xref: /openbmc/linux/lib/test_firmware.c (revision e6f45ea2)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * This module provides an interface to trigger and test firmware loading.
4  *
5  * It is designed to be used for basic evaluation of the firmware loading
6  * subsystem (for example when validating firmware verification). It lacks
7  * any extra dependencies, and will not normally be loaded by the system
8  * unless explicitly requested by name.
9  */
10 
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/printk.h>
16 #include <linux/completion.h>
17 #include <linux/firmware.h>
18 #include <linux/device.h>
19 #include <linux/fs.h>
20 #include <linux/miscdevice.h>
21 #include <linux/sizes.h>
22 #include <linux/slab.h>
23 #include <linux/uaccess.h>
24 #include <linux/delay.h>
25 #include <linux/kthread.h>
26 #include <linux/vmalloc.h>
27 
28 #define TEST_FIRMWARE_NAME	"test-firmware.bin"
29 #define TEST_FIRMWARE_NUM_REQS	4
30 #define TEST_FIRMWARE_BUF_SIZE	SZ_1K
31 
32 static DEFINE_MUTEX(test_fw_mutex);
33 static const struct firmware *test_firmware;
34 
35 struct test_batched_req {
36 	u8 idx;
37 	int rc;
38 	bool sent;
39 	const struct firmware *fw;
40 	const char *name;
41 	struct completion completion;
42 	struct task_struct *task;
43 	struct device *dev;
44 };
45 
46 /**
47  * test_config - represents configuration for the test for different triggers
48  *
49  * @name: the name of the firmware file to look for
50  * @into_buf: when the into_buf is used if this is true
51  *	request_firmware_into_buf() will be used instead.
52  * @sync_direct: when the sync trigger is used if this is true
53  *	request_firmware_direct() will be used instead.
54  * @send_uevent: whether or not to send a uevent for async requests
55  * @num_requests: number of requests to try per test case. This is trigger
56  *	specific.
57  * @reqs: stores all requests information
58  * @read_fw_idx: index of thread from which we want to read firmware results
59  *	from through the read_fw trigger.
60  * @test_result: a test may use this to collect the result from the call
61  *	of the request_firmware*() calls used in their tests. In order of
62  *	priority we always keep first any setup error. If no setup errors were
63  *	found then we move on to the first error encountered while running the
64  *	API. Note that for async calls this typically will be a successful
65  *	result (0) unless of course you've used bogus parameters, or the system
66  *	is out of memory.  In the async case the callback is expected to do a
67  *	bit more homework to figure out what happened, unfortunately the only
68  *	information passed today on error is the fact that no firmware was
69  *	found so we can only assume -ENOENT on async calls if the firmware is
70  *	NULL.
71  *
72  *	Errors you can expect:
73  *
74  *	API specific:
75  *
76  *	0:		success for sync, for async it means request was sent
77  *	-EINVAL:	invalid parameters or request
78  *	-ENOENT:	files not found
79  *
80  *	System environment:
81  *
82  *	-ENOMEM:	memory pressure on system
83  *	-ENODEV:	out of number of devices to test
84  *	-EINVAL:	an unexpected error has occurred
85  * @req_firmware: if @sync_direct is true this is set to
86  *	request_firmware_direct(), otherwise request_firmware()
87  */
88 struct test_config {
89 	char *name;
90 	bool into_buf;
91 	bool sync_direct;
92 	bool send_uevent;
93 	u8 num_requests;
94 	u8 read_fw_idx;
95 
96 	/*
97 	 * These below don't belong her but we'll move them once we create
98 	 * a struct fw_test_device and stuff the misc_dev under there later.
