lib/test_firmware.c

   1 /*
   2  * This module provides an interface to trigger and test firmware loading.
   3  *
   4  * It is designed to be used for basic evaluation of the firmware loading
   5  * subsystem (for example when validating firmware verification). It lacks
   6  * any extra dependencies, and will not normally be loaded by the system
   7  * unless explicitly requested by name.
   8  */
   9
  10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  11
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/printk.h>
  15 #include <linux/completion.h>
  16 #include <linux/firmware.h>
  17 #include <linux/device.h>
  18 #include <linux/fs.h>
  19 #include <linux/miscdevice.h>
  20 #include <linux/slab.h>
  21 #include <linux/uaccess.h>
  22 #include <linux/delay.h>
  23 #include <linux/kthread.h>
  24 #include <linux/vmalloc.h>
  25
  26 #define TEST_FIRMWARE_NAME      "test-firmware.bin"
  27 #define TEST_FIRMWARE_NUM_REQS  4
  28
  29 static DEFINE_MUTEX(test_fw_mutex);
  30 static const struct firmware *test_firmware;
  31
  32 struct test_batched_req {
  33         u8 idx;
  34         int rc;
  35         bool sent;
  36         const struct firmware *fw;
  37         const char *name;
  38         struct completion completion;
  39         struct task_struct *task;
  40         struct device *dev;
  41 };
  42
  43 /**
  44  * test_config - represents configuration for the test for different triggers
  45  *
  46  * @name: the name of the firmware file to look for
  47  * @sync_direct: when the sync trigger is used if this is true
  48  *      request_firmware_direct() will be used instead.
  49  * @send_uevent: whether or not to send a uevent for async requests
  50  * @num_requests: number of requests to try per test case. This is trigger
  51  *      specific.
  52  * @reqs: stores all requests information
  53  * @read_fw_idx: index of thread from which we want to read firmware results
  54  *      from through the read_fw trigger.
  55  * @test_result: a test may use this to collect the result from the call
  56  *      of the request_firmware*() calls used in their tests. In order of
  57  *      priority we always keep first any setup error. If no setup errors were
  58  *      found then we move on to the first error encountered while running the
  59  *      API. Note that for async calls this typically will be a successful
  60  *      result (0) unless of course you've used bogus parameters, or the system
  61  *      is out of memory.  In the async case the callback is expected to do a
  62  *      bit more homework to figure out what happened, unfortunately the only
  63  *      information passed today on error is the fact that no firmware was
  64  *      found so we can only assume -ENOENT on async calls if the firmware is
  65  *      NULL.
  66  *
  67  *      Errors you can expect:
  68  *
  69  *      API specific:
  70  *
  71  *      0:              success for sync, for async it means request was sent
  72  *      -EINVAL:        invalid parameters or request
  73  *      -ENOENT:        files not found
  74  *
  75  *      System environment:
  76  *
  77  *      -ENOMEM:        memory pressure on system
  78  *      -ENODEV:        out of number of devices to test
  79  *      -EINVAL:        an unexpected error has occurred
  80  * @req_firmware: if @sync_direct is true this is set to
  81  *      request_firmware_direct(), otherwise request_firmware()
  82  */
  83 struct test_config {
  84         char *name;
  85         bool sync_direct;
  86         bool send_uevent;
  87         u8 num_requests;
  88         u8 read_fw_idx;
  89
  90         /*
  91          * These below don't belong her but we'll move them once we create
  92          * a struct fw_test_device and stuff the misc_dev under there later.
