Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This module provides an interface to trigger and test firmware loading.
4 *
5 * It is designed to be used for basic evaluation of the firmware loading
6 * subsystem (for example when validating firmware verification). It lacks
7 * any extra dependencies, and will not normally be loaded by the system
8 * unless explicitly requested by name.
9 */
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/printk.h>
16#include <linux/completion.h>
17#include <linux/firmware.h>
18#include <linux/device.h>
19#include <linux/fs.h>
20#include <linux/miscdevice.h>
21#include <linux/sizes.h>
22#include <linux/slab.h>
23#include <linux/uaccess.h>
24#include <linux/delay.h>
25#include <linux/kthread.h>
26#include <linux/vmalloc.h>
27#include <linux/efi_embedded_fw.h>
28
29MODULE_IMPORT_NS(TEST_FIRMWARE);
30
31#define TEST_FIRMWARE_NAME "test-firmware.bin"
32#define TEST_FIRMWARE_NUM_REQS 4
33#define TEST_FIRMWARE_BUF_SIZE SZ_1K
34
35static DEFINE_MUTEX(test_fw_mutex);
36static const struct firmware *test_firmware;
37
38struct test_batched_req {
39 u8 idx;
40 int rc;
41 bool sent;
42 const struct firmware *fw;
43 const char *name;
44 struct completion completion;
45 struct task_struct *task;
46 struct device *dev;
47};
48
49/**
50 * test_config - represents configuration for the test for different triggers
51 *
52 * @name: the name of the firmware file to look for
53 * @into_buf: when the into_buf is used if this is true
54 * request_firmware_into_buf() will be used instead.
55 * @buf_size: size of buf to allocate when into_buf is true
56 * @file_offset: file offset to request when calling request_firmware_into_buf
57 * @partial: partial read opt when calling request_firmware_into_buf
58 * @sync_direct: when the sync trigger is used if this is true
59 * request_firmware_direct() will be used instead.
60 * @send_uevent: whether or not to send a uevent for async requests
61 * @num_requests: number of requests to try per test case. This is trigger
62 * specific.
63 * @reqs: stores all requests information
64 * @read_fw_idx: index of thread from which we want to read firmware results
65 * from through the read_fw trigger.
66 * @test_result: a test may use this to collect the result from the call
67 * of the request_firmware*() calls used in their tests. In order of
68 * priority we always keep first any setup error. If no setup errors were
69 * found then we move on to the first error encountered while running the
70 * API. Note that for async calls this typically will be a successful
71 * result (0) unless of course you've used bogus parameters, or the system
72 * is out of memory. In the async case the callback is expected to do a
73 * bit more homework to figure out what happened, unfortunately the only
74 * information passed today on error is the fact that no firmware was
75 * found so we can only assume -ENOENT on async calls if the firmware is
76 * NULL.
77 *
78 * Errors you can expect:
79 *
80 * API specific:
81 *
82 * 0: success for sync, for async it means request was sent
83 * -EINVAL: invalid parameters or request
84 * -ENOENT: files not found
85 *
86 * System environment:
87 *
88 * -ENOMEM: memory pressure on system
89 * -ENODEV: out of number of devices to test
90 * -EINVAL: an unexpected error has occurred
91 * @req_firmware: if @sync_direct is true this is set to
92 * request_firmware_direct(), otherwise request_firmware()
93 */
94struct test_config {
95 char *name;
96 bool into_buf;
97 size_t buf_size;
98 size_t file_offset;
99 bool partial;
100 bool sync_direct;
101 bool send_uevent;
102 u8 num_requests;
103 u8 read_fw_idx;
104
105 /*
106 * These below don't belong her but we'll move them once we create
107 * a struct fw_test_device and stuff the misc_dev under there later.
108 */
109 struct test_batched_req *reqs;
110 int test_result;
111 int (*req_firmware)(const struct firmware **fw, const char *name,
112 struct device *device);
113};
114
115static struct test_config *test_fw_config;
116
117static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
118 size_t size, loff_t *offset)
119{
120 ssize_t rc = 0;
121
122 mutex_lock(&test_fw_mutex);
123 if (test_firmware)
124 rc = simple_read_from_buffer(buf, size, offset,
125 test_firmware->data,
126 test_firmware->size);
127 mutex_unlock(&test_fw_mutex);
128 return rc;
129}
130
131static const struct file_operations test_fw_fops = {
132 .owner = THIS_MODULE,
133 .read = test_fw_misc_read,
134};
135
136static void __test_release_all_firmware(void)
137{
138 struct test_batched_req *req;
139 u8 i;
140
141 if (!test_fw_config->reqs)
142 return;
143
144 for (i = 0; i < test_fw_config->num_requests; i++) {
145 req = &test_fw_config->reqs[i];
146 if (req->fw)
147 release_firmware(req->fw);
148 }
149
150 vfree(test_fw_config->reqs);
151 test_fw_config->reqs = NULL;
152}
153
154static void test_release_all_firmware(void)
155{
156 mutex_lock(&test_fw_mutex);
157 __test_release_all_firmware();
158 mutex_unlock(&test_fw_mutex);
159}
160
161
162static void __test_firmware_config_free(void)
163{
164 __test_release_all_firmware();
165 kfree_const(test_fw_config->name);
166 test_fw_config->name = NULL;
167}
168
169/*
170 * XXX: move to kstrncpy() once merged.
171 *
172 * Users should use kfree_const() when freeing these.
173 */
174static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
175{
176 *dst = kstrndup(name, count, gfp);
177 if (!*dst)
178 return -ENOSPC;
179 return count;
180}
181
182static int __test_firmware_config_init(void)
183{
184 int ret;
185
186 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
187 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
188 if (ret < 0)
189 goto out;
190
191 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
192 test_fw_config->send_uevent = true;
193 test_fw_config->into_buf = false;
194 test_fw_config->buf_size = TEST_FIRMWARE_BUF_SIZE;
195 test_fw_config->file_offset = 0;
196 test_fw_config->partial = false;
197 test_fw_config->sync_direct = false;
198 test_fw_config->req_firmware = request_firmware;
199 test_fw_config->test_result = 0;
200 test_fw_config->reqs = NULL;
201
202 return 0;
203
204out:
205 __test_firmware_config_free();
206 return ret;
207}
208
209static ssize_t reset_store(struct device *dev,
210 struct device_attribute *attr,
211 const char *buf, size_t count)
212{
213 int ret;
214
215 mutex_lock(&test_fw_mutex);
216
217 __test_firmware_config_free();
218
219 ret = __test_firmware_config_init();
220 if (ret < 0) {
221 ret = -ENOMEM;
222 pr_err("could not alloc settings for config trigger: %d\n",
223 ret);
224 goto out;
225 }
226
227 pr_info("reset\n");
228 ret = count;
229
230out:
231 mutex_unlock(&test_fw_mutex);
232
233 return ret;
234}
235static DEVICE_ATTR_WO(reset);
236
237static ssize_t config_show(struct device *dev,
238 struct device_attribute *attr,
239 char *buf)
240{
241 int len = 0;
242
243 mutex_lock(&test_fw_mutex);
244
245 len += scnprintf(buf, PAGE_SIZE - len,
246 "Custom trigger configuration for: %s\n",
247 dev_name(dev));
248
249 if (test_fw_config->name)
250 len += scnprintf(buf + len, PAGE_SIZE - len,
251 "name:\t%s\n",
252 test_fw_config->name);
253 else
254 len += scnprintf(buf + len, PAGE_SIZE - len,
255 "name:\tEMTPY\n");
256
257 len += scnprintf(buf + len, PAGE_SIZE - len,
258 "num_requests:\t%u\n", test_fw_config->num_requests);
259
260 len += scnprintf(buf + len, PAGE_SIZE - len,
261 "send_uevent:\t\t%s\n",
262 test_fw_config->send_uevent ?
