ath/carl9170/fw.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * Atheros CARL9170 driver
0004  *
0005  * firmware parser
0006  *
0007  * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
0008  */
0009
0010 #include <linux/kernel.h>
0011 #include <linux/firmware.h>
0012 #include <linux/crc32.h>
0013 #include <linux/module.h>
0014 #include "carl9170.h"
0015 #include "fwcmd.h"
0016 #include "version.h"
0017
0018 static const u8 otus_magic[4] = { OTUS_MAGIC };
0019
0020 static const void *carl9170_fw_find_desc(struct ar9170 *ar, const u8 descid[4],
0021     const unsigned int len, const u8 compatible_revision)
0022 {
0023     const struct carl9170fw_desc_head *iter;
0024
0025     carl9170fw_for_each_hdr(iter, ar->fw.desc) {
0026         if (carl9170fw_desc_cmp(iter, descid, len,
0027                     compatible_revision))
0028             return (void *)iter;
0029     }
0030
0031     /* needed to find the LAST desc */
0032     if (carl9170fw_desc_cmp(iter, descid, len,
0033                 compatible_revision))
0034         return (void *)iter;
0035
0036     return NULL;
0037 }
0038
0039 static int carl9170_fw_verify_descs(struct ar9170 *ar,
0040     const struct carl9170fw_desc_head *head, unsigned int max_len)
0041 {
0042     const struct carl9170fw_desc_head *pos;
0043     unsigned long pos_addr, end_addr;
0044     unsigned int pos_length;
0045
0046     if (max_len < sizeof(*pos))
0047         return -ENODATA;
0048
0049     max_len = min_t(unsigned int, CARL9170FW_DESC_MAX_LENGTH, max_len);
0050
0051     pos = head;
0052     pos_addr = (unsigned long) pos;
0053     end_addr = pos_addr + max_len;
0054
0055     while (pos_addr < end_addr) {
0056         if (pos_addr + sizeof(*head) > end_addr)
0057             return -E2BIG;
0058
0059         pos_length = le16_to_cpu(pos->length);
0060
0061         if (pos_length < sizeof(*head))
0062             return -EBADMSG;
0063
0064         if (pos_length > max_len)
0065             return -EOVERFLOW;
0066
0067         if (pos_addr + pos_length > end_addr)
0068             return -EMSGSIZE;
0069
0070         if (carl9170fw_desc_cmp(pos, LAST_MAGIC,
0071                     CARL9170FW_LAST_DESC_SIZE,
0072                     CARL9170FW_LAST_DESC_CUR_VER))
0073             return 0;
0074
0075         pos_addr += pos_length;
0076         pos = (void *)pos_addr;
0077         max_len -= pos_length;
0078     }
0079     return -EINVAL;
0080 }
0081
0082 static void carl9170_fw_info(struct ar9170 *ar)
0083 {
0084     const struct carl9170fw_motd_desc *motd_desc;
0085     unsigned int str_ver_len;
0086     u32 fw_date;
0087
0088     dev_info(&ar->udev->dev, "driver   API: %s 2%03d-%02d-%02d [%d-%d]\n",
0089         CARL9170FW_VERSION_GIT, CARL9170FW_VERSION_YEAR,
0090         CARL9170FW_VERSION_MONTH, CARL9170FW_VERSION_DAY,
0091         CARL9170FW_API_MIN_VER, CARL9170FW_API_MAX_VER);
0092
0093     motd_desc = carl9170_fw_find_desc(ar, MOTD_MAGIC,
0094         sizeof(*motd_desc), CARL9170FW_MOTD_DESC_CUR_VER);
0095
0096     if (motd_desc) {
0097         str_ver_len = strnlen(motd_desc->release,
0098             CARL9170FW_MOTD_RELEASE_LEN);
0099
0100         fw_date = le32_to_cpu(motd_desc->fw_year_month_day);
0101
0102         dev_info(&ar->udev->dev, "firmware API: %.*s 2%03d-%02d-%02d\n",
0103              str_ver_len, motd_desc->release,
0104              CARL9170FW_GET_YEAR(fw_date),
0105              CARL9170FW_GET_MONTH(fw_date),
0106              CARL9170FW_GET_DAY(fw_date));
0107
0108         strlcpy(ar->hw->wiphy->fw_version, motd_desc->release,
0109             sizeof(ar->hw->wiphy->fw_version));
