1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/highmem.h> 4 #include <linux/module.h> 5 #include <linux/security.h> 6 #include <linux/slab.h> 7 #include <linux/types.h> 8 9 #include "sysfs.h" 10 #include "sysfs_upload.h" 11 12 /* 13 * sysfs support for firmware loader 14 */ 15 16 void __fw_load_abort(struct fw_priv *fw_priv) 17 { 18 /* 19 * There is a small window in which user can write to 'loading' 20 * between loading done/aborted and disappearance of 'loading' 21 */ 22 if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) 23 return; 24 25 fw_state_aborted(fw_priv); 26 } 27 28 #ifdef CONFIG_FW_LOADER_USER_HELPER 29 static ssize_t timeout_show(struct class *class, struct class_attribute *attr, 30 char *buf) 31 { 32 return sysfs_emit(buf, "%d\n", __firmware_loading_timeout()); 33 } 34 35 /** 36 * timeout_store() - set number of seconds to wait for firmware 37 * @class: device class pointer 38 * @attr: device attribute pointer 39 * @buf: buffer to scan for timeout value 40 * @count: number of bytes in @buf 41 * 42 * Sets the number of seconds to wait for the firmware. Once 43 * this expires an error will be returned to the driver and no 44 * firmware will be provided. 45 * 46 * Note: zero means 'wait forever'. 47 **/ 48 static ssize_t timeout_store(struct class *class, struct class_attribute *attr, 49 const char *buf, size_t count) 50 { 51 int tmp_loading_timeout = simple_strtol(buf, NULL, 10); 52 53 if (tmp_loading_timeout < 0) 54 tmp_loading_timeout = 0; 55 56 __fw_fallback_set_timeout(tmp_loading_timeout); 57 58 return count; 59 } 60 static CLASS_ATTR_RW(timeout); 61 62 static struct attribute *firmware_class_attrs[] = { 63 &class_attr_timeout.attr, 64 NULL, 65 }; 66 ATTRIBUTE_GROUPS(firmware_class); 67 68 static int do_firmware_uevent(struct fw_sysfs *fw_sysfs, struct kobj_uevent_env *env) 69 { 70 if (add_uevent_var(env, "FIRMWARE=%s", fw_sysfs->fw_priv->fw_name)) 71 return -ENOMEM; 72 if (add_uevent_var(env, "TIMEOUT=%i", __firmware_loading_timeout())) 73 return -ENOMEM; 74 if (add_uevent_var(env, "ASYNC=%d", fw_sysfs->nowait)) 75 return -ENOMEM; 76 77 return 0; 78 } 79 80 static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) 81 { 82 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 83 int err = 0; 84 85 mutex_lock(&fw_lock); 86 if (fw_sysfs->fw_priv) 87 err = do_firmware_uevent(fw_sysfs, env); 88 mutex_unlock(&fw_lock); 89 return err; 90 } 91 #endif /* CONFIG_FW_LOADER_USER_HELPER */ 92 93 static void fw_dev_release(struct device *dev) 94 { 95 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 96 97 if (fw_sysfs->fw_upload_priv) { 98 free_fw_priv(fw_sysfs->fw_priv); 99 kfree(fw_sysfs->fw_upload_priv); 100 } 101 kfree(fw_sysfs); 102 } 103 104 static struct class firmware_class = { 105 .name = "firmware", 106 #ifdef CONFIG_FW_LOADER_USER_HELPER 107 .class_groups = firmware_class_groups, 108 .dev_uevent = firmware_uevent, 109 #endif 110 .dev_release = fw_dev_release, 111 }; 112 113 #ifdef CONFIG_FW_LOADER_USER_HELPER 114 int register_sysfs_loader(void) 115 { 116 int ret = class_register(&firmware_class); 117 118 if (ret != 0) 119 return ret; 120 return register_firmware_config_sysctl(); 121 } 122 123 void unregister_sysfs_loader(void) 124 { 125 unregister_firmware_config_sysctl(); 126 class_unregister(&firmware_class); 127 } 128 #endif 129 130 static ssize_t firmware_loading_show(struct device *dev, 131 struct device_attribute *attr, char *buf) 132 { 133 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 134 int loading = 0; 135 136 mutex_lock(&fw_lock); 137 if (fw_sysfs->fw_priv) 138 loading = fw_state_is_loading(fw_sysfs->fw_priv); 139 mutex_unlock(&fw_lock); 140 141 return