263 "FW_ACTION_UEVENT" :
264 "FW_ACTION_NOUEVENT");
265 len += scnprintf(buf + len, PAGE_SIZE - len,
266 "into_buf:\t\t%s\n",
267 test_fw_config->into_buf ? "true" : "false");
268 len += scnprintf(buf + len, PAGE_SIZE - len,
269 "buf_size:\t%zu\n", test_fw_config->buf_size);
270 len += scnprintf(buf + len, PAGE_SIZE - len,
271 "file_offset:\t%zu\n", test_fw_config->file_offset);
272 len += scnprintf(buf + len, PAGE_SIZE - len,
273 "partial:\t\t%s\n",
274 test_fw_config->partial ? "true" : "false");
275 len += scnprintf(buf + len, PAGE_SIZE - len,
276 "sync_direct:\t\t%s\n",
277 test_fw_config->sync_direct ? "true" : "false");
278 len += scnprintf(buf + len, PAGE_SIZE - len,
279 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
280
281 mutex_unlock(&test_fw_mutex);
282
283 return len;
284}
285static DEVICE_ATTR_RO(config);
286
287static ssize_t config_name_store(struct device *dev,
288 struct device_attribute *attr,
289 const char *buf, size_t count)
290{
291 int ret;
292
293 mutex_lock(&test_fw_mutex);
294 kfree_const(test_fw_config->name);
295 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
296 mutex_unlock(&test_fw_mutex);
297
298 return ret;
299}
300
301/*
302 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
303 */
304static ssize_t config_test_show_str(char *dst,
305 char *src)
306{
307 int len;
308
309 mutex_lock(&test_fw_mutex);
310 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
311 mutex_unlock(&test_fw_mutex);
312
313 return len;
314}
315
316static int test_dev_config_update_bool(const char *buf, size_t size,
317 bool *cfg)
318{
319 int ret;
320
321 mutex_lock(&test_fw_mutex);
322 if (strtobool(buf, cfg) < 0)
323 ret = -EINVAL;
324 else
325 ret = size;
326 mutex_unlock(&test_fw_mutex);
327
328 return ret;
329}
330
331static ssize_t test_dev_config_show_bool(char *buf, bool val)
332{
333 return snprintf(buf, PAGE_SIZE, "%d\n", val);
334}
335
336static int test_dev_config_update_size_t(const char *buf,
337 size_t size,
338 size_t *cfg)
339{
340 int ret;
341 long new;
342
343 ret = kstrtol(buf, 10, &new);
344 if (ret)
345 return ret;
346
347 mutex_lock(&test_fw_mutex);
348 *(size_t *)cfg = new;
349 mutex_unlock(&test_fw_mutex);
350
351 /* Always return full write size even if we didn't consume all */
352 return size;
353}
354
355static ssize_t test_dev_config_show_size_t(char *buf, size_t val)
356{
357 return snprintf(buf, PAGE_SIZE, "%zu\n", val);
358}
359
360static ssize_t test_dev_config_show_int(char *buf, int val)
361{
362 return snprintf(buf, PAGE_SIZE, "%d\n", val);
363}
364
365static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
366{
367 u8 val;
368 int ret;
369
370 ret = kstrtou8(buf, 10, &val);
371 if (ret)
372 return ret;
373
374 mutex_lock(&test_fw_mutex);
375 *(u8 *)cfg = val;
376 mutex_unlock(&test_fw_mutex);
377
378 /* Always return full write size even if we didn't consume all */
379 return size;
380}
381
382static ssize_t test_dev_config_show_u8(char *buf, u8 val)
383{
384 return snprintf(buf, PAGE_SIZE, "%u\n", val);
385}
386
387static ssize_t config_name_show(struct device *dev,
388 struct device_attribute *attr,
389 char *buf)
390{
391 return config_test_show_str(buf, test_fw_config->name);
392}
393static DEVICE_ATTR_RW(config_name);
394
395static ssize_t config_num_requests_store(struct device *dev,
396 struct device_attribute *attr,
397 const char *buf, size_t count)
398{
399 int rc;
400
401 mutex_lock(&test_fw_mutex);
402 if (test_fw_config->reqs) {
403 pr_err("Must call release_all_firmware prior to changing config\n");
404 rc = -EINVAL;
405 mutex_unlock(&test_fw_mutex);
406 goto out;
407 }
408 mutex_unlock(&test_fw_mutex);
409
410 rc = test_dev_config_update_u8(buf, count,
411 &test_fw_config->num_requests);
412
413out:
414 return rc;
415}
416
417static ssize_t config_num_requests_show(struct device *dev,
418 struct device_attribute *attr,
419 char *buf)
420{
421 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
422}
423static DEVICE_ATTR_RW(config_num_requests);
424
425static ssize_t config_into_buf_store(struct device *dev,
426 struct device_attribute *attr,
427 const char *buf, size_t count)
428{
429 return test_dev_config_update_bool(buf,
430 count,
431 &test_fw_config->into_buf);
432}
433
434static ssize_t config_into_buf_show(struct device *dev,
435 struct device_attribute *attr,
436 char *buf)
437{
438 return test_dev_config_show_bool(buf, test_fw_config->into_buf);
439}
440static DEVICE_ATTR_RW(config_into_buf);
441
442static ssize_t config_buf_size_store(struct device *dev,
443 struct device_attribute *attr,
444 const char *buf, size_t count)
445{
446 int rc;
447
448 mutex_lock(&test_fw_mutex);
449 if (test_fw_config->reqs) {
450 pr_err("Must call release_all_firmware prior to changing config\n");
451 rc = -EINVAL;
452 mutex_unlock(&test_fw_mutex);
453 goto out;
454 }
455 mutex_unlock(&test_fw_mutex);
456
457 rc = test_dev_config_update_size_t(buf, count,
458 &test_fw_config->buf_size);
459
460out:
461 return rc;
462}
463
464static ssize_t config_buf_size_show(struct device *dev,
465 struct device_attribute *attr,
466 char *buf)
467{
468 return test_dev_config_show_size_t(buf, test_fw_config->buf_size);
469}
470static DEVICE_ATTR_RW(config_buf_size);
471
472static ssize_t config_file_offset_store(struct device *dev,
473 struct device_attribute *attr,
474 const char *buf, size_t count)
475{
476 int rc;
477
478 mutex_lock(&test_fw_mutex);
479 if (test_fw_config->reqs) {
480 pr_err("Must call release_all_firmware prior to changing config\n");
481 rc = -EINVAL;
482 mutex_unlock(&test_fw_mutex);
483 goto out;
484 }
485 mutex_unlock(&test_fw_mutex);
486
487 rc = test_dev_config_update_size_t(buf, count,
488 &test_fw_config->file_offset);
489
490out:
491 return rc;
492}
493
494static ssize_t config_file_offset_show(struct device *dev,
495 struct device_attribute *attr,
496 char *buf)
497{
498 return test_dev_config_show_size_t(buf, test_fw_config->file_offset);
499}
500static DEVICE_ATTR_RW(config_file_offset);
501
502static ssize_t config_partial_store(struct device *dev,
503 struct device_attribute *attr,
504 const char *buf, size_t count)
505{
506 return test_dev_config_update_bool(buf,
507 count,
508 &test_fw_config->partial);
509}
510
511static ssize_t config_partial_show(struct device *dev,
512 struct device_attribute *attr,
513 char *buf)
514{
515 return test_dev_config_show_bool(buf, test_fw_config->partial);
516}
517static DEVICE_ATTR_RW(config_partial);
518
519static ssize_t config_sync_direct_store(struct device *dev,
520 struct device_attribute *attr,
521 const char *buf, size_t count)
522{
523 int rc = test_dev_config_update_bool(buf, count,
524 &test_fw_config->sync_direct);
525
526 if (rc == count)
527 test_fw_config->req_firmware = test_fw_config->sync_direct ?
