1 | // SPDX-License-Identifier: GPL-2.0 |
2 | |
3 | #include <linux/highmem.h> |
4 | #include <linux/module.h> |
5 | #include <linux/security.h> |
6 | #include <linux/slab.h> |
7 | #include <linux/types.h> |
8 | |
9 | #include "sysfs.h" |
10 | |
11 | /* |
12 | * sysfs support for firmware loader |
13 | */ |
14 | |
15 | void __fw_load_abort(struct fw_priv *fw_priv) |
16 | { |
17 | /* |
18 | * There is a small window in which user can write to 'loading' |
19 | * between loading done/aborted and disappearance of 'loading' |
20 | */ |
21 | if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) |
22 | return; |
23 | |
24 | fw_state_aborted(fw_priv); |
25 | } |
26 | |
27 | #ifdef CONFIG_FW_LOADER_USER_HELPER |
28 | static ssize_t timeout_show(const struct class *class, const struct class_attribute *attr, |
29 | char *buf) |
30 | { |
31 | return sysfs_emit(buf, fmt: "%d\n" , __firmware_loading_timeout()); |
32 | } |
33 | |
34 | /** |
35 | * timeout_store() - set number of seconds to wait for firmware |
36 | * @class: device class pointer |
37 | * @attr: device attribute pointer |
38 | * @buf: buffer to scan for timeout value |
39 | * @count: number of bytes in @buf |
40 | * |
41 | * Sets the number of seconds to wait for the firmware. Once |
42 | * this expires an error will be returned to the driver and no |
43 | * firmware will be provided. |
44 | * |
45 | * Note: zero means 'wait forever'. |
46 | **/ |
47 | static ssize_t timeout_store(const struct class *class, const struct class_attribute *attr, |
48 | const char *buf, size_t count) |
49 | { |
50 | int tmp_loading_timeout = simple_strtol(buf, NULL, 10); |
51 | |
52 | if (tmp_loading_timeout < 0) |
53 | tmp_loading_timeout = 0; |
54 | |
55 | __fw_fallback_set_timeout(timeout: tmp_loading_timeout); |
56 | |
57 | return count; |
58 | } |
59 | static CLASS_ATTR_RW(timeout); |
60 | |
61 | static struct attribute *firmware_class_attrs[] = { |
62 | &class_attr_timeout.attr, |
63 | NULL, |
64 | }; |
65 | ATTRIBUTE_GROUPS(firmware_class); |
66 | |
67 | static int do_firmware_uevent(const struct fw_sysfs *fw_sysfs, struct kobj_uevent_env *env) |
68 | { |
69 | if (add_uevent_var(env, format: "FIRMWARE=%s" , fw_sysfs->fw_priv->fw_name)) |
70 | return -ENOMEM; |
71 | if (add_uevent_var(env, format: "TIMEOUT=%i" , __firmware_loading_timeout())) |
72 | return -ENOMEM; |
73 | if (add_uevent_var(env, format: "ASYNC=%d" , fw_sysfs->nowait)) |
74 | return -ENOMEM; |
75 | |
76 | return 0; |
77 | } |
78 | |
79 | static int firmware_uevent(const struct device *dev, struct kobj_uevent_env *env) |
80 | { |
81 | const struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
82 | int err = 0; |
83 | |
84 | mutex_lock(&fw_lock); |
85 | if (fw_sysfs->fw_priv) |
86 | err = do_firmware_uevent(fw_sysfs, env); |
87 | mutex_unlock(lock: &fw_lock); |
88 | return err; |
89 | } |
90 | #endif /* CONFIG_FW_LOADER_USER_HELPER */ |
91 | |
92 | static void fw_dev_release(struct device *dev) |
93 | { |
94 | struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
95 | |
96 | if (fw_sysfs->fw_upload_priv) |
97 | fw_upload_free(fw_sysfs); |
98 | |
99 | kfree(objp: fw_sysfs); |
100 | } |
101 | |
102 | static struct class firmware_class = { |
103 | .name = "firmware" , |
