1 /******************************************************************************
3 * This file is provided under a dual BSD/GPLv2 license. When using or
4 * redistributing this file, you may do so under either license.
8 * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of version 2 of the GNU General Public License as
12 * published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
24 * The full GNU General Public License is included in this distribution
25 * in the file called LICENSE.GPL.
27 * Contact Information:
28 * Intel Linux Wireless <ilw@linux.intel.com>
29 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
33 * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
34 * All rights reserved.
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
40 * * Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * * Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in
44 * the documentation and/or other materials provided with the
46 * * Neither the name Intel Corporation nor the names of its
47 * contributors may be used to endorse or promote products derived
48 * from this software without specific prior written permission.
50 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
51 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
52 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
53 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
54 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
55 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
56 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
60 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62 *****************************************************************************/
63 #include <linux/init.h>
64 #include <linux/kernel.h>
65 #include <linux/module.h>
66 #include <linux/dma-mapping.h>
67 #include <net/net_namespace.h>
68 #include <linux/netdevice.h>
69 #include <net/cfg80211.h>
70 #include <net/mac80211.h>
71 #include <net/netlink.h>
76 #include "iwl-debug.h"
79 #include "iwl-testmode.h"
80 #include "iwl-trans.h"
85 /* Periphery registers absolute lower bound. This is used in order to
86 * differentiate registery access through HBUS_TARG_PRPH_* and
87 * HBUS_TARG_MEM_* accesses.
89 #define IWL_TM_ABS_PRPH_START (0xA00000)
91 /* The TLVs used in the gnl message policy between the kernel module and
92 * user space application. iwl_testmode_gnl_msg_policy is to be carried
93 * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
97 struct nla_policy iwl_testmode_gnl_msg_policy
[IWL_TM_ATTR_MAX
] = {
98 [IWL_TM_ATTR_COMMAND
] = { .type
= NLA_U32
, },
100 [IWL_TM_ATTR_UCODE_CMD_ID
] = { .type
= NLA_U8
, },
101 [IWL_TM_ATTR_UCODE_CMD_DATA
] = { .type
= NLA_UNSPEC
, },
103 [IWL_TM_ATTR_REG_OFFSET
] = { .type
= NLA_U32
, },
104 [IWL_TM_ATTR_REG_VALUE8
] = { .type
= NLA_U8
, },
105 [IWL_TM_ATTR_REG_VALUE32
] = { .type
= NLA_U32
, },
107 [IWL_TM_ATTR_SYNC_RSP
] = { .type
= NLA_UNSPEC
, },
108 [IWL_TM_ATTR_UCODE_RX_PKT
] = { .type
= NLA_UNSPEC
, },
110 [IWL_TM_ATTR_EEPROM
] = { .type
= NLA_UNSPEC
, },
112 [IWL_TM_ATTR_TRACE_ADDR
] = { .type
= NLA_UNSPEC
, },
113 [IWL_TM_ATTR_TRACE_DUMP
] = { .type
= NLA_UNSPEC
, },
114 [IWL_TM_ATTR_TRACE_SIZE
] = { .type
= NLA_U32
, },
116 [IWL_TM_ATTR_FIXRATE
] = { .type
= NLA_U32
, },
118 [IWL_TM_ATTR_UCODE_OWNER
] = { .type
= NLA_U8
, },
120 [IWL_TM_ATTR_MEM_ADDR
] = { .type
= NLA_U32
, },
121 [IWL_TM_ATTR_BUFFER_SIZE
] = { .type
= NLA_U32
, },
122 [IWL_TM_ATTR_BUFFER_DUMP
] = { .type
= NLA_UNSPEC
, },
124 [IWL_TM_ATTR_FW_VERSION