99 	 */
100 	struct test_batched_req *reqs;
101 	int test_result;
102 	int (*req_firmware)(const struct firmware **fw, const char *name,
103 			    struct device *device);
104 };
105 
106 static struct test_config *test_fw_config;
107 
108 static ssize_t test_fw_misc_read(struct file *f, char __user *buf,
109 				 size_t size, loff_t *offset)
110 {
111 	ssize_t rc = 0;
112 
113 	mutex_lock(&test_fw_mutex);
114 	if (test_firmware)
115 		rc = simple_read_from_buffer(buf, size, offset,
116 					     test_firmware->data,
117 					     test_firmware->size);
118 	mutex_unlock(&test_fw_mutex);
119 	return rc;
120 }
121 
122 static const struct file_operations test_fw_fops = {
123 	.owner          = THIS_MODULE,
124 	.read           = test_fw_misc_read,
125 };
126 
127 static void __test_release_all_firmware(void)
128 {
129 	struct test_batched_req *req;
130 	u8 i;
131 
132 	if (!test_fw_config->reqs)
133 		return;
134 
135 	for (i = 0; i < test_fw_config->num_requests; i++) {
136 		req = &test_fw_config->reqs[i];
137 		if (req->fw)
138 			release_firmware(req->fw);
139 	}
140 
141 	vfree(test_fw_config->reqs);
142 	test_fw_config->reqs = NULL;
143 }
144 
145 static void test_release_all_firmware(void)
146 {
147 	mutex_lock(&test_fw_mutex);
148 	__test_release_all_firmware();
149 	mutex_unlock(&test_fw_mutex);
150 }
151 
152 
153 static void __test_firmware_config_free(void)
154 {
155 	__test_release_all_firmware();
156 	kfree_const(test_fw_config->name);
157 	test_fw_config->name = NULL;
158 }
159 
160 /*
161  * XXX: move to kstrncpy() once merged.
162  *
163  * Users should use kfree_const() when freeing these.
164  */
165 static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
166 {
167 	*dst = kstrndup(name, count, gfp);
168 	if (!*dst)
169 		return -ENOSPC;
170 	return count;
171 }
172 
173 static int __test_firmware_config_init(void)
174 {
175 	int ret;
176 
177 	ret = __kstrncpy(&test_fw_config->name, TEST_FIRMWARE_NAME,
178 			 strlen(TEST_FIRMWARE_NAME), GFP_KERNEL);
179 	if (ret < 0)
180 		goto out;
181 
182 	test_fw_config->num_requests = TEST_FIRMWARE_NUM_REQS;
183 	test_fw_config->send_uevent = true;
184 	test_fw_config->into_buf = false;
185 	test_fw_config->sync_direct = false;
186 	test_fw_config->req_firmware = request_firmware;
187 	test_fw_config->test_result = 0;
188 	test_fw_config->reqs = NULL;
189 
190 	return 0;
191 
192 out:
193 	__test_firmware_config_free();
194 	return ret;
195 }
196 
197 static ssize_t reset_store(struct device *dev,
198 			   struct device_attribute *attr,
199 			   const char *buf, size_t count)
200 {
201 	int ret;
202 
203 	mutex_lock(&test_fw_mutex);
204 
205 	__test_firmware_config_free();
206 
207 	ret = __test_firmware_config_init();
208 	if (ret < 0) {
209 		ret = -ENOMEM;
210 		pr_err("could not alloc settings for config trigger: %d\n",
211 		       ret);
212 		goto out;
213 	}
214 
215 	pr_info("reset\n");
216 	ret = count;
217 
218 out:
219 	mutex_unlock(&test_fw_mutex);
220 
221 	return ret;
222 }
223 static DEVICE_ATTR_WO(reset);
224 
225 static ssize_t config_show(struct device *dev,
226 			   struct device_attribute *attr,
227 			   char *buf)
228 {
229 	int len = 0;
230 
231 	mutex_lock(&test_fw_mutex);
232 
233 	len += scnprintf(buf, PAGE_SIZE - len,
234 			"Custom trigger configuration for: %s\n",
235 			dev_name(dev));
236 
237 	if (test_fw_config->name)
238 		len += scnprintf(buf+len, PAGE_SIZE - len,
239 				"name:\t%s\n",
240 				test_fw_config->name);
241 	else
242 		len += scnprintf(buf+len, PAGE_SIZE - len,
243 				"name:\tEMTPY\n");
244 
245 	len += scnprintf(buf+len, PAGE_SIZE - len,
246 			"num_requests:\t%u\n", test_fw_config->num_requests);
247 
248 	len += scnprintf(buf+len, PAGE_SIZE - len,
249 			"send_uevent:\t\t%s\n",
250 			test_fw_config->send_uevent ?
