[linux-2.6-block.git] / drivers / net / wireless / ath / carl9170 / fw.c

/*
 * Atheros CARL9170 driver
 *
 * firmware parser
 *
 * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; see the file COPYING.  If not, see
 * http://www.gnu.org/licenses/.
 */

#include <linux/kernel.h>
#include <linux/firmware.h>
#include <linux/crc32.h>
#include <linux/module.h>
#include "carl9170.h"
#include "fwcmd.h"
#include "version.h"

#define MAKE_STR(symbol) #symbol
#define TO_STR(symbol) MAKE_STR(symbol)
#define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER)
MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT);

static const u8 otus_magic[4] = { OTUS_MAGIC };

static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4],
	const unsigned int len, const u8 compatible_revision)
{
	const struct carl9170fw_desc_head *iter;

	carl9170fw_for_each_hdr(iter, ar->fw.desc) {
		if (carl9170fw_desc_cmp(iter, descid, len,
					compatible_revision))
			return (void *)iter;
	}

	/* needed to find the LAST desc */
	if (carl9170fw_desc_cmp(iter, descid, len,
				compatible_revision))
		return (void *)iter;

	return NULL;
}

static int carl9170_fw_verify_descs(struct ar9170 *ar,
	const struct carl9170fw_desc_head *head, unsigned int max_len)
{
	const struct carl9170fw_desc_head *pos;
	unsigned long pos_addr, end_addr;
	unsigned int pos_length;

	if (max_len < sizeof(*pos))
		return -ENODATA;

	max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len);

	pos = head;
	pos_addr = (unsigned long) pos;
	end_addr = pos_addr + max_len;

	while (pos_addr < end_addr) {
		if (pos_addr + sizeof(*head) > end_addr)
			return -E2BIG;

		pos_length = le16_to_cpu(pos->length);

		if (pos_length < sizeof(*head))
			return -EBADMSG;

		if (pos_length > max_len)
			return -EOVERFLOW;

		if (pos_addr + pos_length > end_addr)
			return -EMSGSIZE;

		if (carl9170fw_desc_cmp(pos, LAST_MAGIC,
					CARL9170FW_LAST_DESC_SIZE,
					CARL9170FW_LAST_DESC_CUR_VER))
			return 0;

		pos_addr += pos_length;
		pos = (void *)pos_addr;
		max_len -= pos_length;
	}
	return -EINVAL;
}

static void carl9170_fw_info(struct ar9170 *ar)
{
	const struct carl9170fw_motd_desc *motd_desc;
	unsigned int str_ver_len;
	u32 fw_date;

	dev_info(&ar->udev->dev, "driver   API: %s 2%03d-%02d-%02d [%d-%d]\n",
		CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR,
		CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY,
		CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER);

	motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC,
		sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER);

	if (motd_desc) {
		str_ver_len = strnlen(motd_desc->release,
			CARL9170FW_MOTD_RELEASE_LEN);

		fw_date = le32_to_cpu(motd_desc->fw_year_month_day);

		dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n",
			 str_ver_len, motd_desc->release,
			 CARL9170FW_GET_YEAR(fw_date),
			 CARL9170FW_GET_MONTH(fw_date),
			 CARL9170FW_GET_DAY(fw_date));

		strlcpy(ar->hw->wiphy->fw_version, motd_desc->release,
			sizeof(ar->hw->wiphy->fw_version));
	}
}

static bool valid_dma_addr(const u32 address)
{
	if (address >= AR9170_SRAM_OFFSET &&
	    address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE))
		return true;

	return false;
}

static bool valid_cpu_addr(const u32 address)
{
	if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET &&
	    address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE)))
		return true;

	return false;
}

static int carl9170_fw_checksum(struct ar9170 *ar, const __u8 *data,
				size_t len)
{
	const struct carl9170fw_otus_desc *otus_desc;
	const struct carl9170fw_last_desc *last_desc;
	const struct carl9170fw_chk_desc *chk_desc;
	unsigned long fin, diff;
	unsigned int dsc_len;
	u32 crc32;

