1 /******************************************************************************
3 * This file is provided under a dual BSD/GPLv2 license. When using or
4 * redistributing this file, you may do so under either license.
8 * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of version 2 of the GNU General Public License as
12 * published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
24 * The full GNU General Public License is included in this distribution
25 * in the file called LICENSE.GPL.
27 * Contact Information:
28 * Intel Linux Wireless <ilw@linux.intel.com>
29 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
33 * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
34 * All rights reserved.
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
40 * * Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * * Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in
44 * the documentation and/or other materials provided with the
46 * * Neither the name Intel Corporation nor the names of its
47 * contributors may be used to endorse or promote products derived
48 * from this software without specific prior written permission.
50 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
51 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
52 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
53 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
54 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
55 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
56 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
60 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62 *****************************************************************************/
63 #include <linux/init.h>
64 #include <linux/kernel.h>
65 #include <linux/module.h>
66 #include <linux/dma-mapping.h>
67 #include <net/net_namespace.h>
68 #include <linux/netdevice.h>
69 #include <net/cfg80211.h>
70 #include <net/mac80211.h>
71 #include <net/netlink.h>
75 #include "iwl-debug.h"
78 #include "iwl-testmode.h"
79 #include "iwl-trans.h"
84 /* Periphery registers absolute lower bound. This is used in order to
85 * differentiate registery access through HBUS_TARG_PRPH_* and
86 * HBUS_TARG_MEM_* accesses.
88 #define IWL_TM_ABS_PRPH_START (0xA00000)
90 /* The TLVs used in the gnl message policy between the kernel module and
91 * user space application. iwl_testmode_gnl_msg_policy is to be carried
92 * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
96 struct nla_policy iwl_testmode_gnl_msg_policy
[IWL_TM_ATTR_MAX
] = {
97 [IWL_TM_ATTR_COMMAND
] = { .type
= NLA_U32
, },
99 [IWL_TM_ATTR_UCODE_CMD_ID
] = { .type
= NLA_U8
, },
100 [IWL_TM_ATTR_UCODE_CMD_DATA
] = { .type
= NLA_UNSPEC
, },
102 [IWL_TM_ATTR_REG_OFFSET
] = { .type
= NLA_U32
, },
103 [IWL_TM_ATTR_REG_VALUE8
] = { .type
= NLA_U8
, },
104 [IWL_TM_ATTR_REG_VALUE32
] = { .type
= NLA_U32
, },
106 [IWL_TM_ATTR_SYNC_RSP
] = { .type
= NLA_UNSPEC
, },
107 [IWL_TM_ATTR_UCODE_RX_PKT
] = { .type
= NLA_UNSPEC
, },
109 [IWL_TM_ATTR_EEPROM
] = { .type
= NLA_UNSPEC
, },
111 [IWL_TM_ATTR_TRACE_ADDR
] = { .type
= NLA_UNSPEC
, },
112 [IWL_TM_ATTR_TRACE_DUMP
] = { .type
= NLA_UNSPEC
, },
113 [IWL_TM_ATTR_TRACE_SIZE
] = { .type
= NLA_U32
, },
115 [IWL_TM_ATTR_FIXRATE
] = { .type
= NLA_U32
, },
117 [IWL_TM_ATTR_UCODE_OWNER
] = { .type
= NLA_U8
, },
119 [IWL_TM_ATTR_MEM_ADDR
] = { .type
= NLA_U32
, },
120 [IWL_TM_ATTR_BUFFER_SIZE
] = { .type
= NLA_U32
, },
121 [IWL_TM_ATTR_BUFFER_DUMP
] = { .type
= NLA_UNSPEC
, },
123 [IWL_TM_ATTR_FW_VERSION
] = { .type
= NLA_U32
, },
124 [IWL_TM_ATTR_DEVICE_ID
] = { .type
= NLA_U32
