2 * This module provides an interface to trigger and test firmware loading.
4 * It is designed to be used for basic evaluation of the firmware loading
5 * subsystem (for example when validating firmware verification). It lacks
6 * any extra dependencies, and will not normally be loaded by the system
7 * unless explicitly requested by name.
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/printk.h>
15 #include <linux/completion.h>
16 #include <linux/firmware.h>
17 #include <linux/device.h>
19 #include <linux/miscdevice.h>
20 #include <linux/slab.h>
21 #include <linux/uaccess.h>
22 #include <linux/delay.h>
23 #include <linux/kthread.h>
24 #include <linux/vmalloc.h>
26 #define TEST_FIRMWARE_NAME "test-firmware.bin"
27 #define TEST_FIRMWARE_NUM_REQS 4
29 static DEFINE_MUTEX(test_fw_mutex);
30 static const struct firmware *test_firmware;
32 struct test_batched_req {
36 const struct firmware *fw;
38 struct completion completion;
39 struct task_struct *task;
44 * test_config - represents configuration for the test for different triggers
46 * @name: the name of the firmware file to look for
47 * @sync_direct: when the sync trigger is used if this is true
48 * request_firmware_direct() will be used instead.
49 * @send_uevent: whether or not to send a uevent for async requests
50 * @num_requests: number of requests to try per test case. This is trigger
52 * @reqs: stores all requests information
53 * @read_fw_idx: index of thread from which we want to read firmware results
54 * from through the read_fw trigger.
55 * @test_result: a test may use this to collect the result from the call
56 * of the request_firmware*() calls used in their tests. In order of
57 * priority we always keep first any setup error. If no setup errors were
58 * found then we move on to the first error encountered while running the
59 * API. Note that for async calls this typically will be a successful
60 * result (0) unless of course you've used bogus parameters, or the system
61 * is out of memory. In the async case the callback is expected to do a
62 * bit more homework to figure out what happened, unfortunately the only
63 * information passed today on error is the fact that no firmware was
64 * found so we can only assume -ENOENT on async calls if the firmware is
67 * Errors you can expect:
71 * 0: success for sync, for async it means request was sent
72 * -EINVAL: invalid parameters or request
73 * -ENOENT: files not found
77 * -ENOMEM: memory pressure on system
78 * -ENODEV: out of number of devices to test
79 * -EINVAL: an unexpected error has occurred
80 * @req_firmware: if @sync_direct is true this is set to
81 * request_firmware_direct(), otherwise request_firmware()
91 * These below don't belong her but we'll move them once we create
92 * a struct fw_test_device and stuff the misc_dev under there later.
94 struct test_batched_req *reqs;
96 int (*req_firmware)(const struct firmware **fw, const char *name,
97 struct device *device);
100 static struct test_config *test_fw_config;
102 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
103 size_t size, loff_t *offset)
107 mutex_lock(&test_fw_mutex);
109 rc = simple_read_from_buffer(buf, size, offset,
111 test_firmware->size);
112 mutex_unlock(&test_fw_mutex);
116 static const struct file_operations test_fw_fops = {
117 .owner = THIS_MODULE,
118 .read = test_fw_misc_read,
121 static void __test_release_all_firmware(void)
123 struct test_batched_req *req;
126 if (!test_fw_config->reqs)
129 for (i = 0; i < test_fw_config->num_requests; i++) {
130 req = &test_fw_config->reqs[i];
132 release_firmware(req->fw);
135 vfree(test_fw_config->reqs);
136 test_fw_config->reqs = NULL;
139 static void test_release_all_firmware(void)
141 mutex_lock(&test_fw_mutex);
142 __test_release_all_firmware();
143 mutex_unlock(&test_fw_mutex);
147 static void __test_firmware_config_free(void)
149 __test_release_all_firmware();
150 kfree_const(test_fw_config->name);
151 test_fw_config->name = NULL;
155 * XXX: move to kstrncpy() once merged.
157 * Users should use kfree_const() when freeing these.
