bes2600: drop kernel_write() persistence from factory cali save

Following the conversion of the factory-calibration READ path to
request_firmware() (earlier in this series), the factory-calibration
WRITE path in factory_section_write_file() was still using
filp_open(O_CREAT | O_TRUNC | O_RDWR) + kernel_write() to persist
updated calibration data back to FACTORY_PATH
(default /lib/firmware/bes2600/bes2600_factory.txt).

Writing to files under /lib/firmware/ from kernel code is a
standing upstream blocker for staging and for drivers/net/wireless/
submission generally:

 - filp_open()/kernel_write() bypass the firmware-class abstraction,
   the LSM framework, and user/group/mode enforcement that governs
   the firmware search paths. They have been repeatedly called out
   in staging-prep reviews.
 - The kernel runs with capabilities that userspace does not (CAP_
   DAC_OVERRIDE effectively); quietly rewriting firmware blobs that
   userspace owns is a surprise contract.
 - A module unload / reboot immediately after the write races the
   writeback and can leave a truncated calibration file on disk.

Remove factory_section_write_file() and its two call sites in
bes2600_wifi_cali_table_save(). The in-memory factory_save_p
remains authoritative for the duration of the session: the WSM
command handlers that triggered this path (power-cali-table,
freq-cali, efuse-flag, power-cali-flag) already update the live
struct factory_t, and reads served from file_buffer pick up the
rebuilt serialised form immediately. On the next probe the
firmware-class file is re-read read-only via request_firmware(),
as set up by the earlier patch.

If cross-reboot persistence of runtime-updated calibration becomes
a requirement, the expected route is a userspace-visible dump
interface -- a read-only debugfs file exporting the serialised
blob, or an nl80211 vendor command -- that lets userspace copy the
values to a chosen location under its own privileges. Such a
facility can land as a follow-up without touching the core driver
write path again.

Signed-off-by: Markus Fritsche <fritsche.markus@gmail.com>

bes2600/Makefile

@@ -28,6 +28,7 @@ CONFIG_BES2600_WIFI_BOOT_ON             ?= y
 CONFIG_BES2600_BT_BOOT_ON               ?= n
 
 BES2600_GPIO_WAKEUP_AP                  ?= n
+BES2600_WRITE_DPD_TO_FILE               ?= n
 BES2600_TX_MORE_RETRY                   ?= n
 
 # bes evb
@@ -92,6 +93,12 @@ ccflags-y += -DBES_UNIFIED_PM
 ccflags-y += -DBES_SDIO_OPTIMIZED_LEN
 ccflags-y += -DBES2600_HOST_TIMESTAMP_DEBUG
 
+ifeq ($(BES2600_WRITE_DPD_TO_FILE),y)
+BES2600_DPD_PATH ?= /data/cfg/bes2600_dpd.bin
+BES2600_DEFAULT_DPD_PATH ?= /lib/firmware/bes2600_dpd.bin
+BES2600_DPD_GOLDEN_PATH ?= /data/cfg/bes2600_dpd_golden.bin
+endif
+
 ifeq ($(BES2600_DUMP_FW_DPD_LOG),y)
 BES2600_DPD_LOG_PATH ?= /data/applog/bes2600_dpd_log.log
 endif
@@ -128,6 +135,9 @@ ccflags-y += $(call boolen_flag,BSS_LOSS_CHECK,y)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_PATH)
 ccflags-y += $(call string_flag,BES2600_LOAD_FW_TOOL_DEVICE)
 ccflags-y += $(call string_flag,BES2600_DRV_VERSION)
+ccflags-y += $(call string_flag,BES2600_DPD_PATH)
+ccflags-y += $(call string_flag,BES2600_DEFAULT_DPD_PATH)
+ccflags-y += $(call string_flag,BES2600_DPD_GOLDEN_PATH)
 
 ccflags-y += $(call boolen_flag,BES2600_INDEPENDENT_EVB,y)
 ccflags-y += $(call boolen_flag,BES2600_INTEGRATED_MODULE_V1,y)
@@ -149,6 +159,8 @@ ccflags-y += $(call boolen_flag,FACTORY_SAVE_MULTI_PATH,y)
 ccflags-y += $(call boolen_flag,FACTORY_CRC_CHECK,y)
 
 ccflags-y += $(call boolen_flag,BES2600_GPIO_WAKEUP_AP,y)
+ccflags-y += $(call boolen_flag,BES2600_WRITE_DPD_TO_FILE,y)
+
 ccflags-y += $(call boolen_flag,BES2600_DUMP_FW_DPD_LOG,y)
 ccflags-y += $(call string_flag,BES2600_DPD_LOG_PATH)
 

bes2600/bes2600_factory.c

@@ -179,34 +179,6 @@ static int factory_section_read_file(char *path, void *buffer)
 	return ret;
 }
 
