1  // SPDX-License-Identifier: GPL-2.0-only
2  /*
3   * This module provides an interface to trigger and test firmware loading.
4   *
5   * It is designed to be used for basic evaluation of the firmware loading
6   * subsystem (for example when validating firmware verification). It lacks
7   * any extra dependencies, and will not normally be loaded by the system
8   * unless explicitly requested by name.
9   */
10  
11  #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12  
13  #include <linux/init.h>
14  #include <linux/module.h>
15  #include <linux/printk.h>
16  #include <linux/completion.h>
17  #include <linux/firmware.h>
18  #include <linux/device.h>
19  #include <linux/fs.h>
20  #include <linux/miscdevice.h>
21  #include <linux/sizes.h>
22  #include <linux/slab.h>
23  #include <linux/uaccess.h>
24  #include <linux/delay.h>
25  #include <linux/kstrtox.h>
26  #include <linux/kthread.h>
27  #include <linux/vmalloc.h>
28  #include <linux/efi_embedded_fw.h>
29  
30  MODULE_IMPORT_NS(TEST_FIRMWARE);
31  
32  #define TEST_FIRMWARE_NAME	"test-firmware.bin"
33  #define TEST_FIRMWARE_NUM_REQS	4
34  #define TEST_FIRMWARE_BUF_SIZE	SZ_1K
35  #define TEST_UPLOAD_MAX_SIZE	SZ_2K
36  #define TEST_UPLOAD_BLK_SIZE	37	/* Avoid powers of two in testing */
37  
38  static DEFINE_MUTEX(test_fw_mutex);
39  static const struct firmware *test_firmware;
40  static LIST_HEAD(test_upload_list);
41  
42  struct test_batched_req {
43  	u8 idx;
44  	int rc;
45  	bool sent;
46  	const struct firmware *fw;
47  	const char *name;
48  	const char *fw_buf;
49  	struct completion completion;
50  	struct task_struct *task;
51  	struct device *dev;
52  };
53  
54  /**
55   * struct test_config - represents configuration for the test for different triggers
56   *
57   * @name: the name of the firmware file to look for
58   * @into_buf: when the into_buf is used if this is true
59   *	request_firmware_into_buf() will be used instead.
60   * @buf_size: size of buf to allocate when into_buf is true
61   * @file_offset: file offset to request when calling request_firmware_into_buf
62   * @partial: partial read opt when calling request_firmware_into_buf
63   * @sync_direct: when the sync trigger is used if this is true
64   *	request_firmware_direct() will be used instead.
65   * @send_uevent: whether or not to send a uevent for async requests
66   * @num_requests: number of requests to try per test case. This is trigger
67   *	specific.
68   * @reqs: stores all requests information
69   * @read_fw_idx: index of thread from which we want to read firmware results
70   *	from through the read_fw trigger.
71   * @upload_name: firmware name to be used with upload_read sysfs node
72   * @test_result: a test may use this to collect the result from the call
73   *	of the request_firmware*() calls used in their tests. In order of
74   *	priority we always keep first any setup error. If no setup errors were
75   *	found then we move on to the first error encountered while running the
76   *	API. Note that for async calls this typically will be a successful
77   *	result (0) unless of course you've used bogus parameters, or the system
78   *	is out of memory.  In the async case the callback is expected to do a
79   *	bit more homework to figure out what happened, unfortunately the only
80   *	information passed today on error is the fact that no firmware was
81   *	found so we can only assume -ENOENT on async calls if the firmware is
82   *	NULL.
83   *
84   *	Errors you can expect:
85   *
86   *	API specific:
87   *
88   *	0:		success for sync, for async it means request was sent
89   *	-EINVAL:	invalid parameters or request
90   *	-ENOENT:	files not found
91   *
92   *	System environment:
93   *
94   *	-ENOMEM:	memory pressure on system
95   *	-ENODEV:	out of number of devices to test
96   *	-EINVAL:	an unexpected error has occurred
97   * @req_firmware: if @sync_direct is true this is set to
98   *	request_firmware_direct(), otherwise request_firmware()
99   */
100  struct test_config {
101  	char *name;
102  	bool into_buf;
103  	size_t buf_size;
104  	size_t file_offset;
105  	bool partial;
106  	bool sync_direct;
107  	bool send_uevent;
108  	u8 num_requests;
109  	u8 read_fw_idx;
110  	char *upload_name;
111  
112  	/*
113  	 * These below don't belong her but we'll move them once we create
114  	 * a struct fw_test_device and stuff the misc_dev under there later.
115  	 */
116  	struct test_batched_req *reqs;
117  	int test_result;
118  	int (*req_firmware)(const struct firmware **fw, const char *name,
119  			    struct device *device);
120  };
121  
122  struct upload_inject_err {
123  	const char *prog;
124  	enum fw_upload_err err_code;
125  };
126  
127  struct test_firmware_upload {
128  	char *name;
129  	struct list_head node;
130  	char *buf;
131  	size_t size;
132  	bool cancel_request;
133  	struct upload_inject_err inject;
134  	struct fw_upload *fwl;
135  };
136  
137  static struct test_config *test_fw_config;
138  
upload_lookup_name(const char * name)139  static struct test_firmware_upload *upload_lookup_name(const char *name)
140  {
141  	struct test_firmware_upload *tst;
142  
143  	list_for_each_entry(tst, &test_upload_list, node)
144  		if (strncmp(name, tst->name, strlen(tst->name)) == 0)
145  			return tst;
146  
147  	return NULL;
148  }
149  
test_fw_misc_read(struct file * f,char __user * buf,size_t size,loff_t * offset)150  static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
151  				 size_t size, loff_t *offset)
152  {
153  	ssize_t rc = 0;
154  
155  	mutex_lock(&test_fw_mutex);
156  	if (test_firmware)
157  		rc = simple_read_from_buffer(buf, size, offset,
158  					     test_firmware->data,
159  					     test_firmware->size);
160  	mutex_unlock(&test_fw_mutex);
161  	return rc;
162  }
163  
164  static const struct file_operations test_fw_fops = {
165  	.owner          = THIS_MODULE,
166  	.read           = test_fw_misc_read,
167  };
168  
__test_release_all_firmware(void)169  static void __test_release_all_firmware(void)
170  {
171  	struct test_batched_req *req;
172  	u8 i;
173  
174  	if (!test_fw_config->reqs)
175  		return;
176  
177  	for (i = 0; i < test_fw_config->num_requests; i++) {
178  		req = &test_fw_config->reqs[i];
179  		if (req->fw) {
180  			if (req->fw_buf) {
181  				kfree_const(req->fw_buf);
182  				req->fw_buf = NULL;
183  			}
184  			release_firmware(req->fw);
185  			req->fw = NULL;
186  		}
187  	}
188  
189  	vfree(test_fw_config->reqs);
190  	test_fw_config->reqs = NULL;
191  }
192  
test_release_all_firmware(void)193  static void test_release_all_firmware(void)
194  {
195  	mutex_lock(&test_fw_mutex);
196  	__test_release_all_firmware();
197  	mutex_unlock(&test_fw_mutex);
198  }
199  
200  
__test_firmware_config_free(void)201  static void __test_firmware_config_free(void)
202  {
203  	__test_release_all_firmware();
204  	kfree_const(test_fw_config->name);
205  	test_fw_config->name = NULL;
206  }
207  
208  /*
209   * XXX: move to kstrncpy() once merged.
