Commit | Line | Data |
---|---|---|
00c4da27 CL |
1 | /* |
2 | * Atheros CARL9170 driver | |
3 | * | |
4 | * firmware parser | |
5 | * | |
6 | * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; see the file COPYING. If not, see | |
20 | * http://www.gnu.org/licenses/. | |
21 | */ | |
22 | ||
23 | #include <linux/kernel.h> | |
24 | #include <linux/firmware.h> | |
25 | #include <linux/crc32.h> | |
9d9779e7 | 26 | #include <linux/module.h> |
00c4da27 CL |
27 | #include "carl9170.h" |
28 | #include "fwcmd.h" | |
29 | #include "version.h" | |
30 | ||
31 | #define MAKE_STR(symbol) #symbol | |
32 | #define TO_STR(symbol) MAKE_STR(symbol) | |
33 | #define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER) | |
34 | MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT); | |
35 | ||
36 | static const u8 otus_magic[4] = { OTUS_MAGIC }; | |
37 | ||
38 | static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4], | |
39 | const unsigned int len, const u8 compatible_revision) | |
40 | { | |
41 | const struct carl9170fw_desc_head *iter; | |
42 | ||
43 | carl9170fw_for_each_hdr(iter, ar->fw.desc) { | |
44 | if (carl9170fw_desc_cmp(iter, descid, len, | |
45 | compatible_revision)) | |
46 | return (void *)iter; | |
47 | } | |
48 | ||
49 | /* needed to find the LAST desc */ | |
50 | if (carl9170fw_desc_cmp(iter, descid, len, | |
51 | compatible_revision)) | |
52 | return (void *)iter; | |
53 | ||
54 | return NULL; | |
55 | } | |
56 | ||
57 | static int carl9170_fw_verify_descs(struct ar9170 *ar, | |
58 | const struct carl9170fw_desc_head *head, unsigned int max_len) | |
59 | { | |
60 | const struct carl9170fw_desc_head *pos; | |
61 | unsigned long pos_addr, end_addr; | |
62 | unsigned int pos_length; | |
63 | ||
64 | if (max_len < sizeof(*pos)) | |
65 | return -ENODATA; | |
66 | ||
67 | max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len); | |
68 | ||
69 | pos = head; | |
70 | pos_addr = (unsigned long) pos; | |
71 | end_addr = pos_addr + max_len; | |
72 | ||
73 | while (pos_addr < end_addr) { | |
74 | if (pos_addr + sizeof(*head) > end_addr) | |
75 | return -E2BIG; | |
76 | ||
77 | pos_length = le16_to_cpu(pos->length); | |
78 | ||
79 | if (pos_length < sizeof(*head)) | |
80 | return -EBADMSG; | |
81 | ||
82 | if (pos_length > max_len) | |
83 | return -EOVERFLOW; | |
84 | ||
85 | if (pos_addr + pos_length > end_addr) | |
86 | return -EMSGSIZE; | |
87 | ||
88 | if (carl9170fw_desc_cmp(pos, LAST_MAGIC, | |
89 | CARL9170FW_LAST_DESC_SIZE, | |
90 | CARL9170FW_LAST_DESC_CUR_VER)) | |
91 | return 0; | |
92 | ||
93 | pos_addr += pos_length; | |
94 | pos = (void *)pos_addr; | |
95 | max_len -= pos_length; | |
96 | } | |
97 | return -EINVAL; | |
98 | } | |
99 | ||
100 | static void carl9170_fw_info(struct ar9170 *ar) | |
101 | { | |
102 | const struct carl9170fw_motd_desc *motd_desc; | |
103 | unsigned int str_ver_len; | |
104 | u32 fw_date; | |
105 | ||
106 | dev_info(&ar->udev->dev, "driver API: %s 2%03d-%02d-%02d [%d-%d]\n", | |
107 | CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR, | |
108 | CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY, | |
109 | CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER); | |
110 | ||
111 | motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC, | |
112 | sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER); | |
113 | ||
114 | if (motd_desc) { | |
115 | str_ver_len = strnlen(motd_desc->release, | |
116 | CARL9170FW_MOTD_RELEASE_LEN); | |
117 | ||
118 | fw_date = le32_to_cpu(motd_desc->fw_year_month_day); | |
119 | ||
120 | dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n", | |
121 | str_ver_len, motd_desc->release, | |
122 | CARL9170FW_GET_YEAR(fw_date), | |
