1 /*
2  * Copyright (c) 2013 Broadcom Corporation
3  *
4  * Permission to use, copy, modify, and/or distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <linux/efi.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <linux/device.h>
21 #include <linux/firmware.h>
22 #include <linux/module.h>
23 #include <linux/bcm47xx_nvram.h>
24 
25 #include "debug.h"
26 #include "firmware.h"
27 #include "core.h"
28 #include "common.h"
29 #include "chip.h"
30 
31 #define BRCMF_FW_MAX_NVRAM_SIZE			64000
32 #define BRCMF_FW_NVRAM_DEVPATH_LEN		19	/* devpath0=pcie/1/4/ */
33 #define BRCMF_FW_NVRAM_PCIEDEV_LEN		10	/* pcie/1/4/ + \0 */
34 #define BRCMF_FW_DEFAULT_BOARDREV		"boardrev=0xff"
35 
36 enum nvram_parser_state {
37 	IDLE,
38 	KEY,
39 	VALUE,
40 	COMMENT,
41 	END
42 };
43 
44 /**
45  * struct nvram_parser - internal info for parser.
46  *
47  * @state: current parser state.
48  * @data: input buffer being parsed.
49  * @nvram: output buffer with parse result.
50  * @nvram_len: length of parse result.
51  * @line: current line.
52  * @column: current column in line.
53  * @pos: byte offset in input buffer.
54  * @entry: start position of key,value entry.
55  * @multi_dev_v1: detect pcie multi device v1 (compressed).
56  * @multi_dev_v2: detect pcie multi device v2.
57  * @boardrev_found: nvram contains boardrev information.
58  */
59 struct nvram_parser {
60 	enum nvram_parser_state state;
61 	const u8 *data;
62 	u8 *nvram;
63 	u32 nvram_len;
64 	u32 line;
65 	u32 column;
66 	u32 pos;
67 	u32 entry;
68 	bool multi_dev_v1;
69 	bool multi_dev_v2;
70 	bool boardrev_found;
71 };
72 
73 /**
74  * is_nvram_char() - check if char is a valid one for NVRAM entry
75  *
76  * It accepts all printable ASCII chars except for '#' which opens a comment.
77  * Please note that ' ' (space) while accepted is not a valid key name char.
78  */
79 static bool is_nvram_char(char c)
80 {
81 	/* comment marker excluded */
82 	if (c == '#')
83 		return false;
84 
85 	/* key and value may have any other readable character */
86 	return (c >= 0x20 && c < 0x7f);
87 }
88 
89 static bool is_whitespace(char c)
90 {
91 	return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
92 }
93 
94 static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
95 {
96 	char c;
97 
98 	c = nvp->data[nvp->pos];
99 	if (c == '\n')
100 		return COMMENT;
101 	if (is_whitespace(c) || c == '\0')
102 		goto proceed;
103 	if (c == '#')
104 		return COMMENT;
105 	if (is_nvram_char(c)) {
106 		nvp->entry = nvp->pos;
107 		return KEY;
108 	}
109 	brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
110 		  nvp->line, nvp->column);
111 proceed:
112 	nvp->column++;
113 	nvp->pos++;
114 	return IDLE;
115 }
116 
117 static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
118 {
119 	enum nvram_parser_state st = nvp->state;
120 	char c;
121 
122 	c = nvp->data[nvp->pos];
123 	if (c == '=') {
124 		/* ignore RAW1 by treating as comment */
125 		if (strncmp(&nvp->data[nvp->entry], "RAW1", 4) == 0)
126 			st = COMMENT;
127 		else
128 			st = VALUE;
129 		if (strncmp(&nvp->data[nvp->entry], "devpath", 7) == 0)
130 			nvp->multi_dev_v1 = true;
131 		if (strncmp(&nvp->data[nvp->entry], "pcie/", 5) == 0)
132 			nvp->multi_dev_v2 = true;
133 		if (strncmp(&nvp->data[nvp->entry], "boardrev", 8) == 0)
134 			nvp->boardrev_found = true;
135 	} else if (!is_nvram_char(c) || c == ' ') {
136 		brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
137 			  nvp->line, nvp->column);
