6  * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
35  * Intel Corporation <linux-wimax@intel.com>
37  * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
38  *  - Initial implementation
43  * The 2400m and derived devices work in two modes: boot-mode or
44  * normal mode. In boot mode we can execute only a handful of commands
47  * The 2400m enters boot mode when it is first connected to the
49  * two submodes of the boot mode: signed and non-signed. Signed takes
50  * firmwares signed with a certain private key, non-signed takes any
53  * On boot mode, in USB, we write to the device using the bulk out
56  * Upon entrance to boot mode, the device sends (preceded with a few
64  * configurations will send different [re]boot barkers; these are
70  * i2400m_bm_cmd() [boot mode command]. Special return values will
89  * warm reset request that will take us to boot-mode. If we time out
91  * boot mode, so we send a reboot barker.
102  * This code is bus-generic; the bus-specific driver provides back end
103  * implementations to send a boot mode command to the device and to
144  *   i2400m->bus_bm_cmd_send()
145  *   i2400m->bus_bm_wait_for_ack
149  * i2400m_bm_cmd_prepare              Used by bus-drivers to prep
165 #include "debug-levels.h"
177  * Prepare a boot-mode command for delivery
193 		const u32 *checksum_ptr = (void *) cmd->payload;  in i2400m_bm_cmd_prepare()
194 		for (i = 0; i < cmd->data_size / 4; i++)  in i2400m_bm_cmd_prepare()
196 		checksum += cmd->command + cmd->target_addr + cmd->data_size;  in i2400m_bm_cmd_prepare()
197 		cmd->block_checksum = cpu_to_le32(checksum);  in i2400m_bm_cmd_prepare()
237 		return -ENOMEM;  in i2400m_zrealloc_2x()
261 	barker->data[0] = le32_to_cpu(barker_id);  in i2400m_barker_db_add()
262 	barker->data[1] = le32_to_cpu(barker_id);  in i2400m_barker_db_add()
263 	barker->data[2] = le32_to_cpu(barker_id);  in i2400m_barker_db_add()
264 	barker->data[3] = le32_to_cpu(barker_id);  in i2400m_barker_db_add()
308  *     recognize. This is a comma-separated list of 32-bit hex
330 			result = -ENOMEM;  in i2400m_barker_db_init()
342 				       "a 32-bit number\n",  in i2400m_barker_db_init()
344 				result = -EINVAL;  in i2400m_barker_db_init()
370  * Recognize a boot barker
372  * @buf: buffer where the boot barker.
376  * Note that as a side effect, upon identifying the obtained boot
377  * barker, this function will set i2400m->barker to point to the right
379  * in verifying that the same type of boot barker is returned when the
382  * Return: 0 if @buf matches a known boot barker. -ENOENT if the
383  *     buffer in @buf doesn't match any boot barker in the database or
384  *     -EILSEQ if the buffer doesn't have the right size.
