lib/test_firmware.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This module provides an interface to trigger and test firmware loading.
   4  *
   5  * It is designed to be used for basic evaluation of the firmware loading
   6  * subsystem (for example when validating firmware verification). It lacks
   7  * any extra dependencies, and will not normally be loaded by the system
   8  * unless explicitly requested by name.
   9  */
  10
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/printk.h>
  16 #include <linux/completion.h>
  17 #include <linux/firmware.h>
  18 #include <linux/device.h>
  19 #include <linux/fs.h>
  20 #include <linux/miscdevice.h>
  21 #include <linux/sizes.h>
  22 #include <linux/slab.h>
  23 #include <linux/uaccess.h>
  24 #include <linux/delay.h>
  25 #include <linux/kthread.h>
  26 #include <linux/vmalloc.h>
  27 #include <linux/efi_embedded_fw.h>
  28
  29 #define TEST_FIRMWARE_NAME      "test-firmware.bin"
  30 #define TEST_FIRMWARE_NUM_REQS  4
  31 #define TEST_FIRMWARE_BUF_SIZE  SZ_1K
  32
  33 static DEFINE_MUTEX(test_fw_mutex);
  34 static const struct firmware *test_firmware;
  35
  36 struct test_batched_req {
  37         u8 idx;
  38         int rc;
  39         bool sent;
  40         const struct firmware *fw;
  41         const char *name;
  42         struct completion completion;
  43         struct task_struct *task;
  44         struct device *dev;
  45 };
  46
  47 /**
  48  * test_config - represents configuration for the test for different triggers
  49  *
  50  * @name: the name of the firmware file to look for
  51  * @into_buf: when the into_buf is used if this is true
  52  *      request_firmware_into_buf() will be used instead.
  53  * @sync_direct: when the sync trigger is used if this is true
  54  *      request_firmware_direct() will be used instead.
  55  * @send_uevent: whether or not to send a uevent for async requests
  56  * @num_requests: number of requests to try per test case. This is trigger
  57  *      specific.
  58  * @reqs: stores all requests information
  59  * @read_fw_idx: index of thread from which we want to read firmware results
  60  *      from through the read_fw trigger.
  61  * @test_result: a test may use this to collect the result from the call
  62  *      of the request_firmware*() calls used in their tests. In order of
  63  *      priority we always keep first any setup error. If no setup errors were
  64  *      found then we move on to the first error encountered while running the
  65  *      API. Note that for async calls this typically will be a successful
  66  *      result (0) unless of course you've used bogus parameters, or the system
  67  *      is out of memory.  In the async case the callback is expected to do a
  68  *      bit more homework to figure out what happened, unfortunately the only
  69  *      information passed today on error is the fact that no firmware was
  70  *      found so we can only assume -ENOENT on async calls if the firmware is
  71  *      NULL.
  72  *
  73  *      Errors you can expect:
  74  *
  75  *      API specific:
  76  *
  77  *      0:              success for sync, for async it means request was sent
  78  *      -EINVAL:        invalid parameters or request
  79  *      -ENOENT:        files not found
  80  *
  81  *      System environment:
  82  *
  83  *      -ENOMEM:        memory pressure on system
  84  *      -ENODEV:        out of number of devices to test
  85  *      -EINVAL:        an unexpected error has occurred
  86  * @req_firmware: if @sync_direct is true this is set to
  87  *      request_firmware_direct(), otherwise request_firmware()
  88  */
  89 struct test_config {
  90         char *name;
  91         bool into_buf;
  92         bool sync_direct;
  93         bool send_uevent;
  94         u8 num_requests;
  95         u8 read_fw_idx;
  96
  97         /*
  98          * These below don't belong her but we'll move them once we create
  99          * a struct fw_test_device and stuff the misc_dev under there later.
