Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This module provides an interface to trigger and test firmware loading.
4 *
5 * It is designed to be used for basic evaluation of the firmware loading
6 * subsystem (for example when validating firmware verification). It lacks
7 * any extra dependencies, and will not normally be loaded by the system
8 * unless explicitly requested by name.
9 */
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/printk.h>
16#include <linux/completion.h>
17#include <linux/firmware.h>
18#include <linux/device.h>
19#include <linux/fs.h>
20#include <linux/miscdevice.h>
21#include <linux/sizes.h>
22#include <linux/slab.h>
23#include <linux/uaccess.h>
24#include <linux/delay.h>
25#include <linux/kthread.h>
26#include <linux/vmalloc.h>
27#include <linux/efi_embedded_fw.h>
28
29MODULE_IMPORT_NS(TEST_FIRMWARE);
30
31#define TEST_FIRMWARE_NAME "test-firmware.bin"
32#define TEST_FIRMWARE_NUM_REQS 4
33#define TEST_FIRMWARE_BUF_SIZE SZ_1K
34
35static DEFINE_MUTEX(test_fw_mutex);
36static const struct firmware *test_firmware;
37
38struct test_batched_req {
39 u8 idx;
40 int rc;
41 bool sent;
42 const struct firmware *fw;
43 const char *name;
44 struct completion completion;
45 struct task_struct *task;
46 struct device *dev;
47};
48
49/**
50 * test_config - represents configuration for the test for different triggers
51 *
52 * @name: the name of the firmware file to look for
53 * @into_buf: when the into_buf is used if this is true
54 * request_firmware_into_buf() will be used instead.
55 * @buf_size: size of buf to allocate when into_buf is true
56 * @file_offset: file offset to request when calling request_firmware_into_buf
57 * @partial: partial read opt when calling request_firmware_into_buf
58 * @sync_direct: when the sync trigger is used if this is true
59 * request_firmware_direct() will be used instead.
60 * @send_uevent: whether or not to send a uevent for async requests
61 * @num_requests: number of requests to try per test case. This is trigger
62 * specific.
63 * @reqs: stores all requests information
64 * @read_fw_idx: index of thread from which we want to read firmware results
65 * from through the read_fw trigger.
66 * @test_result: a test may use this to collect the result from the call
67 * of the request_firmware*() calls used in their tests. In order of
68 * priority we always keep first any setup error. If no setup errors were
69 * found then we move on to the first error encountered while running the
70 * API. Note that for async calls this typically will be a successful
71 * result (0) unless of course you've used bogus parameters, or the system
72 * is out of memory. In the async case the callback is expected to do a
73 * bit more homework to figure out what happened, unfortunately the only
74 * information passed today on error is the fact that no firmware was
75 * found so we can only assume -ENOENT on async calls if the firmware is
76 * NULL.
77 *
78 * Errors you can expect:
79 *
80 * API specific:
81 *
82 * 0: success for sync, for async it means request was sent
83 * -EINVAL: invalid parameters or request
84 * -ENOENT: files not found
85 *
86 * System environment:
87 *
88 * -ENOMEM: memory pressure on system
89 * -ENODEV: out of number of devices to test
90 * -EINVAL: an unexpected error has occurred
91 * @req_firmware: if @sync_direct is true this is set to
92 * request_firmware_direct(), otherwise request_firmware()
93 */
94struct test_config {
95 char *name;
96 bool into_buf;
97 size_t buf_size;
98 size_t file_offset;
99 bool partial;
100 bool sync_direct;
101 bool send_uevent;
102 u8 num_requests;
103 u8 read_fw_idx;
104
105 /*
106 * These below don't belong her but we'll move them once we create
107 * a struct fw_test_device and stuff the misc_dev under there later.
108 */
109 struct test_batched_req *reqs;
110 int test_result;
111 int (*req_firmware)(const struct firmware **fw, const char *name,
112 struct device *device);
113};
114
115static struct test_config *test_fw_config;
116
117static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
118 size_t size, loff_t *offset)
119{
120 ssize_t rc = 0;
121
122 mutex_lock(&test_fw_mutex);
123 if (test_firmware)
124 rc = simple_read_from_buffer(buf, size, offset,
125 test_firmware->data,
126 test_firmware->size);
127 mutex_unlock(&test_fw_mutex);
128 return rc;
129}
130
131static const struct file_operations test_fw_fops = {
132 .owner = THIS_MODULE,
133 .read = test_fw_misc_read,
134};
135
136static void __test_release_all_firmware(void)
137{
138 struct test_batched_req *req;
139 u8 i;
140
141 if (!test_fw_config->reqs)
142 return;
143
144 for (i = 0; i < test_fw_config->num_requests; i++) {
145 req = &test_fw_config->reqs[i];
146 if (req->fw)
147 release_firmware(req->fw);
148 }
149
150 vfree(test_fw_config->reqs);
151 test_fw_config->reqs = NULL;
152}
153
154static void test_release_all_firmware(void)
155{
156 mutex_lock(&test_fw_mutex);
157 __test_release_all_firmware();
158 mutex_unlock(&test_fw_mutex);
159}
160
161
162static void __test_firmware_config_free(void)
163{
164 __test_release_all_firmware();
165 kfree_const(test_fw_config->name);
166 test_fw_config->name = NULL;
167}
168
169/*
170 * XXX: move to kstrncpy() once merged.
171 *
172 * Users should use kfree_const() when freeing these.
173 */
174static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
175{
176 *dst = kstrndup(name, count, gfp);
177 if (!*dst)
178 return -ENOSPC;
179 return count;
180}
181
182static int __test_firmware_config_init(void)
183{
184 int ret;
185
186 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
187 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
188 if (ret < 0)
189 goto out;
190
191 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
192 test_fw_config->send_uevent = true;
193 test_fw_config->into_buf = false;
194 test_fw_config->buf_size = TEST_FIRMWARE_BUF_SIZE;
195 test_fw_config->file_offset = 0;
196 test_fw_config->partial = false;
197 test_fw_config->sync_direct = false;
198 test_fw_config->req_firmware = request_firmware;
199 test_fw_config->test_result = 0;
200 test_fw_config->reqs = NULL;
201
202 return 0;
203
204out:
205 __test_firmware_config_free();
206 return ret;
207}
208
209static ssize_t reset_store(struct device *dev,
210 struct device_attribute *attr,
211 const char *buf, size_t count)
212{
213 int ret;
214
215 mutex_lock(&test_fw_mutex);
216
217 __test_firmware_config_free();
218
219 ret = __test_firmware_config_init();
220 if (ret < 0) {
221 ret = -ENOMEM;
222 pr_err("could not alloc settings for config trigger: %d\n",
223 ret);
224 goto out;
225 }
226
227 pr_info("reset\n");
228 ret = count;
229
230out:
231 mutex_unlock(&test_fw_mutex);
232
233 return ret;
234}
235static DEVICE_ATTR_WO(reset);
236
237static ssize_t config_show(struct device *dev,
238 struct device_attribute *attr,
239 char *buf)
240{
241 int len = 0;
242
243 mutex_lock(&test_fw_mutex);
244
245 len += scnprintf(buf, PAGE_SIZE - len,
246 "Custom trigger configuration for: %s\n",
247 dev_name(dev));
248
249 if (test_fw_config->name)
250 len += scnprintf(buf + len, PAGE_SIZE - len,
251 "name:\t%s\n",
252 test_fw_config->name);
253 else
254 len += scnprintf(buf + len, PAGE_SIZE - len,
255 "name:\tEMTPY\n");
256
257 len += scnprintf(buf + len, PAGE_SIZE - len,
258 "num_requests:\t%u\n", test_fw_config->num_requests);
259
260 len += scnprintf(buf + len, PAGE_SIZE - len,
261 "send_uevent:\t\t%s\n",
262 test_fw_config->send_uevent ?