394 	result = -ENOENT;  in i2400m_is_boot_barker()
400 	if (i2400m->barker &&  in i2400m_is_boot_barker()
401 	    !memcmp(buf, i2400m->barker, sizeof(i2400m->barker->data)))  in i2400m_is_boot_barker()
406 		BUILD_BUG_ON(sizeof(barker->data) != 16);  in i2400m_is_boot_barker()
407 		if (memcmp(buf, barker->data, sizeof(barker->data)))  in i2400m_is_boot_barker()
410 		if (i2400m->barker == NULL) {  in i2400m_is_boot_barker()
411 			i2400m->barker = barker;  in i2400m_is_boot_barker()
412 			d_printf(1, dev, "boot barker set to #%u/%08x\n",  in i2400m_is_boot_barker()
413 				 i, le32_to_cpu(barker->data[0]));  in i2400m_is_boot_barker()
414 			if (barker->data[0] == le32_to_cpu(I2400M_NBOOT_BARKER))  in i2400m_is_boot_barker()
415 				i2400m->sboot = 0;  in i2400m_is_boot_barker()
417 				i2400m->sboot = 1;  in i2400m_is_boot_barker()
418 		} else if (i2400m->barker != barker) {  in i2400m_is_boot_barker()
420 				"reports a different boot barker "  in i2400m_is_boot_barker()
422 				le32_to_cpu(i2400m->barker->data[0]),  in i2400m_is_boot_barker()
423 				le32_to_cpu(barker->data[0]));  in i2400m_is_boot_barker()
424 			result = -EIO;  in i2400m_is_boot_barker()
426 			d_printf(2, dev, "boot barker confirmed #%u/%08x\n",  in i2400m_is_boot_barker()
427 				 i, le32_to_cpu(barker->data[0]));  in i2400m_is_boot_barker()
439  * Given a reply to a boot mode command, chew it and verify everything
447  * Way too long function -- maybe it should be further split
454 	ssize_t result = -ENOMEM;  in __i2400m_bm_ack_verify()
460 		result = -EIO;  in __i2400m_bm_ack_verify()
461 		dev_err(dev, "boot-mode cmd %d: HW BUG? notification didn't "  in __i2400m_bm_ack_verify()
468 		result = -ERESTARTSYS;  in __i2400m_bm_ack_verify()
469 		d_printf(6, dev, "boot-mode cmd %d: HW boot barker\n", opcode);  in __i2400m_bm_ack_verify()
474 		result = -EISCONN;  in __i2400m_bm_ack_verify()
475 		d_printf(3, dev, "boot-mode cmd %d: HW reboot ack barker\n",  in __i2400m_bm_ack_verify()
482 	ack->data_size = le32_to_cpu(ack->data_size);  in __i2400m_bm_ack_verify()
483 	ack->target_addr = le32_to_cpu(ack->target_addr);  in __i2400m_bm_ack_verify()
484 	ack->block_checksum = le32_to_cpu(ack->block_checksum);  in __i2400m_bm_ack_verify()
485 	d_printf(5, dev, "boot-mode cmd %d: notification for opcode %u "  in __i2400m_bm_ack_verify()
486 		 "response %u csum %u rr %u da %u\n",  in __i2400m_bm_ack_verify()
492 	result = -EIO;  in __i2400m_bm_ack_verify()
494 		dev_err(dev, "boot-mode cmd %d: HW BUG? wrong signature "  in __i2400m_bm_ack_verify()
498 	if (opcode != -1 && opcode != i2400m_brh_get_opcode(ack)) {  in __i2400m_bm_ack_verify()
499 		dev_err(dev, "boot-mode cmd %d: HW BUG? "  in __i2400m_bm_ack_verify()
500 			"received response for opcode %u, expected %u\n",  in __i2400m_bm_ack_verify()
505 		dev_err(dev, "boot-mode cmd %d: error; hw response %u\n",  in __i2400m_bm_ack_verify()
509 	if (ack_size < ack->data_size + sizeof(*ack)) {  in __i2400m_bm_ack_verify()
510 		dev_err(dev, "boot-mode cmd %d: SW BUG "  in __i2400m_bm_ack_verify()
513 			(size_t) le32_to_cpu(ack->data_size) + sizeof(*ack));  in __i2400m_bm_ack_verify()
535  * i2400m_bm_cmd - Execute a boot mode command
549  *     You can use the i2400m->bm_cmd_buf to stage your commands and
555  *     bus-specific drivers padding requirements.
561  *     You *cannot* use i2400m->bm_ack_buf for this buffer.