251 			"FW_ACTION_HOTPLUG" :
252 			"FW_ACTION_NOHOTPLUG");
253 	len += scnprintf(buf+len, PAGE_SIZE - len,
254 			"into_buf:\t\t%s\n",
255 			test_fw_config->into_buf ? "true" : "false");
256 	len += scnprintf(buf+len, PAGE_SIZE - len,
257 			"sync_direct:\t\t%s\n",
258 			test_fw_config->sync_direct ? "true" : "false");
259 	len += scnprintf(buf+len, PAGE_SIZE - len,
260 			"read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
261 
262 	mutex_unlock(&test_fw_mutex);
263 
264 	return len;
265 }
266 static DEVICE_ATTR_RO(config);
267 
268 static ssize_t config_name_store(struct device *dev,
269 				 struct device_attribute *attr,
270 				 const char *buf, size_t count)
271 {
272 	int ret;
273 
274 	mutex_lock(&test_fw_mutex);
275 	kfree_const(test_fw_config->name);
276 	ret = __kstrncpy(&test_fw_config->name, buf, count, GFP_KERNEL);
277 	mutex_unlock(&test_fw_mutex);
278 
279 	return ret;
280 }
281 
282 /*
283  * As per sysfs_kf_seq_show() the buf is max PAGE_SIZE.
284  */
285 static ssize_t config_test_show_str(char *dst,
286 				    char *src)
287 {
288 	int len;
289 
290 	mutex_lock(&test_fw_mutex);
291 	len = snprintf(dst, PAGE_SIZE, "%s\n", src);
292 	mutex_unlock(&test_fw_mutex);
293 
294 	return len;
295 }
296 
297 static int test_dev_config_update_bool(const char *buf, size_t size,
298 				       bool *cfg)
299 {
300 	int ret;
301 
302 	mutex_lock(&test_fw_mutex);
303 	if (strtobool(buf, cfg) < 0)
304 		ret = -EINVAL;
305 	else
306 		ret = size;
307 	mutex_unlock(&test_fw_mutex);
308 
309 	return ret;
310 }
311 
312 static ssize_t
313 test_dev_config_show_bool(char *buf,
314 			  bool config)
315 {
316 	bool val;
317 
318 	mutex_lock(&test_fw_mutex);
319 	val = config;
320 	mutex_unlock(&test_fw_mutex);
321 
322 	return snprintf(buf, PAGE_SIZE, "%d\n", val);
323 }
324 
325 static ssize_t test_dev_config_show_int(char *buf, int cfg)
326 {
327 	int val;
328 
329 	mutex_lock(&test_fw_mutex);
330 	val = cfg;
331 	mutex_unlock(&test_fw_mutex);
332 
333 	return snprintf(buf, PAGE_SIZE, "%d\n", val);
334 }
335 
336 static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
337 {
338 	int ret;
339 	long new;
340 
341 	ret = kstrtol(buf, 10, &new);
342 	if (ret)
343 		return ret;
344 
345 	if (new > U8_MAX)
346 		return -EINVAL;
347 
348 	mutex_lock(&test_fw_mutex);
349 	*(u8 *)cfg = new;
350 	mutex_unlock(&test_fw_mutex);
351 
352 	/* Always return full write size even if we didn't consume all */
353 	return size;
354 }
355 
356 static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
357 {
358 	u8 val;
359 
360 	mutex_lock(&test_fw_mutex);
361 	val = cfg;
362 	mutex_unlock(&test_fw_mutex);
363 
364 	return snprintf(buf, PAGE_SIZE, "%u\n", val);
365 }
366 
367 static ssize_t config_name_show(struct device *dev,
368 				struct device_attribute *attr,
369 				char *buf)
370 {
371 	return config_test_show_str(buf, test_fw_config->name);
372 }
373 static DEVICE_ATTR_RW(config_name);
374 
375 static ssize_t config_num_requests_store(struct device *dev,
376 					 struct device_attribute *attr,
377 					 const char *buf, size_t count)
378 {
379 	int rc;
380 
381 	mutex_lock(&test_fw_mutex);
382 	if (test_fw_config->reqs) {
383 		pr_err("Must call release_all_firmware prior to changing config\n");
384 		rc = -EINVAL;
385 		mutex_unlock(&test_fw_mutex);
386 		goto out;
387 	}
388 	mutex_unlock(&test_fw_mutex);
389 
390 	rc = test_dev_config_update_u8(buf, count,
391 				       &test_fw_config->num_requests);
392 
393 out:
394 	return rc;
395 }
396 
397 static ssize_t config_num_requests_show(struct device *dev,