263 "FW_ACTION_UEVENT" :
264 "FW_ACTION_NOUEVENT");
265 len += scnprintf(buf + len, PAGE_SIZE - len,
266 "into_buf:\t\t%s\n",
267 test_fw_config->into_buf ? "true" : "false");
268 len += scnprintf(buf + len, PAGE_SIZE - len,
269 "buf_size:\t%zu\n", test_fw_config->buf_size);
270 len += scnprintf(buf + len, PAGE_SIZE - len,
271 "file_offset:\t%zu\n", test_fw_config->file_offset);
272 len += scnprintf(buf + len, PAGE_SIZE - len,
273 "partial:\t\t%s\n",
274 test_fw_config->partial ? "true" : "false");
275 len += scnprintf(buf + len, PAGE_SIZE - len,
276 "sync_direct:\t\t%s\n",
277 test_fw_config->sync_direct ? "true" : "false");
278 len += scnprintf(buf + len, PAGE_SIZE - len,
279 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
280
281 mutex_unlock(&test_fw_mutex);
282
283 return len;
284}
285static DEVICE_ATTR_RO(config);
286
287static ssize_t config_name_store(struct device *dev,
288 struct device_attribute *attr,
289 const char *buf, size_t count)
290{
291 int ret;
292
293 mutex_lock(&test_fw_mutex);
294 kfree_const(test_fw_config->name);
295 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
296 mutex_unlock(&test_fw_mutex);
297
298 return ret;
299}
300
301/*
302 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
303 */
304static ssize_t config_test_show_str(char *dst,
305 char *src)
306{
307 int len;
308
309 mutex_lock(&test_fw_mutex);
310 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
311 mutex_unlock(&test_fw_mutex);
312
313 return len;
314}
315
316static int test_dev_config_update_bool(const char *buf, size_t size,
317 bool *cfg)
318{
319 int ret;
320
321 mutex_lock(&test_fw_mutex);
322 if (strtobool(buf, cfg) < 0)
323 ret = -EINVAL;
324 else
325 ret = size;
326 mutex_unlock(&test_fw_mutex);
327
328 return ret;
329}
330
331static ssize_t test_dev_config_show_bool(char *buf, bool val)
332{
333 return snprintf(buf, PAGE_SIZE, "%d\n", val);
334}
335
336static int test_dev_config_update_size_t(const char *buf,
337 size_t size,
338 size_t *cfg)
339{
340 int ret;
341 long new;
342
343 ret = kstrtol(buf, 10, &new);
344 if (ret)
345 return ret;
346
347 mutex_lock(&test_fw_mutex);
348 *(size_t *)cfg = new;
349 mutex_unlock(&test_fw_mutex);
350
351 /* Always return full write size even if we didn't consume all */
352 return size;
353}
354
355static ssize_t test_dev_config_show_size_t(char *buf, size_t val)
356{
357 return snprintf(buf, PAGE_SIZE, "%zu\n", val);
358}
359
360static ssize_t test_dev_config_show_int(char *buf, int val)
361{
362 return snprintf(buf, PAGE_SIZE, "%d\n", val);
363}
364
365static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
366{
367 u8 val;
368 int ret;
369
370 ret = kstrtou8(buf, 10, &val);
371 if (ret)
372 return ret;
373
374 mutex_lock(&test_fw_mutex);
375 *(u8 *)cfg = val;
376 mutex_unlock(&test_fw_mutex);
377
378 /* Always return full write size even if we didn't consume all */
379 return size;
380}
381
382static ssize_t test_dev_config_show_u8(char *buf, u8 val)
383{
384 return snprintf(buf, PAGE_SIZE, "%u\n", val);
385}
386
387static ssize_t config_name_show(struct device *dev,
388 struct device_attribute *attr,
389 char *buf)
390{
391 return config_test_show_str(buf, test_fw_config->name);
392}
393static DEVICE_ATTR_RW(config_name);
394
395static ssize_t config_num_requests_store(struct device *dev,
396 struct device_attribute *attr,
397 const char *buf, size_t count)
398{
399 int rc;
400
401 mutex_lock(&test_fw_mutex);
402 if (test_fw_config->reqs) {
403 pr_err("Must call release_all_firmware prior to changing config\n");
404 rc = -EINVAL;
405 mutex_unlock(&test_fw_mutex);
406 goto out;
407 }
408 mutex_unlock(&test_fw_mutex);
409
410 rc = test_dev_config_update_u8(buf, count,
411 &test_fw_config->num_requests);
412
413out:
414 return rc;
415}
416
417static ssize_t config_num_requests_show(struct device *dev,
418 struct device_attribute *attr,
419 char *buf)
420{
421 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
422}
423static DEVICE_ATTR_RW(config_num_requests);
424
425static ssize_t config_into_buf_store(struct device *dev,
426 struct device_attribute *attr,
427 const char *buf, size_t count)
428{
429 return test_dev_config_update_bool(buf,
430 count,
431 &test_fw_config->into_buf);
432}
433
434static ssize_t config_into_buf_show(struct device *dev,
435 struct device_attribute *attr,
436 char *buf)
437{
438 return test_dev_config_show_bool(buf, test_fw_config->into_buf);
439}
440static DEVICE_ATTR_RW(config_into_buf);
441
442static ssize_t config_buf_size_store(struct device *dev,
443 struct device_attribute *attr,
444 const char *buf, size_t count)
445{
446 int rc;
447
448 mutex_lock(&test_fw_mutex);
449 if (test_fw_config->reqs) {
450 pr_err("Must call release_all_firmware prior to changing config\n");
451 rc = -EINVAL;
452 mutex_unlock(&test_fw_mutex);
453 goto out;
454 }
455 mutex_unlock(&test_fw_mutex);
456
457 rc = test_dev_config_update_size_t(buf, count,
458 &test_fw_config->buf_size);
459
460out:
461 return rc;
462}
463
464static ssize_t config_buf_size_show(struct device *dev,
465 struct device_attribute *attr,
466 char *buf)
467{
468 return test_dev_config_show_size_t(buf, test_fw_config->buf_size);
469}
470static DEVICE_ATTR_RW(config_buf_size);
471
472static ssize_t config_file_offset_store(struct device *dev,
473 struct device_attribute *attr,
474 const char *buf, size_t count)
475{
476 int rc;
477
478 mutex_lock(&test_fw_mutex);
479 if (test_fw_config->reqs) {
480 pr_err("Must call release_all_firmware prior to changing config\n");
481 rc = -EINVAL;
482 mutex_unlock(&test_fw_mutex);
483 goto out;
484 }
485 mutex_unlock(&test_fw_mutex);
486
487 rc = test_dev_config_update_size_t(buf, count,
488 &test_fw_config->file_offset);
489
490out:
491 return rc;
492}
493
494static ssize_t config_file_offset_show(struct device *dev,
495 struct device_attribute *attr,
496 char *buf)
497{
498 return test_dev_config_show_size_t(buf, test_fw_config->file_offset);
499}
500static DEVICE_ATTR_RW(config_file_offset);
501
502static ssize_t config_partial_store(struct device *dev,
503 struct device_attribute *attr,
504 const char *buf, size_t count)
505{
506 return test_dev_config_update_bool(buf,
507 count,
508 &test_fw_config->partial);
509}
510
511static ssize_t config_partial_show(struct device *dev,
512 struct device_attribute *attr,
513 char *buf)
514{
515 return test_dev_config_show_bool(buf, test_fw_config->partial);
516}
517static DEVICE_ATTR_RW(config_partial);
518
519static ssize_t config_sync_direct_store(struct device *dev,
520 struct device_attribute *attr,
521 const char *buf, size_t count)
522{
523 int rc = test_dev_config_update_bool(buf, count,
524 &test_fw_config->sync_direct);
525
526 if (rc == count)
527 test_fw_config->req_firmware = test_fw_config->sync_direct ?
