1// SPDX-License-Identifier: GPL-2.0
  2
  3#include <linux/highmem.h>
  4#include <linux/module.h>
  5#include <linux/security.h>
  6#include <linux/slab.h>
  7#include <linux/types.h>
  8
  9#include "sysfs.h"
 10
 11/*
 12 * sysfs support for firmware loader
 13 */
 14
 15void __fw_load_abort(struct fw_priv *fw_priv)
 16{
 17	/*
 18	 * There is a small window in which user can write to 'loading'
 19	 * between loading done/aborted and disappearance of 'loading'
 20	 */
 21	if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv))
 22		return;
 23
 24	fw_state_aborted(fw_priv);
 25}
 26
 27#ifdef CONFIG_FW_LOADER_USER_HELPER
 28static ssize_t timeout_show(const struct class *class, const struct class_attribute *attr,
 29			    char *buf)
 30{
 31	return sysfs_emit(buf, "%d\n", __firmware_loading_timeout());
 32}
 33
 34/**
 35 * timeout_store() - set number of seconds to wait for firmware
 36 * @class: device class pointer
 37 * @attr: device attribute pointer
 38 * @buf: buffer to scan for timeout value
 39 * @count: number of bytes in @buf
 40 *
 41 *	Sets the number of seconds to wait for the firmware.  Once
 42 *	this expires an error will be returned to the driver and no
 43 *	firmware will be provided.
 44 *
 45 *	Note: zero means 'wait forever'.
 46 **/
 47static ssize_t timeout_store(const struct class *class, const struct class_attribute *attr,
 48			     const char *buf, size_t count)
 49{
 50	int tmp_loading_timeout = simple_strtol(buf, NULL, 10);
 51
 52	if (tmp_loading_timeout < 0)
 53		tmp_loading_timeout = 0;
 54
 55	__fw_fallback_set_timeout(tmp_loading_timeout);
 56
 57	return count;
 58}
 59static CLASS_ATTR_RW(timeout);
 60
 61static struct attribute *firmware_class_attrs[] = {
 62	&class_attr_timeout.attr,
 63	NULL,
 64};
 65ATTRIBUTE_GROUPS(firmware_class);
 66
 67static int do_firmware_uevent(const struct fw_sysfs *fw_sysfs, struct kobj_uevent_env *env)
 68{
 69	if (add_uevent_var(env, "FIRMWARE=%s", fw_sysfs->fw_priv->fw_name))
 70		return -ENOMEM;
 71	if (add_uevent_var(env, "TIMEOUT=%i", __firmware_loading_timeout()))
 72		return -ENOMEM;
 73	if (add_uevent_var(env, "ASYNC=%d", fw_sysfs->nowait))
 74		return -ENOMEM;
 75
 76	return 0;
 77}
 78
 79static int firmware_uevent(const struct device *dev, struct kobj_uevent_env *env)
 80{
 81	const struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
 82	int err = 0;
 83
 84	mutex_lock(&fw_lock);
 85	if (fw_sysfs->fw_priv)
 86		err = do_firmware_uevent(fw_sysfs, env);
 87	mutex_unlock(&fw_lock);
 88	return err;
 89}
 90#endif /* CONFIG_FW_LOADER_USER_HELPER */
 91
 92static void fw_dev_release(struct device *dev)
 93{
 94	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
 95
 96	if (fw_sysfs->fw_upload_priv)
 97		fw_upload_free(fw_sysfs);
 98
 99	kfree(fw_sysfs);
100}
101
102static struct class firmware_class = {
103	.name		= "firmware",
104#ifdef CONFIG_FW_LOADER_USER_HELPER
105	.class_groups	= firmware_class_groups,
106	.dev_uevent	= firmware_uevent,
107#endif
108	.dev_release	= fw_dev_release,
109};
110
111int register_sysfs_loader(void)
112{
113	int ret = class_register(&firmware_class);
114
115	if (ret != 0)
116		return ret;
117	return register_firmware_config_sysctl();
118}
119
120void unregister_sysfs_loader(void)
121{
122	unregister_firmware_config_sysctl();
123	class_unregister(&firmware_class);
124}
125
126static ssize_t firmware_loading_show(struct device *dev,
127				     struct device_attribute *attr, char *buf)
128{
129	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
130	int loading = 0;
131
132	mutex_lock(&fw_lock);
133	if (fw_sysfs->fw_priv)
134		loading = fw_state_is_loading(fw_sysfs->fw_priv);
135	mutex_unlock(&fw_lock);
136
137	return sysfs_emit(buf, "%d\n", loading);
138}
139
140/**
141 * firmware_loading_store() - set value in the 'loading' control file
142 * @dev: device pointer
143 * @attr: device attribute pointer
144 * @buf: buffer to scan for loading control value
145 * @count: number of bytes in @buf
146 *
147 *	The relevant values are:
148 *
149 *	 1: Start a load, discarding any previous partial load.
