drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-wifi.h"
  74 #include "iwl-dev.h"
  75 #include "iwl-core.h"
  76 #include "iwl-debug.h"
  77 #include "iwl-io.h"
  78 #include "iwl-agn.h"
  79 #include "iwl-testmode.h"
  80 #include "iwl-trans.h"
  81 #include "iwl-bus.h"
  82 #include "iwl-fh.h"
  83
  84
  85 /* Periphery registers absolute lower bound. This is used in order to
  86  * differentiate registery access through HBUS_TARG_PRPH_* and
  87  * HBUS_TARG_MEM_* accesses.
  88  */
  89 #define IWL_TM_ABS_PRPH_START (0xA00000)
  90
  91 /* The TLVs used in the gnl message policy between the kernel module and
  92  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  93  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  94  * See iwl-testmode.h
  95  */
  96 static
  97 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  98         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  99
 100         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
 101         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
 102
 103         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
 104         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
 105         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
 106
 107         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
 108         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 109
 110         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 111
 112         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 113         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 114         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 115
 116         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 117
 118         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 119
 120         [IWL_TM_ATTR_MEM_ADDR] = { .type = NLA_U32, },
 121         [IWL_TM_ATTR_BUFFER_SIZE] = { .type = NLA_U32, },
 122         [IWL_TM_ATTR_BUFFER_DUMP] = { .type = NLA_UNSPEC, },
 123
 124         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 125         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 126         [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
 127         [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
 128         [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
 129 };
 130
 131 /*
 132  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 133  * received events from the device
 134  */
 135 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 136 {
 137         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 138         if (pkt)
 139                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 140         else
 141                 return 0;
 142 }
 143
 144
 145 /*
 146  * This function multicasts the spontaneous messages from the device to the
 147  * user space. It is invoked whenever there is a received messages
 148  * from the device. This function is called within the ISR of the rx handlers
 149  * in iwlagn driver.
 150  *
 151  * The parsing of the message content is left to the user space application,
 152  * The message content is treated as unattacked raw data and is encapsulated
 153  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 154  *
 155  * @priv: the instance of iwlwifi device
 156  * @rxb: pointer to rx data content received by the ISR
 157  *
 158  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 159  * For the messages multicasting to the user application, the mandatory
 160  * TLV fields are :
 161  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 162  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 163  */
 164
 165 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 166                                 struct iwl_rx_mem_buffer *rxb)
 167 {
 168         struct ieee80211_hw *hw = priv->hw;
 169         struct sk_buff *skb;
 170         void *data;
 171         int length;
 172
 173         data = (void *)rxb_addr(rxb);
 174         length = get_event_length(rxb);
 175
 176         if (!data || length == 0)
 177                 return;
 178
 179         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 180                                                                 GFP_ATOMIC);
 181         if (skb == NULL) {
 182                 IWL_ERR(priv,
 183                          "Run out of memory for messages to user space ?\n");
 184                 return;
 185         }
 186         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 187         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 188         cfg80211_testmode_event(skb, GFP_ATOMIC);
 189         return;
 190
 191 nla_put_failure:
 192         kfree_skb(skb);
 193         IWL_ERR(priv, "Ouch, overran buffer, check allocation!\n");
 194 }
 195
 196 void iwl_testmode_init(struct iwl_priv *priv)
 197 {
 198         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 199         priv->testmode_trace.trace_enabled = false;
 200         priv->testmode_mem.read_in_progress = false;
 201 }
 202
 203 static void iwl_mem_cleanup(struct iwl_priv *priv)
 204 {
 205         if (priv->testmode_mem.read_in_progress) {
 206                 kfree(priv->testmode_mem.buff_addr);
 207                 priv->testmode_mem.buff_addr = NULL;
 208                 priv->testmode_mem.buff_size = 0;
 209                 priv->testmode_mem.num_chunks = 0;
 210                 priv->testmode_mem.read_in_progress = false;
 211         }
 212 }
 213
 214 static void iwl_trace_cleanup(struct iwl_priv *priv)
 215 {
 216         if (priv->testmode_trace.trace_enabled) {
 217                 if (priv->testmode_trace.cpu_addr &&
 218                     priv->testmode_trace.dma_addr)
 219                         dma_free_coherent(trans(priv)->dev,
 220                                         priv->testmode_trace.total_size,
 221                                         priv->testmode_trace.cpu_addr,
 222                                         priv->testmode_trace.dma_addr);
 223                 priv->testmode_trace.trace_enabled = false;
 224                 priv->testmode_trace.cpu_addr = NULL;
 225                 priv->testmode_trace.trace_addr = NULL;
 226                 priv->testmode_trace.dma_addr = 0;
 227                 priv->testmode_trace.buff_size = 0;
 228                 priv->testmode_trace.total_size = 0;
 229         }
 230 }
 231
 232
 233 void iwl_testmode_cleanup(struct iwl_priv *priv)
 234 {
 235         iwl_trace_cleanup(priv);
 236         iwl_mem_cleanup(priv);
 237 }
 238
 239 /*
 240  * This function handles the user application commands to the ucode.