, },
125 [IWL_TM_ATTR_FW_TYPE
] = { .type
= NLA_U32
, },
126 [IWL_TM_ATTR_FW_INST_SIZE
] = { .type
= NLA_U32
, },
127 [IWL_TM_ATTR_FW_DATA_SIZE
] = { .type
= NLA_U32
, },
129 [IWL_TM_ATTR_ENABLE_NOTIFICATION
] = {.type
= NLA_FLAG
, },
133 * See the struct iwl_rx_packet in iwl-commands.h for the format of the
134 * received events from the device
136 static inline int get_event_length(struct iwl_rx_cmd_buffer
*rxb
)
138 struct iwl_rx_packet
*pkt
= rxb_addr(rxb
);
140 return le32_to_cpu(pkt
->len_n_flags
) & FH_RSCSR_FRAME_SIZE_MSK
;
147 * This function multicasts the spontaneous messages from the device to the
148 * user space. It is invoked whenever there is a received messages
149 * from the device. This function is called within the ISR of the rx handlers
152 * The parsing of the message content is left to the user space application,
153 * The message content is treated as unattacked raw data and is encapsulated
154 * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
156 * @priv: the instance of iwlwifi device
157 * @rxb: pointer to rx data content received by the ISR
159 * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
160 * For the messages multicasting to the user application, the mandatory
162 * IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
163 * IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
166 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv
*priv
,
167 struct iwl_rx_cmd_buffer
*rxb
)
169 struct ieee80211_hw
*hw
= priv
->hw
;
174 data
= (void *)rxb_addr(rxb
);
175 length
= get_event_length(rxb
);
177 if (!data
|| length
== 0)
180 skb
= cfg80211_testmode_alloc_event_skb(hw
->wiphy
, 20 + length
,
184 "Run out of memory for messages to user space ?\n");
187 if (nla_put_u32(skb
, IWL_TM_ATTR_COMMAND
, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
) ||
188 /* the length doesn't include len_n_flags field, so add it manually */
189 nla_put(skb
, IWL_TM_ATTR_UCODE_RX_PKT
, length
+ sizeof(__le32
), data
))
190 goto nla_put_failure
;
191 cfg80211_testmode_event(skb
, GFP_ATOMIC
);
196 IWL_ERR(priv
, "Ouch, overran buffer, check allocation!\n");
199 void iwl_testmode_init(struct iwl_priv
*priv
)
201 priv
->pre_rx_handler
= NULL
;
202 priv
->testmode_trace
.trace_enabled
= false;
203 priv
->testmode_mem
.read_in_progress
= false;
206 static void iwl_mem_cleanup(struct iwl_priv
*priv
)
208 if (priv
->testmode_mem
.read_in_progress
) {
209 kfree(priv
->testmode_mem
.buff_addr
);
210 priv
->testmode_mem
.buff_addr
= NULL
;
211 priv
->testmode_mem
.buff_size
= 0;
212 priv
->testmode_mem
.num_chunks
= 0;
213 priv
->testmode_mem
.read_in_progress
= false;
217 static void iwl_trace_cleanup(struct iwl_priv
*priv
)
219 if (priv
->testmode_trace
.trace_enabled
) {
220 if (priv
->testmode_trace
.cpu_addr
&&
221 priv
->testmode_trace
.dma_addr
)
222 dma_free_coherent(trans(priv
)->dev
,
223 priv
->testmode_trace
.total_size
,
224 priv
->testmode_trace
.cpu_addr
,
225 priv
->testmode_trace
.dma_addr
);
226 priv
->testmode_trace
.trace_enabled
= false;
227 priv
->testmode_trace
.cpu_addr
= NULL
;
228 priv
->testmode_trace
.trace_addr
= NULL
;
229 priv
->testmode_trace
.dma_addr
= 0;
230 priv
->testmode_trace
.buff_size
= 0;
231 priv
->testmode_trace
.total_size
= 0;
236 void iwl_testmode_cleanup(struct iwl_priv
*priv
)
238 iwl_trace_cleanup(priv
);
239 iwl_mem_cleanup(priv
);
244 * This function handles the user application commands to the ucode.
246 * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
247 * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
248 * host command to the ucode.