398 					struct device_attribute *attr,
399 					char *buf)
400 {
401 	return test_dev_config_show_u8(buf, test_fw_config->num_requests);
402 }
403 static DEVICE_ATTR_RW(config_num_requests);
404 
405 static ssize_t config_into_buf_store(struct device *dev,
406 				     struct device_attribute *attr,
407 				     const char *buf, size_t count)
408 {
409 	return test_dev_config_update_bool(buf,
410 					   count,
411 					   &test_fw_config->into_buf);
412 }
413 
414 static ssize_t config_into_buf_show(struct device *dev,
415 				    struct device_attribute *attr,
416 				    char *buf)
417 {
418 	return test_dev_config_show_bool(buf, test_fw_config->into_buf);
419 }
420 static DEVICE_ATTR_RW(config_into_buf);
421 
422 static ssize_t config_sync_direct_store(struct device *dev,
423 					struct device_attribute *attr,
424 					const char *buf, size_t count)
425 {
426 	int rc = test_dev_config_update_bool(buf, count,
427 					     &test_fw_config->sync_direct);
428 
429 	if (rc == count)
430 		test_fw_config->req_firmware = test_fw_config->sync_direct ?
431 				       request_firmware_direct :
432 				       request_firmware;
433 	return rc;
434 }
435 
436 static ssize_t config_sync_direct_show(struct device *dev,
437 				       struct device_attribute *attr,
438 				       char *buf)
439 {
440 	return test_dev_config_show_bool(buf, test_fw_config->sync_direct);
441 }
442 static DEVICE_ATTR_RW(config_sync_direct);
443 
444 static ssize_t config_send_uevent_store(struct device *dev,
445 					struct device_attribute *attr,
446 					const char *buf, size_t count)
447 {
448 	return test_dev_config_update_bool(buf, count,
449 					   &test_fw_config->send_uevent);
450 }
451 
452 static ssize_t config_send_uevent_show(struct device *dev,
453 				       struct device_attribute *attr,
454 				       char *buf)
455 {
456 	return test_dev_config_show_bool(buf, test_fw_config->send_uevent);
457 }
458 static DEVICE_ATTR_RW(config_send_uevent);
459 
460 static ssize_t config_read_fw_idx_store(struct device *dev,
461 					struct device_attribute *attr,
462 					const char *buf, size_t count)
463 {
464 	return test_dev_config_update_u8(buf, count,
465 					 &test_fw_config->read_fw_idx);
466 }
467 
468 static ssize_t config_read_fw_idx_show(struct device *dev,
469 				       struct device_attribute *attr,
470 				       char *buf)
471 {
472 	return test_dev_config_show_u8(buf, test_fw_config->read_fw_idx);
473 }
474 static DEVICE_ATTR_RW(config_read_fw_idx);
475 
476 
477 static ssize_t trigger_request_store(struct device *dev,
478 				     struct device_attribute *attr,
479 				     const char *buf, size_t count)
480 {
481 	int rc;
482 	char *name;
483 
484 	name = kstrndup(buf, count, GFP_KERNEL);
485 	if (!name)
486 		return -ENOSPC;
487 
488 	pr_info("loading '%s'\n", name);
489 
490 	mutex_lock(&test_fw_mutex);
491 	release_firmware(test_firmware);
492 	test_firmware = NULL;
493 	rc = request_firmware(&test_firmware, name, dev);
494 	if (rc) {
495 		pr_info("load of '%s' failed: %d\n", name, rc);
496 		goto out;
497 	}
498 	pr_info("loaded: %zu\n", test_firmware->size);
499 	rc = count;
500 
501 out:
502 	mutex_unlock(&test_fw_mutex);
503 
504 	kfree(name);
505 
506 	return rc;
507 }
508 static DEVICE_ATTR_WO(trigger_request);
509 
510 static DECLARE_COMPLETION(async_fw_done);
511 
512 static void trigger_async_request_cb(const struct firmware *fw, void *context)
513 {
514 	test_firmware = fw;
515 	complete(&async_fw_done);
516 }
517 
518 static ssize_t trigger_async_request_store(struct device *dev,
519 					   struct device_attribute *attr,
520 					   const char *buf, size_t count)
