lib/test_firmware.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This module provides an interface to trigger and test firmware loading.
   4  *
   5  * It is designed to be used for basic evaluation of the firmware loading
   6  * subsystem (for example when validating firmware verification). It lacks
   7  * any extra dependencies, and will not normally be loaded by the system
   8  * unless explicitly requested by name.
   9  */
  10
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/printk.h>
  16 #include <linux/completion.h>
  17 #include <linux/firmware.h>
  18 #include <linux/device.h>
  19 #include <linux/fs.h>
  20 #include <linux/miscdevice.h>
  21 #include <linux/sizes.h>
  22 #include <linux/slab.h>
  23 #include <linux/uaccess.h>
  24 #include <linux/delay.h>
  25 #include <linux/kthread.h>
  26 #include <linux/vmalloc.h>
  27 #include <linux/efi_embedded_fw.h>
  28
  29 #define TEST_FIRMWARE_NAME      "test-firmware.bin"
  30 #define TEST_FIRMWARE_NUM_REQS  4
  31 #define TEST_FIRMWARE_BUF_SIZE  SZ_1K
  32
  33 static DEFINE_MUTEX(test_fw_mutex);
  34 static const struct firmware *test_firmware;
  35
  36 struct test_batched_req {
  37         u8 idx;
  38         int rc;
  39         bool sent;
  40         const struct firmware *fw;
  41         const char *name;
  42         struct completion completion;
  43         struct task_struct *task;
  44         struct device *dev;
  45 };
  46
  47 /**
  48  * test_config - represents configuration for the test for different triggers
  49  *
  50  * @name: the name of the firmware file to look for
  51  * @into_buf: when the into_buf is used if this is true
  52  *      request_firmware_into_buf() will be used instead.
  53  * @sync_direct: when the sync trigger is used if this is true
  54  *      request_firmware_direct() will be used instead.
  55  * @send_uevent: whether or not to send a uevent for async requests
  56  * @num_requests: number of requests to try per test case. This is trigger
  57  *      specific.
  58  * @reqs: stores all requests information
  59  * @read_fw_idx: index of thread from which we want to read firmware results
  60  *      from through the read_fw trigger.
  61  * @test_result: a test may use this to collect the result from the call
  62  *      of the request_firmware*() calls used in their tests. In order of
  63  *      priority we always keep first any setup error. If no setup errors were
  64  *      found then we move on to the first error encountered while running the
  65  *      API. Note that for async calls this typically will be a successful
  66  *      result (0) unless of course you've used bogus parameters, or the system
  67  *      is out of memory.  In the async case the callback is expected to do a
  68  *      bit more homework to figure out what happened, unfortunately the only
  69  *      information passed today on error is the fact that no firmware was
  70  *      found so we can only assume -ENOENT on async calls if the firmware is
  71  *      NULL.
  72  *
  73  *      Errors you can expect:
  74  *
  75  *      API specific:
  76  *
  77  *      0:              success for sync, for async it means request was sent
  78  *      -EINVAL:        invalid parameters or request
  79  *      -ENOENT:        files not found
  80  *
  81  *      System environment:
  82  *
  83  *      -ENOMEM:        memory pressure on system
  84  *      -ENODEV:        out of number of devices to test
  85  *      -EINVAL:        an unexpected error has occurred
  86  * @req_firmware: if @sync_direct is true this is set to
  87  *      request_firmware_direct(), otherwise request_firmware()
  88  */
  89 struct test_config {
  90         char *name;
  91         bool into_buf;
  92         bool sync_direct;
  93         bool send_uevent;
  94         u8 num_requests;
  95         u8 read_fw_idx;
  96
  97         /*
  98          * These below don't belong her but we'll move them once we create
  99          * a struct fw_test_device and stuff the misc_dev under there later.
