drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2011 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2011 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-wifi.h"
  74 #include "iwl-dev.h"
  75 #include "iwl-core.h"
  76 #include "iwl-debug.h"
  77 #include "iwl-io.h"
  78 #include "iwl-agn.h"
  79 #include "iwl-testmode.h"
  80 #include "iwl-trans.h"
  81 #include "iwl-bus.h"
  82
  83 /* The TLVs used in the gnl message policy between the kernel module and
  84  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  85  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  86  * See iwl-testmode.h
  87  */
  88 static
  89 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  90         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  91
  92         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
  93         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
  94
  95         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
  96         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
  97         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
  98
  99         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
 100         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 101
 102         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 103
 104         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 105         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 106         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 107
 108         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 109
 110         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 111
 112         [IWL_TM_ATTR_SRAM_ADDR] = { .type = NLA_U32, },
 113         [IWL_TM_ATTR_SRAM_SIZE] = { .type = NLA_U32, },
 114         [IWL_TM_ATTR_SRAM_DUMP] = { .type = NLA_UNSPEC, },
 115
 116         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 117         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 118 };
 119
 120 /*
 121  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 122  * received events from the device
 123  */
 124 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 125 {
 126         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 127         if (pkt)
 128                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 129         else
 130                 return 0;
 131 }
 132
 133
 134 /*
 135  * This function multicasts the spontaneous messages from the device to the
 136  * user space. It is invoked whenever there is a received messages
 137  * from the device. This function is called within the ISR of the rx handlers
 138  * in iwlagn driver.
 139  *
 140  * The parsing of the message content is left to the user space application,
 141  * The message content is treated as unattacked raw data and is encapsulated
 142  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 143  *
 144  * @priv: the instance of iwlwifi device
 145  * @rxb: pointer to rx data content received by the ISR
 146  *
 147  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 148  * For the messages multicasting to the user application, the mandatory
 149  * TLV fields are :
 150  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 151  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 152  */
 153
 154 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 155                                 struct iwl_rx_mem_buffer *rxb)
 156 {
 157         struct ieee80211_hw *hw = priv->hw;
 158         struct sk_buff *skb;
 159         void *data;
 160         int length;
 161
 162         data = (void *)rxb_addr(rxb);
 163         length = get_event_length(rxb);
 164
 165         if (!data || length == 0)
 166                 return;
 167
 168         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 169                                                                 GFP_ATOMIC);
 170         if (skb == NULL) {
 171                 IWL_DEBUG_INFO(priv,
 172                          "Run out of memory for messages to user space ?\n");
 173                 return;
 174         }
 175         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 176         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 177         cfg80211_testmode_event(skb, GFP_ATOMIC);
 178         return;
 179
 180 nla_put_failure:
 181         kfree_skb(skb);
 182         IWL_DEBUG_INFO(priv, "Ouch, overran buffer, check allocation!\n");
 183 }
 184
 185 void iwl_testmode_init(struct iwl_priv *priv)
 186 {
 187         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 188         priv->testmode_trace.trace_enabled = false;
 189         priv->testmode_sram.sram_readed = false;
 190 }
 191
 192 static void iwl_sram_cleanup(struct iwl_priv *priv)
 193 {
 194         if (priv->testmode_sram.sram_readed) {
 195                 kfree(priv->testmode_sram.buff_addr);
 196                 priv->testmode_sram.buff_addr = NULL;
 197                 priv->testmode_sram.buff_size = 0;
 198                 priv->testmode_sram.num_chunks = 0;
 199                 priv->testmode_sram.sram_readed = false;
 200         }
 201 }
 202
 203 static void iwl_trace_cleanup(struct iwl_priv *priv)
 204 {
 205         if (priv->testmode_trace.trace_enabled) {
 206                 if (priv->testmode_trace.cpu_addr &&
 207                     priv->testmode_trace.dma_addr)
 208                         dma_free_coherent(bus(priv)->dev,
 209                                         priv->testmode_trace.total_size,
 210                                         priv->testmode_trace.cpu_addr,
 211                                         priv->testmode_trace.dma_addr);
 212                 priv->testmode_trace.trace_enabled = false;
 213                 priv->testmode_trace.cpu_addr = NULL;
 214                 priv->testmode_trace.trace_addr = NULL;
 215                 priv->testmode_trace.dma_addr = 0;
 216                 priv->testmode_trace.buff_size = 0;
 217                 priv->testmode_trace.total_size = 0;
 218         }
 219 }
 220
 221
 222 void iwl_testmode_cleanup(struct iwl_priv *priv)
 223 {
 224         iwl_trace_cleanup(priv);
 225         iwl_sram_cleanup(priv);
 226 }
 227
 228 /*
 229  * This function handles the user application commands to the ucode.
