[PATCH 00/13] firewire: core: add KUnit tests for config ROM parser and generator

[PATCH 00/13] firewire: core: add KUnit tests for config ROM parser and generator

[Takashi Sakamoto]

Hi,

(Resent because the previous email was sent to the wrong address...)

This series adds KUnit tests for the configuration ROM parser and
generator in the core function.

The parser tests cover existing device quirks and malformed configuration
ROMs, including out-of-bounds directory/leaf entries.

The generator tests cover AV/C and IIDC devices layouts, combinations of
units, and invalid or oversized extension data.

The tests are intended to document existing behavior and provide regression
coverage for the parser and generator.

The test execution samples:

```
$ python3 tools/testing/kunit/kunit.py run \
  --kunitconfig=drivers/firewire/ \
  'firewire-config-rom-*'
[22:12:56] Configuring KUnit Kernel ...
[22:12:56] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=16
[22:12:59] Starting KUnit Kernel (1/1)...
[22:12:59] ============================================================
Running tests with:
$ .kunit/linux 'kunit.filter_glob=firewire-config-rom-*' kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[22:12:59] ======== firewire-config-rom-generator (4 subtests) ========
[22:12:59] ================ test_config_rom_generator  ================
[22:12:59] [PASSED] bare
[22:12:59] [PASSED] with_avc_unit
[22:12:59] [PASSED] with_iidc_unit
[22:12:59] [PASSED] with_avc_and_iidc_unit
[22:12:59] ============ [PASSED] test_config_rom_generator ============
[22:12:59] [PASSED] add_descriptor_with_invalid_length
[22:12:59] [PASSED] add_descriptor_with_invalid_data
[22:12:59] [PASSED] add_descriptor_beyond_upper_limit
[22:12:59] ========== [PASSED] firewire-config-rom-generator ==========
[22:12:59] ========= firewire-config-rom-parser (2 subtests) ==========
[22:12:59] ============= test_parser_with_regular_cases  ==============
[22:12:59] [PASSED] detect_irm_is_1394_1995_only_quirk
[22:12:59] [PASSED] detect_irm_ignores_bus_manager_quirk
[22:12:59] [PASSED] detect_ack_packet_with_invalid_pending_code_quirk
[22:12:59] [PASSED] detect_unstable_at_s400_quirk
[22:12:59] ========= [PASSED] test_parser_with_regular_cases ==========
[22:12:59] [PASSED] test_parser_with_overflowed_case
[22:12:59] =========== [PASSED] firewire-config-rom-parser ============
[22:12:59] ============================================================
[22:12:59] Testing complete. Ran 12 tests: passed: 12
[22:12:59] Elapsed time: 2.743s total, 0.001s configuring, 2.625s building, 0.085s running
```

Regards


Takashi Sakamoto (13):
  firewire: core: add KUnit test skeleton for config ROM parser and
    generator
  firewire: core: add test to detect irm-is-1394-1995-only quirk in
    config ROM parser
  firewire: core: add test to detect irm-ignores-bus-manager quirk in
    config ROM parser
  firewire: core: add test to detect
    ack-packet-with-invalid-pending-code quirk in config ROM parser
  firewire: core: add test to detect unstable-at-s400 quirk in config
    ROM parser
  firewire: core: add test to avoid excessive configuration ROM length
  firewire: core: add test for root directory generation in config ROM
    generator
  firewire: core: add test to generate with AV/C unit in config ROM
    generator
  firewire: core: add test to generate with IIDC unit in config ROM
    generator
  firewire: core: add test to generate with both AV/C and IIDC units in
    config ROM generator
  firewire: core: add test for invalid length in config ROM generator
  firewire: core: add invalid block test for config ROM generator
  firewire: core: add test for beyond-boundary case in config ROM
    generator

 drivers/firewire/.kunitconfig                |   1 +
 drivers/firewire/Kconfig                     |  16 +
 drivers/firewire/config-rom-generator-test.c | 407 +++++++++++++++++++
 drivers/firewire/config-rom-parser-test.c    | 355 ++++++++++++++++
 drivers/firewire/core-card.c                 |   4 +
 drivers/firewire/core-device.c               |   4 +
 drivers/firewire/core-transaction.c          |   4 +
 7 files changed, 791 insertions(+)
 create mode 100644 drivers/firewire/config-rom-generator-test.c
 create mode 100644 drivers/firewire/config-rom-parser-test.c


base-commit: 61defa04bf0578ff9f7a52a8c74a9cb5acd8fced
-- 
2.53.0

[PATCH 01/13] firewire: core: add KUnit test skeleton for config ROM parser and generator

[Takashi Sakamoto]

In IEEE 1394, all devices on the bus are required to provide structured
data in response to requests to a specific range of their address space.
This structured data is called configuration ROM and is defined in
IEEE 1212.

The core function of this subsystem contains the generator and parser for
the configuration ROM. The generator constructs the configuration ROM for
the local host node, while the parser interprets the configuration ROM of
detected nodes.

Both the generator and parser are fundamental to identifying the node
capabilities. Add KUnit test skeletons for testing their implementations.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/.kunitconfig                |  1 +
 drivers/firewire/Kconfig                     | 16 ++++++++++++++++
 drivers/firewire/config-rom-generator-test.c | 19 +++++++++++++++++++
 drivers/firewire/config-rom-parser-test.c    | 19 +++++++++++++++++++
 drivers/firewire/core-card.c                 |  4 ++++
 drivers/firewire/core-device.c               |  4 ++++
 6 files changed, 63 insertions(+)
 create mode 100644 drivers/firewire/config-rom-generator-test.c
 create mode 100644 drivers/firewire/config-rom-parser-test.c

diff --git a/drivers/firewire/.kunitconfig b/drivers/firewire/.kunitconfig
index 7406acb00478..ee9129081cef 100644
--- a/drivers/firewire/.kunitconfig
+++ b/drivers/firewire/.kunitconfig
@@ -7,3 +7,4 @@ CONFIG_FIREWIRE_KUNIT_PACKET_SERDES_TEST=y
 CONFIG_FIREWIRE_KUNIT_SELF_ID_SEQUENCE_HELPER_TEST=y
 CONFIG_FIREWIRE_KUNIT_OHCI_SERDES_TEST=y
 CONFIG_FIREWIRE_KUNIT_NODE_TREE_TEST=y
+CONFIG_FIREWIRE_KUNIT_CONFIG_ROM_PARSER_AND_GENERATOR_TEST=y
diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
index b5abe00accc9..7e1d4b2c440b 100644
--- a/drivers/firewire/Kconfig
+++ b/drivers/firewire/Kconfig
@@ -96,6 +96,22 @@ config FIREWIRE_KUNIT_NODE_TREE_TEST
 	  For more information on KUnit and unit tests in general, refer
 	  to the KUnit documentation in Documentation/dev-tools/kunit/.
 
