drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-wifi.h"
  74 #include "iwl-dev.h"
  75 #include "iwl-core.h"
  76 #include "iwl-debug.h"
  77 #include "iwl-io.h"
  78 #include "iwl-agn.h"
  79 #include "iwl-testmode.h"
  80 #include "iwl-trans.h"
  81 #include "iwl-bus.h"
  82
  83 /* The TLVs used in the gnl message policy between the kernel module and
  84  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  85  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  86  * See iwl-testmode.h
  87  */
  88 static
  89 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  90         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  91
  92         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
  93         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
  94
  95         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
  96         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
  97         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
  98
  99         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
 100         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 101
 102         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 103
 104         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 105         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 106         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 107
 108         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 109
 110         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 111
 112         [IWL_TM_ATTR_SRAM_ADDR] = { .type = NLA_U32, },
 113         [IWL_TM_ATTR_SRAM_SIZE] = { .type = NLA_U32, },
 114         [IWL_TM_ATTR_SRAM_DUMP] = { .type = NLA_UNSPEC, },
 115
 116         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 117         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 118         [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
 119         [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
 120         [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
 121 };
 122
 123 /*
 124  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 125  * received events from the device
 126  */
 127 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 128 {
 129         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 130         if (pkt)
 131                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 132         else
 133                 return 0;
 134 }
 135
 136
 137 /*
 138  * This function multicasts the spontaneous messages from the device to the
 139  * user space. It is invoked whenever there is a received messages
 140  * from the device. This function is called within the ISR of the rx handlers
 141  * in iwlagn driver.
 142  *
 143  * The parsing of the message content is left to the user space application,
 144  * The message content is treated as unattacked raw data and is encapsulated
 145  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 146  *
 147  * @priv: the instance of iwlwifi device
 148  * @rxb: pointer to rx data content received by the ISR
 149  *
 150  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 151  * For the messages multicasting to the user application, the mandatory
 152  * TLV fields are :
 153  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 154  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 155  */
 156
 157 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 158                                 struct iwl_rx_mem_buffer *rxb)
 159 {
 160         struct ieee80211_hw *hw = priv->hw;
 161         struct sk_buff *skb;
 162         void *data;
 163         int length;
 164
 165         data = (void *)rxb_addr(rxb);
 166         length = get_event_length(rxb);
 167
 168         if (!data || length == 0)
 169                 return;
 170
 171         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 172                                                                 GFP_ATOMIC);
 173         if (skb == NULL) {
 174                 IWL_DEBUG_INFO(priv,
 175                          "Run out of memory for messages to user space ?\n");
 176                 return;
 177         }
 178         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 179         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 180         cfg80211_testmode_event(skb, GFP_ATOMIC);
 181         return;
 182
 183 nla_put_failure:
 184         kfree_skb(skb);
 185         IWL_DEBUG_INFO(priv, "Ouch, overran buffer, check allocation!\n");
 186 }
 187
 188 void iwl_testmode_init(struct iwl_priv *priv)
 189 {
 190         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 191         priv->testmode_trace.trace_enabled = false;
 192         priv->testmode_sram.sram_readed = false;
 193 }
 194
 195 static void iwl_sram_cleanup(struct iwl_priv *priv)
 196 {
 197         if (priv->testmode_sram.sram_readed) {
 198                 kfree(priv->testmode_sram.buff_addr);
 199                 priv->testmode_sram.buff_addr = NULL;
 200                 priv->testmode_sram.buff_size = 0;
 201                 priv->testmode_sram.num_chunks = 0;
 202                 priv->testmode_sram.sram_readed = false;
 203         }
 204 }
 205
 206 static void iwl_trace_cleanup(struct iwl_priv *priv)
 207 {
 208         if (priv->testmode_trace.trace_enabled) {
 209                 if (priv->testmode_trace.cpu_addr &&
 210                     priv->testmode_trace.dma_addr)
 211                         dma_free_coherent(bus(priv)->dev,
 212                                         priv->testmode_trace.total_size,
 213                                         priv->testmode_trace.cpu_addr,
 214                                         priv->testmode_trace.dma_addr);
 215                 priv->testmode_trace.trace_enabled = false;
 216                 priv->testmode_trace.cpu_addr = NULL;
 217                 priv->testmode_trace.trace_addr = NULL;
 218                 priv->testmode_trace.dma_addr = 0;
 219                 priv->testmode_trace.buff_size = 0;
 220                 priv->testmode_trace.total_size = 0;
 221         }
 222 }
 223
 224
 225 void iwl_testmode_cleanup(struct iwl_priv *priv)
 226 {
 227         iwl_trace_cleanup(priv);
 228         iwl_sram_cleanup(priv);
 229 }
 230
 231 /*
 232  * This function handles the user application commands to the ucode.