	last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC,
		sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER);
	if (!last_desc)
		return -EINVAL;

	otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
		sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
	if (!otus_desc) {
		dev_err(&ar->udev->dev, "failed to find compatible firmware "
			"descriptor.\n");
		return -ENODATA;
	}

	chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC,
		sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER);

	if (!chk_desc) {
		dev_warn(&ar->udev->dev, "Unprotected firmware image.\n");
		return 0;
	}

	dsc_len = min_t(unsigned int, len,
			(unsigned long)chk_desc - (unsigned long)otus_desc);

	fin = (unsigned long) last_desc + sizeof(*last_desc);
	diff = fin - (unsigned long) otus_desc;

	if (diff < len)
		len -= diff;

	if (len < 256)
		return -EIO;

	crc32 = crc32_le(~0, data, len);
	if (cpu_to_le32(crc32) != chk_desc->fw_crc32) {
		dev_err(&ar->udev->dev, "fw checksum test failed.\n");
		return -ENOEXEC;
	}

	crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len);
	if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) {
		dev_err(&ar->udev->dev, "descriptor check failed.\n");
		return -EINVAL;
	}
	return 0;
}

static int carl9170_fw_tx_sequence(struct ar9170 *ar)
{
	const struct carl9170fw_txsq_desc *txsq_desc;

	txsq_desc = carl9170_fw_find_desc(ar, TXSQ_MAGIC, sizeof(*txsq_desc),
					  CARL9170FW_TXSQ_DESC_CUR_VER);
	if (txsq_desc) {
		ar->fw.tx_seq_table = le32_to_cpu(txsq_desc->seq_table_addr);
		if (!valid_cpu_addr(ar->fw.tx_seq_table))
			return -EINVAL;
	} else {
		ar->fw.tx_seq_table = 0;
	}

	return 0;
}

static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
{
	const struct carl9170fw_otus_desc *otus_desc;
	int err;
	u16 if_comb_types;

	err = carl9170_fw_checksum(ar, data, len);
	if (err)
		return err;

	otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
		sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
	if (!otus_desc) {
		return -ENODATA;
	}

#define SUPP(feat)						\
	(carl9170fw_supports(otus_desc->feature_set, feat))

	if (!SUPP(CARL9170FW_DUMMY_FEATURE)) {
		dev_err(&ar->udev->dev, "invalid firmware descriptor "
			"format detected.\n");
		return -EINVAL;
	}

	ar->fw.api_version = otus_desc->api_ver;

	if (ar->fw.api_version < CARL9170FW_API_MIN_VER ||
	    ar->fw.api_version > CARL9170FW_API_MAX_VER) {
		dev_err(&ar->udev->dev, "unsupported firmware api version.\n");
		return -EINVAL;
	}

	if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) ||
	    !SUPP(CARL9170FW_HANDLE_BACK_REQ)) {
		dev_err(&ar->udev->dev, "firmware does support "
			"mandatory features.\n");
		return -ECANCELED;
	}

	if (ilog2(le32_to_cpu(otus_desc->feature_set)) >=
		__CARL9170FW_FEATURE_NUM) {
		dev_warn(&ar->udev->dev, "driver does not support all "
			 "firmware features.\n");
	}

	if (!SUPP(CARL9170FW_COMMAND_CAM)) {
		dev_info(&ar->udev->dev, "crypto offloading is disabled "
			 "by firmware.\n");
		ar->disable_offload = true;
	}

	if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM))
		ar->hw->flags |= IEEE80211_HW_SUPPORTS_PS;

	if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) {
		dev_err(&ar->udev->dev, "firmware does not provide "
			"mandatory interfaces.\n");
		return -EINVAL;
	}

	if (SUPP(CARL9170FW_MINIBOOT))
		ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size);
	else
		ar->fw.offset = 0;

	if (SUPP(CARL9170FW_USB_DOWN_STREAM)) {
		ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream);
		ar->fw.tx_stream = true;
	}