+config FIREWIRE_KUNIT_CONFIG_ROM_PARSER_AND_GENERATOR_TEST
+	tristate "KUnit tests for config ROM parser and generator" if !KUNIT_ALL_TESTS
+	depends on FIREWIRE && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  This builds the KUnit tests to check parser and generator for
+	  configuration ROM content defined in IEEE 1212.
+
+	  KUnit tests run during boot and output the results to the debug
+	  log in TAP format (https://testanything.org/). Only useful for
+	  kernel devs running KUnit test harness and are not for inclusion
+	  into a production build.
+
+	  For more information on KUnit and unit tests in general, refer
+	  to the KUnit documentation in Documentation/dev-tools/kunit/.
+
 config FIREWIRE_OHCI
 	tristate "OHCI-1394 controllers"
 	depends on PCI && FIREWIRE
diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
new file mode 100644
index 000000000000..9a901eef7b0a
--- /dev/null
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-only
+//
+// config-rom-generator-test.c - An application of Kunit to test configuration ROM generator.
+//
+// Copyright (c) 2026 Takashi Sakamoto
+//
+// This file can not be built independently since it is intentionally included in core-card.c.
+
+#include <kunit/test.h>
+
+static struct kunit_case config_rom_generator_test_cases[] = {
+	{}
+};
+
+static struct kunit_suite config_rom_generator_test_suite = {
+	.name = "firewire-config-rom-generator",
+	.test_cases = config_rom_generator_test_cases,
+};
+kunit_test_suite(config_rom_generator_test_suite);
diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
new file mode 100644
index 000000000000..632f24e68692
--- /dev/null
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-only
+//
+// config-rom-parser-test.c - An application of Kunit to test configuration ROM parser.
+//
+// Copyright (c) 2026 Takashi Sakamoto
+//
+// This file can not be built independently since it is intentionally included in core-device.c.
+
+#include <kunit/test.h>
+
+static struct kunit_case config_rom_parser_test_cases[] = {
+	{}
+};
+
+static struct kunit_suite config_rom_parser_test_suite = {
+	.name = "firewire-config-rom-parser",
+	.test_cases = config_rom_parser_test_cases,
+};
+kunit_test_suite(config_rom_parser_test_suite);
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index 94992791f02e..23749434d900 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -851,3 +851,7 @@ int fw_card_read_cycle_time(struct fw_card *card, u32 *cycle_time)
 	return 0;
 }
 EXPORT_SYMBOL_GPL(fw_card_read_cycle_time);
+
+#ifdef CONFIG_FIREWIRE_KUNIT_CONFIG_ROM_PARSER_AND_GENERATOR_TEST
+#include "config-rom-generator-test.c"
+#endif
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index cbac66916240..4e79c57263ff 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -1442,3 +1442,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 #ifdef CONFIG_FIREWIRE_KUNIT_DEVICE_ATTRIBUTE_TEST
 #include "device-attribute-test.c"
 #endif
+
+#ifdef CONFIG_FIREWIRE_KUNIT_CONFIG_ROM_PARSER_AND_GENERATOR_TEST
+#include "config-rom-parser-test.c"
+#endif
-- 
2.53.0

[PATCH 02/13] firewire: core: add test to detect irm-is-1394-1995-only quirk in config ROM parser

[Takashi Sakamoto]

Some Sony DV cameras have a quirk where their IRM functionality does not
comply with IEEE 1394a:2000. This quirk was supported by commit
10389536742c ("firewire: core: check for 1394a compliant IRM, fix
inaccessibility of Sony camcorder") and refactored by commit 5a43dc9f4ee0
("firewire: core: detect device quirk when reading configuration ROM").

Add a KUnit test to check detection of the quirk. The configuration ROM
content is retrieved from the following discussion:
https://github.com/systemd/systemd/issues/25029.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-parser-test.c | 151 ++++++++++++++++++++++
 drivers/firewire/core-transaction.c       |   4 +
 2 files changed, 155 insertions(+)

diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
index 632f24e68692..131c7aa3b224 100644
--- a/drivers/firewire/config-rom-parser-test.c
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -7,13 +7,164 @@
 // This file can not be built independently since it is intentionally included in core-device.c.
 
 #include <kunit/test.h>
+#include <kunit/static_stub.h>
+#include <kunit/device.h>
+
+static const u32 sony_dcr_trv310k_config_rom[] = {
+	0x0404e552,
+	0x31333934,
+	0xe0648100,
+	0x00008500,
+	0x005eb597,
+	0x0007cdd0,
+	0x03000085,
+	0x8100000d,
+	0x17000002,
+	0x81000010,
+	0x0c0083c0,
+	0xd8000002,
+	0xd1000003,
+	0x0001ce96,
+	0xd1000001,
+	0x0004bbee,
+	0x1200a02d,
+	0x13010001,
+	0x17000002,
+	0x81000006,
+	0x00046dc8,
+	0x00000000,
+	0x00000000,
+	0x43616e6f,
+	0x6e000000,
+	0x000621ee,
+	0x00000000,
+	0x00000000,
+	0x4d563569,
+	0x204d4300,
+	0x00000000,
+	0x00000000,
+};
+
+static const struct parser_test_case {
+	const char *name;
+	const u32 *quadlets;
+	size_t quadlet_length;
+	int phy_speed_in_self_id;
+	int expected_speed;
+	int expected_quirk;
+	unsigned int expected_max_rec;
+	bool expected_cmc;
+	bool expected_irmc;
+} parser_test_cases[] = {
+	{
+		.name = "detect_irm_is_1394_1995_only_quirk",
+		.quadlets = sony_dcr_trv310k_config_rom,
+		.quadlet_length = ARRAY_SIZE(sony_dcr_trv310k_config_rom),
+		.phy_speed_in_self_id = SCODE_100,
+		.expected_speed = SCODE_100,
+		.expected_quirk = FW_DEVICE_QUIRK_IRM_IS_1394_1995_ONLY,
+		.expected_max_rec = 8,
+		.expected_cmc = true,
+		.expected_irmc = true,
+	},
+};
+
+// Define parser_test_gen_params.
+KUNIT_ARRAY_PARAM_DESC(parser_test, parser_test_cases, name);
+
+static int stub_run_regular_transaction(struct fw_card *card, int tcode, int destination_id,
+					int generation, int speed, unsigned long long offset,
+					void *payload, size_t length)
+{
+	struct kunit *test = kunit_get_current_test();
+	const struct parser_test_case *param = test->param_value;
+
+	KUNIT_ASSERT_GE(test, offset, CSR_REGISTER_BASE | CSR_CONFIG_ROM);
+	KUNIT_ASSERT_LT(test, offset, CSR_REGISTER_BASE | CSR_CONFIG_ROM_END);
+	KUNIT_ASSERT_NOT_NULL(test, payload);
+	KUNIT_ASSERT_EQ(test, length, 4);
+
+	unsigned int index = (offset - (CSR_REGISTER_BASE | CSR_CONFIG_ROM)) / sizeof(u32);
+	u32 *quadlet = payload;
+
+	KUNIT_EXPECT_LE(test, speed, param->expected_speed);
+	KUNIT_EXPECT_LT(test, index, param->quadlet_length);
+
+	*quadlet = cpu_to_be32(param->quadlets[index]);
+
+	return RCODE_COMPLETE;
+}
+
+static void test_parser_with_regular_cases(struct kunit *test)
+{
+	struct fw_device *device = test->priv;
+	const struct parser_test_case *param = test->param_value;
+
+	kunit_activate_static_stub(test, fw_run_transaction, stub_run_regular_transaction);
+
+	device->card->link_speed = SCODE_BETA;
+	device->node->max_speed = param->phy_speed_in_self_id;
+
+	KUNIT_EXPECT_EQ(test, read_config_rom(device, 0), RCODE_COMPLETE);
+
+	KUNIT_EXPECT_EQ(test, device->config_rom_length, param->quadlet_length);
+	KUNIT_EXPECT_MEMEQ(test, device->config_rom, param->quadlets, param->quadlet_length);
+
+	KUNIT_EXPECT_TRUE(test, device->quirks & param->expected_quirk);
+	KUNIT_EXPECT_EQ(test, device->max_speed, param->expected_speed);
+	KUNIT_EXPECT_EQ(test, (unsigned int)device->max_rec, param->expected_max_rec);
+	KUNIT_EXPECT_EQ(test, (bool)device->cmc, param->expected_cmc);
+	KUNIT_EXPECT_EQ(test, (bool)device->irmc, param->expected_irmc);
+
+	kunit_deactivate_static_stub(test, fw_run_transaction);
+}
+
+static const struct fw_card_driver dummy_card_driver;
+
+static int config_rom_parser_test_init(struct kunit *test)
+{
+	struct fw_device *device;
+	struct device *dev;
+
+	device = kunit_kzalloc(test, sizeof(*device), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, device);
+
+	device->node = kunit_kzalloc(test, sizeof(*device->node), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, device->node);
+	kref_init(&device->node->kref);
+
+	device->card = kunit_kzalloc(test, sizeof(*device->card), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, device->card);
+
+	dev = kunit_device_register(test, "dummy-device");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+
+	fw_card_initialize(device->card, &dummy_card_driver, dev);
+
+	test->priv = device;
+
+	return 0;
+}
+
+static void config_rom_parser_test_exit(struct kunit *test)
+{
+	struct fw_device *device = test->priv;
+
+	kunit_device_unregister(test, device->card->device);
+	kunit_kfree(test, device->card);
+	kunit_kfree(test, device->node);
+	kunit_kfree(test, device);
+}
 
