Loading...
1/*
2 * firmware_class.c - Multi purpose firmware loading support
3 *
4 * Copyright (c) 2003 Manuel Estrada Sainz
5 *
6 * Please see Documentation/firmware_class/ for more information.
7 *
8 */
9
10#include <linux/capability.h>
11#include <linux/device.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/timer.h>
15#include <linux/vmalloc.h>
16#include <linux/interrupt.h>
17#include <linux/bitops.h>
18#include <linux/mutex.h>
19#include <linux/workqueue.h>
20#include <linux/highmem.h>
21#include <linux/firmware.h>
22#include <linux/slab.h>
23#include <linux/sched.h>
24#include <linux/file.h>
25#include <linux/list.h>
26#include <linux/async.h>
27#include <linux/pm.h>
28#include <linux/suspend.h>
29#include <linux/syscore_ops.h>
30#include <linux/reboot.h>
31
32#include <generated/utsrelease.h>
33
34#include "base.h"
35
36MODULE_AUTHOR("Manuel Estrada Sainz");
37MODULE_DESCRIPTION("Multi purpose firmware loading support");
38MODULE_LICENSE("GPL");
39
40/* Builtin firmware support */
41
42#ifdef CONFIG_FW_LOADER
43
44extern struct builtin_fw __start_builtin_fw[];
45extern struct builtin_fw __end_builtin_fw[];
46
47static bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
48{
49 struct builtin_fw *b_fw;
50
51 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
52 if (strcmp(name, b_fw->name) == 0) {
53 fw->size = b_fw->size;
54 fw->data = b_fw->data;
55 return true;
56 }
57 }
58
59 return false;
60}
61
62static bool fw_is_builtin_firmware(const struct firmware *fw)
63{
64 struct builtin_fw *b_fw;
65
66 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
67 if (fw->data == b_fw->data)
68 return true;
69
70 return false;
71}
72
73#else /* Module case - no builtin firmware support */
74
75static inline bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
76{
77 return false;
78}
79
80static inline bool fw_is_builtin_firmware(const struct firmware *fw)
81{
82 return false;
83}
84#endif
85
86enum {
87 FW_STATUS_LOADING,
88 FW_STATUS_DONE,
89 FW_STATUS_ABORT,
90};
91
92static int loading_timeout = 60; /* In seconds */
93
94static inline long firmware_loading_timeout(void)
95{
96 return loading_timeout > 0 ? loading_timeout * HZ : MAX_SCHEDULE_TIMEOUT;
97}
98
99/* firmware behavior options */
100#define FW_OPT_UEVENT (1U << 0)
101#define FW_OPT_NOWAIT (1U << 1)
102#ifdef CONFIG_FW_LOADER_USER_HELPER
103#define FW_OPT_FALLBACK (1U << 2)
104#else
105#define FW_OPT_FALLBACK 0
106#endif
107
108struct firmware_cache {
109 /* firmware_buf instance will be added into the below list */
110 spinlock_t lock;
111 struct list_head head;
112 int state;
113
114#ifdef CONFIG_PM_SLEEP
115 /*
116 * Names of firmware images which have been cached successfully
117 * will be added into the below list so that device uncache
118 * helper can trace which firmware images have been cached
119 * before.
120 */
121 spinlock_t name_lock;
122 struct list_head fw_names;
123
124 struct delayed_work work;
125
126 struct notifier_block pm_notify;
127#endif
128};
129
130struct firmware_buf {
131 struct kref ref;
132 struct list_head list;
133 struct completion completion;
134 struct firmware_cache *fwc;
135 unsigned long status;
136 void *data;
137 size_t size;
138#ifdef CONFIG_FW_LOADER_USER_HELPER
139 bool is_paged_buf;
140 bool need_uevent;
141 struct page **pages;
142 int nr_pages;
143 int page_array_size;
144 struct list_head pending_list;
145#endif
146 char fw_id[];
147};
148
149struct fw_cache_entry {
150 struct list_head list;
151 char name[];
152};
153
154struct fw_name_devm {
155 unsigned long magic;
156 char name[];
157};
158
159#define to_fwbuf(d) container_of(d, struct firmware_buf, ref)
160
161#define FW_LOADER_NO_CACHE 0
162#define FW_LOADER_START_CACHE 1
163
164static int fw_cache_piggyback_on_request(const char *name);
165
166/* fw_lock could be moved to 'struct firmware_priv' but since it is just
167 * guarding for corner cases a global lock should be OK */
168static DEFINE_MUTEX(fw_lock);
169
170static struct firmware_cache fw_cache;
171
172static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
173 struct firmware_cache *fwc)
174{
175 struct firmware_buf *buf;
176
177 buf = kzalloc(sizeof(*buf) + strlen(fw_name) + 1 , GFP_ATOMIC);
178
179 if (!buf)
180 return buf;
181
182 kref_init(&buf->ref);
183 strcpy(buf->fw_id, fw_name);
184 buf->fwc = fwc;
185 init_completion(&buf->completion);
186#ifdef CONFIG_FW_LOADER_USER_HELPER
187 INIT_LIST_HEAD(&buf->pending_list);
188#endif
189
190 pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
191
192 return buf;
193}
194
195static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
196{
197 struct firmware_buf *tmp;
198 struct firmware_cache *fwc = &fw_cache;
199
200 list_for_each_entry(tmp, &fwc->head, list)
201 if (!strcmp(tmp->fw_id, fw_name))
202 return tmp;
203 return NULL;
204}
205
206static int fw_lookup_and_allocate_buf(const char *fw_name,
207 struct firmware_cache *fwc,
208 struct firmware_buf **buf)
209{
210 struct firmware_buf *tmp;
211
212 spin_lock(&fwc->lock);
213 tmp = __fw_lookup_buf(fw_name);
214 if (tmp) {