 241  *
 242  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 243  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 244  * host command to the ucode.
 245  *
 246  * If any mandatory field is missing, -ENOMSG is replied to the user space
 247  * application; otherwise, the actual execution result of the host command to
 248  * ucode is replied.
 249  *
 250  * @hw: ieee80211_hw object that represents the device
 251  * @tb: gnl message fields from the user space
 252  */
 253 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 254 {
 255         struct iwl_priv *priv = hw->priv;
 256         struct iwl_host_cmd cmd;
 257
 258         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 259
 260         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 261             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 262                 IWL_ERR(priv, "Missing ucode command mandatory fields\n");
 263                 return -ENOMSG;
 264         }
 265
 266         cmd.flags = CMD_ON_DEMAND;
 267         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 268         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 269         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 270         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 271         IWL_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 272                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 273         /* ok, let's submit the command to ucode */
 274         return iwl_trans_send_cmd(trans(priv), &cmd);
 275 }
 276
 277
 278 /*
 279  * This function handles the user application commands for register access.
 280  *
 281  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 282  * handlers respectively.
 283  *
 284  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 285  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 286  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 287  * the success of the command execution.
 288  *
 289  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 290  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 291  *
 292  * @hw: ieee80211_hw object that represents the device
 293  * @tb: gnl message fields from the user space
 294  */
 295 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 296 {
 297         struct iwl_priv *priv = hw->priv;
 298         u32 ofs, val32, cmd;
 299         u8 val8;
 300         struct sk_buff *skb;
 301         int status = 0;
 302
 303         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 304                 IWL_ERR(priv, "Missing register offset\n");
 305                 return -ENOMSG;
 306         }
 307         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 308         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 309
 310         /* Allow access only to FH/CSR/HBUS in direct mode.
 311         Since we don't have the upper bounds for the CSR and HBUS segments,
 312         we will use only the upper bound of FH for sanity check. */
 313         cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 314         if ((cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32 ||
 315                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32 ||
 316                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8) &&
 317                 (ofs >= FH_MEM_UPPER_BOUND)) {
 318                 IWL_ERR(priv, "offset out of segment (0x0 - 0x%x)\n",
 319                         FH_MEM_UPPER_BOUND);
 320                 return -EINVAL;
 321         }
 322
 323         switch (cmd) {
 324         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 325                 val32 = iwl_read_direct32(trans(priv), ofs);
 326                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 327
 328                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 329                 if (!skb) {
 330                         IWL_ERR(priv, "Memory allocation fail\n");
 331                         return -ENOMEM;
 332                 }
 333                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 334                 status = cfg80211_testmode_reply(skb);
 335                 if (status < 0)
 336                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 337                 break;
 338         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 339                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 340                         IWL_ERR(priv, "Missing value to write\n");
 341                         return -ENOMSG;
 342                 } else {
 343                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 344                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 345                         iwl_write_direct32(trans(priv), ofs, val32);
 346                 }
 347                 break;
 348         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 349                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 350                         IWL_ERR(priv, "Missing value to write\n");
 351                         return -ENOMSG;
 352                 } else {
 353                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 354                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 355                         iwl_write8(trans(priv), ofs, val8);
 356                 }
 357                 break;
 358         default:
 359                 IWL_ERR(priv, "Unknown testmode register command ID\n");
 360                 return -ENOSYS;
 361         }
 362
 363         return status;
 364
 365 nla_put_failure:
 366         kfree_skb(skb);
 367         return -EMSGSIZE;
 368 }
 369
 370
 371 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 372 {
 373         struct iwl_notification_wait calib_wait;
 374         int ret;
 375
 376         iwl_init_notification_wait(priv->shrd, &calib_wait,
 377                                       CALIBRATION_COMPLETE_NOTIFICATION,
 378                                       NULL, NULL);
 379         ret = iwl_init_alive_start(trans(priv));
 380         if (ret) {
 381                 IWL_ERR(priv, "Fail init calibration: %d\n", ret);
 382                 goto cfg_init_calib_error;
 383         }
 384
 385         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 386         if (ret)
 387                 IWL_ERR(priv, "Error detecting"
 388                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 389         return ret;
 390
 391 cfg_init_calib_error:
 392         iwl_remove_notification(priv->shrd, &calib_wait);
 393         return ret;
 394 }
 395
 396 /*
 397  * This function handles the user application commands for driver.