528 request_firmware_direct :
529 request_firmware;
530 return rc;
531}
532
533static ssize_t config_sync_direct_show(struct device *dev,
534 struct device_attribute *attr,
535 char *buf)
536{
537 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
538}
539static DEVICE_ATTR_RW(config_sync_direct);
540
541static ssize_t config_send_uevent_store(struct device *dev,
542 struct device_attribute *attr,
543 const char *buf, size_t count)
544{
545 return test_dev_config_update_bool(buf, count,
546 &test_fw_config->send_uevent);
547}
548
549static ssize_t config_send_uevent_show(struct device *dev,
550 struct device_attribute *attr,
551 char *buf)
552{
553 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
554}
555static DEVICE_ATTR_RW(config_send_uevent);
556
557static ssize_t config_read_fw_idx_store(struct device *dev,
558 struct device_attribute *attr,
559 const char *buf, size_t count)
560{
561 return test_dev_config_update_u8(buf, count,
562 &test_fw_config->read_fw_idx);
563}
564
565static ssize_t config_read_fw_idx_show(struct device *dev,
566 struct device_attribute *attr,
567 char *buf)
568{
569 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
570}
571static DEVICE_ATTR_RW(config_read_fw_idx);
572
573
574static ssize_t trigger_request_store(struct device *dev,
575 struct device_attribute *attr,
576 const char *buf, size_t count)
577{
578 int rc;
579 char *name;
580
581 name = kstrndup(buf, count, GFP_KERNEL);
582 if (!name)
583 return -ENOSPC;
584
585 pr_info("loading '%s'\n", name);
586
587 mutex_lock(&test_fw_mutex);
588 release_firmware(test_firmware);
589 test_firmware = NULL;
590 rc = request_firmware(&test_firmware, name, dev);
591 if (rc) {
592 pr_info("load of '%s' failed: %d\n", name, rc);
593 goto out;
594 }
595 pr_info("loaded: %zu\n", test_firmware->size);
596 rc = count;
597
598out:
599 mutex_unlock(&test_fw_mutex);
600
601 kfree(name);
602
603 return rc;
604}
605static DEVICE_ATTR_WO(trigger_request);
606
607#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
608extern struct list_head efi_embedded_fw_list;
609extern bool efi_embedded_fw_checked;
610
611static ssize_t trigger_request_platform_store(struct device *dev,
612 struct device_attribute *attr,
613 const char *buf, size_t count)
614{
615 static const u8 test_data[] = {
616 0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
617 0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
618 0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
619 0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
620 };
621 struct efi_embedded_fw efi_embedded_fw;
622 const struct firmware *firmware = NULL;
623 bool saved_efi_embedded_fw_checked;
624 char *name;
625 int rc;
626
627 name = kstrndup(buf, count, GFP_KERNEL);
628 if (!name)
629 return -ENOSPC;
630
631 pr_info("inserting test platform fw '%s'\n", name);
632 efi_embedded_fw.name = name;
633 efi_embedded_fw.data = (void *)test_data;
634 efi_embedded_fw.length = sizeof(test_data);
635 list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
636 saved_efi_embedded_fw_checked = efi_embedded_fw_checked;
637 efi_embedded_fw_checked = true;
638
639 pr_info("loading '%s'\n", name);
640 rc = firmware_request_platform(&firmware, name, dev);
641 if (rc) {
642 pr_info("load of '%s' failed: %d\n", name, rc);
643 goto out;
644 }
645 if (firmware->size != sizeof(test_data) ||
646 memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
647 pr_info("firmware contents mismatch for '%s'\n", name);
648 rc = -EINVAL;
649 goto out;
650 }
651 pr_info("loaded: %zu\n", firmware->size);
652 rc = count;
653
654out:
655 efi_embedded_fw_checked = saved_efi_embedded_fw_checked;
656 release_firmware(firmware);
657 list_del(&efi_embedded_fw.list);
658 kfree(name);
659
660 return rc;
661}
662static DEVICE_ATTR_WO(trigger_request_platform);
663#endif
664
665static DECLARE_COMPLETION(async_fw_done);
666
667static void trigger_async_request_cb(const struct firmware *fw, void *context)
668{
669 test_firmware = fw;
670 complete(&async_fw_done);
671}
672
673static ssize_t trigger_async_request_store(struct device *dev,
674 struct device_attribute *attr,
675 const char *buf, size_t count)
676{
677 int rc;
678 char *name;
679
680 name = kstrndup(buf, count, GFP_KERNEL);
681 if (!name)
682 return -ENOSPC;
683
684 pr_info("loading '%s'\n", name);
685
686 mutex_lock(&test_fw_mutex);
687 release_firmware(test_firmware);
688 test_firmware = NULL;
689 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
690 NULL, trigger_async_request_cb);
691 if (rc) {
692 pr_info("async load of '%s' failed: %d\n", name, rc);
693 kfree(name);
694 goto out;
695 }
696 /* Free 'name' ASAP, to test for race conditions */
697 kfree(name);
698
699 wait_for_completion(&async_fw_done);
700
701 if (test_firmware) {
702 pr_info("loaded: %zu\n", test_firmware->size);
703 rc = count;
704 } else {
705 pr_err("failed to async load firmware\n");
706 rc = -ENOMEM;
707 }
708
709out:
710 mutex_unlock(&test_fw_mutex);
711
712 return rc;
713}
714static DEVICE_ATTR_WO(trigger_async_request);
715
716static ssize_t trigger_custom_fallback_store(struct device *dev,
717 struct device_attribute *attr,
718 const char *buf, size_t count)
719{
720 int rc;
721 char *name;
722
723 name = kstrndup(buf, count, GFP_KERNEL);
724 if (!name)
725 return -ENOSPC;
726
727 pr_info("loading '%s' using custom fallback mechanism\n", name);
728
729 mutex_lock(&test_fw_mutex);
730 release_firmware(test_firmware);
731 test_firmware = NULL;
732 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOUEVENT, name,
733 dev, GFP_KERNEL, NULL,
734 trigger_async_request_cb);
735 if (rc) {
736 pr_info("async load of '%s' failed: %d\n", name, rc);
737 kfree(name);
738 goto out;
739 }
740 /* Free 'name' ASAP, to test for race conditions */
741 kfree(name);
742
743 wait_for_completion(&async_fw_done);
744
745 if (test_firmware) {
746 pr_info("loaded: %zu\n", test_firmware->size);
747 rc = count;
748 } else {
749 pr_err("failed to async load firmware\n");
750 rc = -ENODEV;
751 }
752
753out:
754 mutex_unlock(&test_fw_mutex);
755
756 return rc;
757}
758static DEVICE_ATTR_WO(trigger_custom_fallback);
759
760static int test_fw_run_batch_request(void *data)
761{
762 struct test_batched_req *req = data;
763
764 if (!req) {
765 test_fw_config->test_result = -EINVAL;
766 return -EINVAL;
767 }
768
769 if (test_fw_config->into_buf) {
770 void *test_buf;
771
772 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
773 if (!test_buf)
774 return -ENOSPC;
775
776 if (test_fw_config->partial)
777 req->rc = request_partial_firmware_into_buf
778 (&req->fw,
779 req->name,
780 req->dev,
781 test_buf,
782 test_fw_config->buf_size,
783 test_fw_config->file_offset);
784 else
785 req->rc = request_firmware_into_buf
786 (&req->fw,
787 req->name,
788 req->dev,
789 test_buf,
790 test_fw_config->buf_size);
791 if (!req->fw)
792 kfree(test_buf);
793 } else {
794 req->rc = test_fw_config->req_firmware(&req->fw,
795 req->name,
796 req->dev);
797 }
798
799 if (req->rc) {
800 pr_info("#%u: batched sync load failed: %d\n",
801 req->idx, req->rc);
802 if (!test_fw_config->test_result)
803 test_fw_config->test_result = req->rc;
804 } else if (req->fw) {
805 req->sent = true;
806 pr_info("#%u: batched sync loaded %zu\n",
807 req->idx, req->fw->size);
808 }
809 complete(&req->completion);
810
811 req->task = NULL;
812
813 return 0;
814}
815
816/*
817 * We use a kthread as otherwise the kernel serializes all our sync requests
818 * and we would not be able to mimic batched requests on a sync call. Batched
819 * requests on a sync call can for instance happen on a device driver when
820 * multiple cards are used and firmware loading happens outside of probe.