159 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
161 *dst = kstrndup(name, count, gfp);
167 static int __test_firmware_config_init(void)
171 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
172 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
176 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
177 test_fw_config->send_uevent = true;
178 test_fw_config->sync_direct = false;
179 test_fw_config->req_firmware = request_firmware;
180 test_fw_config->test_result = 0;
181 test_fw_config->reqs = NULL;
186 __test_firmware_config_free();
190 static ssize_t reset_store(struct device *dev,
191 struct device_attribute *attr,
192 const char *buf, size_t count)
196 mutex_lock(&test_fw_mutex);
198 __test_firmware_config_free();
200 ret = __test_firmware_config_init();
203 pr_err("could not alloc settings for config trigger: %d\n",
212 mutex_unlock(&test_fw_mutex);
216 static DEVICE_ATTR_WO(reset);
218 static ssize_t config_show(struct device *dev,
219 struct device_attribute *attr,
224 mutex_lock(&test_fw_mutex);
226 len += scnprintf(buf, PAGE_SIZE - len,
227 "Custom trigger configuration for: %s\n",
230 if (test_fw_config->name)
231 len += scnprintf(buf+len, PAGE_SIZE - len,
233 test_fw_config->name);
235 len += scnprintf(buf+len, PAGE_SIZE - len,
238 len += scnprintf(buf+len, PAGE_SIZE - len,
239 "num_requests:\t%u\n", test_fw_config->num_requests);
241 len += scnprintf(buf+len, PAGE_SIZE - len,
242 "send_uevent:\t\t%s\n",
243 test_fw_config->send_uevent ?
244 "FW_ACTION_HOTPLUG" :
245 "FW_ACTION_NOHOTPLUG");
246 len += scnprintf(buf+len, PAGE_SIZE - len,
247 "sync_direct:\t\t%s\n",
248 test_fw_config->sync_direct ? "true" : "false");
249 len += scnprintf(buf+len, PAGE_SIZE - len,
250 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
252 mutex_unlock(&test_fw_mutex);
256 static DEVICE_ATTR_RO(config);
258 static ssize_t config_name_store(struct device *dev,
259 struct device_attribute *attr,
260 const char *buf, size_t count)
264 mutex_lock(&test_fw_mutex);
265 kfree_const(test_fw_config->name);
266 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
267 mutex_unlock(&test_fw_mutex);
273 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
275 static ssize_t config_test_show_str(char *dst,
280 mutex_lock(&test_fw_mutex);
281 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
282 mutex_unlock(&test_fw_mutex);
287 static inline int __test_dev_config_update_bool(const char *buf, size_t size,
292 if (strtobool(buf, cfg) < 0)
300 static int test_dev_config_update_bool(const char *buf, size_t size,
305 mutex_lock(&test_fw_mutex);
306 ret = __test_dev_config_update_bool(buf, size, cfg);
307 mutex_unlock(&test_fw_mutex);
313 test_dev_config_show_bool(char *buf,
318 mutex_lock(&test_fw_mutex);
320 mutex_unlock(&test_fw_mutex);
322 return snprintf(buf, PAGE_SIZE, "%d\n", val);
325 static ssize_t test_dev_config_show_int(char *buf, int cfg)
329 mutex_lock(&test_fw_mutex);
331 mutex_unlock(&test_fw_mutex);
333 return snprintf(buf, PAGE_SIZE, "%d\n", val);
336 static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
341 ret = kstrtol(buf, 10, &new);
350 /* Always return full write size even if we didn't consume all */
354 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
358 mutex_lock(&test_fw_mutex);
359 ret = __test_dev_config_update_u8(buf, size, cfg);
360 mutex_unlock(&test_fw_mutex);
365 static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
369 mutex_lock(&test_fw_mutex);
371 mutex_unlock(&test_fw_mutex);
373 return snprintf(buf, PAGE_SIZE, "%u\n", val);
376 static ssize_t config_name_show(struct device *dev,
377 struct device_attribute *attr,
380 return config_test_show_str(buf, test_fw_config->name);
382 static DEVICE_ATTR_RW(config_name);
384 static ssize_t config_num_requests_store(struct device *dev,
385 struct device_attribute *attr,
386 const char *buf, size_t count)
390 mutex_lock(&test_fw_mutex);
391 if (test_fw_config->reqs) {
392 pr_err("Must call release_all_firmware prior to changing config\n");
394 mutex_unlock(&test_fw_mutex);
398 rc = __test_dev_config_update_u8(buf, count,
399 &test_fw_config->num_requests);
400 mutex_unlock(&test_fw_mutex);
406 static ssize_t config_num_requests_show(struct device *dev,
407 struct device_attribute *attr,
410 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
412 static DEVICE_ATTR_RW(config_num_requests);
414 static ssize_t config_sync_direct_store(struct device *dev,
415 struct device_attribute *attr,
416 const char *buf, size_t count)
418 int rc = test_dev_config_update_bool(buf, count,
419 &test_fw_config->sync_direct);
422 test_fw_config->req_firmware = test_fw_config->sync_direct ?