215 kref_get(&tmp->ref);
216 spin_unlock(&fwc->lock);
217 *buf = tmp;
218 return 1;
219 }
220 tmp = __allocate_fw_buf(fw_name, fwc);
221 if (tmp)
222 list_add(&tmp->list, &fwc->head);
223 spin_unlock(&fwc->lock);
224
225 *buf = tmp;
226
227 return tmp ? 0 : -ENOMEM;
228}
229
230static void __fw_free_buf(struct kref *ref)
231 __releases(&fwc->lock)
232{
233 struct firmware_buf *buf = to_fwbuf(ref);
234 struct firmware_cache *fwc = buf->fwc;
235
236 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
237 __func__, buf->fw_id, buf, buf->data,
238 (unsigned int)buf->size);
239
240 list_del(&buf->list);
241 spin_unlock(&fwc->lock);
242
243#ifdef CONFIG_FW_LOADER_USER_HELPER
244 if (buf->is_paged_buf) {
245 int i;
246 vunmap(buf->data);
247 for (i = 0; i < buf->nr_pages; i++)
248 __free_page(buf->pages[i]);
249 kfree(buf->pages);
250 } else
251#endif
252 vfree(buf->data);
253 kfree(buf);
254}
255
256static void fw_free_buf(struct firmware_buf *buf)
257{
258 struct firmware_cache *fwc = buf->fwc;
259 spin_lock(&fwc->lock);
260 if (!kref_put(&buf->ref, __fw_free_buf))
261 spin_unlock(&fwc->lock);
262}
263
264/* direct firmware loading support */
265static char fw_path_para[256];
266static const char * const fw_path[] = {
267 fw_path_para,
268 "/lib/firmware/updates/" UTS_RELEASE,
269 "/lib/firmware/updates",
270 "/lib/firmware/" UTS_RELEASE,
271 "/lib/firmware"
272};
273
274/*
275 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
276 * from kernel command line because firmware_class is generally built in
277 * kernel instead of module.
278 */
279module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644);
280MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path");
281
282/* Don't inline this: 'struct kstat' is biggish */
283static noinline_for_stack int fw_file_size(struct file *file)
284{
285 struct kstat st;
286 if (vfs_getattr(&file->f_path, &st))
287 return -1;
288 if (!S_ISREG(st.mode))
289 return -1;
290 if (st.size != (int)st.size)
291 return -1;
292 return st.size;
293}
294
295static int fw_read_file_contents(struct file *file, struct firmware_buf *fw_buf)
296{
297 int size;
298 char *buf;
299 int rc;
300
301 size = fw_file_size(file);
302 if (size <= 0)
303 return -EINVAL;
304 buf = vmalloc(size);
305 if (!buf)
306 return -ENOMEM;
307 rc = kernel_read(file, 0, buf, size);
308 if (rc != size) {
309 if (rc > 0)
310 rc = -EIO;
311 vfree(buf);
312 return rc;
313 }
314 fw_buf->data = buf;
315 fw_buf->size = size;
316 return 0;
317}
318
319static int fw_get_filesystem_firmware(struct device *device,
320 struct firmware_buf *buf)
321{
322 int i;
323 int rc = -ENOENT;
324 char *path = __getname();
325
326 for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
327 struct file *file;
328
329 /* skip the unset customized path */
330 if (!fw_path[i][0])
331 continue;
332
333 snprintf(path, PATH_MAX, "%s/%s", fw_path[i], buf->fw_id);
334
335 file = filp_open(path, O_RDONLY, 0);
336 if (IS_ERR(file))
337 continue;
338 rc = fw_read_file_contents(file, buf);
339 fput(file);
340 if (rc)
341 dev_warn(device, "firmware, attempted to load %s, but failed with error %d\n",
342 path, rc);
343 else
344 break;
345 }
346 __putname(path);
347
348 if (!rc) {
349 dev_dbg(device, "firmware: direct-loading firmware %s\n",
350 buf->fw_id);
351 mutex_lock(&fw_lock);
352 set_bit(FW_STATUS_DONE, &buf->status);
353 complete_all(&buf->completion);
354 mutex_unlock(&fw_lock);
355 }
356
357 return rc;
358}
359
360/* firmware holds the ownership of pages */
361static void firmware_free_data(const struct firmware *fw)
362{
363 /* Loaded directly? */
364 if (!fw->priv) {
365 vfree(fw->data);
366 return;
367 }
368 fw_free_buf(fw->priv);
369}
370
371/* store the pages buffer info firmware from buf */
372static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
373{
374 fw->priv = buf;
375#ifdef CONFIG_FW_LOADER_USER_HELPER
376 fw->pages = buf->pages;
377#endif
378 fw->size = buf->size;
379 fw->data = buf->data;
380
381 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
382 __func__, buf->fw_id, buf, buf->data,
383 (unsigned int)buf->size);
384}
385
386#ifdef CONFIG_PM_SLEEP
387static void fw_name_devm_release(struct device *dev, void *res)
388{
389 struct fw_name_devm *fwn = res;
390
391 if (fwn->magic == (unsigned long)&fw_cache)
392 pr_debug("%s: fw_name-%s devm-%p released\n",
393 __func__, fwn->name, res);
394}
395
396static int fw_devm_match(struct device *dev, void *res,
397 void *match_data)
398{
399 struct fw_name_devm *fwn = res;
400
401 return (fwn->magic == (unsigned long)&fw_cache) &&
402 !strcmp(fwn->name, match_data);
403}
404
405static struct fw_name_devm *fw_find_devm_name(struct device *dev,
406 const char *name)
407{
408 struct fw_name_devm *fwn;
409
410 fwn = devres_find(dev, fw_name_devm_release,
411 fw_devm_match, (void *)name);
412 return fwn;
413}
414
415/* add firmware name into devres list */
416static int fw_add_devm_name(struct device *dev, const char *name)
417{
418 struct fw_name_devm *fwn;
419
420 fwn = fw_find_devm_name(dev, name);
421 if (fwn)
422 return 1;
423