521 {
522 	int rc;
523 	char *name;
524 
525 	name = kstrndup(buf, count, GFP_KERNEL);
526 	if (!name)
527 		return -ENOSPC;
528 
529 	pr_info("loading '%s'\n", name);
530 
531 	mutex_lock(&test_fw_mutex);
532 	release_firmware(test_firmware);
533 	test_firmware = NULL;
534 	rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
535 				     NULL, trigger_async_request_cb);
536 	if (rc) {
537 		pr_info("async load of '%s' failed: %d\n", name, rc);
538 		kfree(name);
539 		goto out;
540 	}
541 	/* Free 'name' ASAP, to test for race conditions */
542 	kfree(name);
543 
544 	wait_for_completion(&async_fw_done);
545 
546 	if (test_firmware) {
547 		pr_info("loaded: %zu\n", test_firmware->size);
548 		rc = count;
549 	} else {
550 		pr_err("failed to async load firmware\n");
551 		rc = -ENOMEM;
552 	}
553 
554 out:
555 	mutex_unlock(&test_fw_mutex);
556 
557 	return rc;
558 }
559 static DEVICE_ATTR_WO(trigger_async_request);
560 
561 static ssize_t trigger_custom_fallback_store(struct device *dev,
562 					     struct device_attribute *attr,
563 					     const char *buf, size_t count)
564 {
565 	int rc;
566 	char *name;
567 
568 	name = kstrndup(buf, count, GFP_KERNEL);
569 	if (!name)
570 		return -ENOSPC;
571 
572 	pr_info("loading '%s' using custom fallback mechanism\n", name);
573 
574 	mutex_lock(&test_fw_mutex);
575 	release_firmware(test_firmware);
576 	test_firmware = NULL;
577 	rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name,
578 				     dev, GFP_KERNEL, NULL,
579 				     trigger_async_request_cb);
580 	if (rc) {
581 		pr_info("async load of '%s' failed: %d\n", name, rc);
582 		kfree(name);
583 		goto out;
584 	}
585 	/* Free 'name' ASAP, to test for race conditions */
586 	kfree(name);
587 
588 	wait_for_completion(&async_fw_done);
589 
590 	if (test_firmware) {
591 		pr_info("loaded: %zu\n", test_firmware->size);
592 		rc = count;
593 	} else {
594 		pr_err("failed to async load firmware\n");
595 		rc = -ENODEV;
596 	}
597 
598 out:
599 	mutex_unlock(&test_fw_mutex);
600 
601 	return rc;
602 }
603 static DEVICE_ATTR_WO(trigger_custom_fallback);
604 
605 static int test_fw_run_batch_request(void *data)
606 {
607 	struct test_batched_req *req = data;
608 
609 	if (!req) {
610 		test_fw_config->test_result = -EINVAL;
611 		return -EINVAL;
612 	}
613 
614 	if (test_fw_config->into_buf) {
615 		void *test_buf;
616 
617 		test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL);
618 		if (!test_buf)
619 			return -ENOSPC;
620 
621 		req->rc = request_firmware_into_buf(&req->fw,
622 						    req->name,
623 						    req->dev,
624 						    test_buf,
625 						    TEST_FIRMWARE_BUF_SIZE);
626 		if (!req->fw)
627 			kfree(test_buf);
628 	} else {
629 		req->rc = test_fw_config->req_firmware(&req->fw,
630 						       req->name,
631 						       req->dev);
632 	}
633 
634 	if (req->rc) {
635 		pr_info("#%u: batched sync load failed: %d\n",
636 			req->idx, req->rc);
637 		if (!test_fw_config->test_result)
638 			test_fw_config->test_result = req->rc;
639 	} else if (req->fw) {
640 		req->sent = true;
641 		pr_info("#%u: batched sync loaded %zu\n",
642 			req->idx, req->fw->size);
643 	}
644 	complete(&req->completion);
645 
646 	req->task = NULL;
647 
648 	return 0;
649 }
650 
651 /*
652  * We use a kthread as otherwise the kernel serializes all our sync requests
653  * and we would not be able to mimic batched requests on a sync call. Batched
654  * requests on a sync call can for instance happen on a device driver when
655  * multiple cards are used and firmware loading happens outside of probe.
