drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2011 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2011 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-dev.h"
  74 #include "iwl-core.h"
  75 #include "iwl-debug.h"
  76 #include "iwl-io.h"
  77 #include "iwl-agn.h"
  78 #include "iwl-testmode.h"
  79 #include "iwl-trans.h"
  80 #include "iwl-bus.h"
  81
  82 /* The TLVs used in the gnl message policy between the kernel module and
  83  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  84  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  85  * See iwl-testmode.h
  86  */
  87 static
  88 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  89         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  90
  91         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
  92         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
  93
  94         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
  95         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
  96         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
  97
  98         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
  99         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 100
 101         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 102
 103         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 104         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 105         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 106
 107         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 108
 109         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 110
 111         [IWL_TM_ATTR_SRAM_ADDR] = { .type = NLA_U32, },
 112         [IWL_TM_ATTR_SRAM_SIZE] = { .type = NLA_U32, },
 113         [IWL_TM_ATTR_SRAM_DUMP] = { .type = NLA_UNSPEC, },
 114
 115         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 116         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 117 };
 118
 119 /*
 120  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 121  * received events from the device
 122  */
 123 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 124 {
 125         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 126         if (pkt)
 127                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 128         else
 129                 return 0;
 130 }
 131
 132
 133 /*
 134  * This function multicasts the spontaneous messages from the device to the
 135  * user space. It is invoked whenever there is a received messages
 136  * from the device. This function is called within the ISR of the rx handlers
 137  * in iwlagn driver.
 138  *
 139  * The parsing of the message content is left to the user space application,
 140  * The message content is treated as unattacked raw data and is encapsulated
 141  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 142  *
 143  * @priv: the instance of iwlwifi device
 144  * @rxb: pointer to rx data content received by the ISR
 145  *
 146  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 147  * For the messages multicasting to the user application, the mandatory
 148  * TLV fields are :
 149  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 150  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 151  */
 152
 153 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 154                                 struct iwl_rx_mem_buffer *rxb)
 155 {
 156         struct ieee80211_hw *hw = priv->hw;
 157         struct sk_buff *skb;
 158         void *data;
 159         int length;
 160
 161         data = (void *)rxb_addr(rxb);
 162         length = get_event_length(rxb);
 163
 164         if (!data || length == 0)
 165                 return;
 166
 167         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 168                                                                 GFP_ATOMIC);
 169         if (skb == NULL) {
 170                 IWL_DEBUG_INFO(priv,
 171                          "Run out of memory for messages to user space ?\n");
 172                 return;
 173         }
 174         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 175         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 176         cfg80211_testmode_event(skb, GFP_ATOMIC);
 177         return;
 178
 179 nla_put_failure:
 180         kfree_skb(skb);
 181         IWL_DEBUG_INFO(priv, "Ouch, overran buffer, check allocation!\n");
 182 }
 183
 184 void iwl_testmode_init(struct iwl_priv *priv)
 185 {
 186         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 187         priv->testmode_trace.trace_enabled = false;
 188         priv->testmode_sram.sram_readed = false;
 189 }
 190
 191 static void iwl_sram_cleanup(struct iwl_priv *priv)
 192 {
 193         if (priv->testmode_sram.sram_readed) {
 194                 kfree(priv->testmode_sram.buff_addr);
 195                 priv->testmode_sram.buff_addr = NULL;
 196                 priv->testmode_sram.buff_size = 0;
 197                 priv->testmode_sram.num_chunks = 0;
 198                 priv->testmode_sram.sram_readed = false;
 199         }
 200 }
 201
 202 static void iwl_trace_cleanup(struct iwl_priv *priv)
 203 {
 204         if (priv->testmode_trace.trace_enabled) {
 205                 if (priv->testmode_trace.cpu_addr &&
 206                     priv->testmode_trace.dma_addr)
 207                         dma_free_coherent(bus(priv)->dev,
 208                                         priv->testmode_trace.total_size,
 209                                         priv->testmode_trace.cpu_addr,
 210                                         priv->testmode_trace.dma_addr);
 211                 priv->testmode_trace.trace_enabled = false;
 212                 priv->testmode_trace.cpu_addr = NULL;
 213                 priv->testmode_trace.trace_addr = NULL;
 214                 priv->testmode_trace.dma_addr = 0;
 215                 priv->testmode_trace.buff_size = 0;
 216                 priv->testmode_trace.total_size = 0;
 217         }
 218 }
 219
 220
 221 void iwl_testmode_cleanup(struct iwl_priv *priv)
 222 {
 223         iwl_trace_cleanup(priv);
 224         iwl_sram_cleanup(priv);
 225 }
 226
 227 /*
 228  * This function handles the user application commands to the ucode.