424 fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm) +
425 strlen(name) + 1, GFP_KERNEL);
426 if (!fwn)
427 return -ENOMEM;
428
429 fwn->magic = (unsigned long)&fw_cache;
430 strcpy(fwn->name, name);
431 devres_add(dev, fwn);
432
433 return 0;
434}
435#else
436static int fw_add_devm_name(struct device *dev, const char *name)
437{
438 return 0;
439}
440#endif
441
442
443/*
444 * user-mode helper code
445 */
446#ifdef CONFIG_FW_LOADER_USER_HELPER
447struct firmware_priv {
448 struct delayed_work timeout_work;
449 bool nowait;
450 struct device dev;
451 struct firmware_buf *buf;
452 struct firmware *fw;
453};
454
455static struct firmware_priv *to_firmware_priv(struct device *dev)
456{
457 return container_of(dev, struct firmware_priv, dev);
458}
459
460static void __fw_load_abort(struct firmware_buf *buf)
461{
462 /*
463 * There is a small window in which user can write to 'loading'
464 * between loading done and disappearance of 'loading'
465 */
466 if (test_bit(FW_STATUS_DONE, &buf->status))
467 return;
468
469 list_del_init(&buf->pending_list);
470 set_bit(FW_STATUS_ABORT, &buf->status);
471 complete_all(&buf->completion);
472}
473
474static void fw_load_abort(struct firmware_priv *fw_priv)
475{
476 struct firmware_buf *buf = fw_priv->buf;
477
478 __fw_load_abort(buf);
479
480 /* avoid user action after loading abort */
481 fw_priv->buf = NULL;
482}
483
484#define is_fw_load_aborted(buf) \
485 test_bit(FW_STATUS_ABORT, &(buf)->status)
486
487static LIST_HEAD(pending_fw_head);
488
489/* reboot notifier for avoid deadlock with usermode_lock */
490static int fw_shutdown_notify(struct notifier_block *unused1,
491 unsigned long unused2, void *unused3)
492{
493 mutex_lock(&fw_lock);
494 while (!list_empty(&pending_fw_head))
495 __fw_load_abort(list_first_entry(&pending_fw_head,
496 struct firmware_buf,
497 pending_list));
498 mutex_unlock(&fw_lock);
499 return NOTIFY_DONE;
500}
501
502static struct notifier_block fw_shutdown_nb = {
503 .notifier_call = fw_shutdown_notify,
504};
505
506static ssize_t timeout_show(struct class *class, struct class_attribute *attr,
507 char *buf)
508{
509 return sprintf(buf, "%d\n", loading_timeout);
510}
511
512/**
513 * firmware_timeout_store - set number of seconds to wait for firmware
514 * @class: device class pointer
515 * @attr: device attribute pointer
516 * @buf: buffer to scan for timeout value
517 * @count: number of bytes in @buf
518 *
519 * Sets the number of seconds to wait for the firmware. Once
520 * this expires an error will be returned to the driver and no
521 * firmware will be provided.
522 *
523 * Note: zero means 'wait forever'.
524 **/
525static ssize_t timeout_store(struct class *class, struct class_attribute *attr,
526 const char *buf, size_t count)
527{
528 loading_timeout = simple_strtol(buf, NULL, 10);
529 if (loading_timeout < 0)
530 loading_timeout = 0;
531
532 return count;
533}
534
535static struct class_attribute firmware_class_attrs[] = {
536 __ATTR_RW(timeout),
537 __ATTR_NULL
538};
539
540static void fw_dev_release(struct device *dev)
541{
542 struct firmware_priv *fw_priv = to_firmware_priv(dev);
543
544 kfree(fw_priv);
545}
546
547static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
548{
549 struct firmware_priv *fw_priv = to_firmware_priv(dev);
550
551 if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
552 return -ENOMEM;
553 if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
554 return -ENOMEM;
555 if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
556 return -ENOMEM;
557
558 return 0;
559}
560
561static struct class firmware_class = {
562 .name = "firmware",
563 .class_attrs = firmware_class_attrs,
564 .dev_uevent = firmware_uevent,
565 .dev_release = fw_dev_release,
566};
567
568static ssize_t firmware_loading_show(struct device *dev,
569 struct device_attribute *attr, char *buf)
570{
571 struct firmware_priv *fw_priv = to_firmware_priv(dev);
572 int loading = 0;
573
574 mutex_lock(&fw_lock);
575 if (fw_priv->buf)
576 loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
577 mutex_unlock(&fw_lock);
578
579 return sprintf(buf, "%d\n", loading);
580}
581
582/* Some architectures don't have PAGE_KERNEL_RO */
583#ifndef PAGE_KERNEL_RO
584#define PAGE_KERNEL_RO PAGE_KERNEL
585#endif
586
587/* one pages buffer should be mapped/unmapped only once */
588static int fw_map_pages_buf(struct firmware_buf *buf)
589{
590 if (!buf->is_paged_buf)
591 return 0;
592
593 if (buf->data)
594 vunmap(buf->data);
595 buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
596 if (!buf->data)
597 return -ENOMEM;
598 return 0;
599}
600
601/**
602 * firmware_loading_store - set value in the 'loading' control file
603 * @dev: device pointer
604 * @attr: device attribute pointer
605 * @buf: buffer to scan for loading control value
606 * @count: number of bytes in @buf
607 *
608 * The relevant values are:
609 *
610 * 1: Start a load, discarding any previous partial load.
611 * 0: Conclude the load and hand the data to the driver code.
612 * -1: Conclude the load with an error and discard any written data.