 230  *
 231  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 232  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 233  * host command to the ucode.
 234  *
 235  * If any mandatory field is missing, -ENOMSG is replied to the user space
 236  * application; otherwise, the actual execution result of the host command to
 237  * ucode is replied.
 238  *
 239  * @hw: ieee80211_hw object that represents the device
 240  * @tb: gnl message fields from the user space
 241  */
 242 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 243 {
 244         struct iwl_priv *priv = hw->priv;
 245         struct iwl_host_cmd cmd;
 246
 247         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 248
 249         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 250             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 251                 IWL_DEBUG_INFO(priv,
 252                         "Error finding ucode command mandatory fields\n");
 253                 return -ENOMSG;
 254         }
 255
 256         cmd.flags = CMD_ON_DEMAND;
 257         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 258         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 259         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 260         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 261         IWL_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 262                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 263         /* ok, let's submit the command to ucode */
 264         return iwl_trans_send_cmd(trans(priv), &cmd);
 265 }
 266
 267
 268 /*
 269  * This function handles the user application commands for register access.
 270  *
 271  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 272  * handlers respectively.
 273  *
 274  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 275  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 276  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 277  * the success of the command execution.
 278  *
 279  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 280  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 281  *
 282  * @hw: ieee80211_hw object that represents the device
 283  * @tb: gnl message fields from the user space
 284  */
 285 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 286 {
 287         struct iwl_priv *priv = hw->priv;
 288         u32 ofs, val32;
 289         u8 val8;
 290         struct sk_buff *skb;
 291         int status = 0;
 292
 293         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 294                 IWL_DEBUG_INFO(priv, "Error finding register offset\n");
 295                 return -ENOMSG;
 296         }
 297         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 298         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 299
 300         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 301         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 302                 val32 = iwl_read32(bus(priv), ofs);
 303                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 304
 305                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 306                 if (!skb) {
 307                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 308                         return -ENOMEM;
 309                 }
 310                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 311                 status = cfg80211_testmode_reply(skb);
 312                 if (status < 0)
 313                         IWL_DEBUG_INFO(priv,
 314                                        "Error sending msg : %d\n", status);
 315                 break;
 316         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 317                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 318                         IWL_DEBUG_INFO(priv,
 319                                        "Error finding value to write\n");
 320                         return -ENOMSG;
 321                 } else {
 322                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 323                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 324                         iwl_write32(bus(priv), ofs, val32);
 325                 }
 326                 break;
 327         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 328                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 329                         IWL_DEBUG_INFO(priv, "Error finding value to write\n");
 330                         return -ENOMSG;
 331                 } else {
 332                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 333                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 334                         iwl_write8(bus(priv), ofs, val8);
 335                 }
 336                 break;
 337         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 338                 val32 = iwl_read_prph(bus(priv), ofs);
 339                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 340
 341                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 342                 if (!skb) {
 343                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 344                         return -ENOMEM;
 345                 }
 346                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 347                 status = cfg80211_testmode_reply(skb);
 348                 if (status < 0)
 349                         IWL_DEBUG_INFO(priv,
 350                                         "Error sending msg : %d\n", status);
 351                 break;
