drivers/net/wireless/ath/wil6210/fw_inc.c

   1 /*
   2  * Copyright (c) 2014-2017 Qualcomm Atheros, Inc.
   3  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /* Algorithmic part of the firmware download.
  19  * To be included in the container file providing framework
  20  */
  21
  22 #define wil_err_fw(wil, fmt, arg...) wil_err(wil, "ERR[ FW ]" fmt, ##arg)
  23 #define wil_dbg_fw(wil, fmt, arg...) wil_dbg(wil, "DBG[ FW ]" fmt, ##arg)
  24 #define wil_hex_dump_fw(prefix_str, prefix_type, rowsize,               \
  25                         groupsize, buf, len, ascii)                     \
  26                         print_hex_dump_debug("DBG[ FW ]" prefix_str,    \
  27                                              prefix_type, rowsize,      \
  28                                              groupsize, buf, len, ascii)
  29
  30 static bool wil_fw_addr_check(struct wil6210_priv *wil,
  31                               void __iomem **ioaddr, __le32 val,
  32                               u32 size, const char *msg)
  33 {
  34         *ioaddr = wmi_buffer_block(wil, val, size);
  35         if (!(*ioaddr)) {
  36                 wil_err_fw(wil, "bad %s: 0x%08x\n", msg, le32_to_cpu(val));
  37                 return false;
  38         }
  39         return true;
  40 }
  41
  42 /**
  43  * wil_fw_verify - verify firmware file validity
  44  *
  45  * perform various checks for the firmware file header.
  46  * records are not validated.
  47  *
  48  * Return file size or negative error
  49  */
  50 static int wil_fw_verify(struct wil6210_priv *wil, const u8 *data, size_t size)
  51 {
  52         const struct wil_fw_record_head *hdr = (const void *)data;
  53         struct wil_fw_record_file_header fh;
  54         const struct wil_fw_record_file_header *fh_;
  55         u32 crc;
  56         u32 dlen;
  57
  58         if (size % 4) {
  59                 wil_err_fw(wil, "image size not aligned: %zu\n", size);
  60                 return -EINVAL;
  61         }
  62         /* have enough data for the file header? */
  63         if (size < sizeof(*hdr) + sizeof(fh)) {
  64                 wil_err_fw(wil, "file too short: %zu bytes\n", size);
  65                 return -EINVAL;
  66         }
  67
  68         /* start with the file header? */
  69         if (le16_to_cpu(hdr->type) != wil_fw_type_file_header) {
  70                 wil_err_fw(wil, "no file header\n");
  71                 return -EINVAL;
  72         }
  73
  74         /* data_len */
  75         fh_ = (struct wil_fw_record_file_header *)&hdr[1];
  76         dlen = le32_to_cpu(fh_->data_len);
  77         if (dlen % 4) {
  78                 wil_err_fw(wil, "data length not aligned: %lu\n", (ulong)dlen);
  79                 return -EINVAL;
  80         }
  81         if (size < dlen) {
  82                 wil_err_fw(wil, "file truncated at %zu/%lu\n",
  83                            size, (ulong)dlen);
  84                 return -EINVAL;
  85         }
  86         if (dlen < sizeof(*hdr) + sizeof(fh)) {
  87                 wil_err_fw(wil, "data length too short: %lu\n", (ulong)dlen);
  88                 return -EINVAL;
  89         }
  90
  91         /* signature */
  92         if (le32_to_cpu(fh_->signature) != WIL_FW_SIGNATURE) {
  93                 wil_err_fw(wil, "bad header signature: 0x%08x\n",
  94                            le32_to_cpu(fh_->signature));
  95                 return -EINVAL;
  96         }
  97
  98         /* version */
  99         if (le32_to_cpu(fh_->version) > WIL_FW_FMT_VERSION) {
 100                 wil_err_fw(wil, "unsupported header version: %d\n",
 101                            le32_to_cpu(fh_->version));
 102                 return -EINVAL;
 103         }
 104
 105         /* checksum. ~crc32(~0, data, size) when fh.crc set to 0*/
 106         fh = *fh_;
 107         fh.crc = 0;
 108
 109         crc = crc32_le(~0, (unsigned char const *)hdr, sizeof(*hdr));
 110         crc = crc32_le(crc, (unsigned char const *)&fh, sizeof(fh));
 111         crc = crc32_le(crc, (unsigned char const *)&fh_[1],
 112                        dlen - sizeof(*hdr) - sizeof(fh));
 113         crc = ~crc;
 114
 115         if (crc != le32_to_cpu(fh_->crc)) {
 116                 wil_err_fw(wil, "checksum mismatch:"
 117                            " calculated for %lu bytes 0x%08x != 0x%08x\n",