	if (SUPP(CARL9170FW_USB_UP_STREAM))
		ar->fw.rx_stream = true;

	if (SUPP(CARL9170FW_RX_FILTER)) {
		ar->fw.rx_filter = true;
		ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL |
			FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS |
			FIF_PROMISC_IN_BSS;
	}

	if (SUPP(CARL9170FW_HW_COUNTERS))
		ar->fw.hw_counters = true;

	if (SUPP(CARL9170FW_WOL))
		device_set_wakeup_enable(&ar->udev->dev, true);

	if (SUPP(CARL9170FW_RX_BA_FILTER))
		ar->fw.ba_filter = true;

	if_comb_types = BIT(NL80211_IFTYPE_STATION) |
			BIT(NL80211_IFTYPE_P2P_CLIENT);

	ar->fw.vif_num = otus_desc->vif_num;
	ar->fw.cmd_bufs = otus_desc->cmd_bufs;
	ar->fw.address = le32_to_cpu(otus_desc->fw_address);
	ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len);
	ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe);
	atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
	ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len);

	if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num ||
	    ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs ||
	    ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 ||
	    ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 ||
	    !valid_cpu_addr(ar->fw.address)) {
		dev_err(&ar->udev->dev, "firmware shows obvious signs of "
			"malicious tampering.\n");
		return -EINVAL;
	}

	ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr);
	ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len);

	if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >=
	    AR9170_MAC_BCN_LENGTH_MAX) {
		ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);

		if (SUPP(CARL9170FW_WLANTX_CAB)) {
			if_comb_types |=
				BIT(NL80211_IFTYPE_AP) |
				BIT(NL80211_IFTYPE_P2P_GO);
		}
	}

	ar->if_comb_limits[0].max = ar->fw.vif_num;
	ar->if_comb_limits[0].types = if_comb_types;

	ar->if_combs[0].num_different_channels = 1;
	ar->if_combs[0].max_interfaces = ar->fw.vif_num;
	ar->if_combs[0].limits = ar->if_comb_limits;
	ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits);

	ar->hw->wiphy->iface_combinations = ar->if_combs;
	ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs);

	ar->hw->wiphy->interface_modes |= if_comb_types;

	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;

#undef SUPPORTED
	return carl9170_fw_tx_sequence(ar);
}

static struct carl9170fw_desc_head *
carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len)

{
	int scan = 0, found = 0;

	if (!carl9170fw_size_check(len)) {
		dev_err(&ar->udev->dev, "firmware size is out of bound.\n");
		return NULL;
	}

	while (scan < len - sizeof(struct carl9170fw_desc_head)) {
		if (fw_data[scan++] == otus_magic[found])
			found++;
		else
			found = 0;

		if (scan >= len)
			break;

		if (found == sizeof(otus_magic))
			break;
	}

	if (found != sizeof(otus_magic))
		return NULL;

	return (void *)&fw_data[scan - found];
}

int carl9170_parse_firmware(struct ar9170 *ar)
{
	const struct carl9170fw_desc_head *fw_desc = NULL;
	const struct firmware *fw = ar->fw.fw;
	unsigned long header_offset = 0;
	int err;

	if (WARN_ON(!fw))
		return -EINVAL;

	fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size);

	if (!fw_desc) {
		dev_err(&ar->udev->dev, "unsupported firmware.\n");
		return -ENODATA;
	}

	header_offset = (unsigned long)fw_desc - (unsigned long)fw->data;

	err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset);
	if (err) {
		dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err);
		return err;
	}

	ar->fw.desc = fw_desc;

	carl9170_fw_info(ar);

	err = carl9170_fw(ar, fw->data, fw->size);
	if (err) {
		dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n",
			err);
		return err;
	}

