drivers/net/wireless/iwlwifi/iwl-testmode.c

   1 /******************************************************************************
   2  *
   3  * This file is provided under a dual BSD/GPLv2 license.  When using or
   4  * redistributing this file, you may do so under either license.
   5  *
   6  * GPL LICENSE SUMMARY
   7  *
   8  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of version 2 of the GNU General Public License as
  12  * published by the Free Software Foundation.
  13  *
  14  * This program is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
  22  * USA
  23  *
  24  * The full GNU General Public License is included in this distribution
  25  * in the file called LICENSE.GPL.
  26  *
  27  * Contact Information:
  28  *  Intel Linux Wireless <ilw@linux.intel.com>
  29  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30  *
  31  * BSD LICENSE
  32  *
  33  * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  *
  40  *  * Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  *  * Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in
  44  *    the documentation and/or other materials provided with the
  45  *    distribution.
  46  *  * Neither the name Intel Corporation nor the names of its
  47  *    contributors may be used to endorse or promote products derived
  48  *    from this software without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  51  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  52  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  53  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  54  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  55  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  56  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  57  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  58  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  59  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  60  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  61  *
  62  *****************************************************************************/
  63 #include <linux/init.h>
  64 #include <linux/kernel.h>
  65 #include <linux/module.h>
  66 #include <linux/dma-mapping.h>
  67 #include <net/net_namespace.h>
  68 #include <linux/netdevice.h>
  69 #include <net/cfg80211.h>
  70 #include <net/mac80211.h>
  71 #include <net/netlink.h>
  72
  73 #include "iwl-wifi.h"
  74 #include "iwl-dev.h"
  75 #include "iwl-core.h"
  76 #include "iwl-debug.h"
  77 #include "iwl-io.h"
  78 #include "iwl-agn.h"
  79 #include "iwl-testmode.h"
  80 #include "iwl-trans.h"
  81 #include "iwl-bus.h"
  82 #include "iwl-fh.h"
  83
  84
  85 /* Periphery registers absolute lower bound. This is used in order to
  86  * differentiate registery access through HBUS_TARG_PRPH_* and
  87  * HBUS_TARG_MEM_* accesses.
  88  */
  89 #define IWL_TM_ABS_PRPH_START (0xA00000)
  90
  91 /* The TLVs used in the gnl message policy between the kernel module and
  92  * user space application. iwl_testmode_gnl_msg_policy is to be carried
  93  * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
  94  * See iwl-testmode.h
  95  */
  96 static
  97 struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
  98         [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
  99
 100         [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
 101         [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
 102
 103         [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
 104         [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
 105         [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
 106
 107         [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
 108         [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
 109
 110         [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
 111
 112         [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
 113         [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
 114         [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
 115
 116         [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
 117
 118         [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
 119
 120         [IWL_TM_ATTR_MEM_ADDR] = { .type = NLA_U32, },
 121         [IWL_TM_ATTR_BUFFER_SIZE] = { .type = NLA_U32, },
 122         [IWL_TM_ATTR_BUFFER_DUMP] = { .type = NLA_UNSPEC, },
 123
 124         [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
 125         [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
 126         [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
 127         [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
 128         [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
 129 };
 130
 131 /*
 132  * See the struct iwl_rx_packet in iwl-commands.h for the format of the
 133  * received events from the device
 134  */
 135 static inline int get_event_length(struct iwl_rx_mem_buffer *rxb)
 136 {
 137         struct iwl_rx_packet *pkt = rxb_addr(rxb);
 138         if (pkt)
 139                 return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 140         else
 141                 return 0;
 142 }
 143
 144
 145 /*
 146  * This function multicasts the spontaneous messages from the device to the
 147  * user space. It is invoked whenever there is a received messages
 148  * from the device. This function is called within the ISR of the rx handlers
 149  * in iwlagn driver.