 118                            (ulong)dlen, crc, le32_to_cpu(fh_->crc));
 119                 return -EINVAL;
 120         }
 121
 122         return (int)dlen;
 123 }
 124
 125 static int fw_ignore_section(struct wil6210_priv *wil, const void *data,
 126                              size_t size)
 127 {
 128         return 0;
 129 }
 130
 131 static int
 132 fw_handle_capabilities(struct wil6210_priv *wil, const void *data,
 133                        size_t size)
 134 {
 135         const struct wil_fw_record_capabilities *rec = data;
 136         size_t capa_size;
 137
 138         if (size < sizeof(*rec)) {
 139                 wil_err_fw(wil, "capabilities record too short: %zu\n", size);
 140                 /* let the FW load anyway */
 141                 return 0;
 142         }
 143
 144         capa_size = size - offsetof(struct wil_fw_record_capabilities,
 145                                     capabilities);
 146         bitmap_zero(wil->fw_capabilities, WMI_FW_CAPABILITY_MAX);
 147         memcpy(wil->fw_capabilities, rec->capabilities,
 148                min_t(size_t, sizeof(wil->fw_capabilities), capa_size));
 149         wil_hex_dump_fw("CAPA", DUMP_PREFIX_OFFSET, 16, 1,
 150                         rec->capabilities, capa_size, false);
 151         return 0;
 152 }
 153
 154 static int
 155 fw_handle_brd_file(struct wil6210_priv *wil, const void *data,
 156                    size_t size)
 157 {
 158         const struct wil_fw_record_brd_file *rec = data;
 159
 160         if (size < sizeof(*rec)) {
 161                 wil_err_fw(wil, "brd_file record too short: %zu\n", size);
 162                 return 0;
 163         }
 164
 165         wil->brd_file_addr = le32_to_cpu(rec->base_addr);
 166         wil->brd_file_max_size = le32_to_cpu(rec->max_size_bytes);
 167
 168         wil_dbg_fw(wil, "brd_file_addr 0x%x, brd_file_max_size %d\n",
 169                    wil->brd_file_addr, wil->brd_file_max_size);
 170
 171         return 0;
 172 }
 173
 174 static int
 175 fw_handle_concurrency(struct wil6210_priv *wil, const void *data,
 176                       size_t size)
 177 {
 178         const struct wil_fw_record_concurrency *rec = data;
 179         const struct wil_fw_concurrency_combo *combo;
 180         const struct wil_fw_concurrency_limit *limit;
 181         size_t remain, lsize;
 182         int i, n_combos;
 183
 184         if (size < sizeof(*rec)) {
 185                 wil_err_fw(wil, "concurrency record too short: %zu\n", size);
 186                 /* continue, let the FW load anyway */
 187                 return 0;
 188         }
 189
 190         n_combos = le16_to_cpu(rec->n_combos);
 191         remain = size - offsetof(struct wil_fw_record_concurrency, combos);
 192         combo = rec->combos;
 193         for (i = 0; i < n_combos; i++) {
 194                 if (remain < sizeof(*combo))
 195                         goto out_short;
 196                 remain -= sizeof(*combo);
 197                 limit = combo->limits;
 198                 lsize = combo->n_limits * sizeof(*limit);
 199                 if (remain < lsize)
 200                         goto out_short;
 201                 remain -= lsize;
 202                 limit += combo->n_limits;
 203                 combo = (struct wil_fw_concurrency_combo *)limit;
 204         }
 205
 206         return wil_cfg80211_iface_combinations_from_fw(wil, rec);
 207 out_short:
 208         wil_err_fw(wil, "concurrency record truncated\n");
 209         return 0;
 210 }
 211
 212 static int
 213 fw_handle_comment(struct wil6210_priv *wil, const void *data,
 214                   size_t size)
 215 {
 216         const struct wil_fw_record_comment_hdr *hdr = data;
 217         u32 magic;
 218         int rc = 0;
 219
 220         if (size < sizeof(*hdr))
 221                 return 0;
 222
 223         magic = le32_to_cpu(hdr->magic);
 224
 225         switch (magic) {
 226         case WIL_FW_CAPABILITIES_MAGIC:
 227                 wil_dbg_fw(wil, "magic is WIL_FW_CAPABILITIES_MAGIC\n");
 228                 rc = fw_handle_capabilities(wil, data, size);
 229                 break;
 230         case WIL_BRD_FILE_MAGIC:
 231                 wil_dbg_fw(wil, "magic is WIL_BRD_FILE_MAGIC\n");
 232                 rc = fw_handle_brd_file(wil, data, size);
 233                 break;
 234         case WIL_FW_CONCURRENCY_MAGIC:
 235                 wil_dbg_fw(wil, "magic is WIL_FW_CONCURRENCY_MAGIC\n");