0110     }
0111 }
0112
0113 static bool valid_dma_addr(const u32 address)
0114 {
0115     if (address >= AR9170_SRAM_OFFSET &&
0116         address < (AR9170_SRAM_OFFSET + AR9170_SRAM_SIZE))
0117         return true;
0118
0119     return false;
0120 }
0121
0122 static bool valid_cpu_addr(const u32 address)
0123 {
0124     if (valid_dma_addr(address) || (address >= AR9170_PRAM_OFFSET &&
0125         address < (AR9170_PRAM_OFFSET + AR9170_PRAM_SIZE)))
0126         return true;
0127
0128     return false;
0129 }
0130
0131 static int carl9170_fw_checksum(struct ar9170 *ar, const __u8 *data,
0132                 size_t len)
0133 {
0134     const struct carl9170fw_otus_desc *otus_desc;
0135     const struct carl9170fw_last_desc *last_desc;
0136     const struct carl9170fw_chk_desc *chk_desc;
0137     unsigned long fin, diff;
0138     unsigned int dsc_len;
0139     u32 crc32;
0140
0141     last_desc = carl9170_fw_find_desc(ar, LAST_MAGIC,
0142         sizeof(*last_desc), CARL9170FW_LAST_DESC_CUR_VER);
0143     if (!last_desc)
0144         return -EINVAL;
0145
0146     otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
0147         sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
0148     if (!otus_desc) {
0149         dev_err(&ar->udev->dev, "failed to find compatible firmware "
0150             "descriptor.\n");
0151         return -ENODATA;
0152     }
0153
0154     chk_desc = carl9170_fw_find_desc(ar, CHK_MAGIC,
0155         sizeof(*chk_desc), CARL9170FW_CHK_DESC_CUR_VER);
0156
0157     if (!chk_desc) {
0158         dev_warn(&ar->udev->dev, "Unprotected firmware image.\n");
0159         return 0;
0160     }
0161
0162     dsc_len = min_t(unsigned int, len,
0163             (unsigned long)chk_desc - (unsigned long)otus_desc);
0164
0165     fin = (unsigned long) last_desc + sizeof(*last_desc);
0166     diff = fin - (unsigned long) otus_desc;
0167
0168     if (diff < len)
0169         len -= diff;
0170
0171     if (len < 256)
0172         return -EIO;
0173
0174     crc32 = crc32_le(~0, data, len);
0175     if (cpu_to_le32(crc32) != chk_desc->fw_crc32) {
0176         dev_err(&ar->udev->dev, "fw checksum test failed.\n");
0177         return -ENOEXEC;
0178     }
0179
0180     crc32 = crc32_le(crc32, (void *)otus_desc, dsc_len);
0181     if (cpu_to_le32(crc32) != chk_desc->hdr_crc32) {
0182         dev_err(&ar->udev->dev, "descriptor check failed.\n");
0183         return -EINVAL;
0184     }
0185     return 0;
0186 }
0187
0188 static int carl9170_fw_tx_sequence(struct ar9170 *ar)
0189 {
0190     const struct carl9170fw_txsq_desc *txsq_desc;
0191
0192     txsq_desc = carl9170_fw_find_desc(ar, TXSQ_MAGIC, sizeof(*txsq_desc),
0193                       CARL9170FW_TXSQ_DESC_CUR_VER);
0194     if (txsq_desc) {
0195         ar->fw.tx_seq_table = le32_to_cpu(txsq_desc->seq_table_addr);
0196         if (!valid_cpu_addr(ar->fw.tx_seq_table))
0197             return -EINVAL;
0198     } else {
0199         ar->fw.tx_seq_table = 0;
0200     }
0201
0202     return 0;
0203 }
0204
0205 static void carl9170_fw_set_if_combinations(struct ar9170 *ar,
0206                         u16 if_comb_types)
0207 {
0208     if (ar->fw.vif_num < 2)
0209         return;
0210
0211     ar->if_comb_limits[0].max = ar->fw.vif_num;
0212     ar->if_comb_limits[0].types = if_comb_types;
0213
0214     ar->if_combs[0].num_different_channels = 1;
0215     ar->if_combs[0].max_interfaces = ar->fw.vif_num;
0216     ar->if_combs[0].limits = ar->if_comb_limits;
0217     ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits);
0218
0219     ar->hw->wiphy->iface_combinations = ar->if_combs;