 229  *
 230  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 231  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 232  * host command to the ucode.
 233  *
 234  * If any mandatory field is missing, -ENOMSG is replied to the user space
 235  * application; otherwise, the actual execution result of the host command to
 236  * ucode is replied.
 237  *
 238  * @hw: ieee80211_hw object that represents the device
 239  * @tb: gnl message fields from the user space
 240  */
 241 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 242 {
 243         struct iwl_priv *priv = hw->priv;
 244         struct iwl_host_cmd cmd;
 245
 246         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 247
 248         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 249             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 250                 IWL_DEBUG_INFO(priv,
 251                         "Error finding ucode command mandatory fields\n");
 252                 return -ENOMSG;
 253         }
 254
 255         cmd.flags = CMD_ON_DEMAND;
 256         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 257         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 258         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 259         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 260         IWL_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 261                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 262         /* ok, let's submit the command to ucode */
 263         return iwl_trans_send_cmd(trans(priv), &cmd);
 264 }
 265
 266
 267 /*
 268  * This function handles the user application commands for register access.
 269  *
 270  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 271  * handlers respectively.
 272  *
 273  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 274  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 275  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 276  * the success of the command execution.
 277  *
 278  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 279  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 280  *
 281  * @hw: ieee80211_hw object that represents the device
 282  * @tb: gnl message fields from the user space
 283  */
 284 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 285 {
 286         struct iwl_priv *priv = hw->priv;
 287         u32 ofs, val32;
 288         u8 val8;
 289         struct sk_buff *skb;
 290         int status = 0;
 291
 292         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 293                 IWL_DEBUG_INFO(priv, "Error finding register offset\n");
 294                 return -ENOMSG;
 295         }
 296         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 297         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 298
 299         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 300         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 301                 val32 = iwl_read32(bus(priv), ofs);
 302                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 303
 304                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 305                 if (!skb) {
 306                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 307                         return -ENOMEM;
 308                 }
 309                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 310                 status = cfg80211_testmode_reply(skb);
 311                 if (status < 0)
 312                         IWL_DEBUG_INFO(priv,
 313                                        "Error sending msg : %d\n", status);
 314                 break;
 315         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 316                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 317                         IWL_DEBUG_INFO(priv,
 318                                        "Error finding value to write\n");
 319                         return -ENOMSG;
 320                 } else {
 321                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 322                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 323                         iwl_write32(bus(priv), ofs, val32);
 324                 }
 325                 break;
 326         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 327                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 328                         IWL_DEBUG_INFO(priv, "Error finding value to write\n");
 329                         return -ENOMSG;
 330                 } else {
 331                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 332                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 333                         iwl_write8(bus(priv), ofs, val8);
 334                 }
 335                 break;
 336         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 337                 val32 = iwl_read_prph(bus(priv), ofs);
 338                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 339
 340                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 341                 if (!skb) {
 342                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 343                         return -ENOMEM;
 344                 }
 345                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 346                 status = cfg80211_testmode_reply(skb);
 347                 if (status < 0)
 348                         IWL_DEBUG_INFO(priv,
 349                                         "Error sending msg : %d\n", status);
 350                 break;