 100          */
 101         struct test_batched_req *reqs;
 102         int test_result;
 103         int (*req_firmware)(const struct firmware **fw, const char *name,
 104                             struct device *device);
 105 };
 106
 107 static struct test_config *test_fw_config;
 108
 109 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
 110                                  size_t size, loff_t *offset)
 111 {
 112         ssize_t rc = 0;
 113
 114         mutex_lock(&test_fw_mutex);
 115         if (test_firmware)
 116                 rc = simple_read_from_buffer(buf, size, offset,
 117                                              test_firmware->data,
 118                                              test_firmware->size);
 119         mutex_unlock(&test_fw_mutex);
 120         return rc;
 121 }
 122
 123 static const struct file_operations test_fw_fops = {
 124         .owner          = THIS_MODULE,
 125         .read           = test_fw_misc_read,
 126 };
 127
 128 static void __test_release_all_firmware(void)
 129 {
 130         struct test_batched_req *req;
 131         u8 i;
 132
 133         if (!test_fw_config->reqs)
 134                 return;
 135
 136         for (i = 0; i < test_fw_config->num_requests; i++) {
 137                 req = &test_fw_config->reqs[i];
 138                 if (req->fw)
 139                         release_firmware(req->fw);
 140         }
 141
 142         vfree(test_fw_config->reqs);
 143         test_fw_config->reqs = NULL;
 144 }
 145
 146 static void test_release_all_firmware(void)
 147 {
 148         mutex_lock(&test_fw_mutex);
 149         __test_release_all_firmware();
 150         mutex_unlock(&test_fw_mutex);
 151 }
 152
 153
 154 static void __test_firmware_config_free(void)
 155 {
 156         __test_release_all_firmware();
 157         kfree_const(test_fw_config->name);
 158         test_fw_config->name = NULL;
 159 }
 160
 161 /*
 162  * XXX: move to kstrncpy() once merged.
 163  *
 164  * Users should use kfree_const() when freeing these.
 165  */
 166 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
 167 {
 168         *dst = kstrndup(name, count, gfp);
 169         if (!*dst)
 170                 return -ENOSPC;
 171         return count;
 172 }
 173
 174 static int __test_firmware_config_init(void)
 175 {
 176         int ret;
 177
 178         ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
 179                          strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
 180         if (ret < 0)
 181                 goto out;
 182
 183         test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
 184         test_fw_config->send_uevent = true;
 185         test_fw_config->into_buf = false;
 186         test_fw_config->sync_direct = false;
 187         test_fw_config->req_firmware = request_firmware;
 188         test_fw_config->test_result = 0;
 189         test_fw_config->reqs = NULL;
 190
 191         return 0;
 192
 193 out:
 194         __test_firmware_config_free();
 195         return ret;
 196 }
 197
 198 static ssize_t reset_store(struct device *dev,
 199                            struct device_attribute *attr,
 200                            const char *buf, size_t count)
 201 {
 202         int ret;
 203
 204         mutex_lock(&test_fw_mutex);
 205
 206         __test_firmware_config_free();
 207
 208         ret = __test_firmware_config_init();
 209         if (ret < 0) {
 210                 ret = -ENOMEM;
 211                 pr_err("could not alloc settings for config trigger: %d\n",
 212                        ret);
 213                 goto out;
 214         }
 215
 216         pr_info("reset\n");
 217         ret = count;
 218
 219 out:
 220         mutex_unlock(&test_fw_mutex);
 221
 222         return ret;
 223 }
 224 static DEVICE_ATTR_WO(reset);
 225
 226 static ssize_t config_show(struct device *dev,
 227                            struct device_attribute *attr,
 228                            char *buf)
 229 {
 230         int len = 0;
 231
 232         mutex_lock(&test_fw_mutex);
 233
 234         len += scnprintf(buf, PAGE_SIZE - len,
 235                         "Custom trigger configuration for: %s\n",
 236                         dev_name(dev));
 237
 238         if (test_fw_config->name)
 239                 len += scnprintf(buf+len, PAGE_SIZE - len,
 240                                 "name:\t%s\n",
 241                                 test_fw_config->name);
 242         else
 243                 len += scnprintf(buf+len, PAGE_SIZE - len,
 244                                 "name:\tEMTPY\n");
 245
 246         len += scnprintf(buf+len, PAGE_SIZE - len,
 247                         "num_requests:\t%u\n", test_fw_config->num_requests);
 248
 249         len += scnprintf(buf+len, PAGE_SIZE - len,
 250                         "send_uevent:\t\t%s\n",
 251                         test_fw_config->send_uevent ?