123 | CARL9170FW_GET_MONTH(fw_date), | |
124 | CARL9170FW_GET_DAY(fw_date)); | |
125 | ||
126 | strlcpy(ar->hw->wiphy->fw_version, motd_desc->release, | |
127 | sizeof(ar->hw->wiphy->fw_version)); | |
128 | } | |
129 | } | |
130 | ||
131 | static bool valid_dma_addr(const u32 address) | |
132 | { | |
133 | if (address >= AR9170_SRAM_OFFSET && | |
134 | address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE)) | |
135 | return true; | |
136 | ||
137 | return false; | |
138 | } | |
139 | ||
140 | static bool valid_cpu_addr(const u32 address) | |
141 | { | |
142 | if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET && | |
143 | address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE))) | |
144 | return true; | |
145 | ||
146 | return false; | |
147 | } | |
148 | ||
149 | static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len) | |
150 | { | |
151 | const struct carl9170fw_otus_desc *otus_desc; | |
152 | const struct carl9170fw_chk_desc *chk_desc; | |
153 | const struct carl9170fw_last_desc *last_desc; | |
aa32452d | 154 | const struct carl9170fw_txsq_desc *txsq_desc; |
df64962f | 155 | u16 if_comb_types; |
00c4da27 CL |
156 | |
157 | last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC, | |
158 | sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER); | |
159 | if (!last_desc) | |
160 | return -EINVAL; | |
161 | ||
162 | otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC, | |
163 | sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER); | |
164 | if (!otus_desc) { | |
165 | dev_err(&ar->udev->dev, "failed to find compatible firmware " | |
166 | "descriptor.\n"); | |
167 | return -ENODATA; | |
168 | } | |
169 | ||
170 | chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC, | |
171 | sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER); | |
172 | ||
173 | if (chk_desc) { | |
174 | unsigned long fin, diff; | |
175 | unsigned int dsc_len; | |
176 | u32 crc32; | |
177 | ||
178 | dsc_len = min_t(unsigned int, len, | |
179 | (unsigned long)chk_desc - (unsigned long)otus_desc); | |
180 | ||
181 | fin = (unsigned long) last_desc + sizeof(*last_desc); | |
182 | diff = fin - (unsigned long) otus_desc; | |
183 | ||
184 | if (diff < len) | |
185 | len -= diff; | |
186 | ||
187 | if (len < 256) | |
188 | return -EIO; | |
189 | ||
190 | crc32 = crc32_le(~0, data, len); | |
191 | if (cpu_to_le32(crc32) != chk_desc->fw_crc32) { | |
192 | dev_err(&ar->udev->dev, "fw checksum test failed.\n"); | |
193 | return -ENOEXEC; | |
194 | } | |
195 | ||
196 | crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len); | |
197 | if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) { | |
198 | dev_err(&ar->udev->dev, "descriptor check failed.\n"); | |
199 | return -EINVAL; | |
200 | } | |
201 | } else { | |
202 | dev_warn(&ar->udev->dev, "Unprotected firmware image.\n"); | |
203 | } | |
204 | ||
205 | #define SUPP(feat) \ | |
206 | (carl9170fw_supports(otus_desc->feature_set, feat)) | |
207 | ||
208 | if (!SUPP(CARL9170FW_DUMMY_FEATURE)) { | |
209 | dev_err(&ar->udev->dev, "invalid firmware descriptor " | |
210 | "format detected.\n"); | |
211 | return -EINVAL; | |
212 | } | |
213 | ||
214 | ar->fw.api_version = otus_desc->api_ver; | |
215 | ||
216 | if (ar->fw.api_version < CARL9170FW_API_MIN_VER || | |
217 | ar->fw.api_version > CARL9170FW_API_MAX_VER) { | |
218 | dev_err(&ar->udev->dev, "unsupported firmware api version.\n"); | |
219 | return -EINVAL; | |
220 | } | |
221 | ||
222 | if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) || | |
223 | !SUPP(CARL9170FW_HANDLE_BACK_REQ)) { | |
224 | dev_err(&ar->udev->dev, "firmware does support " | |
225 | "mandatory features.\n"); | |
226 | return -ECANCELED; | |