210   *
211   * Users should use kfree_const() when freeing these.
212   */
__kstrncpy(char ** dst,const char * name,size_t count,gfp_t gfp)213  static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
214  {
215  	*dst = kstrndup(name, count, gfp);
216  	if (!*dst)
217  		return -ENOMEM;
218  	return count;
219  }
220  
__test_firmware_config_init(void)221  static int __test_firmware_config_init(void)
222  {
223  	int ret;
224  
225  	ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
226  			 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
227  	if (ret < 0)
228  		goto out;
229  
230  	test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
231  	test_fw_config->send_uevent = true;
232  	test_fw_config->into_buf = false;
233  	test_fw_config->buf_size = TEST_FIRMWARE_BUF_SIZE;
234  	test_fw_config->file_offset = 0;
235  	test_fw_config->partial = false;
236  	test_fw_config->sync_direct = false;
237  	test_fw_config->req_firmware = request_firmware;
238  	test_fw_config->test_result = 0;
239  	test_fw_config->reqs = NULL;
240  	test_fw_config->upload_name = NULL;
241  
242  	return 0;
243  
244  out:
245  	__test_firmware_config_free();
246  	return ret;
247  }
248  
reset_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)249  static ssize_t reset_store(struct device *dev,
250  			   struct device_attribute *attr,
251  			   const char *buf, size_t count)
252  {
253  	int ret;
254  
255  	mutex_lock(&test_fw_mutex);
256  
257  	__test_firmware_config_free();
258  
259  	ret = __test_firmware_config_init();
260  	if (ret < 0) {
261  		ret = -ENOMEM;
262  		pr_err("could not alloc settings for config trigger: %d\n",
263  		       ret);
264  		goto out;
265  	}
266  
267  	pr_info("reset\n");
268  	ret = count;
269  
270  out:
271  	mutex_unlock(&test_fw_mutex);
272  
273  	return ret;
274  }
275  static DEVICE_ATTR_WO(reset);
276  
config_show(struct device * dev,struct device_attribute * attr,char * buf)277  static ssize_t config_show(struct device *dev,
278  			   struct device_attribute *attr,
279  			   char *buf)
280  {
281  	int len = 0;
282  
283  	mutex_lock(&test_fw_mutex);
284  
285  	len += scnprintf(buf, PAGE_SIZE - len,
286  			"Custom trigger configuration for: %s\n",
287  			dev_name(dev));
288  
289  	if (test_fw_config->name)
290  		len += scnprintf(buf + len, PAGE_SIZE - len,
291  				"name:\t%s\n",
292  				test_fw_config->name);
293  	else
294  		len += scnprintf(buf + len, PAGE_SIZE - len,
295  				"name:\tEMPTY\n");
296  
297  	len += scnprintf(buf + len, PAGE_SIZE - len,
298  			"num_requests:\t%u\n", test_fw_config->num_requests);
299  
300  	len += scnprintf(buf + len, PAGE_SIZE - len,
301  			"send_uevent:\t\t%s\n",
302  			test_fw_config->send_uevent ?
303  			"FW_ACTION_UEVENT" :
304  			"FW_ACTION_NOUEVENT");
305  	len += scnprintf(buf + len, PAGE_SIZE - len,
306  			"into_buf:\t\t%s\n",
307  			test_fw_config->into_buf ? "true" : "false");
308  	len += scnprintf(buf + len, PAGE_SIZE - len,
309  			"buf_size:\t%zu\n", test_fw_config->buf_size);
310  	len += scnprintf(buf + len, PAGE_SIZE - len,
311  			"file_offset:\t%zu\n", test_fw_config->file_offset);
312  	len += scnprintf(buf + len, PAGE_SIZE - len,
313  			"partial:\t\t%s\n",
314  			test_fw_config->partial ? "true" : "false");
315  	len += scnprintf(buf + len, PAGE_SIZE - len,
316  			"sync_direct:\t\t%s\n",
317  			test_fw_config->sync_direct ? "true" : "false");
318  	len += scnprintf(buf + len, PAGE_SIZE - len,
319  			"read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
320  	if (test_fw_config->upload_name)
321  		len += scnprintf(buf + len, PAGE_SIZE - len,
322  				"upload_name:\t%s\n",
323  				test_fw_config->upload_name);
324  	else
325  		len += scnprintf(buf + len, PAGE_SIZE - len,
326  				"upload_name:\tEMPTY\n");
327  
328  	mutex_unlock(&test_fw_mutex);
329  
330  	return len;
331  }
332  static DEVICE_ATTR_RO(config);
333  
config_name_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)334  static ssize_t config_name_store(struct device *dev,
335  				 struct device_attribute *attr,
336  				 const char *buf, size_t count)
337  {
338  	int ret;
339  
340  	mutex_lock(&test_fw_mutex);
341  	kfree_const(test_fw_config->name);
342  	ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
343  	mutex_unlock(&test_fw_mutex);
344  
345  	return ret;
346  }
347  
348  /*
349   * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
350   */
config_test_show_str(char * dst,char * src)351  static ssize_t config_test_show_str(char *dst,
352  				    char *src)
353  {
354  	int len;
355  
356  	mutex_lock(&test_fw_mutex);
357  	len = snprintf(dst, PAGE_SIZE, "%s\n", src);
358  	mutex_unlock(&test_fw_mutex);
359  
360  	return len;
361  }
362  
__test_dev_config_update_bool(const char * buf,size_t size,bool * cfg)363  static inline int __test_dev_config_update_bool(const char *buf, size_t size,
364  				       bool *cfg)
365  {
366  	int ret;
367  
368  	if (kstrtobool(buf, cfg) < 0)
369  		ret = -EINVAL;
370  	else
371  		ret = size;
372  
373  	return ret;
374  }
375  
test_dev_config_update_bool(const char * buf,size_t size,bool * cfg)376  static int test_dev_config_update_bool(const char *buf, size_t size,
377  				       bool *cfg)
378  {
379  	int ret;
380  
381  	mutex_lock(&test_fw_mutex);
382  	ret = __test_dev_config_update_bool(buf, size, cfg);
383  	mutex_unlock(&test_fw_mutex);
384  
385  	return ret;
386  }
387  
test_dev_config_show_bool(char * buf,bool val)388  static ssize_t test_dev_config_show_bool(char *buf, bool val)
389  {
390  	return snprintf(buf, PAGE_SIZE, "%d\n", val);
391  }
392  
__test_dev_config_update_size_t(const char * buf,size_t size,size_t * cfg)393  static int __test_dev_config_update_size_t(
394  					 const char *buf,
395  					 size_t size,
396  					 size_t *cfg)
397  {
398  	int ret;
399  	long new;
400  
401  	ret = kstrtol(buf, 10, &new);
402  	if (ret)
403  		return ret;
404  
405  	*(size_t *)cfg = new;
406  
407  	/* Always return full write size even if we didn't consume all */
408  	return size;
409  }
410  
test_dev_config_show_size_t(char * buf,size_t val)411  static ssize_t test_dev_config_show_size_t(char *buf, size_t val)
412  {
413  	return snprintf(buf, PAGE_SIZE, "%zu\n", val);
414  }
415  
test_dev_config_show_int(char * buf,int val)416  static ssize_t test_dev_config_show_int(char *buf, int val)
417  {
418  	return snprintf(buf, PAGE_SIZE, "%d\n", val);
419  }
420  
__test_dev_config_update_u8(const char * buf,size_t size,u8 * cfg)421  static int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
422  {
423  	u8 val;
424  	int ret;
425  
426  	ret = kstrtou8(buf, 10, &val);
427  	if (ret)
428  		return ret;
429  