572  *     -ERESTARTSYS  The device has rebooted
574  * Executes a boot-mode command and waits for a response, doing basic
576  * waiting for a response until a non-zero one is received (timing out
585 	ssize_t result = -ENOMEM, rx_bytes;  in i2400m_bm_cmd()
587 	int opcode = cmd == NULL ? -1 : i2400m_brh_get_opcode(cmd);  in i2400m_bm_cmd()
592 	BUG_ON(i2400m->boot_mode == 0);  in i2400m_bm_cmd()
595 		result = i2400m->bus_bm_cmd_send(i2400m, cmd, cmd_size, flags);  in i2400m_bm_cmd()
600 				 "boot-mode cmd %d csum %u rr %u da %u: "  in i2400m_bm_cmd()
601 				 "addr 0x%04x size %u block csum 0x%04x\n",  in i2400m_bm_cmd()
605 				 cmd->target_addr, cmd->data_size,  in i2400m_bm_cmd()
606 				 cmd->block_checksum);  in i2400m_bm_cmd()
608 	result = i2400m->bus_bm_wait_for_ack(i2400m, ack, ack_size);  in i2400m_bm_cmd()
610 		dev_err(dev, "boot-mode cmd %d: error waiting for an ack: %d\n",  in i2400m_bm_cmd()
634  * i2400m_download_chunk - write a single chunk of data to the device's memory
657 		  "direct %u do_csum %u)\n", i2400m, chunk, __chunk_len,  in i2400m_download_chunk()
659 	buf = i2400m->bm_cmd_buf;  in i2400m_download_chunk()
660 	memcpy(buf->cmd_payload, chunk, __chunk_len);  in i2400m_download_chunk()
661 	memset(buf->cmd_payload + __chunk_len, 0xad, chunk_len - __chunk_len);  in i2400m_download_chunk()
663 	buf->cmd.command = i2400m_brh_command(I2400M_BRH_WRITE,  in i2400m_download_chunk()
666 	buf->cmd.target_addr = cpu_to_le32(addr);  in i2400m_download_chunk()
667 	buf->cmd.data_size = cpu_to_le32(__chunk_len);  in i2400m_download_chunk()
668 	ret = i2400m_bm_cmd(i2400m, &buf->cmd, sizeof(buf->cmd) + chunk_len,  in i2400m_download_chunk()
673 		"direct %u do_csum %u) = %d\n", i2400m, chunk, __chunk_len,  in i2400m_download_chunk()
714 	offset = le32_to_cpu(bcf->header_len) * sizeof(u32);  in i2400m_dnload_bcf()
717 		data_size = le32_to_cpu(bh->data_size);  in i2400m_dnload_bcf()
722 			 le32_to_cpu(bh->target_addr));  in i2400m_dnload_bcf()
725 		 * either I2400M_BRH_SIGNED_JUMP for secure boot  in i2400m_dnload_bcf()
726 		 * or I2400M_BRH_JUMP for unsecure boot, the last chunk  in i2400m_dnload_bcf()
737 				i2400m->fw_name, section,  in i2400m_dnload_bcf()
739 			ret = -EINVAL;  in i2400m_dnload_bcf()
747 				"failed %d\n", i2400m->fw_name, section,  in i2400m_dnload_bcf()
765  * "signed boot"
770 	return likely(i2400m->sboot);  in i2400m_boot_is_signed()
782  * Depending on the boot mode (signed vs non-signed), different
803 		d_printf(1, dev, "unsecure boot, jumping to 0x%08x\n",  in i2400m_dnload_finalize()
804 			le32_to_cpu(cmd->target_addr));  in i2400m_dnload_finalize()
805 		cmd_buf = i2400m->bm_cmd_buf;  in i2400m_dnload_finalize()
806 		memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd));  in i2400m_dnload_finalize()
807 		cmd = &cmd_buf->cmd;  in i2400m_dnload_finalize()
810 		cmd->data_size = 0;  in i2400m_dnload_finalize()
814 		d_printf(1, dev, "secure boot, jumping to 0x%08x\n",  in i2400m_dnload_finalize()