613 **/
614static ssize_t firmware_loading_store(struct device *dev,
615 struct device_attribute *attr,
616 const char *buf, size_t count)
617{
618 struct firmware_priv *fw_priv = to_firmware_priv(dev);
619 struct firmware_buf *fw_buf;
620 int loading = simple_strtol(buf, NULL, 10);
621 int i;
622
623 mutex_lock(&fw_lock);
624 fw_buf = fw_priv->buf;
625 if (!fw_buf)
626 goto out;
627
628 switch (loading) {
629 case 1:
630 /* discarding any previous partial load */
631 if (!test_bit(FW_STATUS_DONE, &fw_buf->status)) {
632 for (i = 0; i < fw_buf->nr_pages; i++)
633 __free_page(fw_buf->pages[i]);
634 kfree(fw_buf->pages);
635 fw_buf->pages = NULL;
636 fw_buf->page_array_size = 0;
637 fw_buf->nr_pages = 0;
638 set_bit(FW_STATUS_LOADING, &fw_buf->status);
639 }
640 break;
641 case 0:
642 if (test_bit(FW_STATUS_LOADING, &fw_buf->status)) {
643 set_bit(FW_STATUS_DONE, &fw_buf->status);
644 clear_bit(FW_STATUS_LOADING, &fw_buf->status);
645
646 /*
647 * Several loading requests may be pending on
648 * one same firmware buf, so let all requests
649 * see the mapped 'buf->data' once the loading
650 * is completed.
651 * */
652 if (fw_map_pages_buf(fw_buf))
653 dev_err(dev, "%s: map pages failed\n",
654 __func__);
655 list_del_init(&fw_buf->pending_list);
656 complete_all(&fw_buf->completion);
657 break;
658 }
659 /* fallthrough */
660 default:
661 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
662 /* fallthrough */
663 case -1:
664 fw_load_abort(fw_priv);
665 break;
666 }
667out:
668 mutex_unlock(&fw_lock);
669 return count;
670}
671
672static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
673
674static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
675 struct bin_attribute *bin_attr,
676 char *buffer, loff_t offset, size_t count)
677{
678 struct device *dev = kobj_to_dev(kobj);
679 struct firmware_priv *fw_priv = to_firmware_priv(dev);
680 struct firmware_buf *buf;
681 ssize_t ret_count;
682
683 mutex_lock(&fw_lock);
684 buf = fw_priv->buf;
685 if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
686 ret_count = -ENODEV;
687 goto out;
688 }
689 if (offset > buf->size) {
690 ret_count = 0;
691 goto out;
692 }
693 if (count > buf->size - offset)
694 count = buf->size - offset;
695
696 ret_count = count;
697
698 while (count) {
699 void *page_data;
700 int page_nr = offset >> PAGE_SHIFT;
701 int page_ofs = offset & (PAGE_SIZE-1);
702 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
703
704 page_data = kmap(buf->pages[page_nr]);
705
706 memcpy(buffer, page_data + page_ofs, page_cnt);
707
708 kunmap(buf->pages[page_nr]);
709 buffer += page_cnt;
710 offset += page_cnt;
711 count -= page_cnt;
712 }
713out:
714 mutex_unlock(&fw_lock);
715 return ret_count;
716}
717
718static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
719{
720 struct firmware_buf *buf = fw_priv->buf;
721 int pages_needed = ALIGN(min_size, PAGE_SIZE) >> PAGE_SHIFT;
722
723 /* If the array of pages is too small, grow it... */
724 if (buf->page_array_size < pages_needed) {
725 int new_array_size = max(pages_needed,
726 buf->page_array_size * 2);
727 struct page **new_pages;
728
729 new_pages = kmalloc(new_array_size * sizeof(void *),
730 GFP_KERNEL);
731 if (!new_pages) {
732 fw_load_abort(fw_priv);
733 return -ENOMEM;
734 }
735 memcpy(new_pages, buf->pages,
736 buf->page_array_size * sizeof(void *));
737 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
738 (new_array_size - buf->page_array_size));
739 kfree(buf->pages);
740 buf->pages = new_pages;
741 buf->page_array_size = new_array_size;
742 }
743
744 while (buf->nr_pages < pages_needed) {
745 buf->pages[buf->nr_pages] =
746 alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
747
748 if (!buf->pages[buf->nr_pages]) {
749 fw_load_abort(fw_priv);
750 return -ENOMEM;
751 }
752 buf->nr_pages++;
753 }
754 return 0;
755}
756
757/**
758 * firmware_data_write - write method for firmware
759 * @filp: open sysfs file
760 * @kobj: kobject for the device
761 * @bin_attr: bin_attr structure
762 * @buffer: buffer being written
763 * @offset: buffer offset for write in total data store area
764 * @count: buffer size
765 *
766 * Data written to the 'data' attribute will be later handed to
767 * the driver as a firmware image.