430  	*(u8 *)cfg = val;
431  
432  	/* Always return full write size even if we didn't consume all */
433  	return size;
434  }
435  
test_dev_config_update_u8(const char * buf,size_t size,u8 * cfg)436  static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
437  {
438  	int ret;
439  
440  	mutex_lock(&test_fw_mutex);
441  	ret = __test_dev_config_update_u8(buf, size, cfg);
442  	mutex_unlock(&test_fw_mutex);
443  
444  	return ret;
445  }
446  
test_dev_config_show_u8(char * buf,u8 val)447  static ssize_t test_dev_config_show_u8(char *buf, u8 val)
448  {
449  	return snprintf(buf, PAGE_SIZE, "%u\n", val);
450  }
451  
config_name_show(struct device * dev,struct device_attribute * attr,char * buf)452  static ssize_t config_name_show(struct device *dev,
453  				struct device_attribute *attr,
454  				char *buf)
455  {
456  	return config_test_show_str(buf, test_fw_config->name);
457  }
458  static DEVICE_ATTR_RW(config_name);
459  
config_upload_name_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)460  static ssize_t config_upload_name_store(struct device *dev,
461  					struct device_attribute *attr,
462  					const char *buf, size_t count)
463  {
464  	struct test_firmware_upload *tst;
465  	int ret = count;
466  
467  	mutex_lock(&test_fw_mutex);
468  	tst = upload_lookup_name(buf);
469  	if (tst)
470  		test_fw_config->upload_name = tst->name;
471  	else
472  		ret = -EINVAL;
473  	mutex_unlock(&test_fw_mutex);
474  
475  	return ret;
476  }
477  
config_upload_name_show(struct device * dev,struct device_attribute * attr,char * buf)478  static ssize_t config_upload_name_show(struct device *dev,
479  				       struct device_attribute *attr,
480  				       char *buf)
481  {
482  	return config_test_show_str(buf, test_fw_config->upload_name);
483  }
484  static DEVICE_ATTR_RW(config_upload_name);
485  
config_num_requests_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)486  static ssize_t config_num_requests_store(struct device *dev,
487  					 struct device_attribute *attr,
488  					 const char *buf, size_t count)
489  {
490  	int rc;
491  
492  	mutex_lock(&test_fw_mutex);
493  	if (test_fw_config->reqs) {
494  		pr_err("Must call release_all_firmware prior to changing config\n");
495  		rc = -EINVAL;
496  		mutex_unlock(&test_fw_mutex);
497  		goto out;
498  	}
499  
500  	rc = __test_dev_config_update_u8(buf, count,
501  					 &test_fw_config->num_requests);
502  	mutex_unlock(&test_fw_mutex);
503  
504  out:
505  	return rc;
506  }
507  
config_num_requests_show(struct device * dev,struct device_attribute * attr,char * buf)508  static ssize_t config_num_requests_show(struct device *dev,
509  					struct device_attribute *attr,
510  					char *buf)
511  {
512  	return test_dev_config_show_u8(buf, test_fw_config->num_requests);
513  }
514  static DEVICE_ATTR_RW(config_num_requests);
515  
config_into_buf_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)516  static ssize_t config_into_buf_store(struct device *dev,
517  				     struct device_attribute *attr,
518  				     const char *buf, size_t count)
519  {
520  	return test_dev_config_update_bool(buf,
521  					   count,
522  					   &test_fw_config->into_buf);
523  }
524  
config_into_buf_show(struct device * dev,struct device_attribute * attr,char * buf)525  static ssize_t config_into_buf_show(struct device *dev,
526  				    struct device_attribute *attr,
527  				    char *buf)
528  {
529  	return test_dev_config_show_bool(buf, test_fw_config->into_buf);
530  }
531  static DEVICE_ATTR_RW(config_into_buf);
532  
config_buf_size_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)533  static ssize_t config_buf_size_store(struct device *dev,
534  				     struct device_attribute *attr,
535  				     const char *buf, size_t count)
536  {
537  	int rc;
538  
539  	mutex_lock(&test_fw_mutex);
540  	if (test_fw_config->reqs) {
541  		pr_err("Must call release_all_firmware prior to changing config\n");
542  		rc = -EINVAL;
543  		mutex_unlock(&test_fw_mutex);
544  		goto out;
545  	}
546  
547  	rc = __test_dev_config_update_size_t(buf, count,
548  					     &test_fw_config->buf_size);
549  	mutex_unlock(&test_fw_mutex);
550  
551  out:
552  	return rc;
553  }
554  
config_buf_size_show(struct device * dev,struct device_attribute * attr,char * buf)555  static ssize_t config_buf_size_show(struct device *dev,
556  				    struct device_attribute *attr,
557  				    char *buf)
558  {
559  	return test_dev_config_show_size_t(buf, test_fw_config->buf_size);
560  }
561  static DEVICE_ATTR_RW(config_buf_size);
562  
config_file_offset_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)563  static ssize_t config_file_offset_store(struct device *dev,
564  					struct device_attribute *attr,
565  					const char *buf, size_t count)
566  {
567  	int rc;
568  
569  	mutex_lock(&test_fw_mutex);
570  	if (test_fw_config->reqs) {
571  		pr_err("Must call release_all_firmware prior to changing config\n");
572  		rc = -EINVAL;
573  		mutex_unlock(&test_fw_mutex);
574  		goto out;
575  	}
576  
577  	rc = __test_dev_config_update_size_t(buf, count,
578  					     &test_fw_config->file_offset);
579  	mutex_unlock(&test_fw_mutex);
580  
581  out:
582  	return rc;
583  }
584  
config_file_offset_show(struct device * dev,struct device_attribute * attr,char * buf)585  static ssize_t config_file_offset_show(struct device *dev,
586  				       struct device_attribute *attr,
587  				       char *buf)
588  {
589  	return test_dev_config_show_size_t(buf, test_fw_config->file_offset);
590  }
591  static DEVICE_ATTR_RW(config_file_offset);
592  
config_partial_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)593  static ssize_t config_partial_store(struct device *dev,
594  				    struct device_attribute *attr,
595  				    const char *buf, size_t count)
596  {
597  	return test_dev_config_update_bool(buf,
598  					   count,
599  					   &test_fw_config->partial);
600  }
601  
config_partial_show(struct device * dev,struct device_attribute * attr,char * buf)602  static ssize_t config_partial_show(struct device *dev,
603  				   struct device_attribute *attr,
604  				   char *buf)
605  {
606  	return test_dev_config_show_bool(buf, test_fw_config->partial);
607  }
608  static DEVICE_ATTR_RW(config_partial);
609  
config_sync_direct_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)610  static ssize_t config_sync_direct_store(struct device *dev,
611  					struct device_attribute *attr,
612  					const char *buf, size_t count)
613  {
614  	int rc = test_dev_config_update_bool(buf, count,
615  					     &test_fw_config->sync_direct);
616  
617  	if (rc == count)
618  		test_fw_config->req_firmware = test_fw_config->sync_direct ?