 398  *
 399  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 400  * handlers respectively.
 401  *
 402  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 403  * value of the actual command execution is replied to the user application.
 404  *
 405  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 406  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 407  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 408  *
 409  * @hw: ieee80211_hw object that represents the device
 410  * @tb: gnl message fields from the user space
 411  */
 412 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 413 {
 414         struct iwl_priv *priv = hw->priv;
 415         struct iwl_trans *trans = trans(priv);
 416         struct sk_buff *skb;
 417         unsigned char *rsp_data_ptr = NULL;
 418         int status = 0, rsp_data_len = 0;
 419         u32 devid, inst_size = 0, data_size = 0;
 420
 421         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 422         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 423                 rsp_data_ptr = (unsigned char *)cfg(priv)->name;
 424                 rsp_data_len = strlen(cfg(priv)->name);
 425                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 426                                                         rsp_data_len + 20);
 427                 if (!skb) {
 428                         IWL_ERR(priv, "Memory allocation fail\n");
 429                         return -ENOMEM;
 430                 }
 431                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 432                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 433                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 434                         rsp_data_len, rsp_data_ptr);
 435                 status = cfg80211_testmode_reply(skb);
 436                 if (status < 0)
 437                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 438                 break;
 439
 440         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 441                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_INIT);
 442                 if (status)
 443                         IWL_ERR(priv, "Error loading init ucode: %d\n", status);
 444                 break;
 445
 446         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 447                 iwl_testmode_cfg_init_calib(priv);
 448                 iwl_trans_stop_device(trans);
 449                 break;
 450
 451         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 452                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_REGULAR);
 453                 if (status) {
 454                         IWL_ERR(priv,
 455                                 "Error loading runtime ucode: %d\n", status);
 456                         break;
 457                 }
 458                 status = iwl_alive_start(priv);
 459                 if (status)
 460                         IWL_ERR(priv,
 461                                 "Error starting the device: %d\n", status);
 462                 break;
 463
 464         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 465                 iwl_scan_cancel_timeout(priv, 200);
 466                 iwl_trans_stop_device(trans);
 467                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_WOWLAN);
 468                 if (status) {
 469                         IWL_ERR(priv,
 470                                 "Error loading WOWLAN ucode: %d\n", status);
 471                         break;
 472                 }
 473                 status = iwl_alive_start(priv);
 474                 if (status)
 475                         IWL_ERR(priv,
 476                                 "Error starting the device: %d\n", status);
 477                 break;
 478
 479         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 480                 if (priv->shrd->eeprom) {
 481                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 482                                 cfg(priv)->base_params->eeprom_size + 20);
 483                         if (!skb) {
 484                                 IWL_ERR(priv, "Memory allocation fail\n");
 485                                 return -ENOMEM;
 486                         }
 487                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 488                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 489                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 490                                 cfg(priv)->base_params->eeprom_size,
 491                                 priv->shrd->eeprom);
 492                         status = cfg80211_testmode_reply(skb);
 493                         if (status < 0)
 494                                 IWL_ERR(priv, "Error sending msg : %d\n",
 495                                         status);
 496                 } else
 497                         return -EFAULT;
 498                 break;
 499
 500         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 501                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 502                         IWL_ERR(priv, "Missing fixrate setting\n");
 503                         return -ENOMSG;
 504                 }
 505                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 506                 break;
 507
 508         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 509                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 510
 511                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 512                 if (!skb) {
 513                         IWL_ERR(priv, "Memory allocation fail\n");