 100          */
 101         struct test_batched_req *reqs;
 102         int test_result;
 103         int (*req_firmware)(const struct firmware **fw, const char *name,
 104                             struct device *device);
 105 };
 106
 107 static struct test_config *test_fw_config;
 108
 109 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
 110                                  size_t size, loff_t *offset)
 111 {
 112         ssize_t rc = 0;
 113
 114         mutex_lock(&test_fw_mutex);
 115         if (test_firmware)
 116                 rc = simple_read_from_buffer(buf, size, offset,
 117                                              test_firmware->data,
 118                                              test_firmware->size);
 119         mutex_unlock(&test_fw_mutex);
 120         return rc;
 121 }
 122
 123 static const struct file_operations test_fw_fops = {
 124         .owner          = THIS_MODULE,
 125         .read           = test_fw_misc_read,
 126 };
 127
 128 static void __test_release_all_firmware(void)
 129 {
 130         struct test_batched_req *req;
 131         u8 i;
 132
 133         if (!test_fw_config->reqs)
 134                 return;
 135
 136         for (i = 0; i < test_fw_config->num_requests; i++) {
 137                 req = &test_fw_config->reqs[i];
 138                 if (req->fw)
 139                         release_firmware(req->fw);
 140         }
 141
 142         vfree(test_fw_config->reqs);
 143         test_fw_config->reqs = NULL;
 144 }
 145
 146 static void test_release_all_firmware(void)
 147 {
 148         mutex_lock(&test_fw_mutex);
 149         __test_release_all_firmware();
 150         mutex_unlock(&test_fw_mutex);
 151 }
 152
 153
 154 static void __test_firmware_config_free(void)
 155 {
 156         __test_release_all_firmware();
 157         kfree_const(test_fw_config->name);
 158         test_fw_config->name = NULL;
 159 }
 160
 161 /*
 162  * XXX: move to kstrncpy() once merged.
 163  *
 164  * Users should use kfree_const() when freeing these.
 165  */
 166 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
 167 {
 168         *dst = kstrndup(name, count, gfp);
 169         if (!*dst)
 170                 return -ENOSPC;
 171         return count;
 172 }
 173
 174 static int __test_firmware_config_init(void)
 175 {
 176         int ret;
 177
 178         ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
 179                          strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
 180         if (ret < 0)
 181                 goto out;
 182
 183         test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
 184         test_fw_config->send_uevent = true;
 185         test_fw_config->into_buf = false;
 186         test_fw_config->sync_direct = false;
 187         test_fw_config->req_firmware = request_firmware;
 188         test_fw_config->test_result = 0;
 189         test_fw_config->reqs = NULL;
 190
 191         return 0;
 192
 193 out:
 194         __test_firmware_config_free();
 195         return ret;
 196 }
 197
 198 static ssize_t reset_store(struct device *dev,
 199                            struct device_attribute *attr,
 200                            const char *buf, size_t count)
 201 {
 202         int ret;
 203
 204         mutex_lock(&test_fw_mutex);
 205
 206         __test_firmware_config_free();
 207
 208         ret = __test_firmware_config_init();
 209         if (ret < 0) {
 210                 ret = -ENOMEM;
 211                 pr_err("could not alloc settings for config trigger: %d\n",
 212                        ret);
 213                 goto out;
 214         }
 215
 216         pr_info("reset\n");
 217         ret = count;
 218
 219 out:
 220         mutex_unlock(&test_fw_mutex);
 221
 222         return ret;
 223 }
 224 static DEVICE_ATTR_WO(reset);
 225
 226 static ssize_t config_show(struct device *dev,
 227                            struct device_attribute *attr,
 228                            char *buf)
 229 {
 230         int len = 0;
 231
 232         mutex_lock(&test_fw_mutex);
 233
 234         len += scnprintf(buf, PAGE_SIZE - len,
 235                         "Custom trigger configuration for: %s\n",
 236                         dev_name(dev));
 237
 238         if (test_fw_config->name)
 239                 len += scnprintf(buf+len, PAGE_SIZE - len,
 240                                 "name:\t%s\n",
 241                                 test_fw_config->name);
 242         else
 243                 len += scnprintf(buf+len, PAGE_SIZE - len,
 244                                 "name:\tEMTPY\n");
 245
 246         len += scnprintf(buf+len, PAGE_SIZE - len,
 247                         "num_requests:\t%u\n", test_fw_config->num_requests);
 248
 249         len += scnprintf(buf+len, PAGE_SIZE - len,
 250                         "send_uevent:\t\t%s\n",
 251                         test_fw_config->send_uevent ?