250 * If any mandatory field is missing, -ENOMSG is replied to the user space
251 * application; otherwise, waits for the host command to be sent and checks
252 * the return code. In case or error, it is returned, otherwise a reply is
253 * allocated and the reply RX packet
256 * @hw: ieee80211_hw object that represents the device
257 * @tb: gnl message fields from the user space
259 static int iwl_testmode_ucode(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
261 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
262 struct iwl_host_cmd cmd
;
263 struct iwl_rx_packet
*pkt
;
270 memset(&cmd
, 0, sizeof(struct iwl_host_cmd
));
272 if (!tb
[IWL_TM_ATTR_UCODE_CMD_ID
] ||
273 !tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]) {
274 IWL_ERR(priv
, "Missing ucode command mandatory fields\n");
278 cmd
.flags
= CMD_ON_DEMAND
| CMD_SYNC
;
279 cmd_want_skb
= nla_get_flag(tb
[IWL_TM_ATTR_UCODE_CMD_SKB
]);
281 cmd
.flags
|= CMD_WANT_SKB
;
283 cmd
.id
= nla_get_u8(tb
[IWL_TM_ATTR_UCODE_CMD_ID
]);
284 cmd
.data
[0] = nla_data(tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]);
285 cmd
.len
[0] = nla_len(tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]);
286 cmd
.dataflags
[0] = IWL_HCMD_DFL_NOCOPY
;
287 IWL_DEBUG_INFO(priv
, "testmode ucode command ID 0x%x, flags 0x%x,"
288 " len %d\n", cmd
.id
, cmd
.flags
, cmd
.len
[0]);
290 ret
= iwl_dvm_send_cmd(priv
, &cmd
);
292 IWL_ERR(priv
, "Failed to send hcmd\n");
298 /* Handling return of SKB to the user */
301 IWL_ERR(priv
, "HCMD received a null response packet\n");
305 reply_len
= le32_to_cpu(pkt
->len_n_flags
) & FH_RSCSR_FRAME_SIZE_MSK
;
306 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, reply_len
+ 20);
307 reply_buf
= kmalloc(reply_len
, GFP_KERNEL
);
308 if (!skb
|| !reply_buf
) {
314 /* The reply is in a page, that we cannot send to user space. */
315 memcpy(reply_buf
, &(pkt
->hdr
), reply_len
);
318 if (nla_put_u32(skb
, IWL_TM_ATTR_COMMAND
, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
) ||
319 nla_put(skb
, IWL_TM_ATTR_UCODE_RX_PKT
, reply_len
, reply_buf
))
320 goto nla_put_failure
;
321 return cfg80211_testmode_reply(skb
);
324 IWL_DEBUG_INFO(priv
, "Failed creating NL attributes\n");
330 * This function handles the user application commands for register access.
332 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
333 * handlers respectively.
335 * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
336 * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
337 * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
338 * the success of the command execution.
340 * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
341 * value is returned with IWL_TM_ATTR_REG_VALUE32.
343 * @hw: ieee80211_hw object that represents the device
344 * @tb: gnl message fields from the user space
346 static int iwl_testmode_reg(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
348 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
354 if (!tb
[IWL_TM_ATTR_REG_OFFSET
]) {
355 IWL_ERR(priv
, "Missing register offset\n");
358 ofs
= nla_get_u32(tb
[IWL_TM_ATTR_REG_OFFSET
]);
359 IWL_INFO(priv
, "testmode register access command offset 0x%x\n", ofs
);
361 /* Allow access only to FH/CSR/HBUS in direct mode.
362 Since we don't have the upper bounds for the CSR and HBUS segments,
363 we will use only the upper bound of FH for sanity check. */
364 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
365 if ((cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
||
366 cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
||
367 cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
) &&
368 (ofs
>= FH_MEM_UPPER_BOUND
)) {
369 IWL_ERR(priv
, "offset out of segment (0x0 - 0x%x)\n",
375 case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
:
376 val32
= iwl_read_direct32(trans(priv
), ofs
);
377 IWL_INFO(priv
, "32bit value to read 0x%x\n", val32
);
379 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
381 IWL_ERR(priv
, "Memory allocation fail\n");
384 if (nla_put_u32(skb
, IWL_TM_ATTR_REG_VALUE32
, val32
))
385 goto nla_put_failure
;
386 status
= cfg80211_testmode_reply(skb
);
388 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
390 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
:
391 if (!tb
[IWL_TM_ATTR_REG_VALUE32
]) {
392 IWL_ERR(priv
, "Missing value to write\n");
395 val32
= nla_get_u32(tb
[IWL_TM_ATTR_REG_VALUE32
]);
396 IWL_INFO(priv
, "32bit value to write 0x%x\n", val32
);
397 iwl_write_direct32(trans(priv
), ofs
, val32
);
400 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
:
401 if (!tb
[IWL_TM_ATTR_REG_VALUE8
]) {
402 IWL_ERR(priv
, "Missing value to write\n");
405 val8
= nla_get_u8(tb
[IWL_TM_ATTR_REG_VALUE8
]);
406 IWL_INFO(priv
, "8bit value to write 0x%x\n", val8
);
407 iwl_write8(trans(priv
), ofs
, val8
);
411 IWL_ERR(priv
, "Unknown testmode register command ID\n");
423 static int iwl_testmode_cfg_init_calib(struct iwl_priv
*priv
)
425 struct iwl_notification_wait calib_wait
;
426 static const u8 calib_complete
[] = {
427 CALIBRATION_COMPLETE_NOTIFICATION
431 iwl_init_notification_wait(&priv
->notif_wait
, &calib_wait
,
432 calib_complete
, ARRAY_SIZE(calib_complete
),
434 ret
= iwl_init_alive_start(priv
);
436 IWL_ERR(priv
, "Fail init calibration: %d\n", ret
);
437 goto cfg_init_calib_error
;
440 ret
= iwl_wait_notification(&priv
->notif_wait
, &calib_wait
, 2 * HZ
);
442 IWL_ERR(priv
, "Error detecting"
443 " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret
);
446 cfg_init_calib_error
:
447 iwl_remove_notification(&priv
->notif_wait
, &calib_wait
);
452 * This function handles the user application commands for driver.