-/**
- * factory_section_write_file - Write data of specified length to file
- * @path:	path of the file
- * @buffer:	storage of write data
- * @size:	length of data to write
- *
- * Return: length on success, negative error code otherwise.
- */
-static int factory_section_write_file(char *path, void *buffer, int size)
-{
-	int ret = 0;
-	struct file *fp;
-
-	bes_devel("writing %s \n", path);
-
-	fp = filp_open(path, O_TRUNC | O_CREAT | O_RDWR, S_IRUSR);
-	if (IS_ERR(fp)) {
-		bes_devel("BES2600 : can't open %s\n",path);
-		return -1;
-	}
-
-	ret = kernel_write(fp, buffer, size, &fp->f_pos);
-
-	filp_close(fp,NULL);
-
-	return ret;
-}
-
 static inline int factory_parse(uint8_t *source_buf, struct factory_t *factory)
 {
 	int ret = 0;
@@ -898,9 +870,22 @@ static inline int factory_build(uint8_t *dest_buf, struct factory_t *factory)
 #endif
 }
 
+/*
+ * Rebuild the serialised calibration blob in file_buffer from the live
+ * in-memory factory_save_p. Previously this function also persisted the
+ * blob back to FACTORY_PATH via filp_open(O_CREAT) + kernel_write(); that
+ * is not acceptable in mainline, so the persistence step has been removed.
+ *
+ * The in-memory factory_save_p remains authoritative for the duration of
+ * the session; on the next probe the firmware-class file is read back
+ * read-only via request_firmware(). If cross-reboot persistence of runtime
+ * calibration updates becomes a requirement, the expected route is a
+ * userspace-facing dump interface (debugfs read-only blob, or nl80211
+ * vendor command) that lets userspace read the serialised form and store
+ * it under its own privileges.
+ */
 static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *factory_save_p)
 {
-	int ret = 0;
 	int w_size;
 	u32 crc_len = sizeof(factory_data_t);
 #ifndef STANDARD_FACTORY_EFUSE_FLAG
@@ -909,13 +894,11 @@ static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *facto
 
 	bes_devel("enter %s\n", __func__);
 
-	if (!file_buffer) {
+	if (!file_buffer)
 		return -ENOMEM;
-	}
 
-	if (!factory_save_p) {
+	if (!factory_save_p)
 		return -ENOENT;
-	}
 
 	/* All initialized to space */
 	memset(file_buffer, 32, FACTORY_MAX_SIZE);
@@ -927,22 +910,10 @@ static int bes2600_wifi_cali_table_save(u8 *file_buffer, struct factory_t *facto
 	w_size = factory_build(file_buffer, factory_save_p);
 
 	if (w_size < 0 || w_size > FACTORY_MAX_SIZE) {
-		bes_err("%s: build failed! ret = %d.", __func__, ret);
+		bes_err("%s: build failed! w_size = %d.", __func__, w_size);
 		return -ETXTBSY;
 	}
 
-#ifdef FACTORY_SAVE_MULTI_PATH
-	/* avoid trailing characters '\0' */
-	file_buffer[w_size] = 32;
-	ret = factory_section_write_file(FACTORY_PATH, file_buffer, FACTORY_MAX_SIZE);
-#else
-	ret = factory_section_write_file(FACTORY_PATH, file_buffer, w_size);
-#endif
-	if(ret < 0) {
-		bes_err("%s: write failed! ret = %d.", __func__, ret);
-		return ret;
-	}
-
 	return 0;
 }
 

bes2600/bes_chardev.c

@@ -63,6 +63,9 @@ struct bes_cdev {
 	struct delayed_work probe_timeout_work;
 	enum bus_probe_state bus_probe;
 	struct work_struct wifi_force_close_work;
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	int no_dpd;
+#endif
 	enum pend_read_op read_flag;
 	enum wakeup_event wakeup_by_event;	/* used to filter unwanted event wakeup reason report */
 	u16 wakeup_state; /* for userspace check wakeup reason */
@@ -82,6 +85,9 @@ struct bes2600_op_map {
 
 static struct bes_cdev bes2600_cdev;
 module_param_named(fw_type, bes2600_cdev.fw_type, int, 0644);
+#ifdef BES2600_WRITE_DPD_TO_FILE
+module_param_named(no_dpd, bes2600_cdev.no_dpd, int, 0644);
+#endif
 
 extern int bes2600_register_net_dev(struct sbus_priv *bus_priv);
 extern int bes2600_unregister_net_dev(struct sbus_priv *bus_priv);
@@ -263,8 +269,137 @@ static int bes2600_chrdev_check_system_close_internal(void)
 
 
 