 252                         "FW_ACTION_HOTPLUG" :
 253                         "FW_ACTION_NOHOTPLUG");
 254         len += scnprintf(buf+len, PAGE_SIZE - len,
 255                         "into_buf:\t\t%s\n",
 256                         test_fw_config->into_buf ? "true" : "false");
 257         len += scnprintf(buf+len, PAGE_SIZE - len,
 258                         "sync_direct:\t\t%s\n",
 259                         test_fw_config->sync_direct ? "true" : "false");
 260         len += scnprintf(buf+len, PAGE_SIZE - len,
 261                         "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
 262
 263         mutex_unlock(&test_fw_mutex);
 264
 265         return len;
 266 }
 267 static DEVICE_ATTR_RO(config);
 268
 269 static ssize_t config_name_store(struct device *dev,
 270                                  struct device_attribute *attr,
 271                                  const char *buf, size_t count)
 272 {
 273         int ret;
 274
 275         mutex_lock(&test_fw_mutex);
 276         kfree_const(test_fw_config->name);
 277         ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
 278         mutex_unlock(&test_fw_mutex);
 279
 280         return ret;
 281 }
 282
 283 /*
 284  * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
 285  */
 286 static ssize_t config_test_show_str(char *dst,
 287                                     char *src)
 288 {
 289         int len;
 290
 291         mutex_lock(&test_fw_mutex);
 292         len = snprintf(dst, PAGE_SIZE, "%s\n", src);
 293         mutex_unlock(&test_fw_mutex);
 294
 295         return len;
 296 }
 297
 298 static int test_dev_config_update_bool(const char *buf, size_t size,
 299                                        bool *cfg)
 300 {
 301         int ret;
 302
 303         mutex_lock(&test_fw_mutex);
 304         if (strtobool(buf, cfg) < 0)
 305                 ret = -EINVAL;
 306         else
 307                 ret = size;
 308         mutex_unlock(&test_fw_mutex);
 309
 310         return ret;
 311 }
 312
 313 static ssize_t test_dev_config_show_bool(char *buf, bool val)
 314 {
 315         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 316 }
 317
 318 static ssize_t test_dev_config_show_int(char *buf, int val)
 319 {
 320         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 321 }
 322
 323 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
 324 {
 325         int ret;
 326         long new;
 327
 328         ret = kstrtol(buf, 10, &new);
 329         if (ret)
 330                 return ret;
 331
 332         if (new > U8_MAX)
 333                 return -EINVAL;
 334
 335         mutex_lock(&test_fw_mutex);
 336         *(u8 *)cfg = new;
 337         mutex_unlock(&test_fw_mutex);
 338
 339         /* Always return full write size even if we didn't consume all */
 340         return size;
 341 }
 342
 343 static ssize_t test_dev_config_show_u8(char *buf, u8 val)
 344 {
 345         return snprintf(buf, PAGE_SIZE, "%u\n", val);
 346 }
 347
 348 static ssize_t config_name_show(struct device *dev,
 349                                 struct device_attribute *attr,
 350                                 char *buf)
 351 {
 352         return config_test_show_str(buf, test_fw_config->name);
 353 }
 354 static DEVICE_ATTR_RW(config_name);
 355
 356 static ssize_t config_num_requests_store(struct device *dev,
 357                                          struct device_attribute *attr,
 358                                          const char *buf, size_t count)
 359 {
 360         int rc;
 361
 362         mutex_lock(&test_fw_mutex);
 363         if (test_fw_config->reqs) {
 364                 pr_err("Must call release_all_firmware prior to changing config\n");
 365                 rc = -EINVAL;
 366                 mutex_unlock(&test_fw_mutex);
 367                 goto out;
 368         }
 369         mutex_unlock(&test_fw_mutex);
 370
 371         rc = test_dev_config_update_u8(buf, count,
 372                                        &test_fw_config->num_requests);
 373
 374 out:
 375         return rc;
 376 }
 377
 378 static ssize_t config_num_requests_show(struct device *dev,
 379                                         struct device_attribute *attr,
 380                                         char *buf)
 381 {
 382         return test_dev_config_show_u8(buf, test_fw_config->num_requests);
 383 }
 384 static DEVICE_ATTR_RW(config_num_requests);
 385
 386 static ssize_t config_into_buf_store(struct device *dev,
 387                                      struct device_attribute *attr,
 388                                      const char *buf, size_t count)
 389 {
 390         return test_dev_config_update_bool(buf,
 391                                            count,
 392                                            &test_fw_config->into_buf);
 393 }
 394
 395 static ssize_t config_into_buf_show(struct device *dev,
 396                                     struct device_attribute *attr,
 397                                     char *buf)
 398 {
 399         return test_dev_config_show_bool(buf, test_fw_config->into_buf);
 400 }
 401 static DEVICE_ATTR_RW(config_into_buf);
 402
 403 static ssize_t config_sync_direct_store(struct device *dev,
 404                                         struct device_attribute *attr,
 405                                         const char *buf, size_t count)
 406 {
 407         int rc = test_dev_config_update_bool(buf, count,
 408                                              &test_fw_config->sync_direct);
 409
 410         if (rc == count)
 411                 test_fw_config->req_firmware = test_fw_config->sync_direct ?