454 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
455 * handlers respectively.
457 * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
458 * value of the actual command execution is replied to the user application.
460 * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
461 * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
462 * IWL_TM_CMD_DEV2APP_SYNC_RSP.
464 * @hw: ieee80211_hw object that represents the device
465 * @tb: gnl message fields from the user space
467 static int iwl_testmode_driver(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
469 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
470 struct iwl_trans
*trans
= trans(priv
);
472 unsigned char *rsp_data_ptr
= NULL
;
473 int status
= 0, rsp_data_len
= 0;
474 u32 devid
, inst_size
= 0, data_size
= 0;
475 const struct fw_img
*img
;
477 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
478 case IWL_TM_CMD_APP2DEV_GET_DEVICENAME
:
479 rsp_data_ptr
= (unsigned char *)cfg(priv
)->name
;
480 rsp_data_len
= strlen(cfg(priv
)->name
);
481 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
484 IWL_ERR(priv
, "Memory allocation fail\n");
487 if (nla_put_u32(skb
, IWL_TM_ATTR_COMMAND
,
488 IWL_TM_CMD_DEV2APP_SYNC_RSP
) ||
489 nla_put(skb
, IWL_TM_ATTR_SYNC_RSP
,
490 rsp_data_len
, rsp_data_ptr
))
491 goto nla_put_failure
;
492 status
= cfg80211_testmode_reply(skb
);
494 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
497 case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW
:
498 status
= iwl_load_ucode_wait_alive(priv
, IWL_UCODE_INIT
);
500 IWL_ERR(priv
, "Error loading init ucode: %d\n", status
);
503 case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB
:
504 iwl_testmode_cfg_init_calib(priv
);
505 priv
->ucode_loaded
= false;
506 iwl_trans_stop_device(trans
);
509 case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW
:
510 status
= iwl_load_ucode_wait_alive(priv
, IWL_UCODE_REGULAR
);
513 "Error loading runtime ucode: %d\n", status
);
516 status
= iwl_alive_start(priv
);
519 "Error starting the device: %d\n", status
);
522 case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW
:
523 iwl_scan_cancel_timeout(priv
, 200);
524 priv
->ucode_loaded
= false;
525 iwl_trans_stop_device(trans
);
526 status
= iwl_load_ucode_wait_alive(priv
, IWL_UCODE_WOWLAN
);
529 "Error loading WOWLAN ucode: %d\n", status
);
532 status
= iwl_alive_start(priv
);
535 "Error starting the device: %d\n", status
);
538 case IWL_TM_CMD_APP2DEV_GET_EEPROM
:
539 if (priv
->shrd
->eeprom
) {
540 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
541 cfg(priv
)->base_params
->eeprom_size
+ 20);
543 IWL_ERR(priv
, "Memory allocation fail\n");
546 if (nla_put_u32(skb
, IWL_TM_ATTR_COMMAND
,
547 IWL_TM_CMD_DEV2APP_EEPROM_RSP
) ||
548 nla_put(skb
, IWL_TM_ATTR_EEPROM
,
549 cfg(priv
)->base_params
->eeprom_size
,
551 goto nla_put_failure
;
552 status
= cfg80211_testmode_reply(skb
);
554 IWL_ERR(priv
, "Error sending msg : %d\n",
560 case IWL_TM_CMD_APP2DEV_FIXRATE_REQ
:
561 if (!tb
[IWL_TM_ATTR_FIXRATE
]) {
562 IWL_ERR(priv
, "Missing fixrate setting\n");
565 priv
->tm_fixed_rate
= nla_get_u32(tb
[IWL_TM_ATTR_FIXRATE
]);
568 case IWL_TM_CMD_APP2DEV_GET_FW_VERSION
:
569 IWL_INFO(priv
, "uCode version raw: 0x%x\n",
570 priv
->fw
->ucode_ver
);
572 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
574 IWL_ERR(priv
, "Memory allocation fail\n");
577 if (nla_put_u32(skb
, IWL_TM_ATTR_FW_VERSION
,
578 priv
->fw
->ucode_ver
))
579 goto nla_put_failure
;
580 status
= cfg80211_testmode_reply(skb
);
582 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
585 case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID
:
586 devid
= trans(priv
)->hw_id
;
587 IWL_INFO(priv
, "hw version: 0x%x\n", devid
);
589 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
591 IWL_ERR(priv
, "Memory allocation fail\n");
594 if (nla_put_u32(skb
, IWL_TM_ATTR_DEVICE_ID
, devid
))
595 goto nla_put_failure
;
596 status
= cfg80211_testmode_reply(skb
);