138 		return COMMENT;
139 	}
140 
141 	nvp->column++;
142 	nvp->pos++;
143 	return st;
144 }
145 
146 static enum nvram_parser_state
147 brcmf_nvram_handle_value(struct nvram_parser *nvp)
148 {
149 	char c;
150 	char *skv;
151 	char *ekv;
152 	u32 cplen;
153 
154 	c = nvp->data[nvp->pos];
155 	if (!is_nvram_char(c)) {
156 		/* key,value pair complete */
157 		ekv = (u8 *)&nvp->data[nvp->pos];
158 		skv = (u8 *)&nvp->data[nvp->entry];
159 		cplen = ekv - skv;
160 		if (nvp->nvram_len + cplen + 1 >= BRCMF_FW_MAX_NVRAM_SIZE)
161 			return END;
162 		/* copy to output buffer */
163 		memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
164 		nvp->nvram_len += cplen;
165 		nvp->nvram[nvp->nvram_len] = '\0';
166 		nvp->nvram_len++;
167 		return IDLE;
168 	}
169 	nvp->pos++;
170 	nvp->column++;
171 	return VALUE;
172 }
173 
174 static enum nvram_parser_state
175 brcmf_nvram_handle_comment(struct nvram_parser *nvp)
176 {
177 	char *eoc, *sol;
178 
179 	sol = (char *)&nvp->data[nvp->pos];
180 	eoc = strchr(sol, '\n');
181 	if (!eoc) {
182 		eoc = strchr(sol, '\0');
183 		if (!eoc)
184 			return END;
185 	}
186 
187 	/* eat all moving to next line */
188 	nvp->line++;
189 	nvp->column = 1;
190 	nvp->pos += (eoc - sol) + 1;
191 	return IDLE;
192 }
193 
194 static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
195 {
196 	/* final state */
197 	return END;
198 }
199 
200 static enum nvram_parser_state
201 (*nv_parser_states[])(struct nvram_parser *nvp) = {
202 	brcmf_nvram_handle_idle,
203 	brcmf_nvram_handle_key,
204 	brcmf_nvram_handle_value,
205 	brcmf_nvram_handle_comment,
206 	brcmf_nvram_handle_end
207 };
208 
209 static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
210 				   const u8 *data, size_t data_len)
211 {
212 	size_t size;
213 
214 	memset(nvp, 0, sizeof(*nvp));
215 	nvp->data = data;
216 	/* Limit size to MAX_NVRAM_SIZE, some files contain lot of comment */
217 	if (data_len > BRCMF_FW_MAX_NVRAM_SIZE)
218 		size = BRCMF_FW_MAX_NVRAM_SIZE;
219 	else
220 		size = data_len;
221 	/* Alloc for extra 0 byte + roundup by 4 + length field */
222 	size += 1 + 3 + sizeof(u32);
223 	nvp->nvram = kzalloc(size, GFP_KERNEL);
224 	if (!nvp->nvram)
225 		return -ENOMEM;
226 
227 	nvp->line = 1;
228 	nvp->column = 1;
229 	return 0;
230 }
231 
232 /* brcmf_fw_strip_multi_v1 :Some nvram files contain settings for multiple
233  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
234  * which data is to be returned. v1 is the version where nvram is stored
235  * compressed and "devpath" maps to index for valid entries.
236  */
237 static void brcmf_fw_strip_multi_v1(struct nvram_parser *nvp, u16 domain_nr,
238 				    u16 bus_nr)
239 {
240 	/* Device path with a leading '=' key-value separator */
241 	char pci_path[] = "=pci/?/?";
242 	size_t pci_len;
243 	char pcie_path[] = "=pcie/?/?";
244 	size_t pcie_len;
245 
246 	u32 i, j;
247 	bool found;
248 	u8 *nvram;
249 	u8 id;
250 
251 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
252 	if (!nvram)
253 		goto fail;
254 
255 	/* min length: devpath0=pcie/1/4/ + 0:x=y */
256 	if (nvp->nvram_len < BRCMF_FW_NVRAM_DEVPATH_LEN + 6)
257 		goto fail;
258 
259 	/* First search for the devpathX and see if it is the configuration
260 	 * for domain_nr/bus_nr. Search complete nvp
261 	 */
262 	snprintf(pci_path, sizeof(pci_path), "=pci/%d/%d", domain_nr,
263 		 bus_nr);
264 	pci_len = strlen(pci_path);
265 	snprintf(pcie_path, sizeof(pcie_path), "=pcie/%d/%d", domain_nr,