815 			 le32_to_cpu(cmd->target_addr));  in i2400m_dnload_finalize()
816 		cmd_buf = i2400m->bm_cmd_buf;  in i2400m_dnload_finalize()
817 		memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd));  in i2400m_dnload_finalize()
820 			+ le32_to_cpu(bcf_hdr->key_size) * sizeof(u32)  in i2400m_dnload_finalize()
821 			+ le32_to_cpu(bcf_hdr->exponent_size) * sizeof(u32);  in i2400m_dnload_finalize()
823 			le32_to_cpu(bcf_hdr->modulus_size) * sizeof(u32);  in i2400m_dnload_finalize()
824 		memcpy(cmd_buf->cmd_pl,  in i2400m_dnload_finalize()
827 		ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd,  in i2400m_dnload_finalize()
828 				    sizeof(cmd_buf->cmd) + signature_block_size,  in i2400m_dnload_finalize()
837  * i2400m_bootrom_init - Reboots a powered device into boot mode
854  * Tries hard enough to put the device in boot-mode. There are two
873  * what to send to it -- cold reset and bus reset seem to have little
886 	int count = i2400m->bus_bm_retries;  in i2400m_bootrom_init()
894 	result = -ENOMEM;  in i2400m_bootrom_init()
895 	cmd = i2400m->bm_cmd_buf;  in i2400m_bootrom_init()
900 	if (--count < 0)  in i2400m_bootrom_init()
910 	case -ERESTARTSYS:  in i2400m_bootrom_init()
914 		 * i2400m->barker and we are good to go.  in i2400m_bootrom_init()
918 	case -EISCONN:	/* we don't know how it got here...but we follow it */  in i2400m_bootrom_init()
919 		d_printf(4, dev, "device reboot: got ack barker - whatever\n");  in i2400m_bootrom_init()
921 	case -ETIMEDOUT:  in i2400m_bootrom_init()
923 		 * Device has timed out, we might be in boot mode  in i2400m_bootrom_init()
928 		if (i2400m->barker != NULL) {  in i2400m_bootrom_init()
929 			dev_err(dev, "device boot: reboot barker timed out, "  in i2400m_bootrom_init()
931 				le32_to_cpu(i2400m->barker->data[0]));  in i2400m_bootrom_init()
936 			memcpy(cmd, barker->data, sizeof(barker->data));  in i2400m_bootrom_init()
940 			if (result == -EISCONN) {  in i2400m_bootrom_init()
941 				dev_warn(dev, "device boot: got ack barker "  in i2400m_bootrom_init()
944 					 i, le32_to_cpu(barker->data[0]));  in i2400m_bootrom_init()
949 		dev_err(dev, "device boot: tried all the echo/acks, could "  in i2400m_bootrom_init()
951 		result = -ESHUTDOWN;  in i2400m_bootrom_init()
952 	case -EPROTO:  in i2400m_bootrom_init()
953 	case -ESHUTDOWN:	/* dev is gone */  in i2400m_bootrom_init()
954 	case -EINTR:		/* user cancelled */  in i2400m_bootrom_init()
958 			"for reboot barker - rebooting\n", result);  in i2400m_bootrom_init()
963 	 * 4 ACK barkers. This is ugly, as we send a raw command --  in i2400m_bootrom_init()
965 	 * notification and report it as -EISCONN. */  in i2400m_bootrom_init()
968 	memcpy(cmd, i2400m->barker->data, sizeof(i2400m->barker->data));  in i2400m_bootrom_init()
972 	case -ERESTARTSYS:  in i2400m_bootrom_init()
973 		d_printf(4, dev, "reboot ack: got reboot barker - retrying\n");  in i2400m_bootrom_init()
974 		if (--count < 0)  in i2400m_bootrom_init()