 static struct kunit_case config_rom_parser_test_cases[] = {
+	KUNIT_CASE_PARAM(test_parser_with_regular_cases, parser_test_gen_params),
 	{}
 };
 
 static struct kunit_suite config_rom_parser_test_suite = {
 	.name = "firewire-config-rom-parser",
+	.init = config_rom_parser_test_init,
+	.exit = config_rom_parser_test_exit,
 	.test_cases = config_rom_parser_test_cases,
 };
 kunit_test_suite(config_rom_parser_test_suite);
diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index 22ae387ae03c..995c2001bee0 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -24,6 +24,7 @@
 #include <linux/timer.h>
 #include <linux/types.h>
 #include <linux/workqueue.h>
+#include <kunit/static_stub.h>
 
 #include <asm/byteorder.h>
 
@@ -481,6 +482,9 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
 		       int generation, int speed, unsigned long long offset,
 		       void *payload, size_t length)
 {
+	KUNIT_STATIC_STUB_REDIRECT(fw_run_transaction, card, tcode, destination_id, generation,
+				   speed, offset, payload, length);
+
 	struct transaction_callback_data d;
 	struct fw_transaction t;
 
-- 
2.53.0

[PATCH 03/13] firewire: core: add test to detect irm-ignores-bus-manager quirk in config ROM parser

[Takashi Sakamoto]

Some Canon DV cameras have a quirk where they malfunction as non-root
nodes by ignoring the bus manager. This quirk was supported by commit
6044565af458e ("firewire: core: fix unstable I/O with Canon camcorder")
and refactored by commit 5a43dc9f4ee0 ("firewire: core: detect device
quirk when reading configuration ROM").

Add a KUnit test to verify that the configuration ROM parser detects the
quirk correctly. The configuration ROM content is retrieved from the
following discussion:
https://bugzilla.redhat.com/show_bug.cgi?id=633260

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-parser-test.c | 46 +++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
index 131c7aa3b224..11c01ef9efd9 100644
--- a/drivers/firewire/config-rom-parser-test.c
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -45,6 +45,41 @@ static const u32 sony_dcr_trv310k_config_rom[] = {
 	0x00000000,
 };
 
+static const u32 canon_mv5i_mc_config_rom[] = {
+	0x0404e552,
+	0x31333934,
+	0xe0648100,
+	0x00008500,
+	0x005eb597,
+	0x0007cdd0,
+	0x03000085,
+	0x8100000d,
+	0x17000002,
+	0x81000010,
+	0x0c0083c0,
+	0xd8000002,
+	0xd1000003,
+	0x0001ce96,
+	0xd1000001,
+	0x0004bbee,
+	0x1200a02d,
+	0x13010001,
+	0x17000002,
+	0x81000006,
+	0x00046dc8,
+	0x00000000,
+	0x00000000,
+	0x43616e6f,
+	0x6e000000,
+	0x000621ee,
+	0x00000000,
+	0x00000000,
+	0x4d563569,
+	0x204d4300,
+	0x00000000,
+	0x00000000,
+};
+
 static const struct parser_test_case {
 	const char *name;
 	const u32 *quadlets;
@@ -67,6 +102,17 @@ static const struct parser_test_case {
 		.expected_cmc = true,
 		.expected_irmc = true,
 	},
+	{
+		.name = "detect_irm_ignores_bus_manager_quirk",
+		.quadlets = canon_mv5i_mc_config_rom,
+		.quadlet_length = ARRAY_SIZE(canon_mv5i_mc_config_rom),
+		.phy_speed_in_self_id = SCODE_100,
+		.expected_speed = SCODE_100,
+		.expected_quirk = FW_DEVICE_QUIRK_IRM_IGNORES_BUS_MANAGER,
+		.expected_max_rec = 8,
+		.expected_cmc = true,
+		.expected_irmc = true,
+	},
 };
 
 // Define parser_test_gen_params.
-- 
2.53.0

[PATCH 04/13] firewire: core: add test to detect ack-packet-with-invalid-pending-code quirk in config ROM parser

[Takashi Sakamoto]

MOTU Audio Express has a quirk where it transfers an invalid pending
code when receiving an asynchronous request. This quirk was originally
reported by commit 3a93d082bacf ("ALSA: firewire-motu: add support for
MOTU Audio Express") and later supported by commit 15f9610fc96a
("firewire: core: handle device quirk of MOTU Audio Express").

Add a KUnit test to verify that the configuration ROM parser detects the
quirk correctly. The configuration ROM content is retrieved from the
commit mentioned above.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-parser-test.c | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
index 11c01ef9efd9..35ebe8a6b611 100644
--- a/drivers/firewire/config-rom-parser-test.c
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -80,6 +80,26 @@ static const u32 canon_mv5i_mc_config_rom[] = {
 	0x00000000,
 };
 
+static const u32 motu_audioexpress_config_rom[] = {
+	0x0410a756,
+	0x31333934,
+	0x20ff7000,
+	0x0001f200,
+	0x000a8a7b,
+	0x0004ef04,
+	0x030001f2,
+	0x0c0083c0,
+	0xd1000002,
+	0x8d000005,
+	0x00031680,
+	0x120001f2,
+	0x13000033,
+	0x17104800,
+	0x00025ef3,
+	0x0001f200,
+	0x000a8a7b,
+};
+
 static const struct parser_test_case {
 	const char *name;
 	const u32 *quadlets;
@@ -113,6 +133,17 @@ static const struct parser_test_case {
 		.expected_cmc = true,
 		.expected_irmc = true,
 	},
+	{
+		.name = "detect_ack_packet_with_invalid_pending_code_quirk",
+		.quadlets = motu_audioexpress_config_rom,
+		.quadlet_length = ARRAY_SIZE(motu_audioexpress_config_rom),
+		.phy_speed_in_self_id = SCODE_400,
+		.expected_speed = SCODE_400,
+		.expected_quirk = FW_DEVICE_QUIRK_ACK_PACKET_WITH_INVALID_PENDING_CODE,
+		.expected_max_rec = 7,
+		.expected_cmc = false,
+		.expected_irmc = false,
+	},
 };
 
 // Define parser_test_gen_params.
-- 
2.53.0

[PATCH 05/13] firewire: core: add test to detect unstable-at-s400 quirk in config ROM parser

[Takashi Sakamoto]

TASCAM FireWire series devices have a quirk where they fail to respond to
asynchronous transactions at S400 speed. This quirk was supported by
commit d52bb3daad3f ("firewire: core: handle device quirk of TASCAM
FW-1884/FW-1804/FW-1082").

