1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/highmem.h> 4 #include <linux/module.h> 5 #include <linux/security.h> 6 #include <linux/slab.h> 7 #include <linux/types.h> 8 9 #include "sysfs.h" 10 11 /* 12 * sysfs support for firmware loader 13 */ 14 15 void __fw_load_abort(struct fw_priv *fw_priv) 16 { 17 /* 18 * There is a small window in which user can write to 'loading' 19 * between loading done/aborted and disappearance of 'loading' 20 */ 21 if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) 22 return; 23 24 fw_state_aborted(fw_priv); 25 } 26 27 #ifdef CONFIG_FW_LOADER_USER_HELPER 28 static ssize_t timeout_show(struct class *class, struct class_attribute *attr, 29 char *buf) 30 { 31 return sysfs_emit(buf, "%d\n", __firmware_loading_timeout()); 32 } 33 34 /** 35 * timeout_store() - set number of seconds to wait for firmware 36 * @class: device class pointer 37 * @attr: device attribute pointer 38 * @buf: buffer to scan for timeout value 39 * @count: number of bytes in @buf 40 * 41 * Sets the number of seconds to wait for the firmware. Once 42 * this expires an error will be returned to the driver and no 43 * firmware will be provided. 44 * 45 * Note: zero means 'wait forever'. 46 **/ 47 static ssize_t timeout_store(struct class *class, struct class_attribute *attr, 48 const char *buf, size_t count) 49 { 50 int tmp_loading_timeout = simple_strtol(buf, NULL, 10); 51 52 if (tmp_loading_timeout < 0) 53 tmp_loading_timeout = 0; 54 55 __fw_fallback_set_timeout(tmp_loading_timeout); 56 57 return count; 58 } 59 static CLASS_ATTR_RW(timeout); 60 61 static struct attribute *firmware_class_attrs[] = { 62 &class_attr_timeout.attr, 63 NULL, 64 }; 65 ATTRIBUTE_GROUPS(firmware_class); 66 67 static int do_firmware_uevent(const struct fw_sysfs *fw_sysfs, struct kobj_uevent_env *env) 68 { 69 if (add_uevent_var(env, "FIRMWARE=%s", fw_sysfs->fw_priv->fw_name)) 70 return -ENOMEM; 71 if (add_uevent_var(env, "TIMEOUT=%i", __firmware_loading_timeout())) 72 return -ENOMEM; 73 if (add_uevent_var(env, "ASYNC=%d", fw_sysfs->nowait)) 74 return -ENOMEM; 75 76 return 0; 77 } 78 79 static int firmware_uevent(const struct device *dev, struct kobj_uevent_env *env) 80 { 81 const struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 82 int err = 0; 83 84 mutex_lock(&fw_lock); 85 if (fw_sysfs->fw_priv) 86 err = do_firmware_uevent(fw_sysfs, env); 87 mutex_unlock(&fw_lock); 88 return err; 89 } 90 #endif /* CONFIG_FW_LOADER_USER_HELPER */ 91 92 static void fw_dev_release(struct device *dev) 93 { 94 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 95 96 if (fw_sysfs->fw_upload_priv) 97 fw_upload_free(fw_sysfs); 98 99 kfree(fw_sysfs); 100 } 101 102 static struct class firmware_class = { 103 .name = "firmware", 104 #ifdef CONFIG_FW_LOADER_USER_HELPER 105 .class_groups = firmware_class_groups, 106 .dev_uevent = firmware_uevent, 107 #endif 108 .dev_release = fw_dev_release, 109 }; 110 111 int register_sysfs_loader(void) 112 { 113 int ret = class_register(&firmware_class); 114 115 if (ret != 0) 116 return ret; 117 return register_firmware_config_sysctl(); 118 } 119 120 void unregister_sysfs_loader(void) 121 { 122 unregister_firmware_config_sysctl(); 123 class_unregister(&firmware_class); 124 } 125 126 static ssize_t firmware_loading_show(struct device *dev, 127 struct device_attribute *attr, char *buf) 128 { 129 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 130 int loading = 0; 131 132 mutex_lock(&fw_lock); 133 if (fw_sysfs->fw_priv) 134 loading = fw_state_is_loading(fw_sysfs->fw_priv); 135 mutex_unlock(&fw_lock); 136 137 return sysfs_emit(buf, "%d\n", loading); 138 } 139 140 /** 141 * firmware_loading_store() - set value in the 'loading' control file 142 * @dev: device pointer 143 * @attr: device attribute pointer 144 * @buf: buffer to scan for loading control value 145 * @count: number of bytes in @buf 146 * 147 * The relevant values are: 148 * 149 * 1: Start a load, discarding any previous partial load. 150 * 0: Conclude the load and hand the data to the driver code. 151 * -1: Conclude the load with an error and discard any written data. 152 **/ 153 static ssize_t firmware_loading_store(struct device *dev, 154 struct device_attribute *attr, 155 const char *buf, size_t count) 156 { 157 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 158 struct fw_priv *fw_priv; 159 ssize_t written = count; 160 int loading = simple_strtol(buf, NULL, 10); 161 162 mutex_lock(&fw_lock); 163 fw_priv = fw_sysfs->fw_priv; 164 if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) 165 goto out; 166 167 switch (loading) { 168 case 1: 169 /* discarding any previous partial load */ 170 fw_free_paged_buf(fw_priv); 171 fw_state_start(fw_priv); 172 break; 173 case 0: 174 if (fw_state_is_loading(fw_priv)) { 175 int rc; 176 177 /* 178 * Several loading requests may be pending on 179 * one same firmware buf, so let all requests 180 * see the mapped 'buf->data' once the loading 181 * is completed. 182 */ 183 rc = fw_map_paged_buf(fw_priv); 184 if (rc) 185 dev_err(dev, "%s: map pages failed\n", 186 __func__); 187 else 188 rc = security_kernel_post_load_data(fw_priv->data, 189 fw_priv->size, 190 LOADING_FIRMWARE, 191 "blob"); 192 193 /* 194 * Same logic as fw_load_abort, only the DONE bit 195 * is ignored and we set ABORT only on failure. 196 */ 197 if (rc) { 198 fw_state_aborted(fw_priv); 199 written = rc; 200 } else { 201 fw_state_done(fw_priv); 202 203 /* 204 * If this is a user-initiated firmware upload 205 * then start the upload in a worker thread now. 206 */ 207 rc = fw_upload_start(fw_sysfs); 208 if (rc) 209 written = rc; 210 } 211 break; 212 } 213 fallthrough; 214 default: 215 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading); 216 fallthrough; 217 case -1: 218 fw_load_abort(fw_sysfs); 219 if (fw_sysfs->fw_upload_priv) 220 fw_state_init(fw_sysfs->fw_priv); 221 222 break; 223 } 224 out: 225 mutex_unlock(&fw_lock); 226 return written; 227 } 228 229 DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store); 230 231 static void firmware_rw_data(struct fw_priv *fw_priv, char *buffer, 232 loff_t offset, size_t count, bool read) 233 { 234 if (read) 235 memcpy(buffer, fw_priv->data + offset, count); 236 else 237 memcpy(fw_priv->data + offset, buffer, count); 238 } 239 240 static void firmware_rw(struct fw_priv *fw_priv, char *buffer, 241 loff_t offset, size_t count, bool read) 242 { 243 while (count) { 244 int page_nr = offset >> PAGE_SHIFT; 245 int page_ofs = offset & (PAGE_SIZE - 1); 246 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count); 247 248 if (read) 249 memcpy_from_page(buffer, fw_priv->pages[page_nr], 250 page_ofs, page_cnt); 251 else 252 memcpy_to_page(fw_priv->pages[page_nr], page_ofs, 253 buffer, page_cnt); 254 255 buffer += page_cnt; 256 offset += page_cnt; 257 count -= page_cnt; 258 } 259 } 260 261 static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj, 262 struct bin_attribute *bin_attr, 263 char *buffer, loff_t offset, size_t count) 264 { 265 struct device *dev = kobj_to_dev(kobj); 266 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 267 struct fw_priv *fw_priv; 268 ssize_t ret_count; 269 270 mutex_lock(&fw_lock); 271 fw_priv = fw_sysfs->fw_priv; 272 if (!fw_priv || fw_state_is_done(fw_priv)) { 273 ret_count = -ENODEV; 274 goto out; 