619  				       request_firmware_direct :
620  				       request_firmware;
621  	return rc;
622  }
623  
config_sync_direct_show(struct device * dev,struct device_attribute * attr,char * buf)624  static ssize_t config_sync_direct_show(struct device *dev,
625  				       struct device_attribute *attr,
626  				       char *buf)
627  {
628  	return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
629  }
630  static DEVICE_ATTR_RW(config_sync_direct);
631  
config_send_uevent_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)632  static ssize_t config_send_uevent_store(struct device *dev,
633  					struct device_attribute *attr,
634  					const char *buf, size_t count)
635  {
636  	return test_dev_config_update_bool(buf, count,
637  					   &test_fw_config->send_uevent);
638  }
639  
config_send_uevent_show(struct device * dev,struct device_attribute * attr,char * buf)640  static ssize_t config_send_uevent_show(struct device *dev,
641  				       struct device_attribute *attr,
642  				       char *buf)
643  {
644  	return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
645  }
646  static DEVICE_ATTR_RW(config_send_uevent);
647  
config_read_fw_idx_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)648  static ssize_t config_read_fw_idx_store(struct device *dev,
649  					struct device_attribute *attr,
650  					const char *buf, size_t count)
651  {
652  	return test_dev_config_update_u8(buf, count,
653  					 &test_fw_config->read_fw_idx);
654  }
655  
config_read_fw_idx_show(struct device * dev,struct device_attribute * attr,char * buf)656  static ssize_t config_read_fw_idx_show(struct device *dev,
657  				       struct device_attribute *attr,
658  				       char *buf)
659  {
660  	return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
661  }
662  static DEVICE_ATTR_RW(config_read_fw_idx);
663  
664  
trigger_request_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)665  static ssize_t trigger_request_store(struct device *dev,
666  				     struct device_attribute *attr,
667  				     const char *buf, size_t count)
668  {
669  	int rc;
670  	char *name;
671  
672  	name = kstrndup(buf, count, GFP_KERNEL);
673  	if (!name)
674  		return -ENOMEM;
675  
676  	pr_info("loading '%s'\n", name);
677  
678  	mutex_lock(&test_fw_mutex);
679  	release_firmware(test_firmware);
680  	if (test_fw_config->reqs)
681  		__test_release_all_firmware();
682  	test_firmware = NULL;
683  	rc = request_firmware(&test_firmware, name, dev);
684  	if (rc) {
685  		pr_info("load of '%s' failed: %d\n", name, rc);
686  		goto out;
687  	}
688  	pr_info("loaded: %zu\n", test_firmware->size);
689  	rc = count;
690  
691  out:
692  	mutex_unlock(&test_fw_mutex);
693  
694  	kfree(name);
695  
696  	return rc;
697  }
698  static DEVICE_ATTR_WO(trigger_request);
699  
700  #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
701  extern struct list_head efi_embedded_fw_list;
702  extern bool efi_embedded_fw_checked;
703  
trigger_request_platform_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)704  static ssize_t trigger_request_platform_store(struct device *dev,
705  					      struct device_attribute *attr,
706  					      const char *buf, size_t count)
707  {
708  	static const u8 test_data[] = {
709  		0x55, 0xaa, 0x55, 0xaa, 0x01, 0x02, 0x03, 0x04,
710  		0x55, 0xaa, 0x55, 0xaa, 0x05, 0x06, 0x07, 0x08,
711  		0x55, 0xaa, 0x55, 0xaa, 0x10, 0x20, 0x30, 0x40,
712  		0x55, 0xaa, 0x55, 0xaa, 0x50, 0x60, 0x70, 0x80
713  	};
714  	struct efi_embedded_fw efi_embedded_fw;
715  	const struct firmware *firmware = NULL;
716  	bool saved_efi_embedded_fw_checked;
717  	char *name;
718  	int rc;
719  
720  	name = kstrndup(buf, count, GFP_KERNEL);
721  	if (!name)
722  		return -ENOMEM;
723  
724  	pr_info("inserting test platform fw '%s'\n", name);
725  	efi_embedded_fw.name = name;
726  	efi_embedded_fw.data = (void *)test_data;
727  	efi_embedded_fw.length = sizeof(test_data);
728  	list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
729  	saved_efi_embedded_fw_checked = efi_embedded_fw_checked;
730  	efi_embedded_fw_checked = true;
731  
732  	pr_info("loading '%s'\n", name);
733  	rc = firmware_request_platform(&firmware, name, dev);
734  	if (rc) {
735  		pr_info("load of '%s' failed: %d\n", name, rc);
736  		goto out;
737  	}
738  	if (firmware->size != sizeof(test_data) ||
739  	    memcmp(firmware->data, test_data, sizeof(test_data)) != 0) {
740  		pr_info("firmware contents mismatch for '%s'\n", name);
741  		rc = -EINVAL;
742  		goto out;
743  	}
744  	pr_info("loaded: %zu\n", firmware->size);
745  	rc = count;
746  
747  out:
748  	efi_embedded_fw_checked = saved_efi_embedded_fw_checked;
749  	release_firmware(firmware);
750  	list_del(&efi_embedded_fw.list);
751  	kfree(name);
752  
753  	return rc;
754  }
755  static DEVICE_ATTR_WO(trigger_request_platform);
756  #endif
757  
758  static DECLARE_COMPLETION(async_fw_done);
759  
trigger_async_request_cb(const struct firmware * fw,void * context)760  static void trigger_async_request_cb(const struct firmware *fw, void *context)
761  {
762  	test_firmware = fw;
763  	complete(&async_fw_done);
764  }
765  
trigger_async_request_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)766  static ssize_t trigger_async_request_store(struct device *dev,
767  					   struct device_attribute *attr,
768  					   const char *buf, size_t count)
769  {
770  	int rc;
771  	char *name;
772  
773  	name = kstrndup(buf, count, GFP_KERNEL);
774  	if (!name)
775  		return -ENOMEM;
776  
777  	pr_info("loading '%s'\n", name);
778  
779  	mutex_lock(&test_fw_mutex);
780  	release_firmware(test_firmware);
781  	test_firmware = NULL;
782  	if (test_fw_config->reqs)
783  		__test_release_all_firmware();
784  	rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
785  				     NULL, trigger_async_request_cb);
786  	if (rc) {
787  		pr_info("async load of '%s' failed: %d\n", name, rc);
788  		kfree(name);
789  		goto out;
790  	}
791  	/* Free 'name' ASAP, to test for race conditions */
792  	kfree(name);
793  
794  	wait_for_completion(&async_fw_done);
795  
796  	if (test_firmware) {
797  		pr_info("loaded: %zu\n", test_firmware->size);
798  		rc = count;
799  	} else {
800  		pr_err("failed to async load firmware\n");
801  		rc = -ENOMEM;
802  	}
803  
804  out:
805  	mutex_unlock(&test_fw_mutex);
806  
807  	return rc;
808  }
