qcacld: Fix issues in loading signed single binary firmware

- Fix typecast of the signed header that leads to accessing
  invalid memory area

- Use the MSB of action field in the one binary header to
  check if the binary is signed or not. Currently it's been
  done using the target CHIP ID. Using the action field can
  support signed firmware in multiple revisions of AR6320

- As the one binary header action field's MSB is used to indicate
  whether binary is signed or not, add mask while checking the
  action type to see if the binary is for download only or to be
  executed as well

Change-Id: Ia766db19597674228b35a4b655e63ed7006e7804
CRs-Fixed: 614255

2 files changed, 16 insertions, 20 deletions

diff --git a/CORE/SERVICES/BMI/fw_one_bin.h b/CORE/SERVICES/BMI/fw_one_bin.h
index 14c4cc3c88d6..4f7c40cb2242 100644
--- a/CORE/SERVICES/BMI/fw_one_bin.h
+++ b/CORE/SERVICES/BMI/fw_one_bin.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -41,8 +41,10 @@
 #define ONE_BIN_FORMAT_VER    (ONE_BIN_FORMAT_MAJOR << 16 | ONE_BIN_FORMAT_MINOR)
 
 /* CHIP ID */
-#define AR6320_1_0_CHIP_ID      0x50000000
-#define AR6320_1_1_CHIP_ID      0x50000001
+#define AR6320_1_0_CHIP_ID      0x5000000
+#define AR6320_1_1_CHIP_ID      0x5000001
+#define AR6320_1_3_CHIP_ID      0x5000003
+#define AR6320_2_0_CHIP_ID      0x5010000
 
 /* WLAN BINARY_ID */
 #define WLAN_SETUP_BIN_ID     0x01
@@ -59,8 +61,9 @@
 #define UTF_GROUP_ID          0x40000000
 
 /* ACTION */
-#define ACTION_DOWNLOAD       0x1 /* download only */
-#define ACTION_DOWNLOAD_EXEC  0x3 /* download binary and send BMI to execute */
+#define ACTION_PARSE_SIG      0x80000000   /* parse signature		  */
+#define ACTION_DOWNLOAD       0x1	   /* download only		  */
+#define ACTION_DOWNLOAD_EXEC  0x3	   /* download binary and execute */
 
 /* Binary Meta Header */
 typedef struct {
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index 26e2ed4f154c..18e498c96aa6 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -173,18 +173,10 @@ static int ol_transfer_single_bin_file(struct ol_softc *scn,
 		binary_len = one_bin_header->binary_len;
 		next_tag_offset = one_bin_header->next_tag_off;
 
-		switch (one_bin_header->chip_id)
-		{
-		default:
-			fw_sign = FALSE;
-			break;
-		case AR6320_1_0_CHIP_ID:
-			fw_sign = FALSE;
-			break;
-		case AR6320_1_1_CHIP_ID:
+		if (one_bin_header->action & ACTION_PARSE_SIG)
 			fw_sign = TRUE;
-			break;
-		}
+		else
+			fw_sign = FALSE;
 
 		if (fw_sign)
 		{
@@ -198,8 +190,8 @@ static int ol_transfer_single_bin_file(struct ol_softc *scn,
 				status = A_ERROR;
 				goto exit;
 			}
-			sign_header = (SIGN_HEADER_T *)(u_int8_t *)fw_entry_data
-					+ binary_offset;
+			sign_header = (SIGN_HEADER_T *)((u_int8_t *)fw_entry_data
+					+ binary_offset);
 
 			status = BMISignStreamStart(scn->hif_hdl, address,
 						    (u_int8_t *)fw_entry_data
@@ -251,7 +243,8 @@ static int ol_transfer_single_bin_file(struct ol_softc *scn,
 			}
 		}
 
-		if (one_bin_header->action == ACTION_DOWNLOAD_EXEC)
+		if ((one_bin_header->action & ACTION_DOWNLOAD_EXEC)	\
+						== ACTION_DOWNLOAD_EXEC)
 		{
 			param = 0;
 			BMIExecute(scn->hif_hdl, address, &param, scn);