Add a KUnit test to verify that the configuration ROM parser detects the
quirk correctly. The configuration ROM content is retrieved from the
author's collection.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-parser-test.c | 44 +++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
index 35ebe8a6b611..d7c58c7fb995 100644
--- a/drivers/firewire/config-rom-parser-test.c
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -100,6 +100,39 @@ static const u32 motu_audioexpress_config_rom[] = {
 	0x000a8a7b,
 };
 
+static const u32 tascam_fw1884_config_rom[] = {
+	0x040f23c0,
+	0x31333934,
+	0x20ff7002,
+	0x00022eff,
+	0xfe800000,
+	0x0004bccc,
+	0x0300022e,
+	0x0c0083c0,
+	0x8d000006,
+	0xd1000001,
+	0x000347f5,
+	0x1200022e,
+	0x13800000,
+	0xd4000004,
+	0x000289aa,
+	0x00022eff,
+	0xfe800000,
+	0x0002ae47,
+	0x81000002,
+	0x82000006,
+	0x0004a79e,
+	0x00000000,
+	0x00000000,
+	0x54415343,
+	0x414d0000,
+	0x00045443,
+	0x00000000,
+	0x00000000,
+	0x46572d31,
+	0x38383400,
+};
+
 static const struct parser_test_case {
 	const char *name;
 	const u32 *quadlets;
@@ -144,6 +177,17 @@ static const struct parser_test_case {
 		.expected_cmc = false,
 		.expected_irmc = false,
 	},
+	{
+		.name = "detect_unstable_at_s400_quirk",
+		.quadlets = tascam_fw1884_config_rom,
+		.quadlet_length = ARRAY_SIZE(tascam_fw1884_config_rom),
+		.phy_speed_in_self_id = SCODE_400,
+		.expected_speed = SCODE_200,
+		.expected_quirk = FW_DEVICE_QUIRK_UNSTABLE_AT_S400,
+		.expected_max_rec = 7,
+		.expected_cmc = false,
+		.expected_irmc = false,
+	},
 };
 
 // Define parser_test_gen_params.
-- 
2.53.0

[PATCH 06/13] firewire: core: add test to avoid excessive configuration ROM length

[Takashi Sakamoto]

The configuration ROM parser needs to handle malformed ROM contents
safely. In particular, malformed directory and leaf offsets and block
lengths should not result in accesses beyond the available configuration
ROM data.

Add a KUnit test with malformed configuration ROM content to verify that
the parser sanitizes entries that would cause accesses beyond the
available configuration ROM data.

Reported-by: Aleksandr Shabelnikov <mistermidi@gmail.com>
Link: https://lore.kernel.org/lkml/20250901171547.47065-1-mistermidi@gmail.com/
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-parser-test.c | 68 ++++++++++++++++++++++-
 1 file changed, 66 insertions(+), 2 deletions(-)

diff --git a/drivers/firewire/config-rom-parser-test.c b/drivers/firewire/config-rom-parser-test.c
index d7c58c7fb995..e5c173353057 100644
--- a/drivers/firewire/config-rom-parser-test.c
+++ b/drivers/firewire/config-rom-parser-test.c
@@ -193,7 +193,7 @@ static const struct parser_test_case {
 // Define parser_test_gen_params.
 KUNIT_ARRAY_PARAM_DESC(parser_test, parser_test_cases, name);
 
-static int stub_run_regular_transaction(struct fw_card *card, int tcode, int destination_id,
+static int stub_run_transaction_regular(struct fw_card *card, int tcode, int destination_id,
 					int generation, int speed, unsigned long long offset,
 					void *payload, size_t length)
 {
@@ -221,7 +221,7 @@ static void test_parser_with_regular_cases(struct kunit *test)
 	struct fw_device *device = test->priv;
 	const struct parser_test_case *param = test->param_value;
 
-	kunit_activate_static_stub(test, fw_run_transaction, stub_run_regular_transaction);
+	kunit_activate_static_stub(test, fw_run_transaction, stub_run_transaction_regular);
 
 	device->card->link_speed = SCODE_BETA;
 	device->node->max_speed = param->phy_speed_in_self_id;
@@ -240,6 +240,69 @@ static void test_parser_with_regular_cases(struct kunit *test)
 	kunit_deactivate_static_stub(test, fw_run_transaction);
 }
 
+static int stub_run_transaction_malformed(struct fw_card *card, int tcode, int destination_id,
+					  int generation, int speed, unsigned long long offset,
+					  void *payload, size_t length)
+{
+	static const u32 config_rom_first_part[] = {
+		0x04000000,
+		0x31333934,
+		0x00008002,
+		0x00000000,
+		0x00000000,
+		0x00030000,
+		(CSR_VENDOR << 24) | 0x00123456,	// Regular entry.
+		((CSR_LEAF | CSR_DESCRIPTOR) << 24) | 0x000000f9,	// Beyond the upper limit.
+		((CSR_DIRECTORY | CSR_UNIT) << 24) | 0x00000001,
+		0xffff0000,	// Over the upper limit.
+	};
+	struct kunit *test = kunit_get_current_test();
+
+	KUNIT_ASSERT_GE(test, offset, CSR_REGISTER_BASE | CSR_CONFIG_ROM);
+	KUNIT_ASSERT_LT(test, offset, CSR_REGISTER_BASE | CSR_CONFIG_ROM_END);
+	KUNIT_ASSERT_NOT_NULL(test, payload);
+	KUNIT_ASSERT_EQ(test, length, 4);
+
+	unsigned int index = (offset - (CSR_REGISTER_BASE | CSR_CONFIG_ROM)) / sizeof(u32);
+	u32 *quadlet = payload;
+
+	if (index < ARRAY_SIZE(config_rom_first_part))
+		*quadlet = cpu_to_be32(config_rom_first_part[index]);
+	else
+		*quadlet = 0;
+
+	return RCODE_COMPLETE;
+}
+
+static void test_parser_with_overflowed_case(struct kunit *test)
+{
+	static const u32 corrected_config_rom[] = {
+		0x04000000,
+		0x31333934,
+		0x00008002,
+		0x00000000,
+		0x00000000,
+		0x00030000,
+		0x03123456,
+		0x00000000,	// Sanitized.
+		0xd1000001,
+		0x00000000,	// Sanitized.
+	};
+	struct fw_device *device = test->priv;
+
+	kunit_activate_static_stub(test, fw_run_transaction, stub_run_transaction_malformed);
+
+	device->card->link_speed = SCODE_BETA;
+
+	KUNIT_EXPECT_EQ(test, read_config_rom(device, 0), RCODE_COMPLETE);
+
+	KUNIT_EXPECT_EQ(test, device->config_rom_length, ARRAY_SIZE(corrected_config_rom));
+	KUNIT_EXPECT_MEMEQ(test, device->config_rom, corrected_config_rom,
+			   sizeof(corrected_config_rom));
+
+	kunit_deactivate_static_stub(test, fw_run_transaction);
+}
+
 static const struct fw_card_driver dummy_card_driver;
 
 static int config_rom_parser_test_init(struct kunit *test)
@@ -279,6 +342,7 @@ static void config_rom_parser_test_exit(struct kunit *test)
 
 static struct kunit_case config_rom_parser_test_cases[] = {
 	KUNIT_CASE_PARAM(test_parser_with_regular_cases, parser_test_gen_params),
+	KUNIT_CASE(test_parser_with_overflowed_case),
 	{}
 };
 
-- 
2.53.0

[PATCH 07/13] firewire: core: add test for root directory generation in config ROM generator

[Takashi Sakamoto]

The core function allows both the unit drivers and the userspace
applications to extend the system configuration ROM. Without any
extensions, the generator produces a root directory accompanied by two
descriptor leaves.