227 | } | |
228 | ||
229 | if (ilog2(le32_to_cpu(otus_desc->feature_set)) >= | |
230 | __CARL9170FW_FEATURE_NUM) { | |
231 | dev_warn(&ar->udev->dev, "driver does not support all " | |
232 | "firmware features.\n"); | |
233 | } | |
234 | ||
235 | if (!SUPP(CARL9170FW_COMMAND_CAM)) { | |
236 | dev_info(&ar->udev->dev, "crypto offloading is disabled " | |
237 | "by firmware.\n"); | |
238 | ar->disable_offload = true; | |
239 | } | |
240 | ||
1205f543 | 241 | if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM)) |
00c4da27 CL |
242 | ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS; |
243 | ||
244 | if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) { | |
245 | dev_err(&ar->udev->dev, "firmware does not provide " | |
246 | "mandatory interfaces.\n"); | |
247 | return -EINVAL; | |
248 | } | |
249 | ||
250 | if (SUPP(CARL9170FW_MINIBOOT)) | |
251 | ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size); | |
252 | else | |
253 | ar->fw.offset = 0; | |
254 | ||
255 | if (SUPP(CARL9170FW_USB_DOWN_STREAM)) { | |
256 | ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream); | |
257 | ar->fw.tx_stream = true; | |
258 | } | |
259 | ||
260 | if (SUPP(CARL9170FW_USB_UP_STREAM)) | |
261 | ar->fw.rx_stream = true; | |
262 | ||
5c895691 CL |
263 | if (SUPP(CARL9170FW_RX_FILTER)) { |
264 | ar->fw.rx_filter = true; | |
265 | ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL | | |
266 | FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS | | |
267 | FIF_PROMISC_IN_BSS; | |
268 | } | |
269 | ||
7ccc83b0 CL |
270 | if (SUPP(CARL9170FW_HW_COUNTERS)) |
271 | ar->fw.hw_counters = true; | |
272 | ||
c42d6cf2 CL |
273 | if (SUPP(CARL9170FW_WOL)) |
274 | device_set_wakeup_enable(&ar->udev->dev, true); | |
275 | ||
df64962f CL |
276 | if_comb_types = BIT(NL80211_IFTYPE_STATION) | |
277 | BIT(NL80211_IFTYPE_P2P_CLIENT); | |
278 | ||
00c4da27 CL |
279 | ar->fw.vif_num = otus_desc->vif_num; |
280 | ar->fw.cmd_bufs = otus_desc->cmd_bufs; | |
281 | ar->fw.address = le32_to_cpu(otus_desc->fw_address); | |
282 | ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len); | |
283 | ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe); | |
284 | atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks); | |
285 | ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len); | |
286 | ||
287 | if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num || | |
288 | ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs || | |
289 | ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 || | |
290 | ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 || | |
291 | !valid_cpu_addr(ar->fw.address)) { | |
292 | dev_err(&ar->udev->dev, "firmware shows obvious signs of " | |
293 | "malicious tampering.\n"); | |
294 | return -EINVAL; | |
295 | } | |
296 | ||
297 | ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr); | |
298 | ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len); | |
299 | ||
300 | if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >= | |
301 | AR9170_MAC_BCN_LENGTH_MAX) { | |
302 | ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); | |
303 | ||
304 | if (SUPP(CARL9170FW_WLANTX_CAB)) { | |
df64962f | 305 | if_comb_types |= |
c426ee24 JB |
306 | BIT(NL80211_IFTYPE_AP) | |
307 | BIT(NL80211_IFTYPE_P2P_GO); | |
00c4da27 CL |
308 | } |
309 | } | |
310 | ||
df64962f CL |
311 | ar->if_comb_limits[0].max = ar->fw.vif_num; |
312 | ar->if_comb_limits[0].types = if_comb_types; | |
313 | ||
314 | ar->if_combs[0].num_different_channels = 1; | |
315 | ar->if_combs[0].max_interfaces = ar->fw.vif_num; | |
316 | ar->if_combs[0].limits = ar->if_comb_limits; | |
317 | ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits); | |