 150  *
 151  * The parsing of the message content is left to the user space application,
 152  * The message content is treated as unattacked raw data and is encapsulated
 153  * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
 154  *
 155  * @priv: the instance of iwlwifi device
 156  * @rxb: pointer to rx data content received by the ISR
 157  *
 158  * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
 159  * For the messages multicasting to the user application, the mandatory
 160  * TLV fields are :
 161  *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
 162  *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
 163  */
 164
 165 static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 166                                 struct iwl_rx_mem_buffer *rxb)
 167 {
 168         struct ieee80211_hw *hw = priv->hw;
 169         struct sk_buff *skb;
 170         void *data;
 171         int length;
 172
 173         data = (void *)rxb_addr(rxb);
 174         length = get_event_length(rxb);
 175
 176         if (!data || length == 0)
 177                 return;
 178
 179         skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
 180                                                                 GFP_ATOMIC);
 181         if (skb == NULL) {
 182                 IWL_ERR(priv,
 183                          "Run out of memory for messages to user space ?\n");
 184                 return;
 185         }
 186         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 187         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
 188         cfg80211_testmode_event(skb, GFP_ATOMIC);
 189         return;
 190
 191 nla_put_failure:
 192         kfree_skb(skb);
 193         IWL_ERR(priv, "Ouch, overran buffer, check allocation!\n");
 194 }
 195
 196 void iwl_testmode_init(struct iwl_priv *priv)
 197 {
 198         priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
 199         priv->testmode_trace.trace_enabled = false;
 200         priv->testmode_mem.read_in_progress = false;
 201 }
 202
 203 static void iwl_mem_cleanup(struct iwl_priv *priv)
 204 {
 205         if (priv->testmode_mem.read_in_progress) {
 206                 kfree(priv->testmode_mem.buff_addr);
 207                 priv->testmode_mem.buff_addr = NULL;
 208                 priv->testmode_mem.buff_size = 0;
 209                 priv->testmode_mem.num_chunks = 0;
 210                 priv->testmode_mem.read_in_progress = false;
 211         }
 212 }
 213
 214 static void iwl_trace_cleanup(struct iwl_priv *priv)
 215 {
 216         if (priv->testmode_trace.trace_enabled) {
 217                 if (priv->testmode_trace.cpu_addr &&
 218                     priv->testmode_trace.dma_addr)
 219                         dma_free_coherent(trans(priv)->dev,
 220                                         priv->testmode_trace.total_size,
 221                                         priv->testmode_trace.cpu_addr,
 222                                         priv->testmode_trace.dma_addr);
 223                 priv->testmode_trace.trace_enabled = false;
 224                 priv->testmode_trace.cpu_addr = NULL;
 225                 priv->testmode_trace.trace_addr = NULL;
 226                 priv->testmode_trace.dma_addr = 0;
 227                 priv->testmode_trace.buff_size = 0;
 228                 priv->testmode_trace.total_size = 0;
 229         }
 230 }
 231
 232
 233 void iwl_testmode_cleanup(struct iwl_priv *priv)
 234 {
 235         iwl_trace_cleanup(priv);
 236         iwl_mem_cleanup(priv);
 237 }
 238
 239
 240 /*
 241  * This function handles the user application commands to the ucode.
 242  *
 243  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
 244  * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
 245  * host command to the ucode.
 246  *
 247  * If any mandatory field is missing, -ENOMSG is replied to the user space
 248  * application; otherwise, waits for the host command to be sent and checks
 249  * the return code. In case or error, it is returned, otherwise a reply is
 250  * allocated and the reply RX packet
 251  * is returned.
 252  *
 253  * @hw: ieee80211_hw object that represents the device
 254  * @tb: gnl message fields from the user space
 255  */
 256 static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
 257 {
 258         struct iwl_priv *priv = hw->priv;
 259         struct iwl_host_cmd cmd;
 260         struct iwl_rx_packet *pkt;
 261         struct sk_buff *skb;
 262         void *reply_buf;
 263         u32 reply_len;
 264         int ret;
 265         bool cmd_want_skb;
 266
 267         memset(&cmd, 0, sizeof(struct iwl_host_cmd));
 268
 269         if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
 270             !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
 271                 IWL_ERR(priv, "Missing ucode command mandatory fields\n");
 272                 return -ENOMSG;
 273         }
 274
 275         cmd.flags = CMD_ON_DEMAND | CMD_SYNC;
 276         cmd_want_skb = nla_get_flag(tb[IWL_TM_ATTR_UCODE_CMD_SKB]);
 277         if (cmd_want_skb)
 278                 cmd.flags |= CMD_WANT_SKB;
 279
 280         cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
 281         cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 282         cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
 283         cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
 284         IWL_DEBUG_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
 285                                 " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
 286
 287         ret = iwl_trans_send_cmd(trans(priv), &cmd);
 288         if (ret) {
 289                 IWL_ERR(priv, "Failed to send hcmd\n");
 290                 return ret;
 291         }
 292         if (!cmd_want_skb)
 293                 return ret;
 294
 295         /* Handling return of SKB to the user */
 296         pkt = (struct iwl_rx_packet *)cmd.reply_page;
 297         if (!pkt) {
 298                 IWL_ERR(priv, "HCMD received a null response packet\n");
 299                 return ret;
 300         }
 301
 302         reply_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 303         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, reply_len + 20);
 304         reply_buf = kmalloc(reply_len, GFP_KERNEL);
 305         if (!skb || !reply_buf) {
 306                 kfree_skb(skb);
 307                 kfree(reply_buf);
 308                 return -ENOMEM;
 309         }
 310
 311         /* The reply is in a page, that we cannot send to user space. */
 312         memcpy(reply_buf, &(pkt->u), reply_len);
 313         iwl_free_pages(priv->shrd, cmd.reply_page);
 314
 315         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 316         NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf);
 317         return cfg80211_testmode_reply(skb);
 318
 319 nla_put_failure:
 320         IWL_DEBUG_INFO(priv, "Failed creating NL attributes\n");
 321         return -ENOMSG;
 322 }
 323
 324
 325 /*
 326  * This function handles the user application commands for register access.