 236                 rc = fw_handle_concurrency(wil, data, size);
 237                 break;
 238         default:
 239                 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1,
 240                                 data, size, true);
 241         }
 242
 243         return rc;
 244 }
 245
 246 static int __fw_handle_data(struct wil6210_priv *wil, const void *data,
 247                             size_t size, __le32 addr)
 248 {
 249         const struct wil_fw_record_data *d = data;
 250         void __iomem *dst;
 251         size_t s = size - sizeof(*d);
 252
 253         if (size < sizeof(*d) + sizeof(u32)) {
 254                 wil_err_fw(wil, "data record too short: %zu\n", size);
 255                 return -EINVAL;
 256         }
 257
 258         if (!wil_fw_addr_check(wil, &dst, addr, s, "address"))
 259                 return -EINVAL;
 260         wil_dbg_fw(wil, "write [0x%08x] <== %zu bytes\n", le32_to_cpu(addr), s);
 261         wil_memcpy_toio_32(dst, d->data, s);
 262         wmb(); /* finish before processing next record */
 263
 264         return 0;
 265 }
 266
 267 static int fw_handle_data(struct wil6210_priv *wil, const void *data,
 268                           size_t size)
 269 {
 270         const struct wil_fw_record_data *d = data;
 271
 272         return __fw_handle_data(wil, data, size, d->addr);
 273 }
 274
 275 static int fw_handle_fill(struct wil6210_priv *wil, const void *data,
 276                           size_t size)
 277 {
 278         const struct wil_fw_record_fill *d = data;
 279         void __iomem *dst;
 280         u32 v;
 281         size_t s = (size_t)le32_to_cpu(d->size);
 282
 283         if (size != sizeof(*d)) {
 284                 wil_err_fw(wil, "bad size for fill record: %zu\n", size);
 285                 return -EINVAL;
 286         }
 287
 288         if (s < sizeof(u32)) {
 289                 wil_err_fw(wil, "fill size too short: %zu\n", s);
 290                 return -EINVAL;
 291         }
 292
 293         if (s % sizeof(u32)) {
 294                 wil_err_fw(wil, "fill size not aligned: %zu\n", s);
 295                 return -EINVAL;
 296         }
 297
 298         if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address"))
 299                 return -EINVAL;
 300
 301         v = le32_to_cpu(d->value);
 302         wil_dbg_fw(wil, "fill [0x%08x] <== 0x%08x, %zu bytes\n",
 303                    le32_to_cpu(d->addr), v, s);
 304         wil_memset_toio_32(dst, v, s);
 305         wmb(); /* finish before processing next record */
 306
 307         return 0;
 308 }
 309
 310 static int fw_handle_file_header(struct wil6210_priv *wil, const void *data,
 311                                  size_t size)
 312 {
 313         const struct wil_fw_record_file_header *d = data;
 314
 315         if (size != sizeof(*d)) {
 316                 wil_err_fw(wil, "file header length incorrect: %zu\n", size);
 317                 return -EINVAL;
 318         }
 319
 320         wil_dbg_fw(wil, "new file, ver. %d, %i bytes\n",
 321                    d->version, d->data_len);
 322         wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, d->comment,
 323                         sizeof(d->comment), true);
 324
 325         if (!memcmp(d->comment, WIL_FW_VERSION_PREFIX,
 326                     WIL_FW_VERSION_PREFIX_LEN))
 327                 memcpy(wil->fw_version,
 328                        d->comment + WIL_FW_VERSION_PREFIX_LEN,
 329                        min(sizeof(d->comment) - WIL_FW_VERSION_PREFIX_LEN,
 330                            sizeof(wil->fw_version) - 1));
 331
 332         return 0;
 333 }
 334
 335 static int fw_handle_direct_write(struct wil6210_priv *wil, const void *data,
 336                                   size_t size)
 337 {
 338         const struct wil_fw_record_direct_write *d = data;
 339         const struct wil_fw_data_dwrite *block = d->data;
 340         int n, i;
 341
 342         if (size % sizeof(*block)) {
 343                 wil_err_fw(wil, "record size not aligned on %zu: %zu\n",
 344                            sizeof(*block), size);
 345                 return -EINVAL;
 346         }
 347         n = size / sizeof(*block);
 348
 349         for (i = 0; i < n; i++) {
 350                 void __iomem *dst;
 351                 u32 m = le32_to_cpu(block[i].mask);
