Commit | Line | Data |
---|---|---|
00c4da27 CL |
1 | /* |
2 | * Atheros CARL9170 driver | |
3 | * | |
4 | * firmware parser | |
5 | * | |
6 | * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com> | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; see the file COPYING. If not, see | |
20 | * http://www.gnu.org/licenses/. | |
21 | */ | |
22 | ||
23 | #include <linux/kernel.h> | |
24 | #include <linux/firmware.h> | |
25 | #include <linux/crc32.h> | |
9d9779e7 | 26 | #include <linux/module.h> |
00c4da27 CL |
27 | #include "carl9170.h" |
28 | #include "fwcmd.h" | |
29 | #include "version.h" | |
30 | ||
31 | #define MAKE_STR(symbol) #symbol | |
32 | #define TO_STR(symbol) MAKE_STR(symbol) | |
33 | #define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER) | |
34 | MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT); | |
35 | ||
36 | static const u8 otus_magic[4] = { OTUS_MAGIC }; | |
37 | ||
38 | static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4], | |
39 | const unsigned int len, const u8 compatible_revision) | |
40 | { | |
41 | const struct carl9170fw_desc_head *iter; | |
42 | ||
43 | carl9170fw_for_each_hdr(iter, ar->fw.desc) { | |
44 | if (carl9170fw_desc_cmp(iter, descid, len, | |
45 | compatible_revision)) | |
46 | return (void *)iter; | |
47 | } | |
48 | ||
49 | /* needed to find the LAST desc */ | |
50 | if (carl9170fw_desc_cmp(iter, descid, len, | |
51 | compatible_revision)) | |
52 | return (void *)iter; | |
53 | ||
54 | return NULL; | |
55 | } | |
56 | ||
57 | static int carl9170_fw_verify_descs(struct ar9170 *ar, | |
58 | const struct carl9170fw_desc_head *head, unsigned int max_len) | |
59 | { | |
60 | const struct carl9170fw_desc_head *pos; | |
61 | unsigned long pos_addr, end_addr; | |
62 | unsigned int pos_length; | |
63 | ||
64 | if (max_len < sizeof(*pos)) | |
65 | return -ENODATA; | |
66 | ||
67 | max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len); | |
68 | ||
69 | pos = head; | |
70 | pos_addr = (unsigned long) pos; | |
71 | end_addr = pos_addr + max_len; | |
72 | ||
73 | while (pos_addr < end_addr) { | |
74 | if (pos_addr + sizeof(*head) > end_addr) | |
75 | return -E2BIG; | |
76 | ||
77 | pos_length = le16_to_cpu(pos->length); | |
78 | ||
79 | if (pos_length < sizeof(*head)) | |
80 | return -EBADMSG; | |
81 | ||
82 | if (pos_length > max_len) | |
83 | return -EOVERFLOW; | |
84 | ||
85 | if (pos_addr + pos_length > end_addr) | |
86 | return -EMSGSIZE; | |
87 | ||
88 | if (carl9170fw_desc_cmp(pos, LAST_MAGIC, | |
89 | CARL9170FW_LAST_DESC_SIZE, | |
90 | CARL9170FW_LAST_DESC_CUR_VER)) | |
91 | return 0; | |
92 | ||
93 | pos_addr += pos_length; | |
94 | pos = (void *)pos_addr; | |
95 | max_len -= pos_length; | |
96 | } | |
97 | return -EINVAL; | |
98 | } | |
99 | ||
100 | static void carl9170_fw_info(struct ar9170 *ar) | |
101 | { | |
102 | const struct carl9170fw_motd_desc *motd_desc; | |
103 | unsigned int str_ver_len; | |
104 | u32 fw_date; | |
105 | ||
106 | dev_info(&ar->udev->dev, "driver API: %s 2%03d-%02d-%02d [%d-%d]\n", | |
107 | CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR, | |
108 | CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY, | |
109 | CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER); | |
110 | ||
111 | motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC, | |
112 | sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER); | |
113 | ||
114 | if (motd_desc) { | |
115 | str_ver_len = strnlen(motd_desc->release, | |
116 | CARL9170FW_MOTD_RELEASE_LEN); | |
117 | ||
118 | fw_date = le32_to_cpu(motd_desc->fw_year_month_day); | |
119 | ||
120 | dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n", | |
121 | str_ver_len, motd_desc->release, | |