318 | ||
319 | ar->hw->wiphy->iface_combinations = ar->if_combs; | |
320 | ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs); | |
321 | ||
322 | ar->hw->wiphy->interface_modes |= if_comb_types; | |
323 | ||
aa32452d CL |
324 | txsq_desc = carl9170_fw_find_desc(ar, TXSQ_MAGIC, |
325 | sizeof(*txsq_desc), CARL9170FW_TXSQ_DESC_CUR_VER); | |
326 | ||
327 | if (txsq_desc) { | |
328 | ar->fw.tx_seq_table = le32_to_cpu(txsq_desc->seq_table_addr); | |
329 | if (!valid_cpu_addr(ar->fw.tx_seq_table)) | |
330 | return -EINVAL; | |
331 | } else { | |
332 | ar->fw.tx_seq_table = 0; | |
333 | } | |
334 | ||
00c4da27 CL |
335 | #undef SUPPORTED |
336 | return 0; | |
337 | } | |
338 | ||
339 | static struct carl9170fw_desc_head * | |
340 | carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len) | |
341 | ||
342 | { | |
343 | int scan = 0, found = 0; | |
344 | ||
345 | if (!carl9170fw_size_check(len)) { | |
346 | dev_err(&ar->udev->dev, "firmware size is out of bound.\n"); | |
347 | return NULL; | |
348 | } | |
349 | ||
350 | while (scan < len - sizeof(struct carl9170fw_desc_head)) { | |
351 | if (fw_data[scan++] == otus_magic[found]) | |
352 | found++; | |
353 | else | |
354 | found = 0; | |
355 | ||
356 | if (scan >= len) | |
357 | break; | |
358 | ||
359 | if (found == sizeof(otus_magic)) | |
360 | break; | |
361 | } | |
362 | ||
363 | if (found != sizeof(otus_magic)) | |
364 | return NULL; | |
365 | ||
366 | return (void *)&fw_data[scan - found]; | |
367 | } | |
368 | ||
369 | int carl9170_fw_fix_eeprom(struct ar9170 *ar) | |
370 | { | |
371 | const struct carl9170fw_fix_desc *fix_desc = NULL; | |
372 | unsigned int i, n, off; | |
373 | u32 *data = (void *)&ar->eeprom; | |
374 | ||
375 | fix_desc = carl9170_fw_find_desc(ar, FIX_MAGIC, | |
376 | sizeof(*fix_desc), CARL9170FW_FIX_DESC_CUR_VER); | |
377 | ||
378 | if (!fix_desc) | |
379 | return 0; | |
380 | ||
381 | n = (le16_to_cpu(fix_desc->head.length) - sizeof(*fix_desc)) / | |
382 | sizeof(struct carl9170fw_fix_entry); | |
383 | ||
384 | for (i = 0; i < n; i++) { | |
385 | off = le32_to_cpu(fix_desc->data[i].address) - | |
386 | AR9170_EEPROM_START; | |
387 | ||
388 | if (off >= sizeof(struct ar9170_eeprom) || (off & 3)) { | |
389 | dev_err(&ar->udev->dev, "Skip invalid entry %d\n", i); | |
390 | continue; | |
391 | } | |
392 | ||
393 | data[off / sizeof(*data)] &= | |
394 | le32_to_cpu(fix_desc->data[i].mask); | |
395 | data[off / sizeof(*data)] |= | |
396 | le32_to_cpu(fix_desc->data[i].value); | |
397 | } | |
398 | ||
399 | return 0; | |
400 | } | |
401 | ||
402 | int carl9170_parse_firmware(struct ar9170 *ar) | |
403 | { | |
404 | const struct carl9170fw_desc_head *fw_desc = NULL; | |
405 | const struct firmware *fw = ar->fw.fw; | |
406 | unsigned long header_offset = 0; | |
407 | int err; | |
408 | ||
409 | if (WARN_ON(!fw)) | |
410 | return -EINVAL; | |
411 | ||
412 | fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size); | |
413 | ||
414 | if (!fw_desc) { | |
415 | dev_err(&ar->udev->dev, "unsupported firmware.\n"); | |
416 | return -ENODATA; | |
417 | } | |
418 | ||
419 | header_offset = (unsigned long)fw_desc - (unsigned long)fw->data; | |
420 | ||
421 | err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset); | |
422 | if (err) { | |
423 | dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err); | |
424 | return err; | |
425 | } | |
426 | ||
427 | ar->fw.desc = fw_desc; | |
428 | ||
429 | carl9170_fw_info(ar); | |
430 | ||
431 | err = carl9170_fw(ar, fw->data, fw->size); | |
432 | if (err) { | |
433 | dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n", | |
434 | err); | |
435 | return err; | |
436 | } | |
437 | ||
438 | return 0; | |
439 | } |