0220     ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs);
0221 }
0222
0223 static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
0224 {
0225     const struct carl9170fw_otus_desc *otus_desc;
0226     int err;
0227     u16 if_comb_types;
0228
0229     err = carl9170_fw_checksum(ar, data, len);
0230     if (err)
0231         return err;
0232
0233     otus_desc = carl9170_fw_find_desc(ar, OTUS_MAGIC,
0234         sizeof(*otus_desc), CARL9170FW_OTUS_DESC_CUR_VER);
0235     if (!otus_desc) {
0236         return -ENODATA;
0237     }
0238
0239 #define SUPP(feat)                      \
0240     (carl9170fw_supports(otus_desc->feature_set, feat))
0241
0242     if (!SUPP(CARL9170FW_DUMMY_FEATURE)) {
0243         dev_err(&ar->udev->dev, "invalid firmware descriptor "
0244             "format detected.\n");
0245         return -EINVAL;
0246     }
0247
0248     ar->fw.api_version = otus_desc->api_ver;
0249
0250     if (ar->fw.api_version < CARL9170FW_API_MIN_VER ||
0251         ar->fw.api_version > CARL9170FW_API_MAX_VER) {
0252         dev_err(&ar->udev->dev, "unsupported firmware api version.\n");
0253         return -EINVAL;
0254     }
0255
0256     if (!SUPP(CARL9170FW_COMMAND_PHY) || SUPP(CARL9170FW_UNUSABLE) ||
0257         !SUPP(CARL9170FW_HANDLE_BACK_REQ)) {
0258         dev_err(&ar->udev->dev, "firmware does support "
0259             "mandatory features.\n");
0260         return -ECANCELED;
0261     }
0262
0263     if (ilog2(le32_to_cpu(otus_desc->feature_set)) >=
0264         __CARL9170FW_FEATURE_NUM) {
0265         dev_warn(&ar->udev->dev, "driver does not support all "
0266              "firmware features.\n");
0267     }
0268
0269     if (!SUPP(CARL9170FW_COMMAND_CAM)) {
0270         dev_info(&ar->udev->dev, "crypto offloading is disabled "
0271              "by firmware.\n");
0272         ar->fw.disable_offload_fw = true;
0273     }
0274
0275     if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM))
0276         ieee80211_hw_set(ar->hw, SUPPORTS_PS);
0277
0278     if (!SUPP(CARL9170FW_USB_INIT_FIRMWARE)) {
0279         dev_err(&ar->udev->dev, "firmware does not provide "
0280             "mandatory interfaces.\n");
0281         return -EINVAL;
0282     }
0283
0284     if (SUPP(CARL9170FW_MINIBOOT))
0285         ar->fw.offset = le16_to_cpu(otus_desc->miniboot_size);
0286     else
0287         ar->fw.offset = 0;
0288
0289     if (SUPP(CARL9170FW_USB_DOWN_STREAM)) {
0290         ar->hw->extra_tx_headroom += sizeof(struct ar9170_stream);
0291         ar->fw.tx_stream = true;
0292     }
0293
0294     if (SUPP(CARL9170FW_USB_UP_STREAM))
0295         ar->fw.rx_stream = true;
0296
0297     if (SUPP(CARL9170FW_RX_FILTER)) {
0298         ar->fw.rx_filter = true;
0299         ar->rx_filter_caps = FIF_FCSFAIL | FIF_PLCPFAIL |
0300             FIF_CONTROL | FIF_PSPOLL | FIF_OTHER_BSS;
0301     }
0302
0303     if (SUPP(CARL9170FW_HW_COUNTERS))
0304         ar->fw.hw_counters = true;
0305
0306     if (SUPP(CARL9170FW_WOL))
0307         device_set_wakeup_enable(&ar->udev->dev, true);
0308
0309     if (SUPP(CARL9170FW_RX_BA_FILTER))
0310         ar->fw.ba_filter = true;
0311
0312     if_comb_types = BIT(NL80211_IFTYPE_STATION) |
0313             BIT(NL80211_IFTYPE_P2P_CLIENT);
0314
0315     ar->fw.vif_num = otus_desc->vif_num;
0316     ar->fw.cmd_bufs = otus_desc->cmd_bufs;
0317     ar->fw.address = le32_to_cpu(otus_desc->fw_address);
0318     ar->fw.rx_size = le16_to_cpu(otus_desc->rx_max_frame_len);
0319     ar->fw.mem_blocks = min_t(unsigned int, otus_desc->tx_descs, 0xfe);
0320     atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