809  static DEVICE_ATTR_WO(trigger_async_request);
810  
trigger_custom_fallback_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)811  static ssize_t trigger_custom_fallback_store(struct device *dev,
812  					     struct device_attribute *attr,
813  					     const char *buf, size_t count)
814  {
815  	int rc;
816  	char *name;
817  
818  	name = kstrndup(buf, count, GFP_KERNEL);
819  	if (!name)
820  		return -ENOMEM;
821  
822  	pr_info("loading '%s' using custom fallback mechanism\n", name);
823  
824  	mutex_lock(&test_fw_mutex);
825  	release_firmware(test_firmware);
826  	if (test_fw_config->reqs)
827  		__test_release_all_firmware();
828  	test_firmware = NULL;
829  	rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOUEVENT, name,
830  				     dev, GFP_KERNEL, NULL,
831  				     trigger_async_request_cb);
832  	if (rc) {
833  		pr_info("async load of '%s' failed: %d\n", name, rc);
834  		kfree(name);
835  		goto out;
836  	}
837  	/* Free 'name' ASAP, to test for race conditions */
838  	kfree(name);
839  
840  	wait_for_completion(&async_fw_done);
841  
842  	if (test_firmware) {
843  		pr_info("loaded: %zu\n", test_firmware->size);
844  		rc = count;
845  	} else {
846  		pr_err("failed to async load firmware\n");
847  		rc = -ENODEV;
848  	}
849  
850  out:
851  	mutex_unlock(&test_fw_mutex);
852  
853  	return rc;
854  }
855  static DEVICE_ATTR_WO(trigger_custom_fallback);
856  
test_fw_run_batch_request(void * data)857  static int test_fw_run_batch_request(void *data)
858  {
859  	struct test_batched_req *req = data;
860  
861  	if (!req) {
862  		test_fw_config->test_result = -EINVAL;
863  		return -EINVAL;
864  	}
865  
866  	if (test_fw_config->into_buf) {
867  		void *test_buf;
868  
869  		test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
870  		if (!test_buf)
871  			return -ENOMEM;
872  
873  		if (test_fw_config->partial)
874  			req->rc = request_partial_firmware_into_buf
875  						(&req->fw,
876  						 req->name,
877  						 req->dev,
878  						 test_buf,
879  						 test_fw_config->buf_size,
880  						 test_fw_config->file_offset);
881  		else
882  			req->rc = request_firmware_into_buf
883  						(&req->fw,
884  						 req->name,
885  						 req->dev,
886  						 test_buf,
887  						 test_fw_config->buf_size);
888  		if (!req->fw)
889  			kfree(test_buf);
890  		else
891  			req->fw_buf = test_buf;
892  	} else {
893  		req->rc = test_fw_config->req_firmware(&req->fw,
894  						       req->name,
895  						       req->dev);
896  	}
897  
898  	if (req->rc) {
899  		pr_info("#%u: batched sync load failed: %d\n",
900  			req->idx, req->rc);
901  		if (!test_fw_config->test_result)
902  			test_fw_config->test_result = req->rc;
903  	} else if (req->fw) {
904  		req->sent = true;
905  		pr_info("#%u: batched sync loaded %zu\n",
906  			req->idx, req->fw->size);
907  	}
908  	complete(&req->completion);
909  
910  	req->task = NULL;
911  
912  	return 0;
913  }
914  
915  /*
916   * We use a kthread as otherwise the kernel serializes all our sync requests
917   * and we would not be able to mimic batched requests on a sync call. Batched
918   * requests on a sync call can for instance happen on a device driver when
919   * multiple cards are used and firmware loading happens outside of probe.
920   */
trigger_batched_requests_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)921  static ssize_t trigger_batched_requests_store(struct device *dev,
922  					      struct device_attribute *attr,
923  					      const char *buf, size_t count)
924  {
925  	struct test_batched_req *req;
926  	int rc;
927  	u8 i;
928  
929  	mutex_lock(&test_fw_mutex);
930  
931  	if (test_fw_config->reqs) {
932  		rc = -EBUSY;
933  		goto out_bail;
934  	}
935  
936  	test_fw_config->reqs =
937  		vzalloc(array3_size(sizeof(struct test_batched_req),
938  				    test_fw_config->num_requests, 2));
939  	if (!test_fw_config->reqs) {
940  		rc = -ENOMEM;
941  		goto out_unlock;
942  	}
943  
944  	pr_info("batched sync firmware loading '%s' %u times\n",
945  		test_fw_config->name, test_fw_config->num_requests);
946  
947  	for (i = 0; i < test_fw_config->num_requests; i++) {
948  		req = &test_fw_config->reqs[i];
949  		req->fw = NULL;
950  		req->idx = i;
951  		req->name = test_fw_config->name;
952  		req->fw_buf = NULL;
953  		req->dev = dev;
954  		init_completion(&req->completion);
955  		req->task = kthread_run(test_fw_run_batch_request, req,
956  					     "%s-%u", KBUILD_MODNAME, req->idx);
957  		if (!req->task || IS_ERR(req->task)) {
958  			pr_err("Setting up thread %u failed\n", req->idx);
959  			req->task = NULL;
960  			rc = -ENOMEM;
961  			goto out_bail;
962  		}
963  	}
964  
965  	rc = count;
966  
967  	/*
968  	 * We require an explicit release to enable more time and delay of
969  	 * calling release_firmware() to improve our chances of forcing a
970  	 * batched request. If we instead called release_firmware() right away
971  	 * then we might miss on an opportunity of having a successful firmware
972  	 * request pass on the opportunity to be come a batched request.
973  	 */
974  
975  out_bail:
976  	for (i = 0; i < test_fw_config->num_requests; i++) {
977  		req = &test_fw_config->reqs[i];
978  		if (req->task || req->sent)
979  			wait_for_completion(&req->completion);
980  	}
981  
982  	/* Override any worker error if we had a general setup error */
983  	if (rc < 0)
984  		test_fw_config->test_result = rc;
985  
986  out_unlock:
987  	mutex_unlock(&test_fw_mutex);
988  
989  	return rc;
990  }
991  static DEVICE_ATTR_WO(trigger_batched_requests);
992  
993  /*
994   * We wait for each callback to return with the lock held, no need to lock here
995   */
trigger_batched_cb(const struct firmware * fw,void * context)996  static void trigger_batched_cb(const struct firmware *fw, void *context)
997  {
998  	struct test_batched_req *req = context;
999  
1000  	if (!req) {
1001  		test_fw_config->test_result = -EINVAL;
1002  		return;
1003  	}
1004  
1005  	/* forces *some* batched requests to queue up */
1006  	if (!req->idx)
1007  		ssleep(2);
1008  
1009  	req->fw = fw;
1010  
1011  	/*
1012  	 * Unfortunately the firmware API gives us nothing other than a null FW
1013  	 * if the firmware was not found on async requests.  Best we can do is
1014  	 * just assume -ENOENT. A better API would pass the actual return
1015  	 * value to the callback.