 252                         "FW_ACTION_HOTPLUG" :
 253                         "FW_ACTION_NOHOTPLUG");
 254         len += scnprintf(buf+len, PAGE_SIZE - len,
 255                         "into_buf:\t\t%s\n",
 256                         test_fw_config->into_buf ? "true" : "false");
 257         len += scnprintf(buf+len, PAGE_SIZE - len,
 258                         "sync_direct:\t\t%s\n",
 259                         test_fw_config->sync_direct ? "true" : "false");
 260         len += scnprintf(buf+len, PAGE_SIZE - len,
 261                         "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
 262
 263         mutex_unlock(&test_fw_mutex);
 264
 265         return len;
 266 }
 267 static DEVICE_ATTR_RO(config);
 268
 269 static ssize_t config_name_store(struct device *dev,
 270                                  struct device_attribute *attr,
 271                                  const char *buf, size_t count)
 272 {
 273         int ret;
 274
 275         mutex_lock(&test_fw_mutex);
 276         kfree_const(test_fw_config->name);
 277         ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
 278         mutex_unlock(&test_fw_mutex);
 279
 280         return ret;
 281 }
 282
 283 /*
 284  * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
 285  */
 286 static ssize_t config_test_show_str(char *dst,
 287                                     char *src)
 288 {
 289         int len;
 290
 291         mutex_lock(&test_fw_mutex);
 292         len = snprintf(dst, PAGE_SIZE, "%s\n", src);
 293         mutex_unlock(&test_fw_mutex);
 294
 295         return len;
 296 }
 297
 298 static int test_dev_config_update_bool(const char *buf, size_t size,
 299                                        bool *cfg)
 300 {
 301         int ret;
 302
 303         mutex_lock(&test_fw_mutex);
 304         if (strtobool(buf, cfg) < 0)
 305                 ret = -EINVAL;
 306         else
 307                 ret = size;
 308         mutex_unlock(&test_fw_mutex);
 309
 310         return ret;
 311 }
 312
 313 static ssize_t
 314 test_dev_config_show_bool(char *buf,
 315                           bool config)
 316 {
 317         bool val;
 318
 319         mutex_lock(&test_fw_mutex);
 320         val = config;
 321         mutex_unlock(&test_fw_mutex);
 322
 323         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 324 }
 325
 326 static ssize_t test_dev_config_show_int(char *buf, int cfg)
 327 {
 328         int val;
 329
 330         mutex_lock(&test_fw_mutex);
 331         val = cfg;
 332         mutex_unlock(&test_fw_mutex);
 333
 334         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 335 }
 336
 337 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
 338 {
 339         int ret;
 340         long new;
 341
 342         ret = kstrtol(buf, 10, &new);
 343         if (ret)
 344                 return ret;
 345
 346         if (new > U8_MAX)
 347                 return -EINVAL;
 348
 349         mutex_lock(&test_fw_mutex);
 350         *(u8 *)cfg = new;
 351         mutex_unlock(&test_fw_mutex);
 352
 353         /* Always return full write size even if we didn't consume all */
 354         return size;
 355 }
 356
 357 static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
 358 {
 359         u8 val;
 360
 361         mutex_lock(&test_fw_mutex);
 362         val = cfg;
 363         mutex_unlock(&test_fw_mutex);
 364
 365         return snprintf(buf, PAGE_SIZE, "%u\n", val);
 366 }
 367
 368 static ssize_t config_name_show(struct device *dev,
 369                                 struct device_attribute *attr,
 370                                 char *buf)
 371 {
 372         return config_test_show_str(buf, test_fw_config->name);
 373 }
 374 static DEVICE_ATTR_RW(config_name);
 375
 376 static ssize_t config_num_requests_store(struct device *dev,
 377                                          struct device_attribute *attr,
 378                                          const char *buf, size_t count)
 379 {
 380         int rc;
 381
 382         mutex_lock(&test_fw_mutex);
 383         if (test_fw_config->reqs) {
 384                 pr_err("Must call release_all_firmware prior to changing config\n");
 385                 rc = -EINVAL;
 386                 mutex_unlock(&test_fw_mutex);
 387                 goto out;
 388         }
 389         mutex_unlock(&test_fw_mutex);
 390
 391         rc = test_dev_config_update_u8(buf, count,
 392                                        &test_fw_config->num_requests);
 393
 394 out:
 395         return rc;
 396 }
 397
 398 static ssize_t config_num_requests_show(struct device *dev,
 399                                         struct device_attribute *attr,