Add a KUnit test to verify the configuration ROM generated in this case.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 100 +++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 9a901eef7b0a..02477300c1df 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -7,13 +7,113 @@
 // This file can not be built independently since it is intentionally included in core-card.c.
 
 #include <kunit/test.h>
+#include <kunit/device.h>
+
+static const u32 config_rom_bare[] = {
+	cpu_to_be32(0x0404921b), // bus info
+	cpu_to_be32(0x31333934), // |
+	cpu_to_be32(0xf000b223), // |
+	cpu_to_be32(0x01234567), // |
+	cpu_to_be32(0x89abcdef), // v
+	cpu_to_be32(0x00051b70), // root directory
+	cpu_to_be32(0x0c0083c0), // |
+	cpu_to_be32(0x03001f11), // |
+	cpu_to_be32(0x81000003), // |
+	cpu_to_be32(0x17023901), // |
+	cpu_to_be32(0x81000008), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0003ff1c), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4a756a75), // v Juju is a code name at the development time of this stack.
+};
+
+static const struct generator_test_case {
+	const char *const name;
+	int config_rom_generation;
+	const __be32 *const expected;
+	unsigned int quadlet_length;
+} generator_test_cases[] = {
+	{
+		.name = "bare",
+		.config_rom_generation = 0,
+		.expected = config_rom_bare,
+		.quadlet_length = ARRAY_SIZE(config_rom_bare),
+	},
+};
+
+// Define generator_test_gen_params.
+KUNIT_ARRAY_PARAM_DESC(generator_test, generator_test_cases, name);
+
+struct state_data {
+	struct fw_card card;
+	__be32 config_rom[(CSR_CONFIG_ROM_END - CSR_CONFIG_ROM) / sizeof(__be32)];
+};
+
+static void test_config_rom_generator(struct kunit *test)
+{
+	const struct generator_test_case *test_case = test->param_value;
+	struct state_data *state = test->priv;
+	struct fw_card *card = &state->card;
+	__be32 *config_rom = state->config_rom;
+
+	card->config_rom_generation = test_case->config_rom_generation;
+	card->link_speed = SCODE_800;
+	card->max_receive = 11;
+	card->guid = 0x0123456789abcdefULL;
+
+	scoped_guard(mutex, &card_mutex) {
+		generate_config_rom(card, config_rom);
+		KUNIT_EXPECT_EQ(test, config_rom_length, test_case->quadlet_length);
+	}
+
+	KUNIT_EXPECT_MEMEQ(test, config_rom, test_case->expected,
+			   sizeof(*test_case->expected) * test_case->quadlet_length);
+}
+
+static const struct fw_card_driver dummy_card_driver;
+
+static int config_rom_generator_test_init(struct kunit *test)
+{
+	struct state_data *state = kunit_kzalloc(test, sizeof(*state), GFP_KERNEL);
+
+	KUNIT_ASSERT_NOT_NULL(test, state);
+
+	struct device *dev = kunit_device_register(test, "dummy-device");
+
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+
+	fw_card_initialize(&state->card, &dummy_card_driver, dev);
+
+	test->priv = state;
+
+	return 0;
+}
+
+static void config_rom_generator_test_exit(struct kunit *test)
+{
+	struct state_data *state = test->priv;
+
+	kunit_device_unregister(test, state->card.device);
+	kunit_kfree(test, state);
+}
+
 
 static struct kunit_case config_rom_generator_test_cases[] = {
+	KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params),
 	{}
 };
 
 static struct kunit_suite config_rom_generator_test_suite = {
 	.name = "firewire-config-rom-generator",
+	.init = config_rom_generator_test_init,
+	.exit = config_rom_generator_test_exit,
 	.test_cases = config_rom_generator_test_cases,
 };
 kunit_test_suite(config_rom_generator_test_suite);
-- 
2.53.0

[PATCH 08/13] firewire: core: add test to generate with AV/C unit in config ROM generator

[Takashi Sakamoto]

There is a standard layout of configuration ROM for AV/C devices.

Add a KUnit test to verify that the generator produces the expected
configuration ROM when an AV/C unit is registered.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 71 ++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 02477300c1df..c695811a50bb 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -34,6 +34,59 @@ static const u32 config_rom_bare[] = {
 	cpu_to_be32(0x4a756a75), // v Juju is a code name at the development time of this stack.
 };
 
+// Following to Configuration ROM for AV/C Devices 1.0 (Dec. 2000. 1394 Trading Association,
+// Document 1999027).
+#define UNIT_SPEC_ID_1394TA		0x0000a02d
+#define UNIT_SW_VERSION_AVC		0x00010001
+#define UNIT_SW_VERSION_IIDC_0104	0x00000100
+
+static const u32 avc_unit_directory_and_leaf[] = {
+	0x00040000,		// Unit directory consists of below 4 quads.
+	(CSR_SPECIFIER_ID << 24) | UNIT_SPEC_ID_1394TA,
+	(CSR_VERSION << 24) | UNIT_SW_VERSION_AVC,
+	(CSR_MODEL << 24) | 0x00260827,	// Today.
+	((CSR_LEAF | CSR_DESCRIPTOR) << 24) | 0x00000001, // Point to next quadlet.
+	0x00030000,	// Text leaf consists of below 3 quads.
+	0x00000000,
+	0x00000000,
+	0x50756900,	// Pui is the name of a cat that the author takes care of.
+};
+
+static const u32 config_rom_with_avc_unit[] = {
+	cpu_to_be32(0x0404c1e5), // bus info
+	cpu_to_be32(0x31333934), // |
+	cpu_to_be32(0xf000b233), // |
+	cpu_to_be32(0x01234567), // |
+	cpu_to_be32(0x89abcdef), // v
+	cpu_to_be32(0x0006a2d2), // root directory
+	cpu_to_be32(0x0c0083c0), // |
+	cpu_to_be32(0x03001f11), // |
+	cpu_to_be32(0x81000004), // |
+	cpu_to_be32(0x17023901), // |
+	cpu_to_be32(0x81000009), // |
+	cpu_to_be32(0xd100000c), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0003ff1c), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4a756a75), // v
+	cpu_to_be32(0x0004227b), // unit directory (from root)
+	cpu_to_be32(0x1200a02d), // |
+	cpu_to_be32(0x13010001), // |
+	cpu_to_be32(0x17260827), // |
+	cpu_to_be32(0x81000001), // v
+	cpu_to_be32(0x0003f771), // text descriptor leaf (from unit)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x50756900), // v
+};
+
 static const struct generator_test_case {
 	const char *const name;
 	int config_rom_generation;
@@ -46,6 +99,12 @@ static const struct generator_test_case {
 		.expected = config_rom_bare,
 		.quadlet_length = ARRAY_SIZE(config_rom_bare),
 	},
+	{
+		.name = "with_avc_unit",
+		.config_rom_generation = 1,
+		.expected = config_rom_with_avc_unit,
+		.quadlet_length = ARRAY_SIZE(config_rom_with_avc_unit),
+	},
 };
 