1016  	 */
1017  	if (!fw && !test_fw_config->test_result)
1018  		test_fw_config->test_result = -ENOENT;
1019  
1020  	complete(&req->completion);
1021  }
1022  
1023  static
trigger_batched_requests_async_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)1024  ssize_t trigger_batched_requests_async_store(struct device *dev,
1025  					     struct device_attribute *attr,
1026  					     const char *buf, size_t count)
1027  {
1028  	struct test_batched_req *req;
1029  	bool send_uevent;
1030  	int rc;
1031  	u8 i;
1032  
1033  	mutex_lock(&test_fw_mutex);
1034  
1035  	if (test_fw_config->reqs) {
1036  		rc = -EBUSY;
1037  		goto out_bail;
1038  	}
1039  
1040  	test_fw_config->reqs =
1041  		vzalloc(array3_size(sizeof(struct test_batched_req),
1042  				    test_fw_config->num_requests, 2));
1043  	if (!test_fw_config->reqs) {
1044  		rc = -ENOMEM;
1045  		goto out;
1046  	}
1047  
1048  	pr_info("batched loading '%s' custom fallback mechanism %u times\n",
1049  		test_fw_config->name, test_fw_config->num_requests);
1050  
1051  	send_uevent = test_fw_config->send_uevent ? FW_ACTION_UEVENT :
1052  		FW_ACTION_NOUEVENT;
1053  
1054  	for (i = 0; i < test_fw_config->num_requests; i++) {
1055  		req = &test_fw_config->reqs[i];
1056  		req->name = test_fw_config->name;
1057  		req->fw_buf = NULL;
1058  		req->fw = NULL;
1059  		req->idx = i;
1060  		init_completion(&req->completion);
1061  		rc = request_firmware_nowait(THIS_MODULE, send_uevent,
1062  					     req->name,
1063  					     dev, GFP_KERNEL, req,
1064  					     trigger_batched_cb);
1065  		if (rc) {
1066  			pr_info("#%u: batched async load failed setup: %d\n",
1067  				i, rc);
1068  			req->rc = rc;
1069  			goto out_bail;
1070  		} else
1071  			req->sent = true;
1072  	}
1073  
1074  	rc = count;
1075  
1076  out_bail:
1077  
1078  	/*
1079  	 * We require an explicit release to enable more time and delay of
1080  	 * calling release_firmware() to improve our chances of forcing a
1081  	 * batched request. If we instead called release_firmware() right away
1082  	 * then we might miss on an opportunity of having a successful firmware
1083  	 * request pass on the opportunity to be come a batched request.
1084  	 */
1085  
1086  	for (i = 0; i < test_fw_config->num_requests; i++) {
1087  		req = &test_fw_config->reqs[i];
1088  		if (req->sent)
1089  			wait_for_completion(&req->completion);
1090  	}
1091  
1092  	/* Override any worker error if we had a general setup error */
1093  	if (rc < 0)
1094  		test_fw_config->test_result = rc;
1095  
1096  out:
1097  	mutex_unlock(&test_fw_mutex);
1098  
1099  	return rc;
1100  }
1101  static DEVICE_ATTR_WO(trigger_batched_requests_async);
1102  
upload_release(struct test_firmware_upload * tst)1103  static void upload_release(struct test_firmware_upload *tst)
1104  {
1105  	firmware_upload_unregister(tst->fwl);
1106  	kfree(tst->buf);
1107  	kfree(tst->name);
1108  	kfree(tst);
1109  }
1110  
upload_release_all(void)1111  static void upload_release_all(void)
1112  {
1113  	struct test_firmware_upload *tst, *tmp;
1114  
1115  	list_for_each_entry_safe(tst, tmp, &test_upload_list, node) {
1116  		list_del(&tst->node);
1117  		upload_release(tst);
1118  	}
1119  	test_fw_config->upload_name = NULL;
1120  }
1121  
1122  /*
1123   * This table is replicated from .../firmware_loader/sysfs_upload.c
1124   * and needs to be kept in sync.
1125   */
1126  static const char * const fw_upload_err_str[] = {
1127  	[FW_UPLOAD_ERR_NONE]	     = "none",
1128  	[FW_UPLOAD_ERR_HW_ERROR]     = "hw-error",
1129  	[FW_UPLOAD_ERR_TIMEOUT]	     = "timeout",
1130  	[FW_UPLOAD_ERR_CANCELED]     = "user-abort",
1131  	[FW_UPLOAD_ERR_BUSY]	     = "device-busy",
1132  	[FW_UPLOAD_ERR_INVALID_SIZE] = "invalid-file-size",
1133  	[FW_UPLOAD_ERR_RW_ERROR]     = "read-write-error",
1134  	[FW_UPLOAD_ERR_WEAROUT]	     = "flash-wearout",
1135  	[FW_UPLOAD_ERR_FW_INVALID]   = "firmware-invalid",
1136  };
1137  
upload_err_inject_error(struct test_firmware_upload * tst,const u8 * p,const char * prog)1138  static void upload_err_inject_error(struct test_firmware_upload *tst,
1139  				    const u8 *p, const char *prog)
1140  {
1141  	enum fw_upload_err err;
1142  
1143  	for (err = FW_UPLOAD_ERR_NONE + 1; err < FW_UPLOAD_ERR_MAX; err++) {
1144  		if (strncmp(p, fw_upload_err_str[err],
1145  			    strlen(fw_upload_err_str[err])) == 0) {
1146  			tst->inject.prog = prog;
1147  			tst->inject.err_code = err;
1148  			return;
1149  		}
1150  	}
1151  }
1152  
upload_err_inject_prog(struct test_firmware_upload * tst,const u8 * p)1153  static void upload_err_inject_prog(struct test_firmware_upload *tst,
1154  				   const u8 *p)
1155  {
1156  	static const char * const progs[] = {
1157  		"preparing:", "transferring:", "programming:"
1158  	};
1159  	int i;
1160  
1161  	for (i = 0; i < ARRAY_SIZE(progs); i++) {
1162  		if (strncmp(p, progs[i], strlen(progs[i])) == 0) {
1163  			upload_err_inject_error(tst, p + strlen(progs[i]),
1164  						progs[i]);
1165  			return;
1166  		}
1167  	}
1168  }
1169  
1170  #define FIVE_MINUTES_MS	(5 * 60 * 1000)
1171  static enum fw_upload_err
fw_upload_wait_on_cancel(struct test_firmware_upload * tst)1172  fw_upload_wait_on_cancel(struct test_firmware_upload *tst)
1173  {
1174  	int ms_delay;
1175  
1176  	for (ms_delay = 0; ms_delay < FIVE_MINUTES_MS; ms_delay += 100) {
1177  		msleep(100);
1178  		if (tst->cancel_request)
1179  			return FW_UPLOAD_ERR_CANCELED;
1180  	}
1181  	return FW_UPLOAD_ERR_NONE;
1182  }
1183  
test_fw_upload_prepare(struct fw_upload * fwl,const u8 * data,u32 size)1184  static enum fw_upload_err test_fw_upload_prepare(struct fw_upload *fwl,
1185  						 const u8 *data, u32 size)
1186  {
1187  	struct test_firmware_upload *tst = fwl->dd_handle;
1188  	enum fw_upload_err ret = FW_UPLOAD_ERR_NONE;
1189  	const char *progress = "preparing:";
1190  
1191  	tst->cancel_request = false;
1192  
1193  	if (!size || size > TEST_UPLOAD_MAX_SIZE) {
1194  		ret = FW_UPLOAD_ERR_INVALID_SIZE;
1195  		goto err_out;
1196  	}
1197  
1198  	if (strncmp(data, "inject:", strlen("inject:")) == 0)
1199  		upload_err_inject_prog(tst, data + strlen("inject:"));
1200  
1201  	memset(tst->buf, 0, TEST_UPLOAD_MAX_SIZE);
1202  	tst->size = size;
1203  
1204  	if (tst->inject.err_code == FW_UPLOAD_ERR_NONE ||
1205  	    strncmp(tst->inject.prog, progress, strlen(progress)) != 0)
1206  		return FW_UPLOAD_ERR_NONE;
1207  
1208  	if (tst->inject.err_code == FW_UPLOAD_ERR_CANCELED)
1209  		ret = fw_upload_wait_on_cancel(tst);
1210  	else
1211  		ret = tst->inject.err_code;
1212  
1213  err_out:
1214  	/*
1215  	 * The cleanup op only executes if the prepare op succeeds.