 514                         return -ENOMEM;
 515                 }
 516                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 517                 status = cfg80211_testmode_reply(skb);
 518                 if (status < 0)
 519                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 520                 break;
 521
 522         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 523                 devid = trans(priv)->hw_id;
 524                 IWL_INFO(priv, "hw version: 0x%x\n", devid);
 525
 526                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 527                 if (!skb) {
 528                         IWL_ERR(priv, "Memory allocation fail\n");
 529                         return -ENOMEM;
 530                 }
 531                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 532                 status = cfg80211_testmode_reply(skb);
 533                 if (status < 0)
 534                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 535                 break;
 536
 537         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 538                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
 539                 if (!skb) {
 540                         IWL_ERR(priv, "Memory allocation fail\n");
 541                         return -ENOMEM;
 542                 }
 543                 switch (priv->shrd->ucode_type) {
 544                 case IWL_UCODE_REGULAR:
 545                         inst_size = trans(priv)->ucode_rt.code.len;
 546                         data_size = trans(priv)->ucode_rt.data.len;
 547                         break;
 548                 case IWL_UCODE_INIT:
 549                         inst_size = trans(priv)->ucode_init.code.len;
 550                         data_size = trans(priv)->ucode_init.data.len;
 551                         break;
 552                 case IWL_UCODE_WOWLAN:
 553                         inst_size = trans(priv)->ucode_wowlan.code.len;
 554                         data_size = trans(priv)->ucode_wowlan.data.len;
 555                         break;
 556                 case IWL_UCODE_NONE:
 557                         IWL_ERR(priv, "No uCode has not been loaded\n");
 558                         break;
 559                 default:
 560                         IWL_ERR(priv, "Unsupported uCode type\n");
 561                         break;
 562                 }
 563                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_TYPE, priv->shrd->ucode_type);
 564                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size);
 565                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size);
 566                 status = cfg80211_testmode_reply(skb);
 567                 if (status < 0)
 568                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 569                 break;
 570
 571         default:
 572                 IWL_ERR(priv, "Unknown testmode driver command ID\n");
 573                 return -ENOSYS;
 574         }
 575         return status;
 576
 577 nla_put_failure:
 578         kfree_skb(skb);
 579         return -EMSGSIZE;
 580 }
 581
 582
 583 /*
 584  * This function handles the user application commands for uCode trace
 585  *
 586  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 587  * handlers respectively.
 588  *
 589  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 590  * value of the actual command execution is replied to the user application.
 591  *
 592  * @hw: ieee80211_hw object that represents the device
 593  * @tb: gnl message fields from the user space
 594  */
 595 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 596 {
 597         struct iwl_priv *priv = hw->priv;
 598         struct sk_buff *skb;
 599         int status = 0;
 600         struct device *dev = trans(priv)->dev;
 601
 602         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 603         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 604                 if (priv->testmode_trace.trace_enabled)
 605                         return -EBUSY;
 606
 607                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 608                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 609                 else
 610                         priv->testmode_trace.buff_size =
 611                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 612                 if (!priv->testmode_trace.buff_size)
 613                         return -EINVAL;
 614                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 615                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 616                         return -EINVAL;
 617
 618                 priv->testmode_trace.total_size =
 619                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 620                 priv->testmode_trace.cpu_addr =
 621                         dma_alloc_coherent(dev,
 622                                            priv->testmode_trace.total_size,
 623                                            &priv->testmode_trace.dma_addr,
 624                                            GFP_KERNEL);
 625                 if (!priv->testmode_trace.cpu_addr)
 626                         return -ENOMEM;
 627                 priv->testmode_trace.trace_enabled = true;
 628                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 629                         priv->testmode_trace.cpu_addr, 0x100);
 630                 memset(priv->testmode_trace.trace_addr, 0x03B,
 631                         priv->testmode_trace.buff_size);
 632                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 633                         sizeof(priv->testmode_trace.dma_addr) + 20);