 // Define generator_test_gen_params.
@@ -58,6 +117,12 @@ struct state_data {
 
 static void test_config_rom_generator(struct kunit *test)
 {
+	// Use kernel stack since they should be mutable for doubly linked-list.
+	struct fw_descriptor avc_unit_entry = {
+		.length = ARRAY_SIZE(avc_unit_directory_and_leaf),
+		.key = (CSR_DIRECTORY | CSR_UNIT) << 24,
+		.data = avc_unit_directory_and_leaf,
+	};
 	const struct generator_test_case *test_case = test->param_value;
 	struct state_data *state = test->priv;
 	struct fw_card *card = &state->card;
@@ -68,6 +133,9 @@ static void test_config_rom_generator(struct kunit *test)
 	card->max_receive = 11;
 	card->guid = 0x0123456789abcdefULL;
 
+	if (test_case->expected == config_rom_with_avc_unit)
+		KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&avc_unit_entry), 0);
+
 	scoped_guard(mutex, &card_mutex) {
 		generate_config_rom(card, config_rom);
 		KUNIT_EXPECT_EQ(test, config_rom_length, test_case->quadlet_length);
@@ -75,6 +143,9 @@ static void test_config_rom_generator(struct kunit *test)
 
 	KUNIT_EXPECT_MEMEQ(test, config_rom, test_case->expected,
 			   sizeof(*test_case->expected) * test_case->quadlet_length);
+
+	if (test_case->expected == config_rom_with_avc_unit)
+		fw_core_remove_descriptor(&avc_unit_entry);
 }
 
 static const struct fw_card_driver dummy_card_driver;
-- 
2.53.0

[PATCH 09/13] firewire: core: add test to generate with IIDC unit in config ROM generator

[Takashi Sakamoto]

There is a standard layout of configuration ROM for IIDC devices.

Add a KUnit test to verify that the generator produces the expected
configuration ROM when an IIDC unit is registered.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 92 ++++++++++++++++++++
 1 file changed, 92 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index c695811a50bb..6ca5c16b4f0f 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -87,6 +87,81 @@ static const u32 config_rom_with_avc_unit[] = {
 	cpu_to_be32(0x50756900), // v
 };
 
+// Following to 1394-based Digital Camera Specification Version 1.04 (Aug. 1996. 1394 Trading
+// Association)
+#define IIDC_COMMAND_REGS_BASE	0x00
+#define IIDC_VENDOR_NAME_LEAF	0x01
+#define IIDC_MODEL_NAME_LEAF	0x02
+
+static const u32 iidc_unit_directories_and_leafs[] = {
+	0x00030000,
+	(CSR_SPECIFIER_ID << 24) | UNIT_SPEC_ID_1394TA,
+	(CSR_VERSION << 24) | UNIT_SW_VERSION_IIDC_0104,
+	((CSR_DIRECTORY | CSR_DEPENDENT_INFO) << 24) | 0x00000001,
+	0x00030000,
+	((CSR_OFFSET | IIDC_COMMAND_REGS_BASE) << 24) | 0x00012345,
+	((CSR_LEAF | IIDC_VENDOR_NAME_LEAF) << 24) | 0x00000002,
+	((CSR_LEAF | IIDC_MODEL_NAME_LEAF) << 24) | 0x00000008,
+	0x00060000,	// Text leaf consists of below 6 quads.
+	0x00000000,
+	0x00000000,
+	0x4c696e75,	// Use the same name in root directory.
+	0x78204669,
+	0x72657769,
+	0x72650000,
+	0x00040000,	// Text leaf consists of below 4 quads.
+	0x00000000,
+	0x00000000,
+	0x43686566,	// Chef Cat is a nick name when inventing IEEE 1394 itself.
+	0x20436174,
+};
+
+static const u32 config_rom_with_iidc_unit[] = {
+	cpu_to_be32(0x04046a3e), // bus info
+	cpu_to_be32(0x31333934), // |
+	cpu_to_be32(0xf000b243), // |
+	cpu_to_be32(0x01234567), // |
+	cpu_to_be32(0x89abcdef), // v
+	cpu_to_be32(0x0006a2d2), // root directory
+	cpu_to_be32(0x0c0083c0), // |
+	cpu_to_be32(0x03001f11), // |
+	cpu_to_be32(0x81000004), // |
+	cpu_to_be32(0x17023901), // |
+	cpu_to_be32(0x81000009), // |
+	cpu_to_be32(0xd100000c), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0003ff1c), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4a756a75), // v
+	cpu_to_be32(0x0003d7fe), // unit directory (from root)
+	cpu_to_be32(0x1200a02d), // |
+	cpu_to_be32(0x13000100), // |
+	cpu_to_be32(0xd4000001), // v
+	cpu_to_be32(0x0003ea57), // dependent directory (from unit directory)
+	cpu_to_be32(0x40012345), // |
+	cpu_to_be32(0x81000002), // |
+	cpu_to_be32(0x82000008), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from dependent directory)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0004a3e9), // text descriptor leaf (from dependent directory)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x43686566), // |
+	cpu_to_be32(0x20436174), // v
+};
+
 static const struct generator_test_case {
 	const char *const name;
 	int config_rom_generation;
@@ -105,6 +180,12 @@ static const struct generator_test_case {
 		.expected = config_rom_with_avc_unit,
 		.quadlet_length = ARRAY_SIZE(config_rom_with_avc_unit),
 	},
+	{
+		.name = "with_iidc_unit",
+		.config_rom_generation = 2,
+		.expected = config_rom_with_iidc_unit,
+		.quadlet_length = ARRAY_SIZE(config_rom_with_iidc_unit),
+	},
 };
 
 // Define generator_test_gen_params.
@@ -123,6 +204,11 @@ static void test_config_rom_generator(struct kunit *test)
 		.key = (CSR_DIRECTORY | CSR_UNIT) << 24,
 		.data = avc_unit_directory_and_leaf,
 	};
+	struct fw_descriptor iidc_unit_entry = {
+		.length = ARRAY_SIZE(iidc_unit_directories_and_leafs),
+		.key = (CSR_DIRECTORY | CSR_UNIT) << 24,
+		.data = iidc_unit_directories_and_leafs,
+	};
 	const struct generator_test_case *test_case = test->param_value;
 	struct state_data *state = test->priv;
 	struct fw_card *card = &state->card;
@@ -136,6 +222,9 @@ static void test_config_rom_generator(struct kunit *test)
 	if (test_case->expected == config_rom_with_avc_unit)
 		KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&avc_unit_entry), 0);
 
+	if (test_case->expected == config_rom_with_iidc_unit)
+		KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&iidc_unit_entry), 0);
+
 	scoped_guard(mutex, &card_mutex) {
 		generate_config_rom(card, config_rom);
 		KUNIT_EXPECT_EQ(test, config_rom_length, test_case->quadlet_length);
@@ -144,6 +233,9 @@ static void test_config_rom_generator(struct kunit *test)
 	KUNIT_EXPECT_MEMEQ(test, config_rom, test_case->expected,
 			   sizeof(*test_case->expected) * test_case->quadlet_length);
 
+	if (test_case->expected == config_rom_with_iidc_unit)
+		fw_core_remove_descriptor(&iidc_unit_entry);
+
 	if (test_case->expected == config_rom_with_avc_unit)
 		fw_core_remove_descriptor(&avc_unit_entry);
 }
-- 
2.53.0

[PATCH 10/13] firewire: core: add test to generate with both AV/C and IIDC units in config ROM generator

[Takashi Sakamoto]