] = { .type
= NLA_U32
, },
125 [IWL_TM_ATTR_DEVICE_ID
] = { .type
= NLA_U32
, },
126 [IWL_TM_ATTR_FW_TYPE
] = { .type
= NLA_U32
, },
127 [IWL_TM_ATTR_FW_INST_SIZE
] = { .type
= NLA_U32
, },
128 [IWL_TM_ATTR_FW_DATA_SIZE
] = { .type
= NLA_U32
, },
132 * See the struct iwl_rx_packet in iwl-commands.h for the format of the
133 * received events from the device
135 static inline int get_event_length(struct iwl_rx_mem_buffer
*rxb
)
137 struct iwl_rx_packet
*pkt
= rxb_addr(rxb
);
139 return le32_to_cpu(pkt
->len_n_flags
) & FH_RSCSR_FRAME_SIZE_MSK
;
146 * This function multicasts the spontaneous messages from the device to the
147 * user space. It is invoked whenever there is a received messages
148 * from the device. This function is called within the ISR of the rx handlers
151 * The parsing of the message content is left to the user space application,
152 * The message content is treated as unattacked raw data and is encapsulated
153 * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
155 * @priv: the instance of iwlwifi device
156 * @rxb: pointer to rx data content received by the ISR
158 * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
159 * For the messages multicasting to the user application, the mandatory
161 * IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
162 * IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
165 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv
*priv
,
166 struct iwl_rx_mem_buffer
*rxb
)
168 struct ieee80211_hw
*hw
= priv
->hw
;
173 data
= (void *)rxb_addr(rxb
);
174 length
= get_event_length(rxb
);
176 if (!data
|| length
== 0)
179 skb
= cfg80211_testmode_alloc_event_skb(hw
->wiphy
, 20 + length
,
183 "Run out of memory for messages to user space ?\n");
186 NLA_PUT_U32(skb
, IWL_TM_ATTR_COMMAND
, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
);
187 NLA_PUT(skb
, IWL_TM_ATTR_UCODE_RX_PKT
, length
, data
);
188 cfg80211_testmode_event(skb
, GFP_ATOMIC
);
193 IWL_ERR(priv
, "Ouch, overran buffer, check allocation!\n");
196 void iwl_testmode_init(struct iwl_priv
*priv
)
198 priv
->pre_rx_handler
= iwl_testmode_ucode_rx_pkt
;
199 priv
->testmode_trace
.trace_enabled
= false;
200 priv
->testmode_mem
.read_in_progress
= false;
203 static void iwl_mem_cleanup(struct iwl_priv
*priv
)
205 if (priv
->testmode_mem
.read_in_progress
) {
206 kfree(priv
->testmode_mem
.buff_addr
);
207 priv
->testmode_mem
.buff_addr
= NULL
;
208 priv
->testmode_mem
.buff_size
= 0;
209 priv
->testmode_mem
.num_chunks
= 0;
210 priv
->testmode_mem
.read_in_progress
= false;
214 static void iwl_trace_cleanup(struct iwl_priv
*priv
)
216 if (priv
->testmode_trace
.trace_enabled
) {
217 if (priv
->testmode_trace
.cpu_addr
&&
218 priv
->testmode_trace
.dma_addr
)
219 dma_free_coherent(trans(priv
)->dev
,
220 priv
->testmode_trace
.total_size
,
221 priv
->testmode_trace
.cpu_addr
,
222 priv
->testmode_trace
.dma_addr
);
223 priv
->testmode_trace
.trace_enabled
= false;
224 priv
->testmode_trace
.cpu_addr
= NULL
;
225 priv
->testmode_trace
.trace_addr
= NULL
;
226 priv
->testmode_trace
.dma_addr
= 0;
227 priv
->testmode_trace
.buff_size
= 0;
228 priv
->testmode_trace
.total_size
= 0;
233 void iwl_testmode_cleanup(struct iwl_priv
*priv
)
235 iwl_trace_cleanup(priv
);
236 iwl_mem_cleanup(priv
);
241 * This function handles the user application commands to the ucode.
243 * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
244 * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
245 * host command to the ucode.