266 		 bus_nr);
267 	pcie_len = strlen(pcie_path);
268 	found = false;
269 	i = 0;
270 	while (i < nvp->nvram_len - BRCMF_FW_NVRAM_DEVPATH_LEN) {
271 		/* Format: devpathX=pcie/Y/Z/
272 		 * Y = domain_nr, Z = bus_nr, X = virtual ID
273 		 */
274 		if (strncmp(&nvp->nvram[i], "devpath", 7) == 0 &&
275 		    (!strncmp(&nvp->nvram[i + 8], pci_path, pci_len) ||
276 		     !strncmp(&nvp->nvram[i + 8], pcie_path, pcie_len))) {
277 			id = nvp->nvram[i + 7] - '0';
278 			found = true;
279 			break;
280 		}
281 		while (nvp->nvram[i] != 0)
282 			i++;
283 		i++;
284 	}
285 	if (!found)
286 		goto fail;
287 
288 	/* Now copy all valid entries, release old nvram and assign new one */
289 	i = 0;
290 	j = 0;
291 	while (i < nvp->nvram_len) {
292 		if ((nvp->nvram[i] - '0' == id) && (nvp->nvram[i + 1] == ':')) {
293 			i += 2;
294 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
295 				nvp->boardrev_found = true;
296 			while (nvp->nvram[i] != 0) {
297 				nvram[j] = nvp->nvram[i];
298 				i++;
299 				j++;
300 			}
301 			nvram[j] = 0;
302 			j++;
303 		}
304 		while (nvp->nvram[i] != 0)
305 			i++;
306 		i++;
307 	}
308 	kfree(nvp->nvram);
309 	nvp->nvram = nvram;
310 	nvp->nvram_len = j;
311 	return;
312 
313 fail:
314 	kfree(nvram);
315 	nvp->nvram_len = 0;
316 }
317 
318 /* brcmf_fw_strip_multi_v2 :Some nvram files contain settings for multiple
319  * devices. Strip it down for one device, use domain_nr/bus_nr to determine
320  * which data is to be returned. v2 is the version where nvram is stored
321  * uncompressed, all relevant valid entries are identified by
322  * pcie/domain_nr/bus_nr:
323  */
324 static void brcmf_fw_strip_multi_v2(struct nvram_parser *nvp, u16 domain_nr,
325 				    u16 bus_nr)
326 {
327 	char prefix[BRCMF_FW_NVRAM_PCIEDEV_LEN];
328 	size_t len;
329 	u32 i, j;
330 	u8 *nvram;
331 
332 	nvram = kzalloc(nvp->nvram_len + 1 + 3 + sizeof(u32), GFP_KERNEL);
333 	if (!nvram)
334 		goto fail;
335 
336 	/* Copy all valid entries, release old nvram and assign new one.
337 	 * Valid entries are of type pcie/X/Y/ where X = domain_nr and
338 	 * Y = bus_nr.
339 	 */
340 	snprintf(prefix, sizeof(prefix), "pcie/%d/%d/", domain_nr, bus_nr);
341 	len = strlen(prefix);
342 	i = 0;
343 	j = 0;
344 	while (i < nvp->nvram_len - len) {
345 		if (strncmp(&nvp->nvram[i], prefix, len) == 0) {
346 			i += len;
347 			if (strncmp(&nvp->nvram[i], "boardrev", 8) == 0)
348 				nvp->boardrev_found = true;
349 			while (nvp->nvram[i] != 0) {
350 				nvram[j] = nvp->nvram[i];
351 				i++;
352 				j++;
353 			}
354 			nvram[j] = 0;
355 			j++;
356 		}
357 		while (nvp->nvram[i] != 0)
358 			i++;
359 		i++;
360 	}
361 	kfree(nvp->nvram);
362 	nvp->nvram = nvram;
363 	nvp->nvram_len = j;
364 	return;
365 fail:
366 	kfree(nvram);
367 	nvp->nvram_len = 0;
368 }
369 
370 static void brcmf_fw_add_defaults(struct nvram_parser *nvp)
371 {
372 	if (nvp->boardrev_found)
373 		return;
374 
375 	memcpy(&nvp->nvram[nvp->nvram_len], &BRCMF_FW_DEFAULT_BOARDREV,
376 	       strlen(BRCMF_FW_DEFAULT_BOARDREV));
377 	nvp->nvram_len += strlen(BRCMF_FW_DEFAULT_BOARDREV);
378 	nvp->nvram[nvp->nvram_len] = '\0';
379 	nvp->nvram_len++;
380 }
381 
382 /* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
383  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
384  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
385  * End of buffer is completed with token identifying length of buffer.