 233  *
 234  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 235  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 236  * host command to the ucode.
 237  *
 238  * If any mandatory field is missing, -ENOMSG is replied to the user space
 239  * application; otherwise, the actual execution result of the host command to
 240  * ucode is replied.
 241  *
 242  * @hw: ieee80211_hw object that represents the device
 243  * @tb: gnl message fields from the user space
 244  */
 245 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 246 {
 247         struct iwl_priv *priv = hw->priv;
 248         struct iwl_host_cmd cmd;
 249
 250         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 251
 252         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 253             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 254                 IWL_DEBUG_INFO(priv,
 255                         "Error finding ucode command mandatory fields\n");
 256                 return -ENOMSG;
 257         }
 258
 259         cmd.flags = CMD_ON_DEMAND;
 260         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 261         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 262         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 263         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 264         IWL_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 265                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 266         /* ok, let's submit the command to ucode */
 267         return iwl_trans_send_cmd(trans(priv), &cmd);
 268 }
 269
 270
 271 /*
 272  * This function handles the user application commands for register access.
 273  *
 274  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 275  * handlers respectively.
 276  *
 277  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 278  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 279  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 280  * the success of the command execution.
 281  *
 282  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 283  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 284  *
 285  * @hw: ieee80211_hw object that represents the device
 286  * @tb: gnl message fields from the user space
 287  */
 288 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 289 {
 290         struct iwl_priv *priv = hw->priv;
 291         u32 ofs, val32;
 292         u8 val8;
 293         struct sk_buff *skb;
 294         int status = 0;
 295
 296         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 297                 IWL_DEBUG_INFO(priv, "Error finding register offset\n");
 298                 return -ENOMSG;
 299         }
 300         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 301         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 302
 303         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 304         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 305                 val32 = iwl_read_direct32(bus(priv), ofs);
 306                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 307
 308                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 309                 if (!skb) {
 310                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 311                         return -ENOMEM;
 312                 }
 313                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 314                 status = cfg80211_testmode_reply(skb);
 315                 if (status < 0)
 316                         IWL_DEBUG_INFO(priv,
 317                                        "Error sending msg : %d\n", status);
 318                 break;
 319         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 320                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 321                         IWL_DEBUG_INFO(priv,
 322                                        "Error finding value to write\n");
 323                         return -ENOMSG;
 324                 } else {
 325                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 326                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 327                         iwl_write_direct32(bus(priv), ofs, val32);
 328                 }
 329                 break;
 330         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 331                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 332                         IWL_DEBUG_INFO(priv, "Error finding value to write\n");
 333                         return -ENOMSG;
 334                 } else {
 335                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 336                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 337                         iwl_write8(bus(priv), ofs, val8);
 338                 }
 339                 break;
 340         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 341                 val32 = iwl_read_prph(bus(priv), ofs);
 342                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 343
 344                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 345                 if (!skb) {
 346                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 347                         return -ENOMEM;
 348                 }
 349                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 350                 status = cfg80211_testmode_reply(skb);
 351                 if (status < 0)
 352                         IWL_DEBUG_INFO(priv,
 353                                         "Error sending msg : %d\n", status);
 354                 break;
 355         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 356                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 357                         IWL_DEBUG_INFO(priv,
 358                                         "Error finding value to write\n");
 359                         return -ENOMSG;
 360                 } else {
 361                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 362                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 363                         iwl_write_prph(bus(priv), ofs, val32);
 364                 }
 365                 break;
 366         default:
 367                 IWL_DEBUG_INFO(priv, "Unknown testmode register command ID\n");
 368                 return -ENOSYS;
 369         }
 370
 371         return status;
 372
 373 nla_put_failure:
 374         kfree_skb(skb);
 375         return -EMSGSIZE;
 376 }
 377
 378
 379 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 380 {
 381         struct iwl_notification_wait calib_wait;
 382         int ret;
 383
 384         iwl_init_notification_wait(priv->shrd, &calib_wait,
 385                                       CALIBRATION_COMPLETE_NOTIFICATION,
 386                                       NULL, NULL);
 387         ret = iwl_init_alive_start(trans(priv));
 388         if (ret) {
 389                 IWL_DEBUG_INFO(priv,
 390                         "Error configuring init calibration: %d\n", ret);
 391                 goto cfg_init_calib_error;
 392         }
 393
 394         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 395         if (ret)
 396                 IWL_DEBUG_INFO(priv, "Error detecting"
 397                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 398         return ret;
 399
 400 cfg_init_calib_error:
 401         iwl_remove_notification(priv->shrd, &calib_wait);
 402         return ret;
 403 }
 404
 405 /*
 406  * This function handles the user application commands for driver.
