* version */
  99         if (le32_to_cpu(fh_->version) > WIL_FW_FMT_VERSION) {
 100                 wil_err_fw(wil, "unsupported header version: %d\n",
 101                            le32_to_cpu(fh_->version));
 102                 return -EINVAL;
 103         }
 104
 105         /* checksum. ~crc32(~0, data, size) when fh.crc set to 0*/
 106         fh = *fh_;
 107         fh.crc = 0;
 108
 109         crc = crc32_le(~0, (unsigned char const *)hdr, sizeof(*hdr));
 110         crc = crc32_le(crc, (unsigned char const *)&fh, sizeof(fh));
 111         crc = crc32_le(crc, (unsigned char const *)&fh_[1],
 112                        dlen - sizeof(*hdr) - sizeof(fh));
 113         crc = ~crc;
 114
 115         if (crc != le32_to_cpu(fh_->crc)) {
 116                 wil_err_fw(wil, "checksum mismatch:"
 117                            " calculated for %lu bytes 0x%08x != 0x%08x\n",
 118                            (ulong)dlen, crc, le32_to_cpu(fh_->crc));
 119                 return -EINVAL;
 120         }
 121
 122         return (int)dlen;
 123 }
 124
 125 static int fw_ignore_section(struct wil6210_priv *wil, const void *data,
 126                              size_t size)
 127 {
 128         return 0;
 129 }
 130
 131 static int
 132 fw_handle_capabilities(struct wil6210_priv *wil, const void *data,
 133                        size_t size)
 134 {
 135         const struct wil_fw_record_capabilities *rec = data;
 136         size_t capa_size;
 137
 138         if (size < sizeof(*rec)) {
 139                 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1,
 140                                 data, size, true);
 141                 return 0;
 142         }
 143
 144         capa_size = size - offsetof(struct wil_fw_record_capabilities,
 145                                     capabilities);
 146         bitmap_zero(wil->fw_capabilities, WMI_FW_CAPABILITY_MAX);
 147         memcpy(wil->fw_capabilities, rec->capabilities,
 148                min(sizeof(wil->fw_capabilities), capa_size));
 149         wil_hex_dump_fw("CAPA", DUMP_PREFIX_OFFSET, 16, 1,
 150                         rec->capabilities, capa_size, false);
 151         return 0;
 152 }
 153
 154 static int
 155 fw_handle_brd_file(struct wil6210_priv *wil, const void *data,
 156                    size_t size)
 157 {
 158         const struct wil_fw_record_brd_file *rec = data;
 159
 160         if (size < sizeof(*rec)) {
 161                 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1,
 162                                 data, size, true);
 163                 return 0;
 164         }
 165
 166         wil->brd_file_addr = le32_to_cpu(rec->base_addr);
 167         wil->brd_file_max_size = le32_to_cpu(rec->max_size_bytes);
 168
 169         wil_dbg_fw(wil, "brd_file_addr 0x%x, brd_file_max_size %d\n",
 170                    wil->brd_file_addr, wil->brd_file_max_size);
 171
 172         return 0;
 173 }
 174
 175 static int
 176 fw_handle_comment(struct wil6210_priv *wil, const void *data,
 177                   size_t size)
 178 {
 179         const struct wil_fw_record_comment_hdr *hdr = data;
 180         u32 magic;
 181         int rc = 0;
 182
 183         if (size < sizeof(*hdr))
 184                 return 0;
 185
 186         magic = le32_to_cpu(hdr->magic);
 187
 188         switch (magic) {
 189         case WIL_FW_CAPABILITIES_MAGIC:
 190                 wil_dbg_fw(wil, "magic is WIL_FW_CAPABILITIES_MAGIC\n");
 191                 rc = fw_handle_capabilities(wil, data, size);
 192                 break;
 193         case WIL_BRD_FILE_MAGIC:
 194                 wil_dbg_fw(wil, "magic is WIL_BRD_FILE_MAGIC\n");
 195                 rc = fw_handle_brd_file(wil, data, size);
 196                 break;
 197         }
 198
 199         return rc;
 200 }
 201
 202 static int __fw_handle_data(struct wil6210_priv *wil, const void *data,
 203                             size_t size, __le32 addr)
 204 {
 205         const struct wil_fw_record_data *d = data;
 206         void __iomem *dst;
 207         size_t s = size - sizeof(*d);
 208
 209         if (size < sizeof(*d) + sizeof(u32)) {