	return 0;
}
Commit	Line	Data
00c4da27 CL	1	/*
	2	* Atheros CARL9170 driver
	3	*
	4	* firmware parser
	5	*
	6	* Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	* You should have received a copy of the GNU General Public License
	19	* along with this program; see the file COPYING. If not, see
	20	* http://www.gnu.org/licenses/.
	21	*/
	22
	23	#include <linux/kernel.h>
	24	#include <linux/firmware.h>
	25	#include <linux/crc32.h>
9d9779e7	26	#include <linux/module.h>
00c4da27 CL	27	#include "carl9170.h"
	28	#include "fwcmd.h"
	29	#include "version.h"
	30
	31	#define MAKE_STR(symbol) #symbol
	32	#define TO_STR(symbol) MAKE_STR(symbol)
	33	#define CARL9170FW_API_VER_STR TO_STR(CARL9170FW_API_MAX_VER)
	34	MODULE_VERSION(CARL9170FW_API_VER_STR ":" CARL9170FW_VERSION_GIT);
	35
	36	static const u8 otus_magic[4] = { OTUS_MAGIC };
	37
	38	static const void carl9170_fw_find_desc(struct ar9170 ar, const u8 descid[4],
	39	const unsigned int len, const u8 compatible_revision)
	40	{
	41	const struct carl9170fw_desc_head *iter;
	42
	43	carl9170fw_for_each_hdr(iter, ar->fw.desc) {
	44	if (carl9170fw_desc_cmp(iter, descid, len,
	45	compatible_revision))
	46	return (void *)iter;
	47	}
	48
	49	/* needed to find the LAST desc */
	50	if (carl9170fw_desc_cmp(iter, descid, len,
	51	compatible_revision))
	52	return (void *)iter;
	53
	54	return NULL;
	55	}
	56
	57	static int carl9170_fw_verify_descs(struct ar9170 *ar,
	58	const struct carl9170fw_desc_head *head, unsigned int max_len)
	59	{
	60	const struct carl9170fw_desc_head *pos;
	61	unsigned long pos_addr, end_addr;
	62	unsigned int pos_length;
	63
	64	if (max_len < sizeof(*pos))
	65	return -ENODATA;
	66
	67	max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len);
	68
	69	pos = head;
	70	pos_addr = (unsigned long) pos;
	71	end_addr = pos_addr + max_len;
	72
	73	while (pos_addr < end_addr) {
	74	if (pos_addr + sizeof(*head) > end_addr)
	75	return -E2BIG;
	76
	77	pos_length = le16_to_cpu(pos->length);
	78
	79	if (pos_length < sizeof(*head))
	80	return -EBADMSG;
	81
	82	if (pos_length > max_len)
	83	return -EOVERFLOW;
	84
	85	if (pos_addr + pos_length > end_addr)
	86	return -EMSGSIZE;
	87
	88	if (carl9170fw_desc_cmp(pos, LAST_MAGIC,
	89	CARL9170FW_LAST_DESC_SIZE,
	90	CARL9170FW_LAST_DESC_CUR_VER))
91	return 0;
92
93	pos_addr += pos_length;
94	pos = (void *)pos_addr;
95	max_len -= pos_length;
96	}
97	return -EINVAL;
98	}
99
100	static void carl9170_fw_info(struct ar9170 *ar)
101	{
102	const struct carl9170fw_motd_desc *motd_desc;
103	unsigned int str_ver_len;
104	u32 fw_date;
105
106	dev_info(&ar->udev->dev, "driver API: %s 2%03d-%02d-%02d [%d-%d]\n",
107	CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR,
108	CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY,
109	CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER);
110
111	motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC,
112	sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER);
113
114	if (motd_desc) {
115	str_ver_len = strnlen(motd_desc->release,
116	CARL9170FW_MOTD_RELEASE_LEN);
117
118	fw_date = le32_to_cpu(motd_desc->fw_year_month_day);
119
120	dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n",
121	str_ver_len, motd_desc->release,
122	CARL9170FW_GET_YEAR(fw_date),