247 * If any mandatory field is missing, -ENOMSG is replied to the user space
248 * application; otherwise, waits for the host command to be sent and checks
249 * the return code. In case or error, it is returned, otherwise a reply is
250 * allocated and the reply RX packet
253 * @hw: ieee80211_hw object that represents the device
254 * @tb: gnl message fields from the user space
256 static int iwl_testmode_ucode(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
258 struct iwl_priv
*priv
= hw
->priv
;
259 struct iwl_host_cmd cmd
;
260 struct iwl_rx_packet
*pkt
;
267 memset(&cmd
, 0, sizeof(struct iwl_host_cmd
));
269 if (!tb
[IWL_TM_ATTR_UCODE_CMD_ID
] ||
270 !tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]) {
271 IWL_ERR(priv
, "Missing ucode command mandatory fields\n");
275 cmd
.flags
= CMD_ON_DEMAND
| CMD_SYNC
;
276 cmd_want_skb
= nla_get_flag(tb
[IWL_TM_ATTR_UCODE_CMD_SKB
]);
278 cmd
.flags
|= CMD_WANT_SKB
;
280 cmd
.id
= nla_get_u8(tb
[IWL_TM_ATTR_UCODE_CMD_ID
]);
281 cmd
.data
[0] = nla_data(tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]);
282 cmd
.len
[0] = nla_len(tb
[IWL_TM_ATTR_UCODE_CMD_DATA
]);
283 cmd
.dataflags
[0] = IWL_HCMD_DFL_NOCOPY
;
284 IWL_DEBUG_INFO(priv
, "testmode ucode command ID 0x%x, flags 0x%x,"
285 " len %d\n", cmd
.id
, cmd
.flags
, cmd
.len
[0]);
287 ret
= iwl_trans_send_cmd(trans(priv
), &cmd
);
289 IWL_ERR(priv
, "Failed to send hcmd\n");
295 /* Handling return of SKB to the user */
296 pkt
= (struct iwl_rx_packet
*)cmd
.reply_page
;
298 IWL_ERR(priv
, "HCMD received a null response packet\n");
302 reply_len
= le32_to_cpu(pkt
->len_n_flags
) & FH_RSCSR_FRAME_SIZE_MSK
;
303 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, reply_len
+ 20);
304 reply_buf
= kmalloc(reply_len
, GFP_KERNEL
);
305 if (!skb
|| !reply_buf
) {
311 /* The reply is in a page, that we cannot send to user space. */
312 memcpy(reply_buf
, &(pkt
->hdr
), reply_len
);
313 iwl_free_pages(priv
->shrd
, cmd
.reply_page
);
315 NLA_PUT_U32(skb
, IWL_TM_ATTR_COMMAND
, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
);
316 NLA_PUT(skb
, IWL_TM_ATTR_UCODE_RX_PKT
, reply_len
, reply_buf
);
317 return cfg80211_testmode_reply(skb
);
320 IWL_DEBUG_INFO(priv
, "Failed creating NL attributes\n");
326 * This function handles the user application commands for register access.
328 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
329 * handlers respectively.
331 * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
332 * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
333 * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
334 * the success of the command execution.
336 * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
337 * value is returned with IWL_TM_ATTR_REG_VALUE32.
339 * @hw: ieee80211_hw object that represents the device
340 * @tb: gnl message fields from the user space
342 static int iwl_testmode_reg(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
344 struct iwl_priv
*priv
= hw
->priv
;
350 if (!tb
[IWL_TM_ATTR_REG_OFFSET
]) {
351 IWL_ERR(priv
, "Missing register offset\n");
354 ofs
= nla_get_u32(tb
[IWL_TM_ATTR_REG_OFFSET
]);
355 IWL_INFO(priv
, "testmode register access command offset 0x%x\n", ofs
);
357 /* Allow access only to FH/CSR/HBUS in direct mode.
358 Since we don't have the upper bounds for the CSR and HBUS segments,
359 we will use only the upper bound of FH for sanity check. */
360 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
361 if ((cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
||
362 cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
||
363 cmd
== IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
) &&
364 (ofs
>= FH_MEM_UPPER_BOUND
)) {
365 IWL_ERR(priv
, "offset out of segment (0x0 - 0x%x)\n",
371 case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
:
372 val32
= iwl_read_direct32(trans(priv
), ofs
);
373 IWL_INFO(priv
, "32bit value to read 0x%x\n", val32
);
375 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
377 IWL_ERR(priv
, "Memory allocation fail\n");
380 NLA_PUT_U32(skb
, IWL_TM_ATTR_REG_VALUE32
, val32
);
381 status
= cfg80211_testmode_reply(skb
);
383 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
385 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
:
386 if (!tb
[IWL_TM_ATTR_REG_VALUE32
]) {
387 IWL_ERR(priv
, "Missing value to write\n");
390 val32
= nla_get_u32(tb
[IWL_TM_ATTR_REG_VALUE32
]);
391 IWL_INFO(priv
, "32bit value to write 0x%x\n", val32
);
392 iwl_write_direct32(trans(priv
), ofs
, val32
);
395 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
:
396 if (!tb
[IWL_TM_ATTR_REG_VALUE8
]) {
397 IWL_ERR(priv
, "Missing value to write\n");
400 val8
= nla_get_u8(tb
[IWL_TM_ATTR_REG_VALUE8
]);
401 IWL_INFO(priv
, "8bit value to write 0x%x\n", val8
);
402 iwl_write8(trans(priv
), ofs
, val8
);
406 IWL_ERR(priv
, "Unknown testmode register command ID\n");
418 static int iwl_testmode_cfg_init_calib(struct iwl_priv
*priv
)
420 struct iwl_notification_wait calib_wait
;
423 iwl_init_notification_wait(priv
->shrd
, &calib_wait
,
424 CALIBRATION_COMPLETE_NOTIFICATION
,
426 ret
= iwl_init_alive_start(trans(priv
));
428 IWL_ERR(priv
, "Fail init calibration: %d\n", ret
);
429 goto cfg_init_calib_error
;
432 ret
= iwl_wait_notification(priv
->shrd
, &calib_wait
, 2 * HZ
);
434 IWL_ERR(priv
, "Error detecting"
435 " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret
);
438 cfg_init_calib_error
:
439 iwl_remove_notification(priv
->shrd
, &calib_wait
);
444 * This function handles the user application commands for driver.