sysfs_emit(buf, "%d\n", loading); 142 } 143 144 /** 145 * firmware_loading_store() - set value in the 'loading' control file 146 * @dev: device pointer 147 * @attr: device attribute pointer 148 * @buf: buffer to scan for loading control value 149 * @count: number of bytes in @buf 150 * 151 * The relevant values are: 152 * 153 * 1: Start a load, discarding any previous partial load. 154 * 0: Conclude the load and hand the data to the driver code. 155 * -1: Conclude the load with an error and discard any written data. 156 **/ 157 static ssize_t firmware_loading_store(struct device *dev, 158 struct device_attribute *attr, 159 const char *buf, size_t count) 160 { 161 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 162 struct fw_priv *fw_priv; 163 ssize_t written = count; 164 int loading = simple_strtol(buf, NULL, 10); 165 166 mutex_lock(&fw_lock); 167 fw_priv = fw_sysfs->fw_priv; 168 if (fw_state_is_aborted(fw_priv) || fw_state_is_done(fw_priv)) 169 goto out; 170 171 switch (loading) { 172 case 1: 173 /* discarding any previous partial load */ 174 fw_free_paged_buf(fw_priv); 175 fw_state_start(fw_priv); 176 break; 177 case 0: 178 if (fw_state_is_loading(fw_priv)) { 179 int rc; 180 181 /* 182 * Several loading requests may be pending on 183 * one same firmware buf, so let all requests 184 * see the mapped 'buf->data' once the loading 185 * is completed. 186 */ 187 rc = fw_map_paged_buf(fw_priv); 188 if (rc) 189 dev_err(dev, "%s: map pages failed\n", 190 __func__); 191 else 192 rc = security_kernel_post_load_data(fw_priv->data, 193 fw_priv->size, 194 LOADING_FIRMWARE, 195 "blob"); 196 197 /* 198 * Same logic as fw_load_abort, only the DONE bit 199 * is ignored and we set ABORT only on failure. 200 */ 201 if (rc) { 202 fw_state_aborted(fw_priv); 203 written = rc; 204 } else { 205 fw_state_done(fw_priv); 206 207 /* 208 * If this is a user-initiated firmware upload 209 * then start the upload in a worker thread now. 210 */ 211 rc = fw_upload_start(fw_sysfs); 212 if (rc) 213 written = rc; 214 } 215 break; 216 } 217 fallthrough; 218 default: 219 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading); 220 fallthrough; 221 case -1: 222 fw_load_abort(fw_sysfs); 223 if (fw_sysfs->fw_upload_priv) 224 fw_state_init(fw_sysfs->fw_priv); 225 226 break; 227 } 228 out: 229 mutex_unlock(&fw_lock); 230 return written; 231 } 232 233 DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store); 234 235 static void firmware_rw_data(struct fw_priv *fw_priv, char *buffer, 236 loff_t offset, size_t count, bool read) 237 { 238 if (read) 239 memcpy(buffer, fw_priv->data + offset, count); 240 else 241 memcpy(fw_priv->data + offset, buffer, count); 242 } 243 244 static void firmware_rw(struct fw_priv *fw_priv, char *buffer, 245 loff_t offset, size_t count, bool read) 246 { 247 while (count) { 248 void *page_data; 249 int page_nr = offset >> PAGE_SHIFT; 250 int page_ofs = offset & (PAGE_SIZE - 1); 251 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count); 252 253 page_data = kmap(fw_priv->pages[page_nr]); 254 255 if (read) 256 memcpy(buffer, page_data + page_ofs, page_cnt); 257 else 258 memcpy(page_data + page_ofs, buffer, page_cnt); 259 260 kunmap(fw_priv->pages[page_nr]); 261 buffer += page_cnt; 262 offset += page_cnt; 263 count -= page_cnt; 264 } 265 } 266 267 static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj, 268 struct bin_attribute *bin_attr, 269 char *buffer, loff_t offset, size_t count) 270 { 271 struct device *dev = kobj_to_dev(kobj); 272 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 273 struct fw_priv *fw_priv; 274 ssize_t ret_count; 275 276 mutex_lock(&fw_lock); 277 fw_priv = fw_sysfs->fw_priv; 278 if (!fw_priv || fw_state_is_done(fw_priv)) { 279 ret_count = -ENODEV; 280 goto out; 281 } 282 if (offset > fw_priv->size) { 283 ret_count = 0; 284 goto out; 285 } 286 if (count > fw_priv->size - offset) 287 count = fw_priv->size - offset; 288 289 ret_count = count; 290 291 if (fw_priv->data) 292 firmware_rw_data(fw_priv, buffer, offset, count, true); 293 else 294 firmware_rw(fw_priv, buffer, offset, count, true); 295 296 out: 297 mutex_unlock(&fw_lock); 298 return ret_count; 299 } 300 301 static int fw_realloc_pages(struct fw_sysfs *fw_sysfs, int min_size) 302 { 303 int err; 304 305 err = fw_grow_paged_buf(fw_sysfs->fw_priv, 306 PAGE_ALIGN(min_size) >> PAGE_SHIFT); 307 if (err) 308 fw_load_abort(fw_sysfs); 309 return err; 310 } 311 312 /** 313 * firmware_data_write() - write method for firmware 314 * @filp: open sysfs file 315 * @kobj: kobject for the device 316 * @bin_attr: bin_attr structure 317 * @buffer: buffer being written 318 * @offset: buffer offset for write in total data store area 319 * @count: buffer size 320 * 321 * Data written to the 'data' attribute will be later handed to 322 * the driver as a firmware image. 323 **/ 324 static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj, 325 struct bin_attribute *bin_attr, 326 char *buffer, loff_t offset, size_t count) 327 { 328 struct device *dev = kobj_to_dev(kobj); 329 struct fw_sysfs *fw_sysfs = to_fw_sysfs(dev); 330 struct fw_priv *fw_priv; 331 ssize_t retval; 332 333 if (!capable(CAP_SYS_RAWIO)) 334 return -EPERM; 335 336 mutex_lock(&fw_lock); 337 fw_priv = fw_sysfs->fw_priv; 338 if (!fw_priv || fw_state_is_done(fw_priv)) { 339 retval = -ENODEV; 340 goto out; 341 } 342 343 if (fw_priv->data) { 344 if (offset + count > fw_priv->allocated_size) { 345 retval = -ENOMEM; 346 goto out; 347 } 348 firmware_rw_data(fw_priv, buffer, offset, count, false); 349 retval = count; 350 } else { 351 retval = fw_realloc_pages(fw_sysfs, offset + count); 352 if (retval) 353 goto out; 354 355 retval = count; 356 firmware_rw(fw_priv, buffer, offset, count, false); 357 } 358 359 fw_priv->size = max_t(size_t, offset + count, fw_priv->size); 360 out: 361 mutex_unlock(&fw_lock); 362 return retval; 363 } 364 365 static struct bin_attribute firmware_attr_data = { 366 .attr = { .name = "data", .mode = 0644 }, 367 .size = 0, 368 .read = firmware_data_read, 369 .write = firmware_data_write, 370 }; 371 372 static struct attribute *fw_dev_attrs[] = { 373 &dev_attr_loading.attr, 374 #ifdef CONFIG_FW_UPLOAD 375 &dev_attr_cancel.attr, 376 &dev_attr_status.attr, 377 &dev_attr_error.attr, 378 &dev_attr_remaining_size.attr, 379 #endif 380 NULL 381 }; 382 383 static struct bin_attribute *fw_dev_bin_attrs[] = { 384 &firmware_attr_data, 385 NULL 386 }; 387 388 static const struct attribute_group fw_dev_attr_group = { 389 .attrs = fw_dev_attrs, 390 .bin_attrs = fw_dev_bin_attrs, 391 #ifdef CONFIG_FW_UPLOAD 392 .is_visible = fw_upload_is_visible, 393 #endif 394 }; 395 396 static const struct attribute_group *fw_dev_attr_groups[] = { 397 &fw_dev_attr_group, 398 NULL 399 }; 400 401 struct fw_sysfs * 402 fw_create_instance(struct firmware *firmware, const char *fw_name, 403 struct device *device, u32 opt_flags) 404 { 405 struct fw_sysfs *fw_sysfs; 406 struct device *f_dev; 407 408 fw_sysfs = kzalloc(sizeof(*fw_sysfs), GFP_KERNEL); 409 if (!fw_sysfs) { 410 fw_sysfs = ERR_PTR(-ENOMEM); 411 goto exit; 412 } 413 414 fw_sysfs->nowait = !!(opt_flags & FW_OPT_NOWAIT); 415 fw_sysfs->fw = firmware; 416 f_dev = &fw_sysfs->dev; 417 418 device_initialize(f_dev); 419 dev_set_name(f_dev, "%s", fw_name); 420 f_dev->parent = device; 421 f_dev->class = &firmware_class; 422 f_dev->groups = fw_dev_attr_groups; 423 exit: 424 return fw_sysfs; 425 } 426