423 request_firmware_direct :
428 static ssize_t config_sync_direct_show(struct device *dev,
429 struct device_attribute *attr,
432 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
434 static DEVICE_ATTR_RW(config_sync_direct);
436 static ssize_t config_send_uevent_store(struct device *dev,
437 struct device_attribute *attr,
438 const char *buf, size_t count)
440 return test_dev_config_update_bool(buf, count,
441 &test_fw_config->send_uevent);
444 static ssize_t config_send_uevent_show(struct device *dev,
445 struct device_attribute *attr,
448 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
450 static DEVICE_ATTR_RW(config_send_uevent);
452 static ssize_t config_read_fw_idx_store(struct device *dev,
453 struct device_attribute *attr,
454 const char *buf, size_t count)
456 return test_dev_config_update_u8(buf, count,
457 &test_fw_config->read_fw_idx);
460 static ssize_t config_read_fw_idx_show(struct device *dev,
461 struct device_attribute *attr,
464 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
466 static DEVICE_ATTR_RW(config_read_fw_idx);
469 static ssize_t trigger_request_store(struct device *dev,
470 struct device_attribute *attr,
471 const char *buf, size_t count)
476 name = kstrndup(buf, count, GFP_KERNEL);
480 pr_info("loading '%s'\n", name);
482 mutex_lock(&test_fw_mutex);
483 release_firmware(test_firmware);
484 test_firmware = NULL;
485 rc = request_firmware(&test_firmware, name, dev);
487 pr_info("load of '%s' failed: %d\n", name, rc);
490 pr_info("loaded: %zu\n", test_firmware->size);
494 mutex_unlock(&test_fw_mutex);
500 static DEVICE_ATTR_WO(trigger_request);
502 static DECLARE_COMPLETION(async_fw_done);
504 static void trigger_async_request_cb(const struct firmware *fw, void *context)
507 complete(&async_fw_done);
510 static ssize_t trigger_async_request_store(struct device *dev,
511 struct device_attribute *attr,
512 const char *buf, size_t count)
517 name = kstrndup(buf, count, GFP_KERNEL);
521 pr_info("loading '%s'\n", name);
523 mutex_lock(&test_fw_mutex);
524 release_firmware(test_firmware);
525 test_firmware = NULL;
526 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
527 NULL, trigger_async_request_cb);
529 pr_info("async load of '%s' failed: %d\n", name, rc);
533 /* Free 'name' ASAP, to test for race conditions */
536 wait_for_completion(&async_fw_done);
539 pr_info("loaded: %zu\n", test_firmware->size);
542 pr_err("failed to async load firmware\n");
547 mutex_unlock(&test_fw_mutex);
551 static DEVICE_ATTR_WO(trigger_async_request);
553 static ssize_t trigger_custom_fallback_store(struct device *dev,
554 struct device_attribute *attr,
555 const char *buf, size_t count)
560 name = kstrndup(buf, count, GFP_KERNEL);
564 pr_info("loading '%s' using custom fallback mechanism\n", name);
566 mutex_lock(&test_fw_mutex);
567 release_firmware(test_firmware);
568 test_firmware = NULL;
569 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
570 dev, GFP_KERNEL, NULL,
571 trigger_async_request_cb);
573 pr_info("async load of '%s' failed: %d\n", name, rc);
577 /* Free 'name' ASAP, to test for race conditions */
580 wait_for_completion(&async_fw_done);
583 pr_info("loaded: %zu\n", test_firmware->size);
586 pr_err("failed to async load firmware\n");
591 mutex_unlock(&test_fw_mutex);
595 static DEVICE_ATTR_WO(trigger_custom_fallback);
597 static int test_fw_run_batch_request(void *data)
599 struct test_batched_req *req = data;
602 test_fw_config->test_result = -EINVAL;
606 req->rc = test_fw_config->req_firmware(&req->fw, req->name, req->dev);
608 pr_info("#%u: batched sync load failed: %d\n",
610 if (!test_fw_config->test_result)
611 test_fw_config->test_result = req->rc;
612 } else if (req->fw) {
614 pr_info("#%u: batched sync loaded %zu\n",
615 req->idx, req->fw->size);
617 complete(&req->completion);
625 * We use a kthread as otherwise the kernel serializes all our sync requests
626 * and we would not be able to mimic batched requests on a sync call. Batched
627 * requests on a sync call can for instance happen on a device driver when
628 * multiple cards are used and firmware loading happens outside of probe.
