1 // SPDX-License-Identifier: GPL-2.0-only
3 * This module provides an interface to trigger and test firmware loading.
5 * It is designed to be used for basic evaluation of the firmware loading
6 * subsystem (for example when validating firmware verification). It lacks
7 * any extra dependencies, and will not normally be loaded by the system
8 * unless explicitly requested by name.
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/printk.h>
16 #include <linux/completion.h>
17 #include <linux/firmware.h>
18 #include <linux/device.h>
20 #include <linux/miscdevice.h>
21 #include <linux/sizes.h>
22 #include <linux/slab.h>
23 #include <linux/uaccess.h>
24 #include <linux/delay.h>
25 #include <linux/kthread.h>
26 #include <linux/vmalloc.h>
28 #define TEST_FIRMWARE_NAME "test-firmware.bin"
29 #define TEST_FIRMWARE_NUM_REQS 4
30 #define TEST_FIRMWARE_BUF_SIZE SZ_1K
32 static DEFINE_MUTEX(test_fw_mutex);
33 static const struct firmware *test_firmware;
35 struct test_batched_req {
39 const struct firmware *fw;
42 struct completion completion;
43 struct task_struct *task;
48 * test_config - represents configuration for the test for different triggers
50 * @name: the name of the firmware file to look for
51 * @into_buf: when the into_buf is used if this is true
52 * request_firmware_into_buf() will be used instead.
53 * @sync_direct: when the sync trigger is used if this is true
54 * request_firmware_direct() will be used instead.
55 * @send_uevent: whether or not to send a uevent for async requests
56 * @num_requests: number of requests to try per test case. This is trigger
58 * @reqs: stores all requests information
59 * @read_fw_idx: index of thread from which we want to read firmware results
60 * from through the read_fw trigger.
61 * @test_result: a test may use this to collect the result from the call
62 * of the request_firmware*() calls used in their tests. In order of
63 * priority we always keep first any setup error. If no setup errors were
64 * found then we move on to the first error encountered while running the
65 * API. Note that for async calls this typically will be a successful
66 * result (0) unless of course you've used bogus parameters, or the system
67 * is out of memory. In the async case the callback is expected to do a
68 * bit more homework to figure out what happened, unfortunately the only
69 * information passed today on error is the fact that no firmware was
70 * found so we can only assume -ENOENT on async calls if the firmware is
73 * Errors you can expect:
77 * 0: success for sync, for async it means request was sent
78 * -EINVAL: invalid parameters or request
79 * -ENOENT: files not found
83 * -ENOMEM: memory pressure on system
84 * -ENODEV: out of number of devices to test
85 * -EINVAL: an unexpected error has occurred
86 * @req_firmware: if @sync_direct is true this is set to
87 * request_firmware_direct(), otherwise request_firmware()
98 * These below don't belong her but we'll move them once we create
99 * a struct fw_test_device and stuff the misc_dev under there later.
101 struct test_batched_req *reqs;
103 int (*req_firmware)(const struct firmware **fw, const char *name,
104 struct device *device);
107 static struct test_config *test_fw_config;
109 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
110 size_t size, loff_t *offset)
114 mutex_lock(&test_fw_mutex);
116 rc = simple_read_from_buffer(buf, size, offset,
118 test_firmware->size);
119 mutex_unlock(&test_fw_mutex);
123 static const struct file_operations test_fw_fops = {
124 .owner = THIS_MODULE,
125 .read = test_fw_misc_read,
128 static void __test_release_all_firmware(void)
130 struct test_batched_req *req;
133 if (!test_fw_config->reqs)
136 for (i = 0; i < test_fw_config->num_requests; i++) {
137 req = &test_fw_config->reqs[i];
140 kfree_const(req->fw_buf);
143 release_firmware(req->fw);
148 vfree(test_fw_config->reqs);
149 test_fw_config->reqs = NULL;
152 static void test_release_all_firmware(void)
154 mutex_lock(&test_fw_mutex);
155 __test_release_all_firmware();
156 mutex_unlock(&test_fw_mutex);
160 static void __test_firmware_config_free(void)
162 __test_release_all_firmware();
163 kfree_const(test_fw_config->name);
164 test_fw_config->name = NULL;
168 * XXX: move to kstrncpy() once merged.
170 * Users should use kfree_const() when freeing these.