123	CARL9170FW_GET_MONTH(fw_date),
124	CARL9170FW_GET_DAY(fw_date));
125
126	strlcpy(ar->hw->wiphy->fw_version, motd_desc->release,
127	sizeof(ar->hw->wiphy->fw_version));
128	}
129	}
130
131	static bool valid_dma_addr(const u32 address)
132	{
133	if (address >= AR9170_SRAM_OFFSET &&
134	address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE))
135	return true;
136
137	return false;
138	}
139
140	static bool valid_cpu_addr(const u32 address)
141	{
142	if (valid_dma_addr(address) \|\| (address >= AR9170_PRAM_OFFSET &&
143	address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE)))
144	return true;
145
146	return false;
147	}
148
65a69228 CL	149	static int carl9170_fw_checksum(struct ar9170 ar, const __u8 data,
65a69228 CL	150	size_t len)
00c4da27 CL	151	{
00c4da27 CL	152	const struct carl9170fw_otus_desc *otus_desc;
00c4da27	153	const struct carl9170fw_last_desc *last_desc;
65a69228 CL	154	const struct carl9170fw_chk_desc *chk_desc;
	155	unsigned long fin, diff;
	156	unsigned int dsc_len;
	157	u32 crc32;
00c4da27 CL	158
	159	last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC,
	160	sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER);
	161	if (!last_desc)
	162	return -EINVAL;
	163
	164	otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
	165	sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
	166	if (!otus_desc) {
	167	dev_err(&ar->udev->dev, "failed to find compatible firmware "
	168	"descriptor.\n");
	169	return -ENODATA;
	170	}
	171
	172	chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC,
	173	sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER);
	174
65a69228 CL	175	if (!chk_desc) {
	176	dev_warn(&ar->udev->dev, "Unprotected firmware image.\n");
	177	return 0;
	178	}
00c4da27	179
65a69228	180	dsc_len = min_t(unsigned int, len,
00c4da27 CL	181	(unsigned long)chk_desc - (unsigned long)otus_desc);
00c4da27 CL	182
65a69228 CL	183	fin = (unsigned long) last_desc + sizeof(*last_desc);
65a69228 CL	184	diff = fin - (unsigned long) otus_desc;
00c4da27	185
65a69228 CL	186	if (diff < len)
65a69228 CL	187	len -= diff;
00c4da27	188
65a69228 CL	189	if (len < 256)
65a69228 CL	190	return -EIO;
00c4da27	191
65a69228 CL	192	crc32 = crc32_le(~0, data, len);
	193	if (cpu_to_le32(crc32) != chk_desc->fw_crc32) {
	194	dev_err(&ar->udev->dev, "fw checksum test failed.\n");
	195	return -ENOEXEC;
	196	}
	197
	198	crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len);
	199	if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) {
	200	dev_err(&ar->udev->dev, "descriptor check failed.\n");
	201	return -EINVAL;
	202	}
	203	return 0;
	204	}
	205
	206	static int carl9170_fw_tx_sequence(struct ar9170 *ar)
	207	{
	208	const struct carl9170fw_txsq_desc *txsq_desc;
00c4da27	209
65a69228 CL	210	txsq_desc = carl9170_fw_find_desc(ar, TXSQ_MAGIC, sizeof(*txsq_desc),
	211	CARL9170FW_TXSQ_DESC_CUR_VER);
	212	if (txsq_desc) {
	213	ar->fw.tx_seq_table = le32_to_cpu(txsq_desc->seq_table_addr);
	214	if (!valid_cpu_addr(ar->fw.tx_seq_table))
00c4da27	215	return -EINVAL;
00c4da27	216	} else {
65a69228 CL	217	ar->fw.tx_seq_table = 0;
	218	}
	219
	220	return 0;
	221	}
	222
	223	static int carl9170_fw(struct ar9170 ar, const __u8 data, size_t len)
	224	{