 352         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 353                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 354                         IWL_DEBUG_INFO(priv,
 355                                         "Error finding value to write\n");
 356                         return -ENOMSG;
 357                 } else {
 358                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 359                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 360                         iwl_write_prph(bus(priv), ofs, val32);
 361                 }
 362                 break;
 363         default:
 364                 IWL_DEBUG_INFO(priv, "Unknown testmode register command ID\n");
 365                 return -ENOSYS;
 366         }
 367
 368         return status;
 369
 370 nla_put_failure:
 371         kfree_skb(skb);
 372         return -EMSGSIZE;
 373 }
 374
 375
 376 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 377 {
 378         struct iwl_notification_wait calib_wait;
 379         int ret;
 380
 381         iwl_init_notification_wait(priv->shrd, &calib_wait,
 382                                       CALIBRATION_COMPLETE_NOTIFICATION,
 383                                       NULL, NULL);
 384         ret = iwl_init_alive_start(trans(priv));
 385         if (ret) {
 386                 IWL_DEBUG_INFO(priv,
 387                         "Error configuring init calibration: %d\n", ret);
 388                 goto cfg_init_calib_error;
 389         }
 390
 391         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 392         if (ret)
 393                 IWL_DEBUG_INFO(priv, "Error detecting"
 394                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 395         return ret;
 396
 397 cfg_init_calib_error:
 398         iwl_remove_notification(priv->shrd, &calib_wait);
 399         return ret;
 400 }
 401
 402 /*
 403  * This function handles the user application commands for driver.
 404  *
 405  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 406  * handlers respectively.
 407  *
 408  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 409  * value of the actual command execution is replied to the user application.
 410  *
 411  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 412  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 413  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 414  *
 415  * @hw: ieee80211_hw object that represents the device
 416  * @tb: gnl message fields from the user space
 417  */
 418 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 419 {
 420         struct iwl_priv *priv = hw->priv;
 421         struct iwl_trans *trans = trans(priv);
 422         struct sk_buff *skb;
 423         unsigned char *rsp_data_ptr = NULL;
 424         int status = 0, rsp_data_len = 0;
 425         char buf[32], *ptr = NULL;
 426         unsigned int num, devid;
 427
 428         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 429         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 430                 rsp_data_ptr = (unsigned char *)cfg(priv)->name;
 431                 rsp_data_len = strlen(cfg(priv)->name);
 432                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 433                                                         rsp_data_len + 20);
 434                 if (!skb) {
 435                         IWL_DEBUG_INFO(priv,
 436                                        "Error allocating memory\n");
 437                         return -ENOMEM;
 438                 }
 439                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 440                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 441                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 442                         rsp_data_len, rsp_data_ptr);
 443                 status = cfg80211_testmode_reply(skb);
 444                 if (status < 0)
 445                         IWL_DEBUG_INFO(priv, "Error sending msg : %d\n",
 446                                        status);
 447                 break;
 448
 449         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 450                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_INIT);
 451                 if (status)
 452                         IWL_DEBUG_INFO(priv,
 453                                 "Error loading init ucode: %d\n", status);
 454                 break;
 455
 456         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 457                 iwl_testmode_cfg_init_calib(priv);
 458                 iwl_trans_stop_device(trans);
 459                 break;
 460
 461         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 462                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_REGULAR);
 463                 if (status) {
 464                         IWL_DEBUG_INFO(priv,
 465                                 "Error loading runtime ucode: %d\n", status);
 466                         break;
 467                 }
 468                 status = iwl_alive_start(priv);
 469                 if (status)
 470                         IWL_DEBUG_INFO(priv,
 471                                 "Error starting the device: %d\n", status);
 472                 break;
 473
 474         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 475                 iwl_scan_cancel_timeout(priv, 200);
 476                 iwl_trans_stop_device(trans);
 477                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_WOWLAN);
 478                 if (status) {
 479                         IWL_DEBUG_INFO(priv,
 480                                 "Error loading WOWLAN ucode: %d\n", status);
 481                         break;
 482                 }