150 *	 0: Conclude the load and hand the data to the driver code.
151 *	-1: Conclude the load with an error and discard any written data.
152 **/
153static ssize_t firmware_loading_store(struct device *dev,
154				      struct device_attribute *attr,
155				      const char *buf, size_t count)
156{
157	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
158	struct fw_priv *fw_priv;
159	ssize_t written = count;
160	int loading = simple_strtol(buf, NULL, 10);
161
162	mutex_lock(&fw_lock);
163	fw_priv = fw_sysfs->fw_priv;
164	if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv))
165		goto out;
166
167	switch (loading) {
168	case 1:
169		/* discarding any previous partial load */
170		fw_free_paged_buf(fw_priv);
171		fw_state_start(fw_priv);
172		break;
173	case 0:
174		if (fw_state_is_loading(fw_priv)) {
175			int rc;
176
177			/*
178			 * Several loading requests may be pending on
179			 * one same firmware buf, so let all requests
180			 * see the mapped 'buf->data' once the loading
181			 * is completed.
182			 */
183			rc = fw_map_paged_buf(fw_priv);
184			if (rc)
185				dev_err(dev, "%s: map pages failed\n",
186					__func__);
187			else
188				rc = security_kernel_post_load_data(fw_priv->data,
189								    fw_priv->size,
190								    LOADING_FIRMWARE,
191								    "blob");
192
193			/*
194			 * Same logic as fw_load_abort, only the DONE bit
195			 * is ignored and we set ABORT only on failure.
196			 */
197			if (rc) {
198				fw_state_aborted(fw_priv);
199				written = rc;
200			} else {
201				fw_state_done(fw_priv);
202
203				/*
204				 * If this is a user-initiated firmware upload
205				 * then start the upload in a worker thread now.
206				 */
207				rc = fw_upload_start(fw_sysfs);
208				if (rc)
209					written = rc;
210			}
211			break;
212		}
213		fallthrough;
214	default:
215		dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
216		fallthrough;
217	case -1:
218		fw_load_abort(fw_sysfs);
219		if (fw_sysfs->fw_upload_priv)
220			fw_state_init(fw_sysfs->fw_priv);
221
222		break;
223	}
224out:
225	mutex_unlock(&fw_lock);
226	return written;
227}
228
229DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
230
231static void firmware_rw_data(struct fw_priv *fw_priv, char *buffer,
232			     loff_t offset, size_t count, bool read)
233{
234	if (read)
235		memcpy(buffer, fw_priv->data + offset, count);
236	else
237		memcpy(fw_priv->data + offset, buffer, count);
238}
239
240static void firmware_rw(struct fw_priv *fw_priv, char *buffer,
241			loff_t offset, size_t count, bool read)
242{
243	while (count) {
244		int page_nr = offset >> PAGE_SHIFT;
245		int page_ofs = offset & (PAGE_SIZE - 1);
246		int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
247
248		if (read)
249			memcpy_from_page(buffer, fw_priv->pages[page_nr],
250					 page_ofs, page_cnt);
251		else
252			memcpy_to_page(fw_priv->pages[page_nr], page_ofs,
253				       buffer, page_cnt);
254
255		buffer += page_cnt;
256		offset += page_cnt;
257		count -= page_cnt;
258	}
259}
260
261static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
262				  struct bin_attribute *bin_attr,
263				  char *buffer, loff_t offset, size_t count)
264{
265	struct device *dev = kobj_to_dev(kobj);
266	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
267	struct fw_priv *fw_priv;
268	ssize_t ret_count;
269
270	mutex_lock(&fw_lock);
271	fw_priv = fw_sysfs->fw_priv;
272	if (!fw_priv || fw_state_is_done(fw_priv)) {
273		ret_count = -ENODEV;
274		goto out;
275	}
276	if (offset > fw_priv->size) {
277		ret_count = 0;
278		goto out;
279	}
280	if (count > fw_priv->size - offset)
281		count = fw_priv->size - offset;
282
283	ret_count = count;
284
285	if (fw_priv->data)
286		firmware_rw_data(fw_priv, buffer, offset, count, true);
287	else
288		firmware_rw(fw_priv, buffer, offset, count, true);
289
290out:
291	mutex_unlock(&fw_lock);
292	return ret_count;
293}
294
295static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size)
296{
297	int err;
298
299	err = fw_grow_paged_buf(fw_sysfs->fw_priv,
300				PAGE_ALIGN(min_size) >> PAGE_SHIFT);
301	if (err)
302		fw_load_abort(fw_sysfs);
303	return err;
304}
305
306/**
307 * firmware_data_write() - write method for firmware
308 * @filp: open sysfs file
309 * @kobj: kobject for the device
310 * @bin_attr: bin_attr structure
311 * @buffer: buffer being written
312 * @offset: buffer offset for write in total data store area
313 * @count: buffer size
314 *
315 *	Data written to the 'data' attribute will be later handed to
316 *	the driver as a firmware image.