630 static ssize_t trigger_batched_requests_store(struct device *dev,
631 struct device_attribute *attr,
632 const char *buf, size_t count)
634 struct test_batched_req *req;
638 mutex_lock(&test_fw_mutex);
640 if (test_fw_config->reqs) {
645 test_fw_config->reqs =
646 vzalloc(array3_size(sizeof(struct test_batched_req),
647 test_fw_config->num_requests, 2));
648 if (!test_fw_config->reqs) {
653 pr_info("batched sync firmware loading '%s' %u times\n",
654 test_fw_config->name, test_fw_config->num_requests);
656 for (i = 0; i < test_fw_config->num_requests; i++) {
657 req = &test_fw_config->reqs[i];
665 req->name = test_fw_config->name;
667 init_completion(&req->completion);
668 req->task = kthread_run(test_fw_run_batch_request, req,
669 "%s-%u", KBUILD_MODNAME, req->idx);
670 if (!req->task || IS_ERR(req->task)) {
671 pr_err("Setting up thread %u failed\n", req->idx);
681 * We require an explicit release to enable more time and delay of
682 * calling release_firmware() to improve our chances of forcing a
683 * batched request. If we instead called release_firmware() right away
684 * then we might miss on an opportunity of having a successful firmware
685 * request pass on the opportunity to be come a batched request.
689 for (i = 0; i < test_fw_config->num_requests; i++) {
690 req = &test_fw_config->reqs[i];
691 if (req->task || req->sent)
692 wait_for_completion(&req->completion);
695 /* Override any worker error if we had a general setup error */
697 test_fw_config->test_result = rc;
700 mutex_unlock(&test_fw_mutex);
704 static DEVICE_ATTR_WO(trigger_batched_requests);
707 * We wait for each callback to return with the lock held, no need to lock here
709 static void trigger_batched_cb(const struct firmware *fw, void *context)
711 struct test_batched_req *req = context;
714 test_fw_config->test_result = -EINVAL;
718 /* forces *some* batched requests to queue up */
725 * Unfortunately the firmware API gives us nothing other than a null FW
726 * if the firmware was not found on async requests. Best we can do is
727 * just assume -ENOENT. A better API would pass the actual return
728 * value to the callback.
730 if (!fw && !test_fw_config->test_result)
731 test_fw_config->test_result = -ENOENT;
733 complete(&req->completion);
737 ssize_t trigger_batched_requests_async_store(struct device *dev,
738 struct device_attribute *attr,
739 const char *buf, size_t count)
741 struct test_batched_req *req;
746 mutex_lock(&test_fw_mutex);
748 if (test_fw_config->reqs) {
753 test_fw_config->reqs =
754 vzalloc(array3_size(sizeof(struct test_batched_req),
755 test_fw_config->num_requests, 2));
756 if (!test_fw_config->reqs) {
761 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
762 test_fw_config->name, test_fw_config->num_requests);
764 send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
767 for (i = 0; i < test_fw_config->num_requests; i++) {
768 req = &test_fw_config->reqs[i];
773 req->name = test_fw_config->name;
776 init_completion(&req->completion);
777 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
779 dev, GFP_KERNEL, req,
782 pr_info("#%u: batched async load failed setup: %d\n",
795 * We require an explicit release to enable more time and delay of
796 * calling release_firmware() to improve our chances of forcing a
797 * batched request. If we instead called release_firmware() right away
798 * then we might miss on an opportunity of having a successful firmware
799 * request pass on the opportunity to be come a batched request.