768 **/
769static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
770 struct bin_attribute *bin_attr,
771 char *buffer, loff_t offset, size_t count)
772{
773 struct device *dev = kobj_to_dev(kobj);
774 struct firmware_priv *fw_priv = to_firmware_priv(dev);
775 struct firmware_buf *buf;
776 ssize_t retval;
777
778 if (!capable(CAP_SYS_RAWIO))
779 return -EPERM;
780
781 mutex_lock(&fw_lock);
782 buf = fw_priv->buf;
783 if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
784 retval = -ENODEV;
785 goto out;
786 }
787
788 retval = fw_realloc_buffer(fw_priv, offset + count);
789 if (retval)
790 goto out;
791
792 retval = count;
793
794 while (count) {
795 void *page_data;
796 int page_nr = offset >> PAGE_SHIFT;
797 int page_ofs = offset & (PAGE_SIZE - 1);
798 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
799
800 page_data = kmap(buf->pages[page_nr]);
801
802 memcpy(page_data + page_ofs, buffer, page_cnt);
803
804 kunmap(buf->pages[page_nr]);
805 buffer += page_cnt;
806 offset += page_cnt;
807 count -= page_cnt;
808 }
809
810 buf->size = max_t(size_t, offset, buf->size);
811out:
812 mutex_unlock(&fw_lock);
813 return retval;
814}
815
816static struct bin_attribute firmware_attr_data = {
817 .attr = { .name = "data", .mode = 0644 },
818 .size = 0,
819 .read = firmware_data_read,
820 .write = firmware_data_write,
821};
822
823static void firmware_class_timeout_work(struct work_struct *work)
824{
825 struct firmware_priv *fw_priv = container_of(work,
826 struct firmware_priv, timeout_work.work);
827
828 mutex_lock(&fw_lock);
829 fw_load_abort(fw_priv);
830 mutex_unlock(&fw_lock);
831}
832
833static struct firmware_priv *
834fw_create_instance(struct firmware *firmware, const char *fw_name,
835 struct device *device, unsigned int opt_flags)
836{
837 struct firmware_priv *fw_priv;
838 struct device *f_dev;
839
840 fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
841 if (!fw_priv) {
842 dev_err(device, "%s: kmalloc failed\n", __func__);
843 fw_priv = ERR_PTR(-ENOMEM);
844 goto exit;
845 }
846
847 fw_priv->nowait = !!(opt_flags & FW_OPT_NOWAIT);
848 fw_priv->fw = firmware;
849 INIT_DELAYED_WORK(&fw_priv->timeout_work,
850 firmware_class_timeout_work);
851
852 f_dev = &fw_priv->dev;
853
854 device_initialize(f_dev);
855 dev_set_name(f_dev, "%s", fw_name);
856 f_dev->parent = device;
857 f_dev->class = &firmware_class;
858exit:
859 return fw_priv;
860}
861
862/* load a firmware via user helper */
863static int _request_firmware_load(struct firmware_priv *fw_priv,
864 unsigned int opt_flags, long timeout)
865{
866 int retval = 0;
867 struct device *f_dev = &fw_priv->dev;
868 struct firmware_buf *buf = fw_priv->buf;
869
870 /* fall back on userspace loading */
871 buf->is_paged_buf = true;
872
873 dev_set_uevent_suppress(f_dev, true);
874
875 retval = device_add(f_dev);
876 if (retval) {
877 dev_err(f_dev, "%s: device_register failed\n", __func__);
878 goto err_put_dev;
879 }
880
881 retval = device_create_bin_file(f_dev, &firmware_attr_data);
882 if (retval) {
883 dev_err(f_dev, "%s: sysfs_create_bin_file failed\n", __func__);
884 goto err_del_dev;
885 }
886
887 mutex_lock(&fw_lock);
888 list_add(&buf->pending_list, &pending_fw_head);
889 mutex_unlock(&fw_lock);
890
891 retval = device_create_file(f_dev, &dev_attr_loading);
892 if (retval) {
893 mutex_lock(&fw_lock);
894 list_del_init(&buf->pending_list);
895 mutex_unlock(&fw_lock);
896 dev_err(f_dev, "%s: device_create_file failed\n", __func__);
897 goto err_del_bin_attr;
898 }
899
900 if (opt_flags & FW_OPT_UEVENT) {
901 buf->need_uevent = true;
902 dev_set_uevent_suppress(f_dev, false);
903 dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
904 if (timeout != MAX_SCHEDULE_TIMEOUT)
905 queue_delayed_work(system_power_efficient_wq,
906 &fw_priv->timeout_work, timeout);
907
908 kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
909 }
910
911 wait_for_completion(&buf->completion);
912
913 cancel_delayed_work_sync(&fw_priv->timeout_work);
914 if (!buf->data)
915 retval = -ENOMEM;
916
917 device_remove_file(f_dev, &dev_attr_loading);
918err_del_bin_attr:
919 device_remove_bin_file(f_dev, &firmware_attr_data);
920err_del_dev:
921 device_del(f_dev);
922err_put_dev:
923 put_device(f_dev);
924 return retval;
925}
926
927static int fw_load_from_user_helper(struct firmware *firmware,
928 const char *name, struct device *device,
929 unsigned int opt_flags, long timeout)
930{
931 struct firmware_priv *fw_priv;
932
933 fw_priv = fw_create_instance(firmware, name, device, opt_flags);
934 if (IS_ERR(fw_priv))
935 return PTR_ERR(fw_priv);
936
937 fw_priv->buf = firmware->priv;
938 return _request_firmware_load(fw_priv, opt_flags, timeout);
939}
940
941#ifdef CONFIG_PM_SLEEP
942/* kill pending requests without uevent to avoid blocking suspend */
943static void kill_requests_without_uevent(void)
944{
945 struct firmware_buf *buf;
946 struct firmware_buf *next;
947
948 mutex_lock(&fw_lock);
949 list_for_each_entry_safe(buf, next, &pending_fw_head, pending_list) {
950 if (!buf->need_uevent)
951 __fw_load_abort(buf);
952 }
953 mutex_unlock(&fw_lock);
954}
955#endif
956
957#else /* CONFIG_FW_LOADER_USER_HELPER */
958static inline int
959fw_load_from_user_helper(struct firmware *firmware, const char *name,
960 struct device *device, unsigned int opt_flags,
961 long timeout)
962{
963 return -ENOENT;
964}
965
966/* No abort during direct loading */
967#define is_fw_load_aborted(buf) false
968
969#ifdef CONFIG_PM_SLEEP
970static inline void kill_requests_without_uevent(void) { }
971#endif
972
973#endif /* CONFIG_FW_LOADER_USER_HELPER */
974
975
976/* wait until the shared firmware_buf becomes ready (or error) */
977static int sync_cached_firmware_buf(struct firmware_buf *buf)
978{
979 int ret = 0;
980
981 mutex_lock(&fw_lock);
982 while (!test_bit(FW_STATUS_DONE, &buf->status)) {
983 if (is_fw_load_aborted(buf)) {
984 ret = -ENOENT;
985 break;
986 }
987 mutex_unlock(&fw_lock);
988 wait_for_completion(&buf->completion);
989 mutex_lock(&fw_lock);
990 }
991 mutex_unlock(&fw_lock);
992 return ret;
993}
994
995/* prepare firmware and firmware_buf structs;
996 * return 0 if a firmware is already assigned, 1 if need to load one,
997 * or a negative error code
998 */
999static int
1000_request_firmware_prepare(struct firmware **firmware_p, const char *name,
1001 struct device *device)
1002{
1003 struct firmware *firmware;
1004 struct firmware_buf *buf;
1005 int ret;
1006
1007 *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
1008 if (!firmware) {
1009 dev_err(device, "%s: kmalloc(struct firmware) failed\n",
1010 __func__);
1011 return -ENOMEM;
1012 }
1013
1014 if (fw_get_builtin_firmware(firmware, name)) {
1015 dev_dbg(device, "firmware: using built-in firmware %s\n", name);
1016 return 0; /* assigned */
1017 }
1018
1019 ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf);
1020
1021 /*
1022 * bind with 'buf' now to avoid warning in failure path
1023 * of requesting firmware.