 407  *
 408  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 409  * handlers respectively.
 410  *
 411  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 412  * value of the actual command execution is replied to the user application.
 413  *
 414  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 415  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 416  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 417  *
 418  * @hw: ieee80211_hw object that represents the device
 419  * @tb: gnl message fields from the user space
 420  */
 421 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 422 {
 423         struct iwl_priv *priv = hw->priv;
 424         struct iwl_trans *trans = trans(priv);
 425         struct sk_buff *skb;
 426         unsigned char *rsp_data_ptr = NULL;
 427         int status = 0, rsp_data_len = 0;
 428         u32 devid, inst_size = 0, data_size = 0;
 429
 430         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 431         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 432                 rsp_data_ptr = (unsigned char *)cfg(priv)->name;
 433                 rsp_data_len = strlen(cfg(priv)->name);
 434                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 435                                                         rsp_data_len + 20);
 436                 if (!skb) {
 437                         IWL_DEBUG_INFO(priv,
 438                                        "Error allocating memory\n");
 439                         return -ENOMEM;
 440                 }
 441                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 442                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 443                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 444                         rsp_data_len, rsp_data_ptr);
 445                 status = cfg80211_testmode_reply(skb);
 446                 if (status < 0)
 447                         IWL_DEBUG_INFO(priv, "Error sending msg : %d\n",
 448                                        status);
 449                 break;
 450
 451         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 452                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_INIT);
 453                 if (status)
 454                         IWL_DEBUG_INFO(priv,
 455                                 "Error loading init ucode: %d\n", status);
 456                 break;
 457
 458         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 459                 iwl_testmode_cfg_init_calib(priv);
 460                 iwl_trans_stop_device(trans);
 461                 break;
 462
 463         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 464                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_REGULAR);
 465                 if (status) {
 466                         IWL_DEBUG_INFO(priv,
 467                                 "Error loading runtime ucode: %d\n", status);
 468                         break;
 469                 }
 470                 status = iwl_alive_start(priv);
 471                 if (status)
 472                         IWL_DEBUG_INFO(priv,
 473                                 "Error starting the device: %d\n", status);
 474                 break;
 475
 476         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 477                 iwl_scan_cancel_timeout(priv, 200);
 478                 iwl_trans_stop_device(trans);
 479                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_WOWLAN);
 480                 if (status) {
 481                         IWL_DEBUG_INFO(priv,
 482                                 "Error loading WOWLAN ucode: %d\n", status);
 483                         break;
 484                 }
 485                 status = iwl_alive_start(priv);
 486                 if (status)
 487                         IWL_DEBUG_INFO(priv,
 488                                 "Error starting the device: %d\n", status);
 489                 break;
 490
 491         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 492                 if (priv->shrd->eeprom) {
 493                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 494                                 cfg(priv)->base_params->eeprom_size + 20);
 495                         if (!skb) {
 496                                 IWL_DEBUG_INFO(priv,
 497                                        "Error allocating memory\n");
 498                                 return -ENOMEM;
 499                         }
 500                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 501                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 502                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 503                                 cfg(priv)->base_params->eeprom_size,
 504                                 priv->shrd->eeprom);