528 request_firmware_direct :
529 request_firmware;
530 return rc;
531}
532
533static ssize_t config_sync_direct_show(struct device *dev,
534 struct device_attribute *attr,
535 char *buf)
536{
537 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
538}
539static DEVICE_ATTR_RW(config_sync_direct);
540
541static ssize_t config_send_uevent_store(struct device *dev,
542 struct device_attribute *attr,
543 const char *buf, size_t count)
544{
545 return test_dev_config_update_bool(buf, count,
546 &test_fw_config->send_uevent);
547}
548
549static ssize_t config_send_uevent_show(struct device *dev,
550 struct device_attribute *attr,
551 char *buf)
552{
553 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
554}
555static DEVICE_ATTR_RW(config_send_uevent);
556
557static ssize_t config_read_fw_idx_store(struct device *dev,
558 struct device_attribute *attr,
559 const char *buf, size_t count)
560{
561 return test_dev_config_update_u8(buf, count,
562 &test_fw_config->read_fw_idx);
563}
564
565static ssize_t config_read_fw_idx_show(struct device *dev,
566 struct device_attribute *attr,
567 char *buf)
568{
569 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
570}
571static DEVICE_ATTR_RW(config_read_fw_idx);
572
573
574static ssize_t trigger_request_store(struct device *dev,
575 struct device_attribute *attr,
576 const char *buf, size_t count)
577{
578 int rc;
579 char *name;
580
581 name = kstrndup(buf, count, GFP_KERNEL);
582 if (!name)
583 return -ENOSPC;
584
585 pr_info("loading '%s'\n", name);
586
587 mutex_lock(&test_fw_mutex);
588 release_firmware(test_firmware);
589 test_firmware = NULL;
590 rc = request_firmware(&test_firmware, name, dev);
591 if (rc) {
592 pr_info("load of '%s' failed: %d\n", name, rc);
593 goto out;
594 }
595 pr_info("loaded: %zu\n", test_firmware->size);
596 rc = count;
597
598out:
599 mutex_unlock(&test_fw_mutex);
600
601 kfree(name);
602
603 return rc;
604}
605static DEVICE_ATTR_WO(trigger_request);
606
607#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
608extern struct list_head efi_embedded_fw_list;
609extern bool efi_embedded_fw_checked;
610
611static ssize_t trigger_request_platform_store(struct device *dev,
612 struct device_attribute *attr,
613 const char *buf, size_t count)
614{
615 static const u8 test_data[] = {
616 0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
617 0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
618 0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
619 0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
620 };
621 struct efi_embedded_fw efi_embedded_fw;
622 const struct firmware *firmware = NULL;
623 bool saved_efi_embedded_fw_checked;
624 char *name;
625 int rc;
626
627 name = kstrndup(buf, count, GFP_KERNEL);
628 if (!name)
629 return -ENOSPC;
630
631 pr_info("inserting test platform fw '%s'\n", name);
632 efi_embedded_fw.name = name;
633 efi_embedded_fw.data = (void *)test_data;
634 efi_embedded_fw.length = sizeof(test_data);
635 list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
636 saved_efi_embedded_fw_checked = efi_embedded_fw_checked;
637 efi_embedded_fw_checked = true;
638
639 pr_info("loading '%s'\n", name);
640 rc = firmware_request_platform(&firmware, name, dev);
641 if (rc) {
642 pr_info("load of '%s' failed: %d\n", name, rc);
643 goto out;
644 }
645 if (firmware->size != sizeof(test_data) ||
646 memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
647 pr_info("firmware contents mismatch for '%s'\n", name);
648 rc = -EINVAL;
649 goto out;
650 }
651 pr_info("loaded: %zu\n", firmware->size);
652 rc = count;
653
654out:
655 efi_embedded_fw_checked = saved_efi_embedded_fw_checked;
656 release_firmware(firmware);
657 list_del(&efi_embedded_fw.list);
658 kfree(name);
659
660 return rc;
661}
662static DEVICE_ATTR_WO(trigger_request_platform);
663#endif
664
665static DECLARE_COMPLETION(async_fw_done);
666
667static void trigger_async_request_cb(const struct firmware *fw, void *context)
668{
669 test_firmware = fw;
670 complete(&async_fw_done);
671}
672
673static ssize_t trigger_async_request_store(struct device *dev,
674 struct device_attribute *attr,
675 const char *buf, size_t count)
676{
677 int rc;
678 char *name;
679
680 name = kstrndup(buf, count, GFP_KERNEL);
681 if (!name)
682 return -ENOSPC;
683
684 pr_info("loading '%s'\n", name);
685
686 mutex_lock(&test_fw_mutex);
687 release_firmware(test_firmware);
688 test_firmware = NULL;
689 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
690 NULL, trigger_async_request_cb);
691 if (rc) {
692 pr_info("async load of '%s' failed: %d\n", name, rc);
693 kfree(name);
694 goto out;
695 }
696 /* Free 'name' ASAP, to test for race conditions */
697 kfree(name);
698
699 wait_for_completion(&async_fw_done);
700
701 if (test_firmware) {
702 pr_info("loaded: %zu\n", test_firmware->size);
703 rc = count;
704 } else {
705 pr_err("failed to async load firmware\n");
706 rc = -ENOMEM;
707 }
708
709out:
710 mutex_unlock(&test_fw_mutex);
711
712 return rc;
713}
714static DEVICE_ATTR_WO(trigger_async_request);
715
716static ssize_t trigger_custom_fallback_store(struct device *dev,
717 struct device_attribute *attr,
718 const char *buf, size_t count)
719{
720 int rc;
721 char *name;
722
723 name = kstrndup(buf, count, GFP_KERNEL);
724 if (!name)
725 return -ENOSPC;
726
727 pr_info("loading '%s' using custom fallback mechanism\n", name);
728
729 mutex_lock(&test_fw_mutex);
730 release_firmware(test_firmware);
731 test_firmware = NULL;
732 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOUEVENT, name,
733 dev, GFP_KERNEL, NULL,
734 trigger_async_request_cb);
735 if (rc) {
736 pr_info("async load of '%s' failed: %d\n", name, rc);
737 kfree(name);
738 goto out;
739 }
740 /* Free 'name' ASAP, to test for race conditions */
741 kfree(name);
742
743 wait_for_completion(&async_fw_done);
744
745 if (test_firmware) {
746 pr_info("loaded: %zu\n", test_firmware->size);
747 rc = count;
748 } else {
749 pr_err("failed to async load firmware\n");
750 rc = -ENODEV;
751 }
752
753out:
754 mutex_unlock(&test_fw_mutex);
755
756 return rc;
757}
758static DEVICE_ATTR_WO(trigger_custom_fallback);
759
760static int test_fw_run_batch_request(void *data)
761{
762 struct test_batched_req *req = data;
763
764 if (!req) {
765 test_fw_config->test_result = -EINVAL;
766 return -EINVAL;
767 }
768
769 if (test_fw_config->into_buf) {
770 void *test_buf;
771
772 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
773 if (!test_buf)
774 return -ENOSPC;
775
776 if (test_fw_config->partial)
777 req->rc = request_partial_firmware_into_buf
778 (&req->fw,
779 req->name,
780 req->dev,
781 test_buf,
782 test_fw_config->buf_size,
783 test_fw_config->file_offset);
784 else
785 req->rc = request_firmware_into_buf
786 (&req->fw,
787 req->name,
788 req->dev,
789 test_buf,
790 test_fw_config->buf_size);
791 if (!req->fw)
792 kfree(test_buf);
793 } else {
794 req->rc = test_fw_config->req_firmware(&req->fw,
795 req->name,
796 req->dev);
797 }
798
799 if (req->rc) {
800 pr_info("#%u: batched sync load failed: %d\n",
801 req->idx, req->rc);
802 if (!test_fw_config->test_result)
803 test_fw_config->test_result = req->rc;
804 } else if (req->fw) {
805 req->sent = true;
806 pr_info("#%u: batched sync loaded %zu\n",
807 req->idx, req->fw->size);
808 }
809 complete(&req->completion);
810
811 req->task = NULL;
812
813 return 0;
814}
815
816/*
817 * We use a kthread as otherwise the kernel serializes all our sync requests
818 * and we would not be able to mimic batched requests on a sync call. Batched
819 * requests on a sync call can for instance happen on a device driver when
820 * multiple cards are used and firmware loading happens outside of probe.