802 for (i = 0; i < test_fw_config->num_requests; i++) {
803 req = &test_fw_config->reqs[i];
805 wait_for_completion(&req->completion);
808 /* Override any worker error if we had a general setup error */
810 test_fw_config->test_result = rc;
813 mutex_unlock(&test_fw_mutex);
817 static DEVICE_ATTR_WO(trigger_batched_requests_async);
819 static ssize_t test_result_show(struct device *dev,
820 struct device_attribute *attr,
823 return test_dev_config_show_int(buf, test_fw_config->test_result);
825 static DEVICE_ATTR_RO(test_result);
827 static ssize_t release_all_firmware_store(struct device *dev,
828 struct device_attribute *attr,
829 const char *buf, size_t count)
831 test_release_all_firmware();
834 static DEVICE_ATTR_WO(release_all_firmware);
836 static ssize_t read_firmware_show(struct device *dev,
837 struct device_attribute *attr,
840 struct test_batched_req *req;
844 mutex_lock(&test_fw_mutex);
846 idx = test_fw_config->read_fw_idx;
847 if (idx >= test_fw_config->num_requests) {
852 if (!test_fw_config->reqs) {
857 req = &test_fw_config->reqs[idx];
859 pr_err("#%u: failed to async load firmware\n", idx);
864 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
866 if (req->fw->size > PAGE_SIZE) {
867 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
871 memcpy(buf, req->fw->data, req->fw->size);
875 mutex_unlock(&test_fw_mutex);
879 static DEVICE_ATTR_RO(read_firmware);
881 #define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
883 static struct attribute *test_dev_attrs[] = {
884 TEST_FW_DEV_ATTR(reset),
886 TEST_FW_DEV_ATTR(config),
887 TEST_FW_DEV_ATTR(config_name),
888 TEST_FW_DEV_ATTR(config_num_requests),
889 TEST_FW_DEV_ATTR(config_sync_direct),
890 TEST_FW_DEV_ATTR(config_send_uevent),
891 TEST_FW_DEV_ATTR(config_read_fw_idx),
893 /* These don't use the config at all - they could be ported! */
894 TEST_FW_DEV_ATTR(trigger_request),
895 TEST_FW_DEV_ATTR(trigger_async_request),
896 TEST_FW_DEV_ATTR(trigger_custom_fallback),
898 /* These use the config and can use the test_result */
899 TEST_FW_DEV_ATTR(trigger_batched_requests),
900 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
902 TEST_FW_DEV_ATTR(release_all_firmware),
903 TEST_FW_DEV_ATTR(test_result),
904 TEST_FW_DEV_ATTR(read_firmware),
908 ATTRIBUTE_GROUPS(test_dev);
910 static struct miscdevice test_fw_misc_device = {
911 .minor = MISC_DYNAMIC_MINOR,
912 .name = "test_firmware",
913 .fops = &test_fw_fops,
914 .groups = test_dev_groups,
917 static int __init test_firmware_init(void)
921 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
925 rc = __test_firmware_config_init();
927 kfree(test_fw_config);
928 pr_err("could not init firmware test config: %d\n", rc);
932 rc = misc_register(&test_fw_misc_device);
934 __test_firmware_config_free();
935 kfree(test_fw_config);
936 pr_err("could not register misc device: %d\n", rc);
940 pr_warn("interface ready\n");
945 module_init(test_firmware_init);
947 static void __exit test_firmware_exit(void)
949 mutex_lock(&test_fw_mutex);
950 release_firmware(test_firmware);
951 misc_deregister(&test_fw_misc_device);
952 __test_firmware_config_free();
953 kfree(test_fw_config);
954 mutex_unlock(&test_fw_mutex);
956 pr_warn("removed interface\n");
959 module_exit(test_firmware_exit);
961 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
962 MODULE_LICENSE("GPL");