  93          */
  94         struct test_batched_req *reqs;
  95         int test_result;
  96         int (*req_firmware)(const struct firmware **fw, const char *name,
  97                             struct device *device);
  98 };
  99
 100 static struct test_config *test_fw_config;
 101
 102 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
 103                                  size_t size, loff_t *offset)
 104 {
 105         ssize_t rc = 0;
 106
 107         mutex_lock(&test_fw_mutex);
 108         if (test_firmware)
 109                 rc = simple_read_from_buffer(buf, size, offset,
 110                                              test_firmware->data,
 111                                              test_firmware->size);
 112         mutex_unlock(&test_fw_mutex);
 113         return rc;
 114 }
 115
 116 static const struct file_operations test_fw_fops = {
 117         .owner          = THIS_MODULE,
 118         .read           = test_fw_misc_read,
 119 };
 120
 121 static void __test_release_all_firmware(void)
 122 {
 123         struct test_batched_req *req;
 124         u8 i;
 125
 126         if (!test_fw_config->reqs)
 127                 return;
 128
 129         for (i = 0; i < test_fw_config->num_requests; i++) {
 130                 req = &test_fw_config->reqs[i];
 131                 if (req->fw)
 132                         release_firmware(req->fw);
 133         }
 134
 135         vfree(test_fw_config->reqs);
 136         test_fw_config->reqs = NULL;
 137 }
 138
 139 static void test_release_all_firmware(void)
 140 {
 141         mutex_lock(&test_fw_mutex);
 142         __test_release_all_firmware();
 143         mutex_unlock(&test_fw_mutex);
 144 }
 145
 146
 147 static void __test_firmware_config_free(void)
 148 {
 149         __test_release_all_firmware();
 150         kfree_const(test_fw_config->name);
 151         test_fw_config->name = NULL;
 152 }
 153
 154 /*
 155  * XXX: move to kstrncpy() once merged.
 156  *
 157  * Users should use kfree_const() when freeing these.
 158  */
 159 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
 160 {
 161         *dst = kstrndup(name, count, gfp);
 162         if (!*dst)
 163                 return -ENOMEM;
 164         return count;
 165 }
 166
 167 static int __test_firmware_config_init(void)
 168 {
 169         int ret;
 170
 171         ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
 172                          strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
 173         if (ret < 0)
 174                 goto out;
 175
 176         test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
 177         test_fw_config->send_uevent = true;
 178         test_fw_config->sync_direct = false;
 179         test_fw_config->req_firmware = request_firmware;
 180         test_fw_config->test_result = 0;
 181         test_fw_config->reqs = NULL;
 182
 183         return 0;
 184
 185 out:
 186         __test_firmware_config_free();
 187         return ret;
 188 }
 189
 190 static ssize_t reset_store(struct device *dev,
 191                            struct device_attribute *attr,
 192                            const char *buf, size_t count)
 193 {
 194         int ret;
 195
 196         mutex_lock(&test_fw_mutex);
 197
 198         __test_firmware_config_free();
 199
 200         ret = __test_firmware_config_init();
 201         if (ret < 0) {
 202                 ret = -ENOMEM;
 203                 pr_err("could not alloc settings for config trigger: %d\n",
 204                        ret);
 205                 goto out;
 206         }
 207
 208         pr_info("reset\n");
 209         ret = count;
 210
 211 out:
 212         mutex_unlock(&test_fw_mutex);
 213
 214         return ret;
 215 }
 216 static DEVICE_ATTR_WO(reset);
 217
 218 static ssize_t config_show(struct device *dev,
 219                            struct device_attribute *attr,
 220                            char *buf)
 221 {
 222         int len = 0;
 223
 224         mutex_lock(&test_fw_mutex);
 225
 226         len += scnprintf(buf, PAGE_SIZE - len,
 227                         "Custom trigger configuration for: %s\n",
 228                         dev_name(dev));
 229
 230         if (test_fw_config->name)
 231                 len += scnprintf(buf+len, PAGE_SIZE - len,
 232                                 "name:\t%s\n",
 233                                 test_fw_config->name);
 234         else
 235                 len += scnprintf(buf+len, PAGE_SIZE - len,
 236                                 "name:\tEMTPY\n");
 237
 238         len += scnprintf(buf+len, PAGE_SIZE - len,
 239                         "num_requests:\t%u\n", test_fw_config->num_requests);
 240
 241         len += scnprintf(buf+len, PAGE_SIZE - len,
 242                         "send_uevent:\t\t%s\n",
 243                         test_fw_config->send_uevent ?