821 */
822static ssize_t trigger_batched_requests_store(struct device *dev,
823 struct device_attribute *attr,
824 const char *buf, size_t count)
825{
826 struct test_batched_req *req;
827 int rc;
828 u8 i;
829
830 mutex_lock(&test_fw_mutex);
831
832 test_fw_config->reqs =
833 vzalloc(array3_size(sizeof(struct test_batched_req),
834 test_fw_config->num_requests, 2));
835 if (!test_fw_config->reqs) {
836 rc = -ENOMEM;
837 goto out_unlock;
838 }
839
840 pr_info("batched sync firmware loading '%s' %u times\n",
841 test_fw_config->name, test_fw_config->num_requests);
842
843 for (i = 0; i < test_fw_config->num_requests; i++) {
844 req = &test_fw_config->reqs[i];
845 req->fw = NULL;
846 req->idx = i;
847 req->name = test_fw_config->name;
848 req->dev = dev;
849 init_completion(&req->completion);
850 req->task = kthread_run(test_fw_run_batch_request, req,
851 "%s-%u", KBUILD_MODNAME, req->idx);
852 if (!req->task || IS_ERR(req->task)) {
853 pr_err("Setting up thread %u failed\n", req->idx);
854 req->task = NULL;
855 rc = -ENOMEM;
856 goto out_bail;
857 }
858 }
859
860 rc = count;
861
862 /*
863 * We require an explicit release to enable more time and delay of
864 * calling release_firmware() to improve our chances of forcing a
865 * batched request. If we instead called release_firmware() right away
866 * then we might miss on an opportunity of having a successful firmware
867 * request pass on the opportunity to be come a batched request.
868 */
869
870out_bail:
871 for (i = 0; i < test_fw_config->num_requests; i++) {
872 req = &test_fw_config->reqs[i];
873 if (req->task || req->sent)
874 wait_for_completion(&req->completion);
875 }
876
877 /* Override any worker error if we had a general setup error */
878 if (rc < 0)
879 test_fw_config->test_result = rc;
880
881out_unlock:
882 mutex_unlock(&test_fw_mutex);
883
884 return rc;
885}
886static DEVICE_ATTR_WO(trigger_batched_requests);
887
888/*
889 * We wait for each callback to return with the lock held, no need to lock here
890 */
891static void trigger_batched_cb(const struct firmware *fw, void *context)
892{
893 struct test_batched_req *req = context;
894
895 if (!req) {
896 test_fw_config->test_result = -EINVAL;
897 return;
898 }
899
900 /* forces *some* batched requests to queue up */
901 if (!req->idx)
902 ssleep(2);
903
904 req->fw = fw;
905
906 /*
907 * Unfortunately the firmware API gives us nothing other than a null FW
908 * if the firmware was not found on async requests. Best we can do is
909 * just assume -ENOENT. A better API would pass the actual return
910 * value to the callback.
911 */
912 if (!fw && !test_fw_config->test_result)
913 test_fw_config->test_result = -ENOENT;
914
915 complete(&req->completion);
916}
917
918static
919ssize_t trigger_batched_requests_async_store(struct device *dev,
920 struct device_attribute *attr,
921 const char *buf, size_t count)
922{
923 struct test_batched_req *req;
924 bool send_uevent;
925 int rc;
926 u8 i;
927
928 mutex_lock(&test_fw_mutex);
929
930 test_fw_config->reqs =
931 vzalloc(array3_size(sizeof(struct test_batched_req),
932 test_fw_config->num_requests, 2));
933 if (!test_fw_config->reqs) {
934 rc = -ENOMEM;
935 goto out;
936 }
937
938 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
939 test_fw_config->name, test_fw_config->num_requests);
940
941 send_uevent = test_fw_config->send_uevent ? FW_ACTION_UEVENT :
942 FW_ACTION_NOUEVENT;
943
944 for (i = 0; i < test_fw_config->num_requests; i++) {
945 req = &test_fw_config->reqs[i];
946 req->name = test_fw_config->name;
947 req->fw = NULL;
948 req->idx = i;
949 init_completion(&req->completion);
950 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
951 req->name,
952 dev, GFP_KERNEL, req,
953 trigger_batched_cb);
954 if (rc) {
955 pr_info("#%u: batched async load failed setup: %d\n",
956 i, rc);
957 req->rc = rc;
958 goto out_bail;
959 } else
960 req->sent = true;
961 }
962
963 rc = count;
964
965out_bail:
966
967 /*
968 * We require an explicit release to enable more time and delay of
969 * calling release_firmware() to improve our chances of forcing a
970 * batched request. If we instead called release_firmware() right away
971 * then we might miss on an opportunity of having a successful firmware
972 * request pass on the opportunity to be come a batched request.