Add a KUnit test to verify that the generator produces the expected
configuration ROM when both AV/C and IIDC units are registered.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 74 ++++++++++++++++++--
 1 file changed, 70 insertions(+), 4 deletions(-)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 6ca5c16b4f0f..7d76580c2004 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -162,6 +162,62 @@ static const u32 config_rom_with_iidc_unit[] = {
 	cpu_to_be32(0x20436174), // v
 };
 
+static const u32 config_rom_with_avc_and_iidc_units[] = {
+	cpu_to_be32(0x040439c0), // bus info
+	cpu_to_be32(0x31333934), // |
+	cpu_to_be32(0xf000b253), // |
+	cpu_to_be32(0x01234567), // |
+	cpu_to_be32(0x89abcdef), // v
+	cpu_to_be32(0x0007073e), // root directory
+	cpu_to_be32(0x0c0083c0), // |
+	cpu_to_be32(0x03001f11), // |
+	cpu_to_be32(0x81000005), // |
+	cpu_to_be32(0x17023901), // |
+	cpu_to_be32(0x8100000a), // |
+	cpu_to_be32(0xd100000d), // |
+	cpu_to_be32(0xd1000015), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0003ff1c), // text descriptor leaf (from root)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4a756a75), // v
+	cpu_to_be32(0x0004227b), // unit directory (from root)
+	cpu_to_be32(0x1200a02d), // |
+	cpu_to_be32(0x13010001), // |
+	cpu_to_be32(0x17260827), // |
+	cpu_to_be32(0x81000001), // v
+	cpu_to_be32(0x0003f771), // text descriptor leaf (from unit)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x50756900), // v
+	cpu_to_be32(0x0003d7fe), // unit directory (from root)
+	cpu_to_be32(0x1200a02d), // |
+	cpu_to_be32(0x13000100), // |
+	cpu_to_be32(0xd4000001), // v
+	cpu_to_be32(0x0003ea57), // dependent directory (from unit directory)
+	cpu_to_be32(0x40012345), // |
+	cpu_to_be32(0x81000002), // |
+	cpu_to_be32(0x82000008), // v
+	cpu_to_be32(0x00064cb7), // text descriptor leaf (from dependent directory)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x4c696e75), // |
+	cpu_to_be32(0x78204669), // |
+	cpu_to_be32(0x72657769), // |
+	cpu_to_be32(0x72650000), // v
+	cpu_to_be32(0x0004a3e9), // text descriptor leaf (from dependent directory)
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x00000000), // |
+	cpu_to_be32(0x43686566), // |
+	cpu_to_be32(0x20436174), // v
+};
+
 static const struct generator_test_case {
 	const char *const name;
 	int config_rom_generation;
@@ -186,6 +242,12 @@ static const struct generator_test_case {
 		.expected = config_rom_with_iidc_unit,
 		.quadlet_length = ARRAY_SIZE(config_rom_with_iidc_unit),
 	},
+	{
+		.name = "with_avc_and_iidc_unit",
+		.config_rom_generation = 3,
+		.expected = config_rom_with_avc_and_iidc_units,
+		.quadlet_length = ARRAY_SIZE(config_rom_with_avc_and_iidc_units),
+	},
 };
 
 // Define generator_test_gen_params.
@@ -219,10 +281,12 @@ static void test_config_rom_generator(struct kunit *test)
 	card->max_receive = 11;
 	card->guid = 0x0123456789abcdefULL;
 
-	if (test_case->expected == config_rom_with_avc_unit)
+	if (test_case->expected == config_rom_with_avc_unit ||
+	    test_case->expected == config_rom_with_avc_and_iidc_units)
 		KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&avc_unit_entry), 0);
 
-	if (test_case->expected == config_rom_with_iidc_unit)
+	if (test_case->expected == config_rom_with_iidc_unit ||
+	    test_case->expected == config_rom_with_avc_and_iidc_units)
 		KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&iidc_unit_entry), 0);
 
 	scoped_guard(mutex, &card_mutex) {
@@ -233,10 +297,12 @@ static void test_config_rom_generator(struct kunit *test)
 	KUNIT_EXPECT_MEMEQ(test, config_rom, test_case->expected,
 			   sizeof(*test_case->expected) * test_case->quadlet_length);
 
-	if (test_case->expected == config_rom_with_iidc_unit)
+	if (test_case->expected == config_rom_with_iidc_unit ||
+	    test_case->expected == config_rom_with_avc_and_iidc_units)
 		fw_core_remove_descriptor(&iidc_unit_entry);
 
-	if (test_case->expected == config_rom_with_avc_unit)
+	if (test_case->expected == config_rom_with_avc_unit ||
+	    test_case->expected == config_rom_with_avc_and_iidc_units)
 		fw_core_remove_descriptor(&avc_unit_entry);
 }
 
-- 
2.53.0

[PATCH 11/13] firewire: core: add test for invalid length in config ROM generator

[Takashi Sakamoto]

Although the unit drivers and the userspace applications are allowed to
extend the system configuration ROM, they could provide invalid extension
data.

Add a KUnit test to verify that the generator handles an extension with
an invalid length.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 7d76580c2004..260b3d6e9a27 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -306,6 +306,16 @@ static void test_config_rom_generator(struct kunit *test)
 		fw_core_remove_descriptor(&avc_unit_entry);
 }
 
+static void add_descriptor_with_invalid_length(struct kunit *test)
+{
+	// Use kernel stack since they should be mutable for doubly linked-list.
+	struct fw_descriptor entry_with_invalid_length = {
+		.length = 257,
+	};
+
+	KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_length), -EINVAL);
+}
+
 static const struct fw_card_driver dummy_card_driver;
 
 static int config_rom_generator_test_init(struct kunit *test)
@@ -336,6 +346,7 @@ static void config_rom_generator_test_exit(struct kunit *test)
 
 static struct kunit_case config_rom_generator_test_cases[] = {
 	KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params),
+	KUNIT_CASE(add_descriptor_with_invalid_length),
 	{}
 };
 
-- 
2.53.0

[PATCH 12/13] firewire: core: add invalid block test for config ROM generator

[Takashi Sakamoto]

Although the unit drivers and the userspace applications are allowed to
extend the system configuration ROM, they could provide invalid extension
data.

Add a KUnit test to verify that the generator handles an invalid block.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 27 ++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 260b3d6e9a27..3114110307b5 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -316,6 +316,32 @@ static void add_descriptor_with_invalid_length(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_length), -EINVAL);
 }
 
+static void add_descriptor_with_invalid_data(struct kunit *test)
+{
+	// Use vendor directory defined in Annex A of Configuration ROM for AV/C Devices 1.0 (Dec.
+	// 2000, 1394 Trading Association, TA Document 1999027).
+	static const u32 invalid_vendor_directory[] = {
+		0x00020000,
+		(CSR_MODEL << 24) | 0x00009402,
+		((CSR_LEAF | CSR_DESCRIPTOR) << 24) | 0x00000001,
+		0xffff0000,	// The length should be 6, invalid.
+		0x00000000,
+		0x00000000,
+		0x436f6e63,
+		0x6174204e,
+		0x6f746174,
+		0x696f6e00,
+	};
+	// Use kernel stack since they should be mutable for doubly linked-list.
+	struct fw_descriptor entry_with_invalid_data = {
+		.length = ARRAY_SIZE(invalid_vendor_directory),
+		.key = (CSR_DIRECTORY | CSR_VENDOR) << 24,
+		.data = invalid_vendor_directory,
+	};
+
+	KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_data), -EINVAL);
+}
+
 static const struct fw_card_driver dummy_card_driver;
 
 static int config_rom_generator_test_init(struct kunit *test)
@@ -347,6 +373,7 @@ static void config_rom_generator_test_exit(struct kunit *test)
 static struct kunit_case config_rom_generator_test_cases[] = {
 	KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params),
 	KUNIT_CASE(add_descriptor_with_invalid_length),
+	KUNIT_CASE(add_descriptor_with_invalid_data),
 	{}
 };
 
-- 
2.53.0

[PATCH 13/13] firewire: core: add test for beyond-boundary case in config ROM generator

[Takashi Sakamoto]

Although unit drivers and userspace applications are allowed to extend
the system configuration ROM, they could provide invalid extension data.