386  */
387 static void *brcmf_fw_nvram_strip(const u8 *data, size_t data_len,
388 				  u32 *new_length, u16 domain_nr, u16 bus_nr)
389 {
390 	struct nvram_parser nvp;
391 	u32 pad;
392 	u32 token;
393 	__le32 token_le;
394 
395 	if (brcmf_init_nvram_parser(&nvp, data, data_len) < 0)
396 		return NULL;
397 
398 	while (nvp.pos < data_len) {
399 		nvp.state = nv_parser_states[nvp.state](&nvp);
400 		if (nvp.state == END)
401 			break;
402 	}
403 	if (nvp.multi_dev_v1) {
404 		nvp.boardrev_found = false;
405 		brcmf_fw_strip_multi_v1(&nvp, domain_nr, bus_nr);
406 	} else if (nvp.multi_dev_v2) {
407 		nvp.boardrev_found = false;
408 		brcmf_fw_strip_multi_v2(&nvp, domain_nr, bus_nr);
409 	}
410 
411 	if (nvp.nvram_len == 0) {
412 		kfree(nvp.nvram);
413 		return NULL;
414 	}
415 
416 	brcmf_fw_add_defaults(&nvp);
417 
418 	pad = nvp.nvram_len;
419 	*new_length = roundup(nvp.nvram_len + 1, 4);
420 	while (pad != *new_length) {
421 		nvp.nvram[pad] = 0;
422 		pad++;
423 	}
424 
425 	token = *new_length / 4;
426 	token = (~token << 16) | (token & 0x0000FFFF);
427 	token_le = cpu_to_le32(token);
428 
429 	memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
430 	*new_length += sizeof(token_le);
431 
432 	return nvp.nvram;
433 }
434 
435 void brcmf_fw_nvram_free(void *nvram)
436 {
437 	kfree(nvram);
438 }
439 
440 struct brcmf_fw {
441 	struct device *dev;
442 	struct brcmf_fw_request *req;
443 	u32 curpos;
444 	void (*done)(struct device *dev, int err, struct brcmf_fw_request *req);
445 };
446 
447 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx);
448 
449 #ifdef CONFIG_EFI
450 /* In some cases the EFI-var stored nvram contains "ccode=ALL" or "ccode=XV"
451  * to specify "worldwide" compatible settings, but these 2 ccode-s do not work
452  * properly. "ccode=ALL" causes channels 12 and 13 to not be available,
453  * "ccode=XV" causes all 5GHz channels to not be available. So we replace both
454  * with "ccode=X2" which allows channels 12+13 and 5Ghz channels in
455  * no-Initiate-Radiation mode. This means that we will never send on these
456  * channels without first having received valid wifi traffic on the channel.
457  */
458 static void brcmf_fw_fix_efi_nvram_ccode(char *data, unsigned long data_len)
459 {
460 	char *ccode;
461 
462 	ccode = strnstr((char *)data, "ccode=ALL", data_len);
463 	if (!ccode)
464 		ccode = strnstr((char *)data, "ccode=XV\r", data_len);
465 	if (!ccode)
466 		return;
467 
468 	ccode[6] = 'X';
469 	ccode[7] = '2';
470 	ccode[8] = '\r';
471 }
472 
473 static u8 *brcmf_fw_nvram_from_efi(size_t *data_len_ret)
474 {
475 	const u16 name[] = { 'n', 'v', 'r', 'a', 'm', 0 };
476 	struct efivar_entry *nvram_efivar;
477 	unsigned long data_len = 0;
478 	u8 *data = NULL;
479 	int err;
480 
481 	nvram_efivar = kzalloc(sizeof(*nvram_efivar), GFP_KERNEL);
482 	if (!nvram_efivar)
483 		return NULL;
484 
485 	memcpy(&nvram_efivar->var.VariableName, name, sizeof(name));
486 	nvram_efivar->var.VendorGuid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61,
487 						0xb5, 0x1f, 0x43, 0x26,
488 						0x81, 0x23, 0xd1, 0x13);
489 
490 	err = efivar_entry_size(nvram_efivar, &data_len);
491 	if (err)
492 		goto fail;
493 
494 	data = kmalloc(data_len, GFP_KERNEL);
495 	if (!data)
496 		goto fail;
497 
498 	err = efivar_entry_get(nvram_efivar, NULL, &data_len, data);
499 	if (err)
500 		goto fail;
501 
502 	brcmf_fw_fix_efi_nvram_ccode(data, data_len);
503 	brcmf_info("Using nvram EFI variable\n");
504 
505 	kfree(nvram_efivar);
506 	*data_len_ret = data_len;