 244                         "FW_ACTION_HOTPLUG" :
 245                         "FW_ACTION_NOHOTPLUG");
 246         len += scnprintf(buf+len, PAGE_SIZE - len,
 247                         "sync_direct:\t\t%s\n",
 248                         test_fw_config->sync_direct ? "true" : "false");
 249         len += scnprintf(buf+len, PAGE_SIZE - len,
 250                         "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
 251
 252         mutex_unlock(&test_fw_mutex);
 253
 254         return len;
 255 }
 256 static DEVICE_ATTR_RO(config);
 257
 258 static ssize_t config_name_store(struct device *dev,
 259                                  struct device_attribute *attr,
 260                                  const char *buf, size_t count)
 261 {
 262         int ret;
 263
 264         mutex_lock(&test_fw_mutex);
 265         kfree_const(test_fw_config->name);
 266         ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
 267         mutex_unlock(&test_fw_mutex);
 268
 269         return ret;
 270 }
 271
 272 /*
 273  * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
 274  */
 275 static ssize_t config_test_show_str(char *dst,
 276                                     char *src)
 277 {
 278         int len;
 279
 280         mutex_lock(&test_fw_mutex);
 281         len = snprintf(dst, PAGE_SIZE, "%s\n", src);
 282         mutex_unlock(&test_fw_mutex);
 283
 284         return len;
 285 }
 286
 287 static inline int __test_dev_config_update_bool(const char *buf, size_t size,
 288                                                 bool *cfg)
 289 {
 290         int ret;
 291
 292         if (strtobool(buf, cfg) < 0)
 293                 ret = -EINVAL;
 294         else
 295                 ret = size;
 296
 297         return ret;
 298 }
 299
 300 static int test_dev_config_update_bool(const char *buf, size_t size,
 301                                        bool *cfg)
 302 {
 303         int ret;
 304
 305         mutex_lock(&test_fw_mutex);
 306         ret = __test_dev_config_update_bool(buf, size, cfg);
 307         mutex_unlock(&test_fw_mutex);
 308
 309         return ret;
 310 }
 311
 312 static ssize_t
 313 test_dev_config_show_bool(char *buf,
 314                           bool config)
 315 {
 316         bool val;
 317
 318         mutex_lock(&test_fw_mutex);
 319         val = config;
 320         mutex_unlock(&test_fw_mutex);
 321
 322         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 323 }
 324
 325 static ssize_t test_dev_config_show_int(char *buf, int cfg)
 326 {
 327         int val;
 328
 329         mutex_lock(&test_fw_mutex);
 330         val = cfg;
 331         mutex_unlock(&test_fw_mutex);
 332
 333         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 334 }
 335
 336 static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
 337 {
 338         int ret;
 339         long new;
 340
 341         ret = kstrtol(buf, 10, &new);
 342         if (ret)
 343                 return ret;
 344
 345         if (new > U8_MAX)
 346                 return -EINVAL;
 347
 348         *(u8 *)cfg = new;
 349
 350         /* Always return full write size even if we didn't consume all */
 351         return size;
 352 }
 353
 354 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
 355 {
 356         int ret;
 357
 358         mutex_lock(&test_fw_mutex);
 359         ret = __test_dev_config_update_u8(buf, size, cfg);
 360         mutex_unlock(&test_fw_mutex);
 361
 362         return ret;
 363 }
 364
 365 static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
 366 {
 367         u8 val;
 368
 369         mutex_lock(&test_fw_mutex);
 370         val = cfg;
 371         mutex_unlock(&test_fw_mutex);
 372
 373         return snprintf(buf, PAGE_SIZE, "%u\n", val);
 374 }
 375
 376 static ssize_t config_name_show(struct device *dev,
 377                                 struct device_attribute *attr,
 378                                 char *buf)
 379 {
 380         return config_test_show_str(buf, test_fw_config->name);
 381 }
 382 static DEVICE_ATTR_RW(config_name);
 383
 384 static ssize_t config_num_requests_store(struct device *dev,
 385                                          struct device_attribute *attr,
 386                                          const char *buf, size_t count)
 387 {
 388         int rc;
 389
 390         mutex_lock(&test_fw_mutex);