 210                 wil_err_fw(wil, "data record too short: %zu\n", size);
 211                 return -EINVAL;
 212         }
 213
 214         if (!wil_fw_addr_check(wil, &dst, addr, s, "address"))
 215                 return -EINVAL;
 216         wil_dbg_fw(wil, "write [0x%08x] <== %zu bytes\n", le32_to_cpu(addr), s);
 217         wil_memcpy_toio_32(dst, d->data, s);
 218         wmb(); /* finish before processing next record */
 219
 220         return 0;
 221 }
 222
 223 static int fw_handle_data(struct wil6210_priv *wil, const void *data,
 224                           size_t size)
 225 {
 226         const struct wil_fw_record_data *d = data;
 227
 228         return __fw_handle_data(wil, data, size, d->addr);
 229 }
 230
 231 static int fw_handle_fill(struct wil6210_priv *wil, const void *data,
 232                           size_t size)
 233 {
 234         const struct wil_fw_record_fill *d = data;
 235         void __iomem *dst;
 236         u32 v;
 237         size_t s = (size_t)le32_to_cpu(d->size);
 238
 239         if (size != sizeof(*d)) {
 240                 wil_err_fw(wil, "bad size for fill record: %zu\n", size);
 241                 return -EINVAL;
 242         }
 243
 244         if (s < sizeof(u32)) {
 245                 wil_err_fw(wil, "fill size too short: %zu\n", s);
 246                 return -EINVAL;
 247         }
 248
 249         if (s % sizeof(u32)) {
 250                 wil_err_fw(wil, "fill size not aligned: %zu\n", s);
 251                 return -EINVAL;
 252         }
 253
 254         if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address"))
 255                 return -EINVAL;
 256
 257         v = le32_to_cpu(d->value);
 258         wil_dbg_fw(wil, "fill [0x%08x] <== 0x%08x, %zu bytes\n",
 259                    le32_to_cpu(d->addr), v, s);
 260         wil_memset_toio_32(dst, v, s);
 261         wmb(); /* finish before processing next record */
 262
 263         return 0;
 264 }
 265
 266 static int fw_handle_file_header(struct wil6210_priv *wil, const void *data,
 267                                  size_t size)
 268 {
 269         const struct wil_fw_record_file_header *d = data;
 270
 271         if (size != sizeof(*d)) {
 272                 wil_err_fw(wil, "file header length incorrect: %zu\n", size);
 273                 return -EINVAL;
 274         }
 275
 276         wil_dbg_fw(wil, "new file, ver. %d, %i bytes\n",
 277                    d->version, d->data_len);
 278         wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, d->comment,
 279                         sizeof(d->comment), true);
 280
 281         if (!memcmp(d->comment, WIL_FW_VERSION_PREFIX,
 282                     WIL_FW_VERSION_PREFIX_LEN))
 283                 memcpy(wil->fw_version,
 284                        d->comment + WIL_FW_VERSION_PREFIX_LEN,
 285                        min(sizeof(d->comment) - WIL_FW_VERSION_PREFIX_LEN,
 286                            sizeof(wil->fw_version) - 1));
 287
 288         return 0;
 289 }
 290
 291 static int fw_handle_direct_write(struct wil6210_priv *wil, const void *data,
 292                                   size_t size)
 293 {
 294         const struct wil_fw_record_direct_write *d = data;
 295         const struct wil_fw_data_dwrite *block = d->data;
 296         int n, i;
 297
 298         if (size % sizeof(*block)) {
 299                 wil_err_fw(wil, "record size not aligned on %zu: %zu\n",
 300                            sizeof(*block), size);
 301                 return -EINVAL;
 302         }
 303         n = size / sizeof(*block);
 304
 305         for (i = 0; i < n; i++) {
 306                 void __iomem *dst;
 307                 u32 m = le32_to_cpu(block[i].mask);
 308                 u32 v = le32_to_cpu(block[i].value);
 309                 u32 x, y;
 310
 311                 if (!wil_fw_addr_check(wil, &dst, block[i].addr, 0, "address"))
 312                         return -EINVAL;
 313
 314                 x = readl(dst);
 315                 y = (x & m) | (v & ~m);
 316                 wil_dbg_fw(wil, "write [0x%08x] <== 0x%08x "
 317                            "(old 0x%08x val 0x%08x mask 0x%08x)\n",
 318                            le32_to_cpu(block[i].addr), y, x, v, m);