446 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
447 * handlers respectively.
449 * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
450 * value of the actual command execution is replied to the user application.
452 * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
453 * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
454 * IWL_TM_CMD_DEV2APP_SYNC_RSP.
456 * @hw: ieee80211_hw object that represents the device
457 * @tb: gnl message fields from the user space
459 static int iwl_testmode_driver(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
461 struct iwl_priv
*priv
= hw
->priv
;
462 struct iwl_trans
*trans
= trans(priv
);
464 unsigned char *rsp_data_ptr
= NULL
;
465 int status
= 0, rsp_data_len
= 0;
466 u32 devid
, inst_size
= 0, data_size
= 0;
468 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
469 case IWL_TM_CMD_APP2DEV_GET_DEVICENAME
:
470 rsp_data_ptr
= (unsigned char *)cfg(priv
)->name
;
471 rsp_data_len
= strlen(cfg(priv
)->name
);
472 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
475 IWL_ERR(priv
, "Memory allocation fail\n");
478 NLA_PUT_U32(skb
, IWL_TM_ATTR_COMMAND
,
479 IWL_TM_CMD_DEV2APP_SYNC_RSP
);
480 NLA_PUT(skb
, IWL_TM_ATTR_SYNC_RSP
,
481 rsp_data_len
, rsp_data_ptr
);
482 status
= cfg80211_testmode_reply(skb
);
484 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
487 case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW
:
488 status
= iwl_load_ucode_wait_alive(trans
, IWL_UCODE_INIT
);
490 IWL_ERR(priv
, "Error loading init ucode: %d\n", status
);
493 case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB
:
494 iwl_testmode_cfg_init_calib(priv
);
495 iwl_trans_stop_device(trans
);
498 case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW
:
499 status
= iwl_load_ucode_wait_alive(trans
, IWL_UCODE_REGULAR
);
502 "Error loading runtime ucode: %d\n", status
);
505 status
= iwl_alive_start(priv
);
508 "Error starting the device: %d\n", status
);
511 case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW
:
512 iwl_scan_cancel_timeout(priv
, 200);
513 iwl_trans_stop_device(trans
);
514 status
= iwl_load_ucode_wait_alive(trans
, IWL_UCODE_WOWLAN
);
517 "Error loading WOWLAN ucode: %d\n", status
);
520 status
= iwl_alive_start(priv
);
523 "Error starting the device: %d\n", status
);
526 case IWL_TM_CMD_APP2DEV_GET_EEPROM
:
527 if (priv
->shrd
->eeprom
) {
528 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
529 cfg(priv
)->base_params
->eeprom_size
+ 20);
531 IWL_ERR(priv
, "Memory allocation fail\n");
534 NLA_PUT_U32(skb
, IWL_TM_ATTR_COMMAND
,
535 IWL_TM_CMD_DEV2APP_EEPROM_RSP
);
536 NLA_PUT(skb
, IWL_TM_ATTR_EEPROM
,
537 cfg(priv
)->base_params
->eeprom_size
,
539 status
= cfg80211_testmode_reply(skb
);
541 IWL_ERR(priv
, "Error sending msg : %d\n",
547 case IWL_TM_CMD_APP2DEV_FIXRATE_REQ
:
548 if (!tb
[IWL_TM_ATTR_FIXRATE
]) {
549 IWL_ERR(priv
, "Missing fixrate setting\n");
552 priv
->tm_fixed_rate
= nla_get_u32(tb
[IWL_TM_ATTR_FIXRATE
]);
555 case IWL_TM_CMD_APP2DEV_GET_FW_VERSION
:
556 IWL_INFO(priv
, "uCode version raw: 0x%x\n",
557 nic(priv
)->fw
.ucode_ver
);
559 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
561 IWL_ERR(priv
, "Memory allocation fail\n");
564 NLA_PUT_U32(skb
, IWL_TM_ATTR_FW_VERSION
,
565 nic(priv
)->fw
.ucode_ver
);
566 status
= cfg80211_testmode_reply(skb
);
568 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