0321     ar->fw.mem_block_size = le16_to_cpu(otus_desc->tx_frag_len);
0322
0323     if (ar->fw.vif_num >= AR9170_MAX_VIRTUAL_MAC || !ar->fw.vif_num ||
0324         ar->fw.mem_blocks < 16 || !ar->fw.cmd_bufs ||
0325         ar->fw.mem_block_size < 64 || ar->fw.mem_block_size > 512 ||
0326         ar->fw.rx_size > 32768 || ar->fw.rx_size < 4096 ||
0327         !valid_cpu_addr(ar->fw.address)) {
0328         dev_err(&ar->udev->dev, "firmware shows obvious signs of "
0329             "malicious tampering.\n");
0330         return -EINVAL;
0331     }
0332
0333     ar->fw.beacon_addr = le32_to_cpu(otus_desc->bcn_addr);
0334     ar->fw.beacon_max_len = le16_to_cpu(otus_desc->bcn_len);
0335
0336     if (valid_dma_addr(ar->fw.beacon_addr) && ar->fw.beacon_max_len >=
0337         AR9170_MAC_BCN_LENGTH_MAX) {
0338         ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
0339
0340         if (SUPP(CARL9170FW_WLANTX_CAB)) {
0341             if_comb_types |= BIT(NL80211_IFTYPE_AP);
0342
0343 #ifdef CONFIG_MAC80211_MESH
0344             if_comb_types |=
0345                 BIT(NL80211_IFTYPE_MESH_POINT);
0346 #endif /* CONFIG_MAC80211_MESH */
0347         }
0348     }
0349
0350     carl9170_fw_set_if_combinations(ar, if_comb_types);
0351
0352     ar->hw->wiphy->interface_modes |= if_comb_types;
0353
0354     ar->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
0355
0356     /* As IBSS Encryption is software-based, IBSS RSN is supported. */
0357     ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
0358          WIPHY_FLAG_IBSS_RSN | WIPHY_FLAG_SUPPORTS_TDLS;
0359
0360 #undef SUPPORTED
0361     return carl9170_fw_tx_sequence(ar);
0362 }
0363
0364 static struct carl9170fw_desc_head *
0365 carl9170_find_fw_desc(struct ar9170 *ar, const __u8 *fw_data, const size_t len)
0366
0367 {
0368     int scan = 0, found = 0;
0369
0370     if (!carl9170fw_size_check(len)) {
0371         dev_err(&ar->udev->dev, "firmware size is out of bound.\n");
0372         return NULL;
0373     }
0374
0375     while (scan < len - sizeof(struct carl9170fw_desc_head)) {
0376         if (fw_data[scan++] == otus_magic[found])
0377             found++;
0378         else
0379             found = 0;
0380
0381         if (scan >= len)
0382             break;
0383
0384         if (found == sizeof(otus_magic))
0385             break;
0386     }
0387
0388     if (found != sizeof(otus_magic))
0389         return NULL;
0390
0391     return (void *)&fw_data[scan - found];
0392 }
0393
0394 int carl9170_parse_firmware(struct ar9170 *ar)
0395 {
0396     const struct carl9170fw_desc_head *fw_desc = NULL;
0397     const struct firmware *fw = ar->fw.fw;
0398     unsigned long header_offset = 0;
0399     int err;
0400
0401     if (WARN_ON(!fw))
0402         return -EINVAL;
0403
0404     fw_desc = carl9170_find_fw_desc(ar, fw->data, fw->size);
0405
0406     if (!fw_desc) {
0407         dev_err(&ar->udev->dev, "unsupported firmware.\n");
0408         return -ENODATA;
0409     }
0410
0411     header_offset = (unsigned long)fw_desc - (unsigned long)fw->data;
0412
0413     err = carl9170_fw_verify_descs(ar, fw_desc, fw->size - header_offset);
0414     if (err) {
0415         dev_err(&ar->udev->dev, "damaged firmware (%d).\n", err);
0416         return err;
0417     }
0418
0419     ar->fw.desc = fw_desc;
0420
0421     carl9170_fw_info(ar);
0422
0423     err = carl9170_fw(ar, fw->data, fw->size);
0424     if (err) {
0425         dev_err(&ar->udev->dev, "failed to parse firmware (%d).\n",
0426             err);
0427         return err;
0428     }
0429
0430     return 0;
0431 }