 412                                        request_firmware_direct :
 413                                        request_firmware;
 414         return rc;
 415 }
 416
 417 static ssize_t config_sync_direct_show(struct device *dev,
 418                                        struct device_attribute *attr,
 419                                        char *buf)
 420 {
 421         return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
 422 }
 423 static DEVICE_ATTR_RW(config_sync_direct);
 424
 425 static ssize_t config_send_uevent_store(struct device *dev,
 426                                         struct device_attribute *attr,
 427                                         const char *buf, size_t count)
 428 {
 429         return test_dev_config_update_bool(buf, count,
 430                                            &test_fw_config->send_uevent);
 431 }
 432
 433 static ssize_t config_send_uevent_show(struct device *dev,
 434                                        struct device_attribute *attr,
 435                                        char *buf)
 436 {
 437         return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
 438 }
 439 static DEVICE_ATTR_RW(config_send_uevent);
 440
 441 static ssize_t config_read_fw_idx_store(struct device *dev,
 442                                         struct device_attribute *attr,
 443                                         const char *buf, size_t count)
 444 {
 445         return test_dev_config_update_u8(buf, count,
 446                                          &test_fw_config->read_fw_idx);
 447 }
 448
 449 static ssize_t config_read_fw_idx_show(struct device *dev,
 450                                        struct device_attribute *attr,
 451                                        char *buf)
 452 {
 453         return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
 454 }
 455 static DEVICE_ATTR_RW(config_read_fw_idx);
 456
 457
 458 static ssize_t trigger_request_store(struct device *dev,
 459                                      struct device_attribute *attr,
 460                                      const char *buf, size_t count)
 461 {
 462         int rc;
 463         char *name;
 464
 465         name = kstrndup(buf, count, GFP_KERNEL);
 466         if (!name)
 467                 return -ENOSPC;
 468
 469         pr_info("loading '%s'\n", name);
 470
 471         mutex_lock(&test_fw_mutex);
 472         release_firmware(test_firmware);
 473         test_firmware = NULL;
 474         rc = request_firmware(&test_firmware, name, dev);
 475         if (rc) {
 476                 pr_info("load of '%s' failed: %d\n", name, rc);
 477                 goto out;
 478         }
 479         pr_info("loaded: %zu\n", test_firmware->size);
 480         rc = count;
 481
 482 out:
 483         mutex_unlock(&test_fw_mutex);
 484
 485         kfree(name);
 486
 487         return rc;
 488 }
 489 static DEVICE_ATTR_WO(trigger_request);
 490
 491 #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
 492 static ssize_t trigger_request_platform_store(struct device *dev,
 493                                               struct device_attribute *attr,
 494                                               const char *buf, size_t count)
 495 {
 496         static const u8 test_data[] = {
 497                 0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
 498                 0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
 499                 0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
 500                 0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
 501         };
 502         struct efi_embedded_fw efi_embedded_fw;
 503         const struct firmware *firmware = NULL;
 504         char *name;
 505         int rc;
 506
 507         name = kstrndup(buf, count, GFP_KERNEL);
 508         if (!name)
 509                 return -ENOSPC;
 510
 511         pr_info("inserting test platform fw '%s'\n", name);
 512         efi_embedded_fw.name = name;
 513         efi_embedded_fw.data = (void *)test_data;
 514         efi_embedded_fw.length = sizeof(test_data);
 515         list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
 516
 517         pr_info("loading '%s'\n", name);
 518         rc = firmware_request_platform(&firmware, name, dev);
 519         if (rc) {
 520                 pr_info("load of '%s' failed: %d\n", name, rc);
 521                 goto out;
 522         }
 523         if (firmware->size != sizeof(test_data) ||
 524             memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
 525                 pr_info("firmware contents mismatch for '%s'\n", name);
 526                 rc = -EINVAL;