 327  *
 328  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 329  * handlers respectively.
 330  *
 331  * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
 332  * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
 333  * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
 334  * the success of the command execution.
 335  *
 336  * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
 337  * value is returned with IWL_TM_ATTR_REG_VALUE32.
 338  *
 339  * @hw: ieee80211_hw object that represents the device
 340  * @tb: gnl message fields from the user space
 341  */
 342 static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
 343 {
 344         struct iwl_priv *priv = hw->priv;
 345         u32 ofs, val32, cmd;
 346         u8 val8;
 347         struct sk_buff *skb;
 348         int status = 0;
 349
 350         if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
 351                 IWL_ERR(priv, "Missing register offset\n");
 352                 return -ENOMSG;
 353         }
 354         ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
 355         IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
 356
 357         /* Allow access only to FH/CSR/HBUS in direct mode.
 358         Since we don't have the upper bounds for the CSR and HBUS segments,
 359         we will use only the upper bound of FH for sanity check. */
 360         cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 361         if ((cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32 ||
 362                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32 ||
 363                 cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8) &&
 364                 (ofs >= FH_MEM_UPPER_BOUND)) {
 365                 IWL_ERR(priv, "offset out of segment (0x0 - 0x%x)\n",
 366                         FH_MEM_UPPER_BOUND);
 367                 return -EINVAL;
 368         }
 369
 370         switch (cmd) {
 371         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 372                 val32 = iwl_read_direct32(trans(priv), ofs);
 373                 IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
 374
 375                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 376                 if (!skb) {
 377                         IWL_ERR(priv, "Memory allocation fail\n");
 378                         return -ENOMEM;
 379                 }
 380                 NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 381                 status = cfg80211_testmode_reply(skb);
 382                 if (status < 0)
 383                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 384                 break;
 385         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 386                 if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
 387                         IWL_ERR(priv, "Missing value to write\n");
 388                         return -ENOMSG;
 389                 } else {
 390                         val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
 391                         IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
 392                         iwl_write_direct32(trans(priv), ofs, val32);
 393                 }
 394                 break;
 395         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 396                 if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
 397                         IWL_ERR(priv, "Missing value to write\n");
 398                         return -ENOMSG;
 399                 } else {
 400                         val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
 401                         IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
 402                         iwl_write8(trans(priv), ofs, val8);
 403                 }
 404                 break;
 405         default:
 406                 IWL_ERR(priv, "Unknown testmode register command ID\n");
 407                 return -ENOSYS;
 408         }
 409
 410         return status;
 411
 412 nla_put_failure:
 413         kfree_skb(skb);
 414         return -EMSGSIZE;
 415 }
 416
 417
 418 static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
 419 {
 420         struct iwl_notification_wait calib_wait;
 421         int ret;
 422
 423         iwl_init_notification_wait(priv->shrd, &calib_wait,
 424                                       CALIBRATION_COMPLETE_NOTIFICATION,
 425                                       NULL, NULL);
 426         ret = iwl_init_alive_start(trans(priv));
 427         if (ret) {
 428                 IWL_ERR(priv, "Fail init calibration: %d\n", ret);
 429                 goto cfg_init_calib_error;
 430         }
 431
 432         ret = iwl_wait_notification(priv->shrd, &calib_wait, 2 * HZ);
 433         if (ret)
 434                 IWL_ERR(priv, "Error detecting"
 435                         " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
 436         return ret;
 437
 438 cfg_init_calib_error:
 439         iwl_remove_notification(priv->shrd, &calib_wait);
 440         return ret;
 441 }
 442
 443 /*
 444  * This function handles the user application commands for driver.
 445  *
 446  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 447  * handlers respectively.
 448  *
 449  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 450  * value of the actual command execution is replied to the user application.