656  */
657 static ssize_t trigger_batched_requests_store(struct device *dev,
658 					      struct device_attribute *attr,
659 					      const char *buf, size_t count)
660 {
661 	struct test_batched_req *req;
662 	int rc;
663 	u8 i;
664 
665 	mutex_lock(&test_fw_mutex);
666 
667 	test_fw_config->reqs =
668 		vzalloc(array3_size(sizeof(struct test_batched_req),
669 				    test_fw_config->num_requests, 2));
670 	if (!test_fw_config->reqs) {
671 		rc = -ENOMEM;
672 		goto out_unlock;
673 	}
674 
675 	pr_info("batched sync firmware loading '%s' %u times\n",
676 		test_fw_config->name, test_fw_config->num_requests);
677 
678 	for (i = 0; i < test_fw_config->num_requests; i++) {
679 		req = &test_fw_config->reqs[i];
680 		req->fw = NULL;
681 		req->idx = i;
682 		req->name = test_fw_config->name;
683 		req->dev = dev;
684 		init_completion(&req->completion);
685 		req->task = kthread_run(test_fw_run_batch_request, req,
686 					     "%s-%u", KBUILD_MODNAME, req->idx);
687 		if (!req->task || IS_ERR(req->task)) {
688 			pr_err("Setting up thread %u failed\n", req->idx);
689 			req->task = NULL;
690 			rc = -ENOMEM;
691 			goto out_bail;
692 		}
693 	}
694 
695 	rc = count;
696 
697 	/*
698 	 * We require an explicit release to enable more time and delay of
699 	 * calling release_firmware() to improve our chances of forcing a
700 	 * batched request. If we instead called release_firmware() right away
701 	 * then we might miss on an opportunity of having a successful firmware
702 	 * request pass on the opportunity to be come a batched request.
703 	 */
704 
705 out_bail:
706 	for (i = 0; i < test_fw_config->num_requests; i++) {
707 		req = &test_fw_config->reqs[i];
708 		if (req->task || req->sent)
709 			wait_for_completion(&req->completion);
710 	}
711 
712 	/* Override any worker error if we had a general setup error */
713 	if (rc < 0)
714 		test_fw_config->test_result = rc;
715 
716 out_unlock:
717 	mutex_unlock(&test_fw_mutex);
718 
719 	return rc;
720 }
721 static DEVICE_ATTR_WO(trigger_batched_requests);
722 
723 /*
724  * We wait for each callback to return with the lock held, no need to lock here
725  */
726 static void trigger_batched_cb(const struct firmware *fw, void *context)
727 {
728 	struct test_batched_req *req = context;
729 
730 	if (!req) {
731 		test_fw_config->test_result = -EINVAL;
732 		return;
733 	}
734 
735 	/* forces *some* batched requests to queue up */
736 	if (!req->idx)
737 		ssleep(2);
738 
739 	req->fw = fw;
740 
741 	/*
742 	 * Unfortunately the firmware API gives us nothing other than a null FW
743 	 * if the firmware was not found on async requests.  Best we can do is
744 	 * just assume -ENOENT. A better API would pass the actual return
745 	 * value to the callback.