1024 */
1025 firmware->priv = buf;
1026
1027 if (ret > 0) {
1028 ret = sync_cached_firmware_buf(buf);
1029 if (!ret) {
1030 fw_set_page_data(buf, firmware);
1031 return 0; /* assigned */
1032 }
1033 }
1034
1035 if (ret < 0)
1036 return ret;
1037 return 1; /* need to load */
1038}
1039
1040static int assign_firmware_buf(struct firmware *fw, struct device *device,
1041 unsigned int opt_flags)
1042{
1043 struct firmware_buf *buf = fw->priv;
1044
1045 mutex_lock(&fw_lock);
1046 if (!buf->size || is_fw_load_aborted(buf)) {
1047 mutex_unlock(&fw_lock);
1048 return -ENOENT;
1049 }
1050
1051 /*
1052 * add firmware name into devres list so that we can auto cache
1053 * and uncache firmware for device.
1054 *
1055 * device may has been deleted already, but the problem
1056 * should be fixed in devres or driver core.
1057 */
1058 /* don't cache firmware handled without uevent */
1059 if (device && (opt_flags & FW_OPT_UEVENT))
1060 fw_add_devm_name(device, buf->fw_id);
1061
1062 /*
1063 * After caching firmware image is started, let it piggyback
1064 * on request firmware.
1065 */
1066 if (buf->fwc->state == FW_LOADER_START_CACHE) {
1067 if (fw_cache_piggyback_on_request(buf->fw_id))
1068 kref_get(&buf->ref);
1069 }
1070
1071 /* pass the pages buffer to driver at the last minute */
1072 fw_set_page_data(buf, fw);
1073 mutex_unlock(&fw_lock);
1074 return 0;
1075}
1076
1077/* called from request_firmware() and request_firmware_work_func() */
1078static int
1079_request_firmware(const struct firmware **firmware_p, const char *name,
1080 struct device *device, unsigned int opt_flags)
1081{
1082 struct firmware *fw;
1083 long timeout;
1084 int ret;
1085
1086 if (!firmware_p)
1087 return -EINVAL;
1088
1089 ret = _request_firmware_prepare(&fw, name, device);
1090 if (ret <= 0) /* error or already assigned */
1091 goto out;
1092
1093 ret = 0;
1094 timeout = firmware_loading_timeout();
1095 if (opt_flags & FW_OPT_NOWAIT) {
1096 timeout = usermodehelper_read_lock_wait(timeout);
1097 if (!timeout) {
1098 dev_dbg(device, "firmware: %s loading timed out\n",
1099 name);
1100 ret = -EBUSY;
1101 goto out;
1102 }
1103 } else {
1104 ret = usermodehelper_read_trylock();
1105 if (WARN_ON(ret)) {
1106 dev_err(device, "firmware: %s will not be loaded\n",
1107 name);
1108 goto out;
1109 }
1110 }
1111
1112 ret = fw_get_filesystem_firmware(device, fw->priv);
1113 if (ret) {
1114 if (opt_flags & FW_OPT_FALLBACK) {
1115 dev_warn(device,
1116 "Direct firmware load failed with error %d\n",
1117 ret);
1118 dev_warn(device, "Falling back to user helper\n");
1119 ret = fw_load_from_user_helper(fw, name, device,
1120 opt_flags, timeout);
1121 }
1122 }
1123
1124 if (!ret)
1125 ret = assign_firmware_buf(fw, device, opt_flags);
1126
1127 usermodehelper_read_unlock();
1128
1129 out:
1130 if (ret < 0) {
1131 release_firmware(fw);
1132 fw = NULL;
1133 }
1134
1135 *firmware_p = fw;
1136 return ret;
1137}
1138
1139/**
1140 * request_firmware: - send firmware request and wait for it
1141 * @firmware_p: pointer to firmware image
1142 * @name: name of firmware file
1143 * @device: device for which firmware is being loaded
1144 *
1145 * @firmware_p will be used to return a firmware image by the name
1146 * of @name for device @device.
1147 *
1148 * Should be called from user context where sleeping is allowed.
1149 *
1150 * @name will be used as $FIRMWARE in the uevent environment and
1151 * should be distinctive enough not to be confused with any other
1152 * firmware image for this or any other device.
1153 *
1154 * Caller must hold the reference count of @device.
1155 *
1156 * The function can be called safely inside device's suspend and
1157 * resume callback.
1158 **/
1159int
1160request_firmware(const struct firmware **firmware_p, const char *name,
1161 struct device *device)
1162{
1163 int ret;
1164
1165 /* Need to pin this module until return */
1166 __module_get(THIS_MODULE);
1167 ret = _request_firmware(firmware_p, name, device,
1168 FW_OPT_UEVENT | FW_OPT_FALLBACK);
1169 module_put(THIS_MODULE);
1170 return ret;
1171}
1172EXPORT_SYMBOL(request_firmware);
1173
1174#ifdef CONFIG_FW_LOADER_USER_HELPER
1175/**
1176 * request_firmware: - load firmware directly without usermode helper
1177 * @firmware_p: pointer to firmware image
1178 * @name: name of firmware file
1179 * @device: device for which firmware is being loaded
1180 *
1181 * This function works pretty much like request_firmware(), but this doesn't
1182 * fall back to usermode helper even if the firmware couldn't be loaded
1183 * directly from fs. Hence it's useful for loading optional firmwares, which
1184 * aren't always present, without extra long timeouts of udev.