 352                 u32 v = le32_to_cpu(block[i].value);
 353                 u32 x, y;
 354
 355                 if (!wil_fw_addr_check(wil, &dst, block[i].addr, 0, "address"))
 356                         return -EINVAL;
 357
 358                 x = readl(dst);
 359                 y = (x & m) | (v & ~m);
 360                 wil_dbg_fw(wil, "write [0x%08x] <== 0x%08x "
 361                            "(old 0x%08x val 0x%08x mask 0x%08x)\n",
 362                            le32_to_cpu(block[i].addr), y, x, v, m);
 363                 writel(y, dst);
 364                 wmb(); /* finish before processing next record */
 365         }
 366
 367         return 0;
 368 }
 369
 370 static int gw_write(struct wil6210_priv *wil, void __iomem *gwa_addr,
 371                     void __iomem *gwa_cmd, void __iomem *gwa_ctl, u32 gw_cmd,
 372                     u32 a)
 373 {
 374         unsigned delay = 0;
 375
 376         writel(a, gwa_addr);
 377         writel(gw_cmd, gwa_cmd);
 378         wmb(); /* finish before activate gw */
 379
 380         writel(WIL_FW_GW_CTL_RUN, gwa_ctl); /* activate gw */
 381         do {
 382                 udelay(1); /* typical time is few usec */
 383                 if (delay++ > 100) {
 384                         wil_err_fw(wil, "gw timeout\n");
 385                         return -EINVAL;
 386                 }
 387         } while (readl(gwa_ctl) & WIL_FW_GW_CTL_BUSY); /* gw done? */
 388
 389         return 0;
 390 }
 391
 392 static int fw_handle_gateway_data(struct wil6210_priv *wil, const void *data,
 393                                   size_t size)
 394 {
 395         const struct wil_fw_record_gateway_data *d = data;
 396         const struct wil_fw_data_gw *block = d->data;
 397         void __iomem *gwa_addr;
 398         void __iomem *gwa_val;
 399         void __iomem *gwa_cmd;
 400         void __iomem *gwa_ctl;
 401         u32 gw_cmd;
 402         int n, i;
 403
 404         if (size < sizeof(*d) + sizeof(*block)) {
 405                 wil_err_fw(wil, "gateway record too short: %zu\n", size);
 406                 return -EINVAL;
 407         }
 408
 409         if ((size - sizeof(*d)) % sizeof(*block)) {
 410                 wil_err_fw(wil, "gateway record data size"
 411                            " not aligned on %zu: %zu\n",
 412                            sizeof(*block), size - sizeof(*d));
 413                 return -EINVAL;
 414         }
 415         n = (size - sizeof(*d)) / sizeof(*block);
 416
 417         gw_cmd = le32_to_cpu(d->command);
 418
 419         wil_dbg_fw(wil, "gw write record [%3d] blocks, cmd 0x%08x\n",
 420                    n, gw_cmd);
 421
 422         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 423                                "gateway_addr_addr") ||
 424             !wil_fw_addr_check(wil, &gwa_val, d->gateway_value_addr, 0,
 425                                "gateway_value_addr") ||
 426             !wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 427                                "gateway_cmd_addr") ||
 428             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 429                                "gateway_ctrl_address"))
 430                 return -EINVAL;
 431
 432         wil_dbg_fw(wil, "gw addresses: addr 0x%08x val 0x%08x"
 433                    " cmd 0x%08x ctl 0x%08x\n",
 434                    le32_to_cpu(d->gateway_addr_addr),
 435                    le32_to_cpu(d->gateway_value_addr),
 436                    le32_to_cpu(d->gateway_cmd_addr),
 437                    le32_to_cpu(d->gateway_ctrl_address));
 438
 439         for (i = 0; i < n; i++) {
 440                 int rc;
 441                 u32 a = le32_to_cpu(block[i].addr);
 442                 u32 v = le32_to_cpu(block[i].value);
 443
 444                 wil_dbg_fw(wil, "  gw write[%3d] [0x%08x] <== 0x%08x\n",
 445                            i, a, v);
 446
 447                 writel(v, gwa_val);
 448                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 449                 if (rc)
 450                         return rc;
 451         }
 452
 453         return 0;
 454 }
 455
 456 static int fw_handle_gateway_data4(struct wil6210_priv *wil, const void *data,
 457                                    size_t size)
 458 {
 459         const struct wil_fw_record_gateway_data4 *d = data;
 460         const struct wil_fw_data_gw4 *block = d->data;