598 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
601 case IWL_TM_CMD_APP2DEV_GET_FW_INFO
:
602 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20 + 8);
604 IWL_ERR(priv
, "Memory allocation fail\n");
607 if (!priv
->ucode_loaded
) {
608 IWL_ERR(priv
, "No uCode has not been loaded\n");
611 img
= &priv
->fw
->img
[priv
->cur_ucode
];
612 inst_size
= img
->sec
[IWL_UCODE_SECTION_INST
].len
;
613 data_size
= img
->sec
[IWL_UCODE_SECTION_DATA
].len
;
615 if (nla_put_u32(skb
, IWL_TM_ATTR_FW_TYPE
, priv
->cur_ucode
) ||
616 nla_put_u32(skb
, IWL_TM_ATTR_FW_INST_SIZE
, inst_size
) ||
617 nla_put_u32(skb
, IWL_TM_ATTR_FW_DATA_SIZE
, data_size
))
618 goto nla_put_failure
;
619 status
= cfg80211_testmode_reply(skb
);
621 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
625 IWL_ERR(priv
, "Unknown testmode driver command ID\n");
637 * This function handles the user application commands for uCode trace
639 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
640 * handlers respectively.
642 * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
643 * value of the actual command execution is replied to the user application.
645 * @hw: ieee80211_hw object that represents the device
646 * @tb: gnl message fields from the user space
648 static int iwl_testmode_trace(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
650 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
653 struct device
*dev
= trans(priv
)->dev
;
655 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
656 case IWL_TM_CMD_APP2DEV_BEGIN_TRACE
:
657 if (priv
->testmode_trace
.trace_enabled
)
660 if (!tb
[IWL_TM_ATTR_TRACE_SIZE
])
661 priv
->testmode_trace
.buff_size
= TRACE_BUFF_SIZE_DEF
;
663 priv
->testmode_trace
.buff_size
=
664 nla_get_u32(tb
[IWL_TM_ATTR_TRACE_SIZE
]);
665 if (!priv
->testmode_trace
.buff_size
)
667 if (priv
->testmode_trace
.buff_size
< TRACE_BUFF_SIZE_MIN
||
668 priv
->testmode_trace
.buff_size
> TRACE_BUFF_SIZE_MAX
)
671 priv
->testmode_trace
.total_size
=
672 priv
->testmode_trace
.buff_size
+ TRACE_BUFF_PADD
;
673 priv
->testmode_trace
.cpu_addr
=
674 dma_alloc_coherent(dev
,
675 priv
->testmode_trace
.total_size
,
676 &priv
->testmode_trace
.dma_addr
,
678 if (!priv
->testmode_trace
.cpu_addr
)
680 priv
->testmode_trace
.trace_enabled
= true;
681 priv
->testmode_trace
.trace_addr
= (u8
*)PTR_ALIGN(
682 priv
->testmode_trace
.cpu_addr
, 0x100);
683 memset(priv
->testmode_trace
.trace_addr
, 0x03B,
684 priv
->testmode_trace
.buff_size
);
685 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
686 sizeof(priv
->testmode_trace
.dma_addr
) + 20);
688 IWL_ERR(priv
, "Memory allocation fail\n");
689 iwl_trace_cleanup(priv
);
692 if (nla_put(skb
, IWL_TM_ATTR_TRACE_ADDR
,
693 sizeof(priv
->testmode_trace
.dma_addr
),
694 (u64
*)&priv
->testmode_trace
.dma_addr
))
695 goto nla_put_failure
;
696 status
= cfg80211_testmode_reply(skb
);
698 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
700 priv
->testmode_trace
.num_chunks
=
701 DIV_ROUND_UP(priv
->testmode_trace
.buff_size
,
705 case IWL_TM_CMD_APP2DEV_END_TRACE
:
706 iwl_trace_cleanup(priv
);
709 IWL_ERR(priv
, "Unknown testmode mem command ID\n");
716 if (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]) ==
717 IWL_TM_CMD_APP2DEV_BEGIN_TRACE
)
718 iwl_trace_cleanup(priv
);
722 static int iwl_testmode_trace_dump(struct ieee80211_hw
*hw
,
724 struct netlink_callback
*cb
)
726 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
729 if (priv
->testmode_trace
.trace_enabled
&&
730 priv
->testmode_trace
.trace_addr
) {
732 if (idx
>= priv
->testmode_trace
.num_chunks
)
734 length
= DUMP_CHUNK_SIZE
;
735 if (((idx
+ 1) == priv
->testmode_trace
.num_chunks
) &&
736 (priv
->testmode_trace
.buff_size
% DUMP_CHUNK_SIZE
))
737 length
= priv
->testmode_trace
.buff_size
%
740 if (nla_put(skb
, IWL_TM_ATTR_TRACE_DUMP
, length
,
741 priv
->testmode_trace
.trace_addr
+
742 (DUMP_CHUNK_SIZE
* idx
)))
743 goto nla_put_failure
;
755 * This function handles the user application switch ucode ownership.