 319                 writel(y, dst);
 320                 wmb(); /* finish before processing next record */
 321         }
 322
 323         return 0;
 324 }
 325
 326 static int gw_write(struct wil6210_priv *wil, void __iomem *gwa_addr,
 327                     void __iomem *gwa_cmd, void __iomem *gwa_ctl, u32 gw_cmd,
 328                     u32 a)
 329 {
 330         unsigned delay = 0;
 331
 332         writel(a, gwa_addr);
 333         writel(gw_cmd, gwa_cmd);
 334         wmb(); /* finish before activate gw */
 335
 336         writel(WIL_FW_GW_CTL_RUN, gwa_ctl); /* activate gw */
 337         do {
 338                 udelay(1); /* typical time is few usec */
 339                 if (delay++ > 100) {
 340                         wil_err_fw(wil, "gw timeout\n");
 341                         return -EINVAL;
 342                 }
 343         } while (readl(gwa_ctl) & WIL_FW_GW_CTL_BUSY); /* gw done? */
 344
 345         return 0;
 346 }
 347
 348 static int fw_handle_gateway_data(struct wil6210_priv *wil, const void *data,
 349                                   size_t size)
 350 {
 351         const struct wil_fw_record_gateway_data *d = data;
 352         const struct wil_fw_data_gw *block = d->data;
 353         void __iomem *gwa_addr;
 354         void __iomem *gwa_val;
 355         void __iomem *gwa_cmd;
 356         void __iomem *gwa_ctl;
 357         u32 gw_cmd;
 358         int n, i;
 359
 360         if (size < sizeof(*d) + sizeof(*block)) {
 361                 wil_err_fw(wil, "gateway record too short: %zu\n", size);
 362                 return -EINVAL;
 363         }
 364
 365         if ((size - sizeof(*d)) % sizeof(*block)) {
 366                 wil_err_fw(wil, "gateway record data size"
 367                            " not aligned on %zu: %zu\n",
 368                            sizeof(*block), size - sizeof(*d));
 369                 return -EINVAL;
 370         }
 371         n = (size - sizeof(*d)) / sizeof(*block);
 372
 373         gw_cmd = le32_to_cpu(d->command);
 374
 375         wil_dbg_fw(wil, "gw write record [%3d] blocks, cmd 0x%08x\n",
 376                    n, gw_cmd);
 377
 378         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 379                                "gateway_addr_addr") ||
 380             !wil_fw_addr_check(wil, &gwa_val, d->gateway_value_addr, 0,
 381                                "gateway_value_addr") ||
 382             !wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 383                                "gateway_cmd_addr") ||
 384             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 385                                "gateway_ctrl_address"))
 386                 return -EINVAL;
 387
 388         wil_dbg_fw(wil, "gw addresses: addr 0x%08x val 0x%08x"
 389                    " cmd 0x%08x ctl 0x%08x\n",
 390                    le32_to_cpu(d->gateway_addr_addr),
 391                    le32_to_cpu(d->gateway_value_addr),
 392                    le32_to_cpu(d->gateway_cmd_addr),
 393                    le32_to_cpu(d->gateway_ctrl_address));
 394
 395         for (i = 0; i < n; i++) {
 396                 int rc;
 397                 u32 a = le32_to_cpu(block[i].addr);
 398                 u32 v = le32_to_cpu(block[i].value);
 399
 400                 wil_dbg_fw(wil, "  gw write[%3d] [0x%08x] <== 0x%08x\n",
 401                            i, a, v);
 402
 403                 writel(v, gwa_val);
 404                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 405                 if (rc)
 406                         return rc;
 407         }
 408
 409         return 0;
 410 }
 411
 412 static int fw_handle_gateway_data4(struct wil6210_priv *wil, const void *data,
 413                                    size_t size)
 414 {
 415         const struct wil_fw_record_gateway_data4 *d = data;
 416         const struct wil_fw_data_gw4 *block = d->data;
 417         void __iomem *gwa_addr;
 418         void __iomem *gwa_val[ARRAY_SIZE(block->value)];
 419         void __iomem *gwa_cmd;
 420         void __iomem *gwa_ctl;
 421         u32 gw_cmd;
 422         int n, i, k;
 423