746 	 */
747 	if (!fw && !test_fw_config->test_result)
748 		test_fw_config->test_result = -ENOENT;
749 
750 	complete(&req->completion);
751 }
752 
753 static
754 ssize_t trigger_batched_requests_async_store(struct device *dev,
755 					     struct device_attribute *attr,
756 					     const char *buf, size_t count)
757 {
758 	struct test_batched_req *req;
759 	bool send_uevent;
760 	int rc;
761 	u8 i;
762 
763 	mutex_lock(&test_fw_mutex);
764 
765 	test_fw_config->reqs =
766 		vzalloc(array3_size(sizeof(struct test_batched_req),
767 				    test_fw_config->num_requests, 2));
768 	if (!test_fw_config->reqs) {
769 		rc = -ENOMEM;
770 		goto out;
771 	}
772 
773 	pr_info("batched loading '%s' custom fallback mechanism %u times\n",
774 		test_fw_config->name, test_fw_config->num_requests);
775 
776 	send_uevent = test_fw_config->send_uevent ? FW_ACTION_HOTPLUG :
777 		FW_ACTION_NOHOTPLUG;
778 
779 	for (i = 0; i < test_fw_config->num_requests; i++) {
780 		req = &test_fw_config->reqs[i];
781 		req->name = test_fw_config->name;
782 		req->fw = NULL;
783 		req->idx = i;
784 		init_completion(&req->completion);
785 		rc = request_firmware_nowait(THIS_MODULE, send_uevent,
786 					     req->name,
787 					     dev, GFP_KERNEL, req,
788 					     trigger_batched_cb);
789 		if (rc) {
790 			pr_info("#%u: batched async load failed setup: %d\n",
791 				i, rc);
792 			req->rc = rc;
793 			goto out_bail;
794 		} else
795 			req->sent = true;
796 	}
797 
798 	rc = count;
799 
800 out_bail:
801 
802 	/*
803 	 * We require an explicit release to enable more time and delay of
804 	 * calling release_firmware() to improve our chances of forcing a
805 	 * batched request. If we instead called release_firmware() right away
806 	 * then we might miss on an opportunity of having a successful firmware
807 	 * request pass on the opportunity to be come a batched request.
808 	 */
809 
810 	for (i = 0; i < test_fw_config->num_requests; i++) {
811 		req = &test_fw_config->reqs[i];
812 		if (req->sent)
813 			wait_for_completion(&req->completion);
814 	}
815 
816 	/* Override any worker error if we had a general setup error */
817 	if (rc < 0)
818 		test_fw_config->test_result = rc;
819 
820 out:
821 	mutex_unlock(&test_fw_mutex);
822 
823 	return rc;
824 }
825 static DEVICE_ATTR_WO(trigger_batched_requests_async);
826 
827 static ssize_t test_result_show(struct device *dev,
828 				struct device_attribute *attr,
829 				char *buf)
830 {
831 	return test_dev_config_show_int(buf, test_fw_config->test_result);
832 }
833 static DEVICE_ATTR_RO(test_result);
834 
835 static ssize_t release_all_firmware_store(struct device *dev,
836 					  struct device_attribute *attr,
837 					  const char *buf, size_t count)
838 {
839 	test_release_all_firmware();
840 	return count;
841 }
842 static DEVICE_ATTR_WO(release_all_firmware);
843 
844 static ssize_t read_firmware_show(struct device *dev,
845 				  struct device_attribute *attr,
846 				  char *buf)
847 {
848 	struct test_batched_req *req;
849 	u8 idx;
850 	ssize_t rc = 0;
851 
852 	mutex_lock(&test_fw_mutex);
853 