571 case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID
:
572 devid
= trans(priv
)->hw_id
;
573 IWL_INFO(priv
, "hw version: 0x%x\n", devid
);
575 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20);
577 IWL_ERR(priv
, "Memory allocation fail\n");
580 NLA_PUT_U32(skb
, IWL_TM_ATTR_DEVICE_ID
, devid
);
581 status
= cfg80211_testmode_reply(skb
);
583 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
586 case IWL_TM_CMD_APP2DEV_GET_FW_INFO
:
587 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
, 20 + 8);
589 IWL_ERR(priv
, "Memory allocation fail\n");
592 switch (priv
->shrd
->ucode_type
) {
593 case IWL_UCODE_REGULAR
:
594 inst_size
= nic(priv
)->fw
.ucode_rt
.code
.len
;
595 data_size
= nic(priv
)->fw
.ucode_rt
.data
.len
;
598 inst_size
= nic(priv
)->fw
.ucode_init
.code
.len
;
599 data_size
= nic(priv
)->fw
.ucode_init
.data
.len
;
601 case IWL_UCODE_WOWLAN
:
602 inst_size
= nic(priv
)->fw
.ucode_wowlan
.code
.len
;
603 data_size
= nic(priv
)->fw
.ucode_wowlan
.data
.len
;
606 IWL_ERR(priv
, "No uCode has not been loaded\n");
609 IWL_ERR(priv
, "Unsupported uCode type\n");
612 NLA_PUT_U32(skb
, IWL_TM_ATTR_FW_TYPE
, priv
->shrd
->ucode_type
);
613 NLA_PUT_U32(skb
, IWL_TM_ATTR_FW_INST_SIZE
, inst_size
);
614 NLA_PUT_U32(skb
, IWL_TM_ATTR_FW_DATA_SIZE
, data_size
);
615 status
= cfg80211_testmode_reply(skb
);
617 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
621 IWL_ERR(priv
, "Unknown testmode driver command ID\n");
633 * This function handles the user application commands for uCode trace
635 * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
636 * handlers respectively.
638 * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
639 * value of the actual command execution is replied to the user application.
641 * @hw: ieee80211_hw object that represents the device
642 * @tb: gnl message fields from the user space
644 static int iwl_testmode_trace(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
646 struct iwl_priv
*priv
= hw
->priv
;
649 struct device
*dev
= trans(priv
)->dev
;
651 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
652 case IWL_TM_CMD_APP2DEV_BEGIN_TRACE
:
653 if (priv
->testmode_trace
.trace_enabled
)
656 if (!tb
[IWL_TM_ATTR_TRACE_SIZE
])
657 priv
->testmode_trace
.buff_size
= TRACE_BUFF_SIZE_DEF
;
659 priv
->testmode_trace
.buff_size
=
660 nla_get_u32(tb
[IWL_TM_ATTR_TRACE_SIZE
]);
661 if (!priv
->testmode_trace
.buff_size
)
663 if (priv
->testmode_trace
.buff_size
< TRACE_BUFF_SIZE_MIN
||
664 priv
->testmode_trace
.buff_size
> TRACE_BUFF_SIZE_MAX
)
667 priv
->testmode_trace
.total_size
=
668 priv
->testmode_trace
.buff_size
+ TRACE_BUFF_PADD
;
669 priv
->testmode_trace
.cpu_addr
=
670 dma_alloc_coherent(dev
,
671 priv
->testmode_trace
.total_size
,
672 &priv
->testmode_trace
.dma_addr
,
674 if (!priv
->testmode_trace
.cpu_addr
)
676 priv
->testmode_trace
.trace_enabled
= true;
677 priv
->testmode_trace
.trace_addr
= (u8
*)PTR_ALIGN(
678 priv
->testmode_trace
.cpu_addr
, 0x100);
679 memset(priv
->testmode_trace
.trace_addr
, 0x03B,
680 priv
->testmode_trace
.buff_size
);
681 skb
= cfg80211_testmode_alloc_reply_skb(hw
->wiphy
,
682 sizeof(priv
->testmode_trace
.dma_addr
) + 20);
684 IWL_ERR(priv
, "Memory allocation fail\n");
685 iwl_trace_cleanup(priv
);
688 NLA_PUT(skb
, IWL_TM_ATTR_TRACE_ADDR
,
689 sizeof(priv
->testmode_trace
.dma_addr
),
690 (u64
*)&priv
->testmode_trace
.dma_addr
);
691 status
= cfg80211_testmode_reply(skb