172 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
174 *dst = kstrndup(name, count, gfp);
180 static int __test_firmware_config_init(void)
184 ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
185 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
189 test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
190 test_fw_config->send_uevent = true;
191 test_fw_config->into_buf = false;
192 test_fw_config->sync_direct = false;
193 test_fw_config->req_firmware = request_firmware;
194 test_fw_config->test_result = 0;
195 test_fw_config->reqs = NULL;
200 __test_firmware_config_free();
204 static ssize_t reset_store(struct device *dev,
205 struct device_attribute *attr,
206 const char *buf, size_t count)
210 mutex_lock(&test_fw_mutex);
212 __test_firmware_config_free();
214 ret = __test_firmware_config_init();
217 pr_err("could not alloc settings for config trigger: %d\n",
226 mutex_unlock(&test_fw_mutex);
230 static DEVICE_ATTR_WO(reset);
232 static ssize_t config_show(struct device *dev,
233 struct device_attribute *attr,
238 mutex_lock(&test_fw_mutex);
240 len += scnprintf(buf, PAGE_SIZE - len,
241 "Custom trigger configuration for: %s\n",
244 if (test_fw_config->name)
245 len += scnprintf(buf+len, PAGE_SIZE - len,
247 test_fw_config->name);
249 len += scnprintf(buf+len, PAGE_SIZE - len,
252 len += scnprintf(buf+len, PAGE_SIZE - len,
253 "num_requests:\t%u\n", test_fw_config->num_requests);
255 len += scnprintf(buf+len, PAGE_SIZE - len,
256 "send_uevent:\t\t%s\n",
257 test_fw_config->send_uevent ?
258 "FW_ACTION_HOTPLUG" :
259 "FW_ACTION_NOHOTPLUG");
260 len += scnprintf(buf+len, PAGE_SIZE - len,
262 test_fw_config->into_buf ? "true" : "false");
263 len += scnprintf(buf+len, PAGE_SIZE - len,
264 "sync_direct:\t\t%s\n",
265 test_fw_config->sync_direct ? "true" : "false");
266 len += scnprintf(buf+len, PAGE_SIZE - len,
267 "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
269 mutex_unlock(&test_fw_mutex);
273 static DEVICE_ATTR_RO(config);
275 static ssize_t config_name_store(struct device *dev,
276 struct device_attribute *attr,
277 const char *buf, size_t count)
281 mutex_lock(&test_fw_mutex);
282 kfree_const(test_fw_config->name);
283 ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
284 mutex_unlock(&test_fw_mutex);
290 * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
292 static ssize_t config_test_show_str(char *dst,
297 mutex_lock(&test_fw_mutex);
298 len = snprintf(dst, PAGE_SIZE, "%s\n", src);
299 mutex_unlock(&test_fw_mutex);
304 static inline int __test_dev_config_update_bool(const char *buf, size_t size,
309 if (strtobool(buf, cfg) < 0)
317 static int test_dev_config_update_bool(const char *buf, size_t size,
322 mutex_lock(&test_fw_mutex);
323 ret = __test_dev_config_update_bool(buf, size, cfg);
324 mutex_unlock(&test_fw_mutex);
330 test_dev_config_show_bool(char *buf,
335 mutex_lock(&test_fw_mutex);
337 mutex_unlock(&test_fw_mutex);
339 return snprintf(buf, PAGE_SIZE, "%d\n", val);
342 static ssize_t test_dev_config_show_int(char *buf, int cfg)
346 mutex_lock(&test_fw_mutex);
348 mutex_unlock(&test_fw_mutex);
350 return snprintf(buf, PAGE_SIZE, "%d\n", val);
353 static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
358 ret = kstrtol(buf, 10, &new);
367 /* Always return full write size even if we didn't consume all */
371 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
375 mutex_lock(&test_fw_mutex);
376 ret = __test_dev_config_update_u8(buf, size, cfg);
377 mutex_unlock(&test_fw_mutex);
382 static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
386 mutex_lock(&test_fw_mutex);
388 mutex_unlock(&test_fw_mutex);
390 return snprintf(buf, PAGE_SIZE, "%u\n", val);
393 static ssize_t config_name_show(struct device *dev,
394 struct device_attribute *attr,
397 return config_test_show_str(buf, test_fw_config->name);
399 static DEVICE_ATTR_RW(config_name);
401 static ssize_t config_num_requests_store(struct device *dev,
402 struct device_attribute *attr,
403 const char *buf, size_t count)
407 mutex_lock(&test_fw_mutex);
408 if (test_fw_config->reqs) {
409 pr_err("Must call release_all_firmware prior to changing config\n");
411 mutex_unlock(&test_fw_mutex);
415 rc = __test_dev_config_update_u8(buf, count,
416 &test_fw_config->num_requests);
417 mutex_unlock(&test_fw_mutex);
423 static ssize_t config_num_requests_show(struct device *dev,
424 struct device_attribute *attr,
427 return test_dev_config_show_u8(buf, test_fw_config->num_requests);
429 static DEVICE_ATTR_RW(config_num_requests);
431 static ssize_t config_into_buf_store(struct device *dev,
432 struct device_attribute *attr,
433 const char *buf, size_t count)
435 return test_dev_config_update_bool(buf,
437 &test_fw_config->into_buf);
440 static ssize_t config_into_buf_show(struct device *dev,
441 struct device_attribute *attr,
444 return test_dev_config_show_bool(buf, test_fw_config->into_buf);
446 static DEVICE_ATTR_RW(config_into_buf);
448 static ssize_t config_sync_direct_store(struct device *dev,
449 struct device_attribute *attr,
450 const char *buf, size_t count)
452 int rc = test_dev_config_update_bool(buf, count,
453 &test_fw_config->sync_direct);
456 test_fw_config->req_firmware = test_fw_config->sync_direct ?