 400                                         char *buf)
 401 {
 402         return test_dev_config_show_u8(buf, test_fw_config->num_requests);
 403 }
 404 static DEVICE_ATTR_RW(config_num_requests);
 405
 406 static ssize_t config_into_buf_store(struct device *dev,
 407                                      struct device_attribute *attr,
 408                                      const char *buf, size_t count)
 409 {
 410         return test_dev_config_update_bool(buf,
 411                                            count,
 412                                            &test_fw_config->into_buf);
 413 }
 414
 415 static ssize_t config_into_buf_show(struct device *dev,
 416                                     struct device_attribute *attr,
 417                                     char *buf)
 418 {
 419         return test_dev_config_show_bool(buf, test_fw_config->into_buf);
 420 }
 421 static DEVICE_ATTR_RW(config_into_buf);
 422
 423 static ssize_t config_sync_direct_store(struct device *dev,
 424                                         struct device_attribute *attr,
 425                                         const char *buf, size_t count)
 426 {
 427         int rc = test_dev_config_update_bool(buf, count,
 428                                              &test_fw_config->sync_direct);
 429
 430         if (rc == count)
 431                 test_fw_config->req_firmware = test_fw_config->sync_direct ?
 432                                        request_firmware_direct :
 433                                        request_firmware;
 434         return rc;
 435 }
 436
 437 static ssize_t config_sync_direct_show(struct device *dev,
 438                                        struct device_attribute *attr,
 439                                        char *buf)
 440 {
 441         return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
 442 }
 443 static DEVICE_ATTR_RW(config_sync_direct);
 444
 445 static ssize_t config_send_uevent_store(struct device *dev,
 446                                         struct device_attribute *attr,
 447                                         const char *buf, size_t count)
 448 {
 449         return test_dev_config_update_bool(buf, count,
 450                                            &test_fw_config->send_uevent);
 451 }
 452
 453 static ssize_t config_send_uevent_show(struct device *dev,
 454                                        struct device_attribute *attr,
 455                                        char *buf)
 456 {
 457         return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
 458 }
 459 static DEVICE_ATTR_RW(config_send_uevent);
 460
 461 static ssize_t config_read_fw_idx_store(struct device *dev,
 462                                         struct device_attribute *attr,
 463                                         const char *buf, size_t count)
 464 {
 465         return test_dev_config_update_u8(buf, count,
 466                                          &test_fw_config->read_fw_idx);
 467 }
 468
 469 static ssize_t config_read_fw_idx_show(struct device *dev,
 470                                        struct device_attribute *attr,
 471                                        char *buf)
 472 {
 473         return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
 474 }
 475 static DEVICE_ATTR_RW(config_read_fw_idx);
 476
 477
 478 static ssize_t trigger_request_store(struct device *dev,
 479                                      struct device_attribute *attr,
 480                                      const char *buf, size_t count)
 481 {
 482         int rc;
 483         char *name;
 484
 485         name = kstrndup(buf, count, GFP_KERNEL);
 486         if (!name)
 487                 return -ENOSPC;
 488
 489         pr_info("loading '%s'\n", name);
 490
 491         mutex_lock(&test_fw_mutex);
 492         release_firmware(test_firmware);
 493         test_firmware = NULL;
 494         rc = request_firmware(&test_firmware, name, dev);
 495         if (rc) {
 496                 pr_info("load of '%s' failed: %d\n", name, rc);
 497                 goto out;
 498         }
 499         pr_info("loaded: %zu\n", test_firmware->size);
 500         rc = count;
 501
 502 out:
 503         mutex_unlock(&test_fw_mutex);
 504
 505         kfree(name);
 506
 507         return rc;
 508 }
 509 static DEVICE_ATTR_WO(trigger_request);
 510
 511 #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
 512 static ssize_t trigger_request_platform_store(struct device *dev,
 513                                               struct device_attribute *attr,
 514                                               const char *buf, size_t count)
