drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-wifi.h"
  74 #include "iwl-dev.h"
  75 #include "iwl-core.h"
  76 #include "iwl-debug.h"
  77 #include "iwl-io.h"
  78 #include "iwl-agn.h"
  79 #include "iwl-testmode.h"
  80 #include "iwl-trans.h"
  81 #include "iwl-bus.h"
  82 #include "iwl-fh.h"
  83
  84 /* The TLVs used in the gnl message policy between the kernel module and
  85  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  86  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  87  * See iwl-testmode.h
  88  */
  89 static
  90 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  91         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  92
  93         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
  94         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
  95
  96         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
  97         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
  98         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
  99
 100         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
 101         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 102
 103         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 104
 105         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 106         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 107         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 108
 109         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 110
 111         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 112
 113         [IWL_TM_ATTR_SRAM_ADDR] = { .type = NLA_U32, },
 114         [IWL_TM_ATTR_SRAM_SIZE] = { .type = NLA_U32, },
 115         [IWL_TM_ATTR_SRAM_DUMP] = { .type = NLA_UNSPEC, },
 116
 117         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 118         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 119         [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
 120         [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
 121         [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
 122 };
 123
 124 /*
 125  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 126  * received events from the device
 127  */
 128 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 129 {
 130         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 131         if (pkt)
 132                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 133         else
 134                 return 0;
 135 }
 136
 137
 138 /*
 139  * This function multicasts the spontaneous messages from the device to the
 140  * user space. It is invoked whenever there is a received messages
 141  * from the device. This function is called within the ISR of the rx handlers
 142  * in iwlagn driver.
 143  *
 144  * The parsing of the message content is left to the user space application,
 145  * The message content is treated as unattacked raw data and is encapsulated
 146  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 147  *
 148  * @priv: the instance of iwlwifi device
 149  * @rxb: pointer to rx data content received by the ISR
 150  *
 151  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 152  * For the messages multicasting to the user application, the mandatory
 153  * TLV fields are :
 154  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 155  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 156  */
 157
 158 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 159                                 struct iwl_rx_mem_buffer *rxb)
 160 {
 161         struct ieee80211_hw *hw = priv->hw;
 162         struct sk_buff *skb;
 163         void *data;
 164         int length;
 165
 166         data = (void *)rxb_addr(rxb);
 167         length = get_event_length(rxb);
 168
 169         if (!data || length == 0)
 170                 return;
 171
 172         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 173                                                                 GFP_ATOMIC);
 174         if (skb == NULL) {
 175                 IWL_ERR(priv,
 176                          "Run out of memory for messages to user space ?\n");
 177                 return;
 178         }
 179         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 180         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 181         cfg80211_testmode_event(skb, GFP_ATOMIC);
 182         return;
 183
 184 nla_put_failure:
 185         kfree_skb(skb);
 186         IWL_ERR(priv, "Ouch, overran buffer, check allocation!\n");
 187 }
 188
 189 void iwl_testmode_init(struct iwl_priv *priv)
 190 {
 191         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 192         priv->testmode_trace.trace_enabled = false;
 193         priv->testmode_sram.sram_readed = false;
 194 }
 195
 196 static void iwl_sram_cleanup(struct iwl_priv *priv)
 197 {
 198         if (priv->testmode_sram.sram_readed) {
 199                 kfree(priv->testmode_sram.buff_addr);
 200                 priv->testmode_sram.buff_addr = NULL;
 201                 priv->testmode_sram.buff_size = 0;
 202                 priv->testmode_sram.num_chunks = 0;
 203                 priv->testmode_sram.sram_readed = false;
 204         }
 205 }
 206
 207 static void iwl_trace_cleanup(struct iwl_priv *priv)
 208 {
 209         if (priv->testmode_trace.trace_enabled) {
 210                 if (priv->testmode_trace.cpu_addr &&
 211                     priv->testmode_trace.dma_addr)
 212                         dma_free_coherent(trans(priv)->dev,
 213                                         priv->testmode_trace.total_size,
 214                                         priv->testmode_trace.cpu_addr,
 215                                         priv->testmode_trace.dma_addr);
 216                 priv->testmode_trace.trace_enabled = false;
 217                 priv->testmode_trace.cpu_addr = NULL;
 218                 priv->testmode_trace.trace_addr = NULL;
 219                 priv->testmode_trace.dma_addr = 0;
 220                 priv->testmode_trace.buff_size = 0;
 221                 priv->testmode_trace.total_size = 0;
 222         }
 223 }
 224
 225
 226 void iwl_testmode_cleanup(struct iwl_priv *priv)
 227 {
 228         iwl_trace_cleanup(priv);
 229         iwl_sram_cleanup(priv);
 230 }
 231
 232 /*
 233  * This function handles the user application commands to the ucode.