 451  *
 452  * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
 453  * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
 454  * IWL_TM_CMD_DEV2APP_SYNC_RSP.
 455  *
 456  * @hw: ieee80211_hw object that represents the device
 457  * @tb: gnl message fields from the user space
 458  */
 459 static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
 460 {
 461         struct iwl_priv *priv = hw->priv;
 462         struct iwl_trans *trans = trans(priv);
 463         struct sk_buff *skb;
 464         unsigned char *rsp_data_ptr = NULL;
 465         int status = 0, rsp_data_len = 0;
 466         u32 devid, inst_size = 0, data_size = 0;
 467
 468         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 469         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 470                 rsp_data_ptr = (unsigned char *)cfg(priv)->name;
 471                 rsp_data_len = strlen(cfg(priv)->name);
 472                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 473                                                         rsp_data_len + 20);
 474                 if (!skb) {
 475                         IWL_ERR(priv, "Memory allocation fail\n");
 476                         return -ENOMEM;
 477                 }
 478                 NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 479                             IWL_TM_CMD_DEV2APP_SYNC_RSP);
 480                 NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 481                         rsp_data_len, rsp_data_ptr);
 482                 status = cfg80211_testmode_reply(skb);
 483                 if (status < 0)
 484                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 485                 break;
 486
 487         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 488                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_INIT);
 489                 if (status)
 490                         IWL_ERR(priv, "Error loading init ucode: %d\n", status);
 491                 break;
 492
 493         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 494                 iwl_testmode_cfg_init_calib(priv);
 495                 iwl_trans_stop_device(trans);
 496                 break;
 497
 498         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 499                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_REGULAR);
 500                 if (status) {
 501                         IWL_ERR(priv,
 502                                 "Error loading runtime ucode: %d\n", status);
 503                         break;
 504                 }
 505                 status = iwl_alive_start(priv);
 506                 if (status)
 507                         IWL_ERR(priv,
 508                                 "Error starting the device: %d\n", status);
 509                 break;
 510
 511         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 512                 iwl_scan_cancel_timeout(priv, 200);
 513                 iwl_trans_stop_device(trans);
 514                 status = iwl_load_ucode_wait_alive(trans, IWL_UCODE_WOWLAN);
 515                 if (status) {
 516                         IWL_ERR(priv,
 517                                 "Error loading WOWLAN ucode: %d\n", status);
 518                         break;
 519                 }
 520                 status = iwl_alive_start(priv);
 521                 if (status)
 522                         IWL_ERR(priv,
 523                                 "Error starting the device: %d\n", status);
 524                 break;
 525
 526         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 527                 if (priv->shrd->eeprom) {
 528                         skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 529                                 cfg(priv)->base_params->eeprom_size + 20);
 530                         if (!skb) {
 531                                 IWL_ERR(priv, "Memory allocation fail\n");
 532                                 return -ENOMEM;
 533                         }
 534                         NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 535                                 IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 536                         NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 537                                 cfg(priv)->base_params->eeprom_size,
 538                                 priv->shrd->eeprom);
 539                         status = cfg80211_testmode_reply(skb);
 540                         if (status < 0)
 541                                 IWL_ERR(priv, "Error sending msg : %d\n",
 542                                         status);
 543                 } else
 544                         return -EFAULT;
 545                 break;
 546
 547         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 548                 if (!tb[IWL_TM_ATTR_FIXRATE]) {
 549                         IWL_ERR(priv, "Missing fixrate setting\n");
 550                         return -ENOMSG;
 551                 }
 552                 priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
 553                 break;
 554
 555         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 556                 IWL_INFO(priv, "uCode version raw: 0x%x\n", priv->ucode_ver);
 557
 558                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 559                 if (!skb) {
 560                         IWL_ERR(priv, "Memory allocation fail\n");
 561                         return -ENOMEM;
 562                 }
 563                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION, priv->ucode_ver);
 564                 status = cfg80211_testmode_reply(skb);
 565                 if (status < 0)
 566                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 567                 break;
 568
 569         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 570                 devid = trans(priv)->hw_id;
 571                 IWL_INFO(priv, "hw version: 0x%x\n", devid);
 572
 573                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
 574                 if (!skb) {
 575                         IWL_ERR(priv, "Memory allocation fail\n");
 576                         return -ENOMEM;
 577                 }
 578                 NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 579                 status = cfg80211_testmode_reply(skb);
 580                 if (status < 0)
 581                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 582                 break;
 583
 584         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 585                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
 586                 if (!skb) {
 587                         IWL_ERR(priv, "Memory allocation fail\n");
 588                         return -ENOMEM;
 589                 }
 590                 switch (priv->shrd->ucode_type) {
 591                 case IWL_UCODE_REGULAR:
 592                         inst_size = trans(priv)->ucode_rt.code.len;
 593                         data_size = trans(priv)->ucode_rt.data.len;