 351         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 352                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 353                         IWL_DEBUG_INFO(priv,
 354                                         "Error finding value to write\n");
 355                         return -ENOMSG;
 356                 } else {
 357                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 358                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 359                         iwl_write_prph(bus(priv), ofs, val32);
 360                 }
 361                 break;
 362         default:
 363                 IWL_DEBUG_INFO(priv, "Unknown testmode register command ID\n");
 364                 return -ENOSYS;
 365         }
 366
 367         return status;
 368
 369 nla_put_failure:
 370         kfree_skb(skb);
 371         return -EMSGSIZE;
 372 }
 373
 374
 375 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 376 {
 377         struct iwl_notification_wait calib_wait;
 378         int ret;
 379
 380         iwl_init_notification_wait(priv->shrd, &calib_wait,
 381                                       CALIBRATION_COMPLETE_NOTIFICATION,
 382                                       NULL, NULL);
 383         ret = iwlagn_init_alive_start(priv);
 384         if (ret) {
 385                 IWL_DEBUG_INFO(priv,
 386                         "Error configuring init calibration: %d\n", ret);
 387                 goto cfg_init_calib_error;
 388         }
 389
 390         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 391         if (ret)
 392                 IWL_DEBUG_INFO(priv, "Error detecting"
 393                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 394         return ret;
 395
 396 cfg_init_calib_error:
 397         iwl_remove_notification(priv->shrd, &calib_wait);
 398         return ret;
 399 }
 400
 401 /*
 402  * This function handles the user application commands for driver.
 403  *
 404  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 405  * handlers respectively.
 406  *
 407  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 408  * value of the actual command execution is replied to the user application.
 409  *
 410  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 411  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 412  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 413  *
 414  * @hw: ieee80211_hw object that represents the device
 415  * @tb: gnl message fields from the user space
 416  */
 417 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 418 {
 419         struct iwl_priv *priv = hw->priv;
 420         struct sk_buff *skb;
 421         unsigned char *rsp_data_ptr = NULL;
 422         int status = 0, rsp_data_len = 0;
 423         char buf[32], *ptr = NULL;
 424         unsigned int num, devid;
 425
 426         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 427         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 428                 rsp_data_ptr = (unsigned char *)priv->cfg->name;
 429                 rsp_data_len = strlen(priv->cfg->name);
 430                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 431                                                         rsp_data_len + 20);
 432                 if (!skb) {
 433                         IWL_DEBUG_INFO(priv,
 434                                        "Error allocating memory\n");
 435                         return -ENOMEM;
 436                 }
 437                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 438                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 439                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 440                         rsp_data_len, rsp_data_ptr);
 441                 status = cfg80211_testmode_reply(skb);
 442                 if (status < 0)
 443                         IWL_DEBUG_INFO(priv, "Error sending msg : %d\n",
 444                                        status);
 445                 break;
 446
 447         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 448                 status = iwlagn_load_ucode_wait_alive(priv, IWL_UCODE_INIT);
 449                 if (status)
 450                         IWL_DEBUG_INFO(priv,
 451                                 "Error loading init ucode: %d\n", status);
 452                 break;
 453
 454         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 455                 iwl_testmode_cfg_init_calib(priv);
 456                 iwl_trans_stop_device(trans(priv));
 457                 break;
 458
 459         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 460                 status = iwlagn_load_ucode_wait_alive(priv, IWL_UCODE_REGULAR);
 461                 if (status) {
 462                         IWL_DEBUG_INFO(priv,
 463                                 "Error loading runtime ucode: %d\n", status);
 464                         break;
 465                 }
 466                 status = iwl_alive_start(priv);
 467                 if (status)
 468                         IWL_DEBUG_INFO(priv,
 469                                 "Error starting the device: %d\n", status);
 470                 break;
 471
 472         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 473                 iwl_scan_cancel_timeout(priv, 200);
 474                 iwl_trans_stop_device(trans(priv));
 475                 status = iwlagn_load_ucode_wait_alive(priv, IWL_UCODE_WOWLAN);
 476                 if (status) {
 477                         IWL_DEBUG_INFO(priv,
 478                                 "Error loading WOWLAN ucode: %d\n", status);
 479                         break;
 480                 }