757 * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
758 * decide who the current owner of the uCode
760 * If the current owner is OWNERSHIP_TM, then the only host command
761 * can deliver to uCode is from testmode, all the other host commands
764 * default driver is the owner of uCode in normal operational mode
766 * @hw: ieee80211_hw object that represents the device
767 * @tb: gnl message fields from the user space
769 static int iwl_testmode_ownership(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
771 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
774 if (!tb
[IWL_TM_ATTR_UCODE_OWNER
]) {
775 IWL_ERR(priv
, "Missing ucode owner\n");
779 owner
= nla_get_u8(tb
[IWL_TM_ATTR_UCODE_OWNER
]);
780 if (owner
== IWL_OWNERSHIP_DRIVER
) {
781 priv
->ucode_owner
= owner
;
782 priv
->pre_rx_handler
= NULL
;
783 } else if (owner
== IWL_OWNERSHIP_TM
) {
784 priv
->pre_rx_handler
= iwl_testmode_ucode_rx_pkt
;
785 priv
->ucode_owner
= owner
;
787 IWL_ERR(priv
, "Invalid owner\n");
793 static int iwl_testmode_indirect_read(struct iwl_priv
*priv
, u32 addr
, u32 size
)
795 struct iwl_trans
*trans
= trans(priv
);
801 priv
->testmode_mem
.buff_size
= size
;
802 priv
->testmode_mem
.buff_addr
=
803 kmalloc(priv
->testmode_mem
.buff_size
, GFP_KERNEL
);
804 if (priv
->testmode_mem
.buff_addr
== NULL
)
807 /* Hard-coded periphery absolute address */
808 if (IWL_TM_ABS_PRPH_START
<= addr
&&
809 addr
< IWL_TM_ABS_PRPH_START
+ PRPH_END
) {
810 spin_lock_irqsave(&trans
->reg_lock
, flags
);
811 iwl_grab_nic_access(trans
);
812 iwl_write32(trans
, HBUS_TARG_PRPH_RADDR
,
814 for (i
= 0; i
< size
; i
+= 4)
815 *(u32
*)(priv
->testmode_mem
.buff_addr
+ i
) =
816 iwl_read32(trans
, HBUS_TARG_PRPH_RDAT
);
817 iwl_release_nic_access(trans
);
818 spin_unlock_irqrestore(&trans
->reg_lock
, flags
);
819 } else { /* target memory (SRAM) */
820 _iwl_read_targ_mem_words(trans
, addr
,
821 priv
->testmode_mem
.buff_addr
,
822 priv
->testmode_mem
.buff_size
/ 4);
825 priv
->testmode_mem
.num_chunks
=
826 DIV_ROUND_UP(priv
->testmode_mem
.buff_size
, DUMP_CHUNK_SIZE
);
827 priv
->testmode_mem
.read_in_progress
= true;
832 static int iwl_testmode_indirect_write(struct iwl_priv
*priv
, u32 addr
,
833 u32 size
, unsigned char *buf
)
835 struct iwl_trans
*trans
= trans(priv
);
839 if (IWL_TM_ABS_PRPH_START
<= addr
&&
840 addr
< IWL_TM_ABS_PRPH_START
+ PRPH_END
) {
841 /* Periphery writes can be 1-3 bytes long, or DWORDs */
843 memcpy(&val
, buf
, size
);
844 spin_lock_irqsave(&trans
->reg_lock
, flags
);
845 iwl_grab_nic_access(trans
);
846 iwl_write32(trans
, HBUS_TARG_PRPH_WADDR
,
847 (addr
& 0x0000FFFF) |
849 iwl_write32(trans
, HBUS_TARG_PRPH_WDAT
, val
);
850 iwl_release_nic_access(trans
);
851 /* needed after consecutive writes w/o read */
853 spin_unlock_irqrestore(&trans
->reg_lock
, flags
);
857 for (i
= 0; i
< size
; i
+= 4)
858 iwl_write_prph(trans
, addr
+i
,
861 } else if (iwlagn_hw_valid_rtc_data_addr(addr
) ||
862 (IWLAGN_RTC_INST_LOWER_BOUND
<= addr
&&
863 addr
< IWLAGN_RTC_INST_UPPER_BOUND
)) {
864 _iwl_write_targ_mem_words(trans
, addr
, buf
, size