 483                 status = iwl_alive_start(priv);
 484                 if (status)
 485                         IWL_DEBUG_INFO(priv,
 486                                 "Error starting the device: %d\n", status);
 487                 break;
 488
 489         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 490                 if (priv->shrd->eeprom) {
 491                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 492                                 cfg(priv)->base_params->eeprom_size + 20);
 493                         if (!skb) {
 494                                 IWL_DEBUG_INFO(priv,
 495                                        "Error allocating memory\n");
 496                                 return -ENOMEM;
 497                         }
 498                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 499                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 500                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 501                                 cfg(priv)->base_params->eeprom_size,
 502                                 priv->shrd->eeprom);
 503                         status = cfg80211_testmode_reply(skb);
 504                         if (status < 0)
 505                                 IWL_DEBUG_INFO(priv,
 506                                                "Error sending msg : %d\n",
 507                                                status);
 508                 } else
 509                         return -EFAULT;
 510                 break;
 511
 512         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 513                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 514                         IWL_DEBUG_INFO(priv,
 515                                        "Error finding fixrate setting\n");
 516                         return -ENOMSG;
 517                 }
 518                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 519                 break;
 520
 521         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 522                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 523
 524                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 525                 if (!skb) {
 526                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 527                         return -ENOMEM;
 528                 }
 529                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 530                 status = cfg80211_testmode_reply(skb);
 531                 if (status < 0)
 532                         IWL_DEBUG_INFO(priv,
 533                                         "Error sending msg : %d\n", status);
 534                 break;
 535
 536         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 537                 bus_get_hw_id(bus(priv), buf, sizeof(buf));
 538                 ptr = buf;
 539                 strsep(&ptr, ":");
 540                 sscanf(strsep(&ptr, ":"), "%x", &num);
 541                 sscanf(strsep(&ptr, ":"), "%x", &devid);
 542                 IWL_INFO(priv, "Device ID = 0x%04x, SubDevice ID= 0x%04x\n",
 543                                 num, devid);
 544                 devid |= (num << 16);
 545
 546                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 547                 if (!skb) {
 548                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 549                         return -ENOMEM;
 550                 }
 551                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 552                 status = cfg80211_testmode_reply(skb);
 553                 if (status < 0)
 554                         IWL_DEBUG_INFO(priv,
 555                                         "Error sending msg : %d\n", status);
 556                 break;
 557
 558         default:
 559                 IWL_DEBUG_INFO(priv, "Unknown testmode driver command ID\n");
 560                 return -ENOSYS;
 561         }
 562         return status;
 563
 564 nla_put_failure:
 565         kfree_skb(skb);
 566         return -EMSGSIZE;
 567 }
 568
 569
 570 /*
 571  * This function handles the user application commands for uCode trace
 572  *
 573  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 574  * handlers respectively.
 575  *
 576  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 577  * value of the actual command execution is replied to the user application.
 578  *
 579  * @hw: ieee80211_hw object that represents the device
 580  * @tb: gnl message fields from the user space
 581  */
 582 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 583 {
 584         struct iwl_priv *priv = hw->priv;
 585         struct sk_buff *skb;
 586         int status = 0;
 587         struct device *dev = bus(priv)->dev;
 588
 589         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 590         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 591                 if (priv->testmode_trace.trace_enabled)
 592                         return -EBUSY;
 593
 594                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 595                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 596                 else
 597                         priv->testmode_trace.buff_size =
 598                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 599                 if (!priv->testmode_trace.buff_size)
 600                         return -EINVAL;
 601                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 602                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 603                         return -EINVAL;
 604
 605                 priv->testmode_trace.total_size =