821 */
822static ssize_t trigger_batched_requests_store(struct device *dev,
823 struct device_attribute *attr,
824 const char *buf, size_t count)
825{
826 struct test_batched_req *req;
827 int rc;
828 u8 i;
829
830 mutex_lock(&test_fw_mutex);
831
832 test_fw_config->reqs =
833 vzalloc(array3_size(sizeof(struct test_batched_req),
834 test_fw_config->num_requests, 2));
835 if (!test_fw_config->reqs) {
836 rc = -ENOMEM;
837 goto out_unlock;
838 }
839
840 pr_info("batched sync firmware loading '%s' %u times\n",
841 test_fw_config->name, test_fw_config->num_requests);
842
843 for (i = 0; i < test_fw_config->num_requests; i++) {
844 req = &test_fw_config->reqs[i];
845 req->fw = NULL;
846 req->idx = i;
847 req->name = test_fw_config->name;
848 req->dev = dev;
849 init_completion(&req->completion);
850 req->task = kthread_run(test_fw_run_batch_request, req,
851 "%s-%u", KBUILD_MODNAME, req->idx);
852 if (!req->task || IS_ERR(req->task)) {
853 pr_err("Setting up thread %u failed\n", req->idx);
854 req->task = NULL;
855 rc = -ENOMEM;
856 goto out_bail;
857 }
858 }
859
860 rc = count;
861
862 /*
863 * We require an explicit release to enable more time and delay of
864 * calling release_firmware() to improve our chances of forcing a
865 * batched request. If we instead called release_firmware() right away
866 * then we might miss on an opportunity of having a successful firmware
867 * request pass on the opportunity to be come a batched request.
868 */
869
870out_bail:
871 for (i = 0; i < test_fw_config->num_requests; i++) {
872 req = &test_fw_config->reqs[i];
873 if (req->task || req->sent)
874 wait_for_completion(&req->completion);
875 }
876
877 /* Override any worker error if we had a general setup error */
878 if (rc < 0)
879 test_fw_config->test_result = rc;
880
881out_unlock:
882 mutex_unlock(&test_fw_mutex);
883
884 return rc;
885}
886static DEVICE_ATTR_WO(trigger_batched_requests);
887
888/*
889 * We wait for each callback to return with the lock held, no need to lock here
890 */
891static void trigger_batched_cb(const struct firmware *fw, void *context)
892{
893 struct test_batched_req *req = context;
894
895 if (!req) {
896 test_fw_config->test_result = -EINVAL;
897 return;
898 }
899
900 /* forces *some* batched requests to queue up */
901 if (!req->idx)
902 ssleep(2);
903
904 req->fw = fw;
905
906 /*
907 * Unfortunately the firmware API gives us nothing other than a null FW
908 * if the firmware was not found on async requests. Best we can do is
909 * just assume -ENOENT. A better API would pass the actual return
910 * value to the callback.
911 */
912 if (!fw && !test_fw_config->test_result)
913 test_fw_config->test_result = -ENOENT;
914
915 complete(&req->completion);
916}
917
918static
919ssize_t trigger_batched_requests_async_store(struct device *dev,
920 struct device_attribute *attr,
921 const char *buf, size_t count)
922{
923 struct test_batched_req *req;
924 bool send_uevent;
925 int rc;
926 u8 i;
927
928 mutex_lock(&test_fw_mutex);
929
930 test_fw_config->reqs =
931 vzalloc(array3_size(sizeof(struct test_batched_req),
932 test_fw_config->num_requests, 2));
933 if (!test_fw_config->reqs) {
934 rc = -ENOMEM;
935 goto out;
936 }
937
938 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
939 test_fw_config->name, test_fw_config->num_requests);
940
941 send_uevent = test_fw_config->send_uevent ? FW_ACTION_UEVENT :
942 FW_ACTION_NOUEVENT;
943
944 for (i = 0; i < test_fw_config->num_requests; i++) {
945 req = &test_fw_config->reqs[i];
946 req->name = test_fw_config->name;
947 req->fw = NULL;
948 req->idx = i;
949 init_completion(&req->completion);
950 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
951 req->name,
952 dev, GFP_KERNEL, req,
953 trigger_batched_cb);
954 if (rc) {
955 pr_info("#%u: batched async load failed setup: %d\n",
956 i, rc);
957 req->rc = rc;
958 goto out_bail;
959 } else
960 req->sent = true;
961 }
962
963 rc = count;
964
965out_bail:
966
967 /*
968 * We require an explicit release to enable more time and delay of
969 * calling release_firmware() to improve our chances of forcing a
970 * batched request. If we instead called release_firmware() right away
971 * then we might miss on an opportunity of having a successful firmware
972 * request pass on the opportunity to be come a batched request.
973 */
974
975 for (i = 0; i < test_fw_config->num_requests; i++) {
976 req = &test_fw_config->reqs[i];
977 if (req->sent)
978 wait_for_completion(&req->completion);
979 }
980
981 /* Override any worker error if we had a general setup error */
982 if (rc < 0)
983 test_fw_config->test_result = rc;
984
985out:
986 mutex_unlock(&test_fw_mutex);
987
988 return rc;
989}
990static DEVICE_ATTR_WO(trigger_batched_requests_async);
991
992static ssize_t test_result_show(struct device *dev,
993 struct device_attribute *attr,
994 char *buf)
995{
996 return test_dev_config_show_int(buf, test_fw_config->test_result);
997}
998static DEVICE_ATTR_RO(test_result);
999
1000static ssize_t release_all_firmware_store(struct device *dev,
1001 struct device_attribute *attr,
1002 const char *buf, size_t count)
1003{
1004 test_release_all_firmware();
1005 return count;
1006}
1007static DEVICE_ATTR_WO(release_all_firmware);
1008
1009static ssize_t read_firmware_show(struct device *dev,
1010 struct device_attribute *attr,
1011 char *buf)
1012{
1013 struct test_batched_req *req;
1014 u8 idx;
1015 ssize_t rc = 0;
1016
1017 mutex_lock(&test_fw_mutex);
1018
1019 idx = test_fw_config->read_fw_idx;
1020 if (idx >= test_fw_config->num_requests) {
1021 rc = -ERANGE;
1022 goto out;
1023 }
1024
1025 if (!test_fw_config->reqs) {
1026 rc = -EINVAL;
1027 goto out;
1028 }
1029
1030 req = &test_fw_config->reqs[idx];
1031 if (!req->fw) {
1032 pr_err("#%u: failed to async load firmware\n", idx);
1033 rc = -ENOENT;
1034 goto out;
1035 }
1036
1037 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
1038
1039 if (req->fw->size > PAGE_SIZE) {
1040 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
1041 rc = -EINVAL;
1042 goto out;
1043 }
1044 memcpy(buf, req->fw->data, req->fw->size);
1045
1046 rc = req->fw->size;
1047out:
1048 mutex_unlock(&test_fw_mutex);
1049
1050 return rc;
1051}
1052static DEVICE_ATTR_RO(read_firmware);
1053
1054#define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
1055
1056static struct attribute *test_dev_attrs[] = {
1057 TEST_FW_DEV_ATTR(reset),
1058
1059 TEST_FW_DEV_ATTR(config),
1060 TEST_FW_DEV_ATTR(config_name),
1061 TEST_FW_DEV_ATTR(config_num_requests),
1062 TEST_FW_DEV_ATTR(config_into_buf),
1063 TEST_FW_DEV_ATTR(config_buf_size),
1064 TEST_FW_DEV_ATTR(config_file_offset),
1065 TEST_FW_DEV_ATTR(config_partial),
1066 TEST_FW_DEV_ATTR(config_sync_direct),
1067 TEST_FW_DEV_ATTR(config_send_uevent),
1068 TEST_FW_DEV_ATTR(config_read_fw_idx),
1069
1070 /* These don't use the config at all - they could be ported! */
1071 TEST_FW_DEV_ATTR(trigger_request),
1072 TEST_FW_DEV_ATTR(trigger_async_request),
1073 TEST_FW_DEV_ATTR(trigger_custom_fallback),
1074#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
1075 TEST_FW_DEV_ATTR(trigger_request_platform),
1076#endif
1077
1078 /* These use the config and can use the test_result */
1079 TEST_FW_DEV_ATTR(trigger_batched_requests),
1080 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
1081
1082 TEST_FW_DEV_ATTR(release_all_firmware),
1083 TEST_FW_DEV_ATTR(test_result),
1084 TEST_FW_DEV_ATTR(read_firmware),
1085 NULL,
1086};
1087
1088ATTRIBUTE_GROUPS(test_dev);
1089
1090static struct miscdevice test_fw_misc_device = {
1091 .minor = MISC_DYNAMIC_MINOR,
1092 .name = "test_firmware",
1093 .fops = &test_fw_fops,
1094 .groups = test_dev_groups,
1095};
1096
1097static int __init test_firmware_init(void)
1098{
1099 int rc;
1100
1101 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
1102 if (!test_fw_config)
1103 return -ENOMEM;
1104
1105 rc = __test_firmware_config_init();
1106 if (rc) {
1107 kfree(test_fw_config);
1108 pr_err("could not init firmware test config: %d\n", rc);
1109 return rc;
1110 }
1111
1112 rc = misc_register(&test_fw_misc_device);
1113 if (rc) {
1114 kfree(test_fw_config);
1115 pr_err("could not register misc device: %d\n", rc);
1116 return rc;
1117 }
1118
1119 pr_warn("interface ready\n");
1120
1121 return 0;
1122}
1123
1124module_init(test_firmware_init);
1125
1126static void __exit test_firmware_exit(void)
1127{
1128 mutex_lock(&test_fw_mutex);
1129 release_firmware(test_firmware);
1130 misc_deregister(&test_fw_misc_device);
1131 __test_firmware_config_free();
1132 kfree(test_fw_config);
1133 mutex_unlock(&test_fw_mutex);
1134
1135 pr_warn("removed interface\n");
1136}
1137
1138module_exit(test_firmware_exit);
1139
1140MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1141MODULE_LICENSE("GPL");
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This module provides an interface to trigger and test firmware loading.