 527                 goto out;
 528         }
 529         pr_info("loaded: %zu\n", firmware->size);
 530         rc = count;
 531
 532 out:
 533         release_firmware(firmware);
 534         list_del(&efi_embedded_fw.list);
 535         kfree(name);
 536
 537         return rc;
 538 }
 539 static DEVICE_ATTR_WO(trigger_request_platform);
 540 #endif
 541
 542 static DECLARE_COMPLETION(async_fw_done);
 543
 544 static void trigger_async_request_cb(const struct firmware *fw, void *context)
 545 {
 546         test_firmware = fw;
 547         complete(&async_fw_done);
 548 }
 549
 550 static ssize_t trigger_async_request_store(struct device *dev,
 551                                            struct device_attribute *attr,
 552                                            const char *buf, size_t count)
 553 {
 554         int rc;
 555         char *name;
 556
 557         name = kstrndup(buf, count, GFP_KERNEL);
 558         if (!name)
 559                 return -ENOSPC;
 560
 561         pr_info("loading '%s'\n", name);
 562
 563         mutex_lock(&test_fw_mutex);
 564         release_firmware(test_firmware);
 565         test_firmware = NULL;
 566         rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
 567                                      NULL, trigger_async_request_cb);
 568         if (rc) {
 569                 pr_info("async load of '%s' failed: %d\n", name, rc);
 570                 kfree(name);
 571                 goto out;
 572         }
 573         /* Free 'name' ASAP, to test for race conditions */
 574         kfree(name);
 575
 576         wait_for_completion(&async_fw_done);
 577
 578         if (test_firmware) {
 579                 pr_info("loaded: %zu\n", test_firmware->size);
 580                 rc = count;
 581         } else {
 582                 pr_err("failed to async load firmware\n");
 583                 rc = -ENOMEM;
 584         }
 585
 586 out:
 587         mutex_unlock(&test_fw_mutex);
 588
 589         return rc;
 590 }
 591 static DEVICE_ATTR_WO(trigger_async_request);
 592
 593 static ssize_t trigger_custom_fallback_store(struct device *dev,
 594                                              struct device_attribute *attr,
 595                                              const char *buf, size_t count)
 596 {
 597         int rc;
 598         char *name;
 599
 600         name = kstrndup(buf, count, GFP_KERNEL);
 601         if (!name)
 602                 return -ENOSPC;
 603
 604         pr_info("loading '%s' using custom fallback mechanism\n", name);
 605
 606         mutex_lock(&test_fw_mutex);
 607         release_firmware(test_firmware);
 608         test_firmware = NULL;
 609         rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
 610                                      dev, GFP_KERNEL, NULL,
 611                                      trigger_async_request_cb);
 612         if (rc) {
 613                 pr_info("async load of '%s' failed: %d\n", name, rc);
 614                 kfree(name);
 615                 goto out;
 616         }
 617         /* Free 'name' ASAP, to test for race conditions */
 618         kfree(name);
 619
 620         wait_for_completion(&async_fw_done);
 621
 622         if (test_firmware) {
 623                 pr_info("loaded: %zu\n", test_firmware->size);
 624                 rc = count;
 625         } else {
 626                 pr_err("failed to async load firmware\n");
 627                 rc = -ENODEV;
 628         }
 629
 630 out:
 631         mutex_unlock(&test_fw_mutex);
 632
 633         return rc;
 634 }
 635 static DEVICE_ATTR_WO(trigger_custom_fallback);
 636
 637 static int test_fw_run_batch_request(void *data)
 638 {
 639         struct test_batched_req *req = data;
 640
 641         if (!req) {
 642                 test_fw_config->test_result = -EINVAL;
 643                 return -EINVAL;
 644         }
 645
 646         if (test_fw_config->into_buf) {
 647                 void *test_buf;
 648
 649                 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
 650                 if (!test_buf)
 651                         return -ENOSPC;
 652
 653                 req->rc = request_firmware_into_buf(&req->fw,
 654                                                     req->name,
 655                                                     req->dev,
 656                                                     test_buf,
 657                                                     TEST_FIRMWARE_BUF_SIZE);
 658                 if (!req->fw)
 659                         kfree(test_buf);
 660         } else {
 661                 req->rc = test_fw_config->req_firmware(&req->fw,