);
693 IWL_ERR(priv
, "Error sending msg : %d\n", status
);
695 priv
->testmode_trace
.num_chunks
=
696 DIV_ROUND_UP(priv
->testmode_trace
.buff_size
,
700 case IWL_TM_CMD_APP2DEV_END_TRACE
:
701 iwl_trace_cleanup(priv
);
704 IWL_ERR(priv
, "Unknown testmode mem command ID\n");
711 if (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]) ==
712 IWL_TM_CMD_APP2DEV_BEGIN_TRACE
)
713 iwl_trace_cleanup(priv
);
717 static int iwl_testmode_trace_dump(struct ieee80211_hw
*hw
, struct nlattr
**tb
,
719 struct netlink_callback
*cb
)
721 struct iwl_priv
*priv
= hw
->priv
;
724 if (priv
->testmode_trace
.trace_enabled
&&
725 priv
->testmode_trace
.trace_addr
) {
727 if (idx
>= priv
->testmode_trace
.num_chunks
)
729 length
= DUMP_CHUNK_SIZE
;
730 if (((idx
+ 1) == priv
->testmode_trace
.num_chunks
) &&
731 (priv
->testmode_trace
.buff_size
% DUMP_CHUNK_SIZE
))
732 length
= priv
->testmode_trace
.buff_size
%
735 NLA_PUT(skb
, IWL_TM_ATTR_TRACE_DUMP
, length
,
736 priv
->testmode_trace
.trace_addr
+
737 (DUMP_CHUNK_SIZE
* idx
));
749 * This function handles the user application switch ucode ownership.
751 * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
752 * decide who the current owner of the uCode
754 * If the current owner is OWNERSHIP_TM, then the only host command
755 * can deliver to uCode is from testmode, all the other host commands
758 * default driver is the owner of uCode in normal operational mode
760 * @hw: ieee80211_hw object that represents the device
761 * @tb: gnl message fields from the user space
763 static int iwl_testmode_ownership(struct ieee80211_hw
*hw
, struct nlattr
**tb
)
765 struct iwl_priv
*priv
= hw
->priv
;
768 if (!tb
[IWL_TM_ATTR_UCODE_OWNER
]) {
769 IWL_ERR(priv
, "Missing ucode owner\n");
773 owner
= nla_get_u8(tb
[IWL_TM_ATTR_UCODE_OWNER
]);
774 if ((owner
== IWL_OWNERSHIP_DRIVER
) || (owner
== IWL_OWNERSHIP_TM
))
775 priv
->shrd
->ucode_owner
= owner
;
777 IWL_ERR(priv
, "Invalid owner\n");
783 static int iwl_testmode_indirect_read(struct iwl_priv
*priv
, u32 addr
, u32 size
)
785 struct iwl_trans
*trans
= trans(priv
);
791 priv
->testmode_mem
.buff_size
= size
;
792 priv
->testmode_mem
.buff_addr
=
793 kmalloc(priv
->testmode_mem
.buff_size
, GFP_KERNEL
);
794 if (priv
->testmode_mem
.buff_addr
== NULL
)
797 /* Hard-coded periphery absolute address */
798 if (IWL_TM_ABS_PRPH_START
<= addr
&&
799 addr
< IWL_TM_ABS_PRPH_START
+ PRPH_END
) {
800 spin_lock_irqsave(&trans
->reg_lock
, flags
);
801 iwl_grab_nic_access(trans
);
802 iwl_write32(trans
, HBUS_TARG_PRPH_RADDR
,
804 for (i
= 0; i
< size
; i
+= 4)
805 *(u32
*)(priv
->testmode_mem
.buff_addr
+ i
) =
806 iwl_read32(trans
, HBUS_TARG_PRPH_RDAT
);
807 iwl_release_nic_access(trans
);
808 spin_unlock_irqrestore(&trans
->reg_lock
, flags
);
809 } else { /* target memory (SRAM) */
810 _iwl_read_targ_mem_words(trans
, addr
,
811 priv
->testmode_mem
.buff_addr
,
812 priv
->testmode_mem
.buff_size
/ 4);
815 priv
->testmode_mem
.num_chunks
=
816 DIV_ROUND_UP(priv
->testmode_mem
.buff_size
, DUMP_CHUNK_SIZE
);
817 priv
->testmode_mem
.read_in_progress
= true;
822 static int iwl_testmode_indirect_write(struct iwl_priv
*priv
, u32 addr
,
823 u32 size
, unsigned char *buf
)
825 struct iwl_trans
*trans
= trans(priv
);
829 if (IWL_TM_ABS_PRPH_START
<= addr
&&
830 addr
< IWL_TM_ABS_PRPH_START
+ PRPH_END
) {
831 /* Periphery writes can be 1-3 bytes long, or DWORDs */
833 memcpy(&val