Add a KUnit test to verify that the generator does not write beyond the
boundary of the configuration ROM when handling an extension.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/config-rom-generator-test.c | 21 ++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/firewire/config-rom-generator-test.c b/drivers/firewire/config-rom-generator-test.c
index 3114110307b5..212dbdcd43ba 100644
--- a/drivers/firewire/config-rom-generator-test.c
+++ b/drivers/firewire/config-rom-generator-test.c
@@ -342,6 +342,26 @@ static void add_descriptor_with_invalid_data(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_with_invalid_data), -EINVAL);
 }
 
+static void add_descriptor_beyond_upper_limit(struct kunit *test)
+{
+	// Use kernel stack since they should be mutable for doubly linked-list.
+	struct fw_descriptor entry_beyond_upper_limit = {
+		.length = 255,
+		.key = (CSR_DIRECTORY | CSR_UNIT) << 24,
+		.data = NULL,
+	};
+	u32 *data;
+
+	data = kunit_kzalloc(test, entry_beyond_upper_limit.length, GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, data);
+
+	data[0] = (entry_beyond_upper_limit.length - 1) << 16;
+	entry_beyond_upper_limit.data = data;
+	KUNIT_EXPECT_EQ(test, fw_core_add_descriptor(&entry_beyond_upper_limit), -EBUSY);
+
+	kunit_kfree(test, data);
+}
+
 static const struct fw_card_driver dummy_card_driver;
 
 static int config_rom_generator_test_init(struct kunit *test)
@@ -374,6 +394,7 @@ static struct kunit_case config_rom_generator_test_cases[] = {
 	KUNIT_CASE_PARAM(test_config_rom_generator, generator_test_gen_params),
 	KUNIT_CASE(add_descriptor_with_invalid_length),
 	KUNIT_CASE(add_descriptor_with_invalid_data),
+	KUNIT_CASE(add_descriptor_beyond_upper_limit),
 	{}
 };
 
-- 
2.53.0

Re: [PATCH 00/13] firewire: core: add KUnit tests for config ROM parser and generator

[Takashi Sakamoto]

Hi,

On Tue, Sep 01, 2026 at 10:45:21PM +0900, Takashi Sakamoto wrote:
> Hi,
> 
> (Resent because the previous email was sent to the wrong address...)
> 
> This series adds KUnit tests for the configuration ROM parser and
> generator in the core function.
> 
> The parser tests cover existing device quirks and malformed configuration
> ROMs, including out-of-bounds directory/leaf entries.
> 
> The generator tests cover AV/C and IIDC devices layouts, combinations of
> units, and invalid or oversized extension data.
> 
> The tests are intended to document existing behavior and provide regression
> coverage for the parser and generator.
> 
> The test execution samples:
> 
> ```
> $ python3 tools/testing/kunit/kunit.py run \
>   --kunitconfig=drivers/firewire/ \
>   'firewire-config-rom-*'
> [22:12:56] Configuring KUnit Kernel ...
> [22:12:56] Building KUnit Kernel ...
> Populating config with:
> $ make ARCH=um O=.kunit olddefconfig
> Building with:
> $ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=16
> [22:12:59] Starting KUnit Kernel (1/1)...
> [22:12:59] ============================================================
> Running tests with:
> $ .kunit/linux 'kunit.filter_glob=firewire-config-rom-*' kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
> [22:12:59] ======== firewire-config-rom-generator (4 subtests) ========
> [22:12:59] ================ test_config_rom_generator  ================
> [22:12:59] [PASSED] bare
> [22:12:59] [PASSED] with_avc_unit
> [22:12:59] [PASSED] with_iidc_unit
> [22:12:59] [PASSED] with_avc_and_iidc_unit
> [22:12:59] ============ [PASSED] test_config_rom_generator ============
> [22:12:59] [PASSED] add_descriptor_with_invalid_length
> [22:12:59] [PASSED] add_descriptor_with_invalid_data
> [22:12:59] [PASSED] add_descriptor_beyond_upper_limit
> [22:12:59] ========== [PASSED] firewire-config-rom-generator ==========
> [22:12:59] ========= firewire-config-rom-parser (2 subtests) ==========
> [22:12:59] ============= test_parser_with_regular_cases  ==============
> [22:12:59] [PASSED] detect_irm_is_1394_1995_only_quirk
> [22:12:59] [PASSED] detect_irm_ignores_bus_manager_quirk
> [22:12:59] [PASSED] detect_ack_packet_with_invalid_pending_code_quirk
> [22:12:59] [PASSED] detect_unstable_at_s400_quirk
> [22:12:59] ========= [PASSED] test_parser_with_regular_cases ==========
> [22:12:59] [PASSED] test_parser_with_overflowed_case
> [22:12:59] =========== [PASSED] firewire-config-rom-parser ============
> [22:12:59] ============================================================
> [22:12:59] Testing complete. Ran 12 tests: passed: 12
> [22:12:59] Elapsed time: 2.743s total, 0.001s configuring, 2.625s building, 0.085s running
> ```
> 
> Regards
> 
> 
> Takashi Sakamoto (13):
>   firewire: core: add KUnit test skeleton for config ROM parser and
>     generator
>   firewire: core: add test to detect irm-is-1394-1995-only quirk in
>     config ROM parser
>   firewire: core: add test to detect irm-ignores-bus-manager quirk in
>     config ROM parser
>   firewire: core: add test to detect
>     ack-packet-with-invalid-pending-code quirk in config ROM parser
>   firewire: core: add test to detect unstable-at-s400 quirk in config
>     ROM parser
>   firewire: core: add test to avoid excessive configuration ROM length
>   firewire: core: add test for root directory generation in config ROM
>     generator
>   firewire: core: add test to generate with AV/C unit in config ROM
>     generator
>   firewire: core: add test to generate with IIDC unit in config ROM
>     generator
>   firewire: core: add test to generate with both AV/C and IIDC units in
>     config ROM generator
>   firewire: core: add test for invalid length in config ROM generator
>   firewire: core: add invalid block test for config ROM generator
>   firewire: core: add test for beyond-boundary case in config ROM
>     generator
> 
>  drivers/firewire/.kunitconfig                |   1 +
>  drivers/firewire/Kconfig                     |  16 +
>  drivers/firewire/config-rom-generator-test.c | 407 +++++++++++++++++++
>  drivers/firewire/config-rom-parser-test.c    | 355 ++++++++++++++++
>  drivers/firewire/core-card.c                 |   4 +
>  drivers/firewire/core-device.c               |   4 +
>  drivers/firewire/core-transaction.c          |   4 +
>  7 files changed, 791 insertions(+)
>  create mode 100644 drivers/firewire/config-rom-generator-test.c
>  create mode 100644 drivers/firewire/config-rom-parser-test.c

Applied to for-next branch.


Regards

Takashi Sakamoto