317 **/
318static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
319				   struct bin_attribute *bin_attr,
320				   char *buffer, loff_t offset, size_t count)
321{
322	struct device *dev = kobj_to_dev(kobj);
323	struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev);
324	struct fw_priv *fw_priv;
325	ssize_t retval;
326
327	if (!capable(CAP_SYS_RAWIO))
328		return -EPERM;
329
330	mutex_lock(&fw_lock);
331	fw_priv = fw_sysfs->fw_priv;
332	if (!fw_priv || fw_state_is_done(fw_priv)) {
333		retval = -ENODEV;
334		goto out;
335	}
336
337	if (fw_priv->data) {
338		if (offset + count > fw_priv->allocated_size) {
339			retval = -ENOMEM;
340			goto out;
341		}
342		firmware_rw_data(fw_priv, buffer, offset, count, false);
343		retval = count;
344	} else {
345		retval = fw_realloc_pages(fw_sysfs, offset + count);
346		if (retval)
347			goto out;
348
349		retval = count;
350		firmware_rw(fw_priv, buffer, offset, count, false);
351	}
352
353	fw_priv->size = max_t(size_t, offset + count, fw_priv->size);
354out:
355	mutex_unlock(&fw_lock);
356	return retval;
357}
358
359static struct bin_attribute firmware_attr_data = {
360	.attr = { .name = "data", .mode = 0644 },
361	.size = 0,
362	.read = firmware_data_read,
363	.write = firmware_data_write,
364};
365
366static struct attribute *fw_dev_attrs[] = {
367	&dev_attr_loading.attr,
368#ifdef CONFIG_FW_UPLOAD
369	&dev_attr_cancel.attr,
370	&dev_attr_status.attr,
371	&dev_attr_error.attr,
372	&dev_attr_remaining_size.attr,
373#endif
374	NULL
375};
376
377static struct bin_attribute *fw_dev_bin_attrs[] = {
378	&firmware_attr_data,
379	NULL
380};
381
382static const struct attribute_group fw_dev_attr_group = {
383	.attrs = fw_dev_attrs,
384	.bin_attrs = fw_dev_bin_attrs,
385#ifdef CONFIG_FW_UPLOAD
386	.is_visible = fw_upload_is_visible,
387#endif
388};
389
390static const struct attribute_group *fw_dev_attr_groups[] = {
391	&fw_dev_attr_group,
392	NULL
393};
394
395struct fw_sysfs *
396fw_create_instance(struct firmware *firmware, const char *fw_name,
397		   struct device *device, u32 opt_flags)
398{
399	struct fw_sysfs *fw_sysfs;
400	struct device *f_dev;
401
402	fw_sysfs = kzalloc(sizeof(*fw_sysfs), GFP_KERNEL);
403	if (!fw_sysfs) {
404		fw_sysfs = ERR_PTR(-ENOMEM);
405		goto exit;
406	}
407
408	fw_sysfs->nowait = !!(opt_flags & FW_OPT_NOWAIT);
409	fw_sysfs->fw = firmware;
410	f_dev = &fw_sysfs->dev;
411
412	device_initialize(f_dev);
413	dev_set_name(f_dev, "%s", fw_name);
414	f_dev->parent = device;
415	f_dev->class = &firmware_class;
416	f_dev->groups = fw_dev_attr_groups;
417exit:
418	return fw_sysfs;
419}