275 } 276 if (offset > fw_priv->size) { 277 ret_count = 0; 278 goto out; 279 } 280 if (count > fw_priv->size - offset) 281 count = fw_priv->size - offset; 282 283 ret_count = count; 284 285 if (fw_priv->data) 286 firmware_rw_data(fw_priv, buffer, offset, count, true); 287 else 288 firmware_rw(fw_priv, buffer, offset, count, true); 289 290 out: 291 mutex_unlock(&fw_lock); 292 return ret_count; 293 } 294 295 static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size) 296 { 297 int err; 298 299 err = fw_grow_paged_buf(fw_sysfs->fw_priv, 300 PAGE_ALIGN(min_size) >> PAGE_SHIFT); 301 if (err) 302 fw_load_abort(fw_sysfs); 303 return err; 304 } 305 306 /** 307 * firmware_data_write() - write method for firmware 308 * @filp: open sysfs file 309 * @kobj: kobject for the device 310 * @bin_attr: bin_attr structure 311 * @buffer: buffer being written 312 * @offset: buffer offset for write in total data store area 313 * @count: buffer size 314 * 315 * Data written to the 'data' attribute will be later handed to 316 * the driver as a firmware image. 317 **/ 318 static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj, 319 struct bin_attribute *bin_attr, 320 char *buffer, loff_t offset, size_t count) 321 { 322 struct device *dev = kobj_to_dev(kobj); 323 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 324 struct fw_priv *fw_priv; 325 ssize_t retval; 326 327 if (!capable(CAP_SYS_RAWIO)) 328 return -EPERM; 329 330 mutex_lock(&fw_lock); 331 fw_priv = fw_sysfs->fw_priv; 332 if (!fw_priv || fw_state_is_done(fw_priv)) { 333 retval = -ENODEV; 334 goto out; 335 } 336 337 if (fw_priv->data) { 338 if (offset + count > fw_priv->allocated_size) { 339 retval = -ENOMEM; 340 goto out; 341 } 342 firmware_rw_data(fw_priv, buffer, offset, count, false); 343 retval = count; 344 } else { 345 retval = fw_realloc_pages(fw_sysfs, offset + count); 346 if (retval) 347 goto out; 348 349 retval = count; 350 firmware_rw(fw_priv, buffer, offset, count, false); 351 } 352 353 fw_priv->size = max_t(size_t, offset + count, fw_priv->size); 354 out: 355 mutex_unlock(&fw_lock); 356 return retval; 357 } 358 359 static struct bin_attribute firmware_attr_data = { 360 .attr = { .name = "data", .mode = 0644 }, 361 .size = 0, 362 .read = firmware_data_read, 363 .write = firmware_data_write, 364 }; 365 366 static struct attribute *fw_dev_attrs[] = { 367 &dev_attr_loading.attr, 368 #ifdef CONFIG_FW_UPLOAD 369 &dev_attr_cancel.attr, 370 &dev_attr_status.attr, 371 &dev_attr_error.attr, 372 &dev_attr_remaining_size.attr, 373 #endif 374 NULL 375 }; 376 377 static struct bin_attribute *fw_dev_bin_attrs[] = { 378 &firmware_attr_data, 379 NULL 380 }; 381 382 static const struct attribute_group fw_dev_attr_group = { 383 .attrs = fw_dev_attrs, 384 .bin_attrs = fw_dev_bin_attrs, 385 #ifdef CONFIG_FW_UPLOAD 386 .is_visible = fw_upload_is_visible, 387 #endif 388 }; 389 390 static const struct attribute_group *fw_dev_attr_groups[] = { 391 &fw_dev_attr_group, 392 NULL 393 }; 394 395 struct fw_sysfs * 396 fw_create_instance(struct firmware *firmware, const char *fw_name, 397 struct device *device, u32 opt_flags) 398 { 399 struct fw_sysfs *fw_sysfs; 400 struct device *f_dev; 401 402 fw_sysfs = kzalloc(sizeof(*fw_sysfs), GFP_KERNEL); 403 if (!fw_sysfs) { 404 fw_sysfs = ERR_PTR(-ENOMEM); 405 goto exit; 406 } 407 408 fw_sysfs->nowait = !!(opt_flags & FW_OPT_NOWAIT); 409 fw_sysfs->fw = firmware; 410 f_dev = &fw_sysfs->dev; 411 412 device_initialize(f_dev); 413 dev_set_name(f_dev, "%s", fw_name); 414 f_dev->parent = device; 415 f_dev->class = &firmware_class; 416 f_dev->groups = fw_dev_attr_groups; 417 exit: 418 return fw_sysfs; 419 } 420