 234  *
 235  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 236  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 237  * host command to the ucode.
 238  *
 239  * If any mandatory field is missing, -ENOMSG is replied to the user space
 240  * application; otherwise, the actual execution result of the host command to
 241  * ucode is replied.
 242  *
 243  * @hw: ieee80211_hw object that represents the device
 244  * @tb: gnl message fields from the user space
 245  */
 246 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 247 {
 248         struct iwl_priv *priv = hw->priv;
 249         struct iwl_host_cmd cmd;
 250
 251         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 252
 253         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 254             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 255                 IWL_ERR(priv, "Missing ucode command mandatory fields\n");
 256                 return -ENOMSG;
 257         }
 258
 259         cmd.flags = CMD_ON_DEMAND;
 260         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 261         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 262         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 263         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 264         IWL_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 265                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 266         /* ok, let's submit the command to ucode */
 267         return iwl_trans_send_cmd(trans(priv), &cmd);
 268 }
 269
 270
 271 /*
 272  * This function handles the user application commands for register access.
 273  *
 274  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 275  * handlers respectively.
 276  *
 277  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 278  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 279  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 280  * the success of the command execution.
 281  *
 282  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 283  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 284  *
 285  * @hw: ieee80211_hw object that represents the device
 286  * @tb: gnl message fields from the user space
 287  */
 288 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 289 {
 290         struct iwl_priv *priv = hw->priv;
 291         u32 ofs, val32, cmd;
 292         u8 val8;
 293         struct sk_buff *skb;
 294         int status = 0;
 295
 296         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 297                 IWL_ERR(priv, "Missing register offset\n");
 298                 return -ENOMSG;
 299         }
 300         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 301         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 302
 303         /* Allow access only to FH/CSR/HBUS in direct mode.
 304         Since we don't have the upper bounds for the CSR and HBUS segments,
 305         we will use only the upper bound of FH for sanity check. */
 306         cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 307         if ((cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32 ||
 308                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32 ||
 309                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8) &&
 310                 (ofs >= FH_MEM_UPPER_BOUND)) {
 311                 IWL_ERR(priv, "offset out of segment (0x0 - 0x%x)\n",
 312                         FH_MEM_UPPER_BOUND);
 313                 return -EINVAL;
 314         }
 315
 316         switch (cmd) {
 317         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 318                 val32 = iwl_read_direct32(trans(priv), ofs);
 319                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 320
 321                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 322                 if (!skb) {
 323                         IWL_ERR(priv, "Memory allocation fail\n");
 324                         return -ENOMEM;
 325                 }
 326                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 327                 status = cfg80211_testmode_reply(skb);
 328                 if (status < 0)
 329                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 330                 break;
 331         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 332                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 333                         IWL_ERR(priv, "Missing value to write\n");
 334                         return -ENOMSG;
 335                 } else {
 336                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 337                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 338                         iwl_write_direct32(trans(priv), ofs, val32);
 339                 }
 340                 break;
 341         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 342                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 343                         IWL_ERR(priv, "Missing value to write\n");
 344                         return -ENOMSG;
 345                 } else {
 346                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 347                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 348                         iwl_write8(trans(priv), ofs, val8);
 349                 }
 350                 break;
 351         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 352                 val32 = iwl_read_prph(trans(priv), ofs);
 353                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 354
 355                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 356                 if (!skb) {
