Commit | Line | Data |
---|---|---|
00c4da27 CL |
1 | /* |
2 | * Atheros CARL9170 driver | |
3 | * | |
4 | * firmware parser | |
5 | * | |
6 | * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; see the file COPYING. If not, see | |
20 | * http://www.gnu.org/licenses/. | |
21 | */ | |
22 | ||
23 | #include <linux/kernel.h> | |
24 | #include <linux/firmware.h> | |
25 | #include <linux/crc32.h> | |
26 | #include "carl9170.h" | |
27 | #include "fwcmd.h" | |
28 | #include "version.h" | |
29 | ||
30 | #define MAKE_STR(symbol) #symbol | |
31 | #define TO_STR(symbol) MAKE_STR(symbol) | |
32 | #define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER) | |
33 | MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT); | |
34 | ||
35 | static const u8 otus_magic[4] = { OTUS_MAGIC }; | |
36 | ||
37 | static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4], | |
38 | const unsigned int len, const u8 compatible_revision) | |
39 | { | |
40 | const struct carl9170fw_desc_head *iter; | |
41 | ||
42 | carl9170fw_for_each_hdr(iter, ar->fw.desc) { | |
43 | if (carl9170fw_desc_cmp(iter, descid, len, | |
44 | compatible_revision)) | |
45 | return (void *)iter; | |
46 | } | |
47 | ||
48 | /* needed to find the LAST desc */ | |
49 | if (carl9170fw_desc_cmp(iter, descid, len, | |
50 | compatible_revision)) | |
51 | return (void *)iter; | |
52 | ||
53 | return NULL; | |
54 | } | |
55 | ||
56 | static int carl9170_fw_verify_descs(struct ar9170 *ar, | |
57 | const struct carl9170fw_desc_head *head, unsigned int max_len) | |
58 | { | |
59 | const struct carl9170fw_desc_head *pos; | |
60 | unsigned long pos_addr, end_addr; | |
61 | unsigned int pos_length; | |
62 | ||
63 | if (max_len < sizeof(*pos)) | |
64 | return -ENODATA; | |
65 | ||
66 | max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len); | |
67 | ||
68 | pos = head; | |
69 | pos_addr = (unsigned long) pos; | |
70 | end_addr = pos_addr + max_len; | |
71 | ||
72 | while (pos_addr < end_addr) { | |
73 | if (pos_addr + sizeof(*head) > end_addr) | |
74 | return -E2BIG; | |
75 | ||
76 | pos_length = le16_to_cpu(pos->length); | |
77 | ||
78 | if (pos_length < sizeof(*head)) | |
79 | return -EBADMSG; | |
80 | ||
81 | if (pos_length > max_len) | |
82 | return -EOVERFLOW; | |
83 | ||
84 | if (pos_addr + pos_length > end_addr) | |
85 | return -EMSGSIZE; | |
86 | ||
87 | if (carl9170fw_desc_cmp(pos, LAST_MAGIC, | |
88 | CARL9170FW_LAST_DESC_SIZE, | |
89 | CARL9170FW_LAST_DESC_CUR_VER)) | |
90 | return 0; | |
91 | ||
92 | pos_addr += pos_length; | |
93 | pos = (void *)pos_addr; | |
94 | max_len -= pos_length; | |
95 | } | |
96 | return -EINVAL; | |
97 | } | |
98 | ||
99 | static void carl9170_fw_info(struct ar9170 *ar) | |
100 | { | |
101 | const struct carl9170fw_motd_desc *motd_desc; | |
102 | unsigned int str_ver_len; | |
103 | u32 fw_date; | |
104 | ||
105 | dev_info(&ar->udev->dev, "driver API: %s 2%03d-%02d-%02d [%d-%d]\n", | |
106 | CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR, | |
107 | CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY, | |
108 | CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER); | |
109 | ||
110 | motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC, | |
111 | sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER); | |
112 | ||
113 | if (motd_desc) { | |
114 | str_ver_len = strnlen(motd_desc->release, | |
115 | CARL9170FW_MOTD_RELEASE_LEN); | |
116 | ||
117 | fw_date = le32_to_cpu(motd_desc->fw_year_month_day); | |
118 | ||
119 | dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n", | |
120 | str_ver_len, motd_desc->release, | |
121 | CARL9170FW_GET_YEAR(fw_date), | |
122 | CARL9170FW_GET_MONTH(fw_date), | |
123 | CARL9170FW_GET_DAY(fw_date)); | |
124 | ||
125 | strlcpy(ar->hw->wiphy->fw_version, motd_desc->release, | |
126 | sizeof(ar->hw->wiphy->fw_version)); | |
127 | } | |
128 | } | |
129 | ||
130 | static bool valid_dma_addr(const u32 address) | |
131 | { | |
132 | if (address >= AR9170_SRAM_OFFSET && | |
133 | address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE)) | |
134 | return true; | |
135 | ||
136 | return false; | |
137 | } | |
138 | ||
139 | static bool valid_cpu_addr(const u32 address) | |
140 | { | |
141 | if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET && | |
142 | address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE))) | |
143 | return true; | |
144 | ||
145 | return false; | |
146 | } | |