854 	idx = test_fw_config->read_fw_idx;
855 	if (idx >= test_fw_config->num_requests) {
856 		rc = -ERANGE;
857 		goto out;
858 	}
859 
860 	if (!test_fw_config->reqs) {
861 		rc = -EINVAL;
862 		goto out;
863 	}
864 
865 	req = &test_fw_config->reqs[idx];
866 	if (!req->fw) {
867 		pr_err("#%u: failed to async load firmware\n", idx);
868 		rc = -ENOENT;
869 		goto out;
870 	}
871 
872 	pr_info("#%u: loaded %zu\n", idx, req->fw->size);
873 
874 	if (req->fw->size > PAGE_SIZE) {
875 		pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
876 		rc = -EINVAL;
877 		goto out;
878 	}
879 	memcpy(buf, req->fw->data, req->fw->size);
880 
881 	rc = req->fw->size;
882 out:
883 	mutex_unlock(&test_fw_mutex);
884 
885 	return rc;
886 }
887 static DEVICE_ATTR_RO(read_firmware);
888 
889 #define TEST_FW_DEV_ATTR(name)          &dev_attr_##name.attr
890 
891 static struct attribute *test_dev_attrs[] = {
892 	TEST_FW_DEV_ATTR(reset),
893 
894 	TEST_FW_DEV_ATTR(config),
895 	TEST_FW_DEV_ATTR(config_name),
896 	TEST_FW_DEV_ATTR(config_num_requests),
897 	TEST_FW_DEV_ATTR(config_into_buf),
898 	TEST_FW_DEV_ATTR(config_sync_direct),
899 	TEST_FW_DEV_ATTR(config_send_uevent),
900 	TEST_FW_DEV_ATTR(config_read_fw_idx),
901 
902 	/* These don't use the config at all - they could be ported! */
903 	TEST_FW_DEV_ATTR(trigger_request),
904 	TEST_FW_DEV_ATTR(trigger_async_request),
905 	TEST_FW_DEV_ATTR(trigger_custom_fallback),
906 
907 	/* These use the config and can use the test_result */
908 	TEST_FW_DEV_ATTR(trigger_batched_requests),
909 	TEST_FW_DEV_ATTR(trigger_batched_requests_async),
910 
911 	TEST_FW_DEV_ATTR(release_all_firmware),
912 	TEST_FW_DEV_ATTR(test_result),
913 	TEST_FW_DEV_ATTR(read_firmware),
914 	NULL,
915 };
916 
917 ATTRIBUTE_GROUPS(test_dev);
918 
919 static struct miscdevice test_fw_misc_device = {
920 	.minor          = MISC_DYNAMIC_MINOR,
921 	.name           = "test_firmware",
922 	.fops           = &test_fw_fops,
923 	.groups 	= test_dev_groups,
924 };
925 
926 static int __init test_firmware_init(void)
927 {
928 	int rc;
929 
930 	test_fw_config = kzalloc(sizeof(struct test_config), GFP_KERNEL);
931 	if (!test_fw_config)
932 		return -ENOMEM;
933 
934 	rc = __test_firmware_config_init();
935 	if (rc) {
936 		kfree(test_fw_config);
937 		pr_err("could not init firmware test config: %d\n", rc);
938 		return rc;
939 	}
940 
941 	rc = misc_register(&test_fw_misc_device);
942 	if (rc) {
943 		kfree(test_fw_config);
944 		pr_err("could not register misc device: %d\n", rc);
945 		return rc;
946 	}
947 
948 	pr_warn("interface ready\n");
949 
950 	return 0;
951 }
952 
953 module_init(test_firmware_init);
954 
955 static void __exit test_firmware_exit(void)
956 {
957 	mutex_lock(&test_fw_mutex);
958 	release_firmware(test_firmware);
959 	misc_deregister(&test_fw_misc_device);
960 	__test_firmware_config_free();
961 	kfree(test_fw_config);
962 	mutex_unlock(&test_fw_mutex);
963 
964 	pr_warn("removed interface\n");
965 }
966 
967 module_exit(test_firmware_exit);
968 
969 MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
970 MODULE_LICENSE("GPL");
971