457 request_firmware_direct :
462 static ssize_t config_sync_direct_show(struct device *dev,
463 struct device_attribute *attr,
466 return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
468 static DEVICE_ATTR_RW(config_sync_direct);
470 static ssize_t config_send_uevent_store(struct device *dev,
471 struct device_attribute *attr,
472 const char *buf, size_t count)
474 return test_dev_config_update_bool(buf, count,
475 &test_fw_config->send_uevent);
478 static ssize_t config_send_uevent_show(struct device *dev,
479 struct device_attribute *attr,
482 return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
484 static DEVICE_ATTR_RW(config_send_uevent);
486 static ssize_t config_read_fw_idx_store(struct device *dev,
487 struct device_attribute *attr,
488 const char *buf, size_t count)
490 return test_dev_config_update_u8(buf, count,
491 &test_fw_config->read_fw_idx);
494 static ssize_t config_read_fw_idx_show(struct device *dev,
495 struct device_attribute *attr,
498 return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
500 static DEVICE_ATTR_RW(config_read_fw_idx);
503 static ssize_t trigger_request_store(struct device *dev,
504 struct device_attribute *attr,
505 const char *buf, size_t count)
510 name = kstrndup(buf, count, GFP_KERNEL);
514 pr_info("loading '%s'\n", name);
516 mutex_lock(&test_fw_mutex);
517 release_firmware(test_firmware);
518 if (test_fw_config->reqs)
519 __test_release_all_firmware();
520 test_firmware = NULL;
521 rc = request_firmware(&test_firmware, name, dev);
523 pr_info("load of '%s' failed: %d\n", name, rc);
526 pr_info("loaded: %zu\n", test_firmware->size);
530 mutex_unlock(&test_fw_mutex);
536 static DEVICE_ATTR_WO(trigger_request);
538 static DECLARE_COMPLETION(async_fw_done);
540 static void trigger_async_request_cb(const struct firmware *fw, void *context)
543 complete(&async_fw_done);
546 static ssize_t trigger_async_request_store(struct device *dev,
547 struct device_attribute *attr,
548 const char *buf, size_t count)
553 name = kstrndup(buf, count, GFP_KERNEL);
557 pr_info("loading '%s'\n", name);
559 mutex_lock(&test_fw_mutex);
560 release_firmware(test_firmware);
561 test_firmware = NULL;
562 if (test_fw_config->reqs)
563 __test_release_all_firmware();
564 rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
565 NULL, trigger_async_request_cb);
567 pr_info("async load of '%s' failed: %d\n", name, rc);
571 /* Free 'name' ASAP, to test for race conditions */
574 wait_for_completion(&async_fw_done);
577 pr_info("loaded: %zu\n", test_firmware->size);
580 pr_err("failed to async load firmware\n");
585 mutex_unlock(&test_fw_mutex);
589 static DEVICE_ATTR_WO(trigger_async_request);
591 static ssize_t trigger_custom_fallback_store(struct device *dev,
592 struct device_attribute *attr,
593 const char *buf, size_t count)
598 name = kstrndup(buf, count, GFP_KERNEL);
602 pr_info("loading '%s' using custom fallback mechanism\n", name);
604 mutex_lock(&test_fw_mutex);
605 release_firmware(test_firmware);
606 if (test_fw_config->reqs)
607 __test_release_all_firmware();
608 test_firmware = NULL;
609 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
610 dev, GFP_KERNEL, NULL,
611 trigger_async_request_cb);
613 pr_info("async load of '%s' failed: %d\n", name, rc);
617 /* Free 'name' ASAP, to test for race conditions */
620 wait_for_completion(&async_fw_done);
623 pr_info("loaded: %zu\n", test_firmware->size);
626 pr_err("failed to async load firmware\n");
631 mutex_unlock(&test_fw_mutex);
635 static DEVICE_ATTR_WO(trigger_custom_fallback);
637 static int test_fw_run_batch_request(void *data)
639 struct test_batched_req *req = data;
642 test_fw_config->test_result = -EINVAL;
646 if (test_fw_config->into_buf) {
649 test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
653 req->rc = request_firmware_into_buf(&req->fw,
657 TEST_FIRMWARE_BUF_SIZE);
661 req->fw_buf = test_buf;
663 req->rc = test_fw_config->req_firmware(&req->fw,
669 pr_info("#%u: batched sync load failed: %d\n",
671 if (!test_fw_config->test_result)
672 test_fw_config->test_result = req->rc;
673 } else if (req->fw) {
675 pr_info("#%u: batched sync loaded %zu\n",
676 req->idx, req->fw->size);
678 complete(&req->completion);
686 * We use a kthread as otherwise the kernel serializes all our sync requests
687 * and we would not be able to mimic batched requests on a sync call. Batched
688 * requests on a sync call can for instance happen on a device driver when
689 * multiple cards are used and firmware loading happens outside of probe.