 424         if (size < sizeof(*d) + sizeof(*block)) {
 425                 wil_err_fw(wil, "gateway4 record too short: %zu\n", size);
 426                 return -EINVAL;
 427         }
 428
 429         if ((size - sizeof(*d)) % sizeof(*block)) {
 430                 wil_err_fw(wil, "gateway4 record data size"
 431                            " not aligned on %zu: %zu\n",
 432                            sizeof(*block), size - sizeof(*d));
 433                 return -EINVAL;
 434         }
 435         n = (size - sizeof(*d)) / sizeof(*block);
 436
 437         gw_cmd = le32_to_cpu(d->command);
 438
 439         wil_dbg_fw(wil, "gw4 write record [%3d] blocks, cmd 0x%08x\n",
 440                    n, gw_cmd);
 441
 442         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 443                                "gateway_addr_addr"))
 444                 return -EINVAL;
 445         for (k = 0; k < ARRAY_SIZE(block->value); k++)
 446                 if (!wil_fw_addr_check(wil, &gwa_val[k],
 447                                        d->gateway_value_addr[k],
 448                                        0, "gateway_value_addr"))
 449                         return -EINVAL;
 450         if (!wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 451                                "gateway_cmd_addr") ||
 452             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 453                                "gateway_ctrl_address"))
 454                 return -EINVAL;
 455
 456         wil_dbg_fw(wil, "gw4 addresses: addr 0x%08x cmd 0x%08x ctl 0x%08x\n",
 457                    le32_to_cpu(d->gateway_addr_addr),
 458                    le32_to_cpu(d->gateway_cmd_addr),
 459                    le32_to_cpu(d->gateway_ctrl_address));
 460         wil_hex_dump_fw("val addresses: ", DUMP_PREFIX_NONE, 16, 4,
 461                         d->gateway_value_addr, sizeof(d->gateway_value_addr),
 462                         false);
 463
 464         for (i = 0; i < n; i++) {
 465                 int rc;
 466                 u32 a = le32_to_cpu(block[i].addr);
 467                 u32 v[ARRAY_SIZE(block->value)];
 468
 469                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 470                         v[k] = le32_to_cpu(block[i].value[k]);
 471
 472                 wil_dbg_fw(wil, "  gw4 write[%3d] [0x%08x] <==\n", i, a);
 473                 wil_hex_dump_fw("    val ", DUMP_PREFIX_NONE, 16, 4, v,
 474                                 sizeof(v), false);
 475
 476                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 477                         writel(v[k], gwa_val[k]);
 478                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 479                 if (rc)
 480                         return rc;
 481         }
 482
 483         return 0;
 484 }
 485
 486 static const struct {
 487         int type;
 488         int (*load_handler)(struct wil6210_priv *wil, const void *data,
 489                             size_t size);
 490         int (*parse_handler)(struct wil6210_priv *wil, const void *data,
 491                              size_t size);
 492 } wil_fw_handlers[] = {
 493         {wil_fw_type_comment, fw_handle_comment, fw_handle_comment},
 494         {wil_fw_type_data, fw_handle_data, fw_ignore_section},
 495         {wil_fw_type_fill, fw_handle_fill, fw_ignore_section},
 496         /* wil_fw_type_action */
 497         /* wil_fw_type_verify */
 498         {wil_fw_type_file_header, fw_handle_file_header,
 499                 fw_handle_file_header},
 500         {wil_fw_type_direct_write, fw_handle_direct_write, fw_ignore_section},
 501         {wil_fw_type_gateway_data, fw_handle_gateway_data, fw_ignore_section},
 502         {wil_fw_type_gateway_data4, fw_handle_gateway_data4,
 503                 fw_ignore_section},
 504 };
 505
 506 static int wil_fw_handle_record(struct wil6210_priv *wil, int type,
 507                                 const void *data, size_t size, bool load)
 508 {
 509         int i;
 510
 511         for (i = 0; i < ARRAY_SIZE(wil_fw_handlers); i++)
 512                 if (wil_fw_handlers[i].type == type)
 513                         return load ?