 391         if (test_fw_config->reqs) {
 392                 pr_err("Must call release_all_firmware prior to changing config\n");
 393                 rc = -EINVAL;
 394                 mutex_unlock(&test_fw_mutex);
 395                 goto out;
 396         }
 397
 398         rc = __test_dev_config_update_u8(buf, count,
 399                                          &test_fw_config->num_requests);
 400         mutex_unlock(&test_fw_mutex);
 401
 402 out:
 403         return rc;
 404 }
 405
 406 static ssize_t config_num_requests_show(struct device *dev,
 407                                         struct device_attribute *attr,
 408                                         char *buf)
 409 {
 410         return test_dev_config_show_u8(buf, test_fw_config->num_requests);
 411 }
 412 static DEVICE_ATTR_RW(config_num_requests);
 413
 414 static ssize_t config_sync_direct_store(struct device *dev,
 415                                         struct device_attribute *attr,
 416                                         const char *buf, size_t count)
 417 {
 418         int rc = test_dev_config_update_bool(buf, count,
 419                                              &test_fw_config->sync_direct);
 420
 421         if (rc == count)
 422                 test_fw_config->req_firmware = test_fw_config->sync_direct ?
 423                                        request_firmware_direct :
 424                                        request_firmware;
 425         return rc;
 426 }
 427
 428 static ssize_t config_sync_direct_show(struct device *dev,
 429                                        struct device_attribute *attr,
 430                                        char *buf)
 431 {
 432         return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
 433 }
 434 static DEVICE_ATTR_RW(config_sync_direct);
 435
 436 static ssize_t config_send_uevent_store(struct device *dev,
 437                                         struct device_attribute *attr,
 438                                         const char *buf, size_t count)
 439 {
 440         return test_dev_config_update_bool(buf, count,
 441                                            &test_fw_config->send_uevent);
 442 }
 443
 444 static ssize_t config_send_uevent_show(struct device *dev,
 445                                        struct device_attribute *attr,
 446                                        char *buf)
 447 {
 448         return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
 449 }
 450 static DEVICE_ATTR_RW(config_send_uevent);
 451
 452 static ssize_t config_read_fw_idx_store(struct device *dev,
 453                                         struct device_attribute *attr,
 454                                         const char *buf, size_t count)
 455 {
 456         return test_dev_config_update_u8(buf, count,
 457                                          &test_fw_config->read_fw_idx);
 458 }
 459
 460 static ssize_t config_read_fw_idx_show(struct device *dev,
 461                                        struct device_attribute *attr,
 462                                        char *buf)
 463 {
 464         return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
 465 }
 466 static DEVICE_ATTR_RW(config_read_fw_idx);
 467
 468
 469 static ssize_t trigger_request_store(struct device *dev,
 470                                      struct device_attribute *attr,
 471                                      const char *buf, size_t count)
 472 {
 473         int rc;
 474         char *name;
 475
 476         name = kstrndup(buf, count, GFP_KERNEL);
 477         if (!name)
 478                 return -ENOMEM;
 479
 480         pr_info("loading '%s'\n", name);
 481
 482         mutex_lock(&test_fw_mutex);
 483         release_firmware(test_firmware);
 484         test_firmware = NULL;
 485         rc = request_firmware(&test_firmware, name, dev);
 486         if (rc) {
 487                 pr_info("load of '%s' failed: %d\n", name, rc);
 488                 goto out;
 489         }
 490         pr_info("loaded: %zu\n", test_firmware->size);
 491         rc = count;
 492
 493 out:
 494         mutex_unlock(&test_fw_mutex);
 495
 496         kfree(name);
 497
 498         return rc;
 499 }
 500 static DEVICE_ATTR_WO(trigger_request);
 501
 502 static DECLARE_COMPLETION(async_fw_done);
 503
 504 static void trigger_async_request_cb(const struct firmware *fw, void *context)
 505 {