 505                         status = cfg80211_testmode_reply(skb);
 506                         if (status < 0)
 507                                 IWL_DEBUG_INFO(priv,
 508                                                "Error sending msg : %d\n",
 509                                                status);
 510                 } else
 511                         return -EFAULT;
 512                 break;
 513
 514         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 515                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 516                         IWL_DEBUG_INFO(priv,
 517                                        "Error finding fixrate setting\n");
 518                         return -ENOMSG;
 519                 }
 520                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 521                 break;
 522
 523         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 524                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 525
 526                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 527                 if (!skb) {
 528                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 529                         return -ENOMEM;
 530                 }
 531                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 532                 status = cfg80211_testmode_reply(skb);
 533                 if (status < 0)
 534                         IWL_DEBUG_INFO(priv,
 535                                         "Error sending msg : %d\n", status);
 536                 break;
 537
 538         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 539                 devid = bus_get_hw_id(bus(priv));
 540                 IWL_INFO(priv, "hw version: 0x%x\n", devid);
 541
 542                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 543                 if (!skb) {
 544                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 545                         return -ENOMEM;
 546                 }
 547                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 548                 status = cfg80211_testmode_reply(skb);
 549                 if (status < 0)
 550                         IWL_DEBUG_INFO(priv,
 551                                         "Error sending msg : %d\n", status);
 552                 break;
 553
 554         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 555                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
 556                 if (!skb) {
 557                         IWL_DEBUG_INFO(priv, "Error allocating memory\n");
 558                         return -ENOMEM;
 559                 }
 560                 switch (priv->shrd->ucode_type) {
 561                 case IWL_UCODE_REGULAR:
 562                         inst_size = trans(priv)->ucode_rt.code.len;
 563                         data_size = trans(priv)->ucode_rt.data.len;
 564                         break;
 565                 case IWL_UCODE_INIT:
 566                         inst_size = trans(priv)->ucode_init.code.len;
 567                         data_size = trans(priv)->ucode_init.data.len;
 568                         break;
 569                 case IWL_UCODE_WOWLAN:
 570                         inst_size = trans(priv)->ucode_wowlan.code.len;
 571                         data_size = trans(priv)->ucode_wowlan.data.len;
 572                         break;
 573                 case IWL_UCODE_NONE:
 574                         IWL_DEBUG_INFO(priv, "The uCode has not been loaded\n");
 575                         break;
 576                 default:
 577                         IWL_DEBUG_INFO(priv, "Unsupported uCode type\n");
 578                         break;
 579                 }
 580                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_TYPE, priv->shrd->ucode_type);
 581                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size);
 582                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size);
 583                 status = cfg80211_testmode_reply(skb);
 584                 if (status < 0)
 585                         IWL_DEBUG_INFO(priv,
 586                                         "Error sending msg : %d\n", status);
 587                 break;
 588
 589         default:
 590                 IWL_DEBUG_INFO(priv, "Unknown testmode driver command ID\n");
 591                 return -ENOSYS;
 592         }
 593         return status;
 594
 595 nla_put_failure:
 596         kfree_skb(skb);
 597         return -EMSGSIZE;
 598 }
 599
 600
 601 /*
 602  * This function handles the user application commands for uCode trace
 603  *
 604  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 605  * handlers respectively.
 606  *
 607  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 608  * value of the actual command execution is replied to the user application.