122 | CARL9170FW_GET_YEAR(fw_date), | |
123 | CARL9170FW_GET_MONTH(fw_date), | |
124 | CARL9170FW_GET_DAY(fw_date)); | |
125 | ||
126 | strlcpy(ar->hw->wiphy->fw_version, motd_desc->release, | |
127 | sizeof(ar->hw->wiphy->fw_version)); | |
128 | } | |
129 | } | |
130 | ||
131 | static bool valid_dma_addr(const u32 address) | |
132 | { | |
133 | if (address >= AR9170_SRAM_OFFSET && | |
134 | address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE)) | |
135 | return true; | |
136 | ||
137 | return false; | |
138 | } | |
139 | ||
140 | static bool valid_cpu_addr(const u32 address) | |
141 | { | |
142 | if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET && | |
143 | address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE))) | |
144 | return true; | |
145 | ||
146 | return false; | |
147 | } | |
148 | ||
65a69228 CL |
149 | static int carl9170_fw_checksum(struct ar9170 *ar, const __u8 *data, |
150 | size_t len) | |
00c4da27 CL |
151 | { |
152 | const struct carl9170fw_otus_desc *otus_desc; | |
00c4da27 | 153 | const struct carl9170fw_last_desc *last_desc; |
65a69228 CL |
154 | const struct carl9170fw_chk_desc *chk_desc; |
155 | unsigned long fin, diff; | |
156 | unsigned int dsc_len; | |
157 | u32 crc32; | |
00c4da27 CL |
158 | |
159 | last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC, | |
160 | sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER); | |
161 | if (!last_desc) | |
162 | return -EINVAL; | |
163 | ||
164 | otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC, | |
165 | sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER); | |
166 | if (!otus_desc) { | |
167 | dev_err(&ar->udev->dev, "failed to find compatible firmware " | |
168 | "descriptor.\n"); | |
169 | return -ENODATA; | |
170 | } | |
171 | ||
172 | chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC, | |
173 | sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER); | |
174 | ||
65a69228 CL |
175 | if (!chk_desc) { |
176 | dev_warn(&ar->udev->dev, "Unprotected firmware image.\n"); | |
177 | return 0; | |
178 | } | |
00c4da27 | 179 | |
65a69228 | 180 | dsc_len = min_t(unsigned int, len, |
00c4da27 CL |
181 | (unsigned long)chk_desc - (unsigned long)otus_desc); |
182 | ||
65a69228 CL |
183 | fin = (unsigned long) last_desc + sizeof(*last_desc); |
184 | diff = fin - (unsigned long) otus_desc; | |
00c4da27 | 185 | |
65a69228 CL |
186 | if (diff < len) |
187 | len -= diff; | |
00c4da27 | 188 | |
65a69228 CL |
189 | if (len < 256) |
190 | return -EIO; | |
00c4da27 | 191 | |
65a69228 CL |
192 | crc32 = crc32_le(~0, data, len); |
193 | if (cpu_to_le32(crc32) != chk_desc->fw_crc32) { | |
194 | dev_err(&ar->udev->dev, "fw checksum test failed.\n"); | |
195 | return -ENOEXEC; | |
196 | } | |
197 | ||
198 | crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len); | |
199 | if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) { | |
200 | dev_err(&ar->udev->dev, "descriptor check failed.\n"); | |
201 | return -EINVAL; | |
202 | } | |
203 | return 0; | |
204 | } | |
205 | ||
206 | static int carl9170_fw_tx_sequence(struct ar9170 *ar) | |
207 | { | |
208 | const struct carl9170fw_txsq_desc *txsq_desc; | |
00c4da27 | 209 | |
65a69228 CL |
210 | txsq_desc = carl9170_fw_find_desc(ar, TXSQ_MAGIC, sizeof(*txsq_desc), |
211 | CARL9170FW_TXSQ_DESC_CUR_VER); | |
212 | if (txsq_desc) { | |
213 | ar->fw.tx_seq_table = le32_to_cpu(txsq_desc->seq_table_addr); | |
214 | if (!valid_cpu_addr(ar->fw.tx_seq_table)) | |
00c4da27 | 215 | return -EINVAL; |
00c4da27 | 216 | } else { |
65a69228 CL |
217 | ar->fw.tx_seq_table = 0; |
218 | } | |
219 | ||
220 | return 0; | |
221 | } | |
222 | ||
223 | static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len) | |
224 | { | |