147 | ||
148 | static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len) | |
149 | { | |
150 | const struct carl9170fw_otus_desc *otus_desc; | |
151 | const struct carl9170fw_chk_desc *chk_desc; | |
152 | const struct carl9170fw_last_desc *last_desc; | |
153 | ||
154 | last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC, | |
155 | sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER); | |
156 | if (!last_desc) | |
157 | return -EINVAL; | |
158 | ||
159 | otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC, | |
160 | sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER); | |
161 | if (!otus_desc) { | |
162 | dev_err(&ar->udev->dev, "failed to find compatible firmware " | |
163 | "descriptor.\n"); | |
164 | return -ENODATA; | |
165 | } | |
166 | ||
167 | chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC, | |
168 | sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER); | |
169 | ||
170 | if (chk_desc) { | |
171 | unsigned long fin, diff; | |
172 | unsigned int dsc_len; | |
173 | u32 crc32; | |
174 | ||
175 | dsc_len = min_t(unsigned int, len, | |
176 | (unsigned long)chk_desc - (unsigned long)otus_desc); | |
177 | ||
178 | fin = (unsigned long) last_desc + sizeof(*last_desc); | |
179 | diff = fin - (unsigned long) otus_desc; | |
180 | ||
181 | if (diff < len) | |
182 | len -= diff; | |
183 | ||
184 | if (len < 256) | |
185 | return -EIO; | |
186 | ||
187 | crc32 = crc32_le(~0, data, len); | |
188 | if (cpu_to_le32(crc32) != chk_desc->fw_crc32) { | |
189 | dev_err(&ar->udev->dev, "fw checksum test failed.\n"); | |
190 | return -ENOEXEC; | |
191 | } | |
192 | ||
193 | crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len); | |
194 | if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) { | |
195 | dev_err(&ar->udev->dev, "descriptor check failed.\n"); | |
196 | return -EINVAL; | |
197 | } | |
198 | } else { | |
199 | dev_warn(&ar->udev->dev, "Unprotected firmware image.\n"); | |
200 | } | |
201 | ||
202 | #define SUPP(feat) \ | |
203 | (carl9170fw_supports(otus_desc->feature_set, feat)) | |
204 | ||
205 | if (!SUPP(CARL9170FW_DUMMY_FEATURE)) { | |
206 | dev_err(&ar->udev->dev, "invalid firmware descriptor " | |
207 | "format detected.\n"); | |
208 | return -EINVAL; | |
209 | } | |
210 | ||
211 | ar->fw.api_version = otus_desc->api_ver; | |
212 | ||
213 | if (ar->fw.api_version < CARL9170FW_API_MIN_VER || | |
214 | ar->fw.api_version > CARL9170FW_API_MAX_VER) { | |
215 | dev_err(&ar->udev->dev, "unsupported firmware api version.\n"); | |
216 | return -EINVAL; | |
217 | } | |
218 | ||
219 | if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) || | |
220 | !SUPP(CARL9170FW_HANDLE_BACK_REQ)) { | |
221 | dev_err(&ar->udev->dev, "firmware does support " | |
222 | "mandatory features.\n"); | |
223 | return -ECANCELED; | |
224 | } | |
225 | ||
226 | if (ilog2(le32_to_cpu(otus_desc->feature_set)) >= | |
227 | __CARL9170FW_FEATURE_NUM) { | |
228 | dev_warn(&ar->udev->dev, "driver does not support all " | |
229 | "firmware features.\n"); | |
230 | } | |
231 | ||
232 | if (!SUPP(CARL9170FW_COMMAND_CAM)) { | |
233 | dev_info(&ar->udev->dev, "crypto offloading is disabled " | |
234 | "by firmware.\n"); | |
235 | ar->disable_offload = true; | |
236 | } | |
237 | ||
238 | if (SUPP(CARL9170FW_PSM)) | |
239 | ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS; | |
240 | ||
241 | if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) { | |
242 | dev_err(&ar->udev->dev, "firmware does not provide " | |
243 | "mandatory interfaces.\n"); | |
244 | return -EINVAL; | |
245 | } | |
246 | ||
247 | if (SUPP(CARL9170FW_MINIBOOT)) | |
248 | ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size); | |
249 | else | |
250 | ar->fw.offset = 0; | |
251 | ||
252 | if (SUPP(CARL9170FW_USB_DOWN_STREAM)) { | |
253 | ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream); | |
254 | ar->fw.tx_stream = true; | |
255 | } | |
256 | ||
257 | if (SUPP(CARL9170FW_USB_UP_STREAM)) | |
258 | ar->fw.rx_stream = true; | |
259 | ||
5c895691 CL |
260 | if (SUPP(CARL9170FW_RX_FILTER)) { |
261 | ar->fw.rx_filter = true; | |
262 | ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL | | |
263 | FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS | | |
264 | FIF_PROMISC_IN_BSS; | |
265 | } | |
266 | ||
00c4da27 CL |
267 | ar->fw.vif_num = otus_desc->vif_num; |
268 | ar->fw.cmd_bufs = otus_desc->cmd_bufs; | |