1216  	 * If the prepare op fails, it must do it's own clean-up.
1217  	 */
1218  	tst->inject.err_code = FW_UPLOAD_ERR_NONE;
1219  	tst->inject.prog = NULL;
1220  
1221  	return ret;
1222  }
1223  
test_fw_upload_write(struct fw_upload * fwl,const u8 * data,u32 offset,u32 size,u32 * written)1224  static enum fw_upload_err test_fw_upload_write(struct fw_upload *fwl,
1225  					       const u8 *data, u32 offset,
1226  					       u32 size, u32 *written)
1227  {
1228  	struct test_firmware_upload *tst = fwl->dd_handle;
1229  	const char *progress = "transferring:";
1230  	u32 blk_size;
1231  
1232  	if (tst->cancel_request)
1233  		return FW_UPLOAD_ERR_CANCELED;
1234  
1235  	blk_size = min_t(u32, TEST_UPLOAD_BLK_SIZE, size);
1236  	memcpy(tst->buf + offset, data + offset, blk_size);
1237  
1238  	*written = blk_size;
1239  
1240  	if (tst->inject.err_code == FW_UPLOAD_ERR_NONE ||
1241  	    strncmp(tst->inject.prog, progress, strlen(progress)) != 0)
1242  		return FW_UPLOAD_ERR_NONE;
1243  
1244  	if (tst->inject.err_code == FW_UPLOAD_ERR_CANCELED)
1245  		return fw_upload_wait_on_cancel(tst);
1246  
1247  	return tst->inject.err_code;
1248  }
1249  
test_fw_upload_complete(struct fw_upload * fwl)1250  static enum fw_upload_err test_fw_upload_complete(struct fw_upload *fwl)
1251  {
1252  	struct test_firmware_upload *tst = fwl->dd_handle;
1253  	const char *progress = "programming:";
1254  
1255  	if (tst->cancel_request)
1256  		return FW_UPLOAD_ERR_CANCELED;
1257  
1258  	if (tst->inject.err_code == FW_UPLOAD_ERR_NONE ||
1259  	    strncmp(tst->inject.prog, progress, strlen(progress)) != 0)
1260  		return FW_UPLOAD_ERR_NONE;
1261  
1262  	if (tst->inject.err_code == FW_UPLOAD_ERR_CANCELED)
1263  		return fw_upload_wait_on_cancel(tst);
1264  
1265  	return tst->inject.err_code;
1266  }
1267  
test_fw_upload_cancel(struct fw_upload * fwl)1268  static void test_fw_upload_cancel(struct fw_upload *fwl)
1269  {
1270  	struct test_firmware_upload *tst = fwl->dd_handle;
1271  
1272  	tst->cancel_request = true;
1273  }
1274  
test_fw_cleanup(struct fw_upload * fwl)1275  static void test_fw_cleanup(struct fw_upload *fwl)
1276  {
1277  	struct test_firmware_upload *tst = fwl->dd_handle;
1278  
1279  	tst->inject.err_code = FW_UPLOAD_ERR_NONE;
1280  	tst->inject.prog = NULL;
1281  }
1282  
1283  static const struct fw_upload_ops upload_test_ops = {
1284  	.prepare = test_fw_upload_prepare,
1285  	.write = test_fw_upload_write,
1286  	.poll_complete = test_fw_upload_complete,
1287  	.cancel = test_fw_upload_cancel,
1288  	.cleanup = test_fw_cleanup
1289  };
1290  
upload_register_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)1291  static ssize_t upload_register_store(struct device *dev,
1292  				     struct device_attribute *attr,
1293  				     const char *buf, size_t count)
1294  {
1295  	struct test_firmware_upload *tst;
1296  	struct fw_upload *fwl;
1297  	char *name;
1298  	int ret;
1299  
1300  	name = kstrndup(buf, count, GFP_KERNEL);
1301  	if (!name)
1302  		return -ENOMEM;
1303  
1304  	mutex_lock(&test_fw_mutex);
1305  	tst = upload_lookup_name(name);
1306  	if (tst) {
1307  		ret = -EEXIST;
1308  		goto free_name;
1309  	}
1310  
1311  	tst = kzalloc(sizeof(*tst), GFP_KERNEL);
1312  	if (!tst) {
1313  		ret = -ENOMEM;
1314  		goto free_name;
1315  	}
1316  
1317  	tst->name = name;
1318  	tst->buf = kzalloc(TEST_UPLOAD_MAX_SIZE, GFP_KERNEL);
1319  	if (!tst->buf) {
1320  		ret = -ENOMEM;
1321  		goto free_tst;
1322  	}
1323  
1324  	fwl = firmware_upload_register(THIS_MODULE, dev, tst->name,
1325  				       &upload_test_ops, tst);
1326  	if (IS_ERR(fwl)) {
1327  		ret = PTR_ERR(fwl);
1328  		goto free_buf;
1329  	}
1330  
1331  	tst->fwl = fwl;
1332  	list_add_tail(&tst->node, &test_upload_list);
1333  	mutex_unlock(&test_fw_mutex);
1334  	return count;
1335  
1336  free_buf:
1337  	kfree(tst->buf);
1338  
1339  free_tst:
1340  	kfree(tst);
1341  
1342  free_name:
1343  	mutex_unlock(&test_fw_mutex);
1344  	kfree(name);
1345  
1346  	return ret;
1347  }
1348  static DEVICE_ATTR_WO(upload_register);
1349  
upload_unregister_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)1350  static ssize_t upload_unregister_store(struct device *dev,
1351  				       struct device_attribute *attr,
1352  				       const char *buf, size_t count)
1353  {
1354  	struct test_firmware_upload *tst;
1355  	int ret = count;
1356  
1357  	mutex_lock(&test_fw_mutex);
1358  	tst = upload_lookup_name(buf);
1359  	if (!tst) {
1360  		ret = -EINVAL;
1361  		goto out;
1362  	}
1363  
1364  	if (test_fw_config->upload_name == tst->name)
1365  		test_fw_config->upload_name = NULL;
1366  
1367  	list_del(&tst->node);
1368  	upload_release(tst);
1369  
1370  out:
1371  	mutex_unlock(&test_fw_mutex);
1372  	return ret;
1373  }
1374  static DEVICE_ATTR_WO(upload_unregister);
1375  
test_result_show(struct device * dev,struct device_attribute * attr,char * buf)1376  static ssize_t test_result_show(struct device *dev,
1377  				struct device_attribute *attr,
1378  				char *buf)
1379  {
1380  	return test_dev_config_show_int(buf, test_fw_config->test_result);
1381  }
1382  static DEVICE_ATTR_RO(test_result);
1383  
release_all_firmware_store(struct device * dev,struct device_attribute * attr,const char * buf,size_t count)1384  static ssize_t release_all_firmware_store(struct device *dev,
1385  					  struct device_attribute *attr,
1386  					  const char *buf, size_t count)
1387  {
1388  	test_release_all_firmware();
1389  	return count;