 634                 if (!skb) {
 635                         IWL_ERR(priv, "Memory allocation fail\n");
 636                         iwl_trace_cleanup(priv);
 637                         return -ENOMEM;
 638                 }
 639                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 640                         sizeof(priv->testmode_trace.dma_addr),
 641                         (u64 *)&priv->testmode_trace.dma_addr);
 642                 status = cfg80211_testmode_reply(skb);
 643                 if (status < 0) {
 644                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 645                 }
 646                 priv->testmode_trace.num_chunks =
 647                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 648                                      DUMP_CHUNK_SIZE);
 649                 break;
 650
 651         case IWL_TM_CMD_APP2DEV_END_TRACE:
 652                 iwl_trace_cleanup(priv);
 653                 break;
 654         default:
 655                 IWL_ERR(priv, "Unknown testmode mem command ID\n");
 656                 return -ENOSYS;
 657         }
 658         return status;
 659
 660 nla_put_failure:
 661         kfree_skb(skb);
 662         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 663             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 664                 iwl_trace_cleanup(priv);
 665         return -EMSGSIZE;
 666 }
 667
 668 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 669                                    struct sk_buff *skb,
 670                                    struct netlink_callback *cb)
 671 {
 672         struct iwl_priv *priv = hw->priv;
 673         int idx, length;
 674
 675         if (priv->testmode_trace.trace_enabled &&
 676             priv->testmode_trace.trace_addr) {
 677                 idx = cb->args[4];
 678                 if (idx >= priv->testmode_trace.num_chunks)
 679                         return -ENOENT;
 680                 length = DUMP_CHUNK_SIZE;
 681                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 682                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 683                         length = priv->testmode_trace.buff_size %
 684                                 DUMP_CHUNK_SIZE;
 685
 686                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 687                         priv->testmode_trace.trace_addr +
 688                         (DUMP_CHUNK_SIZE * idx));
 689                 idx++;
 690                 cb->args[4] = idx;
 691                 return 0;
 692         } else
 693                 return -EFAULT;
 694
 695  nla_put_failure:
 696         return -ENOBUFS;
 697 }
 698
 699 /*
 700  * This function handles the user application switch ucode ownership.
 701  *
 702  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 703  * decide who the current owner of the uCode
 704  *
 705  * If the current owner is OWNERSHIP_TM, then the only host command
 706  * can deliver to uCode is from testmode, all the other host commands
 707  * will dropped.
 708  *
 709  * default driver is the owner of uCode in normal operational mode
 710  *
 711  * @hw: ieee80211_hw object that represents the device
 712  * @tb: gnl message fields from the user space
 713  */
 714 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 715 {
 716         struct iwl_priv *priv = hw->priv;
 717         u8 owner;
 718
 719         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 720                 IWL_ERR(priv, "Missing ucode owner\n");
 721                 return -ENOMSG;
 722         }
 723
 724         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 725         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 726                 priv->shrd->ucode_owner = owner;
 727         else {
 728                 IWL_ERR(priv, "Invalid owner\n");
 729                 return -EINVAL;
 730         }
 731         return 0;
 732 }
 733
 734 static int iwl_testmode_indirect_read(struct iwl_priv *priv, u32 addr, u32 size)
 735 {
 736         struct iwl_trans *trans = trans(priv);
 737         unsigned long flags;
 738         int i;
 739
 740         if (size & 0x3)
 741                 return -EINVAL;
 742         priv->testmode_mem.buff_size = size;
 743         priv->testmode_mem.buff_addr =
 744                 kmalloc(priv->testmode_mem.buff_size, GFP_KERNEL);
 745         if (priv->testmode_mem.buff_addr == NULL)
 746                 return -ENOMEM;
 747
 748         /* Hard-coded periphery absolute address */
 749         if (IWL_TM_ABS_PRPH_START <= addr &&
 750                 addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
 751                         spin_lock_irqsave(&trans->reg_lock, flags);
 752                         iwl_grab_nic_access(trans);
 753                         iwl_write32(trans, HBUS_TARG_PRPH_RADDR, addr);
 754                         for (i = 0; i < size; i += 4)
 755                                 priv->testmode_mem.buff_addr[i] =
 756                                         iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
 757                         iwl_release_nic_access(trans);
 758                         spin_unlock_irqrestore(&trans->reg_lock, flags);
 759         } else { /* target memory (SRAM) */
 760                 _iwl_read_targ_mem_words(trans, addr,
 761                         priv->testmode_mem.buff_addr,
 762                         priv->testmode_mem.buff_size / 4);
 763         }
 764
 765         priv->testmode_mem.num_chunks =
 766                 DIV_ROUND_UP(priv->testmode_mem.buff_size, DUMP_CHUNK_SIZE);
 767         priv->testmode_mem.read_in_progress = true;