269 | ar->fw.address = le32_to_cpu(otus_desc->fw_address); | |
270 | ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len); | |
271 | ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe); | |
272 | atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks); | |
273 | ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len); | |
274 | ||
275 | if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num || | |
276 | ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs || | |
277 | ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 || | |
278 | ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 || | |
279 | !valid_cpu_addr(ar->fw.address)) { | |
280 | dev_err(&ar->udev->dev, "firmware shows obvious signs of " | |
281 | "malicious tampering.\n"); | |
282 | return -EINVAL; | |
283 | } | |
284 | ||
285 | ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr); | |
286 | ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len); | |
287 | ||
288 | if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >= | |
289 | AR9170_MAC_BCN_LENGTH_MAX) { | |
290 | ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); | |
291 | ||
292 | if (SUPP(CARL9170FW_WLANTX_CAB)) { | |
293 | ar->hw->wiphy->interface_modes |= | |
c426ee24 JB |
294 | BIT(NL80211_IFTYPE_AP) | |
295 | BIT(NL80211_IFTYPE_P2P_GO); | |
00c4da27 CL |
296 | } |
297 | } | |
298 | ||
299 | #undef SUPPORTED | |
300 | return 0; | |
301 | } | |
302 | ||
303 | static struct carl9170fw_desc_head * | |
304 | carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len) | |
305 | ||
306 | { | |
307 | int scan = 0, found = 0; | |
308 | ||
309 | if (!carl9170fw_size_check(len)) { | |
310 | dev_err(&ar->udev->dev, "firmware size is out of bound.\n"); | |
311 | return NULL; | |
312 | } | |
313 | ||
314 | while (scan < len - sizeof(struct carl9170fw_desc_head)) { | |
315 | if (fw_data[scan++] == otus_magic[found]) | |
316 | found++; | |
317 | else | |
318 | found = 0; | |
319 | ||
320 | if (scan >= len) | |
321 | break; | |
322 | ||
323 | if (found == sizeof(otus_magic)) | |
324 | break; | |
325 | } | |
326 | ||
327 | if (found != sizeof(otus_magic)) | |
328 | return NULL; | |
329 | ||
330 | return (void *)&fw_data[scan - found]; | |
331 | } | |
332 | ||
333 | int carl9170_fw_fix_eeprom(struct ar9170 *ar) | |
334 | { | |
335 | const struct carl9170fw_fix_desc *fix_desc = NULL; | |
336 | unsigned int i, n, off; | |
337 | u32 *data = (void *)&ar->eeprom; | |
338 | ||
339 | fix_desc = carl9170_fw_find_desc(ar, FIX_MAGIC, | |
340 | sizeof(*fix_desc), CARL9170FW_FIX_DESC_CUR_VER); | |
341 | ||
342 | if (!fix_desc) | |
343 | return 0; | |
344 | ||
345 | n = (le16_to_cpu(fix_desc->head.length) - sizeof(*fix_desc)) / | |
346 | sizeof(struct carl9170fw_fix_entry); | |
347 | ||
348 | for (i = 0; i < n; i++) { | |
349 | off = le32_to_cpu(fix_desc->data[i].address) - | |
350 | AR9170_EEPROM_START; | |
351 | ||
352 | if (off >= sizeof(struct ar9170_eeprom) || (off & 3)) { | |
353 | dev_err(&ar->udev->dev, "Skip invalid entry %d\n", i); | |
354 | continue; | |
355 | } | |
356 | ||
357 | data[off / sizeof(*data)] &= | |
358 | le32_to_cpu(fix_desc->data[i].mask); | |
359 | data[off / sizeof(*data)] |= | |
360 | le32_to_cpu(fix_desc->data[i].value); | |
361 | } | |
362 | ||
363 | return 0; | |
364 | } | |
365 | ||
366 | int carl9170_parse_firmware(struct ar9170 *ar) | |
367 | { | |
368 | const struct carl9170fw_desc_head *fw_desc = NULL; | |
369 | const struct firmware *fw = ar->fw.fw; | |
370 | unsigned long header_offset = 0; | |
371 | int err; | |
372 | ||
373 | if (WARN_ON(!fw)) | |
374 | return -EINVAL; | |
375 | ||
376 | fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size); | |
377 | ||
378 | if (!fw_desc) { | |
379 | dev_err(&ar->udev->dev, "unsupported firmware.\n"); | |
380 | return -ENODATA; | |
381 | } | |
382 | ||
383 | header_offset = (unsigned long)fw_desc - (unsigned long)fw->data; | |
384 | ||
385 | err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset); | |
386 | if (err) { | |
387 | dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err); | |
388 | return err; | |
389 | } | |
390 | ||
391 | ar->fw.desc = fw_desc; | |
392 | ||
393 | carl9170_fw_info(ar); | |
394 | ||
395 | err = carl9170_fw(ar, fw->data, fw->size); | |
396 | if (err) { | |
397 | dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n", | |
398 | err); | |
399 | return err; | |
400 | } | |
401 | ||
402 | return 0; | |
403 | } |