 609  *
 610  * @hw: ieee80211_hw object that represents the device
 611  * @tb: gnl message fields from the user space
 612  */
 613 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 614 {
 615         struct iwl_priv *priv = hw->priv;
 616         struct sk_buff *skb;
 617         int status = 0;
 618         struct device *dev = bus(priv)->dev;
 619
 620         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 621         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 622                 if (priv->testmode_trace.trace_enabled)
 623                         return -EBUSY;
 624
 625                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 626                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 627                 else
 628                         priv->testmode_trace.buff_size =
 629                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 630                 if (!priv->testmode_trace.buff_size)
 631                         return -EINVAL;
 632                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 633                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 634                         return -EINVAL;
 635
 636                 priv->testmode_trace.total_size =
 637                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 638                 priv->testmode_trace.cpu_addr =
 639                         dma_alloc_coherent(dev,
 640                                            priv->testmode_trace.total_size,
 641                                            &priv->testmode_trace.dma_addr,
 642                                            GFP_KERNEL);
 643                 if (!priv->testmode_trace.cpu_addr)
 644                         return -ENOMEM;
 645                 priv->testmode_trace.trace_enabled = true;
 646                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 647                         priv->testmode_trace.cpu_addr, 0x100);
 648                 memset(priv->testmode_trace.trace_addr, 0x03B,
 649                         priv->testmode_trace.buff_size);
 650                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 651                         sizeof(priv->testmode_trace.dma_addr) + 20);
 652                 if (!skb) {
 653                         IWL_DEBUG_INFO(priv,
 654                                 "Error allocating memory\n");
 655                         iwl_trace_cleanup(priv);
 656                         return -ENOMEM;
 657                 }
 658                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 659                         sizeof(priv->testmode_trace.dma_addr),
 660                         (u64 *)&priv->testmode_trace.dma_addr);
 661                 status = cfg80211_testmode_reply(skb);
 662                 if (status < 0) {
 663                         IWL_DEBUG_INFO(priv,
 664                                        "Error sending msg : %d\n",
 665                                        status);
 666                 }
 667                 priv->testmode_trace.num_chunks =
 668                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 669                                      DUMP_CHUNK_SIZE);
 670                 break;
 671
 672         case IWL_TM_CMD_APP2DEV_END_TRACE:
 673                 iwl_trace_cleanup(priv);
 674                 break;
 675         default:
 676                 IWL_DEBUG_INFO(priv, "Unknown testmode mem command ID\n");
 677                 return -ENOSYS;
 678         }
 679         return status;
 680
 681 nla_put_failure:
 682         kfree_skb(skb);
 683         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 684             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 685                 iwl_trace_cleanup(priv);
 686         return -EMSGSIZE;
 687 }
 688
 689 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 690                                    struct sk_buff *skb,
 691                                    struct netlink_callback *cb)
 692 {
 693         struct iwl_priv *priv = hw->priv;
 694         int idx, length;
 695
 696         if (priv->testmode_trace.trace_enabled &&
 697             priv->testmode_trace.trace_addr) {
 698                 idx = cb->args[4];
 699                 if (idx >= priv->testmode_trace.num_chunks)
 700                         return -ENOENT;
 701                 length = DUMP_CHUNK_SIZE;
 702                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 703                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 704                         length = priv->testmode_trace.buff_size %
 705                                 DUMP_CHUNK_SIZE;
 706
 707                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 708                         priv->testmode_trace.trace_addr +
 709                         (DUMP_CHUNK_SIZE * idx));
 710                 idx++;
 711                 cb->args[4] = idx;
 712                 return 0;
 713         } else
 714                 return -EFAULT;
 715
 716  nla_put_failure:
 717         return -ENOBUFS;
 718 }
 719
 720 /*
 721  * This function handles the user application switch ucode ownership.
 722  *
 723  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 724  * decide who the current owner of the uCode
 725  *
 726  * If the current owner is OWNERSHIP_TM, then the only host command
 727  * can deliver to uCode is from testmode, all the other host commands
 728  * will dropped.
 729  *
 730  * default driver is the owner of uCode in normal operational mode
 731  *
 732  * @hw: ieee80211_hw object that represents the device
 733  * @tb: gnl message fields from the user space
 734  */
 735 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 736 {
 737         struct iwl_priv *priv = hw->priv;
 738         u8 owner;
 739
 740         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 741                 IWL_DEBUG_INFO(priv, "Error finding ucode owner\n");
 742                 return -ENOMSG;
 743         }
 744
 745         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 746         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 747                 priv->shrd->ucode_owner = owner;
 748         else {
 749                 IWL_DEBUG_INFO(priv, "Invalid owner\n");
 750                 return -EINVAL;
 751         }
 752         return 0;
 753 }
 754
 755 /*
 756  * This function handles the user application commands for SRAM data dump
 757  *
 758  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 759  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 760  *
 761  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 762  * previous command has not been delivered to userspace, or -ENOMSG if
 763  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 764  * are missing, or -ENOMEM if the buffer allocation fails.
 765  *
 766  * Otherwise 0 is replied indicating the success of the SRAM reading.