104 | #ifdef CONFIG_FW_LOADER_USER_HELPER |
105 | .class_groups = firmware_class_groups, |
106 | .dev_uevent = firmware_uevent, |
107 | #endif |
108 | .dev_release = fw_dev_release, |
109 | }; |
110 | |
111 | int register_sysfs_loader(void) |
112 | { |
113 | int ret = class_register(class: &firmware_class); |
114 | |
115 | if (ret != 0) |
116 | return ret; |
117 | return register_firmware_config_sysctl(); |
118 | } |
119 | |
120 | void unregister_sysfs_loader(void) |
121 | { |
122 | unregister_firmware_config_sysctl(); |
123 | class_unregister(class: &firmware_class); |
124 | } |
125 | |
126 | static ssize_t firmware_loading_show(struct device *dev, |
127 | struct device_attribute *attr, char *buf) |
128 | { |
129 | struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
130 | int loading = 0; |
131 | |
132 | mutex_lock(&fw_lock); |
133 | if (fw_sysfs->fw_priv) |
134 | loading = fw_state_is_loading(fw_priv: fw_sysfs->fw_priv); |
135 | mutex_unlock(lock: &fw_lock); |
136 | |
137 | return sysfs_emit(buf, fmt: "%d\n" , loading); |
138 | } |
139 | |
140 | /** |
141 | * firmware_loading_store() - set value in the 'loading' control file |
142 | * @dev: device pointer |
143 | * @attr: device attribute pointer |
144 | * @buf: buffer to scan for loading control value |
145 | * @count: number of bytes in @buf |
146 | * |
147 | * The relevant values are: |
148 | * |
149 | * 1: Start a load, discarding any previous partial load. |
150 | * 0: Conclude the load and hand the data to the driver code. |
151 | * -1: Conclude the load with an error and discard any written data. |
152 | **/ |
153 | static ssize_t firmware_loading_store(struct device *dev, |
154 | struct device_attribute *attr, |
155 | const char *buf, size_t count) |
156 | { |
157 | struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
158 | struct fw_priv *fw_priv; |
159 | ssize_t written = count; |
160 | int loading = simple_strtol(buf, NULL, 10); |
161 | |
162 | mutex_lock(&fw_lock); |
163 | fw_priv = fw_sysfs->fw_priv; |
164 | if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) |
165 | goto out; |
166 | |
167 | switch (loading) { |
168 | case 1: |
169 | /* discarding any previous partial load */ |
170 | fw_free_paged_buf(fw_priv); |
171 | fw_state_start(fw_priv); |
172 | break; |
173 | case 0: |
174 | if (fw_state_is_loading(fw_priv)) { |
175 | int rc; |
176 | |
177 | /* |
178 | * Several loading requests may be pending on |
179 | * one same firmware buf, so let all requests |
180 | * see the mapped 'buf->data' once the loading |
181 | * is completed. |
182 | */ |
183 | rc = fw_map_paged_buf(fw_priv); |
184 | if (rc) |
185 | dev_err(dev, "%s: map pages failed\n" , |
186 | __func__); |
187 | else |
188 | rc = security_kernel_post_load_data(buf: fw_priv->data, |
189 | size: fw_priv->size, |
190 | id: LOADING_FIRMWARE, |
191 | description: "blob" ); |
192 | |
193 | /* |
194 | * Same logic as fw_load_abort, only the DONE bit |
195 | * is ignored and we set ABORT only on failure. |
196 | */ |
197 | if (rc) { |
198 | fw_state_aborted(fw_priv); |
199 | written = rc; |
200 | } else { |
201 | fw_state_done(fw_priv); |
202 | |
203 | /* |
204 | * If this is a user-initiated firmware upload |