 515 {
 516         static const u8 test_data[] = {
 517                 0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
 518                 0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
 519                 0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
 520                 0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
 521         };
 522         struct efi_embedded_fw efi_embedded_fw;
 523         const struct firmware *firmware = NULL;
 524         char *name;
 525         int rc;
 526
 527         name = kstrndup(buf, count, GFP_KERNEL);
 528         if (!name)
 529                 return -ENOSPC;
 530
 531         pr_info("inserting test platform fw '%s'\n", name);
 532         efi_embedded_fw.name = name;
 533         efi_embedded_fw.data = (void *)test_data;
 534         efi_embedded_fw.length = sizeof(test_data);
 535         list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
 536
 537         pr_info("loading '%s'\n", name);
 538         rc = firmware_request_platform(&firmware, name, dev);
 539         if (rc) {
 540                 pr_info("load of '%s' failed: %d\n", name, rc);
 541                 goto out;
 542         }
 543         if (firmware->size != sizeof(test_data) ||
 544             memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
 545                 pr_info("firmware contents mismatch for '%s'\n", name);
 546                 rc = -EINVAL;
 547                 goto out;
 548         }
 549         pr_info("loaded: %zu\n", firmware->size);
 550         rc = count;
 551
 552 out:
 553         release_firmware(firmware);
 554         list_del(&efi_embedded_fw.list);
 555         kfree(name);
 556
 557         return rc;
 558 }
 559 static DEVICE_ATTR_WO(trigger_request_platform);
 560 #endif
 561
 562 static DECLARE_COMPLETION(async_fw_done);
 563
 564 static void trigger_async_request_cb(const struct firmware *fw, void *context)
 565 {
 566         test_firmware = fw;
 567         complete(&async_fw_done);
 568 }
 569
 570 static ssize_t trigger_async_request_store(struct device *dev,
 571                                            struct device_attribute *attr,
 572                                            const char *buf, size_t count)
 573 {
 574         int rc;
 575         char *name;
 576
 577         name = kstrndup(buf, count, GFP_KERNEL);
 578         if (!name)
 579                 return -ENOSPC;
 580
 581         pr_info("loading '%s'\n", name);
 582
 583         mutex_lock(&test_fw_mutex);
 584         release_firmware(test_firmware);
 585         test_firmware = NULL;
 586         rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
 587                                      NULL, trigger_async_request_cb);
 588         if (rc) {
 589                 pr_info("async load of '%s' failed: %d\n", name, rc);
 590                 kfree(name);
 591                 goto out;
 592         }
 593         /* Free 'name' ASAP, to test for race conditions */
 594         kfree(name);
 595
 596         wait_for_completion(&async_fw_done);
 597
 598         if (test_firmware) {
 599                 pr_info("loaded: %zu\n", test_firmware->size);
 600                 rc = count;
 601         } else {
 602                 pr_err("failed to async load firmware\n");
 603                 rc = -ENOMEM;
 604         }
 605
 606 out:
 607         mutex_unlock(&test_fw_mutex);
 608
 609         return rc;
 610 }
 611 static DEVICE_ATTR_WO(trigger_async_request);
 612
 613 static ssize_t trigger_custom_fallback_store(struct device *dev,
 614                                              struct device_attribute *attr,
 615                                              const char *buf, size_t count)
 616 {
 617         int rc;
 618         char *name;
 619
 620         name = kstrndup(buf, count, GFP_KERNEL);
 621         if (!name)
 622                 return -ENOSPC;
 623
 624         pr_info("loading '%s' using custom fallback mechanism\n", name);
 625
 626         mutex_lock(&test_fw_mutex);
 627         release_firmware(test_firmware);
 628         test_firmware = NULL;
 629         rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
 630                                      dev, GFP_KERNEL, NULL,
 631                                      trigger_async_request_cb);
 632         if (rc) {
 633                 pr_info("async load of '%s' failed: %d\n", name, rc);
 634                 kfree(name);
 635                 goto out;
 636         }
 637         /* Free 'name' ASAP, to test for race conditions */
 638         kfree(name);
 639
 640         wait_for_completion(&async_fw_done);
 641