 506         test_firmware = fw;
 507         complete(&async_fw_done);
 508 }
 509
 510 static ssize_t trigger_async_request_store(struct device *dev,
 511                                            struct device_attribute *attr,
 512                                            const char *buf, size_t count)
 513 {
 514         int rc;
 515         char *name;
 516
 517         name = kstrndup(buf, count, GFP_KERNEL);
 518         if (!name)
 519                 return -ENOMEM;
 520
 521         pr_info("loading '%s'\n", name);
 522
 523         mutex_lock(&test_fw_mutex);
 524         release_firmware(test_firmware);
 525         test_firmware = NULL;
 526         rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
 527                                      NULL, trigger_async_request_cb);
 528         if (rc) {
 529                 pr_info("async load of '%s' failed: %d\n", name, rc);
 530                 kfree(name);
 531                 goto out;
 532         }
 533         /* Free 'name' ASAP, to test for race conditions */
 534         kfree(name);
 535
 536         wait_for_completion(&async_fw_done);
 537
 538         if (test_firmware) {
 539                 pr_info("loaded: %zu\n", test_firmware->size);
 540                 rc = count;
 541         } else {
 542                 pr_err("failed to async load firmware\n");
 543                 rc = -ENODEV;
 544         }
 545
 546 out:
 547         mutex_unlock(&test_fw_mutex);
 548
 549         return rc;
 550 }
 551 static DEVICE_ATTR_WO(trigger_async_request);
 552
 553 static ssize_t trigger_custom_fallback_store(struct device *dev,
 554                                              struct device_attribute *attr,
 555                                              const char *buf, size_t count)
 556 {
 557         int rc;
 558         char *name;
 559
 560         name = kstrndup(buf, count, GFP_KERNEL);
 561         if (!name)
 562                 return -ENOMEM;
 563
 564         pr_info("loading '%s' using custom fallback mechanism\n", name);
 565
 566         mutex_lock(&test_fw_mutex);
 567         release_firmware(test_firmware);
 568         test_firmware = NULL;
 569         rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
 570                                      dev, GFP_KERNEL, NULL,
 571                                      trigger_async_request_cb);
 572         if (rc) {
 573                 pr_info("async load of '%s' failed: %d\n", name, rc);
 574                 kfree(name);
 575                 goto out;
 576         }
 577         /* Free 'name' ASAP, to test for race conditions */
 578         kfree(name);
 579
 580         wait_for_completion(&async_fw_done);
 581
 582         if (test_firmware) {
 583                 pr_info("loaded: %zu\n", test_firmware->size);
 584                 rc = count;
 585         } else {
 586                 pr_err("failed to async load firmware\n");
 587                 rc = -ENODEV;
 588         }
 589
 590 out:
 591         mutex_unlock(&test_fw_mutex);
 592
 593         return rc;
 594 }
 595 static DEVICE_ATTR_WO(trigger_custom_fallback);
 596
 597 static int test_fw_run_batch_request(void *data)
 598 {
 599         struct test_batched_req *req = data;
 600
 601         if (!req) {
 602                 test_fw_config->test_result = -EINVAL;
 603                 return -EINVAL;
 604         }
 605
 606         req->rc = test_fw_config->req_firmware(&req->fw, req->name, req->dev);
 607         if (req->rc) {
 608                 pr_info("#%u: batched sync load failed: %d\n",
 609                         req->idx, req->rc);
 610                 if (!test_fw_config->test_result)
 611                         test_fw_config->test_result = req->rc;
 612         } else if (req->fw) {
 613                 req->sent = true;
 614                 pr_info("#%u: batched sync loaded %zu\n",
 615                         req->idx, req->fw->size);
 616         }
 617         complete(&req->completion);
 618
 619         req->task = NULL;
 620
 621         return 0;
 622 }
 623
 624 /*
 625  * We use a kthread as otherwise the kernel serializes all our sync requests
 626  * and we would not be able to mimic batched requests on a sync call. Batched
 627  * requests on a sync call can for instance happen on a device driver when
 628  * multiple cards are used and firmware loading happens outside of probe.