973 */
974
975 for (i = 0; i < test_fw_config->num_requests; i++) {
976 req = &test_fw_config->reqs[i];
977 if (req->sent)
978 wait_for_completion(&req->completion);
979 }
980
981 /* Override any worker error if we had a general setup error */
982 if (rc < 0)
983 test_fw_config->test_result = rc;
984
985out:
986 mutex_unlock(&test_fw_mutex);
987
988 return rc;
989}
990static DEVICE_ATTR_WO(trigger_batched_requests_async);
991
992static ssize_t test_result_show(struct device *dev,
993 struct device_attribute *attr,
994 char *buf)
995{
996 return test_dev_config_show_int(buf, test_fw_config->test_result);
997}
998static DEVICE_ATTR_RO(test_result);
999
1000static ssize_t release_all_firmware_store(struct device *dev,
1001 struct device_attribute *attr,
1002 const char *buf, size_t count)
1003{
1004 test_release_all_firmware();
1005 return count;
1006}
1007static DEVICE_ATTR_WO(release_all_firmware);
1008
1009static ssize_t read_firmware_show(struct device *dev,
1010 struct device_attribute *attr,
1011 char *buf)
1012{
1013 struct test_batched_req *req;
1014 u8 idx;
1015 ssize_t rc = 0;
1016
1017 mutex_lock(&test_fw_mutex);
1018
1019 idx = test_fw_config->read_fw_idx;
1020 if (idx >= test_fw_config->num_requests) {
1021 rc = -ERANGE;
1022 goto out;
1023 }
1024
1025 if (!test_fw_config->reqs) {
1026 rc = -EINVAL;
1027 goto out;
1028 }
1029
1030 req = &test_fw_config->reqs[idx];
1031 if (!req->fw) {
1032 pr_err("#%u: failed to async load firmware\n", idx);
1033 rc = -ENOENT;
1034 goto out;
1035 }
1036
1037 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
1038
1039 if (req->fw->size > PAGE_SIZE) {
1040 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
1041 rc = -EINVAL;
1042 goto out;
1043 }
1044 memcpy(buf, req->fw->data, req->fw->size);
1045
1046 rc = req->fw->size;
1047out:
1048 mutex_unlock(&test_fw_mutex);
1049
1050 return rc;
1051}
1052static DEVICE_ATTR_RO(read_firmware);
1053
1054#define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
1055
1056static struct attribute *test_dev_attrs[] = {
1057 TEST_FW_DEV_ATTR(reset),
1058
1059 TEST_FW_DEV_ATTR(config),
1060 TEST_FW_DEV_ATTR(config_name),
1061 TEST_FW_DEV_ATTR(config_num_requests),
1062 TEST_FW_DEV_ATTR(config_into_buf),
1063 TEST_FW_DEV_ATTR(config_buf_size),
1064 TEST_FW_DEV_ATTR(config_file_offset),
1065 TEST_FW_DEV_ATTR(config_partial),
1066 TEST_FW_DEV_ATTR(config_sync_direct),
1067 TEST_FW_DEV_ATTR(config_send_uevent),
1068 TEST_FW_DEV_ATTR(config_read_fw_idx),
1069
1070 /* These don't use the config at all - they could be ported! */
1071 TEST_FW_DEV_ATTR(trigger_request),
1072 TEST_FW_DEV_ATTR(trigger_async_request),
1073 TEST_FW_DEV_ATTR(trigger_custom_fallback),
1074#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
1075 TEST_FW_DEV_ATTR(trigger_request_platform),
1076#endif
1077
1078 /* These use the config and can use the test_result */
1079 TEST_FW_DEV_ATTR(trigger_batched_requests),
1080 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
1081
1082 TEST_FW_DEV_ATTR(release_all_firmware),
1083 TEST_FW_DEV_ATTR(test_result),
1084 TEST_FW_DEV_ATTR(read_firmware),
1085 NULL,
1086};
1087
1088ATTRIBUTE_GROUPS(test_dev);
1089
1090static struct miscdevice test_fw_misc_device = {
1091 .minor = MISC_DYNAMIC_MINOR,
1092 .name = "test_firmware",
1093 .fops = &test_fw_fops,
1094 .groups = test_dev_groups,
1095};
1096
1097static int __init test_firmware_init(void)
1098{
1099 int rc;
1100
1101 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
1102 if (!test_fw_config)
1103 return -ENOMEM;
1104
1105 rc = __test_firmware_config_init();
1106 if (rc) {
1107 kfree(test_fw_config);
1108 pr_err("could not init firmware test config: %d\n", rc);
1109 return rc;
1110 }
1111
1112 rc = misc_register(&test_fw_misc_device);
1113 if (rc) {
1114 kfree(test_fw_config);
1115 pr_err("could not register misc device: %d\n", rc);
1116 return rc;
1117 }
1118
1119 pr_warn("interface ready\n");
1120
1121 return 0;
1122}
1123
1124module_init(test_firmware_init);
1125
1126static void __exit test_firmware_exit(void)
1127{
1128 mutex_lock(&test_fw_mutex);
1129 release_firmware(test_firmware);
1130 misc_deregister(&test_fw_misc_device);
1131 __test_firmware_config_free();
1132 kfree(test_fw_config);
1133 mutex_unlock(&test_fw_mutex);
1134
1135 pr_warn("removed interface\n");
1136}
1137
1138module_exit(test_firmware_exit);
1139
1140MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1141MODULE_LICENSE("GPL");
1/*
2 * This module provides an interface to trigger and test firmware loading.
3 *
4 * It is designed to be used for basic evaluation of the firmware loading
5 * subsystem (for example when validating firmware verification). It lacks
6 * any extra dependencies, and will not normally be loaded by the system
7 * unless explicitly requested by name.
8 */
9
10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11
12#include <linux/init.h>
13#include <linux/module.h>
14#include <linux/printk.h>
15#include <linux/completion.h>
16#include <linux/firmware.h>
17#include <linux/device.h>
18#include <linux/fs.h>
19#include <linux/miscdevice.h>
20#include <linux/slab.h>
21#include <linux/uaccess.h>
22#include <linux/delay.h>
23#include <linux/kthread.h>
24#include <linux/vmalloc.h>
25
26#define TEST_FIRMWARE_NAME "test-firmware.bin"
27#define TEST_FIRMWARE_NUM_REQS 4
28
29static DEFINE_MUTEX(test_fw_mutex);
30static const struct firmware *test_firmware;
31
32struct test_batched_req {
33 u8 idx;
34 int rc;
35 bool sent;
36 const struct firmware *fw;
37 const char *name;
38 struct completion completion;
39 struct task_struct *task;
40 struct device *dev;
41};
42
43/**
44 * test_config - represents configuration for the test for different triggers
45 *
46 * @name: the name of the firmware file to look for
47 * @sync_direct: when the sync trigger is used if this is true
48 * request_firmware_direct() will be used instead.
49 * @send_uevent: whether or not to send a uevent for async requests
50 * @num_requests: number of requests to try per test case. This is trigger
51 * specific.
52 * @reqs: stores all requests information
53 * @read_fw_idx: index of thread from which we want to read firmware results
54 * from through the read_fw trigger.
55 * @test_result: a test may use this to collect the result from the call
56 * of the request_firmware*() calls used in their tests. In order of
57 * priority we always keep first any setup error. If no setup errors were
58 * found then we move on to the first error encountered while running the
59 * API. Note that for async calls this typically will be a successful
60 * result (0) unless of course you've used bogus parameters, or the system
61 * is out of memory. In the async case the callback is expected to do a
62 * bit more homework to figure out what happened, unfortunately the only
63 * information passed today on error is the fact that no firmware was
64 * found so we can only assume -ENOENT on async calls if the firmware is
65 * NULL.
66 *
67 * Errors you can expect:
68 *
69 * API specific:
70 *
71 * 0: success for sync, for async it means request was sent
72 * -EINVAL: invalid parameters or request
73 * -ENOENT: files not found
74 *
75 * System environment:
76 *
77 * -ENOMEM: memory pressure on system
78 * -ENODEV: out of number of devices to test
79 * -EINVAL: an unexpected error has occurred
80 * @req_firmware: if @sync_direct is true this is set to
81 * request_firmware_direct(), otherwise request_firmware()
82 */
83struct test_config {
84 char *name;
85 bool sync_direct;
86 bool send_uevent;
87 u8 num_requests;
88 u8 read_fw_idx;
89
90 /*
91 * These below don't belong her but we'll move them once we create
92 * a struct fw_test_device and stuff the misc_dev under there later.