1185 **/
1186int request_firmware_direct(const struct firmware **firmware_p,
1187 const char *name, struct device *device)
1188{
1189 int ret;
1190 __module_get(THIS_MODULE);
1191 ret = _request_firmware(firmware_p, name, device, FW_OPT_UEVENT);
1192 module_put(THIS_MODULE);
1193 return ret;
1194}
1195EXPORT_SYMBOL_GPL(request_firmware_direct);
1196#endif
1197
1198/**
1199 * release_firmware: - release the resource associated with a firmware image
1200 * @fw: firmware resource to release
1201 **/
1202void release_firmware(const struct firmware *fw)
1203{
1204 if (fw) {
1205 if (!fw_is_builtin_firmware(fw))
1206 firmware_free_data(fw);
1207 kfree(fw);
1208 }
1209}
1210EXPORT_SYMBOL(release_firmware);
1211
1212/* Async support */
1213struct firmware_work {
1214 struct work_struct work;
1215 struct module *module;
1216 const char *name;
1217 struct device *device;
1218 void *context;
1219 void (*cont)(const struct firmware *fw, void *context);
1220 unsigned int opt_flags;
1221};
1222
1223static void request_firmware_work_func(struct work_struct *work)
1224{
1225 struct firmware_work *fw_work;
1226 const struct firmware *fw;
1227
1228 fw_work = container_of(work, struct firmware_work, work);
1229
1230 _request_firmware(&fw, fw_work->name, fw_work->device,
1231 fw_work->opt_flags);
1232 fw_work->cont(fw, fw_work->context);
1233 put_device(fw_work->device); /* taken in request_firmware_nowait() */
1234
1235 module_put(fw_work->module);
1236 kfree(fw_work);
1237}
1238
1239/**
1240 * request_firmware_nowait - asynchronous version of request_firmware
1241 * @module: module requesting the firmware
1242 * @uevent: sends uevent to copy the firmware image if this flag
1243 * is non-zero else the firmware copy must be done manually.
1244 * @name: name of firmware file
1245 * @device: device for which firmware is being loaded
1246 * @gfp: allocation flags
1247 * @context: will be passed over to @cont, and
1248 * @fw may be %NULL if firmware request fails.
1249 * @cont: function will be called asynchronously when the firmware
1250 * request is over.
1251 *
1252 * Caller must hold the reference count of @device.
1253 *
1254 * Asynchronous variant of request_firmware() for user contexts:
1255 * - sleep for as small periods as possible since it may
1256 * increase kernel boot time of built-in device drivers
1257 * requesting firmware in their ->probe() methods, if
1258 * @gfp is GFP_KERNEL.
1259 *
1260 * - can't sleep at all if @gfp is GFP_ATOMIC.
1261 **/
1262int
1263request_firmware_nowait(
1264 struct module *module, bool uevent,
1265 const char *name, struct device *device, gfp_t gfp, void *context,
1266 void (*cont)(const struct firmware *fw, void *context))
1267{
1268 struct firmware_work *fw_work;
1269
1270 fw_work = kzalloc(sizeof (struct firmware_work), gfp);
1271 if (!fw_work)
1272 return -ENOMEM;
1273
1274 fw_work->module = module;
1275 fw_work->name = name;
1276 fw_work->device = device;
1277 fw_work->context = context;
1278 fw_work->cont = cont;
1279 fw_work->opt_flags = FW_OPT_NOWAIT | FW_OPT_FALLBACK |
1280 (uevent ? FW_OPT_UEVENT : 0);
1281
1282 if (!try_module_get(module)) {
1283 kfree(fw_work);
1284 return -EFAULT;
1285 }
1286
1287 get_device(fw_work->device);
1288 INIT_WORK(&fw_work->work, request_firmware_work_func);
1289 schedule_work(&fw_work->work);
1290 return 0;
1291}
1292EXPORT_SYMBOL(request_firmware_nowait);
1293
1294#ifdef CONFIG_PM_SLEEP
1295static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);
1296
1297/**
1298 * cache_firmware - cache one firmware image in kernel memory space
1299 * @fw_name: the firmware image name
1300 *
1301 * Cache firmware in kernel memory so that drivers can use it when
1302 * system isn't ready for them to request firmware image from userspace.
1303 * Once it returns successfully, driver can use request_firmware or its
1304 * nowait version to get the cached firmware without any interacting
1305 * with userspace
1306 *
1307 * Return 0 if the firmware image has been cached successfully
1308 * Return !0 otherwise
1309 *
1310 */
1311static int cache_firmware(const char *fw_name)
1312{
1313 int ret;
1314 const struct firmware *fw;
1315
1316 pr_debug("%s: %s\n", __func__, fw_name);
1317
1318 ret = request_firmware(&fw, fw_name, NULL);
1319 if (!ret)
1320 kfree(fw);
1321
1322 pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);
1323
1324 return ret;
1325}
1326
1327static struct firmware_buf *fw_lookup_buf(const char *fw_name)
1328{
1329 struct firmware_buf *tmp;
1330 struct firmware_cache *fwc = &fw_cache;
1331
1332 spin_lock(&fwc->lock);
1333 tmp = __fw_lookup_buf(fw_name);
1334 spin_unlock(&fwc->lock);
1335
1336 return tmp;
1337}
1338
1339/**
1340 * uncache_firmware - remove one cached firmware image
1341 * @fw_name: the firmware image name
1342 *
1343 * Uncache one firmware image which has been cached successfully
1344 * before.