4 *
5 * It is designed to be used for basic evaluation of the firmware loading
6 * subsystem (for example when validating firmware verification). It lacks
7 * any extra dependencies, and will not normally be loaded by the system
8 * unless explicitly requested by name.
9 */
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/printk.h>
16#include <linux/completion.h>
17#include <linux/firmware.h>
18#include <linux/device.h>
19#include <linux/fs.h>
20#include <linux/miscdevice.h>
21#include <linux/sizes.h>
22#include <linux/slab.h>
23#include <linux/uaccess.h>
24#include <linux/delay.h>
25#include <linux/kthread.h>
26#include <linux/vmalloc.h>
27#include <linux/efi_embedded_fw.h>
28
29MODULE_IMPORT_NS(TEST_FIRMWARE);
30
31#define TEST_FIRMWARE_NAME "test-firmware.bin"
32#define TEST_FIRMWARE_NUM_REQS 4
33#define TEST_FIRMWARE_BUF_SIZE SZ_1K
34
35static DEFINE_MUTEX(test_fw_mutex);
36static const struct firmware *test_firmware;
37
38struct test_batched_req {
39 u8 idx;
40 int rc;
41 bool sent;
42 const struct firmware *fw;
43 const char *name;
44 struct completion completion;
45 struct task_struct *task;
46 struct device *dev;
47};
48
49/**
50 * test_config - represents configuration for the test for different triggers
51 *
52 * @name: the name of the firmware file to look for
53 * @into_buf: when the into_buf is used if this is true
54 * request_firmware_into_buf() will be used instead.
55 * @sync_direct: when the sync trigger is used if this is true
56 * request_firmware_direct() will be used instead.
57 * @send_uevent: whether or not to send a uevent for async requests
58 * @num_requests: number of requests to try per test case. This is trigger
59 * specific.
60 * @reqs: stores all requests information
61 * @read_fw_idx: index of thread from which we want to read firmware results
62 * from through the read_fw trigger.
63 * @test_result: a test may use this to collect the result from the call
64 * of the request_firmware*() calls used in their tests. In order of
65 * priority we always keep first any setup error. If no setup errors were
66 * found then we move on to the first error encountered while running the
67 * API. Note that for async calls this typically will be a successful
68 * result (0) unless of course you've used bogus parameters, or the system
69 * is out of memory. In the async case the callback is expected to do a
70 * bit more homework to figure out what happened, unfortunately the only
71 * information passed today on error is the fact that no firmware was
72 * found so we can only assume -ENOENT on async calls if the firmware is
73 * NULL.
74 *
75 * Errors you can expect:
76 *
77 * API specific:
78 *
79 * 0: success for sync, for async it means request was sent
80 * -EINVAL: invalid parameters or request
81 * -ENOENT: files not found
82 *
83 * System environment:
84 *
85 * -ENOMEM: memory pressure on system
86 * -ENODEV: out of number of devices to test
87 * -EINVAL: an unexpected error has occurred
88 * @req_firmware: if @sync_direct is true this is set to
89 * request_firmware_direct(), otherwise request_firmware()
90 */
91struct test_config {
92 char *name;
93 bool into_buf;
94 bool sync_direct;
95 bool send_uevent;
96 u8 num_requests;
97 u8 read_fw_idx;
98
99 /*
100 * These below don't belong her but we'll move them once we create
101 * a struct fw_test_device and stuff the misc_dev under there later.
102 */
103 struct test_batched_req *reqs;
104 int test_result;
105 int (*req_firmware)(const struct firmware **fw, const char *name,
106 struct device *device);
107};
108
109static struct test_config *test_fw_config;
110
111static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
112 size_t size, loff_t *offset)
113{
114 ssize_t rc = 0;
115
116 mutex_lock(&test_fw_mutex);
117 if (test_firmware)
118 rc = simple_read_from_buffer(buf, size, offset,
119 test_firmware->data,
120 test_firmware->size);
121 mutex_unlock(&test_fw_mutex);
122 return rc;
123}
124
125static const struct file_operations test_fw_fops = {
126 .owner = THIS_MODULE,
127 .read = test_fw_misc_read,
128};
129
130static void __test_release_all_firmware(void)
131{
132 struct test_batched_req *req;
133 u8 i;
134
135 if (!test_fw_config->reqs)
136 return;
137
138 for (i = 0; i < test_fw_config->num_requests; i++) {
139 req = &test_fw_config->reqs[i];
140 if (req->fw)
141 release_firmware(req->fw);
142 }
143
144 vfree(test_fw_config->reqs);
145 test_fw_config->reqs = NULL;
146}
147
148static void test_release_all_firmware(void)
149{
150 mutex_lock(&test_fw_mutex);
151 __test_release_all_firmware();
152 mutex_unlock(&test_fw_mutex);
153}
154
155
156static void __test_firmware_config_free(void)
157{
158 __test_release_all_firmware();
159 kfree_const(test_fw_config->name);
160 test_fw_config->name = NULL;
161}
162
163/*
164 * XXX: move to kstrncpy() once merged.
165 *
166 * Users should use kfree_const() when freeing these.