 461         void __iomem *gwa_addr;
 462         void __iomem *gwa_val[ARRAY_SIZE(block->value)];
 463         void __iomem *gwa_cmd;
 464         void __iomem *gwa_ctl;
 465         u32 gw_cmd;
 466         int n, i, k;
 467
 468         if (size < sizeof(*d) + sizeof(*block)) {
 469                 wil_err_fw(wil, "gateway4 record too short: %zu\n", size);
 470                 return -EINVAL;
 471         }
 472
 473         if ((size - sizeof(*d)) % sizeof(*block)) {
 474                 wil_err_fw(wil, "gateway4 record data size"
 475                            " not aligned on %zu: %zu\n",
 476                            sizeof(*block), size - sizeof(*d));
 477                 return -EINVAL;
 478         }
 479         n = (size - sizeof(*d)) / sizeof(*block);
 480
 481         gw_cmd = le32_to_cpu(d->command);
 482
 483         wil_dbg_fw(wil, "gw4 write record [%3d] blocks, cmd 0x%08x\n",
 484                    n, gw_cmd);
 485
 486         if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
 487                                "gateway_addr_addr"))
 488                 return -EINVAL;
 489         for (k = 0; k < ARRAY_SIZE(block->value); k++)
 490                 if (!wil_fw_addr_check(wil, &gwa_val[k],
 491                                        d->gateway_value_addr[k],
 492                                        0, "gateway_value_addr"))
 493                         return -EINVAL;
 494         if (!wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
 495                                "gateway_cmd_addr") ||
 496             !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
 497                                "gateway_ctrl_address"))
 498                 return -EINVAL;
 499
 500         wil_dbg_fw(wil, "gw4 addresses: addr 0x%08x cmd 0x%08x ctl 0x%08x\n",
 501                    le32_to_cpu(d->gateway_addr_addr),
 502                    le32_to_cpu(d->gateway_cmd_addr),
 503                    le32_to_cpu(d->gateway_ctrl_address));
 504         wil_hex_dump_fw("val addresses: ", DUMP_PREFIX_NONE, 16, 4,
 505                         d->gateway_value_addr, sizeof(d->gateway_value_addr),
 506                         false);
 507
 508         for (i = 0; i < n; i++) {
 509                 int rc;
 510                 u32 a = le32_to_cpu(block[i].addr);
 511                 u32 v[ARRAY_SIZE(block->value)];
 512
 513                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 514                         v[k] = le32_to_cpu(block[i].value[k]);
 515
 516                 wil_dbg_fw(wil, "  gw4 write[%3d] [0x%08x] <==\n", i, a);
 517                 wil_hex_dump_fw("    val ", DUMP_PREFIX_NONE, 16, 4, v,
 518                                 sizeof(v), false);
 519
 520                 for (k = 0; k < ARRAY_SIZE(block->value); k++)
 521                         writel(v[k], gwa_val[k]);
 522                 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
 523                 if (rc)
 524                         return rc;
 525         }
 526
 527         return 0;
 528 }
 529
 530 static const struct {
 531         int type;
 532         int (*load_handler)(struct wil6210_priv *wil, const void *data,
 533                             size_t size);
 534         int (*parse_handler)(struct wil6210_priv *wil, const void *data,
 535                              size_t size);
 536 } wil_fw_handlers[] = {
 537         {wil_fw_type_comment, fw_handle_comment, fw_handle_comment},
 538         {wil_fw_type_data, fw_handle_data, fw_ignore_section},
 539         {wil_fw_type_fill, fw_handle_fill, fw_ignore_section},
 540         /* wil_fw_type_action */
 541         /* wil_fw_type_verify */
 542         {wil_fw_type_file_header, fw_handle_file_header,
 543                 fw_handle_file_header},
 544         {wil_fw_type_direct_write, fw_handle_direct_write, fw_ignore_section},
 545         {wil_fw_type_gateway_data, fw_handle_gateway_data, fw_ignore_section},
 546         {wil_fw_type_gateway_data4, fw_handle_gateway_data4,
 547                 fw_ignore_section},
 548 };
 549
 550 static int wil_fw_handle_record(struct wil6210_priv *wil, int type,
 551                                 const void *data, size_t size, bool load)
 552 {
 553         int i;
 554
 555         for (i = 0; i < ARRAY_SIZE(wil_fw_handlers); i++)
 556                 if (wil_fw_handlers[i].type == type)
 557                         return load ?