 768         return 0;
 769
 770 }
 771
 772 static int iwl_testmode_indirect_write(struct iwl_priv *priv, u32 addr,
 773         u32 size, unsigned char *buf)
 774 {
 775         struct iwl_trans *trans = trans(priv);
 776         u32 val, i;
 777         unsigned long flags;
 778
 779         if (IWL_TM_ABS_PRPH_START <= addr &&
 780                 addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
 781                         /* Periphery writes can be 1-3 bytes long, or DWORDs */
 782                         if (size < 4) {
 783                                 memcpy(&val, buf, size);
 784                                 spin_lock_irqsave(&trans->reg_lock, flags);
 785                                 iwl_grab_nic_access(trans);
 786                                 iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
 787                                             (addr & 0x0000FFFF) | (size << 24));
 788                                 iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
 789                                 iwl_release_nic_access(trans);
 790                                 /* needed after consecutive writes w/o read */
 791                                 mmiowb();
 792                                 spin_unlock_irqrestore(&trans->reg_lock, flags);
 793                         } else {
 794                                 if (size % 4)
 795                                         return -EINVAL;
 796                                 for (i = 0; i < size; i += 4)
 797                                         iwl_write_prph(trans, addr+i,
 798                                                 *(u32 *)buf+i);
 799                         }
 800         } else if (iwlagn_hw_valid_rtc_data_addr(addr) ||
 801                 (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&
 802                 addr < IWLAGN_RTC_INST_UPPER_BOUND)) {
 803                         _iwl_write_targ_mem_words(trans, addr, buf, size/4);
 804         } else
 805                 return -EINVAL;
 806         return 0;
 807 }
 808
 809 /*
 810  * This function handles the user application commands for SRAM data dump
 811  *
 812  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 813  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 814  *
 815  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 816  * previous command has not been delivered to userspace, or -ENOMSG if
 817  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 818  * are missing, or -ENOMEM if the buffer allocation fails.
 819  *
 820  * Otherwise 0 is replied indicating the success of the SRAM reading.
 821  *
 822  * @hw: ieee80211_hw object that represents the device
 823  * @tb: gnl message fields from the user space
 824  */
 825 static int iwl_testmode_indirect_mem(struct ieee80211_hw *hw,
 826         struct nlattr **tb)
 827 {
 828         struct iwl_priv *priv = hw->priv;
 829         u32 addr, size, cmd;
 830         unsigned char *buf;
 831
 832         /* Both read and write should be blocked, for atomicity */
 833         if (priv->testmode_mem.read_in_progress)
 834                 return -EBUSY;
 835
 836         cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 837         if (!tb[IWL_TM_ATTR_MEM_ADDR]) {
 838                 IWL_ERR(priv, "Error finding memory offset address\n");
 839                 return -ENOMSG;
 840         }
 841         addr = nla_get_u32(tb[IWL_TM_ATTR_MEM_ADDR]);
 842         if (!tb[IWL_TM_ATTR_BUFFER_SIZE]) {
 843                 IWL_ERR(priv, "Error finding size for memory reading\n");
 844                 return -ENOMSG;
 845         }
 846         size = nla_get_u32(tb[IWL_TM_ATTR_BUFFER_SIZE]);
 847
 848         if (cmd == IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ)
 849                 return iwl_testmode_indirect_read(priv, addr,  size);
 850         else {
 851                 if (!tb[IWL_TM_ATTR_BUFFER_DUMP])
 852                         return -EINVAL;
 853                 buf = (unsigned char *) nla_data(tb[IWL_TM_ATTR_BUFFER_DUMP]);
 854                 return iwl_testmode_indirect_write(priv, addr, size, buf);
 855         }
 856 }
 857
 858 static int iwl_testmode_buffer_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 859                                    struct sk_buff *skb,
 860                                    struct netlink_callback *cb)
 861 {
 862         struct iwl_priv *priv = hw->priv;
 863         int idx, length;
 864
 865         if (priv->testmode_mem.read_in_progress) {
 866                 idx = cb->args[4];
 867                 if (idx >= priv->testmode_mem.num_chunks) {
 868                         iwl_mem_cleanup(priv);
 869                         return -ENOENT;
 870                 }
 871                 length = DUMP_CHUNK_SIZE;
 872                 if (((idx + 1) == priv->testmode_mem.num_chunks) &&
 873                     (priv->testmode_mem.buff_size % DUMP_CHUNK_SIZE))
 874                         length = priv->testmode_mem.buff_size %
 875                                 DUMP_CHUNK_SIZE;
 876
 877                 NLA_PUT(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
 878                         priv->testmode_mem.buff_addr +
 879                         (DUMP_CHUNK_SIZE * idx));
 880                 idx++;
 881                 cb->args[4] = idx;
 882                 return 0;
 883         } else
 884                 return -EFAULT;
 885
 886  nla_put_failure:
 887         return -ENOBUFS;
 888 }
 889
 890
 891 /* The testmode gnl message handler that takes the gnl message from the
 892  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 893  * invoke the corresponding handlers.