/4);
871 * This function handles the user application commands for SRAM data dump
873 * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
874 * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
876 * Several error will be retured, -EBUSY if the SRAM data retrieved by
877 * previous command has not been delivered to userspace, or -ENOMSG if
878 * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
879 * are missing, or -ENOMEM if the buffer allocation fails.
881 * Otherwise 0 is replied indicating the success of the SRAM reading.
883 * @hw: ieee80211_hw object that represents the device
884 * @tb: gnl message fields from the user space
886 static int iwl_testmode_indirect_mem(struct ieee80211_hw
*hw
,
889 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
893 /* Both read and write should be blocked, for atomicity */
894 if (priv
->testmode_mem
.read_in_progress
)
897 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
898 if (!tb
[IWL_TM_ATTR_MEM_ADDR
]) {
899 IWL_ERR(priv
, "Error finding memory offset address\n");
902 addr
= nla_get_u32(tb
[IWL_TM_ATTR_MEM_ADDR
]);
903 if (!tb
[IWL_TM_ATTR_BUFFER_SIZE
]) {
904 IWL_ERR(priv
, "Error finding size for memory reading\n");
907 size
= nla_get_u32(tb
[IWL_TM_ATTR_BUFFER_SIZE
]);
909 if (cmd
== IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ
)
910 return iwl_testmode_indirect_read(priv
, addr
, size
);
912 if (!tb
[IWL_TM_ATTR_BUFFER_DUMP
])
914 buf
= (unsigned char *) nla_data(tb
[IWL_TM_ATTR_BUFFER_DUMP
]);
915 return iwl_testmode_indirect_write(priv
, addr
, size
, buf
);
919 static int iwl_testmode_buffer_dump(struct ieee80211_hw
*hw
,
921 struct netlink_callback
*cb
)
923 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
926 if (priv
->testmode_mem
.read_in_progress
) {
928 if (idx
>= priv
->testmode_mem
.num_chunks
) {
929 iwl_mem_cleanup(priv
);
932 length
= DUMP_CHUNK_SIZE
;
933 if (((idx
+ 1) == priv
->testmode_mem
.num_chunks
) &&
934 (priv
->testmode_mem
.buff_size
% DUMP_CHUNK_SIZE
))
935 length
= priv
->testmode_mem
.buff_size
%
938 if (nla_put(skb
, IWL_TM_ATTR_BUFFER_DUMP
, length
,
939 priv
->testmode_mem
.buff_addr
+
940 (DUMP_CHUNK_SIZE
* idx
)))
941 goto nla_put_failure
;
952 static int iwl_testmode_notifications(struct ieee80211_hw
*hw
,
955 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
958 enable
= nla_get_flag(tb
[IWL_TM_ATTR_ENABLE_NOTIFICATION
]);
960 priv
->pre_rx_handler
= iwl_testmode_ucode_rx_pkt
;
962 priv
->pre_rx_handler
= NULL
;
967 /* The testmode gnl message handler that takes the gnl message from the
968 * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
969 * invoke the corresponding handlers.
971 * This function is invoked when there is user space application sending
972 * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
975 * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
976 * dispatching it to the corresponding handler.
978 * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
979 * -ENOSYS is replied to the user application if the command is unknown;
980 * Otherwise, the command is dispatched to the respective handler.