+#ifdef BES2600_WRITE_DPD_TO_FILE
+static int bes2600_chrdev_write_dpd_data_to_file(const char *path, void *buffer, int size)
+{
+	int ret = 0;
+	struct file *fp;
+
+	if (buffer == NULL || size == 0)
+		return 0;
+
+	fp = filp_open(path, O_TRUNC | O_CREAT | O_RDWR, S_IRUSR);
+	if (IS_ERR(fp)) {
+		bes_err("BES2600 : can't open %s\n",path);
+		return -1;
+	}
+
+	ret = kernel_write(fp, buffer, size, &fp->f_pos);
+	if (ret < 0)
+		bes_err("write dpd to file failed\n");
+
+	filp_close(fp,NULL);
+
+	bes_devel("write dpd to %s\n", path);
+
+	return ret;
+}
+
+static bool bes2600_chrdev_dpd_is_vaild(u8 *dpd_data)
+{
+	u32 cal_crc = 0;
+	u32 dpd_crc = le32_to_cpup((__le32 *)(dpd_data));
+	u32 dpd_ver = le32_to_cpup((__le32 *)(dpd_data + DPD_VERSION_OFFSET));
+
+	/* check version */
+	if (dpd_ver < DPD_CUR_VERSION)
+		return false;
+
+	cal_crc ^= 0xffffffffL;
+	cal_crc = crc32_le(cal_crc, dpd_data + 4, DPD_BIN_SIZE - 4);
+	cal_crc ^= 0xffffffffL;
+
+	/* check if the dpd data is valid */
+	if (cal_crc != dpd_crc) {
+		bes_err(
+			"bes2600 dpd data from file check failed, calc_crc:0x%08x dpd_crc: 0x%08x\n",
+			cal_crc, dpd_crc);
+		return false;
+	}
+
+	return true;
+}
+
+static int bes2600_chrdev_read_and_check_dpd_data(const char *file, u8 **data, u32 *len)
+{
+	int ret = 0;
+	u8* read_data = NULL;
+	struct file *fp;
+
+	/* open file */
+	fp = filp_open(file, O_RDONLY, 0);//S_IRUSR
+	if (IS_ERR(fp)) {
+		bes_devel("BES2600 : can't open %s\n",file);
+		return -1;
+	}
+
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	if (fp->f_inode->i_size != DPD_BIN_FILE_SIZE) {
+		bes_err(
+			"bes2600 dpd data file size check failed, read_size: %lld file_size: %d\n",
+			fp->f_inode->i_size, DPD_BIN_FILE_SIZE);
+		filp_close(fp, NULL);
+		return -1;
+	}
+#endif
+
+	/* allocate memory for storing reading data */
+	read_data = kmalloc(fp->f_inode->i_size, GFP_KERNEL);
+	if (read_data == NULL) {
+		bes_devel("%s alloc mem fail\n", __func__);
+		goto err1;
+	}
+
+	/* read data  from file */
+	ret = kernel_read(fp, read_data, fp->f_inode->i_size, &fp->f_pos);
+	if (ret < DPD_BIN_SIZE) {
+		bes_err("%s read fail, ret=%d\n", __func__, ret);
+		goto err2;
+	}
+
+	/* check dpd version and crc */
+	if (!bes2600_chrdev_dpd_is_vaild(read_data))
+		goto err2;
+
+	/* close file */
+	filp_close(fp, NULL);
+
+	/* copy data to external */
+	*data = read_data;
+	*len = DPD_BIN_SIZE;;
+
+	/* output debug information */
+	bes_devel("read dpd data from %s\n", file);
+
+	return 0;
+
+err2:
+	kfree(read_data);
+err1:
+	filp_close(fp, NULL);
+	*data = NULL;
+	*len = 0;
+	return -1;
+}
+#endif
+
 const u8* bes2600_chrdev_get_dpd_data(u32 *len)
 {
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	if (!bes2600_cdev.dpd_calied && bes2600_cdev.no_dpd) {
+		/* read dpd data from file that stores factory dpd calibration data */
+		if ((bes2600_chrdev_read_and_check_dpd_data(BES2600_DPD_GOLDEN_PATH,
+		   	&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0) &&
+		   (bes2600_chrdev_read_and_check_dpd_data(BES2600_DEFAULT_DPD_PATH,
+			&bes2600_cdev.dpd_data, &bes2600_cdev.dpd_len) < 0)) {
+			bes_err("%s read dpd data fail\n", __func__);
+			return NULL;
+		} else {
+			bes2600_cdev.dpd_calied = true;
+		}
+	}
+#endif
+
 	if (!bes2600_cdev.dpd_calied)
 		return NULL;
 	if (len)
@@ -325,6 +460,14 @@ int bes2600_chrdev_update_dpd_data(void)
 	}
 	spin_unlock(&bes2600_cdev.status_lock);
 
+#ifdef BES2600_WRITE_DPD_TO_FILE
+	/* write dpd data to file */
+	memset(bes2600_cdev.dpd_data + DPD_BIN_SIZE, 0, DPD_BIN_FILE_SIZE - DPD_BIN_SIZE);
+	bes2600_chrdev_write_dpd_data_to_file(BES2600_DPD_PATH,
+		bes2600_cdev.dpd_data, DPD_BIN_FILE_SIZE);
+#endif
+
+
 	return 0;
 }