 594                         break;
 595                 case IWL_UCODE_INIT:
 596                         inst_size = trans(priv)->ucode_init.code.len;
 597                         data_size = trans(priv)->ucode_init.data.len;
 598                         break;
 599                 case IWL_UCODE_WOWLAN:
 600                         inst_size = trans(priv)->ucode_wowlan.code.len;
 601                         data_size = trans(priv)->ucode_wowlan.data.len;
 602                         break;
 603                 case IWL_UCODE_NONE:
 604                         IWL_ERR(priv, "No uCode has not been loaded\n");
 605                         break;
 606                 default:
 607                         IWL_ERR(priv, "Unsupported uCode type\n");
 608                         break;
 609                 }
 610                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_TYPE, priv->shrd->ucode_type);
 611                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size);
 612                 NLA_PUT_U32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size);
 613                 status = cfg80211_testmode_reply(skb);
 614                 if (status < 0)
 615                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 616                 break;
 617
 618         default:
 619                 IWL_ERR(priv, "Unknown testmode driver command ID\n");
 620                 return -ENOSYS;
 621         }
 622         return status;
 623
 624 nla_put_failure:
 625         kfree_skb(skb);
 626         return -EMSGSIZE;
 627 }
 628
 629
 630 /*
 631  * This function handles the user application commands for uCode trace
 632  *
 633  * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
 634  * handlers respectively.
 635  *
 636  * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
 637  * value of the actual command execution is replied to the user application.
 638  *
 639  * @hw: ieee80211_hw object that represents the device
 640  * @tb: gnl message fields from the user space
 641  */
 642 static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
 643 {
 644         struct iwl_priv *priv = hw->priv;
 645         struct sk_buff *skb;
 646         int status = 0;
 647         struct device *dev = trans(priv)->dev;
 648
 649         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 650         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
 651                 if (priv->testmode_trace.trace_enabled)
 652                         return -EBUSY;
 653
 654                 if (!tb[IWL_TM_ATTR_TRACE_SIZE])
 655                         priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
 656                 else
 657                         priv->testmode_trace.buff_size =
 658                                 nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
 659                 if (!priv->testmode_trace.buff_size)
 660                         return -EINVAL;
 661                 if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
 662                     priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
 663                         return -EINVAL;
 664
 665                 priv->testmode_trace.total_size =
 666                         priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
 667                 priv->testmode_trace.cpu_addr =
 668                         dma_alloc_coherent(dev,
 669                                            priv->testmode_trace.total_size,
 670                                            &priv->testmode_trace.dma_addr,
 671                                            GFP_KERNEL);
 672                 if (!priv->testmode_trace.cpu_addr)
 673                         return -ENOMEM;
 674                 priv->testmode_trace.trace_enabled = true;
 675                 priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
 676                         priv->testmode_trace.cpu_addr, 0x100);
 677                 memset(priv->testmode_trace.trace_addr, 0x03B,
 678                         priv->testmode_trace.buff_size);
 679                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
 680                         sizeof(priv->testmode_trace.dma_addr) + 20);
 681                 if (!skb) {
 682                         IWL_ERR(priv, "Memory allocation fail\n");
 683                         iwl_trace_cleanup(priv);
 684                         return -ENOMEM;
 685                 }
 686                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 687                         sizeof(priv->testmode_trace.dma_addr),
 688                         (u64 *)&priv->testmode_trace.dma_addr);
 689                 status = cfg80211_testmode_reply(skb);
 690                 if (status < 0) {
 691                         IWL_ERR(priv, "Error sending msg : %d\n", status);
 692                 }
 693                 priv->testmode_trace.num_chunks =
 694                         DIV_ROUND_UP(priv->testmode_trace.buff_size,
 695                                      DUMP_CHUNK_SIZE);
 696                 break;
 697
 698         case IWL_TM_CMD_APP2DEV_END_TRACE:
 699                 iwl_trace_cleanup(priv);
 700                 break;
 701         default:
 702                 IWL_ERR(priv, "Unknown testmode mem command ID\n");
 703                 return -ENOSYS;
 704         }
 705         return status;
 706
 707 nla_put_failure:
 708         kfree_skb(skb);
 709         if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
 710             IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
 711                 iwl_trace_cleanup(priv);
 712         return -EMSGSIZE;
 713 }
 714
 715 static int iwl_testmode_trace_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 716                                    struct sk_buff *skb,
 717                                    struct netlink_callback *cb)
 718 {
 719         struct iwl_priv *priv = hw->priv;
 720         int idx, length;
 721
 722         if (priv->testmode_trace.trace_enabled &&
 723             priv->testmode_trace.trace_addr) {
 724                 idx = cb->args[4];
 725                 if (idx >= priv->testmode_trace.num_chunks)
 726                         return -ENOENT;
 727                 length = DUMP_CHUNK_SIZE;
 728                 if (((idx + 1) == priv->testmode_trace.num_chunks) &&
 729                     (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
 730                         length = priv->testmode_trace.buff_size %
 731                                 DUMP_CHUNK_SIZE;
 732
 733                 NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 734                         priv->testmode_trace.trace_addr +
 735                         (DUMP_CHUNK_SIZE * idx));
 736                 idx++;
 737                 cb->args[4] = idx;
 738                 return 0;
 739         } else
 740                 return -EFAULT;
 741
 742  nla_put_failure:
 743         return -ENOBUFS;
 744 }
 745
 746 /*
 747  * This function handles the user application switch ucode ownership.