93 */
94 struct test_batched_req *reqs;
95 int test_result;
96 int (*req_firmware)(const struct firmware **fw, const char *name,
97 struct device *device);
98};
99
100static struct test_config *test_fw_config;
101
102static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
103 size_t size, loff_t *offset)
104{
105 ssize_t rc = 0;
106
107 mutex_lock(&test_fw_mutex);
108 if (test_firmware)
109 rc = simple_read_from_buffer(buf, size, offset,
110 test_firmware->data,
111 test_firmware->size);
112 mutex_unlock(&test_fw_mutex);
113 return rc;
114}
115
116static const struct file_operations test_fw_fops = {
117 .owner = THIS_MODULE,
118 .read = test_fw_misc_read,
119};
120
121static void __test_release_all_firmware(void)
122{
123 struct test_batched_req *req;
124 u8 i;
125
126 if (!test_fw_config->reqs)
127 return;
128
129 for (i = 0; i < test_fw_config->num_requests; i++) {
130 req = &test_fw_config->reqs[i];
131 if (req->fw)
132 release_firmware(req->fw);
133 }
134
135 vfree(test_fw_config->reqs);
136 test_fw_config->reqs = NULL;
137}
138
139static void test_release_all_firmware(void)
140{
141 mutex_lock(&test_fw_mutex);
142 __test_release_all_firmware();
143 mutex_unlock(&test_fw_mutex);
144}
145
146
147static void __test_firmware_config_free(void)
148{
149 __test_release_all_firmware();
150 kfree_const(test_fw_config->name);
151 test_fw_config->name = NULL;
152}
153
154/*
155 * XXX: move to kstrncpy() once merged.
156 *
157 * Users should use kfree_const() when freeing these.
158 */
159static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
160{
161 *dst = kstrndup(name, count, gfp);
162 if (!*dst)
163 return -ENOSPC;
164 return count;
165}
166
167static int __test_firmware_config_init(void)
168{
169 int ret;
170
171 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
172 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
173 if (ret < 0)
174 goto out;
175
176 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
177 test_fw_config->send_uevent = true;
178 test_fw_config->sync_direct = false;
179 test_fw_config->req_firmware = request_firmware;
180 test_fw_config->test_result = 0;
181 test_fw_config->reqs = NULL;
182
183 return 0;
184
185out:
186 __test_firmware_config_free();
187 return ret;
188}
189
190static ssize_t reset_store(struct device *dev,
191 struct device_attribute *attr,
192 const char *buf, size_t count)
193{
194 int ret;
195
196 mutex_lock(&test_fw_mutex);
197
198 __test_firmware_config_free();
199
200 ret = __test_firmware_config_init();
201 if (ret < 0) {
202 ret = -ENOMEM;
203 pr_err("could not alloc settings for config trigger: %d\n",
204 ret);
205 goto out;
206 }
207
208 pr_info("reset\n");
209 ret = count;
210
211out:
212 mutex_unlock(&test_fw_mutex);
213
214 return ret;
215}
216static DEVICE_ATTR_WO(reset);
217
218static ssize_t config_show(struct device *dev,
219 struct device_attribute *attr,
220 char *buf)
221{
222 int len = 0;
223
224 mutex_lock(&test_fw_mutex);
225
226 len += snprintf(buf, PAGE_SIZE,
227 "Custom trigger configuration for: %s\n",
228 dev_name(dev));
229
230 if (test_fw_config->name)
231 len += snprintf(buf+len, PAGE_SIZE,
232 "name:\t%s\n",
233 test_fw_config->name);
234 else
235 len += snprintf(buf+len, PAGE_SIZE,
236 "name:\tEMTPY\n");
237
238 len += snprintf(buf+len, PAGE_SIZE,
239 "num_requests:\t%u\n", test_fw_config->num_requests);
240
241 len += snprintf(buf+len, PAGE_SIZE,
242 "send_uevent:\t\t%s\n",
243 test_fw_config->send_uevent ?
244 "FW_ACTION_HOTPLUG" :
245 "FW_ACTION_NOHOTPLUG");
246 len += snprintf(buf+len, PAGE_SIZE,
247 "sync_direct:\t\t%s\n",
248 test_fw_config->sync_direct ? "true" : "false");
249 len += snprintf(buf+len, PAGE_SIZE,
250 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
251
252 mutex_unlock(&test_fw_mutex);
253
254 return len;
255}
256static DEVICE_ATTR_RO(config);
257
258static ssize_t config_name_store(struct device *dev,
259 struct device_attribute *attr,
260 const char *buf, size_t count)
261{
262 int ret;
263
264 mutex_lock(&test_fw_mutex);
265 kfree_const(test_fw_config->name);
266 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
267 mutex_unlock(&test_fw_mutex);
268
269 return ret;
270}
271
272/*
273 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
274 */
275static ssize_t config_test_show_str(char *dst,
276 char *src)
277{
278 int len;
279
280 mutex_lock(&test_fw_mutex);
281 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
282 mutex_unlock(&test_fw_mutex);
283
284 return len;
285}
286
287static int test_dev_config_update_bool(const char *buf, size_t size,
288 bool *cfg)
289{
290 int ret;
291
292 mutex_lock(&test_fw_mutex);
293 if (strtobool(buf, cfg) < 0)
294 ret = -EINVAL;
295 else
296 ret = size;
297 mutex_unlock(&test_fw_mutex);
298
299 return ret;
300}
301
302static ssize_t
303test_dev_config_show_bool(char *buf,
304 bool config)
305{
306 bool val;
307
308 mutex_lock(&test_fw_mutex);
309 val = config;
310 mutex_unlock(&test_fw_mutex);
311
312 return snprintf(buf, PAGE_SIZE, "%d\n", val);
313}
314
315static ssize_t test_dev_config_show_int(char *buf, int cfg)
316{
317 int val;
318
319 mutex_lock(&test_fw_mutex);
320 val = cfg;
321 mutex_unlock(&test_fw_mutex);
322
323 return snprintf(buf, PAGE_SIZE, "%d\n", val);
324}
325
326static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
327{
328 int ret;
329 long new;
330
331 ret = kstrtol(buf, 10, &new);
332 if (ret)
333 return ret;
334
335 if (new > U8_MAX)
336 return -EINVAL;
337
338 mutex_lock(&test_fw_mutex);
339 *(u8 *)cfg = new;
340 mutex_unlock(&test_fw_mutex);
341
342 /* Always return full write size even if we didn't consume all */
343 return size;
344}
345
346static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
347{
348 u8 val;
349
350 mutex_lock(&test_fw_mutex);
351 val = cfg;
352 mutex_unlock(&test_fw_mutex);
353
354 return snprintf(buf, PAGE_SIZE, "%u\n", val);
355}
356
357static ssize_t config_name_show(struct device *dev,
358 struct device_attribute *attr,
359 char *buf)
360{
361 return config_test_show_str(buf, test_fw_config->name);
362}
363static DEVICE_ATTR_RW(config_name);
364
365static ssize_t config_num_requests_store(struct device *dev,
366 struct device_attribute *attr,
367 const char *buf, size_t count)
368{
369 int rc;
370
371 mutex_lock(&test_fw_mutex);
372 if (test_fw_config->reqs) {
373 pr_err("Must call release_all_firmware prior to changing config\n");
374 rc = -EINVAL;
375 mutex_unlock(&test_fw_mutex);
376 goto out;
377 }
378 mutex_unlock(&test_fw_mutex);
379
380 rc = test_dev_config_update_u8(buf, count,
381 &test_fw_config->num_requests);
382
383out:
384 return rc;
385}
386
387static ssize_t config_num_requests_show(struct device *dev,
388 struct device_attribute *attr,
389 char *buf)
390{
391 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
392}
393static DEVICE_ATTR_RW(config_num_requests);
394
395static ssize_t config_sync_direct_store(struct device *dev,
396 struct device_attribute *attr,
397 const char *buf, size_t count)
398{
399 int rc = test_dev_config_update_bool(buf, count,
400 &test_fw_config->sync_direct);
401
402 if (rc == count)
403 test_fw_config->req_firmware = test_fw_config->sync_direct ?