 357                         IWL_ERR(priv, "Memory allocation fail\n");
 358                         return -ENOMEM;
 359                 }
 360                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 361                 status = cfg80211_testmode_reply(skb);
 362                 if (status < 0)
 363                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 364                 break;
 365         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 366                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 367                         IWL_ERR(priv, "Missing value to write\n");
 368                         return -ENOMSG;
 369                 } else {
 370                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 371                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 372                         iwl_write_prph(trans(priv), ofs, val32);
 373                 }
 374                 break;
 375         default:
 376                 IWL_ERR(priv, "Unknown testmode register command ID\n");
 377                 return -ENOSYS;
 378         }
 379
 380         return status;
 381
 382 nla_put_failure:
 383         kfree_skb(skb);
 384         return -EMSGSIZE;
 385 }
 386
 387
 388 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 389 {
 390         struct iwl_notification_wait calib_wait;
 391         int ret;
 392
 393         iwl_init_notification_wait(priv->shrd, &calib_wait,
 394                                       CALIBRATION_COMPLETE_NOTIFICATION,
 395                                       NULL, NULL);
 396         ret = iwl_init_alive_start(trans(priv));
 397         if (ret) {
 398                 IWL_ERR(priv, "Fail init calibration: %d\n", ret);
 399                 goto cfg_init_calib_error;
 400         }
 401
 402         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 403         if (ret)
 404                 IWL_ERR(priv, "Error detecting"
 405                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 406         return ret;
 407
 408 cfg_init_calib_error:
 409         iwl_remove_notification(priv->shrd, &calib_wait);
 410         return ret;
 411 }
 412
 413 /*
 414  * This function handles the user application commands for driver.
 415  *
 416  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 417  * handlers respectively.
 418  *
 419  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 420  * value of the actual command execution is replied to the user application.
 421  *
 422  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 423  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 424  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 425  *
 426  * @hw: ieee80211_hw object that represents the device
 427  * @tb: gnl message fields from the user space
 428  */
 429 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 430 {
 431         struct iwl_priv *priv = hw->priv;
 432         struct iwl_trans *trans = trans(priv);
 433         struct sk_buff *skb;
 434         unsigned char *rsp_data_ptr = NULL;
 435         int status = 0, rsp_data_len = 0;
 436         u32 devid, inst_size = 0, data_size = 0;
 437
 438         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 439         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 440                 rsp_data_ptr = (unsigned char *)cfg(priv)->name;
 441                 rsp_data_len = strlen(cfg(priv)->name);
 442                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 443                                                         rsp_data_len + 20);
 444                 if (!skb) {
 445                         IWL_ERR(priv, "Memory allocation fail\n");
 446                         return -ENOMEM;
 447                 }
 448                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 449                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 450                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 451                         rsp_data_len, rsp_data_ptr);
 452                 status = cfg80211_testmode_reply(skb);
 453                 if (status < 0)
 454                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 455                 break;
 456
 457         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 458                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_INIT);
 459                 if (status)
 460                         IWL_ERR(priv, "Error loading init ucode: %d\n", status);
 461                 break;
 462
 463         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 464                 iwl_testmode_cfg_init_calib(priv);
 465                 iwl_trans_stop_device(trans);
 466                 break;
 467
 468         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 469                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_REGULAR);
 470                 if (status) {
 471                         IWL_ERR(priv,
 472                                 "Error loading runtime ucode: %d\n", status);
 473                         break;
 474                 }
 475                 status = iwl_alive_start(priv);
 476                 if (status)
 477                         IWL_ERR(priv,
 478                                 "Error starting the device: %d\n", status);
 479                 break;
 480
 481         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 482                 iwl_scan_cancel_timeout(priv, 200);
 483                 iwl_trans_stop_device(trans);
 484                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_WOWLAN);
 485                 if (status) {
 486                         IWL_ERR(priv,