167 */
168static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
169{
170 *dst = kstrndup(name, count, gfp);
171 if (!*dst)
172 return -ENOSPC;
173 return count;
174}
175
176static int __test_firmware_config_init(void)
177{
178 int ret;
179
180 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
181 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
182 if (ret < 0)
183 goto out;
184
185 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
186 test_fw_config->send_uevent = true;
187 test_fw_config->into_buf = false;
188 test_fw_config->sync_direct = false;
189 test_fw_config->req_firmware = request_firmware;
190 test_fw_config->test_result = 0;
191 test_fw_config->reqs = NULL;
192
193 return 0;
194
195out:
196 __test_firmware_config_free();
197 return ret;
198}
199
200static ssize_t reset_store(struct device *dev,
201 struct device_attribute *attr,
202 const char *buf, size_t count)
203{
204 int ret;
205
206 mutex_lock(&test_fw_mutex);
207
208 __test_firmware_config_free();
209
210 ret = __test_firmware_config_init();
211 if (ret < 0) {
212 ret = -ENOMEM;
213 pr_err("could not alloc settings for config trigger: %d\n",
214 ret);
215 goto out;
216 }
217
218 pr_info("reset\n");
219 ret = count;
220
221out:
222 mutex_unlock(&test_fw_mutex);
223
224 return ret;
225}
226static DEVICE_ATTR_WO(reset);
227
228static ssize_t config_show(struct device *dev,
229 struct device_attribute *attr,
230 char *buf)
231{
232 int len = 0;
233
234 mutex_lock(&test_fw_mutex);
235
236 len += scnprintf(buf, PAGE_SIZE - len,
237 "Custom trigger configuration for: %s\n",
238 dev_name(dev));
239
240 if (test_fw_config->name)
241 len += scnprintf(buf+len, PAGE_SIZE - len,
242 "name:\t%s\n",
243 test_fw_config->name);
244 else
245 len += scnprintf(buf+len, PAGE_SIZE - len,
246 "name:\tEMTPY\n");
247
248 len += scnprintf(buf+len, PAGE_SIZE - len,
249 "num_requests:\t%u\n", test_fw_config->num_requests);
250
251 len += scnprintf(buf+len, PAGE_SIZE - len,
252 "send_uevent:\t\t%s\n",
253 test_fw_config->send_uevent ?
254 "FW_ACTION_HOTPLUG" :
255 "FW_ACTION_NOHOTPLUG");
256 len += scnprintf(buf+len, PAGE_SIZE - len,
257 "into_buf:\t\t%s\n",
258 test_fw_config->into_buf ? "true" : "false");
259 len += scnprintf(buf+len, PAGE_SIZE - len,
260 "sync_direct:\t\t%s\n",
261 test_fw_config->sync_direct ? "true" : "false");
262 len += scnprintf(buf+len, PAGE_SIZE - len,
263 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
264
265 mutex_unlock(&test_fw_mutex);
266
267 return len;
268}
269static DEVICE_ATTR_RO(config);
270
271static ssize_t config_name_store(struct device *dev,
272 struct device_attribute *attr,
273 const char *buf, size_t count)
274{
275 int ret;
276
277 mutex_lock(&test_fw_mutex);
278 kfree_const(test_fw_config->name);
279 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
280 mutex_unlock(&test_fw_mutex);
281
282 return ret;
283}
284
285/*
286 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
287 */
288static ssize_t config_test_show_str(char *dst,
289 char *src)
290{
291 int len;
292
293 mutex_lock(&test_fw_mutex);
294 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
295 mutex_unlock(&test_fw_mutex);
296
297 return len;
298}
299
300static int test_dev_config_update_bool(const char *buf, size_t size,
301 bool *cfg)
302{
303 int ret;
304
305 mutex_lock(&test_fw_mutex);
306 if (strtobool(buf, cfg) < 0)
307 ret = -EINVAL;
308 else
309 ret = size;
310 mutex_unlock(&test_fw_mutex);
311
312 return ret;
313}
314
315static ssize_t test_dev_config_show_bool(char *buf, bool val)
316{
317 return snprintf(buf, PAGE_SIZE, "%d\n", val);
318}
319
320static ssize_t test_dev_config_show_int(char *buf, int val)
321{
322 return snprintf(buf, PAGE_SIZE, "%d\n", val);
323}
324
325static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
326{
327 int ret;
328 long new;
329
330 ret = kstrtol(buf, 10, &new);
331 if (ret)
332 return ret;
333
334 if (new > U8_MAX)
335 return -EINVAL;
336
337 mutex_lock(&test_fw_mutex);
338 *(u8 *)cfg = new;
339 mutex_unlock(&test_fw_mutex);
340
341 /* Always return full write size even if we didn't consume all */
342 return size;
343}
344
345static ssize_t test_dev_config_show_u8(char *buf, u8 val)
346{
347 return snprintf(buf, PAGE_SIZE, "%u\n", val);
348}
349
350static ssize_t config_name_show(struct device *dev,
351 struct device_attribute *attr,
352 char *buf)
353{
354 return config_test_show_str(buf, test_fw_config->name);
355}
356static DEVICE_ATTR_RW(config_name);
357
358static ssize_t config_num_requests_store(struct device *dev,
359 struct device_attribute *attr,
360 const char *buf, size_t count)
361{
362 int rc;
363
364 mutex_lock(&test_fw_mutex);
365 if (test_fw_config->reqs) {
366 pr_err("Must call release_all_firmware prior to changing config\n");
367 rc = -EINVAL;
368 mutex_unlock(&test_fw_mutex);
369 goto out;
370 }
371 mutex_unlock(&test_fw_mutex);
372
373 rc = test_dev_config_update_u8(buf, count,
374 &test_fw_config->num_requests);
375
376out:
377 return rc;
378}
379
380static ssize_t config_num_requests_show(struct device *dev,
381 struct device_attribute *attr,
382 char *buf)
383{
384 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
385}
386static DEVICE_ATTR_RW(config_num_requests);
387
388static ssize_t config_into_buf_store(struct device *dev,
389 struct device_attribute *attr,
390 const char *buf, size_t count)
391{
392 return test_dev_config_update_bool(buf,
393 count,
394 &test_fw_config->into_buf);
395}
396
397static ssize_t config_into_buf_show(struct device *dev,
398 struct device_attribute *attr,
399 char *buf)
400{
401 return test_dev_config_show_bool(buf, test_fw_config->into_buf);
402}
403static DEVICE_ATTR_RW(config_into_buf);
404
405static ssize_t config_sync_direct_store(struct device *dev,
406 struct device_attribute *attr,
407 const char *buf, size_t count)
408{
409 int rc = test_dev_config_update_bool(buf, count,
410 &test_fw_config->sync_direct);
411
412 if (rc == count)
413 test_fw_config->req_firmware = test_fw_config->sync_direct ?