 894  *
 895  * This function is invoked when there is user space application sending
 896  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 897  * by nl80211.
 898  *
 899  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 900  * dispatching it to the corresponding handler.
 901  *
 902  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 903  * -ENOSYS is replied to the user application if the command is unknown;
 904  * Otherwise, the command is dispatched to the respective handler.
 905  *
 906  * @hw: ieee80211_hw object that represents the device
 907  * @data: pointer to user space message
 908  * @len: length in byte of @data
 909  */
 910 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 911 {
 912         struct nlattr *tb[IWL_TM_ATTR_MAX];
 913         struct iwl_priv *priv = hw->priv;
 914         int result;
 915
 916         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 917                         iwl_testmode_gnl_msg_policy);
 918         if (result != 0) {
 919                 IWL_ERR(priv, "Error parsing the gnl message : %d\n", result);
 920                 return result;
 921         }
 922
 923         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 924         if (!tb[IWL_TM_ATTR_COMMAND]) {
 925                 IWL_ERR(priv, "Missing testmode command type\n");
 926                 return -ENOMSG;
 927         }
 928         /* in case multiple accesses to the device happens */
 929         mutex_lock(&priv->shrd->mutex);
 930
 931         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 932         case IWL_TM_CMD_APP2DEV_UCODE:
 933                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 934                 result = iwl_testmode_ucode(hw, tb);
 935                 break;
 936         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 937         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 938         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 939                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 940                 result = iwl_testmode_reg(hw, tb);
 941                 break;
 942         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 943         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 944         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 945         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 946         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 947         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 948         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 949         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 950         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 951         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 952                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
 953                 result = iwl_testmode_driver(hw, tb);
 954                 break;
 955
 956         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 957         case IWL_TM_CMD_APP2DEV_END_TRACE:
 958         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 959                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
 960                 result = iwl_testmode_trace(hw, tb);
 961                 break;
 962
 963         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
 964                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
 965                 result = iwl_testmode_ownership(hw, tb);
 966                 break;
 967
 968         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
 969         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
 970                 IWL_DEBUG_INFO(priv, "testmode indirect memory cmd "
 971                         "to driver\n");
 972                 result = iwl_testmode_indirect_mem(hw, tb);
 973                 break;
 974
 975         default:
 976                 IWL_ERR(priv, "Unknown testmode command\n");
 977                 result = -ENOSYS;
 978                 break;
 979         }
 980
 981         mutex_unlock(&priv->shrd->mutex);
 982         return result;
 983 }
 984
 985 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 986                       struct netlink_callback *cb,
 987                       void *data, int len)
 988 {
 989         struct nlattr *tb[IWL_TM_ATTR_MAX];
 990         struct iwl_priv *priv = hw->priv;
 991         int result;
 992         u32 cmd;
 993
 994         if (cb->args[3]) {
 995                 /* offset by 1 since commands start at 0 */
 996                 cmd = cb->args[3] - 1;
 997         } else {
 998                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 999                                 iwl_testmode_gnl_msg_policy);
1000                 if (result) {
1001                         IWL_ERR(priv,
1002                                 "Error parsing the gnl message : %d\n", result);
1003                         return result;
1004                 }
1005
1006                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
1007                 if (!tb[IWL_TM_ATTR_COMMAND]) {
1008                         IWL_ERR(priv, "Missing testmode command type\n");
1009                         return -ENOMSG;
1010                 }
1011                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
1012                 cb->args[3] = cmd + 1;
1013         }
1014
1015         /* in case multiple accesses to the device happens */
1016         mutex_lock(&priv->shrd->mutex);
1017         switch (cmd) {
1018         case IWL_TM_CMD_APP2DEV_READ_TRACE:
1019                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
1020                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
1021                 break;
1022         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
1023                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
1024                 result = iwl_testmode_buffer_dump(hw, tb, skb, cb);
1025                 break;
1026         default:
1027                 result = -EINVAL;
1028                 break;
1029         }
1030
1031         mutex_unlock(&priv->shrd->mutex);
1032         return result;
1033 }