 558                                 wil_fw_handlers[i].load_handler(
 559                                         wil, data, size) :
 560                                 wil_fw_handlers[i].parse_handler(
 561                                         wil, data, size);
 562
 563         wil_err_fw(wil, "unknown record type: %d\n", type);
 564         return -EINVAL;
 565 }
 566
 567 /**
 568  * wil_fw_process - process section from FW file
 569  * if load is true: Load the FW and uCode code and data to the
 570  * corresponding device memory regions,
 571  * otherwise only parse and look for capabilities
 572  *
 573  * Return error code
 574  */
 575 static int wil_fw_process(struct wil6210_priv *wil, const void *data,
 576                           size_t size, bool load)
 577 {
 578         int rc = 0;
 579         const struct wil_fw_record_head *hdr;
 580         size_t s, hdr_sz;
 581
 582         for (hdr = data;; hdr = (const void *)hdr + s, size -= s) {
 583                 if (size < sizeof(*hdr))
 584                         break;
 585                 hdr_sz = le32_to_cpu(hdr->size);
 586                 s = sizeof(*hdr) + hdr_sz;
 587                 if (s > size)
 588                         break;
 589                 if (hdr_sz % 4) {
 590                         wil_err_fw(wil, "unaligned record size: %zu\n",
 591                                    hdr_sz);
 592                         return -EINVAL;
 593                 }
 594                 rc = wil_fw_handle_record(wil, le16_to_cpu(hdr->type),
 595                                           &hdr[1], hdr_sz, load);
 596                 if (rc)
 597                         return rc;
 598         }
 599         if (size) {
 600                 wil_err_fw(wil, "unprocessed bytes: %zu\n", size);
 601                 if (size >= sizeof(*hdr)) {
 602                         wil_err_fw(wil, "Stop at offset %ld"
 603                                    " record type %d [%zd bytes]\n",
 604                                    (long)((const void *)hdr - data),
 605                                    le16_to_cpu(hdr->type), hdr_sz);
 606                 }
 607                 return -EINVAL;
 608         }
 609
 610         return rc;
 611 }
 612
 613 /**
 614  * wil_request_firmware - Request firmware
 615  *
 616  * Request firmware image from the file
 617  * If load is true, load firmware to device, otherwise
 618  * only parse and extract capabilities
 619  *
 620  * Return error code
 621  */
 622 int wil_request_firmware(struct wil6210_priv *wil, const char *name,
 623                          bool load)
 624 {
 625         int rc, rc1;
 626         const struct firmware *fw;
 627         size_t sz;
 628         const void *d;
 629
 630         rc = reject_firmware(&fw, name, wil_to_dev(wil));
 631         if (rc) {
 632                 wil_err_fw(wil, "Failed to load firmware %s rc %d\n", name, rc);
 633                 return rc;
 634         }
 635         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, fw->size);
 636
 637         for (sz = fw->size, d = fw->data; sz; sz -= rc1, d += rc1) {
 638                 rc1 = wil_fw_verify(wil, d, sz);
 639                 if (rc1 < 0) {
 640                         rc = rc1;
 641                         goto out;
 642                 }
 643                 rc = wil_fw_process(wil, d, rc1, load);
 644                 if (rc < 0)
 645                         goto out;
 646         }
 647
 648 out:
 649         release_firmware(fw);
 650         return rc;
 651 }
 652
 653 /**
 654  * wil_brd_process - process section from BRD file
 655  *
 656  * Return error code
 657  */
 658 static int wil_brd_process(struct wil6210_priv *wil, const void *data,
 659                            size_t size)
 660 {
 661         int rc = 0;
 662         const struct wil_fw_record_head *hdr = data;
 663         size_t s, hdr_sz;
 664         u16 type;
 665
 666         /* Assuming the board file includes only one header record and one data
 667          * record. Each record starts with wil_fw_record_head.