 748  *
 749  * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
 750  * decide who the current owner of the uCode
 751  *
 752  * If the current owner is OWNERSHIP_TM, then the only host command
 753  * can deliver to uCode is from testmode, all the other host commands
 754  * will dropped.
 755  *
 756  * default driver is the owner of uCode in normal operational mode
 757  *
 758  * @hw: ieee80211_hw object that represents the device
 759  * @tb: gnl message fields from the user space
 760  */
 761 static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
 762 {
 763         struct iwl_priv *priv = hw->priv;
 764         u8 owner;
 765
 766         if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
 767                 IWL_ERR(priv, "Missing ucode owner\n");
 768                 return -ENOMSG;
 769         }
 770
 771         owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
 772         if ((owner == IWL_OWNERSHIP_DRIVER) || (owner == IWL_OWNERSHIP_TM))
 773                 priv->shrd->ucode_owner = owner;
 774         else {
 775                 IWL_ERR(priv, "Invalid owner\n");
 776                 return -EINVAL;
 777         }
 778         return 0;
 779 }
 780
 781 static int iwl_testmode_indirect_read(struct iwl_priv *priv, u32 addr, u32 size)
 782 {
 783         struct iwl_trans *trans = trans(priv);
 784         unsigned long flags;
 785         int i;
 786
 787         if (size & 0x3)
 788                 return -EINVAL;
 789         priv->testmode_mem.buff_size = size;
 790         priv->testmode_mem.buff_addr =
 791                 kmalloc(priv->testmode_mem.buff_size, GFP_KERNEL);
 792         if (priv->testmode_mem.buff_addr == NULL)
 793                 return -ENOMEM;
 794
 795         /* Hard-coded periphery absolute address */
 796         if (IWL_TM_ABS_PRPH_START <= addr &&
 797                 addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
 798                         spin_lock_irqsave(&trans->reg_lock, flags);
 799                         iwl_grab_nic_access(trans);
 800                         iwl_write32(trans, HBUS_TARG_PRPH_RADDR, addr);
 801                         for (i = 0; i < size; i += 4)
 802                                 priv->testmode_mem.buff_addr[i] =
 803                                         iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
 804                         iwl_release_nic_access(trans);
 805                         spin_unlock_irqrestore(&trans->reg_lock, flags);
 806         } else { /* target memory (SRAM) */
 807                 _iwl_read_targ_mem_words(trans, addr,
 808                         priv->testmode_mem.buff_addr,
 809                         priv->testmode_mem.buff_size / 4);
 810         }
 811
 812         priv->testmode_mem.num_chunks =
 813                 DIV_ROUND_UP(priv->testmode_mem.buff_size, DUMP_CHUNK_SIZE);
 814         priv->testmode_mem.read_in_progress = true;
 815         return 0;
 816
 817 }
 818
 819 static int iwl_testmode_indirect_write(struct iwl_priv *priv, u32 addr,
 820         u32 size, unsigned char *buf)
 821 {
 822         struct iwl_trans *trans = trans(priv);
 823         u32 val, i;
 824         unsigned long flags;
 825
 826         if (IWL_TM_ABS_PRPH_START <= addr &&
 827                 addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
 828                         /* Periphery writes can be 1-3 bytes long, or DWORDs */
 829                         if (size < 4) {
 830                                 memcpy(&val, buf, size);
 831                                 spin_lock_irqsave(&trans->reg_lock, flags);
 832                                 iwl_grab_nic_access(trans);
 833                                 iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
 834                                             (addr & 0x0000FFFF) | (size << 24));
 835                                 iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
 836                                 iwl_release_nic_access(trans);
 837                                 /* needed after consecutive writes w/o read */
 838                                 mmiowb();
 839                                 spin_unlock_irqrestore(&trans->reg_lock, flags);
 840                         } else {
 841                                 if (size % 4)