, buf
, size
);
834 spin_lock_irqsave(&trans
->reg_lock
, flags
);
835 iwl_grab_nic_access(trans
);
836 iwl_write32(trans
, HBUS_TARG_PRPH_WADDR
,
837 (addr
& 0x0000FFFF) |
839 iwl_write32(trans
, HBUS_TARG_PRPH_WDAT
, val
);
840 iwl_release_nic_access(trans
);
841 /* needed after consecutive writes w/o read */
843 spin_unlock_irqrestore(&trans
->reg_lock
, flags
);
847 for (i
= 0; i
< size
; i
+= 4)
848 iwl_write_prph(trans
, addr
+i
,
851 } else if (iwlagn_hw_valid_rtc_data_addr(addr
) ||
852 (IWLAGN_RTC_INST_LOWER_BOUND
<= addr
&&
853 addr
< IWLAGN_RTC_INST_UPPER_BOUND
)) {
854 _iwl_write_targ_mem_words(trans
, addr
, buf
, size
/4);
861 * This function handles the user application commands for SRAM data dump
863 * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
864 * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
866 * Several error will be retured, -EBUSY if the SRAM data retrieved by
867 * previous command has not been delivered to userspace, or -ENOMSG if
868 * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
869 * are missing, or -ENOMEM if the buffer allocation fails.
871 * Otherwise 0 is replied indicating the success of the SRAM reading.
873 * @hw: ieee80211_hw object that represents the device
874 * @tb: gnl message fields from the user space
876 static int iwl_testmode_indirect_mem(struct ieee80211_hw
*hw
,
879 struct iwl_priv
*priv
= hw
->priv
;
883 /* Both read and write should be blocked, for atomicity */
884 if (priv
->testmode_mem
.read_in_progress
)
887 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
888 if (!tb
[IWL_TM_ATTR_MEM_ADDR
]) {
889 IWL_ERR(priv
, "Error finding memory offset address\n");
892 addr
= nla_get_u32(tb
[IWL_TM_ATTR_MEM_ADDR
]);
893 if (!tb
[IWL_TM_ATTR_BUFFER_SIZE
]) {
894 IWL_ERR(priv
, "Error finding size for memory reading\n");
897 size
= nla_get_u32(tb
[IWL_TM_ATTR_BUFFER_SIZE
]);
899 if (cmd
== IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ
)
900 return iwl_testmode_indirect_read(priv
, addr
, size
);
902 if (!tb
[IWL_TM_ATTR_BUFFER_DUMP
])
904 buf
= (unsigned char *) nla_data(tb
[IWL_TM_ATTR_BUFFER_DUMP
]);
905 return iwl_testmode_indirect_write(priv
, addr
, size
, buf
);
909 static int iwl_testmode_buffer_dump(struct ieee80211_hw
*hw
, struct nlattr
**tb
,
911 struct netlink_callback
*cb
)
913 struct iwl_priv
*priv
= hw
->priv
;
916 if (priv
->testmode_mem
.read_in_progress
) {
918 if (idx
>= priv
->testmode_mem
.num_chunks
) {
919 iwl_mem_cleanup(priv
);
922 length
= DUMP_CHUNK_SIZE
;
923 if (((idx
+ 1) == priv
->testmode_mem
.num_chunks
) &&
924 (priv
->testmode_mem
.buff_size
% DUMP_CHUNK_SIZE
))
925 length
= priv
->testmode_mem
.buff_size
%
928 NLA_PUT(skb
, IWL_TM_ATTR_BUFFER_DUMP
, length
,
929 priv
->testmode_mem
.buff_addr
+
930 (DUMP_CHUNK_SIZE
* idx
));
942 /* The testmode gnl message handler that takes the gnl message from the
943 * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
944 * invoke the corresponding handlers.
946 * This function is invoked when there is user space application sending
947 * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
950 * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
951 * dispatching it to the corresponding handler.
953 * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
954 * -ENOSYS is replied to the user application if the command is unknown;
955 * Otherwise, the command is dispatched to the respective handler.