507 	return data;
508 
509 fail:
510 	kfree(data);
511 	kfree(nvram_efivar);
512 	return NULL;
513 }
514 #else
515 static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
516 #endif
517 
518 static void brcmf_fw_free_request(struct brcmf_fw_request *req)
519 {
520 	struct brcmf_fw_item *item;
521 	int i;
522 
523 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
524 		if (item->type == BRCMF_FW_TYPE_BINARY)
525 			release_firmware(item->binary);
526 		else if (item->type == BRCMF_FW_TYPE_NVRAM)
527 			brcmf_fw_nvram_free(item->nv_data.data);
528 	}
529 	kfree(req);
530 }
531 
532 static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
533 {
534 	struct brcmf_fw *fwctx = ctx;
535 	struct brcmf_fw_item *cur;
536 	bool free_bcm47xx_nvram = false;
537 	bool kfree_nvram = false;
538 	u32 nvram_length = 0;
539 	void *nvram = NULL;
540 	u8 *data = NULL;
541 	size_t data_len;
542 
543 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
544 
545 	cur = &fwctx->req->items[fwctx->curpos];
546 
547 	if (fw && fw->data) {
548 		data = (u8 *)fw->data;
549 		data_len = fw->size;
550 	} else {
551 		if ((data = bcm47xx_nvram_get_contents(&data_len)))
552 			free_bcm47xx_nvram = true;
553 		else if ((data = brcmf_fw_nvram_from_efi(&data_len)))
554 			kfree_nvram = true;
555 		else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL))
556 			goto fail;
557 	}
558 
559 	if (data)
560 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
561 					     fwctx->req->domain_nr,
562 					     fwctx->req->bus_nr);
563 
564 	if (free_bcm47xx_nvram)
565 		bcm47xx_nvram_release_contents(data);
566 	if (kfree_nvram)
567 		kfree(data);
568 
569 	release_firmware(fw);
570 	if (!nvram && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
571 		goto fail;
572 
573 	brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
574 	cur->nv_data.data = nvram;
575 	cur->nv_data.len = nvram_length;
576 	return 0;
577 
578 fail:
579 	return -ENOENT;
580 }
581 
582 static int brcmf_fw_complete_request(const struct firmware *fw,
583 				     struct brcmf_fw *fwctx)
584 {
585 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
586 	int ret = 0;
587 
588 	brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
589 
590 	switch (cur->type) {
591 	case BRCMF_FW_TYPE_NVRAM:
592 		ret = brcmf_fw_request_nvram_done(fw, fwctx);
593 		break;
594 	case BRCMF_FW_TYPE_BINARY:
595 		if (fw)
596 			cur->binary = fw;
597 		else
598 			ret = -ENOENT;
599 		break;
600 	default:
601 		/* something fishy here so bail out early */
602 		brcmf_err("unknown fw type: %d\n", cur->type);
603 		release_firmware(fw);
604 		ret = -EINVAL;
605 	}
606 
607 	return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
608 }
609 
610 static int brcmf_fw_request_firmware(const struct firmware **fw,
611 				     struct brcmf_fw *fwctx)
612 {
613 	struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
614 	int ret;
615 
616 	/* nvram files are board-specific, first try a board-specific path */
617 	if (cur->type == BRCMF_FW_TYPE_NVRAM && fwctx->req->board_type) {
618 		char alt_path[BRCMF_FW_NAME_LEN];
619 
620 		strlcpy(alt_path, cur->path, BRCMF_FW_NAME_LEN);
621 		/* strip .txt at the end */
622 		alt_path[strlen(alt_path) - 4] = 0;
623 		strlcat(alt_path, ".", BRCMF_FW_NAME_LEN);
624 		strlcat(alt_path, fwctx->req->board_type, BRCMF_FW_NAME_LEN);
625 		strlcat(alt_path, ".txt", BRCMF_FW_NAME_LEN);
626 
627 		ret = request_firmware(fw, alt_path, fwctx->dev);
628 		if (ret == 0)
629 			return ret;
630 	}
631 
632 	return request_firmware(fw, cur->path, fwctx->dev);