 842                                         return -EINVAL;
 843                                 for (i = 0; i < size; i += 4)
 844                                         iwl_write_prph(trans, addr+i,
 845                                                 *(u32 *)buf+i);
 846                         }
 847         } else if (iwlagn_hw_valid_rtc_data_addr(addr) ||
 848                 (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&
 849                 addr < IWLAGN_RTC_INST_UPPER_BOUND)) {
 850                         _iwl_write_targ_mem_words(trans, addr, buf, size/4);
 851         } else
 852                 return -EINVAL;
 853         return 0;
 854 }
 855
 856 /*
 857  * This function handles the user application commands for SRAM data dump
 858  *
 859  * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
 860  * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
 861  *
 862  * Several error will be retured, -EBUSY if the SRAM data retrieved by
 863  * previous command has not been delivered to userspace, or -ENOMSG if
 864  * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
 865  * are missing, or -ENOMEM if the buffer allocation fails.
 866  *
 867  * Otherwise 0 is replied indicating the success of the SRAM reading.
 868  *
 869  * @hw: ieee80211_hw object that represents the device
 870  * @tb: gnl message fields from the user space
 871  */
 872 static int iwl_testmode_indirect_mem(struct ieee80211_hw *hw,
 873         struct nlattr **tb)
 874 {
 875         struct iwl_priv *priv = hw->priv;
 876         u32 addr, size, cmd;
 877         unsigned char *buf;
 878
 879         /* Both read and write should be blocked, for atomicity */
 880         if (priv->testmode_mem.read_in_progress)
 881                 return -EBUSY;
 882
 883         cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
 884         if (!tb[IWL_TM_ATTR_MEM_ADDR]) {
 885                 IWL_ERR(priv, "Error finding memory offset address\n");
 886                 return -ENOMSG;
 887         }
 888         addr = nla_get_u32(tb[IWL_TM_ATTR_MEM_ADDR]);
 889         if (!tb[IWL_TM_ATTR_BUFFER_SIZE]) {
 890                 IWL_ERR(priv, "Error finding size for memory reading\n");
 891                 return -ENOMSG;
 892         }
 893         size = nla_get_u32(tb[IWL_TM_ATTR_BUFFER_SIZE]);
 894
 895         if (cmd == IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ)
 896                 return iwl_testmode_indirect_read(priv, addr,  size);
 897         else {
 898                 if (!tb[IWL_TM_ATTR_BUFFER_DUMP])
 899                         return -EINVAL;
 900                 buf = (unsigned char *) nla_data(tb[IWL_TM_ATTR_BUFFER_DUMP]);
 901                 return iwl_testmode_indirect_write(priv, addr, size, buf);
 902         }
 903 }
 904
 905 static int iwl_testmode_buffer_dump(struct ieee80211_hw *hw, struct nlattr **tb,
 906                                    struct sk_buff *skb,
 907                                    struct netlink_callback *cb)
 908 {
 909         struct iwl_priv *priv = hw->priv;
 910         int idx, length;
 911
 912         if (priv->testmode_mem.read_in_progress) {
 913                 idx = cb->args[4];
 914                 if (idx >= priv->testmode_mem.num_chunks) {
 915                         iwl_mem_cleanup(priv);
 916                         return -ENOENT;
 917                 }
 918                 length = DUMP_CHUNK_SIZE;
 919                 if (((idx + 1) == priv->testmode_mem.num_chunks) &&
 920                     (priv->testmode_mem.buff_size % DUMP_CHUNK_SIZE))
 921                         length = priv->testmode_mem.buff_size %
 922                                 DUMP_CHUNK_SIZE;
 923
 924                 NLA_PUT(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
 925                         priv->testmode_mem.buff_addr +
 926                         (DUMP_CHUNK_SIZE * idx));
 927                 idx++;
 928                 cb->args[4] = idx;
 929                 return 0;
 930         } else
 931                 return -EFAULT;
 932
 933  nla_put_failure:
 934         return -ENOBUFS;
 935 }
 936
 937
 938 /* The testmode gnl message handler that takes the gnl message from the
 939  * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
 940  * invoke the corresponding handlers.