 481                 status = iwl_alive_start(priv);
 482                 if (status)
 483                         IWL_DEBUG_INFO(priv,
 484                                 "Error starting the device: %d\n", status);
 485                 break;
 486
 487         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 488                 if (priv->shrd->eeprom) {
 489                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 490                                 priv->cfg->base_params->eeprom_size + 20);
 491                         if (!skb) {
 492                                 IWL_DEBUG_INFO(priv,
 493                                        "Error allocating memory\n");
 494                                 return -ENOMEM;
 495                         }
 496                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 497                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 498                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 499                                 priv->cfg->base_params->eeprom_size,
 500                                 priv->shrd->eeprom);
 501                         status = cfg80211_testmode_reply(skb);
 502                         if (status < 0)
 503                                 IWL_DEBUG_INFO(priv,
 504                                                "Error sending msg : %d\n",
 505                                                status);
 506                 } else
 507                         return -EFAULT;
 508                 break;
 509
 510         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 511                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 512                         IWL_DEBUG_INFO(priv,
 513                                        "Error finding fixrate setting\n");
 514                         return -ENOMSG;
 515                 }
 516                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 517                 break;
 518
 519         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 520                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 521
 522                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 523                 if (!skb) {
 524                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 525                         return -ENOMEM;
 526                 }
 527                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 528                 status = cfg80211_testmode_reply(skb);
 529                 if (status < 0)
 530                         IWL_DEBUG_INFO(priv,
 531                                         "Error sending msg : %d\n", status);
 532                 break;
 533
 534         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 535                 bus_get_hw_id(bus(priv), buf, sizeof(buf));
 536                 ptr = buf;
 537                 strsep(&ptr, ":");
 538                 sscanf(strsep(&ptr, ":"), "%x", &num);
 539                 sscanf(strsep(&ptr, ":"), "%x", &devid);
 540                 IWL_INFO(priv, "Device ID = 0x%04x, SubDevice ID= 0x%04x\n",
 541                                 num, devid);
 542                 devid |= (num << 16);
 543
 544                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 545                 if (!skb) {
 546                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 547                         return -ENOMEM;
 548                 }
 549                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 550                 status = cfg80211_testmode_reply(skb);
 551                 if (status < 0)
 552                         IWL_DEBUG_INFO(priv,
 553                                         "Error sending msg : %d\n", status);
 554                 break;
 555
 556         default:
 557                 IWL_DEBUG_INFO(priv, "Unknown testmode driver command ID\n");
 558                 return -ENOSYS;
 559         }
 560         return status;
 561
 562 nla_put_failure:
 563         kfree_skb(skb);
 564         return -EMSGSIZE;
 565 }
 566
 567
 568 /*
 569  * This function handles the user application commands for uCode trace
 570  *
 571  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 572  * handlers respectively.
 573  *
 574  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 575  * value of the actual command execution is replied to the user application.
 576  *
 577  * @hw: ieee80211_hw object that represents the device
 578  * @tb: gnl message fields from the user space
 579  */
 580 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 581 {
 582         struct iwl_priv *priv = hw->priv;
 583         struct sk_buff *skb;
 584         int status = 0;
 585         struct device *dev = bus(priv)->dev;
 586
 587         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 588         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 589                 if (priv->testmode_trace.trace_enabled)
 590                         return -EBUSY;
 591
 592                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 593                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 594                 else
 595                         priv->testmode_trace.buff_size =
 596                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 597                 if (!priv->testmode_trace.buff_size)
 598                         return -EINVAL;
 599                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 600                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 601                         return -EINVAL;
 602
 603                 priv->testmode_trace.total_size =