 629  */
 630 static ssize_t trigger_batched_requests_store(struct device *dev,
 631                                               struct device_attribute *attr,
 632                                               const char *buf, size_t count)
 633 {
 634         struct test_batched_req *req;
 635         int rc;
 636         u8 i;
 637
 638         mutex_lock(&test_fw_mutex);
 639
 640         if (test_fw_config->reqs) {
 641                 rc = -EBUSY;
 642                 goto out_bail;
 643         }
 644
 645         test_fw_config->reqs =
 646                 vzalloc(array3_size(sizeof(struct test_batched_req),
 647                                     test_fw_config->num_requests, 2));
 648         if (!test_fw_config->reqs) {
 649                 rc = -ENOMEM;
 650                 goto out_unlock;
 651         }
 652
 653         pr_info("batched sync firmware loading '%s' %u times\n",
 654                 test_fw_config->name, test_fw_config->num_requests);
 655
 656         for (i = 0; i < test_fw_config->num_requests; i++) {
 657                 req = &test_fw_config->reqs[i];
 658                 if (!req) {
 659                         WARN_ON(1);
 660                         rc = -ENOMEM;
 661                         goto out_bail;
 662                 }
 663                 req->fw = NULL;
 664                 req->idx = i;
 665                 req->name = test_fw_config->name;
 666                 req->dev = dev;
 667                 init_completion(&req->completion);
 668                 req->task = kthread_run(test_fw_run_batch_request, req,
 669                                              "%s-%u", KBUILD_MODNAME, req->idx);
 670                 if (!req->task || IS_ERR(req->task)) {
 671                         pr_err("Setting up thread %u failed\n", req->idx);
 672                         req->task = NULL;
 673                         rc = -ENOMEM;
 674                         goto out_bail;
 675                 }
 676         }
 677
 678         rc = count;
 679
 680         /*
 681          * We require an explicit release to enable more time and delay of
 682          * calling release_firmware() to improve our chances of forcing a
 683          * batched request. If we instead called release_firmware() right away
 684          * then we might miss on an opportunity of having a successful firmware
 685          * request pass on the opportunity to be come a batched request.
 686          */
 687
 688 out_bail:
 689         for (i = 0; i < test_fw_config->num_requests; i++) {
 690                 req = &test_fw_config->reqs[i];
 691                 if (req->task || req->sent)
 692                         wait_for_completion(&req->completion);
 693         }
 694
 695         /* Override any worker error if we had a general setup error */
 696         if (rc < 0)
 697                 test_fw_config->test_result = rc;
 698
 699 out_unlock:
 700         mutex_unlock(&test_fw_mutex);
 701
 702         return rc;
 703 }
 704 static DEVICE_ATTR_WO(trigger_batched_requests);
 705
 706 /*
 707  * We wait for each callback to return with the lock held, no need to lock here
 708  */
 709 static void trigger_batched_cb(const struct firmware *fw, void *context)
 710 {
 711         struct test_batched_req *req = context;
 712
 713         if (!req) {
 714                 test_fw_config->test_result = -EINVAL;
 715                 return;
 716         }
 717
 718         /* forces *some* batched requests to queue up */
 719         if (!req->idx)
 720                 ssleep(2);
 721
 722         req->fw = fw;
 723
 724         /*
 725          * Unfortunately the firmware API gives us nothing other than a null FW
 726          * if the firmware was not found on async requests.  Best we can do is
 727          * just assume -ENOENT. A better API would pass the actual return
 728          * value to the callback.