 662                                                        req->name,
 663                                                        req->dev);
 664         }
 665
 666         if (req->rc) {
 667                 pr_info("#%u: batched sync load failed: %d\n",
 668                         req->idx, req->rc);
 669                 if (!test_fw_config->test_result)
 670                         test_fw_config->test_result = req->rc;
 671         } else if (req->fw) {
 672                 req->sent = true;
 673                 pr_info("#%u: batched sync loaded %zu\n",
 674                         req->idx, req->fw->size);
 675         }
 676         complete(&req->completion);
 677
 678         req->task = NULL;
 679
 680         return 0;
 681 }
 682
 683 /*
 684  * We use a kthread as otherwise the kernel serializes all our sync requests
 685  * and we would not be able to mimic batched requests on a sync call. Batched
 686  * requests on a sync call can for instance happen on a device driver when
 687  * multiple cards are used and firmware loading happens outside of probe.
 688  */
 689 static ssize_t trigger_batched_requests_store(struct device *dev,
 690                                               struct device_attribute *attr,
 691                                               const char *buf, size_t count)
 692 {
 693         struct test_batched_req *req;
 694         int rc;
 695         u8 i;
 696
 697         mutex_lock(&test_fw_mutex);
 698
 699         test_fw_config->reqs =
 700                 vzalloc(array3_size(sizeof(struct test_batched_req),
 701                                     test_fw_config->num_requests, 2));
 702         if (!test_fw_config->reqs) {
 703                 rc = -ENOMEM;
 704                 goto out_unlock;
 705         }
 706
 707         pr_info("batched sync firmware loading '%s' %u times\n",
 708                 test_fw_config->name, test_fw_config->num_requests);
 709
 710         for (i = 0; i < test_fw_config->num_requests; i++) {
 711                 req = &test_fw_config->reqs[i];
 712                 req->fw = NULL;
 713                 req->idx = i;
 714                 req->name = test_fw_config->name;
 715                 req->dev = dev;
 716                 init_completion(&req->completion);
 717                 req->task = kthread_run(test_fw_run_batch_request, req,
 718                                              "%s-%u", KBUILD_MODNAME, req->idx);
 719                 if (!req->task || IS_ERR(req->task)) {
 720                         pr_err("Setting up thread %u failed\n", req->idx);
 721                         req->task = NULL;
 722                         rc = -ENOMEM;
 723                         goto out_bail;
 724                 }
 725         }
 726
 727         rc = count;
 728
 729         /*
 730          * We require an explicit release to enable more time and delay of
 731          * calling release_firmware() to improve our chances of forcing a
 732          * batched request. If we instead called release_firmware() right away
 733          * then we might miss on an opportunity of having a successful firmware
 734          * request pass on the opportunity to be come a batched request.
 735          */
 736
 737 out_bail:
 738         for (i = 0; i < test_fw_config->num_requests; i++) {
 739                 req = &test_fw_config->reqs[i];
 740                 if (req->task || req->sent)
 741                         wait_for_completion(&req->completion);
 742         }
 743
 744         /* Override any worker error if we had a general setup error */
 745         if (rc < 0)
 746                 test_fw_config->test_result = rc;
 747
 748 out_unlock:
 749         mutex_unlock(&test_fw_mutex);
 750
 751         return rc;
 752 }
 753 static DEVICE_ATTR_WO(trigger_batched_requests);
 754
 755 /*
 756  * We wait for each callback to return with the lock held, no need to lock here
 757  */
 758 static void trigger_batched_cb(const struct firmware *fw, void *context)
 759 {
 760         struct test_batched_req *req = context;
 761
 762         if (!req) {
 763                 test_fw_config->test_result = -EINVAL;
 764                 return;
 765         }
 766
 767         /* forces *some* batched requests to queue up */
 768         if (!req->idx)
 769                 ssleep(2);
 770
 771         req->fw = fw;
 772
 773         /*
 774          * Unfortunately the firmware API gives us nothing other than a null FW
 775          * if the firmware was not found on async requests.  Best we can do is
 776          * just assume -ENOENT. A better API would pass the actual return
 777          * value to the callback.