 606                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 607                 priv->testmode_trace.cpu_addr =
 608                         dma_alloc_coherent(dev,
 609                                            priv->testmode_trace.total_size,
 610                                            &priv->testmode_trace.dma_addr,
 611                                            GFP_KERNEL);
 612                 if (!priv->testmode_trace.cpu_addr)
 613                         return -ENOMEM;
 614                 priv->testmode_trace.trace_enabled = true;
 615                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 616                         priv->testmode_trace.cpu_addr, 0x100);
 617                 memset(priv->testmode_trace.trace_addr, 0x03B,
 618                         priv->testmode_trace.buff_size);
 619                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 620                         sizeof(priv->testmode_trace.dma_addr) + 20);
 621                 if (!skb) {
 622                         IWL_DEBUG_INFO(priv,
 623                                 "Error allocating memory\n");
 624                         iwl_trace_cleanup(priv);
 625                         return -ENOMEM;
 626                 }
 627                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 628                         sizeof(priv->testmode_trace.dma_addr),
 629                         (u64 *)&priv->testmode_trace.dma_addr);
 630                 status = cfg80211_testmode_reply(skb);
 631                 if (status < 0) {
 632                         IWL_DEBUG_INFO(priv,
 633                                        "Error sending msg : %d\n",
 634                                        status);
 635                 }
 636                 priv->testmode_trace.num_chunks =
 637                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 638                                      DUMP_CHUNK_SIZE);
 639                 break;
 640
 641         case IWL_TM_CMD_APP2DEV_END_TRACE:
 642                 iwl_trace_cleanup(priv);
 643                 break;
 644         default:
 645                 IWL_DEBUG_INFO(priv, "Unknown testmode mem command ID\n");
 646                 return -ENOSYS;
 647         }
 648         return status;
 649
 650 nla_put_failure:
 651         kfree_skb(skb);
 652         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 653             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 654                 iwl_trace_cleanup(priv);
 655         return -EMSGSIZE;
 656 }
 657
 658 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 659                                    struct sk_buff *skb,
 660                                    struct netlink_callback *cb)
 661 {
 662         struct iwl_priv *priv = hw->priv;
 663         int idx, length;
 664
 665         if (priv->testmode_trace.trace_enabled &&
 666             priv->testmode_trace.trace_addr) {
 667                 idx = cb->args[4];
 668                 if (idx >= priv->testmode_trace.num_chunks)
 669                         return -ENOENT;
 670                 length = DUMP_CHUNK_SIZE;
 671                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 672                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 673                         length = priv->testmode_trace.buff_size %
 674                                 DUMP_CHUNK_SIZE;
 675
 676                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 677                         priv->testmode_trace.trace_addr +
 678                         (DUMP_CHUNK_SIZE * idx));
 679                 idx++;
 680                 cb->args[4] = idx;
 681                 return 0;
 682         } else
 683                 return -EFAULT;
 684
 685  nla_put_failure:
 686         return -ENOBUFS;
 687 }
 688
 689 /*
 690  * This function handles the user application switch ucode ownership.
 691  *
 692  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 693  * decide who the current owner of the uCode
 694  *
 695  * If the current owner is OWNERSHIP_TM, then the only host command
 696  * can deliver to uCode is from testmode, all the other host commands
 697  * will dropped.
 698  *
 699  * default driver is the owner of uCode in normal operational mode
 700  *
 701  * @hw: ieee80211_hw object that represents the device
 702  * @tb: gnl message fields from the user space
 703  */
 704 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 705 {
 706         struct iwl_priv *priv = hw->priv;
 707         u8 owner;
 708
 709         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 710                 IWL_DEBUG_INFO(priv, "Error finding ucode owner\n");
 711                 return -ENOMSG;
 712         }
 713
 714         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 715         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 716                 priv->shrd->ucode_owner = owner;
 717         else {
 718                 IWL_DEBUG_INFO(priv, "Invalid owner\n");
 719                 return -EINVAL;
 720         }
 721         return 0;
 722 }
 723
 724 /*
 725  * This function handles the user application commands for SRAM data dump
 726  *
 727  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 728  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 729  *
 730  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 731  * previous command has not been delivered to userspace, or -ENOMSG if
 732  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 733  * are missing, or -ENOMEM if the buffer allocation fails.
 734  *
 735  * Otherwise 0 is replied indicating the success of the SRAM reading.