977 	case -EISCONN:  in i2400m_bootrom_init()
978 		d_printf(4, dev, "reboot ack: got ack barker - good\n");  in i2400m_bootrom_init()
980 	case -ETIMEDOUT:	/* no response, maybe it is the other type? */  in i2400m_bootrom_init()
981 		if (ack_timeout_cnt-- < 0) {  in i2400m_bootrom_init()
990 	case -EPROTO:  in i2400m_bootrom_init()
991 	case -ESHUTDOWN:	/* dev is gone */  in i2400m_bootrom_init()
995 			"reboot ack barker - rebooting\n", result);  in i2400m_bootrom_init()
998 	d_printf(2, dev, "device reboot ack: got ack barker - boot done\n");  in i2400m_bootrom_init()
1008 	result = -ETIMEDOUT;  in i2400m_bootrom_init()
1026 	struct net_device *net_dev = i2400m->wimax_dev.net_dev;  in i2400m_read_mac_addr()
1034 	cmd = i2400m->bm_cmd_buf;  in i2400m_read_mac_addr()
1035 	cmd->command = i2400m_brh_command(I2400M_BRH_READ, 0, 1);  in i2400m_read_mac_addr()
1036 	cmd->target_addr = cpu_to_le32(0x00203fe8);  in i2400m_read_mac_addr()
1037 	cmd->data_size = cpu_to_le32(6);  in i2400m_read_mac_addr()
1045 	if (i2400m->bus_bm_mac_addr_impaired == 1) {  in i2400m_read_mac_addr()
1054 	net_dev->addr_len = ETH_ALEN;  in i2400m_read_mac_addr()
1055 	memcpy(net_dev->dev_addr, ack_buf.ack_pl, ETH_ALEN);  in i2400m_read_mac_addr()
1063  * Initialize a non signed boot
1076 	if (i2400m->bus_bm_pokes_table) {  in i2400m_dnload_init_nonsigned()
1077 		while (i2400m->bus_bm_pokes_table[i].address) {  in i2400m_dnload_init_nonsigned()
1080 				&i2400m->bus_bm_pokes_table[i].data,  in i2400m_dnload_init_nonsigned()
1081 				sizeof(i2400m->bus_bm_pokes_table[i].data),  in i2400m_dnload_init_nonsigned()
1082 				i2400m->bus_bm_pokes_table[i].address, 1, 1);  in i2400m_dnload_init_nonsigned()
1094  * Initialize the signed boot process
1101  * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw
1120 	cmd_buf = i2400m->bm_cmd_buf;  in i2400m_dnload_init_signed()
1121 	cmd_buf->cmd.command =  in i2400m_dnload_init_signed()
1123 	cmd_buf->cmd.target_addr = 0;  in i2400m_dnload_init_signed()
1124 	cmd_buf->cmd.data_size = cpu_to_le32(sizeof(cmd_buf->cmd_pl));  in i2400m_dnload_init_signed()
1125 	memcpy(&cmd_buf->cmd_pl, bcf_hdr, sizeof(*bcf_hdr));  in i2400m_dnload_init_signed()
1126 	ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, sizeof(*cmd_buf),  in i2400m_dnload_init_signed()
1139  * (signed or non-signed).
1149 		d_printf(1, dev, "signed boot\n");  in i2400m_dnload_init()
1151 		if (result == -ERESTARTSYS)  in i2400m_dnload_init()
1154 			dev_err(dev, "firmware %s: signed boot download "  in i2400m_dnload_init()
1156 				i2400m->fw_name, result);  in i2400m_dnload_init()
1158 		/* non-signed boot process without pokes */  in i2400m_dnload_init()
1159 		d_printf(1, dev, "non-signed boot\n");  in i2400m_dnload_init()
1161 		if (result == -ERESTARTSYS)  in i2400m_dnload_init()
1164 			dev_err(dev, "firmware %s: non-signed download "  in i2400m_dnload_init()
1166 				i2400m->fw_name, result);  in i2400m_dnload_init()
1181  * file, and update i2400m->fw_bcf_hdr to point to them.