	225	const struct carl9170fw_otus_desc *otus_desc;
	226	int err;
	227	u16 if_comb_types;
	228
	229	err = carl9170_fw_checksum(ar, data, len);
	230	if (err)
	231	return err;
	232
	233	otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
	234	sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
	235	if (!otus_desc) {
	236	return -ENODATA;
00c4da27 CL	237	}
	238
	239	#define SUPP(feat) \
	240	(carl9170fw_supports(otus_desc->feature_set, feat))
	241
	242	if (!SUPP(CARL9170FW_DUMMY_FEATURE)) {
	243	dev_err(&ar->udev->dev, "invalid firmware descriptor "
	244	"format detected.\n");
	245	return -EINVAL;
	246	}
	247
	248	ar->fw.api_version = otus_desc->api_ver;
	249
	250	if (ar->fw.api_version < CARL9170FW_API_MIN_VER \|\|
	251	ar->fw.api_version > CARL9170FW_API_MAX_VER) {
	252	dev_err(&ar->udev->dev, "unsupported firmware api version.\n");
	253	return -EINVAL;
	254	}
	255
	256	if (!SUPP(CARL9170FW_COMMAND_PHY) \|\| SUPP(CARL9170FW_UNUSABLE) \|\|
	257	!SUPP(CARL9170FW_HANDLE_BACK_REQ)) {
	258	dev_err(&ar->udev->dev, "firmware does support "
	259	"mandatory features.\n");
	260	return -ECANCELED;
	261	}
	262
	263	if (ilog2(le32_to_cpu(otus_desc->feature_set)) >=
	264	__CARL9170FW_FEATURE_NUM) {
	265	dev_warn(&ar->udev->dev, "driver does not support all "
	266	"firmware features.\n");
	267	}
	268
	269	if (!SUPP(CARL9170FW_COMMAND_CAM)) {
	270	dev_info(&ar->udev->dev, "crypto offloading is disabled "
	271	"by firmware.\n");
	272	ar->disable_offload = true;
	273	}
	274
1205f543	275	if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM))
00c4da27 CL	276	ar->hw->flags \|= IEEE80211_HW_SUPPORTS_PS;
	277
	278	if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) {
	279	dev_err(&ar->udev->dev, "firmware does not provide "
	280	"mandatory interfaces.\n");
	281	return -EINVAL;
	282	}
	283
	284	if (SUPP(CARL9170FW_MINIBOOT))
	285	ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size);
	286	else
	287	ar->fw.offset = 0;
	288
	289	if (SUPP(CARL9170FW_USB_DOWN_STREAM)) {
	290	ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream);
	291	ar->fw.tx_stream = true;
	292	}
	293
	294	if (SUPP(CARL9170FW_USB_UP_STREAM))
	295	ar->fw.rx_stream = true;
	296
5c895691 CL	297	if (SUPP(CARL9170FW_RX_FILTER)) {
	298	ar->fw.rx_filter = true;
	299	ar->rx_filter_caps = FIF_FCSFAIL \| FIF_PLCPFAIL \|
	300	FIF_CONTROL \| FIF_PSPOLL \| FIF_OTHER_BSS \|
	301	FIF_PROMISC_IN_BSS;
	302	}
	303
7ccc83b0 CL	304	if (SUPP(CARL9170FW_HW_COUNTERS))
	305	ar->fw.hw_counters = true;
	306
c42d6cf2 CL	307	if (SUPP(CARL9170FW_WOL))
	308	device_set_wakeup_enable(&ar->udev->dev, true);
	309
c9122c0d CL	310	if (SUPP(CARL9170FW_RX_BA_FILTER))
	311	ar->fw.ba_filter = true;
	312
df64962f CL	313	if_comb_types = BIT(NL80211_IFTYPE_STATION) \|
	314	BIT(NL80211_IFTYPE_P2P_CLIENT);
	315
00c4da27 CL	316	ar->fw.vif_num = otus_desc->vif_num;
	317	ar->fw.cmd_bufs = otus_desc->cmd_bufs;
	318	ar->fw.address = le32_to_cpu(otus_desc->fw_address);
	319	ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len);
	320	ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe);
	321	atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
	322	ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len);
	323
	324	if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC \|\| !ar->fw.vif_num \|\|