957 * @hw: ieee80211_hw object that represents the device
958 * @data: pointer to user space message
959 * @len: length in byte of @data
961 int iwlagn_mac_testmode_cmd(struct ieee80211_hw
*hw
, void *data
, int len
)
963 struct nlattr
*tb
[IWL_TM_ATTR_MAX
];
964 struct iwl_priv
*priv
= hw
->priv
;
967 result
= nla_parse(tb
, IWL_TM_ATTR_MAX
- 1, data
, len
,
968 iwl_testmode_gnl_msg_policy
);
970 IWL_ERR(priv
, "Error parsing the gnl message : %d\n", result
);
974 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
975 if (!tb
[IWL_TM_ATTR_COMMAND
]) {
976 IWL_ERR(priv
, "Missing testmode command type\n");
979 /* in case multiple accesses to the device happens */
980 mutex_lock(&priv
->shrd
->mutex
);
982 switch (nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
])) {
983 case IWL_TM_CMD_APP2DEV_UCODE
:
984 IWL_DEBUG_INFO(priv
, "testmode cmd to uCode\n");
985 result
= iwl_testmode_ucode(hw
, tb
);
987 case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32
:
988 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32
:
989 case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8
:
990 IWL_DEBUG_INFO(priv
, "testmode cmd to register\n");
991 result
= iwl_testmode_reg(hw
, tb
);
993 case IWL_TM_CMD_APP2DEV_GET_DEVICENAME
:
994 case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW
:
995 case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB
:
996 case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW
:
997 case IWL_TM_CMD_APP2DEV_GET_EEPROM
:
998 case IWL_TM_CMD_APP2DEV_FIXRATE_REQ
:
999 case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW
:
1000 case IWL_TM_CMD_APP2DEV_GET_FW_VERSION
:
1001 case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID
:
1002 case IWL_TM_CMD_APP2DEV_GET_FW_INFO
:
1003 IWL_DEBUG_INFO(priv
, "testmode cmd to driver\n");
1004 result
= iwl_testmode_driver(hw
, tb
);
1007 case IWL_TM_CMD_APP2DEV_BEGIN_TRACE
:
1008 case IWL_TM_CMD_APP2DEV_END_TRACE
:
1009 case IWL_TM_CMD_APP2DEV_READ_TRACE
:
1010 IWL_DEBUG_INFO(priv
, "testmode uCode trace cmd to driver\n");
1011 result
= iwl_testmode_trace(hw
, tb
);
1014 case IWL_TM_CMD_APP2DEV_OWNERSHIP
:
1015 IWL_DEBUG_INFO(priv
, "testmode change uCode ownership\n");
1016 result
= iwl_testmode_ownership(hw
, tb
);
1019 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ
:
1020 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE
:
1021 IWL_DEBUG_INFO(priv
, "testmode indirect memory cmd "
1023 result
= iwl_testmode_indirect_mem(hw
, tb
);
1027 IWL_ERR(priv
, "Unknown testmode command\n");
1032 mutex_unlock(&priv
->shrd
->mutex
);
1036 int iwlagn_mac_testmode_dump(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1037 struct netlink_callback
*cb
,
1038 void *data
, int len
)
1040 struct nlattr
*tb
[IWL_TM_ATTR_MAX
];
1041 struct iwl_priv
*priv
= hw
->priv
;
1046 /* offset by 1 since commands start at 0 */
1047 cmd
= cb
->args
[3] - 1;
1049 result
= nla_parse(tb
, IWL_TM_ATTR_MAX
- 1, data
, len
,
1050 iwl_testmode_gnl_msg_policy
);
1053 "Error parsing the gnl message : %d\n", result
);
1057 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
1058 if (!tb
[IWL_TM_ATTR_COMMAND
]) {
1059 IWL_ERR(priv
, "Missing testmode command type\n");
1062 cmd
= nla_get_u32(tb
[IWL_TM_ATTR_COMMAND
]);
1063 cb
->args
[3] = cmd
+ 1;
1066 /* in case multiple accesses to the device happens */
1067 mutex_lock(&priv
->shrd
->mutex
);
1069 case IWL_TM_CMD_APP2DEV_READ_TRACE
:
1070 IWL_DEBUG_INFO(priv
, "uCode trace cmd to driver\n");
1071 result
= iwl_testmode_trace_dump(hw
, tb
, skb
, cb
);
1073 case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP
:
1074 IWL_DEBUG_INFO(priv
, "testmode sram dump cmd to driver\n");
1075 result
= iwl_testmode_buffer_dump(hw
, tb
, skb
, cb
);
1082 mutex_unlock(&priv
->shrd
->mutex
);