225 | const struct carl9170fw_otus_desc *otus_desc; | |
226 | int err; | |
227 | u16 if_comb_types; | |
228 | ||
229 | err = carl9170_fw_checksum(ar, data, len); | |
230 | if (err) | |
231 | return err; | |
232 | ||
233 | otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC, | |
234 | sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER); | |
235 | if (!otus_desc) { | |
236 | return -ENODATA; | |
00c4da27 CL |
237 | } |
238 | ||
239 | #define SUPP(feat) \ | |
240 | (carl9170fw_supports(otus_desc->feature_set, feat)) | |
241 | ||
242 | if (!SUPP(CARL9170FW_DUMMY_FEATURE)) { | |
243 | dev_err(&ar->udev->dev, "invalid firmware descriptor " | |
244 | "format detected.\n"); | |
245 | return -EINVAL; | |
246 | } | |
247 | ||
248 | ar->fw.api_version = otus_desc->api_ver; | |
249 | ||
250 | if (ar->fw.api_version < CARL9170FW_API_MIN_VER || | |
251 | ar->fw.api_version > CARL9170FW_API_MAX_VER) { | |
252 | dev_err(&ar->udev->dev, "unsupported firmware api version.\n"); | |
253 | return -EINVAL; | |
254 | } | |
255 | ||
256 | if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) || | |
257 | !SUPP(CARL9170FW_HANDLE_BACK_REQ)) { | |
258 | dev_err(&ar->udev->dev, "firmware does support " | |
259 | "mandatory features.\n"); | |
260 | return -ECANCELED; | |
261 | } | |
262 | ||
263 | if (ilog2(le32_to_cpu(otus_desc->feature_set)) >= | |
264 | __CARL9170FW_FEATURE_NUM) { | |
265 | dev_warn(&ar->udev->dev, "driver does not support all " | |
266 | "firmware features.\n"); | |
267 | } | |
268 | ||
269 | if (!SUPP(CARL9170FW_COMMAND_CAM)) { | |
270 | dev_info(&ar->udev->dev, "crypto offloading is disabled " | |
271 | "by firmware.\n"); | |
272 | ar->disable_offload = true; | |
273 | } | |
274 | ||
1205f543 | 275 | if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM)) |
00c4da27 CL |
276 | ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS; |
277 | ||
278 | if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) { | |
279 | dev_err(&ar->udev->dev, "firmware does not provide " | |
280 | "mandatory interfaces.\n"); | |
281 | return -EINVAL; | |
282 | } | |
283 | ||
284 | if (SUPP(CARL9170FW_MINIBOOT)) | |
285 | ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size); | |
286 | else | |
287 | ar->fw.offset = 0; | |
288 | ||
289 | if (SUPP(CARL9170FW_USB_DOWN_STREAM)) { | |
290 | ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream); | |
291 | ar->fw.tx_stream = true; | |
292 | } | |
293 | ||
294 | if (SUPP(CARL9170FW_USB_UP_STREAM)) | |
295 | ar->fw.rx_stream = true; | |
296 | ||
5c895691 CL |
297 | if (SUPP(CARL9170FW_RX_FILTER)) { |
298 | ar->fw.rx_filter = true; | |
299 | ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL | | |
300 | FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS | | |
301 | FIF_PROMISC_IN_BSS; | |
302 | } | |
303 | ||
7ccc83b0 CL |
304 | if (SUPP(CARL9170FW_HW_COUNTERS)) |
305 | ar->fw.hw_counters = true; | |
306 | ||
c42d6cf2 CL |
307 | if (SUPP(CARL9170FW_WOL)) |
308 | device_set_wakeup_enable(&ar->udev->dev, true); | |
309 | ||
c9122c0d CL |
310 | if (SUPP(CARL9170FW_RX_BA_FILTER)) |
311 | ar->fw.ba_filter = true; | |
312 | ||
df64962f CL |
313 | if_comb_types = BIT(NL80211_IFTYPE_STATION) | |
314 | BIT(NL80211_IFTYPE_P2P_CLIENT); | |
315 | ||
00c4da27 CL |
316 | ar->fw.vif_num = otus_desc->vif_num; |
317 | ar->fw.cmd_bufs = otus_desc->cmd_bufs; | |
318 | ar->fw.address = le32_to_cpu(otus_desc->fw_address); | |
319 | ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len); | |
320 | ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe); | |
321 | atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks); | |
322 | ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len); | |
323 | ||