 642         if (test_firmware) {
 643                 pr_info("loaded: %zu\n", test_firmware->size);
 644                 rc = count;
 645         } else {
 646                 pr_err("failed to async load firmware\n");
 647                 rc = -ENODEV;
 648         }
 649
 650 out:
 651         mutex_unlock(&test_fw_mutex);
 652
 653         return rc;
 654 }
 655 static DEVICE_ATTR_WO(trigger_custom_fallback);
 656
 657 static int test_fw_run_batch_request(void *data)
 658 {
 659         struct test_batched_req *req = data;
 660
 661         if (!req) {
 662                 test_fw_config->test_result = -EINVAL;
 663                 return -EINVAL;
 664         }
 665
 666         if (test_fw_config->into_buf) {
 667                 void *test_buf;
 668
 669                 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
 670                 if (!test_buf)
 671                         return -ENOSPC;
 672
 673                 req->rc = request_firmware_into_buf(&req->fw,
 674                                                     req->name,
 675                                                     req->dev,
 676                                                     test_buf,
 677                                                     TEST_FIRMWARE_BUF_SIZE);
 678                 if (!req->fw)
 679                         kfree(test_buf);
 680         } else {
 681                 req->rc = test_fw_config->req_firmware(&req->fw,
 682                                                        req->name,
 683                                                        req->dev);
 684         }
 685
 686         if (req->rc) {
 687                 pr_info("#%u: batched sync load failed: %d\n",
 688                         req->idx, req->rc);
 689                 if (!test_fw_config->test_result)
 690                         test_fw_config->test_result = req->rc;
 691         } else if (req->fw) {
 692                 req->sent = true;
 693                 pr_info("#%u: batched sync loaded %zu\n",
 694                         req->idx, req->fw->size);
 695         }
 696         complete(&req->completion);
 697
 698         req->task = NULL;
 699
 700         return 0;
 701 }
 702
 703 /*
 704  * We use a kthread as otherwise the kernel serializes all our sync requests
 705  * and we would not be able to mimic batched requests on a sync call. Batched
 706  * requests on a sync call can for instance happen on a device driver when
 707  * multiple cards are used and firmware loading happens outside of probe.
 708  */
 709 static ssize_t trigger_batched_requests_store(struct device *dev,
 710                                               struct device_attribute *attr,
 711                                               const char *buf, size_t count)
 712 {
 713         struct test_batched_req *req;
 714         int rc;
 715         u8 i;
 716
 717         mutex_lock(&test_fw_mutex);
 718
 719         test_fw_config->reqs =
 720                 vzalloc(array3_size(sizeof(struct test_batched_req),
 721                                     test_fw_config->num_requests, 2));
 722         if (!test_fw_config->reqs) {
 723                 rc = -ENOMEM;
 724                 goto out_unlock;
 725         }
 726
 727         pr_info("batched sync firmware loading '%s' %u times\n",
 728                 test_fw_config->name, test_fw_config->num_requests);
 729
 730         for (i = 0; i < test_fw_config->num_requests; i++) {
 731                 req = &test_fw_config->reqs[i];
 732                 req->fw = NULL;
 733                 req->idx = i;
 734                 req->name = test_fw_config->name;
 735                 req->dev = dev;
 736                 init_completion(&req->completion);
 737                 req->task = kthread_run(test_fw_run_batch_request, req,
 738                                              "%s-%u", KBUILD_MODNAME, req->idx);
 739                 if (!req->task || IS_ERR(req->task)) {
 740                         pr_err("Setting up thread %u failed\n", req->idx);
 741                         req->task = NULL;
 742                         rc = -ENOMEM;
 743                         goto out_bail;
 744                 }
 745         }
 746
 747         rc = count;
 748
 749         /*
 750          * We require an explicit release to enable more time and delay of
 751          * calling release_firmware() to improve our chances of forcing a
 752          * batched request. If we instead called release_firmware() right away
 753          * then we might miss on an opportunity of having a successful firmware
 754          * request pass on the opportunity to be come a batched request.