 487                                 "Error loading WOWLAN ucode: %d\n", status);
 488                         break;
 489                 }
 490                 status = iwl_alive_start(priv);
 491                 if (status)
 492                         IWL_ERR(priv,
 493                                 "Error starting the device: %d\n", status);
 494                 break;
 495
 496         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 497                 if (priv->shrd->eeprom) {
 498                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 499                                 cfg(priv)->base_params->eeprom_size + 20);
 500                         if (!skb) {
 501                                 IWL_ERR(priv, "Memory allocation fail\n");
 502                                 return -ENOMEM;
 503                         }
 504                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 505                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 506                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 507                                 cfg(priv)->base_params->eeprom_size,
 508                                 priv->shrd->eeprom);
 509                         status = cfg80211_testmode_reply(skb);
 510                         if (status < 0)
 511                                 IWL_ERR(priv, "Error sending msg : %d\n",
 512                                         status);
 513                 } else
 514                         return -EFAULT;
 515                 break;
 516
 517         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 518                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 519                         IWL_ERR(priv, "Missing fixrate setting\n");
 520                         return -ENOMSG;
 521                 }
 522                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 523                 break;
 524
 525         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 526                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 527
 528                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 529                 if (!skb) {
 530                         IWL_ERR(priv, "Memory allocation fail\n");
 531                         return -ENOMEM;
 532                 }
 533                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 534                 status = cfg80211_testmode_reply(skb);
 535                 if (status < 0)
 536                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 537                 break;
 538
 539         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 540                 devid = trans(priv)->hw_id;
 541                 IWL_INFO(priv, "hw version: 0x%x\n", devid);
 542
 543                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 544                 if (!skb) {
 545                         IWL_ERR(priv, "Memory allocation fail\n");
 546                         return -ENOMEM;
 547                 }
 548                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 549                 status = cfg80211_testmode_reply(skb);
 550                 if (status < 0)
 551                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 552                 break;
 553
 554         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 555                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
 556                 if (!skb) {
 557                         IWL_ERR(priv, "Memory allocation fail\n");
 558                         return -ENOMEM;
 559                 }
 560                 switch (priv->shrd->ucode_type) {
 561                 case IWL_UCODE_REGULAR:
 562                         inst_size = trans(priv)->ucode_rt.code.len;
 563                         data_size = trans(priv)->ucode_rt.data.len;
 564                         break;
 565                 case IWL_UCODE_INIT:
 566                         inst_size = trans(priv)->ucode_init.code.len;
 567                         data_size = trans(priv)->ucode_init.data.len;
 568                         break;
 569                 case IWL_UCODE_WOWLAN:
 570                         inst_size = trans(priv)->ucode_wowlan.code.len;
 571                         data_size = trans(priv)->ucode_wowlan.data.len;
 572                         break;
 573                 case IWL_UCODE_NONE:
 574                         IWL_ERR(priv, "No uCode has not been loaded\n");
 575                         break;
 576                 default:
 577                         IWL_ERR(priv, "Unsupported uCode type\n");
 578                         break;
 579                 }
 580                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_TYPE, priv->shrd->ucode_type);
 581                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size);
 582                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size);
 583                 status = cfg80211_testmode_reply(skb);
 584                 if (status < 0)
 585                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 586                 break;
 587
 588         default:
 589                 IWL_ERR(priv, "Unknown testmode driver command ID\n");
 590                 return -ENOSYS;
 591         }
 592         return status;
 593
 594 nla_put_failure:
 595         kfree_skb(skb);
 596         return -EMSGSIZE;
 597 }
 598
 599
 600 /*
 601  * This function handles the user application commands for uCode trace
 602  *
 603  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 604  * handlers respectively.
 605  *
 606  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 607  * value of the actual command execution is replied to the user application.