205 | * then start the upload in a worker thread now. |
206 | */ |
207 | rc = fw_upload_start(fw_sysfs); |
208 | if (rc) |
209 | written = rc; |
210 | } |
211 | break; |
212 | } |
213 | fallthrough; |
214 | default: |
215 | dev_err(dev, "%s: unexpected value (%d)\n" , __func__, loading); |
216 | fallthrough; |
217 | case -1: |
218 | fw_load_abort(fw_sysfs); |
219 | if (fw_sysfs->fw_upload_priv) |
220 | fw_state_init(fw_priv: fw_sysfs->fw_priv); |
221 | |
222 | break; |
223 | } |
224 | out: |
225 | mutex_unlock(lock: &fw_lock); |
226 | return written; |
227 | } |
228 | |
229 | DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store); |
230 | |
231 | static void firmware_rw_data(struct fw_priv *fw_priv, char *buffer, |
232 | loff_t offset, size_t count, bool read) |
233 | { |
234 | if (read) |
235 | memcpy(buffer, fw_priv->data + offset, count); |
236 | else |
237 | memcpy(fw_priv->data + offset, buffer, count); |
238 | } |
239 | |
240 | static void firmware_rw(struct fw_priv *fw_priv, char *buffer, |
241 | loff_t offset, size_t count, bool read) |
242 | { |
243 | while (count) { |
244 | int page_nr = offset >> PAGE_SHIFT; |
245 | int page_ofs = offset & (PAGE_SIZE - 1); |
246 | int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count); |
247 | |
248 | if (read) |
249 | memcpy_from_page(to: buffer, page: fw_priv->pages[page_nr], |
250 | offset: page_ofs, len: page_cnt); |
251 | else |
252 | memcpy_to_page(page: fw_priv->pages[page_nr], offset: page_ofs, |
253 | from: buffer, len: page_cnt); |
254 | |
255 | buffer += page_cnt; |
256 | offset += page_cnt; |
257 | count -= page_cnt; |
258 | } |
259 | } |
260 | |
261 | static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj, |
262 | struct bin_attribute *bin_attr, |
263 | char *buffer, loff_t offset, size_t count) |
264 | { |
265 | struct device *dev = kobj_to_dev(kobj); |
266 | struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
267 | struct fw_priv *fw_priv; |
268 | ssize_t ret_count; |
269 | |
270 | mutex_lock(&fw_lock); |
271 | fw_priv = fw_sysfs->fw_priv; |
272 | if (!fw_priv || fw_state_is_done(fw_priv)) { |
273 | ret_count = -ENODEV; |
274 | goto out; |
275 | } |
276 | if (offset > fw_priv->size) { |
277 | ret_count = 0; |
278 | goto out; |
279 | } |
280 | if (count > fw_priv->size - offset) |
281 | count = fw_priv->size - offset; |
282 | |
283 | ret_count = count; |
284 | |
285 | if (fw_priv->data) |
286 | firmware_rw_data(fw_priv, buffer, offset, count, read: true); |
287 | else |
288 | firmware_rw(fw_priv, buffer, offset, count, read: true); |
289 | |
290 | out: |
291 | mutex_unlock(lock: &fw_lock); |
292 | return ret_count; |
293 | } |
294 | |
295 | static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size) |
296 | { |
297 | int err; |
298 | |
299 | err = fw_grow_paged_buf(fw_priv: fw_sysfs->fw_priv, |
300 | PAGE_ALIGN(min_size) >> PAGE_SHIFT); |
301 | if (err) |
302 | fw_load_abort(fw_sysfs); |
303 | return err; |
304 | } |
305 | |
306 | /** |
307 | * firmware_data_write() - write method for firmware |
308 | * @filp: open sysfs file |
309 | * @kobj: kobject for the device |
310 | * @bin_attr: bin_attr structure |
311 | * @buffer: buffer being written |
312 | * @offset: buffer offset for write in total data store area |