1193 	module_type = le32_to_cpu(bcf_hdr->module_type);  in i2400m_fw_hdr_check()
1194 	header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);  in i2400m_fw_hdr_check()
1195 	major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000)  in i2400m_fw_hdr_check()
1197 	minor_version = le32_to_cpu(bcf_hdr->header_version) & 0x0000ffff;  in i2400m_fw_hdr_check()
1198 	module_id = le32_to_cpu(bcf_hdr->module_id);  in i2400m_fw_hdr_check()
1199 	module_vendor = le32_to_cpu(bcf_hdr->module_vendor);  in i2400m_fw_hdr_check()
1200 	date = le32_to_cpu(bcf_hdr->date);  in i2400m_fw_hdr_check()
1201 	size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);  in i2400m_fw_hdr_check()
1204 		 "type:vendor:id 0x%x:%x:%x v%u.%u (%u/%u B) built %08x\n",  in i2400m_fw_hdr_check()
1205 		 i2400m->fw_name, index, offset,  in i2400m_fw_hdr_check()
1212 			"v%u.%u not supported\n",  in i2400m_fw_hdr_check()
1213 			i2400m->fw_name, index, offset,  in i2400m_fw_hdr_check()
1215 		return -EBADF;  in i2400m_fw_hdr_check()
1221 			i2400m->fw_name, index, offset,  in i2400m_fw_hdr_check()
1223 		return -EBADF;  in i2400m_fw_hdr_check()
1229 			i2400m->fw_name, index, offset, module_vendor);  in i2400m_fw_hdr_check()
1230 		return -EBADF;  in i2400m_fw_hdr_check()
1236 			 i2400m->fw_name, index, offset, date);  in i2400m_fw_hdr_check()
1250  * file, and update i2400m->fw_hdrs to point to them.
1267 		leftover = top - itr;  in i2400m_fw_check()
1268 		offset = itr - bcf;  in i2400m_fw_check()
1272 				i2400m->fw_name, leftover, offset);  in i2400m_fw_check()
1278 		header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);  in i2400m_fw_check()
1279 		size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);  in i2400m_fw_check()
1289 			/* +1 -> we need to account for the one we'll  in i2400m_fw_check()
1293 				(void **) &i2400m->fw_hdrs, &slots,  in i2400m_fw_check()
1294 				sizeof(i2400m->fw_hdrs[0]),  in i2400m_fw_check()
1299 		i2400m->fw_hdrs[used_slots] = bcf_hdr;  in i2400m_fw_check()
1304 			i2400m->fw_name);  in i2400m_fw_check()
1305 		result = -EBADF;  in i2400m_fw_check()
1323 	u32 barker = le32_to_cpu(i2400m->barker->data[0])  in i2400m_bcf_hdr_match()
1325 	u32 module_id = le32_to_cpu(bcf_hdr->module_id)  in i2400m_bcf_hdr_match()
1342 	u32 barker = le32_to_cpu(i2400m->barker->data[0]);  in i2400m_bcf_hdr_find()
1346 		bcf_hdr = i2400m->fw_hdrs[0];  in i2400m_bcf_hdr_find()
1347 		d_printf(1, dev, "using BCF header #%u/%08x for non-signed "  in i2400m_bcf_hdr_find()
1348 			 "barker\n", 0, le32_to_cpu(bcf_hdr->module_id));  in i2400m_bcf_hdr_find()
1351 	for (bcf_itr = i2400m->fw_hdrs; *bcf_itr != NULL; bcf_itr++, i++) {  in i2400m_bcf_hdr_find()
1354 			d_printf(1, dev, "hit on BCF hdr #%u/%08x\n",  in i2400m_bcf_hdr_find()
1355 				 i, le32_to_cpu(bcf_hdr->module_id));  in i2400m_bcf_hdr_find()
1358 			d_printf(1, dev, "miss on BCF hdr #%u/%08x\n",  in i2400m_bcf_hdr_find()
1359 				 i, le32_to_cpu(bcf_hdr->module_id));  in i2400m_bcf_hdr_find()
1377  * Note we only reinitialize boot-mode if the flags say so. Some hw
1379  * need to reinitialize the boot room, hence the flags modification.