1390  }
1391  static DEVICE_ATTR_WO(release_all_firmware);
1392  
read_firmware_show(struct device * dev,struct device_attribute * attr,char * buf)1393  static ssize_t read_firmware_show(struct device *dev,
1394  				  struct device_attribute *attr,
1395  				  char *buf)
1396  {
1397  	struct test_batched_req *req;
1398  	u8 idx;
1399  	ssize_t rc = 0;
1400  
1401  	mutex_lock(&test_fw_mutex);
1402  
1403  	idx = test_fw_config->read_fw_idx;
1404  	if (idx >= test_fw_config->num_requests) {
1405  		rc = -ERANGE;
1406  		goto out;
1407  	}
1408  
1409  	if (!test_fw_config->reqs) {
1410  		rc = -EINVAL;
1411  		goto out;
1412  	}
1413  
1414  	req = &test_fw_config->reqs[idx];
1415  	if (!req->fw) {
1416  		pr_err("#%u: failed to async load firmware\n", idx);
1417  		rc = -ENOENT;
1418  		goto out;
1419  	}
1420  
1421  	pr_info("#%u: loaded %zu\n", idx, req->fw->size);
1422  
1423  	if (req->fw->size > PAGE_SIZE) {
1424  		pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
1425  		rc = -EINVAL;
1426  		goto out;
1427  	}
1428  	memcpy(buf, req->fw->data, req->fw->size);
1429  
1430  	rc = req->fw->size;
1431  out:
1432  	mutex_unlock(&test_fw_mutex);
1433  
1434  	return rc;
1435  }
1436  static DEVICE_ATTR_RO(read_firmware);
1437  
upload_read_show(struct device * dev,struct device_attribute * attr,char * buf)1438  static ssize_t upload_read_show(struct device *dev,
1439  				struct device_attribute *attr,
1440  				char *buf)
1441  {
1442  	struct test_firmware_upload *tst = NULL;
1443  	struct test_firmware_upload *tst_iter;
1444  	int ret = -EINVAL;
1445  
1446  	if (!test_fw_config->upload_name) {
1447  		pr_err("Set config_upload_name before using upload_read\n");
1448  		return -EINVAL;
1449  	}
1450  
1451  	mutex_lock(&test_fw_mutex);
1452  	list_for_each_entry(tst_iter, &test_upload_list, node)
1453  		if (tst_iter->name == test_fw_config->upload_name) {
1454  			tst = tst_iter;
1455  			break;
1456  		}
1457  
1458  	if (!tst) {
1459  		pr_err("Firmware name not found: %s\n",
1460  		       test_fw_config->upload_name);
1461  		goto out;
1462  	}
1463  
1464  	if (tst->size > PAGE_SIZE) {
1465  		pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
1466  		goto out;
1467  	}
1468  
1469  	memcpy(buf, tst->buf, tst->size);
1470  	ret = tst->size;
1471  out:
1472  	mutex_unlock(&test_fw_mutex);
1473  	return ret;
1474  }
1475  static DEVICE_ATTR_RO(upload_read);
1476  
1477  #define TEST_FW_DEV_ATTR(name)          &dev_attr_##name.attr
1478  
1479  static struct attribute *test_dev_attrs[] = {
1480  	TEST_FW_DEV_ATTR(reset),
1481  
1482  	TEST_FW_DEV_ATTR(config),
1483  	TEST_FW_DEV_ATTR(config_name),
1484  	TEST_FW_DEV_ATTR(config_num_requests),
1485  	TEST_FW_DEV_ATTR(config_into_buf),
1486  	TEST_FW_DEV_ATTR(config_buf_size),
1487  	TEST_FW_DEV_ATTR(config_file_offset),
1488  	TEST_FW_DEV_ATTR(config_partial),
1489  	TEST_FW_DEV_ATTR(config_sync_direct),
1490  	TEST_FW_DEV_ATTR(config_send_uevent),
1491  	TEST_FW_DEV_ATTR(config_read_fw_idx),
1492  	TEST_FW_DEV_ATTR(config_upload_name),
1493  
1494  	/* These don't use the config at all - they could be ported! */
1495  	TEST_FW_DEV_ATTR(trigger_request),
1496  	TEST_FW_DEV_ATTR(trigger_async_request),
1497  	TEST_FW_DEV_ATTR(trigger_custom_fallback),
1498  #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
1499  	TEST_FW_DEV_ATTR(trigger_request_platform),
1500  #endif
1501  
1502  	/* These use the config and can use the test_result */
1503  	TEST_FW_DEV_ATTR(trigger_batched_requests),
1504  	TEST_FW_DEV_ATTR(trigger_batched_requests_async),
1505  
1506  	TEST_FW_DEV_ATTR(release_all_firmware),
1507  	TEST_FW_DEV_ATTR(test_result),
1508  	TEST_FW_DEV_ATTR(read_firmware),
1509  	TEST_FW_DEV_ATTR(upload_read),
1510  	TEST_FW_DEV_ATTR(upload_register),
1511  	TEST_FW_DEV_ATTR(upload_unregister),
1512  	NULL,
1513  };
1514  
1515  ATTRIBUTE_GROUPS(test_dev);
1516  
1517  static struct miscdevice test_fw_misc_device = {
1518  	.minor          = MISC_DYNAMIC_MINOR,
1519  	.name           = "test_firmware",
1520  	.fops           = &test_fw_fops,
1521  	.groups 	= test_dev_groups,
1522  };
1523  
test_firmware_init(void)1524  static int __init test_firmware_init(void)
1525  {
1526  	int rc;
1527  
1528  	test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
1529  	if (!test_fw_config)
1530  		return -ENOMEM;
1531  
1532  	rc = __test_firmware_config_init();
1533  	if (rc) {
1534  		kfree(test_fw_config);
1535  		pr_err("could not init firmware test config: %d\n", rc);
1536  		return rc;
1537  	}
1538  
1539  	rc = misc_register(&test_fw_misc_device);
1540  	if (rc) {
1541  		__test_firmware_config_free();
1542  		kfree(test_fw_config);
1543  		pr_err("could not register misc device: %d\n", rc);
1544  		return rc;
1545  	}
1546  
1547  	pr_warn("interface ready\n");
1548  
1549  	return 0;
1550  }
1551  
1552  module_init(test_firmware_init);
1553  
test_firmware_exit(void)1554  static void __exit test_firmware_exit(void)
1555  {
1556  	mutex_lock(&test_fw_mutex);
1557  	release_firmware(test_firmware);
1558  	misc_deregister(&test_fw_misc_device);
1559  	upload_release_all();
1560  	__test_firmware_config_free();
1561  	kfree(test_fw_config);
1562  	mutex_unlock(&test_fw_mutex);
1563  
1564  	pr_warn("removed interface\n");
1565  }
1566  
1567  module_exit(test_firmware_exit);
1568  
1569  MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1570  MODULE_DESCRIPTION("interface to trigger and test firmware loading");
1571  MODULE_LICENSE("GPL");
1572