 729          */
 730         if (!fw && !test_fw_config->test_result)
 731                 test_fw_config->test_result = -ENOENT;
 732
 733         complete(&req->completion);
 734 }
 735
 736 static
 737 ssize_t trigger_batched_requests_async_store(struct device *dev,
 738                                              struct device_attribute *attr,
 739                                              const char *buf, size_t count)
 740 {
 741         struct test_batched_req *req;
 742         bool send_uevent;
 743         int rc;
 744         u8 i;
 745
 746         mutex_lock(&test_fw_mutex);
 747
 748         if (test_fw_config->reqs) {
 749                 rc = -EBUSY;
 750                 goto out_bail;
 751         }
 752
 753         test_fw_config->reqs =
 754                 vzalloc(array3_size(sizeof(struct test_batched_req),
 755                                     test_fw_config->num_requests, 2));
 756         if (!test_fw_config->reqs) {
 757                 rc = -ENOMEM;
 758                 goto out;
 759         }
 760
 761         pr_info("batched loading '%s' custom fallback mechanism %u times\n",
 762                 test_fw_config->name, test_fw_config->num_requests);
 763
 764         send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
 765                 FW_ACTION_NOHOTPLUG;
 766
 767         for (i = 0; i < test_fw_config->num_requests; i++) {
 768                 req = &test_fw_config->reqs[i];
 769                 if (!req) {
 770                         WARN_ON(1);
 771                         goto out_bail;
 772                 }
 773                 req->name = test_fw_config->name;
 774                 req->fw = NULL;
 775                 req->idx = i;
 776                 init_completion(&req->completion);
 777                 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
 778                                              req->name,
 779                                              dev, GFP_KERNEL, req,
 780                                              trigger_batched_cb);
 781                 if (rc) {
 782                         pr_info("#%u: batched async load failed setup: %d\n",
 783                                 i, rc);
 784                         req->rc = rc;
 785                         goto out_bail;
 786                 } else
 787                         req->sent = true;
 788         }
 789
 790         rc = count;
 791
 792 out_bail:
 793
 794         /*
 795          * We require an explicit release to enable more time and delay of
 796          * calling release_firmware() to improve our chances of forcing a
 797          * batched request. If we instead called release_firmware() right away
 798          * then we might miss on an opportunity of having a successful firmware
 799          * request pass on the opportunity to be come a batched request.
 800          */
 801
 802         for (i = 0; i < test_fw_config->num_requests; i++) {
 803                 req = &test_fw_config->reqs[i];
 804                 if (req->sent)
 805                         wait_for_completion(&req->completion);
 806         }
 807
 808         /* Override any worker error if we had a general setup error */
 809         if (rc < 0)
 810                 test_fw_config->test_result = rc;
 811
 812 out:
 813         mutex_unlock(&test_fw_mutex);
 814
 815         return rc;
 816 }
 817 static DEVICE_ATTR_WO(trigger_batched_requests_async);
 818
 819 static ssize_t test_result_show(struct device *dev,
 820                                 struct device_attribute *attr,
 821                                 char *buf)
 822 {
 823         return test_dev_config_show_int(buf, test_fw_config->test_result);
 824 }
 825 static DEVICE_ATTR_RO(test_result);
 826
 827 static ssize_t release_all_firmware_store(struct device *dev,
 828                                           struct device_attribute *attr,
 829                                           const char *buf, size_t count)
 830 {
 831         test_release_all_firmware();
 832         return count;
 833 }
 834 static DEVICE_ATTR_WO(release_all_firmware);
 835