 608  *
 609  * @hw: ieee80211_hw object that represents the device
 610  * @tb: gnl message fields from the user space
 611  */
 612 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 613 {
 614         struct iwl_priv *priv = hw->priv;
 615         struct sk_buff *skb;
 616         int status = 0;
 617         struct device *dev = trans(priv)->dev;
 618
 619         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 620         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 621                 if (priv->testmode_trace.trace_enabled)
 622                         return -EBUSY;
 623
 624                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 625                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 626                 else
 627                         priv->testmode_trace.buff_size =
 628                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 629                 if (!priv->testmode_trace.buff_size)
 630                         return -EINVAL;
 631                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 632                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 633                         return -EINVAL;
 634
 635                 priv->testmode_trace.total_size =
 636                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 637                 priv->testmode_trace.cpu_addr =
 638                         dma_alloc_coherent(dev,
 639                                            priv->testmode_trace.total_size,
 640                                            &priv->testmode_trace.dma_addr,
 641                                            GFP_KERNEL);
 642                 if (!priv->testmode_trace.cpu_addr)
 643                         return -ENOMEM;
 644                 priv->testmode_trace.trace_enabled = true;
 645                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 646                         priv->testmode_trace.cpu_addr, 0x100);
 647                 memset(priv->testmode_trace.trace_addr, 0x03B,
 648                         priv->testmode_trace.buff_size);
 649                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 650                         sizeof(priv->testmode_trace.dma_addr) + 20);
 651                 if (!skb) {
 652                         IWL_ERR(priv, "Memory allocation fail\n");
 653                         iwl_trace_cleanup(priv);
 654                         return -ENOMEM;
 655                 }
 656                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 657                         sizeof(priv->testmode_trace.dma_addr),
 658                         (u64 *)&priv->testmode_trace.dma_addr);
 659                 status = cfg80211_testmode_reply(skb);
 660                 if (status < 0) {
 661                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 662                 }
 663                 priv->testmode_trace.num_chunks =
 664                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 665                                      DUMP_CHUNK_SIZE);
 666                 break;
 667
 668         case IWL_TM_CMD_APP2DEV_END_TRACE:
 669                 iwl_trace_cleanup(priv);
 670                 break;
 671         default:
 672                 IWL_ERR(priv, "Unknown testmode mem command ID\n");
 673                 return -ENOSYS;
 674         }
 675         return status;
 676
 677 nla_put_failure:
 678         kfree_skb(skb);
 679         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 680             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 681                 iwl_trace_cleanup(priv);
 682         return -EMSGSIZE;
 683 }
 684
 685 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 686                                    struct sk_buff *skb,
 687                                    struct netlink_callback *cb)
 688 {
 689         struct iwl_priv *priv = hw->priv;
 690         int idx, length;
 691
 692         if (priv->testmode_trace.trace_enabled &&
 693             priv->testmode_trace.trace_addr) {
 694                 idx = cb->args[4];
 695                 if (idx >= priv->testmode_trace.num_chunks)
 696                         return -ENOENT;
 697                 length = DUMP_CHUNK_SIZE;
 698                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 699                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 700                         length = priv->testmode_trace.buff_size %
 701                                 DUMP_CHUNK_SIZE;
 702
 703                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 704                         priv->testmode_trace.trace_addr +
 705                         (DUMP_CHUNK_SIZE * idx));
 706                 idx++;
 707                 cb->args[4] = idx;
 708                 return 0;
 709         } else
 710                 return -EFAULT;
 711
 712  nla_put_failure:
 713         return -ENOBUFS;
 714 }
 715
 716 /*
 717  * This function handles the user application switch ucode ownership.
 718  *
 719  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 720  * decide who the current owner of the uCode
 721  *
 722  * If the current owner is OWNERSHIP_TM, then the only host command
 723  * can deliver to uCode is from testmode, all the other host commands
 724  * will dropped.
 725  *
 726  * default driver is the owner of uCode in normal operational mode
 727  *
 728  * @hw: ieee80211_hw object that represents the device
 729  * @tb: gnl message fields from the user space
 730  */
 731 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 732 {
 733         struct iwl_priv *priv = hw->priv;
 734         u8 owner;
 735
 736         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 737                 IWL_ERR(priv, "Missing ucode owner\n");
 738                 return -ENOMSG;
 739         }
 740
 741         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 742         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 743                 priv->shrd->ucode_owner = owner;
 744         else {
 745                 IWL_ERR(priv, "Invalid owner\n");
 746                 return -EINVAL;
 747         }
 748         return 0;
 749 }
 750
 751 /*
 752  * This function handles the user application commands for SRAM data dump
 753  *
 754  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 755  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 756  *
 757  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 758  * previous command has not been delivered to userspace, or -ENOMSG if
 759  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 760  * are missing, or -ENOMEM if the buffer allocation fails.