 755          */
 756
 757 out_bail:
 758         for (i = 0; i < test_fw_config->num_requests; i++) {
 759                 req = &test_fw_config->reqs[i];
 760                 if (req->task || req->sent)
 761                         wait_for_completion(&req->completion);
 762         }
 763
 764         /* Override any worker error if we had a general setup error */
 765         if (rc < 0)
 766                 test_fw_config->test_result = rc;
 767
 768 out_unlock:
 769         mutex_unlock(&test_fw_mutex);
 770
 771         return rc;
 772 }
 773 static DEVICE_ATTR_WO(trigger_batched_requests);
 774
 775 /*
 776  * We wait for each callback to return with the lock held, no need to lock here
 777  */
 778 static void trigger_batched_cb(const struct firmware *fw, void *context)
 779 {
 780         struct test_batched_req *req = context;
 781
 782         if (!req) {
 783                 test_fw_config->test_result = -EINVAL;
 784                 return;
 785         }
 786
 787         /* forces *some* batched requests to queue up */
 788         if (!req->idx)
 789                 ssleep(2);
 790
 791         req->fw = fw;
 792
 793         /*
 794          * Unfortunately the firmware API gives us nothing other than a null FW
 795          * if the firmware was not found on async requests.  Best we can do is
 796          * just assume -ENOENT. A better API would pass the actual return
 797          * value to the callback.
 798          */
 799         if (!fw && !test_fw_config->test_result)
 800                 test_fw_config->test_result = -ENOENT;
 801
 802         complete(&req->completion);
 803 }
 804
 805 static
 806 ssize_t trigger_batched_requests_async_store(struct device *dev,
 807                                              struct device_attribute *attr,
 808                                              const char *buf, size_t count)
 809 {
 810         struct test_batched_req *req;
 811         bool send_uevent;
 812         int rc;
 813         u8 i;
 814
 815         mutex_lock(&test_fw_mutex);
 816
 817         test_fw_config->reqs =
 818                 vzalloc(array3_size(sizeof(struct test_batched_req),
 819                                     test_fw_config->num_requests, 2));
 820         if (!test_fw_config->reqs) {
 821                 rc = -ENOMEM;
 822                 goto out;
 823         }
 824
 825         pr_info("batched loading '%s' custom fallback mechanism %u times\n",
 826                 test_fw_config->name, test_fw_config->num_requests);
 827
 828         send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
 829                 FW_ACTION_NOHOTPLUG;
 830
 831         for (i = 0; i < test_fw_config->num_requests; i++) {
 832                 req = &test_fw_config->reqs[i];
 833                 req->name = test_fw_config->name;
 834                 req->fw = NULL;
 835                 req->idx = i;
 836                 init_completion(&req->completion);
 837                 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
 838                                              req->name,
 839                                              dev, GFP_KERNEL, req,
 840                                              trigger_batched_cb);
 841                 if (rc) {
 842                         pr_info("#%u: batched async load failed setup: %d\n",
 843                                 i, rc);
 844                         req->rc = rc;
 845                         goto out_bail;
 846                 } else
 847                         req->sent = true;
 848         }
 849
 850         rc = count;
 851
 852 out_bail:
 853
 854         /*
 855          * We require an explicit release to enable more time and delay of
 856          * calling release_firmware() to improve our chances of forcing a
 857          * batched request. If we instead called release_firmware() right away
 858          * then we might miss on an opportunity of having a successful firmware
 859          * request pass on the opportunity to be come a batched request.
 860          */
 861
 862         for (i = 0; i < test_fw_config->num_requests; i++) {
 863                 req = &test_fw_config->reqs[i];
 864                 if (req->sent)
 865                         wait_for_completion(&req->completion);
 866         }
 867
 868         /* Override any worker error if we had a general setup error */
 869         if (rc < 0)
 870                 test_fw_config->test_result = rc;
 871
 872 out:
 873         mutex_unlock(&test_fw_mutex);
 874
 875         return rc;
 876 }
 877 static DEVICE_ATTR_WO(trigger_batched_requests_async);
 878
 879 static ssize_t test_result_show(struct device *dev,
 880                                 struct device_attribute *attr,
 881                                 char *buf)