633 }
634 
635 static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
636 {
637 	struct brcmf_fw *fwctx = ctx;
638 	int ret;
639 
640 	ret = brcmf_fw_complete_request(fw, fwctx);
641 
642 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
643 		brcmf_fw_request_firmware(&fw, fwctx);
644 		ret = brcmf_fw_complete_request(fw, ctx);
645 	}
646 
647 	if (ret) {
648 		brcmf_fw_free_request(fwctx->req);
649 		fwctx->req = NULL;
650 	}
651 	fwctx->done(fwctx->dev, ret, fwctx->req);
652 	kfree(fwctx);
653 }
654 
655 static bool brcmf_fw_request_is_valid(struct brcmf_fw_request *req)
656 {
657 	struct brcmf_fw_item *item;
658 	int i;
659 
660 	if (!req->n_items)
661 		return false;
662 
663 	for (i = 0, item = &req->items[0]; i < req->n_items; i++, item++) {
664 		if (!item->path)
665 			return false;
666 	}
667 	return true;
668 }
669 
670 int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
671 			   void (*fw_cb)(struct device *dev, int err,
672 					 struct brcmf_fw_request *req))
673 {
674 	struct brcmf_fw_item *first = &req->items[0];
675 	struct brcmf_fw *fwctx;
676 	int ret;
677 
678 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
679 	if (!fw_cb)
680 		return -EINVAL;
681 
682 	if (!brcmf_fw_request_is_valid(req))
683 		return -EINVAL;
684 
685 	fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
686 	if (!fwctx)
687 		return -ENOMEM;
688 
689 	fwctx->dev = dev;
690 	fwctx->req = req;
691 	fwctx->done = fw_cb;
692 
693 	ret = request_firmware_nowait(THIS_MODULE, true, first->path,
694 				      fwctx->dev, GFP_KERNEL, fwctx,
695 				      brcmf_fw_request_done);
696 	if (ret < 0)
697 		brcmf_fw_request_done(NULL, fwctx);
698 
699 	return 0;
700 }
701 
702 struct brcmf_fw_request *
703 brcmf_fw_alloc_request(u32 chip, u32 chiprev,
704 		       const struct brcmf_firmware_mapping mapping_table[],
705 		       u32 table_size, struct brcmf_fw_name *fwnames,
706 		       u32 n_fwnames)
707 {
708 	struct brcmf_fw_request *fwreq;
709 	char chipname[12];
710 	const char *mp_path;
711 	size_t mp_path_len;
712 	u32 i, j;
713 	char end = '\0';
714 
715 	for (i = 0; i < table_size; i++) {
716 		if (mapping_table[i].chipid == chip &&
717 		    mapping_table[i].revmask & BIT(chiprev))
718 			break;
719 	}
720 
721 	brcmf_chip_name(chip, chiprev, chipname, sizeof(chipname));
722 
723 	if (i == table_size) {
724 		brcmf_err("Unknown chip %s\n", chipname);
725 		return NULL;
726 	}
727 
728 	fwreq = kzalloc(struct_size(fwreq, items, n_fwnames), GFP_KERNEL);
729 	if (!fwreq)
730 		return NULL;
731 
732 	brcmf_info("using %s for chip %s\n",
733 		   mapping_table[i].fw_base, chipname);
734 
735 	mp_path = brcmf_mp_global.firmware_path;
736 	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
737 	if (mp_path_len)
738 		end = mp_path[mp_path_len - 1];
739 
740 	fwreq->n_items = n_fwnames;
741 
742 	for (j = 0; j < n_fwnames; j++) {
743 		fwreq->items[j].path = fwnames[j].path;
744 		fwnames[j].path[0] = '\0';
745 		/* check if firmware path is provided by module parameter */
746 		if (brcmf_mp_global.firmware_path[0] != '\0') {
747 			strlcpy(fwnames[j].path, mp_path,
748 				BRCMF_FW_NAME_LEN);
749 
750 			if (end != '/') {
751 				strlcat(fwnames[j].path, "/",
752 					BRCMF_FW_NAME_LEN);
753 			}
754 		}
755 		strlcat(fwnames[j].path, mapping_table[i].fw_base,
756 			BRCMF_FW_NAME_LEN);
757 		strlcat(fwnames[j].path, fwnames[j].extension,
758 			BRCMF_FW_NAME_LEN);
759 		fwreq->items[j].path = fwnames[j].path;
760 	}
761 
762 	return fwreq;
763 }
764