982 * @hw: ieee80211_hw object that represents the device
983 * @data: pointer to user space message
984 * @len: length in byte of @data
986 int iwlagn_mac_testmode_cmd(struct ieee80211_hw
*hw
, void *data
, int len
)
988 struct nlattr
*tb
[IWL_TM_ATTR_MAX
];
989 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
992 result
= nla_parse(tb
, IWL_TM_ATTR_MAX
- 1, data
, len
,
993 iwl_testmode_gnl_msg_policy
);
995 IWL_ERR(priv
, "Error parsing the gnl message : %d\n", result
);
999 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
1000 if (!tb
[IWL_TM_ATTR_COMMAND
]) {
1001 IWL_ERR(priv
, "Missing testmode command type\n");
1004 /* in case multiple accesses to the device happens */
1005 mutex_lock(&priv
->mutex
);
1007 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
1008 case IWL_TM_CMD_APP2DEV_UCODE
:
1009 IWL_DEBUG_INFO(priv
, "testmode cmd to uCode\n");
1010 result
= iwl_testmode_ucode(hw
, tb
);
1012 case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
:
1013 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
:
1014 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
:
1015 IWL_DEBUG_INFO(priv
, "testmode cmd to register\n");
1016 result
= iwl_testmode_reg(hw
, tb
);
1018 case IWL_TM_CMD_APP2DEV_GET_DEVICENAME
:
1019 case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW
:
1020 case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB
:
1021 case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW
:
1022 case IWL_TM_CMD_APP2DEV_GET_EEPROM
:
1023 case IWL_TM_CMD_APP2DEV_FIXRATE_REQ
:
1024 case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW
:
1025 case IWL_TM_CMD_APP2DEV_GET_FW_VERSION
:
1026 case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID
:
1027 case IWL_TM_CMD_APP2DEV_GET_FW_INFO
:
1028 IWL_DEBUG_INFO(priv
, "testmode cmd to driver\n");
1029 result
= iwl_testmode_driver(hw
, tb
);
1032 case IWL_TM_CMD_APP2DEV_BEGIN_TRACE
:
1033 case IWL_TM_CMD_APP2DEV_END_TRACE
:
1034 case IWL_TM_CMD_APP2DEV_READ_TRACE
:
1035 IWL_DEBUG_INFO(priv
, "testmode uCode trace cmd to driver\n");
1036 result
= iwl_testmode_trace(hw
, tb
);
1039 case IWL_TM_CMD_APP2DEV_OWNERSHIP
:
1040 IWL_DEBUG_INFO(priv
, "testmode change uCode ownership\n");
1041 result
= iwl_testmode_ownership(hw
, tb
);
1044 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ
:
1045 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE
:
1046 IWL_DEBUG_INFO(priv
, "testmode indirect memory cmd "
1048 result
= iwl_testmode_indirect_mem(hw
, tb
);
1051 case IWL_TM_CMD_APP2DEV_NOTIFICATIONS
:
1052 IWL_DEBUG_INFO(priv
, "testmode notifications cmd "
1054 result
= iwl_testmode_notifications(hw
, tb
);
1058 IWL_ERR(priv
, "Unknown testmode command\n");
1063 mutex_unlock(&priv
->mutex
);
1067 int iwlagn_mac_testmode_dump(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1068 struct netlink_callback
*cb
,
1069 void *data
, int len
)
1071 struct nlattr
*tb
[IWL_TM_ATTR_MAX
];
1072 struct iwl_priv
*priv
= IWL_MAC80211_GET_DVM(hw
);
1077 /* offset by 1 since commands start at 0 */
1078 cmd
= cb
->args
[3] - 1;
1080 result
= nla_parse(tb
, IWL_TM_ATTR_MAX
- 1, data
, len
,
1081 iwl_testmode_gnl_msg_policy
);
1084 "Error parsing the gnl message : %d\n", result
);
1088 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
1089 if (!tb
[IWL_TM_ATTR_COMMAND
]) {
1090 IWL_ERR(priv
, "Missing testmode command type\n");
1093 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
1094 cb
->args
[3] = cmd
+ 1;
1097 /* in case multiple accesses to the device happens */
1098 mutex_lock(&priv
->mutex
);
1100 case IWL_TM_CMD_APP2DEV_READ_TRACE
:
1101 IWL_DEBUG_INFO(priv
, "uCode trace cmd to driver\n");
1102 result
= iwl_testmode_trace_dump(hw
, skb
, cb
);
1104 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP
:
1105 IWL_DEBUG_INFO(priv
, "testmode sram dump cmd to driver\n");
1106 result
= iwl_testmode_buffer_dump(hw
, skb
, cb
);
1113 mutex_unlock(&priv
->mutex
);