linux-kernel - MAC address in wl1251 NVS data (Was: Re: wl1251 NVS calibration data format)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 17 Dec 2016 14:10:57 +0100
From:   Pali Rohár <pali.rohar@...il.com>
To:     Sebastian Reichel <sre@...nel.org>
Cc:     Gery Kahn <gery.kahn@...il.com>, Shahar Lev <shahar@...ery.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        Pavel Machek <pavel@....cz>,
        Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>
Subject: MAC address in wl1251 NVS data (Was: Re: wl1251 NVS calibration data format)

> On Sat, Dec 17, 2016 at 12:14:50PM +0100, Pali Rohár wrote:
> > > [1] http://notaz.gp2x.de/misc/pnd/wl1251/nvs_map.txt
> > In that description is something about STA mac address:
> > 

    019       02           //length

> > 01a       6d           //STA_ADDR_L Register Address.  (STA MAC
> > Address)
> > 01b       54           //
> > 01c       00           //STA_ADDR_L Register
> > 01d       00           //
> > 01e       32           //
> > 01f       28           //
> > 020       00           //STA_ADDR_H Register Data.

    021       08           //
    022       00           //
    023       00           //

So... above data means:

019 - number of words
01a - low bits of offset applied with mask 0xfe
01b - high bits of offset
01c-01f first word
020-023 second word

Interpreted as: at address offset 0x536c are written two words 
0x28320000 and 0x00000800

wl1271 driver has in linux/drivers/net/wireless/ti/wlcore/boot.c this:

	/* update current MAC address to NVS */
	nvs_ptr[11] = wl->addresses[0].addr[0];
	nvs_ptr[10] = wl->addresses[0].addr[1];
	nvs_ptr[6] = wl->addresses[0].addr[2];
	nvs_ptr[5] = wl->addresses[0].addr[3];
	nvs_ptr[4] = wl->addresses[0].addr[4];
	nvs_ptr[3] = wl->addresses[0].addr[5];

Looking at wl1271-nvs.bin file (which is "modified" in kernel by boot.c)

000: 01
001: 6d
002: 54
003: 00
004: 00
005: ef
006: be

Means: at address offset 0x536c is written one word 0xBEEF0000

007: 01
008: 71
009: 54
00a: ad
00b: de
00c: 00
00d: 00

Means: at address offset 0x5371 is written one word 0x0000DEAD

Above boot.c kernel code updates those data to MAC address, so at 
address offset 0x536c is written four low bytes of MAC address and to 
0x5371 are written remaining two bytes. So 00:00:DE:AD:BE:EF

So conclusion: address offset for wl1271 (where is written MAC address) 
is exactly same as for wl1251 which is marked in that documentation as 
STA_ADDR_L Register.

Btw, in our wl1251-nvs.bin found in Maemo rootfs, which is exactly same 
as in linux-firmware.git tree there are those data:

019: 02
01a: 6d
01b: 54
01c: 09
01d: 03
01e: 07
01f: 20
020: 00
021: 00
022: 00
023: 00

So hardcoded MAC address in wl1251-nvs.bin is: 00:00:20:07:03:09. Which 
is assigned to DIAB. Strange that it is not TI...

-- 
Pali Rohár
pali.rohar@...il.com

Download attachment "signature.asc " of type "application/pgp-signature" (199 bytes)