 761  *
 762  * Otherwise 0 is replied indicating the success of the SRAM reading.
 763  *
 764  * @hw: ieee80211_hw object that represents the device
 765  * @tb: gnl message fields from the user space
 766  */
 767 static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 768 {
 769         struct iwl_priv *priv = hw->priv;
 770         u32 ofs, size, maxsize;
 771
 772         if (priv->testmode_sram.sram_readed)
 773                 return -EBUSY;
 774
 775         if (!tb[IWL_TM_ATTR_SRAM_ADDR]) {
 776                 IWL_ERR(priv, "Missing SRAM offset address\n");
 777                 return -ENOMSG;
 778         }
 779         ofs = nla_get_u32(tb[IWL_TM_ATTR_SRAM_ADDR]);
 780         if (!tb[IWL_TM_ATTR_SRAM_SIZE]) {
 781                 IWL_ERR(priv, "Missing size for SRAM reading\n");
 782                 return -ENOMSG;
 783         }
 784         size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
 785         switch (priv->shrd->ucode_type) {
 786         case IWL_UCODE_REGULAR:
 787                 maxsize = trans(priv)->ucode_rt.data.len;
 788                 break;
 789         case IWL_UCODE_INIT:
 790                 maxsize = trans(priv)->ucode_init.data.len;
 791                 break;
 792         case IWL_UCODE_WOWLAN:
 793                 maxsize = trans(priv)->ucode_wowlan.data.len;
 794                 break;
 795         case IWL_UCODE_NONE:
 796                 IWL_ERR(priv, "uCode does not been loaded\n");
 797                 return -ENOSYS;
 798         default:
 799                 IWL_ERR(priv, "unsupported uCode type\n");
 800                 return -ENOSYS;
 801         }
 802         if ((ofs + size) > (maxsize + SRAM_DATA_SEG_OFFSET)) {
 803                 IWL_ERR(priv, "Invalid offset/size: out of range\n");
 804                 return -EINVAL;
 805         }
 806         priv->testmode_sram.buff_size = (size / 4) * 4;
 807         priv->testmode_sram.buff_addr =
 808                 kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);
 809         if (priv->testmode_sram.buff_addr == NULL) {
 810                 IWL_ERR(priv, "Memory allocation fail\n");
 811                 return -ENOMEM;
 812         }
 813         _iwl_read_targ_mem_words(trans(priv), ofs,
 814                                         priv->testmode_sram.buff_addr,
 815                                         priv->testmode_sram.buff_size / 4);
 816         priv->testmode_sram.num_chunks =
 817                 DIV_ROUND_UP(priv->testmode_sram.buff_size, DUMP_CHUNK_SIZE);
 818         priv->testmode_sram.sram_readed = true;
 819         return 0;
 820 }
 821
 822 static int iwl_testmode_sram_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 823                                    struct sk_buff *skb,
 824                                    struct netlink_callback *cb)
 825 {
 826         struct iwl_priv *priv = hw->priv;
 827         int idx, length;
 828
 829         if (priv->testmode_sram.sram_readed) {
 830                 idx = cb->args[4];
 831                 if (idx >= priv->testmode_sram.num_chunks) {
 832                         iwl_sram_cleanup(priv);
 833                         return -ENOENT;
 834                 }
 835                 length = DUMP_CHUNK_SIZE;
 836                 if (((idx + 1) == priv->testmode_sram.num_chunks) &&
 837                     (priv->testmode_sram.buff_size % DUMP_CHUNK_SIZE))
 838                         length = priv->testmode_sram.buff_size %
 839                                 DUMP_CHUNK_SIZE;
 840
 841                 NLA_PUT(skb, IWL_TM_ATTR_SRAM_DUMP, length,
 842                         priv->testmode_sram.buff_addr +
 843                         (DUMP_CHUNK_SIZE * idx));
 844                 idx++;
 845                 cb->args[4] = idx;
 846                 return 0;
 847         } else
 848                 return -EFAULT;
 849
 850  nla_put_failure:
 851         return -ENOBUFS;
 852 }
 853
 854
 855 /* The testmode gnl message handler that takes the gnl message from the
 856  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 857  * invoke the corresponding handlers.