 514                                 wil_fw_handlers[i].load_handler(
 515                                         wil, data, size) :
 516                                 wil_fw_handlers[i].parse_handler(
 517                                         wil, data, size);
 518
 519         wil_err_fw(wil, "unknown record type: %d\n", type);
 520         return -EINVAL;
 521 }
 522
 523 /**
 524  * wil_fw_process - process section from FW file
 525  * if load is true: Load the FW and uCode code and data to the
 526  * corresponding device memory regions,
 527  * otherwise only parse and look for capabilities
 528  *
 529  * Return error code
 530  */
 531 static int wil_fw_process(struct wil6210_priv *wil, const void *data,
 532                           size_t size, bool load)
 533 {
 534         int rc = 0;
 535         const struct wil_fw_record_head *hdr;
 536         size_t s, hdr_sz;
 537
 538         for (hdr = data;; hdr = (const void *)hdr + s, size -= s) {
 539                 if (size < sizeof(*hdr))
 540                         break;
 541                 hdr_sz = le32_to_cpu(hdr->size);
 542                 s = sizeof(*hdr) + hdr_sz;
 543                 if (s > size)
 544                         break;
 545                 if (hdr_sz % 4) {
 546                         wil_err_fw(wil, "unaligned record size: %zu\n",
 547                                    hdr_sz);
 548                         return -EINVAL;
 549                 }
 550                 rc = wil_fw_handle_record(wil, le16_to_cpu(hdr->type),
 551                                           &hdr[1], hdr_sz, load);
 552                 if (rc)
 553                         return rc;
 554         }
 555         if (size) {
 556                 wil_err_fw(wil, "unprocessed bytes: %zu\n", size);
 557                 if (size >= sizeof(*hdr)) {
 558                         wil_err_fw(wil, "Stop at offset %ld"
 559                                    " record type %d [%zd bytes]\n",
 560                                    (long)((const void *)hdr - data),
 561                                    le16_to_cpu(hdr->type), hdr_sz);
 562                 }
 563                 return -EINVAL;
 564         }
 565
 566         return rc;
 567 }
 568
 569 /**
 570  * wil_request_firmware - Request firmware
 571  *
 572  * Request firmware image from the file
 573  * If load is true, load firmware to device, otherwise
 574  * only parse and extract capabilities
 575  *
 576  * Return error code
 577  */
 578 int wil_request_firmware(struct wil6210_priv *wil, const char *name,
 579                          bool load)
 580 {
 581         int rc, rc1;
 582         const struct firmware *fw;
 583         size_t sz;
 584         const void *d;
 585
 586         rc = request_firmware(&fw, name, wil_to_dev(wil));
 587         if (rc) {
 588                 wil_err_fw(wil, "Failed to load firmware %s rc %d\n", name, rc);
 589                 return rc;
 590         }
 591         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, fw->size);
 592
 593         for (sz = fw->size, d = fw->data; sz; sz -= rc1, d += rc1) {
 594                 rc1 = wil_fw_verify(wil, d, sz);
 595                 if (rc1 < 0) {
 596                         rc = rc1;
 597                         goto out;
 598                 }
 599                 rc = wil_fw_process(wil, d, rc1, load);
 600                 if (rc < 0)
 601                         goto out;
 602         }
 603
 604 out:
 605         release_firmware(fw);
 606         return rc;
 607 }
 608
 609 /**
 610  * wil_brd_process - process section from BRD file
 611  *
 612  * Return error code
 613  */
 614 static int wil_brd_process(struct wil6210_priv *wil, const void *data,
 615                            size_t size)
 616 {
 617         int rc = 0;
 618         const struct wil_fw_record_head *hdr = data;
 619         size_t s, hdr_sz;
 620         u16 type;
 621
 622         /* Assuming the board file includes only one header record and one data
 623          * record. Each record starts with wil_fw_record_head.