 778          */
 779         if (!fw && !test_fw_config->test_result)
 780                 test_fw_config->test_result = -ENOENT;
 781
 782         complete(&req->completion);
 783 }
 784
 785 static
 786 ssize_t trigger_batched_requests_async_store(struct device *dev,
 787                                              struct device_attribute *attr,
 788                                              const char *buf, size_t count)
 789 {
 790         struct test_batched_req *req;
 791         bool send_uevent;
 792         int rc;
 793         u8 i;
 794
 795         mutex_lock(&test_fw_mutex);
 796
 797         test_fw_config->reqs =
 798                 vzalloc(array3_size(sizeof(struct test_batched_req),
 799                                     test_fw_config->num_requests, 2));
 800         if (!test_fw_config->reqs) {
 801                 rc = -ENOMEM;
 802                 goto out;
 803         }
 804
 805         pr_info("batched loading '%s' custom fallback mechanism %u times\n",
 806                 test_fw_config->name, test_fw_config->num_requests);
 807
 808         send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
 809                 FW_ACTION_NOHOTPLUG;
 810
 811         for (i = 0; i < test_fw_config->num_requests; i++) {
 812                 req = &test_fw_config->reqs[i];
 813                 req->name = test_fw_config->name;
 814                 req->fw = NULL;
 815                 req->idx = i;
 816                 init_completion(&req->completion);
 817                 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
 818                                              req->name,
 819                                              dev, GFP_KERNEL, req,
 820                                              trigger_batched_cb);
 821                 if (rc) {
 822                         pr_info("#%u: batched async load failed setup: %d\n",
 823                                 i, rc);
 824                         req->rc = rc;
 825                         goto out_bail;
 826                 } else
 827                         req->sent = true;
 828         }
 829
 830         rc = count;
 831
 832 out_bail:
 833
 834         /*
 835          * We require an explicit release to enable more time and delay of
 836          * calling release_firmware() to improve our chances of forcing a
 837          * batched request. If we instead called release_firmware() right away
 838          * then we might miss on an opportunity of having a successful firmware
 839          * request pass on the opportunity to be come a batched request.
 840          */
 841
 842         for (i = 0; i < test_fw_config->num_requests; i++) {
 843                 req = &test_fw_config->reqs[i];
 844                 if (req->sent)
 845                         wait_for_completion(&req->completion);
 846         }
 847
 848         /* Override any worker error if we had a general setup error */
 849         if (rc < 0)
 850                 test_fw_config->test_result = rc;
 851
 852 out:
 853         mutex_unlock(&test_fw_mutex);
 854
 855         return rc;
 856 }
 857 static DEVICE_ATTR_WO(trigger_batched_requests_async);
 858
 859 static ssize_t test_result_show(struct device *dev,
 860                                 struct device_attribute *attr,
 861                                 char *buf)
 862 {
 863         return test_dev_config_show_int(buf, test_fw_config->test_result);
 864 }
 865 static DEVICE_ATTR_RO(test_result);
 866
 867 static ssize_t release_all_firmware_store(struct device *dev,
 868                                           struct device_attribute *attr,
 869                                           const char *buf, size_t count)
 870 {
 871         test_release_all_firmware();
 872         return count;
 873 }
 874 static DEVICE_ATTR_WO(release_all_firmware);
 875
 876 static ssize_t read_firmware_show(struct device *dev,
 877                                   struct device_attribute *attr,
 878                                   char *buf)
 879 {
 880         struct test_batched_req *req;