 858  *
 859  * This function is invoked when there is user space application sending
 860  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 861  * by nl80211.
 862  *
 863  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 864  * dispatching it to the corresponding handler.
 865  *
 866  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 867  * -ENOSYS is replied to the user application if the command is unknown;
 868  * Otherwise, the command is dispatched to the respective handler.
 869  *
 870  * @hw: ieee80211_hw object that represents the device
 871  * @data: pointer to user space message
 872  * @len: length in byte of @data
 873  */
 874 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 875 {
 876         struct nlattr *tb[IWL_TM_ATTR_MAX];
 877         struct iwl_priv *priv = hw->priv;
 878         int result;
 879
 880         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 881                         iwl_testmode_gnl_msg_policy);
 882         if (result != 0) {
 883                 IWL_ERR(priv, "Error parsing the gnl message : %d\n", result);
 884                 return result;
 885         }
 886
 887         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 888         if (!tb[IWL_TM_ATTR_COMMAND]) {
 889                 IWL_ERR(priv, "Missing testmode command type\n");
 890                 return -ENOMSG;
 891         }
 892         /* in case multiple accesses to the device happens */
 893         mutex_lock(&priv->shrd->mutex);
 894
 895         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 896         case IWL_TM_CMD_APP2DEV_UCODE:
 897                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 898                 result = iwl_testmode_ucode(hw, tb);
 899                 break;
 900         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 901         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 902         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 903         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 904         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 905                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 906                 result = iwl_testmode_reg(hw, tb);
 907                 break;
 908         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 909         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 910         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 911         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 912         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 913         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 914         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 915         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 916         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 917         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 918                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
 919                 result = iwl_testmode_driver(hw, tb);
 920                 break;
 921
 922         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 923         case IWL_TM_CMD_APP2DEV_END_TRACE:
 924         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 925                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
 926                 result = iwl_testmode_trace(hw, tb);
 927                 break;
 928
 929         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
 930                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
 931                 result = iwl_testmode_ownership(hw, tb);
 932                 break;
 933
 934         case IWL_TM_CMD_APP2DEV_READ_SRAM:
 935                 IWL_DEBUG_INFO(priv, "testmode sram read cmd to driver\n");
 936                 result = iwl_testmode_sram(hw, tb);
 937                 break;
 938
 939         default:
 940                 IWL_ERR(priv, "Unknown testmode command\n");
 941                 result = -ENOSYS;
 942                 break;
 943         }
 944
 945         mutex_unlock(&priv->shrd->mutex);
 946         return result;
 947 }
 948
 949 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 950                       struct netlink_callback *cb,
 951                       void *data, int len)
 952 {
 953         struct nlattr *tb[IWL_TM_ATTR_MAX];
 954         struct iwl_priv *priv = hw->priv;
 955         int result;
 956         u32 cmd;
 957
 958         if (cb->args[3]) {
 959                 /* offset by 1 since commands start at 0 */
 960                 cmd = cb->args[3] - 1;
 961         } else {
 962                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 963                                 iwl_testmode_gnl_msg_policy);
 964                 if (result) {
 965                         IWL_ERR(priv,
 966                                 "Error parsing the gnl message : %d\n", result);
 967                         return result;
 968                 }
 969
 970                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 971                 if (!tb[IWL_TM_ATTR_COMMAND]) {
 972                         IWL_ERR(priv, "Missing testmode command type\n");
 973                         return -ENOMSG;
 974                 }
 975                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 976                 cb->args[3] = cmd + 1;
 977         }
 978
 979         /* in case multiple accesses to the device happens */
 980         mutex_lock(&priv->shrd->mutex);
 981         switch (cmd) {
 982         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 983                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
 984                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
 985                 break;
 986         case IWL_TM_CMD_APP2DEV_DUMP_SRAM:
 987                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
 988                 result = iwl_testmode_sram_dump(hw, tb, skb, cb);
 989                 break;
 990         default:
 991                 result = -EINVAL;
 992                 break;
 993         }
 994
 995         mutex_unlock(&priv->shrd->mutex);
 996         return result;
 997 }