 604                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 605                 priv->testmode_trace.cpu_addr =
 606                         dma_alloc_coherent(dev,
 607                                            priv->testmode_trace.total_size,
 608                                            &priv->testmode_trace.dma_addr,
 609                                            GFP_KERNEL);
 610                 if (!priv->testmode_trace.cpu_addr)
 611                         return -ENOMEM;
 612                 priv->testmode_trace.trace_enabled = true;
 613                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 614                         priv->testmode_trace.cpu_addr, 0x100);
 615                 memset(priv->testmode_trace.trace_addr, 0x03B,
 616                         priv->testmode_trace.buff_size);
 617                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 618                         sizeof(priv->testmode_trace.dma_addr) + 20);
 619                 if (!skb) {
 620                         IWL_DEBUG_INFO(priv,
 621                                 "Error allocating memory\n");
 622                         iwl_trace_cleanup(priv);
 623                         return -ENOMEM;
 624                 }
 625                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 626                         sizeof(priv->testmode_trace.dma_addr),
 627                         (u64 *)&priv->testmode_trace.dma_addr);
 628                 status = cfg80211_testmode_reply(skb);
 629                 if (status < 0) {
 630                         IWL_DEBUG_INFO(priv,
 631                                        "Error sending msg : %d\n",
 632                                        status);
 633                 }
 634                 priv->testmode_trace.num_chunks =
 635                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 636                                      DUMP_CHUNK_SIZE);
 637                 break;
 638
 639         case IWL_TM_CMD_APP2DEV_END_TRACE:
 640                 iwl_trace_cleanup(priv);
 641                 break;
 642         default:
 643                 IWL_DEBUG_INFO(priv, "Unknown testmode mem command ID\n");
 644                 return -ENOSYS;
 645         }
 646         return status;
 647
 648 nla_put_failure:
 649         kfree_skb(skb);
 650         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 651             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 652                 iwl_trace_cleanup(priv);
 653         return -EMSGSIZE;
 654 }
 655
 656 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 657                                    struct sk_buff *skb,
 658                                    struct netlink_callback *cb)
 659 {
 660         struct iwl_priv *priv = hw->priv;
 661         int idx, length;
 662
 663         if (priv->testmode_trace.trace_enabled &&
 664             priv->testmode_trace.trace_addr) {
 665                 idx = cb->args[4];
 666                 if (idx >= priv->testmode_trace.num_chunks)
 667                         return -ENOENT;
 668                 length = DUMP_CHUNK_SIZE;
 669                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 670                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 671                         length = priv->testmode_trace.buff_size %
 672                                 DUMP_CHUNK_SIZE;
 673
 674                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 675                         priv->testmode_trace.trace_addr +
 676                         (DUMP_CHUNK_SIZE * idx));
 677                 idx++;
 678                 cb->args[4] = idx;
 679                 return 0;
 680         } else
 681                 return -EFAULT;
 682
 683  nla_put_failure:
 684         return -ENOBUFS;
 685 }
 686
 687 /*
 688  * This function handles the user application switch ucode ownership.
 689  *
 690  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 691  * decide who the current owner of the uCode
 692  *
 693  * If the current owner is OWNERSHIP_TM, then the only host command
 694  * can deliver to uCode is from testmode, all the other host commands
 695  * will dropped.
 696  *
 697  * default driver is the owner of uCode in normal operational mode
 698  *
 699  * @hw: ieee80211_hw object that represents the device
 700  * @tb: gnl message fields from the user space
 701  */
 702 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 703 {
 704         struct iwl_priv *priv = hw->priv;
 705         u8 owner;
 706
 707         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 708                 IWL_DEBUG_INFO(priv, "Error finding ucode owner\n");
 709                 return -ENOMSG;
 710         }
 711
 712         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 713         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 714                 priv->shrd->ucode_owner = owner;
 715         else {
 716                 IWL_DEBUG_INFO(priv, "Invalid owner\n");
 717                 return -EINVAL;
 718         }
 719         return 0;
 720 }
 721
 722 /*
 723  * This function handles the user application commands for SRAM data dump
 724  *
 725  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 726  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 727  *
 728  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 729  * previous command has not been delivered to userspace, or -ENOMSG if
 730  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 731  * are missing, or -ENOMEM if the buffer allocation fails.
 732  *
 733  * Otherwise 0 is replied indicating the success of the SRAM reading.