 836 static ssize_t read_firmware_show(struct device *dev,
 837                                   struct device_attribute *attr,
 838                                   char *buf)
 839 {
 840         struct test_batched_req *req;
 841         u8 idx;
 842         ssize_t rc = 0;
 843
 844         mutex_lock(&test_fw_mutex);
 845
 846         idx = test_fw_config->read_fw_idx;
 847         if (idx >= test_fw_config->num_requests) {
 848                 rc = -ERANGE;
 849                 goto out;
 850         }
 851
 852         if (!test_fw_config->reqs) {
 853                 rc = -EINVAL;
 854                 goto out;
 855         }
 856
 857         req = &test_fw_config->reqs[idx];
 858         if (!req->fw) {
 859                 pr_err("#%u: failed to async load firmware\n", idx);
 860                 rc = -ENOENT;
 861                 goto out;
 862         }
 863
 864         pr_info("#%u: loaded %zu\n", idx, req->fw->size);
 865
 866         if (req->fw->size > PAGE_SIZE) {
 867                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
 868                 rc = -EINVAL;
 869                 goto out;
 870         }
 871         memcpy(buf, req->fw->data, req->fw->size);
 872
 873         rc = req->fw->size;
 874 out:
 875         mutex_unlock(&test_fw_mutex);
 876
 877         return rc;
 878 }
 879 static DEVICE_ATTR_RO(read_firmware);
 880
 881 #define TEST_FW_DEV_ATTR(name)          &dev_attr_##name.attr
 882
 883 static struct attribute *test_dev_attrs[] = {
 884         TEST_FW_DEV_ATTR(reset),
 885
 886         TEST_FW_DEV_ATTR(config),
 887         TEST_FW_DEV_ATTR(config_name),
 888         TEST_FW_DEV_ATTR(config_num_requests),
 889         TEST_FW_DEV_ATTR(config_sync_direct),
 890         TEST_FW_DEV_ATTR(config_send_uevent),
 891         TEST_FW_DEV_ATTR(config_read_fw_idx),
 892
 893         /* These don't use the config at all - they could be ported! */
 894         TEST_FW_DEV_ATTR(trigger_request),
 895         TEST_FW_DEV_ATTR(trigger_async_request),
 896         TEST_FW_DEV_ATTR(trigger_custom_fallback),
 897
 898         /* These use the config and can use the test_result */
 899         TEST_FW_DEV_ATTR(trigger_batched_requests),
 900         TEST_FW_DEV_ATTR(trigger_batched_requests_async),
 901
 902         TEST_FW_DEV_ATTR(release_all_firmware),
 903         TEST_FW_DEV_ATTR(test_result),
 904         TEST_FW_DEV_ATTR(read_firmware),
 905         NULL,
 906 };
 907
 908 ATTRIBUTE_GROUPS(test_dev);
 909
 910 static struct miscdevice test_fw_misc_device = {
 911         .minor          = MISC_DYNAMIC_MINOR,
 912         .name           = "test_firmware",
 913         .fops           = &test_fw_fops,
 914         .groups         = test_dev_groups,
 915 };
 916
 917 static int __init test_firmware_init(void)
 918 {
 919         int rc;
 920
 921         test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
 922         if (!test_fw_config)
 923                 return -ENOMEM;
 924
 925         rc = __test_firmware_config_init();
 926         if (rc) {
 927                 kfree(test_fw_config);
 928                 pr_err("could not init firmware test config: %d\n", rc);
 929                 return rc;
 930         }
 931
 932         rc = misc_register(&test_fw_misc_device);
 933         if (rc) {
 934                 __test_firmware_config_free();
 935                 kfree(test_fw_config);
 936                 pr_err("could not register misc device: %d\n", rc);
 937                 return rc;
 938         }
 939
 940         pr_warn("interface ready\n");
 941
 942         return 0;
 943 }
 944
 945 module_init(test_firmware_init);
 946
 947 static void __exit test_firmware_exit(void)
 948 {
 949         mutex_lock(&test_fw_mutex);
 950         release_firmware(test_firmware);
 951         misc_deregister(&test_fw_misc_device);
 952         __test_firmware_config_free();
 953         kfree(test_fw_config);
 954         mutex_unlock(&test_fw_mutex);
 955
 956         pr_warn("removed interface\n");
 957 }
 958
 959 module_exit(test_firmware_exit);
 960
 961 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
 962 MODULE_LICENSE("GPL");