404 request_firmware_direct :
405 request_firmware;
406 return rc;
407}
408
409static ssize_t config_sync_direct_show(struct device *dev,
410 struct device_attribute *attr,
411 char *buf)
412{
413 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
414}
415static DEVICE_ATTR_RW(config_sync_direct);
416
417static ssize_t config_send_uevent_store(struct device *dev,
418 struct device_attribute *attr,
419 const char *buf, size_t count)
420{
421 return test_dev_config_update_bool(buf, count,
422 &test_fw_config->send_uevent);
423}
424
425static ssize_t config_send_uevent_show(struct device *dev,
426 struct device_attribute *attr,
427 char *buf)
428{
429 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
430}
431static DEVICE_ATTR_RW(config_send_uevent);
432
433static ssize_t config_read_fw_idx_store(struct device *dev,
434 struct device_attribute *attr,
435 const char *buf, size_t count)
436{
437 return test_dev_config_update_u8(buf, count,
438 &test_fw_config->read_fw_idx);
439}
440
441static ssize_t config_read_fw_idx_show(struct device *dev,
442 struct device_attribute *attr,
443 char *buf)
444{
445 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
446}
447static DEVICE_ATTR_RW(config_read_fw_idx);
448
449
450static ssize_t trigger_request_store(struct device *dev,
451 struct device_attribute *attr,
452 const char *buf, size_t count)
453{
454 int rc;
455 char *name;
456
457 name = kstrndup(buf, count, GFP_KERNEL);
458 if (!name)
459 return -ENOSPC;
460
461 pr_info("loading '%s'\n", name);
462
463 mutex_lock(&test_fw_mutex);
464 release_firmware(test_firmware);
465 test_firmware = NULL;
466 rc = request_firmware(&test_firmware, name, dev);
467 if (rc) {
468 pr_info("load of '%s' failed: %d\n", name, rc);
469 goto out;
470 }
471 pr_info("loaded: %zu\n", test_firmware->size);
472 rc = count;
473
474out:
475 mutex_unlock(&test_fw_mutex);
476
477 kfree(name);
478
479 return rc;
480}
481static DEVICE_ATTR_WO(trigger_request);
482
483static DECLARE_COMPLETION(async_fw_done);
484
485static void trigger_async_request_cb(const struct firmware *fw, void *context)
486{
487 test_firmware = fw;
488 complete(&async_fw_done);
489}
490
491static ssize_t trigger_async_request_store(struct device *dev,
492 struct device_attribute *attr,
493 const char *buf, size_t count)
494{
495 int rc;
496 char *name;
497
498 name = kstrndup(buf, count, GFP_KERNEL);
499 if (!name)
500 return -ENOSPC;
501
502 pr_info("loading '%s'\n", name);
503
504 mutex_lock(&test_fw_mutex);
505 release_firmware(test_firmware);
506 test_firmware = NULL;
507 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
508 NULL, trigger_async_request_cb);
509 if (rc) {
510 pr_info("async load of '%s' failed: %d\n", name, rc);
511 kfree(name);
512 goto out;
513 }
514 /* Free 'name' ASAP, to test for race conditions */
515 kfree(name);
516
517 wait_for_completion(&async_fw_done);
518
519 if (test_firmware) {
520 pr_info("loaded: %zu\n", test_firmware->size);
521 rc = count;
522 } else {
523 pr_err("failed to async load firmware\n");
524 rc = -ENODEV;
525 }
526
527out:
528 mutex_unlock(&test_fw_mutex);
529
530 return rc;
531}
532static DEVICE_ATTR_WO(trigger_async_request);
533
534static ssize_t trigger_custom_fallback_store(struct device *dev,
535 struct device_attribute *attr,
536 const char *buf, size_t count)
537{
538 int rc;
539 char *name;
540
541 name = kstrndup(buf, count, GFP_KERNEL);
542 if (!name)
543 return -ENOSPC;
544
545 pr_info("loading '%s' using custom fallback mechanism\n", name);
546
547 mutex_lock(&test_fw_mutex);
548 release_firmware(test_firmware);
549 test_firmware = NULL;
550 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
551 dev, GFP_KERNEL, NULL,
552 trigger_async_request_cb);
553 if (rc) {
554 pr_info("async load of '%s' failed: %d\n", name, rc);
555 kfree(name);
556 goto out;
557 }
558 /* Free 'name' ASAP, to test for race conditions */
559 kfree(name);
560
561 wait_for_completion(&async_fw_done);
562
563 if (test_firmware) {
564 pr_info("loaded: %zu\n", test_firmware->size);
565 rc = count;
566 } else {
567 pr_err("failed to async load firmware\n");
568 rc = -ENODEV;
569 }
570
571out:
572 mutex_unlock(&test_fw_mutex);
573
574 return rc;
575}
576static DEVICE_ATTR_WO(trigger_custom_fallback);
577
578static int test_fw_run_batch_request(void *data)
579{
580 struct test_batched_req *req = data;
581
582 if (!req) {
583 test_fw_config->test_result = -EINVAL;
584 return -EINVAL;
585 }
586
587 req->rc = test_fw_config->req_firmware(&req->fw, req->name, req->dev);
588 if (req->rc) {
589 pr_info("#%u: batched sync load failed: %d\n",
590 req->idx, req->rc);
591 if (!test_fw_config->test_result)
592 test_fw_config->test_result = req->rc;
593 } else if (req->fw) {
594 req->sent = true;
595 pr_info("#%u: batched sync loaded %zu\n",
596 req->idx, req->fw->size);
597 }
598 complete(&req->completion);
599
600 req->task = NULL;
601
602 return 0;
603}
604
605/*
606 * We use a kthread as otherwise the kernel serializes all our sync requests
607 * and we would not be able to mimic batched requests on a sync call. Batched
608 * requests on a sync call can for instance happen on a device driver when
609 * multiple cards are used and firmware loading happens outside of probe.
610 */
611static ssize_t trigger_batched_requests_store(struct device *dev,
612 struct device_attribute *attr,
613 const char *buf, size_t count)
614{
615 struct test_batched_req *req;
616 int rc;
617 u8 i;
618
619 mutex_lock(&test_fw_mutex);
620
621 test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
622 test_fw_config->num_requests * 2);
623 if (!test_fw_config->reqs) {
624 rc = -ENOMEM;
625 goto out_unlock;
626 }
627
628 pr_info("batched sync firmware loading '%s' %u times\n",
629 test_fw_config->name, test_fw_config->num_requests);
630
631 for (i = 0; i < test_fw_config->num_requests; i++) {
632 req = &test_fw_config->reqs[i];
633 if (!req) {
634 WARN_ON(1);
635 rc = -ENOMEM;
636 goto out_bail;
637 }
638 req->fw = NULL;
639 req->idx = i;
640 req->name = test_fw_config->name;
641 req->dev = dev;
642 init_completion(&req->completion);
643 req->task = kthread_run(test_fw_run_batch_request, req,
644 "%s-%u", KBUILD_MODNAME, req->idx);
645 if (!req->task || IS_ERR(req->task)) {
646 pr_err("Setting up thread %u failed\n", req->idx);
647 req->task = NULL;
648 rc = -ENOMEM;
649 goto out_bail;
650 }
651 }
652
653 rc = count;
654
655 /*
656 * We require an explicit release to enable more time and delay of
657 * calling release_firmware() to improve our chances of forcing a
658 * batched request. If we instead called release_firmware() right away
659 * then we might miss on an opportunity of having a successful firmware
660 * request pass on the opportunity to be come a batched request.