 767  *
 768  * @hw: ieee80211_hw object that represents the device
 769  * @tb: gnl message fields from the user space
 770  */
 771 static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
 772 {
 773         struct iwl_priv *priv = hw->priv;
 774         u32 ofs, size, maxsize;
 775
 776         if (priv->testmode_sram.sram_readed)
 777                 return -EBUSY;
 778
 779         if (!tb[IWL_TM_ATTR_SRAM_ADDR]) {
 780                 IWL_DEBUG_INFO(priv, "Error finding SRAM offset address\n");
 781                 return -ENOMSG;
 782         }
 783         ofs = nla_get_u32(tb[IWL_TM_ATTR_SRAM_ADDR]);
 784         if (!tb[IWL_TM_ATTR_SRAM_SIZE]) {
 785                 IWL_DEBUG_INFO(priv, "Error finding size for SRAM reading\n");
 786                 return -ENOMSG;
 787         }
 788         size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
 789         switch (priv->shrd->ucode_type) {
 790         case IWL_UCODE_REGULAR:
 791                 maxsize = trans(priv)->ucode_rt.data.len;
 792                 break;
 793         case IWL_UCODE_INIT:
 794                 maxsize = trans(priv)->ucode_init.data.len;
 795                 break;
 796         case IWL_UCODE_WOWLAN:
 797                 maxsize = trans(priv)->ucode_wowlan.data.len;
 798                 break;
 799         case IWL_UCODE_NONE:
 800                 IWL_ERR(priv, "Error, uCode does not been loaded\n");
 801                 return -ENOSYS;
 802         default:
 803                 IWL_ERR(priv, "Error, unsupported uCode type\n");
 804                 return -ENOSYS;
 805         }
 806         if ((ofs + size) > (maxsize + SRAM_DATA_SEG_OFFSET)) {
 807                 IWL_ERR(priv, "Invalid offset/size: out of range\n");
 808                 return -EINVAL;
 809         }
 810         priv->testmode_sram.buff_size = (size / 4) * 4;
 811         priv->testmode_sram.buff_addr =
 812                 kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);
 813         if (priv->testmode_sram.buff_addr == NULL) {
 814                 IWL_ERR(priv, "Error allocating memory\n");
 815                 return -ENOMEM;
 816         }
 817         _iwl_read_targ_mem_words(bus(priv), ofs,
 818                                         priv->testmode_sram.buff_addr,
 819                                         priv->testmode_sram.buff_size / 4);
 820         priv->testmode_sram.num_chunks =
 821                 DIV_ROUND_UP(priv->testmode_sram.buff_size, DUMP_CHUNK_SIZE);
 822         priv->testmode_sram.sram_readed = true;
 823         return 0;
 824 }
 825
 826 static int iwl_testmode_sram_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 827                                    struct sk_buff *skb,
 828                                    struct netlink_callback *cb)
 829 {
 830         struct iwl_priv *priv = hw->priv;
 831         int idx, length;
 832
 833         if (priv->testmode_sram.sram_readed) {
 834                 idx = cb->args[4];
 835                 if (idx >= priv->testmode_sram.num_chunks) {
 836                         iwl_sram_cleanup(priv);
 837                         return -ENOENT;
 838                 }
 839                 length = DUMP_CHUNK_SIZE;
 840                 if (((idx + 1) == priv->testmode_sram.num_chunks) &&
 841                     (priv->testmode_sram.buff_size % DUMP_CHUNK_SIZE))
 842                         length = priv->testmode_sram.buff_size %
 843                                 DUMP_CHUNK_SIZE;
 844
 845                 NLA_PUT(skb, IWL_TM_ATTR_SRAM_DUMP, length,
 846                         priv->testmode_sram.buff_addr +
 847                         (DUMP_CHUNK_SIZE * idx));
 848                 idx++;
 849                 cb->args[4] = idx;
 850                 return 0;
 851         } else
 852                 return -EFAULT;
 853
 854  nla_put_failure:
 855         return -ENOBUFS;
 856 }
 857
 858
 859 /* The testmode gnl message handler that takes the gnl message from the
 860  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 861  * invoke the corresponding handlers.
 862  *
 863  * This function is invoked when there is user space application sending
 864  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 865  * by nl80211.