 734  *
 735  * @hw: ieee80211_hw object that represents the device
 736  * @tb: gnl message fields from the user space
 737  */
 738 static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 739 {
 740         struct iwl_priv *priv = hw->priv;
 741         u32 base, ofs, size, maxsize;
 742
 743         if (priv->testmode_sram.sram_readed)
 744                 return -EBUSY;
 745
 746         if (!tb[IWL_TM_ATTR_SRAM_ADDR]) {
 747                 IWL_DEBUG_INFO(priv, "Error finding SRAM offset address\n");
 748                 return -ENOMSG;
 749         }
 750         ofs = nla_get_u32(tb[IWL_TM_ATTR_SRAM_ADDR]);
 751         if (!tb[IWL_TM_ATTR_SRAM_SIZE]) {
 752                 IWL_DEBUG_INFO(priv, "Error finding size for SRAM reading\n");
 753                 return -ENOMSG;
 754         }
 755         size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
 756         switch (priv->shrd->ucode_type) {
 757         case IWL_UCODE_REGULAR:
 758                 maxsize = trans(priv)->ucode_rt.data.len;
 759                 break;
 760         case IWL_UCODE_INIT:
 761                 maxsize = trans(priv)->ucode_init.data.len;
 762                 break;
 763         case IWL_UCODE_WOWLAN:
 764                 maxsize = trans(priv)->ucode_wowlan.data.len;
 765                 break;
 766         case IWL_UCODE_NONE:
 767                 IWL_DEBUG_INFO(priv, "Error, uCode does not been loaded\n");
 768                 return -ENOSYS;
 769         default:
 770                 IWL_DEBUG_INFO(priv, "Error, unsupported uCode type\n");
 771                 return -ENOSYS;
 772         }
 773         if ((ofs + size) > maxsize) {
 774                 IWL_DEBUG_INFO(priv, "Invalid offset/size: out of range\n");
 775                 return -EINVAL;
 776         }
 777         priv->testmode_sram.buff_size = (size / 4) * 4;
 778         priv->testmode_sram.buff_addr =
 779                 kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);
 780         if (priv->testmode_sram.buff_addr == NULL) {
 781                 IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 782                 return -ENOMEM;
 783         }
 784         base = 0x800000;
 785         _iwl_read_targ_mem_words(bus(priv), base + ofs,
 786                                         priv->testmode_sram.buff_addr,
 787                                         priv->testmode_sram.buff_size / 4);
 788         priv->testmode_sram.num_chunks =
 789                 DIV_ROUND_UP(priv->testmode_sram.buff_size, DUMP_CHUNK_SIZE);
 790         priv->testmode_sram.sram_readed = true;
 791         return 0;
 792 }
 793
 794 static int iwl_testmode_sram_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 795                                    struct sk_buff *skb,
 796                                    struct netlink_callback *cb)
 797 {
 798         struct iwl_priv *priv = hw->priv;
 799         int idx, length;
 800
 801         if (priv->testmode_sram.sram_readed) {
 802                 idx = cb->args[4];
 803                 if (idx >= priv->testmode_sram.num_chunks) {
 804                         iwl_sram_cleanup(priv);
 805                         return -ENOENT;
 806                 }
 807                 length = DUMP_CHUNK_SIZE;
 808                 if (((idx + 1) == priv->testmode_sram.num_chunks) &&
 809                     (priv->testmode_sram.buff_size % DUMP_CHUNK_SIZE))
 810                         length = priv->testmode_sram.buff_size %
 811                                 DUMP_CHUNK_SIZE;
 812
 813                 NLA_PUT(skb, IWL_TM_ATTR_SRAM_DUMP, length,
 814                         priv->testmode_sram.buff_addr +
 815                         (DUMP_CHUNK_SIZE * idx));
 816                 idx++;
 817                 cb->args[4] = idx;
 818                 return 0;
 819         } else
 820                 return -EFAULT;
 821
 822  nla_put_failure:
 823         return -ENOBUFS;
 824 }
 825
 826
 827 /* The testmode gnl message handler that takes the gnl message from the
 828  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 829  * invoke the corresponding handlers.
 830  *
 831  * This function is invoked when there is user space application sending
 832  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 833  * by nl80211.