 736  *
 737  * @hw: ieee80211_hw object that represents the device
 738  * @tb: gnl message fields from the user space
 739  */
 740 static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 741 {
 742         struct iwl_priv *priv = hw->priv;
 743         u32 base, ofs, size, maxsize;
 744
 745         if (priv->testmode_sram.sram_readed)
 746                 return -EBUSY;
 747
 748         if (!tb[IWL_TM_ATTR_SRAM_ADDR]) {
 749                 IWL_DEBUG_INFO(priv, "Error finding SRAM offset address\n");
 750                 return -ENOMSG;
 751         }
 752         ofs = nla_get_u32(tb[IWL_TM_ATTR_SRAM_ADDR]);
 753         if (!tb[IWL_TM_ATTR_SRAM_SIZE]) {
 754                 IWL_DEBUG_INFO(priv, "Error finding size for SRAM reading\n");
 755                 return -ENOMSG;
 756         }
 757         size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
 758         switch (priv->shrd->ucode_type) {
 759         case IWL_UCODE_REGULAR:
 760                 maxsize = trans(priv)->ucode_rt.data.len;
 761                 break;
 762         case IWL_UCODE_INIT:
 763                 maxsize = trans(priv)->ucode_init.data.len;
 764                 break;
 765         case IWL_UCODE_WOWLAN:
 766                 maxsize = trans(priv)->ucode_wowlan.data.len;
 767                 break;
 768         case IWL_UCODE_NONE:
 769                 IWL_DEBUG_INFO(priv, "Error, uCode does not been loaded\n");
 770                 return -ENOSYS;
 771         default:
 772                 IWL_DEBUG_INFO(priv, "Error, unsupported uCode type\n");
 773                 return -ENOSYS;
 774         }
 775         if ((ofs + size) > maxsize) {
 776                 IWL_DEBUG_INFO(priv, "Invalid offset/size: out of range\n");
 777                 return -EINVAL;
 778         }
 779         priv->testmode_sram.buff_size = (size / 4) * 4;
 780         priv->testmode_sram.buff_addr =
 781                 kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);
 782         if (priv->testmode_sram.buff_addr == NULL) {
 783                 IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 784                 return -ENOMEM;
 785         }
 786         base = 0x800000;
 787         _iwl_read_targ_mem_words(bus(priv), base + ofs,
 788                                         priv->testmode_sram.buff_addr,
 789                                         priv->testmode_sram.buff_size / 4);
 790         priv->testmode_sram.num_chunks =
 791                 DIV_ROUND_UP(priv->testmode_sram.buff_size, DUMP_CHUNK_SIZE);
 792         priv->testmode_sram.sram_readed = true;
 793         return 0;
 794 }
 795
 796 static int iwl_testmode_sram_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 797                                    struct sk_buff *skb,
 798                                    struct netlink_callback *cb)
 799 {
 800         struct iwl_priv *priv = hw->priv;
 801         int idx, length;
 802
 803         if (priv->testmode_sram.sram_readed) {
 804                 idx = cb->args[4];
 805                 if (idx >= priv->testmode_sram.num_chunks) {
 806                         iwl_sram_cleanup(priv);
 807                         return -ENOENT;
 808                 }
 809                 length = DUMP_CHUNK_SIZE;
 810                 if (((idx + 1) == priv->testmode_sram.num_chunks) &&
 811                     (priv->testmode_sram.buff_size % DUMP_CHUNK_SIZE))
 812                         length = priv->testmode_sram.buff_size %
 813                                 DUMP_CHUNK_SIZE;
 814
 815                 NLA_PUT(skb, IWL_TM_ATTR_SRAM_DUMP, length,
 816                         priv->testmode_sram.buff_addr +
 817                         (DUMP_CHUNK_SIZE * idx));
 818                 idx++;
 819                 cb->args[4] = idx;
 820                 return 0;
 821         } else
 822                 return -EFAULT;
 823
 824  nla_put_failure:
 825         return -ENOBUFS;
 826 }
 827
 828
 829 /* The testmode gnl message handler that takes the gnl message from the
 830  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 831  * invoke the corresponding handlers.
 832  *
 833  * This function is invoked when there is user space application sending
 834  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 835  * by nl80211.
 836  *
 837  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 838  * dispatching it to the corresponding handler.