 882 {
 883         return test_dev_config_show_int(buf, test_fw_config->test_result);
 884 }
 885 static DEVICE_ATTR_RO(test_result);
 886
 887 static ssize_t release_all_firmware_store(struct device *dev,
 888                                           struct device_attribute *attr,
 889                                           const char *buf, size_t count)
 890 {
 891         test_release_all_firmware();
 892         return count;
 893 }
 894 static DEVICE_ATTR_WO(release_all_firmware);
 895
 896 static ssize_t read_firmware_show(struct device *dev,
 897                                   struct device_attribute *attr,
 898                                   char *buf)
 899 {
 900         struct test_batched_req *req;
 901         u8 idx;
 902         ssize_t rc = 0;
 903
 904         mutex_lock(&test_fw_mutex);
 905
 906         idx = test_fw_config->read_fw_idx;
 907         if (idx >= test_fw_config->num_requests) {
 908                 rc = -ERANGE;
 909                 goto out;
 910         }
 911
 912         if (!test_fw_config->reqs) {
 913                 rc = -EINVAL;
 914                 goto out;
 915         }
 916
 917         req = &test_fw_config->reqs[idx];
 918         if (!req->fw) {
 919                 pr_err("#%u: failed to async load firmware\n", idx);
 920                 rc = -ENOENT;
 921                 goto out;
 922         }
 923
 924         pr_info("#%u: loaded %zu\n", idx, req->fw->size);
 925
 926         if (req->fw->size > PAGE_SIZE) {
 927                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
 928                 rc = -EINVAL;
 929                 goto out;
 930         }
 931         memcpy(buf, req->fw->data, req->fw->size);
 932
 933         rc = req->fw->size;
 934 out:
 935         mutex_unlock(&test_fw_mutex);
 936
 937         return rc;
 938 }
 939 static DEVICE_ATTR_RO(read_firmware);
 940
 941 #define TEST_FW_DEV_ATTR(name)          &dev_attr_##name.attr
 942
 943 static struct attribute *test_dev_attrs[] = {
 944         TEST_FW_DEV_ATTR(reset),
 945
 946         TEST_FW_DEV_ATTR(config),
 947         TEST_FW_DEV_ATTR(config_name),
 948         TEST_FW_DEV_ATTR(config_num_requests),
 949         TEST_FW_DEV_ATTR(config_into_buf),
 950         TEST_FW_DEV_ATTR(config_sync_direct),
 951         TEST_FW_DEV_ATTR(config_send_uevent),
 952         TEST_FW_DEV_ATTR(config_read_fw_idx),
 953
 954         /* These don't use the config at all - they could be ported! */
 955         TEST_FW_DEV_ATTR(trigger_request),
 956         TEST_FW_DEV_ATTR(trigger_async_request),
 957         TEST_FW_DEV_ATTR(trigger_custom_fallback),
 958 #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
 959         TEST_FW_DEV_ATTR(trigger_request_platform),
 960 #endif
 961
 962         /* These use the config and can use the test_result */
 963         TEST_FW_DEV_ATTR(trigger_batched_requests),
 964         TEST_FW_DEV_ATTR(trigger_batched_requests_async),
 965
 966         TEST_FW_DEV_ATTR(release_all_firmware),
 967         TEST_FW_DEV_ATTR(test_result),
 968         TEST_FW_DEV_ATTR(read_firmware),
 969         NULL,
 970 };
 971
 972 ATTRIBUTE_GROUPS(test_dev);
 973
 974 static struct miscdevice test_fw_misc_device = {
 975         .minor          = MISC_DYNAMIC_MINOR,
 976         .name           = "test_firmware",
 977         .fops           = &test_fw_fops,
 978         .groups         = test_dev_groups,
 979 };
 980
 981 static int __init test_firmware_init(void)
 982 {
 983         int rc;
 984
 985         test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
 986         if (!test_fw_config)
 987                 return -ENOMEM;
 988
 989         rc = __test_firmware_config_init();
 990         if (rc) {
 991                 kfree(test_fw_config);
 992                 pr_err("could not init firmware test config: %d\n", rc);
 993                 return rc;
 994         }
 995
 996         rc = misc_register(&test_fw_misc_device);
 997         if (rc) {
 998                 kfree(test_fw_config);
 999                 pr_err("could not register misc device: %d\n", rc);
1000                 return rc;
1001         }
1002
1003         pr_warn("interface ready\n");
1004
1005         return 0;
1006 }
1007
1008 module_init(test_firmware_init);
1009
1010 static void __exit test_firmware_exit(void)
1011 {
1012         mutex_lock(&test_fw_mutex);
1013         release_firmware(test_firmware);
1014         misc_deregister(&test_fw_misc_device);
1015         __test_firmware_config_free();
1016         kfree(test_fw_config);
1017         mutex_unlock(&test_fw_mutex);
1018
1019         pr_warn("removed interface\n");
1020 }
1021
1022 module_exit(test_firmware_exit);
1023
1024 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1025 MODULE_LICENSE("GPL");