414 request_firmware_direct :
415 request_firmware;
416 return rc;
417}
418
419static ssize_t config_sync_direct_show(struct device *dev,
420 struct device_attribute *attr,
421 char *buf)
422{
423 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
424}
425static DEVICE_ATTR_RW(config_sync_direct);
426
427static ssize_t config_send_uevent_store(struct device *dev,
428 struct device_attribute *attr,
429 const char *buf, size_t count)
430{
431 return test_dev_config_update_bool(buf, count,
432 &test_fw_config->send_uevent);
433}
434
435static ssize_t config_send_uevent_show(struct device *dev,
436 struct device_attribute *attr,
437 char *buf)
438{
439 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
440}
441static DEVICE_ATTR_RW(config_send_uevent);
442
443static ssize_t config_read_fw_idx_store(struct device *dev,
444 struct device_attribute *attr,
445 const char *buf, size_t count)
446{
447 return test_dev_config_update_u8(buf, count,
448 &test_fw_config->read_fw_idx);
449}
450
451static ssize_t config_read_fw_idx_show(struct device *dev,
452 struct device_attribute *attr,
453 char *buf)
454{
455 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
456}
457static DEVICE_ATTR_RW(config_read_fw_idx);
458
459
460static ssize_t trigger_request_store(struct device *dev,
461 struct device_attribute *attr,
462 const char *buf, size_t count)
463{
464 int rc;
465 char *name;
466
467 name = kstrndup(buf, count, GFP_KERNEL);
468 if (!name)
469 return -ENOSPC;
470
471 pr_info("loading '%s'\n", name);
472
473 mutex_lock(&test_fw_mutex);
474 release_firmware(test_firmware);
475 test_firmware = NULL;
476 rc = request_firmware(&test_firmware, name, dev);
477 if (rc) {
478 pr_info("load of '%s' failed: %d\n", name, rc);
479 goto out;
480 }
481 pr_info("loaded: %zu\n", test_firmware->size);
482 rc = count;
483
484out:
485 mutex_unlock(&test_fw_mutex);
486
487 kfree(name);
488
489 return rc;
490}
491static DEVICE_ATTR_WO(trigger_request);
492
493#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
494extern struct list_head efi_embedded_fw_list;
495extern bool efi_embedded_fw_checked;
496
497static ssize_t trigger_request_platform_store(struct device *dev,
498 struct device_attribute *attr,
499 const char *buf, size_t count)
500{
501 static const u8 test_data[] = {
502 0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
503 0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
504 0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
505 0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
506 };
507 struct efi_embedded_fw efi_embedded_fw;
508 const struct firmware *firmware = NULL;
509 bool saved_efi_embedded_fw_checked;
510 char *name;
511 int rc;
512
513 name = kstrndup(buf, count, GFP_KERNEL);
514 if (!name)
515 return -ENOSPC;
516
517 pr_info("inserting test platform fw '%s'\n", name);
518 efi_embedded_fw.name = name;
519 efi_embedded_fw.data = (void *)test_data;
520 efi_embedded_fw.length = sizeof(test_data);
521 list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
522 saved_efi_embedded_fw_checked = efi_embedded_fw_checked;
523 efi_embedded_fw_checked = true;
524
525 pr_info("loading '%s'\n", name);
526 rc = firmware_request_platform(&firmware, name, dev);
527 if (rc) {
528 pr_info("load of '%s' failed: %d\n", name, rc);
529 goto out;
530 }
531 if (firmware->size != sizeof(test_data) ||
532 memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
533 pr_info("firmware contents mismatch for '%s'\n", name);
534 rc = -EINVAL;
535 goto out;
536 }
537 pr_info("loaded: %zu\n", firmware->size);
538 rc = count;
539
540out:
541 efi_embedded_fw_checked = saved_efi_embedded_fw_checked;
542 release_firmware(firmware);
543 list_del(&efi_embedded_fw.list);
544 kfree(name);
545
546 return rc;
547}
548static DEVICE_ATTR_WO(trigger_request_platform);
549#endif
550
551static DECLARE_COMPLETION(async_fw_done);
552
553static void trigger_async_request_cb(const struct firmware *fw, void *context)
554{
555 test_firmware = fw;
556 complete(&async_fw_done);
557}
558
559static ssize_t trigger_async_request_store(struct device *dev,
560 struct device_attribute *attr,
561 const char *buf, size_t count)
562{
563 int rc;
564 char *name;
565
566 name = kstrndup(buf, count, GFP_KERNEL);
567 if (!name)
568 return -ENOSPC;
569
570 pr_info("loading '%s'\n", name);
571
572 mutex_lock(&test_fw_mutex);
573 release_firmware(test_firmware);
574 test_firmware = NULL;
575 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
576 NULL, trigger_async_request_cb);
577 if (rc) {
578 pr_info("async load of '%s' failed: %d\n", name, rc);
579 kfree(name);
580 goto out;
581 }
582 /* Free 'name' ASAP, to test for race conditions */
583 kfree(name);
584
585 wait_for_completion(&async_fw_done);
586
587 if (test_firmware) {
588 pr_info("loaded: %zu\n", test_firmware->size);
589 rc = count;
590 } else {
591 pr_err("failed to async load firmware\n");
592 rc = -ENOMEM;
593 }
594
595out:
596 mutex_unlock(&test_fw_mutex);
597
598 return rc;
599}
600static DEVICE_ATTR_WO(trigger_async_request);
601
602static ssize_t trigger_custom_fallback_store(struct device *dev,
603 struct device_attribute *attr,
604 const char *buf, size_t count)
605{
606 int rc;
607 char *name;
608
609 name = kstrndup(buf, count, GFP_KERNEL);
610 if (!name)
611 return -ENOSPC;
612
613 pr_info("loading '%s' using custom fallback mechanism\n", name);
614
615 mutex_lock(&test_fw_mutex);
616 release_firmware(test_firmware);
617 test_firmware = NULL;
618 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
619 dev, GFP_KERNEL, NULL,
620 trigger_async_request_cb);
621 if (rc) {
622 pr_info("async load of '%s' failed: %d\n", name, rc);
623 kfree(name);
624 goto out;
625 }
626 /* Free 'name' ASAP, to test for race conditions */
627 kfree(name);
628
629 wait_for_completion(&async_fw_done);
630
631 if (test_firmware) {
632 pr_info("loaded: %zu\n", test_firmware->size);
633 rc = count;
634 } else {
635 pr_err("failed to async load firmware\n");
636 rc = -ENODEV;
637 }
638
639out:
640 mutex_unlock(&test_fw_mutex);
641
642 return rc;
643}
644static DEVICE_ATTR_WO(trigger_custom_fallback);
645
646static int test_fw_run_batch_request(void *data)
647{
648 struct test_batched_req *req = data;
649
650 if (!req) {
651 test_fw_config->test_result = -EINVAL;
652 return -EINVAL;
653 }
654
655 if (test_fw_config->into_buf) {
656 void *test_buf;
657
658 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
659 if (!test_buf)
660 return -ENOSPC;
661
662 req->rc = request_firmware_into_buf(&req->fw,
663 req->name,
664 req->dev,
665 test_buf,
666 TEST_FIRMWARE_BUF_SIZE);
667 if (!req->fw)
668 kfree(test_buf);
669 } else {
670 req->rc = test_fw_config->req_firmware(&req->fw,
671 req->name,
672 req->dev);
673 }
674
675 if (req->rc) {
676 pr_info("#%u: batched sync load failed: %d\n",
677 req->idx, req->rc);
678 if (!test_fw_config->test_result)
679 test_fw_config->test_result = req->rc;
680 } else if (req->fw) {
681 req->sent = true;
682 pr_info("#%u: batched sync loaded %zu\n",
683 req->idx, req->fw->size);
684 }
685 complete(&req->completion);
686
687 req->task = NULL;
688
689 return 0;
690}
691
692/*
693 * We use a kthread as otherwise the kernel serializes all our sync requests
694 * and we would not be able to mimic batched requests on a sync call. Batched
695 * requests on a sync call can for instance happen on a device driver when
696 * multiple cards are used and firmware loading happens outside of probe.
697 */
698static ssize_t trigger_batched_requests_store(struct device *dev,
699 struct device_attribute *attr,
700 const char *buf, size_t count)
701{
702 struct test_batched_req *req;
703 int rc;
704 u8 i;
705
706 mutex_lock(&test_fw_mutex);
707
708 test_fw_config->reqs =
709 vzalloc(array3_size(sizeof(struct test_batched_req),
710 test_fw_config->num_requests, 2));
711 if (!test_fw_config->reqs) {
712 rc = -ENOMEM;
713 goto out_unlock;
714 }
715
716 pr_info("batched sync firmware loading '%s' %u times\n",
717 test_fw_config->name, test_fw_config->num_requests);
718
719 for (i = 0; i < test_fw_config->num_requests; i++) {
720 req = &test_fw_config->reqs[i];
721 req->fw = NULL;
722 req->idx = i;
723 req->name = test_fw_config->name;
724 req->dev = dev;
725 init_completion(&req->completion);
726 req->task = kthread_run(test_fw_run_batch_request, req,
727 "%s-%u", KBUILD_MODNAME, req->idx);
728 if (!req->task || IS_ERR(req->task)) {
729 pr_err("Setting up thread %u failed\n", req->idx);
730 req->task = NULL;
731 rc = -ENOMEM;
732 goto out_bail;
733 }
734 }
735
736 rc = count;
737
738 /*
739 * We require an explicit release to enable more time and delay of
740 * calling release_firmware() to improve our chances of forcing a
741 * batched request. If we instead called release_firmware() right away
742 * then we might miss on an opportunity of having a successful firmware
743 * request pass on the opportunity to be come a batched request.