 881         u8 idx;
 882         ssize_t rc = 0;
 883
 884         mutex_lock(&test_fw_mutex);
 885
 886         idx = test_fw_config->read_fw_idx;
 887         if (idx >= test_fw_config->num_requests) {
 888                 rc = -ERANGE;
 889                 goto out;
 890         }
 891
 892         if (!test_fw_config->reqs) {
 893                 rc = -EINVAL;
 894                 goto out;
 895         }
 896
 897         req = &test_fw_config->reqs[idx];
 898         if (!req->fw) {
 899                 pr_err("#%u: failed to async load firmware\n", idx);
 900                 rc = -ENOENT;
 901                 goto out;
 902         }
 903
 904         pr_info("#%u: loaded %zu\n", idx, req->fw->size);
 905
 906         if (req->fw->size > PAGE_SIZE) {
 907                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
 908                 rc = -EINVAL;
 909                 goto out;
 910         }
 911         memcpy(buf, req->fw->data, req->fw->size);
 912
 913         rc = req->fw->size;
 914 out:
 915         mutex_unlock(&test_fw_mutex);
 916
 917         return rc;
 918 }
 919 static DEVICE_ATTR_RO(read_firmware);
 920
 921 #define TEST_FW_DEV_ATTR(name)          &dev_attr_##name.attr
 922
 923 static struct attribute *test_dev_attrs[] = {
 924         TEST_FW_DEV_ATTR(reset),
 925
 926         TEST_FW_DEV_ATTR(config),
 927         TEST_FW_DEV_ATTR(config_name),
 928         TEST_FW_DEV_ATTR(config_num_requests),
 929         TEST_FW_DEV_ATTR(config_into_buf),
 930         TEST_FW_DEV_ATTR(config_sync_direct),
 931         TEST_FW_DEV_ATTR(config_send_uevent),
 932         TEST_FW_DEV_ATTR(config_read_fw_idx),
 933
 934         /* These don't use the config at all - they could be ported! */
 935         TEST_FW_DEV_ATTR(trigger_request),
 936         TEST_FW_DEV_ATTR(trigger_async_request),
 937         TEST_FW_DEV_ATTR(trigger_custom_fallback),
 938 #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
 939         TEST_FW_DEV_ATTR(trigger_request_platform),
 940 #endif
 941
 942         /* These use the config and can use the test_result */
 943         TEST_FW_DEV_ATTR(trigger_batched_requests),
 944         TEST_FW_DEV_ATTR(trigger_batched_requests_async),
 945
 946         TEST_FW_DEV_ATTR(release_all_firmware),
 947         TEST_FW_DEV_ATTR(test_result),
 948         TEST_FW_DEV_ATTR(read_firmware),
 949         NULL,
 950 };
 951
 952 ATTRIBUTE_GROUPS(test_dev);
 953
 954 static struct miscdevice test_fw_misc_device = {
 955         .minor          = MISC_DYNAMIC_MINOR,
 956         .name           = "test_firmware",
 957         .fops           = &test_fw_fops,
 958         .groups         = test_dev_groups,
 959 };
 960
 961 static int __init test_firmware_init(void)
 962 {
 963         int rc;
 964
 965         test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
 966         if (!test_fw_config)
 967                 return -ENOMEM;
 968
 969         rc = __test_firmware_config_init();
 970         if (rc) {
 971                 kfree(test_fw_config);
 972                 pr_err("could not init firmware test config: %d\n", rc);
 973                 return rc;
 974         }
 975
 976         rc = misc_register(&test_fw_misc_device);
 977         if (rc) {
 978                 kfree(test_fw_config);
 979                 pr_err("could not register misc device: %d\n", rc);
 980                 return rc;
 981         }
 982
 983         pr_warn("interface ready\n");
 984
 985         return 0;
 986 }
 987
 988 module_init(test_firmware_init);
 989
 990 static void __exit test_firmware_exit(void)
 991 {
 992         mutex_lock(&test_fw_mutex);
 993         release_firmware(test_firmware);
 994         misc_deregister(&test_fw_misc_device);
 995         __test_firmware_config_free();
 996         kfree(test_fw_config);
 997         mutex_unlock(&test_fw_mutex);
 998
 999         pr_warn("removed interface\n");
1000 }
1001
1002 module_exit(test_firmware_exit);
1003
1004 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1005 MODULE_LICENSE("GPL");