661 */
662
663out_bail:
664 for (i = 0; i < test_fw_config->num_requests; i++) {
665 req = &test_fw_config->reqs[i];
666 if (req->task || req->sent)
667 wait_for_completion(&req->completion);
668 }
669
670 /* Override any worker error if we had a general setup error */
671 if (rc < 0)
672 test_fw_config->test_result = rc;
673
674out_unlock:
675 mutex_unlock(&test_fw_mutex);
676
677 return rc;
678}
679static DEVICE_ATTR_WO(trigger_batched_requests);
680
681/*
682 * We wait for each callback to return with the lock held, no need to lock here
683 */
684static void trigger_batched_cb(const struct firmware *fw, void *context)
685{
686 struct test_batched_req *req = context;
687
688 if (!req) {
689 test_fw_config->test_result = -EINVAL;
690 return;
691 }
692
693 /* forces *some* batched requests to queue up */
694 if (!req->idx)
695 ssleep(2);
696
697 req->fw = fw;
698
699 /*
700 * Unfortunately the firmware API gives us nothing other than a null FW
701 * if the firmware was not found on async requests. Best we can do is
702 * just assume -ENOENT. A better API would pass the actual return
703 * value to the callback.
704 */
705 if (!fw && !test_fw_config->test_result)
706 test_fw_config->test_result = -ENOENT;
707
708 complete(&req->completion);
709}
710
711static
712ssize_t trigger_batched_requests_async_store(struct device *dev,
713 struct device_attribute *attr,
714 const char *buf, size_t count)
715{
716 struct test_batched_req *req;
717 bool send_uevent;
718 int rc;
719 u8 i;
720
721 mutex_lock(&test_fw_mutex);
722
723 test_fw_config->reqs = vzalloc(sizeof(struct test_batched_req) *
724 test_fw_config->num_requests * 2);
725 if (!test_fw_config->reqs) {
726 rc = -ENOMEM;
727 goto out;
728 }
729
730 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
731 test_fw_config->name, test_fw_config->num_requests);
732
733 send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
734 FW_ACTION_NOHOTPLUG;
735
736 for (i = 0; i < test_fw_config->num_requests; i++) {
737 req = &test_fw_config->reqs[i];
738 if (!req) {
739 WARN_ON(1);
740 goto out_bail;
741 }
742 req->name = test_fw_config->name;
743 req->fw = NULL;
744 req->idx = i;
745 init_completion(&req->completion);
746 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
747 req->name,
748 dev, GFP_KERNEL, req,
749 trigger_batched_cb);
750 if (rc) {
751 pr_info("#%u: batched async load failed setup: %d\n",
752 i, rc);
753 req->rc = rc;
754 goto out_bail;
755 } else
756 req->sent = true;
757 }
758
759 rc = count;
760
761out_bail:
762
763 /*
764 * We require an explicit release to enable more time and delay of
765 * calling release_firmware() to improve our chances of forcing a
766 * batched request. If we instead called release_firmware() right away
767 * then we might miss on an opportunity of having a successful firmware
768 * request pass on the opportunity to be come a batched request.
769 */
770
771 for (i = 0; i < test_fw_config->num_requests; i++) {
772 req = &test_fw_config->reqs[i];
773 if (req->sent)
774 wait_for_completion(&req->completion);
775 }
776
777 /* Override any worker error if we had a general setup error */
778 if (rc < 0)
779 test_fw_config->test_result = rc;
780
781out:
782 mutex_unlock(&test_fw_mutex);
783
784 return rc;
785}
786static DEVICE_ATTR_WO(trigger_batched_requests_async);
787
788static ssize_t test_result_show(struct device *dev,
789 struct device_attribute *attr,
790 char *buf)
791{
792 return test_dev_config_show_int(buf, test_fw_config->test_result);
793}
794static DEVICE_ATTR_RO(test_result);
795
796static ssize_t release_all_firmware_store(struct device *dev,
797 struct device_attribute *attr,
798 const char *buf, size_t count)
799{
800 test_release_all_firmware();
801 return count;
802}
803static DEVICE_ATTR_WO(release_all_firmware);
804
805static ssize_t read_firmware_show(struct device *dev,
806 struct device_attribute *attr,
807 char *buf)
808{
809 struct test_batched_req *req;
810 u8 idx;
811 ssize_t rc = 0;
812
813 mutex_lock(&test_fw_mutex);
814
815 idx = test_fw_config->read_fw_idx;
816 if (idx >= test_fw_config->num_requests) {
817 rc = -ERANGE;
818 goto out;
819 }
820
821 if (!test_fw_config->reqs) {
822 rc = -EINVAL;
823 goto out;
824 }
825
826 req = &test_fw_config->reqs[idx];
827 if (!req->fw) {
828 pr_err("#%u: failed to async load firmware\n", idx);
829 rc = -ENOENT;
830 goto out;
831 }
832
833 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
834
835 if (req->fw->size > PAGE_SIZE) {
836 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
837 rc = -EINVAL;
838 }
839 memcpy(buf, req->fw->data, req->fw->size);
840
841 rc = req->fw->size;
842out:
843 mutex_unlock(&test_fw_mutex);
844
845 return rc;
846}
847static DEVICE_ATTR_RO(read_firmware);
848
849#define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
850
851static struct attribute *test_dev_attrs[] = {
852 TEST_FW_DEV_ATTR(reset),
853
854 TEST_FW_DEV_ATTR(config),
855 TEST_FW_DEV_ATTR(config_name),
856 TEST_FW_DEV_ATTR(config_num_requests),
857 TEST_FW_DEV_ATTR(config_sync_direct),
858 TEST_FW_DEV_ATTR(config_send_uevent),
859 TEST_FW_DEV_ATTR(config_read_fw_idx),
860
861 /* These don't use the config at all - they could be ported! */
862 TEST_FW_DEV_ATTR(trigger_request),
863 TEST_FW_DEV_ATTR(trigger_async_request),
864 TEST_FW_DEV_ATTR(trigger_custom_fallback),
865
866 /* These use the config and can use the test_result */
867 TEST_FW_DEV_ATTR(trigger_batched_requests),
868 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
869
870 TEST_FW_DEV_ATTR(release_all_firmware),
871 TEST_FW_DEV_ATTR(test_result),
872 TEST_FW_DEV_ATTR(read_firmware),
873 NULL,
874};
875
876ATTRIBUTE_GROUPS(test_dev);
877
878static struct miscdevice test_fw_misc_device = {
879 .minor = MISC_DYNAMIC_MINOR,
880 .name = "test_firmware",
881 .fops = &test_fw_fops,
882 .groups = test_dev_groups,
883};
884
885static int __init test_firmware_init(void)
886{
887 int rc;
888
889 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
890 if (!test_fw_config)
891 return -ENOMEM;
892
893 rc = __test_firmware_config_init();
894 if (rc)
895 return rc;
896
897 rc = misc_register(&test_fw_misc_device);
898 if (rc) {
899 kfree(test_fw_config);
900 pr_err("could not register misc device: %d\n", rc);
901 return rc;
902 }
903
904 pr_warn("interface ready\n");
905
906 return 0;
907}
908
909module_init(test_firmware_init);
910
911static void __exit test_firmware_exit(void)
912{
913 mutex_lock(&test_fw_mutex);
914 release_firmware(test_firmware);
915 misc_deregister(&test_fw_misc_device);
916 __test_firmware_config_free();
917 kfree(test_fw_config);
918 mutex_unlock(&test_fw_mutex);
919
920 pr_warn("removed interface\n");
921}
922
923module_exit(test_firmware_exit);
924
925MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
926MODULE_LICENSE("GPL");