744 */
745
746out_bail:
747 for (i = 0; i < test_fw_config->num_requests; i++) {
748 req = &test_fw_config->reqs[i];
749 if (req->task || req->sent)
750 wait_for_completion(&req->completion);
751 }
752
753 /* Override any worker error if we had a general setup error */
754 if (rc < 0)
755 test_fw_config->test_result = rc;
756
757out_unlock:
758 mutex_unlock(&test_fw_mutex);
759
760 return rc;
761}
762static DEVICE_ATTR_WO(trigger_batched_requests);
763
764/*
765 * We wait for each callback to return with the lock held, no need to lock here
766 */
767static void trigger_batched_cb(const struct firmware *fw, void *context)
768{
769 struct test_batched_req *req = context;
770
771 if (!req) {
772 test_fw_config->test_result = -EINVAL;
773 return;
774 }
775
776 /* forces *some* batched requests to queue up */
777 if (!req->idx)
778 ssleep(2);
779
780 req->fw = fw;
781
782 /*
783 * Unfortunately the firmware API gives us nothing other than a null FW
784 * if the firmware was not found on async requests. Best we can do is
785 * just assume -ENOENT. A better API would pass the actual return
786 * value to the callback.
787 */
788 if (!fw && !test_fw_config->test_result)
789 test_fw_config->test_result = -ENOENT;
790
791 complete(&req->completion);
792}
793
794static
795ssize_t trigger_batched_requests_async_store(struct device *dev,
796 struct device_attribute *attr,
797 const char *buf, size_t count)
798{
799 struct test_batched_req *req;
800 bool send_uevent;
801 int rc;
802 u8 i;
803
804 mutex_lock(&test_fw_mutex);
805
806 test_fw_config->reqs =
807 vzalloc(array3_size(sizeof(struct test_batched_req),
808 test_fw_config->num_requests, 2));
809 if (!test_fw_config->reqs) {
810 rc = -ENOMEM;
811 goto out;
812 }
813
814 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
815 test_fw_config->name, test_fw_config->num_requests);
816
817 send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
818 FW_ACTION_NOHOTPLUG;
819
820 for (i = 0; i < test_fw_config->num_requests; i++) {
821 req = &test_fw_config->reqs[i];
822 req->name = test_fw_config->name;
823 req->fw = NULL;
824 req->idx = i;
825 init_completion(&req->completion);
826 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
827 req->name,
828 dev, GFP_KERNEL, req,
829 trigger_batched_cb);
830 if (rc) {
831 pr_info("#%u: batched async load failed setup: %d\n",
832 i, rc);
833 req->rc = rc;
834 goto out_bail;
835 } else
836 req->sent = true;
837 }
838
839 rc = count;
840
841out_bail:
842
843 /*
844 * We require an explicit release to enable more time and delay of
845 * calling release_firmware() to improve our chances of forcing a
846 * batched request. If we instead called release_firmware() right away
847 * then we might miss on an opportunity of having a successful firmware
848 * request pass on the opportunity to be come a batched request.
849 */
850
851 for (i = 0; i < test_fw_config->num_requests; i++) {
852 req = &test_fw_config->reqs[i];
853 if (req->sent)
854 wait_for_completion(&req->completion);
855 }
856
857 /* Override any worker error if we had a general setup error */
858 if (rc < 0)
859 test_fw_config->test_result = rc;
860
861out:
862 mutex_unlock(&test_fw_mutex);
863
864 return rc;
865}
866static DEVICE_ATTR_WO(trigger_batched_requests_async);
867
868static ssize_t test_result_show(struct device *dev,
869 struct device_attribute *attr,
870 char *buf)
871{
872 return test_dev_config_show_int(buf, test_fw_config->test_result);
873}
874static DEVICE_ATTR_RO(test_result);
875
876static ssize_t release_all_firmware_store(struct device *dev,
877 struct device_attribute *attr,
878 const char *buf, size_t count)
879{
880 test_release_all_firmware();
881 return count;
882}
883static DEVICE_ATTR_WO(release_all_firmware);
884
885static ssize_t read_firmware_show(struct device *dev,
886 struct device_attribute *attr,
887 char *buf)
888{
889 struct test_batched_req *req;
890 u8 idx;
891 ssize_t rc = 0;
892
893 mutex_lock(&test_fw_mutex);
894
895 idx = test_fw_config->read_fw_idx;
896 if (idx >= test_fw_config->num_requests) {
897 rc = -ERANGE;
898 goto out;
899 }
900
901 if (!test_fw_config->reqs) {
902 rc = -EINVAL;
903 goto out;
904 }
905
906 req = &test_fw_config->reqs[idx];
907 if (!req->fw) {
908 pr_err("#%u: failed to async load firmware\n", idx);
909 rc = -ENOENT;
910 goto out;
911 }
912
913 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
914
915 if (req->fw->size > PAGE_SIZE) {
916 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
917 rc = -EINVAL;
918 goto out;
919 }
920 memcpy(buf, req->fw->data, req->fw->size);
921
922 rc = req->fw->size;
923out:
924 mutex_unlock(&test_fw_mutex);
925
926 return rc;
927}
928static DEVICE_ATTR_RO(read_firmware);
929
930#define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
931
932static struct attribute *test_dev_attrs[] = {
933 TEST_FW_DEV_ATTR(reset),
934
935 TEST_FW_DEV_ATTR(config),
936 TEST_FW_DEV_ATTR(config_name),
937 TEST_FW_DEV_ATTR(config_num_requests),
938 TEST_FW_DEV_ATTR(config_into_buf),
939 TEST_FW_DEV_ATTR(config_sync_direct),
940 TEST_FW_DEV_ATTR(config_send_uevent),
941 TEST_FW_DEV_ATTR(config_read_fw_idx),
942
943 /* These don't use the config at all - they could be ported! */
944 TEST_FW_DEV_ATTR(trigger_request),
945 TEST_FW_DEV_ATTR(trigger_async_request),
946 TEST_FW_DEV_ATTR(trigger_custom_fallback),
947#ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
948 TEST_FW_DEV_ATTR(trigger_request_platform),
949#endif
950
951 /* These use the config and can use the test_result */
952 TEST_FW_DEV_ATTR(trigger_batched_requests),
953 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
954
955 TEST_FW_DEV_ATTR(release_all_firmware),
956 TEST_FW_DEV_ATTR(test_result),
957 TEST_FW_DEV_ATTR(read_firmware),
958 NULL,
959};
960
961ATTRIBUTE_GROUPS(test_dev);
962
963static struct miscdevice test_fw_misc_device = {
964 .minor = MISC_DYNAMIC_MINOR,
965 .name = "test_firmware",
966 .fops = &test_fw_fops,
967 .groups = test_dev_groups,
968};
969
970static int __init test_firmware_init(void)
971{
972 int rc;
973
974 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
975 if (!test_fw_config)
976 return -ENOMEM;
977
978 rc = __test_firmware_config_init();
979 if (rc) {
980 kfree(test_fw_config);
981 pr_err("could not init firmware test config: %d\n", rc);
982 return rc;
983 }
984
985 rc = misc_register(&test_fw_misc_device);
986 if (rc) {
987 kfree(test_fw_config);
988 pr_err("could not register misc device: %d\n", rc);
989 return rc;
990 }
991
992 pr_warn("interface ready\n");
993
994 return 0;
995}
996
997module_init(test_firmware_init);
998
999static void __exit test_firmware_exit(void)
1000{
1001 mutex_lock(&test_fw_mutex);
1002 release_firmware(test_firmware);
1003 misc_deregister(&test_fw_misc_device);
1004 __test_firmware_config_free();
1005 kfree(test_fw_config);
1006 mutex_unlock(&test_fw_mutex);
1007
1008 pr_warn("removed interface\n");
1009}
1010
1011module_exit(test_firmware_exit);
1012
1013MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1014MODULE_LICENSE("GPL");