691 static ssize_t trigger_batched_requests_store(struct device *dev,
692 struct device_attribute *attr,
693 const char *buf, size_t count)
695 struct test_batched_req *req;
699 mutex_lock(&test_fw_mutex);
701 if (test_fw_config->reqs) {
706 test_fw_config->reqs =
707 vzalloc(array3_size(sizeof(struct test_batched_req),
708 test_fw_config->num_requests, 2));
709 if (!test_fw_config->reqs) {
714 pr_info("batched sync firmware loading '%s' %u times\n",
715 test_fw_config->name, test_fw_config->num_requests);
717 for (i = 0; i < test_fw_config->num_requests; i++) {
718 req = &test_fw_config->reqs[i];
721 req->name = test_fw_config->name;
724 init_completion(&req->completion);
725 req->task = kthread_run(test_fw_run_batch_request, req,
726 "%s-%u", KBUILD_MODNAME, req->idx);
727 if (!req->task || IS_ERR(req->task)) {
728 pr_err("Setting up thread %u failed\n", req->idx);
738 * We require an explicit release to enable more time and delay of
739 * calling release_firmware() to improve our chances of forcing a
740 * batched request. If we instead called release_firmware() right away
741 * then we might miss on an opportunity of having a successful firmware
742 * request pass on the opportunity to be come a batched request.
746 for (i = 0; i < test_fw_config->num_requests; i++) {
747 req = &test_fw_config->reqs[i];
748 if (req->task || req->sent)
749 wait_for_completion(&req->completion);
752 /* Override any worker error if we had a general setup error */
754 test_fw_config->test_result = rc;
757 mutex_unlock(&test_fw_mutex);
761 static DEVICE_ATTR_WO(trigger_batched_requests);
764 * We wait for each callback to return with the lock held, no need to lock here
766 static void trigger_batched_cb(const struct firmware *fw, void *context)
768 struct test_batched_req *req = context;
771 test_fw_config->test_result = -EINVAL;
775 /* forces *some* batched requests to queue up */
782 * Unfortunately the firmware API gives us nothing other than a null FW
783 * if the firmware was not found on async requests. Best we can do is
784 * just assume -ENOENT. A better API would pass the actual return
785 * value to the callback.
787 if (!fw && !test_fw_config->test_result)
788 test_fw_config->test_result = -ENOENT;
790 complete(&req->completion);
794 ssize_t trigger_batched_requests_async_store(struct device *dev,
795 struct device_attribute *attr,
796 const char *buf, size_t count)
798 struct test_batched_req *req;
803 mutex_lock(&test_fw_mutex);
805 if (test_fw_config->reqs) {
810 test_fw_config->reqs =
811 vzalloc(array3_size(sizeof(struct test_batched_req),
812 test_fw_config->num_requests, 2));
813 if (!test_fw_config->reqs) {
818 pr_info("batched loading '%s' custom fallback mechanism %u times\n",
819 test_fw_config->name, test_fw_config->num_requests);
821 send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
824 for (i = 0; i < test_fw_config->num_requests; i++) {
825 req = &test_fw_config->reqs[i];
826 req->name = test_fw_config->name;
830 init_completion(&req->completion);
831 rc = request_firmware_nowait(THIS_MODULE, send_uevent,
833 dev, GFP_KERNEL, req,
836 pr_info("#%u: batched async load failed setup: %d\n",
849 * We require an explicit release to enable more time and delay of
850 * calling release_firmware() to improve our chances of forcing a
851 * batched request. If we instead called release_firmware() right away
852 * then we might miss on an opportunity of having a successful firmware
853 * request pass on the opportunity to be come a batched request.