 866  *
 867  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 868  * dispatching it to the corresponding handler.
 869  *
 870  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 871  * -ENOSYS is replied to the user application if the command is unknown;
 872  * Otherwise, the command is dispatched to the respective handler.
 873  *
 874  * @hw: ieee80211_hw object that represents the device
 875  * @data: pointer to user space message
 876  * @len: length in byte of @data
 877  */
 878 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 879 {
 880         struct nlattr *tb[IWL_TM_ATTR_MAX];
 881         struct iwl_priv *priv = hw->priv;
 882         int result;
 883
 884         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 885                         iwl_testmode_gnl_msg_policy);
 886         if (result != 0) {
 887                 IWL_DEBUG_INFO(priv,
 888                                "Error parsing the gnl message : %d\n", result);
 889                 return result;
 890         }
 891
 892         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 893         if (!tb[IWL_TM_ATTR_COMMAND]) {
 894                 IWL_DEBUG_INFO(priv, "Error finding testmode command type\n");
 895                 return -ENOMSG;
 896         }
 897         /* in case multiple accesses to the device happens */
 898         mutex_lock(&priv->shrd->mutex);
 899
 900         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 901         case IWL_TM_CMD_APP2DEV_UCODE:
 902                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 903                 result = iwl_testmode_ucode(hw, tb);
 904                 break;
 905         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 906         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 907         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 908         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_READ32:
 909         case IWL_TM_CMD_APP2DEV_INDIRECT_REG_WRITE32:
 910                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 911                 result = iwl_testmode_reg(hw, tb);
 912                 break;
 913         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 914         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 915         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 916         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 917         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 918         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 919         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 920         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 921         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 922         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 923                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
 924                 result = iwl_testmode_driver(hw, tb);
 925                 break;
 926
 927         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 928         case IWL_TM_CMD_APP2DEV_END_TRACE:
 929         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 930                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
 931                 result = iwl_testmode_trace(hw, tb);
 932                 break;
 933
 934         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
 935                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
 936                 result = iwl_testmode_ownership(hw, tb);
 937                 break;
 938
 939         case IWL_TM_CMD_APP2DEV_READ_SRAM:
 940                 IWL_DEBUG_INFO(priv, "testmode sram read cmd to driver\n");
 941                 result = iwl_testmode_sram(hw, tb);
 942                 break;
 943
 944         default:
 945                 IWL_DEBUG_INFO(priv, "Unknown testmode command\n");
 946                 result = -ENOSYS;
 947                 break;
 948         }
 949
 950         mutex_unlock(&priv->shrd->mutex);
 951         return result;
 952 }
 953
 954 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 955                       struct netlink_callback *cb,
 956                       void *data, int len)
 957 {
 958         struct nlattr *tb[IWL_TM_ATTR_MAX];
 959         struct iwl_priv *priv = hw->priv;
 960         int result;
 961         u32 cmd;
 962
 963         if (cb->args[3]) {
 964                 /* offset by 1 since commands start at 0 */
 965                 cmd = cb->args[3] - 1;
 966         } else {
 967                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 968                                 iwl_testmode_gnl_msg_policy);
 969                 if (result) {
 970                         IWL_DEBUG_INFO(priv,
 971                                "Error parsing the gnl message : %d\n", result);
 972                         return result;
 973                 }
 974
 975                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 976                 if (!tb[IWL_TM_ATTR_COMMAND]) {
 977                         IWL_DEBUG_INFO(priv,
 978                                 "Error finding testmode command type\n");
 979                         return -ENOMSG;
 980                 }
 981                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 982                 cb->args[3] = cmd + 1;
 983         }
 984
 985         /* in case multiple accesses to the device happens */
 986         mutex_lock(&priv->shrd->mutex);
 987         switch (cmd) {
 988         case IWL_TM_CMD_APP2DEV_READ_TRACE:
 989                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
 990                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
 991                 break;
 992         case IWL_TM_CMD_APP2DEV_DUMP_SRAM:
 993                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
 994                 result = iwl_testmode_sram_dump(hw, tb, skb, cb);
 995                 break;
 996         default:
 997                 result = -EINVAL;
 998                 break;
 999         }
1000
1001         mutex_unlock(&priv->shrd->mutex);
1002         return result;
1003 }