 839  *
 840  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 841  * -ENOSYS is replied to the user application if the command is unknown;
 842  * Otherwise, the command is dispatched to the respective handler.
 843  *
 844  * @hw: ieee80211_hw object that represents the device
 845  * @data: pointer to user space message
 846  * @len: length in byte of @data
 847  */
 848 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 849 {
 850         struct nlattr *tb[IWL_TM_ATTR_MAX];
 851         struct iwl_priv *priv = hw->priv;
 852         int result;
 853
 854         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 855                         iwl_testmode_gnl_msg_policy);
 856         if (result != 0) {
 857                 IWL_DEBUG_INFO(priv,
 858                                "Error parsing the gnl message : %d\n", result);
 859                 return result;
 860         }
 861
 862         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 863         if (!tb[IWL_TM_ATTR_COMMAND]) {
 864                 IWL_DEBUG_INFO(priv, "Error finding testmode command type\n");
 865                 return -ENOMSG;
 866         }
 867         /* in case multiple accesses to the device happens */
 868         mutex_lock(&priv->shrd->mutex);
 869
 870         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 871         case IWL_TM_CMD_APP2DEV_UCODE:
 872                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 873                 result = iwl_testmode_ucode(hw, tb);
 874                 break;
 875         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 876         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 877         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 878         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 879         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 880                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 881                 result = iwl_testmode_reg(hw, tb);
 882                 break;
 883         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 884         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 885         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 886         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 887         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 888         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 889         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 890         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 891         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 892                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
 893                 result = iwl_testmode_driver(hw, tb);
 894                 break;
 895
 896         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 897         case IWL_TM_CMD_APP2DEV_END_TRACE:
 898         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 899                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
 900                 result = iwl_testmode_trace(hw, tb);
 901                 break;
 902
 903         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
 904                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
 905                 result = iwl_testmode_ownership(hw, tb);
 906                 break;
 907
 908         case IWL_TM_CMD_APP2DEV_READ_SRAM:
 909                 IWL_DEBUG_INFO(priv, "testmode sram read cmd to driver\n");
 910                 result = iwl_testmode_sram(hw, tb);
 911                 break;
 912
 913         default:
 914                 IWL_DEBUG_INFO(priv, "Unknown testmode command\n");
 915                 result = -ENOSYS;
 916                 break;
 917         }
 918
 919         mutex_unlock(&priv->shrd->mutex);
 920         return result;
 921 }
 922
 923 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 924                       struct netlink_callback *cb,
 925                       void *data, int len)
 926 {
 927         struct nlattr *tb[IWL_TM_ATTR_MAX];
 928         struct iwl_priv *priv = hw->priv;
 929         int result;
 930         u32 cmd;
 931
 932         if (cb->args[3]) {
 933                 /* offset by 1 since commands start at 0 */
 934                 cmd = cb->args[3] - 1;
 935         } else {
 936                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 937                                 iwl_testmode_gnl_msg_policy);
 938                 if (result) {
 939                         IWL_DEBUG_INFO(priv,
 940                                "Error parsing the gnl message : %d\n", result);
 941                         return result;
 942                 }
 943
 944                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 945                 if (!tb[IWL_TM_ATTR_COMMAND]) {
 946                         IWL_DEBUG_INFO(priv,
 947                                 "Error finding testmode command type\n");
 948                         return -ENOMSG;
 949                 }
 950                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 951                 cb->args[3] = cmd + 1;
 952         }
 953
 954         /* in case multiple accesses to the device happens */
 955         mutex_lock(&priv->shrd->mutex);
 956         switch (cmd) {
 957         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 958                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
 959                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
 960                 break;
 961         case IWL_TM_CMD_APP2DEV_DUMP_SRAM:
 962                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
 963                 result = iwl_testmode_sram_dump(hw, tb, skb, cb);
 964                 break;
 965         default:
 966                 result = -EINVAL;
 967                 break;
 968         }
 969
 970         mutex_unlock(&priv->shrd->mutex);
 971         return result;
 972 }