 941  *
 942  * This function is invoked when there is user space application sending
 943  * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
 944  * by nl80211.
 945  *
 946  * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
 947  * dispatching it to the corresponding handler.
 948  *
 949  * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
 950  * -ENOSYS is replied to the user application if the command is unknown;
 951  * Otherwise, the command is dispatched to the respective handler.
 952  *
 953  * @hw: ieee80211_hw object that represents the device
 954  * @data: pointer to user space message
 955  * @len: length in byte of @data
 956  */
 957 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 958 {
 959         struct nlattr *tb[IWL_TM_ATTR_MAX];
 960         struct iwl_priv *priv = hw->priv;
 961         int result;
 962
 963         result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
 964                         iwl_testmode_gnl_msg_policy);
 965         if (result != 0) {
 966                 IWL_ERR(priv, "Error parsing the gnl message : %d\n", result);
 967                 return result;
 968         }
 969
 970         /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
 971         if (!tb[IWL_TM_ATTR_COMMAND]) {
 972                 IWL_ERR(priv, "Missing testmode command type\n");
 973                 return -ENOMSG;
 974         }
 975         /* in case multiple accesses to the device happens */
 976         mutex_lock(&priv->shrd->mutex);
 977
 978         switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
 979         case IWL_TM_CMD_APP2DEV_UCODE:
 980                 IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
 981                 result = iwl_testmode_ucode(hw, tb);
 982                 break;
 983         case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
 984         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
 985         case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
 986                 IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
 987                 result = iwl_testmode_reg(hw, tb);
 988                 break;
 989         case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
 990         case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
 991         case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
 992         case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
 993         case IWL_TM_CMD_APP2DEV_GET_EEPROM:
 994         case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
 995         case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
 996         case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
 997         case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
 998         case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
 999                 IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
1000                 result = iwl_testmode_driver(hw, tb);
1001                 break;
1002
1003         case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
1004         case IWL_TM_CMD_APP2DEV_END_TRACE:
1005         case IWL_TM_CMD_APP2DEV_READ_TRACE:
1006                 IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
1007                 result = iwl_testmode_trace(hw, tb);
1008                 break;
1009
1010         case IWL_TM_CMD_APP2DEV_OWNERSHIP:
1011                 IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
1012                 result = iwl_testmode_ownership(hw, tb);
1013                 break;
1014
1015         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
1016         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
1017                 IWL_DEBUG_INFO(priv, "testmode indirect memory cmd "
1018                         "to driver\n");
1019                 result = iwl_testmode_indirect_mem(hw, tb);
1020                 break;
1021
1022         default:
1023                 IWL_ERR(priv, "Unknown testmode command\n");
1024                 result = -ENOSYS;
1025                 break;
1026         }
1027
1028         mutex_unlock(&priv->shrd->mutex);
1029         return result;
1030 }
1031
1032 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
1033                       struct netlink_callback *cb,
1034                       void *data, int len)
1035 {
1036         struct nlattr *tb[IWL_TM_ATTR_MAX];
1037         struct iwl_priv *priv = hw->priv;
1038         int result;
1039         u32 cmd;
1040
1041         if (cb->args[3]) {
1042                 /* offset by 1 since commands start at 0 */
1043                 cmd = cb->args[3] - 1;
1044         } else {
1045                 result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
1046                                 iwl_testmode_gnl_msg_policy);
1047                 if (result) {
1048                         IWL_ERR(priv,
1049                                 "Error parsing the gnl message : %d\n", result);
1050                         return result;
1051                 }
1052
1053                 /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
1054                 if (!tb[IWL_TM_ATTR_COMMAND]) {
1055                         IWL_ERR(priv, "Missing testmode command type\n");
1056                         return -ENOMSG;
1057                 }
1058                 cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
1059                 cb->args[3] = cmd + 1;
1060         }
1061
1062         /* in case multiple accesses to the device happens */
1063         mutex_lock(&priv->shrd->mutex);
1064         switch (cmd) {
1065         case IWL_TM_CMD_APP2DEV_READ_TRACE:
1066                 IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
1067                 result = iwl_testmode_trace_dump(hw, tb, skb, cb);
1068                 break;
1069         case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
1070                 IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
1071                 result = iwl_testmode_buffer_dump(hw, tb, skb, cb);
1072                 break;
1073         default:
1074                 result = -EINVAL;
1075                 break;
1076         }
1077
1078         mutex_unlock(&priv->shrd->mutex);
1079         return result;
1080 }