 668          */
 669         if (size < sizeof(*hdr))
 670                 return -EINVAL;
 671         s = sizeof(*hdr) + le32_to_cpu(hdr->size);
 672         if (s > size)
 673                 return -EINVAL;
 674
 675         /* Skip the header record and handle the data record */
 676         hdr = (const void *)hdr + s;
 677         size -= s;
 678         if (size < sizeof(*hdr))
 679                 return -EINVAL;
 680         hdr_sz = le32_to_cpu(hdr->size);
 681
 682         if (wil->brd_file_max_size && hdr_sz > wil->brd_file_max_size)
 683                 return -EINVAL;
 684         if (sizeof(*hdr) + hdr_sz > size)
 685                 return -EINVAL;
 686         if (hdr_sz % 4) {
 687                 wil_err_fw(wil, "unaligned record size: %zu\n",
 688                            hdr_sz);
 689                 return -EINVAL;
 690         }
 691         type = le16_to_cpu(hdr->type);
 692         if (type != wil_fw_type_data) {
 693                 wil_err_fw(wil, "invalid record type for board file: %d\n",
 694                            type);
 695                 return -EINVAL;
 696         }
 697         if (hdr_sz < sizeof(struct wil_fw_record_data)) {
 698                 wil_err_fw(wil, "data record too short: %zu\n", hdr_sz);
 699                 return -EINVAL;
 700         }
 701
 702         wil_dbg_fw(wil, "using addr from fw file: [0x%08x]\n",
 703                    wil->brd_file_addr);
 704
 705         rc = __fw_handle_data(wil, &hdr[1], hdr_sz,
 706                               cpu_to_le32(wil->brd_file_addr));
 707
 708         return rc;
 709 }
 710
 711 /**
 712  * wil_request_board - Request board file
 713  *
 714  * Request board image from the file
 715  * board file address and max size are read from FW file
 716  * during initialization.
 717  * brd file shall include one header and one data section.
 718  *
 719  * Return error code
 720  */
 721 int wil_request_board(struct wil6210_priv *wil, const char *name)
 722 {
 723         int rc, dlen;
 724         const struct firmware *brd;
 725
 726         rc = reject_firmware(&brd, name, wil_to_dev(wil));
 727         if (rc) {
 728                 wil_err_fw(wil, "Failed to load brd %s\n", name);
 729                 return rc;
 730         }
 731         wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, brd->size);
 732
 733         /* Verify the header */
 734         dlen = wil_fw_verify(wil, brd->data, brd->size);
 735         if (dlen < 0) {
 736                 rc = dlen;
 737                 goto out;
 738         }
 739         /* Process the data record */
 740         rc = wil_brd_process(wil, brd->data, dlen);
 741
 742 out:
 743         release_firmware(brd);
 744         return rc;
 745 }
 746
 747 /**
 748  * wil_fw_verify_file_exists - checks if firmware file exist
 749  *
 750  * @wil: driver context
 751  * @name: firmware file name
 752  *
 753  * return value - boolean, true for success, false for failure
 754  */
 755 bool wil_fw_verify_file_exists(struct wil6210_priv *wil, const char *name)
 756 {
 757         const struct firmware *fw;
 758         int rc;
 759
 760         rc = reject_firmware(&fw, name, wil_to_dev(wil));
 761         if (!rc)
 762                 release_firmware(fw);
 763         else
 764                 wil_dbg_fw(wil, "<%s> not available: %d\n", name, rc);
 765         return !rc;
 766 }