1387 	int count = i2400m->bus_bm_retries;  in i2400m_fw_dnload()
1393 	i2400m->boot_mode = 1;  in i2400m_fw_dnload()
1396 	if (count-- == 0) {  in i2400m_fw_dnload()
1397 		ret = -ERESTARTSYS;  in i2400m_fw_dnload()
1419 	ret = -EBADF;  in i2400m_fw_dnload()
1425 	if (ret == -ERESTARTSYS)  in i2400m_fw_dnload()
1435 	bcf_size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);  in i2400m_fw_dnload()
1437 	if (ret == -ERESTARTSYS)  in i2400m_fw_dnload()
1441 			i2400m->fw_name, ret);  in i2400m_fw_dnload()
1446 	if (ret == -ERESTARTSYS)  in i2400m_fw_dnload()
1451 			i2400m->fw_name, ret);  in i2400m_fw_dnload()
1456 		 i2400m->fw_name);  in i2400m_fw_dnload()
1457 	i2400m->boot_mode = 0;  in i2400m_fw_dnload()
1485 	bcf = (void *) fw->data;  in i2400m_fw_bootstrap()
1486 	ret = i2400m_fw_check(i2400m, bcf, fw->size);  in i2400m_fw_bootstrap()
1488 		ret = i2400m_fw_dnload(i2400m, bcf, fw->size, flags);  in i2400m_fw_bootstrap()
1491 			i2400m->fw_name, ret);  in i2400m_fw_bootstrap()
1492 	kfree(i2400m->fw_hdrs);  in i2400m_fw_bootstrap()
1493 	i2400m->fw_hdrs = NULL;  in i2400m_fw_bootstrap()
1511 	release_firmware(i2400m_fw->fw);  in i2400m_fw_destroy()
1520 		kref_get(&i2400m_fw->kref);  in i2400m_fw_get()
1528 	kref_put(&i2400m_fw->kref, i2400m_fw_destroy);  in i2400m_fw_put()
1533  * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware
1545  * single-threade; all I/Os are synchronous.
1557 	ret = -ENODEV;  in i2400m_dev_bootstrap()
1558 	spin_lock(&i2400m->rx_lock);  in i2400m_dev_bootstrap()
1559 	i2400m_fw = i2400m_fw_get(i2400m->fw_cached);  in i2400m_dev_bootstrap()
1560 	spin_unlock(&i2400m->rx_lock);  in i2400m_dev_bootstrap()
1566 			 i2400m->fw_name);  in i2400m_dev_bootstrap()
1567 		ret = i2400m_fw_bootstrap(i2400m, i2400m_fw->fw, flags);  in i2400m_dev_bootstrap()
1573 	for (itr = 0, ret = -ENOENT; ; itr++) {  in i2400m_dev_bootstrap()
1574 		fw_name = i2400m->bus_fw_names[itr];  in i2400m_dev_bootstrap()
1586 		i2400m->fw_name = fw_name;  in i2400m_dev_bootstrap()
1591 		i2400m->fw_name = NULL;  in i2400m_dev_bootstrap()
1606 	/* if there is anything there, free it -- now, this'd be weird */  in i2400m_fw_cache()
1607 	spin_lock(&i2400m->rx_lock);  in i2400m_fw_cache()
1608 	i2400m_fw = i2400m->fw_cached;  in i2400m_fw_cache()
1609 	spin_unlock(&i2400m->rx_lock);  in i2400m_fw_cache()
1612 		WARN(1, "%s:%u: still cached fw still present?\n",  in i2400m_fw_cache()
1616 	if (i2400m->fw_name == NULL) {  in i2400m_fw_cache()
1625 	kref_init(&i2400m_fw->kref);  in i2400m_fw_cache()
1626 	result = request_firmware(&i2400m_fw->fw, i2400m->fw_name, dev);  in i2400m_fw_cache()
1629 			i2400m->fw_name, result);  in i2400m_fw_cache()
1633 		dev_info(dev, "firmware %s: cached\n", i2400m->fw_name);  in i2400m_fw_cache()
1635 	spin_lock(&i2400m->rx_lock);  in i2400m_fw_cache()
1636 	i2400m->fw_cached = i2400m_fw;  in i2400m_fw_cache()
1637 	spin_unlock(&i2400m->rx_lock);  in i2400m_fw_cache()
1645 	spin_lock(&i2400m->rx_lock);  in i2400m_fw_uncache()
1646 	i2400m_fw = i2400m->fw_cached;  in i2400m_fw_uncache()
1647 	i2400m->fw_cached = NULL;  in i2400m_fw_uncache()
1648 	spin_unlock(&i2400m->rx_lock);  in i2400m_fw_uncache()