856 for (i = 0; i < test_fw_config->num_requests; i++) {
857 req = &test_fw_config->reqs[i];
859 wait_for_completion(&req->completion);
862 /* Override any worker error if we had a general setup error */
864 test_fw_config->test_result = rc;
867 mutex_unlock(&test_fw_mutex);
871 static DEVICE_ATTR_WO(trigger_batched_requests_async);
873 static ssize_t test_result_show(struct device *dev,
874 struct device_attribute *attr,
877 return test_dev_config_show_int(buf, test_fw_config->test_result);
879 static DEVICE_ATTR_RO(test_result);
881 static ssize_t release_all_firmware_store(struct device *dev,
882 struct device_attribute *attr,
883 const char *buf, size_t count)
885 test_release_all_firmware();
888 static DEVICE_ATTR_WO(release_all_firmware);
890 static ssize_t read_firmware_show(struct device *dev,
891 struct device_attribute *attr,
894 struct test_batched_req *req;
898 mutex_lock(&test_fw_mutex);
900 idx = test_fw_config->read_fw_idx;
901 if (idx >= test_fw_config->num_requests) {
906 if (!test_fw_config->reqs) {
911 req = &test_fw_config->reqs[idx];
913 pr_err("#%u: failed to async load firmware\n", idx);
918 pr_info("#%u: loaded %zu\n", idx, req->fw->size);
920 if (req->fw->size > PAGE_SIZE) {
921 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
925 memcpy(buf, req->fw->data, req->fw->size);
929 mutex_unlock(&test_fw_mutex);
933 static DEVICE_ATTR_RO(read_firmware);
935 #define TEST_FW_DEV_ATTR(name) &dev_attr_##name.attr
937 static struct attribute *test_dev_attrs[] = {
938 TEST_FW_DEV_ATTR(reset),
940 TEST_FW_DEV_ATTR(config),
941 TEST_FW_DEV_ATTR(config_name),
942 TEST_FW_DEV_ATTR(config_num_requests),
943 TEST_FW_DEV_ATTR(config_into_buf),
944 TEST_FW_DEV_ATTR(config_sync_direct),
945 TEST_FW_DEV_ATTR(config_send_uevent),
946 TEST_FW_DEV_ATTR(config_read_fw_idx),
948 /* These don't use the config at all - they could be ported! */
949 TEST_FW_DEV_ATTR(trigger_request),
950 TEST_FW_DEV_ATTR(trigger_async_request),
951 TEST_FW_DEV_ATTR(trigger_custom_fallback),
953 /* These use the config and can use the test_result */
954 TEST_FW_DEV_ATTR(trigger_batched_requests),
955 TEST_FW_DEV_ATTR(trigger_batched_requests_async),
957 TEST_FW_DEV_ATTR(release_all_firmware),
958 TEST_FW_DEV_ATTR(test_result),
959 TEST_FW_DEV_ATTR(read_firmware),
963 ATTRIBUTE_GROUPS(test_dev);
965 static struct miscdevice test_fw_misc_device = {
966 .minor = MISC_DYNAMIC_MINOR,
967 .name = "test_firmware",
968 .fops = &test_fw_fops,
969 .groups = test_dev_groups,
972 static int __init test_firmware_init(void)
976 test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
980 rc = __test_firmware_config_init();
982 kfree(test_fw_config);
983 pr_err("could not init firmware test config: %d\n", rc);
987 rc = misc_register(&test_fw_misc_device);
989 __test_firmware_config_free();
990 kfree(test_fw_config);
991 pr_err("could not register misc device: %d\n", rc);
995 pr_warn("interface ready\n");
1000 module_init(test_firmware_init);
1002 static void __exit test_firmware_exit(void)
1004 mutex_lock(&test_fw_mutex);
1005 release_firmware(test_firmware);
1006 misc_deregister(&test_fw_misc_device);
1007 __test_firmware_config_free();
1008 kfree(test_fw_config);
1009 mutex_unlock(&test_fw_mutex);
1011 pr_warn("removed interface\n");
1014 module_exit(test_firmware_exit);
1016 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
1017 MODULE_LICENSE("GPL");