	325	ar->fw.mem_blocks < 16 \|\| !ar->fw.cmd_bufs \|\|
	326	ar->fw.mem_block_size < 64 \|\| ar->fw.mem_block_size > 512 \|\|
	327	ar->fw.rx_size > 32768 \|\| ar->fw.rx_size < 4096 \|\|
	328	!valid_cpu_addr(ar->fw.address)) {
	329	dev_err(&ar->udev->dev, "firmware shows obvious signs of "
	330	"malicious tampering.\n");
	331	return -EINVAL;
	332	}
	333
	334	ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr);
	335	ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len);
	336
	337	if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >=
	338	AR9170_MAC_BCN_LENGTH_MAX) {
	339	ar->hw->wiphy->interface_modes \|= BIT(NL80211_IFTYPE_ADHOC);
	340
	341	if (SUPP(CARL9170FW_WLANTX_CAB)) {
df64962f	342	if_comb_types \|=
c426ee24 JB	343	BIT(NL80211_IFTYPE_AP) \|
c426ee24 JB	344	BIT(NL80211_IFTYPE_P2P_GO);
00c4da27 CL	345	}
	346	}
	347
df64962f CL	348	ar->if_comb_limits[0].max = ar->fw.vif_num;
	349	ar->if_comb_limits[0].types = if_comb_types;
	350
	351	ar->if_combs[0].num_different_channels = 1;
	352	ar->if_combs[0].max_interfaces = ar->fw.vif_num;
	353	ar->if_combs[0].limits = ar->if_comb_limits;
	354	ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits);
	355
	356	ar->hw->wiphy->iface_combinations = ar->if_combs;
	357	ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs);
	358
	359	ar->hw->wiphy->interface_modes \|= if_comb_types;
	360
81ddbb5c JB	361	ar->hw->wiphy->flags \|= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
81ddbb5c JB	362
00c4da27	363	#undef SUPPORTED
65a69228	364	return carl9170_fw_tx_sequence(ar);
00c4da27 CL	365	}
	366
	367	static struct carl9170fw_desc_head *
	368	carl9170_find_fw_desc(struct ar9170 ar, const __u8 fw_data, const size_t len)
	369
	370	{
	371	int scan = 0, found = 0;
	372
	373	if (!carl9170fw_size_check(len)) {
	374	dev_err(&ar->udev->dev, "firmware size is out of bound.\n");
	375	return NULL;
	376	}
	377
	378	while (scan < len - sizeof(struct carl9170fw_desc_head)) {
	379	if (fw_data[scan++] == otus_magic[found])
	380	found++;
	381	else
	382	found = 0;
	383
	384	if (scan >= len)
	385	break;
	386
	387	if (found == sizeof(otus_magic))
	388	break;
	389	}
	390
	391	if (found != sizeof(otus_magic))
	392	return NULL;
	393
	394	return (void *)&fw_data[scan - found];
	395	}
	396
00c4da27 CL	397	int carl9170_parse_firmware(struct ar9170 *ar)
	398	{
	399	const struct carl9170fw_desc_head *fw_desc = NULL;
	400	const struct firmware *fw = ar->fw.fw;
	401	unsigned long header_offset = 0;
	402	int err;
	403
	404	if (WARN_ON(!fw))
	405	return -EINVAL;
	406
	407	fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size);
	408
	409	if (!fw_desc) {
	410	dev_err(&ar->udev->dev, "unsupported firmware.\n");
	411	return -ENODATA;
	412	}
	413
	414	header_offset = (unsigned long)fw_desc - (unsigned long)fw->data;
	415
	416	err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset);
	417	if (err) {
	418	dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err);
	419	return err;
	420	}
	421
	422	ar->fw.desc = fw_desc;
	423
	424	carl9170_fw_info(ar);
	425
	426	err = carl9170_fw(ar, fw->data, fw->size);
	427	if (err) {
	428	dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n",
	429	err);
	430	return err;
	431	}
	432
	433	return 0;
	434	}