 624          */
 625         if (size < sizeof(*hdr))
 626                 return -EINVAL;
 627         s = sizeof(*hdr) + le32_to_cpu(hdr->size);
 628         if (s > size)
 629                 return -EINVAL;
 630
 631         /* Skip the header record and handle the data record */
 632         hdr = (const void *)hdr + s;
 633         size -= s;
 634         if (size < sizeof(*hdr))
 635                 return -EINVAL;
 636         hdr_sz = le32_to_cpu(hdr->size);
 637
 638         if (wil->brd_file_max_size && hdr_sz > wil->brd_file_max_size)
 639                 return -EINVAL;
 640         if (sizeof(*hdr) + hdr_sz > size)
 641                 return -EINVAL;
 642         if (hdr_sz % 4) {
 643                 wil_err_fw(wil, "unaligned record size: %zu\n",
 644                            hdr_sz);
 645                 return -EINVAL;
 646         }
 647         type = le16_to_cpu(hdr->type);
 648         if (type != wil_fw_type_data) {
 649                 wil_err_fw(wil, "invalid record type for board file: %d\n",
 650                            type);
 651                 return -EINVAL;
 652         }
 653         if (hdr_sz < sizeof(struct wil_fw_record_data)) {
 654                 wil_err_fw(wil, "data record too short: %zu\n", hdr_sz);
 655                 return -EINVAL;
 656         }
 657
 658         wil_dbg_fw(wil, "using addr from fw file: [0x%08x]\n",
 659                    wil->brd_file_addr);
 660
 661         rc = __fw_handle_data(wil, &hdr[1], hdr_sz,
 662                               cpu_to_le32(wil->brd_file_addr));
 663
 664         return rc;
 665 }
 666
 667 /**
 668  * wil_request_board - Request board file
 669  *
 670  * Request board image from the file
 671  * board file address and max size are read from FW file
 672  * during initialization.
 673  * brd file shall include one header and one data section.
 674  *
 675  * Return error code
 676  */
 677 int wil_request_board(struct wil6210_priv *wil, const char *name)
 678 {
 679         int rc, dlen;
 680         const struct firmware *brd;
 681
 682         rc = request_firmware(&brd, name, wil_to_dev(wil));
 683         if (rc) {
 684                 wil_err_fw(wil, "Failed to load brd %s\n", name);
 685                 return rc;
 686         }
 687         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, brd->size);
 688
 689         /* Verify the header */
 690         dlen = wil_fw_verify(wil, brd->data, brd->size);
 691         if (dlen < 0) {
 692                 rc = dlen;
 693                 goto out;
 694         }
 695         /* Process the data record */
 696         rc = wil_brd_process(wil, brd->data, dlen);
 697
 698 out:
 699         release_firmware(brd);
 700         return rc;
 701 }
 702
 703 /**
 704  * wil_fw_verify_file_exists - checks if firmware file exist
 705  *
 706  * @wil: driver context
 707  * @name: firmware file name
 708  *
 709  * return value - boolean, true for success, false for failure
 710  */
 711 bool wil_fw_verify_file_exists(struct wil6210_priv *wil, const char *name)
 712 {
 713         const struct firmware *fw;
 714         int rc;
 715
 716         rc = request_firmware(&fw, name, wil_to_dev(wil));
 717         if (!rc)
 718                 release_firmware(fw);
 719         else
 720                 wil_dbg_fw(wil, "<%s> not available: %d\n", name, rc);
 721         return !rc;
 722 }