 834  *
 835  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 836  * dispatching it to the corresponding handler.
 837  *
 838  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 839  * -ENOSYS is replied to the user application if the command is unknown;
 840  * Otherwise, the command is dispatched to the respective handler.
 841  *
 842  * @hw: ieee80211_hw object that represents the device
 843  * @data: pointer to user space message
 844  * @len: length in byte of @data
 845  */
 846 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 847 {
 848         struct nlattr *tb[IWL_TM_ATTR_MAX];
 849         struct iwl_priv *priv = hw->priv;
 850         int result;
 851
 852         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 853                         iwl_testmode_gnl_msg_policy);
 854         if (result != 0) {
 855                 IWL_DEBUG_INFO(priv,
 856                                "Error parsing the gnl message : %d\n", result);
 857                 return result;
 858         }
 859
 860         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 861         if (!tb[IWL_TM_ATTR_COMMAND]) {
 862                 IWL_DEBUG_INFO(priv, "Error finding testmode command type\n");
 863                 return -ENOMSG;
 864         }
 865         /* in case multiple accesses to the device happens */
 866         mutex_lock(&priv->shrd->mutex);
 867
 868         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 869         case IWL_TM_CMD_APP2DEV_UCODE:
 870                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 871                 result = iwl_testmode_ucode(hw, tb);
 872                 break;
 873         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 874         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 875         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 876         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 877         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 878                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 879                 result = iwl_testmode_reg(hw, tb);
 880                 break;
 881         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 882         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 883         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 884         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 885         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 886         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 887         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 888         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 889         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 890                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
 891                 result = iwl_testmode_driver(hw, tb);
 892                 break;
 893
 894         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 895         case IWL_TM_CMD_APP2DEV_END_TRACE:
 896         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 897                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
 898                 result = iwl_testmode_trace(hw, tb);
 899                 break;
 900
 901         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
 902                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
 903                 result = iwl_testmode_ownership(hw, tb);
 904                 break;
 905
 906         case IWL_TM_CMD_APP2DEV_READ_SRAM:
 907                 IWL_DEBUG_INFO(priv, "testmode sram read cmd to driver\n");
 908                 result = iwl_testmode_sram(hw, tb);
 909                 break;
 910
 911         default:
 912                 IWL_DEBUG_INFO(priv, "Unknown testmode command\n");
 913                 result = -ENOSYS;
 914                 break;
 915         }
 916
 917         mutex_unlock(&priv->shrd->mutex);
 918         return result;
 919 }
 920
 921 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 922                       struct netlink_callback *cb,
 923                       void *data, int len)
 924 {
 925         struct nlattr *tb[IWL_TM_ATTR_MAX];
 926         struct iwl_priv *priv = hw->priv;
 927         int result;
 928         u32 cmd;
 929
 930         if (cb->args[3]) {
 931                 /* offset by 1 since commands start at 0 */
 932                 cmd = cb->args[3] - 1;
 933         } else {
 934                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 935                                 iwl_testmode_gnl_msg_policy);
 936                 if (result) {
 937                         IWL_DEBUG_INFO(priv,
 938                                "Error parsing the gnl message : %d\n", result);
 939                         return result;
 940                 }
 941
 942                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 943                 if (!tb[IWL_TM_ATTR_COMMAND]) {
 944                         IWL_DEBUG_INFO(priv,
 945                                 "Error finding testmode command type\n");
 946                         return -ENOMSG;
 947                 }
 948                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 949                 cb->args[3] = cmd + 1;
 950         }
 951
 952         /* in case multiple accesses to the device happens */
 953         mutex_lock(&priv->shrd->mutex);
 954         switch (cmd) {
 955         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 956                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
 957                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
 958                 break;
 959         case IWL_TM_CMD_APP2DEV_DUMP_SRAM:
 960                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
 961                 result = iwl_testmode_sram_dump(hw, tb, skb, cb);
 962                 break;
 963         default:
 964                 result = -EINVAL;
 965                 break;
 966         }
 967
 968         mutex_unlock(&priv->shrd->mutex);
 969         return result;
 970 }