313 | * @count: buffer size |
314 | * |
315 | * Data written to the 'data' attribute will be later handed to |
316 | * the driver as a firmware image. |
317 | **/ |
318 | static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj, |
319 | struct bin_attribute *bin_attr, |
320 | char *buffer, loff_t offset, size_t count) |
321 | { |
322 | struct device *dev = kobj_to_dev(kobj); |
323 | struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); |
324 | struct fw_priv *fw_priv; |
325 | ssize_t retval; |
326 | |
327 | if (!capable(CAP_SYS_RAWIO)) |
328 | return -EPERM; |
329 | |
330 | mutex_lock(&fw_lock); |
331 | fw_priv = fw_sysfs->fw_priv; |
332 | if (!fw_priv || fw_state_is_done(fw_priv)) { |
333 | retval = -ENODEV; |
334 | goto out; |
335 | } |
336 | |
337 | if (fw_priv->data) { |
338 | if (offset + count > fw_priv->allocated_size) { |
339 | retval = -ENOMEM; |
340 | goto out; |
341 | } |
342 | firmware_rw_data(fw_priv, buffer, offset, count, read: false); |
343 | retval = count; |
344 | } else { |
345 | retval = fw_realloc_pages(fw_sysfs, min_size: offset + count); |
346 | if (retval) |
347 | goto out; |
348 | |
349 | retval = count; |
350 | firmware_rw(fw_priv, buffer, offset, count, read: false); |
351 | } |
352 | |
353 | fw_priv->size = max_t(size_t, offset + count, fw_priv->size); |
354 | out: |
355 | mutex_unlock(lock: &fw_lock); |
356 | return retval; |
357 | } |
358 | |
359 | static struct bin_attribute firmware_attr_data = { |
360 | .attr = { .name = "data" , .mode = 0644 }, |
361 | .size = 0, |
362 | .read = firmware_data_read, |
363 | .write = firmware_data_write, |
364 | }; |
365 | |
366 | static struct attribute *fw_dev_attrs[] = { |
367 | &dev_attr_loading.attr, |
368 | #ifdef CONFIG_FW_UPLOAD |
369 | &dev_attr_cancel.attr, |
370 | &dev_attr_status.attr, |
371 | &dev_attr_error.attr, |
372 | &dev_attr_remaining_size.attr, |
373 | #endif |
374 | NULL |
375 | }; |
376 | |
377 | static struct bin_attribute *fw_dev_bin_attrs[] = { |
378 | &firmware_attr_data, |
379 | NULL |
380 | }; |
381 | |
382 | static const struct attribute_group fw_dev_attr_group = { |
383 | .attrs = fw_dev_attrs, |
384 | .bin_attrs = fw_dev_bin_attrs, |
385 | #ifdef CONFIG_FW_UPLOAD |
386 | .is_visible = fw_upload_is_visible, |
387 | #endif |
388 | }; |
389 | |
390 | static const struct attribute_group *fw_dev_attr_groups[] = { |
391 | &fw_dev_attr_group, |
392 | NULL |
393 | }; |
394 | |
395 | struct fw_sysfs * |
396 | fw_create_instance(struct firmware *firmware, const char *fw_name, |
397 | struct device *device, u32 opt_flags) |
398 | { |
399 | struct fw_sysfs *fw_sysfs; |
400 | struct device *f_dev; |
401 | |
402 | fw_sysfs = kzalloc(size: sizeof(*fw_sysfs), GFP_KERNEL); |
403 | if (!fw_sysfs) { |
404 | fw_sysfs = ERR_PTR(error: -ENOMEM); |
405 | goto exit; |
406 | } |
407 | |
408 | fw_sysfs->nowait = !!(opt_flags & FW_OPT_NOWAIT); |
409 | fw_sysfs->fw = firmware; |
410 | f_dev = &fw_sysfs->dev; |
411 | |
412 | device_initialize(dev: f_dev); |
413 | dev_set_name(dev: f_dev, name: "%s" , fw_name); |
414 | f_dev->parent = device; |
415 | f_dev->class = &firmware_class; |
416 | f_dev->groups = fw_dev_attr_groups; |
417 | exit: |
418 | return fw_sysfs; |
419 | } |
420 | |