324 | if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num || | |
325 | ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs || | |
326 | ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 || | |
327 | ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 || | |
328 | !valid_cpu_addr(ar->fw.address)) { | |
329 | dev_err(&ar->udev->dev, "firmware shows obvious signs of " | |
330 | "malicious tampering.\n"); | |
331 | return -EINVAL; | |
332 | } | |
333 | ||
334 | ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr); | |
335 | ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len); | |
336 | ||
337 | if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >= | |
338 | AR9170_MAC_BCN_LENGTH_MAX) { | |
339 | ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC); | |
340 | ||
341 | if (SUPP(CARL9170FW_WLANTX_CAB)) { | |
df64962f | 342 | if_comb_types |= |
c426ee24 JB |
343 | BIT(NL80211_IFTYPE_AP) | |
344 | BIT(NL80211_IFTYPE_P2P_GO); | |
00c4da27 CL |
345 | } |
346 | } | |
347 | ||
df64962f CL |
348 | ar->if_comb_limits[0].max = ar->fw.vif_num; |
349 | ar->if_comb_limits[0].types = if_comb_types; | |
350 | ||
351 | ar->if_combs[0].num_different_channels = 1; | |
352 | ar->if_combs[0].max_interfaces = ar->fw.vif_num; | |
353 | ar->if_combs[0].limits = ar->if_comb_limits; | |
354 | ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits); | |
355 | ||
356 | ar->hw->wiphy->iface_combinations = ar->if_combs; | |
357 | ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs); | |
358 | ||
359 | ar->hw->wiphy->interface_modes |= if_comb_types; | |
360 | ||
81ddbb5c JB |
361 | ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL; |
362 | ||
00c4da27 | 363 | #undef SUPPORTED |
65a69228 | 364 | return carl9170_fw_tx_sequence(ar); |
00c4da27 CL |
365 | } |
366 | ||
367 | static struct carl9170fw_desc_head * | |
368 | carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len) | |
369 | ||
370 | { | |
371 | int scan = 0, found = 0; | |
372 | ||
373 | if (!carl9170fw_size_check(len)) { | |
374 | dev_err(&ar->udev->dev, "firmware size is out of bound.\n"); | |
375 | return NULL; | |
376 | } | |
377 | ||
378 | while (scan < len - sizeof(struct carl9170fw_desc_head)) { | |
379 | if (fw_data[scan++] == otus_magic[found]) | |
380 | found++; | |
381 | else | |
382 | found = 0; | |
383 | ||
384 | if (scan >= len) | |
385 | break; | |
386 | ||
387 | if (found == sizeof(otus_magic)) | |
388 | break; | |
389 | } | |
390 | ||
391 | if (found != sizeof(otus_magic)) | |
392 | return NULL; | |
393 | ||
394 | return (void *)&fw_data[scan - found]; | |
395 | } | |
396 | ||
00c4da27 CL |
397 | int carl9170_parse_firmware(struct ar9170 *ar) |
398 | { | |
399 | const struct carl9170fw_desc_head *fw_desc = NULL; | |
400 | const struct firmware *fw = ar->fw.fw; | |
401 | unsigned long header_offset = 0; | |
402 | int err; | |
403 | ||
404 | if (WARN_ON(!fw)) | |
405 | return -EINVAL; | |
406 | ||
407 | fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size); | |
408 | ||
409 | if (!fw_desc) { | |
410 | dev_err(&ar->udev->dev, "unsupported firmware.\n"); | |
411 | return -ENODATA; | |
412 | } | |
413 | ||
414 | header_offset = (unsigned long)fw_desc - (unsigned long)fw->data; | |
415 | ||
416 | err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset); | |
417 | if (err) { | |
418 | dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err); | |
419 | return err; | |
420 | } | |
421 | ||
422 | ar->fw.desc = fw_desc; | |
423 | ||
424 | carl9170_fw_info(ar); | |
425 | ||
426 | err = carl9170_fw(ar, fw->data, fw->size); | |
427 | if (err) { | |
428 | dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n", | |
429 | err); | |
430 | return err; | |
431 | } | |
432 | ||
433 | return 0; | |
434 | } |