1345 *
1346 * Return 0 if the firmware cache has been removed successfully
1347 * Return !0 otherwise
1348 *
1349 */
1350static int uncache_firmware(const char *fw_name)
1351{
1352 struct firmware_buf *buf;
1353 struct firmware fw;
1354
1355 pr_debug("%s: %s\n", __func__, fw_name);
1356
1357 if (fw_get_builtin_firmware(&fw, fw_name))
1358 return 0;
1359
1360 buf = fw_lookup_buf(fw_name);
1361 if (buf) {
1362 fw_free_buf(buf);
1363 return 0;
1364 }
1365
1366 return -EINVAL;
1367}
1368
1369static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
1370{
1371 struct fw_cache_entry *fce;
1372
1373 fce = kzalloc(sizeof(*fce) + strlen(name) + 1, GFP_ATOMIC);
1374 if (!fce)
1375 goto exit;
1376
1377 strcpy(fce->name, name);
1378exit:
1379 return fce;
1380}
1381
1382static int __fw_entry_found(const char *name)
1383{
1384 struct firmware_cache *fwc = &fw_cache;
1385 struct fw_cache_entry *fce;
1386
1387 list_for_each_entry(fce, &fwc->fw_names, list) {
1388 if (!strcmp(fce->name, name))
1389 return 1;
1390 }
1391 return 0;
1392}
1393
1394static int fw_cache_piggyback_on_request(const char *name)
1395{
1396 struct firmware_cache *fwc = &fw_cache;
1397 struct fw_cache_entry *fce;
1398 int ret = 0;
1399
1400 spin_lock(&fwc->name_lock);
1401 if (__fw_entry_found(name))
1402 goto found;
1403
1404 fce = alloc_fw_cache_entry(name);
1405 if (fce) {
1406 ret = 1;
1407 list_add(&fce->list, &fwc->fw_names);
1408 pr_debug("%s: fw: %s\n", __func__, name);
1409 }
1410found:
1411 spin_unlock(&fwc->name_lock);
1412 return ret;
1413}
1414
1415static void free_fw_cache_entry(struct fw_cache_entry *fce)
1416{
1417 kfree(fce);
1418}
1419
1420static void __async_dev_cache_fw_image(void *fw_entry,
1421 async_cookie_t cookie)
1422{
1423 struct fw_cache_entry *fce = fw_entry;
1424 struct firmware_cache *fwc = &fw_cache;
1425 int ret;
1426
1427 ret = cache_firmware(fce->name);
1428 if (ret) {
1429 spin_lock(&fwc->name_lock);
1430 list_del(&fce->list);
1431 spin_unlock(&fwc->name_lock);
1432
1433 free_fw_cache_entry(fce);
1434 }
1435}
1436
1437/* called with dev->devres_lock held */
1438static void dev_create_fw_entry(struct device *dev, void *res,
1439 void *data)
1440{
1441 struct fw_name_devm *fwn = res;
1442 const char *fw_name = fwn->name;
1443 struct list_head *head = data;
1444 struct fw_cache_entry *fce;
1445
1446 fce = alloc_fw_cache_entry(fw_name);
1447 if (fce)
1448 list_add(&fce->list, head);
1449}
1450
1451static int devm_name_match(struct device *dev, void *res,
1452 void *match_data)
1453{
1454 struct fw_name_devm *fwn = res;
1455 return (fwn->magic == (unsigned long)match_data);
1456}
1457
1458static void dev_cache_fw_image(struct device *dev, void *data)
1459{
1460 LIST_HEAD(todo);
1461 struct fw_cache_entry *fce;
1462 struct fw_cache_entry *fce_next;
1463 struct firmware_cache *fwc = &fw_cache;
1464
1465 devres_for_each_res(dev, fw_name_devm_release,
1466 devm_name_match, &fw_cache,
1467 dev_create_fw_entry, &todo);
1468
1469 list_for_each_entry_safe(fce, fce_next, &todo, list) {
1470 list_del(&fce->list);
1471
1472 spin_lock(&fwc->name_lock);
1473 /* only one cache entry for one firmware */
1474 if (!__fw_entry_found(fce->name)) {
1475 list_add(&fce->list, &fwc->fw_names);
1476 } else {
1477 free_fw_cache_entry(fce);
1478 fce = NULL;
1479 }
1480 spin_unlock(&fwc->name_lock);
1481
1482 if (fce)
1483 async_schedule_domain(__async_dev_cache_fw_image,
1484 (void *)fce,
1485 &fw_cache_domain);
1486 }
1487}
1488
1489static void __device_uncache_fw_images(void)
1490{
1491 struct firmware_cache *fwc = &fw_cache;
1492 struct fw_cache_entry *fce;
1493
1494 spin_lock(&fwc->name_lock);
1495 while (!list_empty(&fwc->fw_names)) {
1496 fce = list_entry(fwc->fw_names.next,
1497 struct fw_cache_entry, list);
1498 list_del(&fce->list);
1499 spin_unlock(&fwc->name_lock);
1500
1501 uncache_firmware(fce->name);
1502 free_fw_cache_entry(fce);
1503
1504 spin_lock(&fwc->name_lock);
1505 }
1506 spin_unlock(&fwc->name_lock);
1507}
1508
1509/**
1510 * device_cache_fw_images - cache devices' firmware
1511 *
1512 * If one device called request_firmware or its nowait version
1513 * successfully before, the firmware names are recored into the
1514 * device's devres link list, so device_cache_fw_images can call
1515 * cache_firmware() to cache these firmwares for the device,
1516 * then the device driver can load its firmwares easily at
1517 * time when system is not ready to complete loading firmware.
1518 */
1519static void device_cache_fw_images(void)
1520{
1521 struct firmware_cache *fwc = &fw_cache;
1522 int old_timeout;
1523 DEFINE_WAIT(wait);
1524
1525 pr_debug("%s\n", __func__);
1526
1527 /* cancel uncache work */
1528 cancel_delayed_work_sync(&fwc->work);
1529
1530 /*
1531 * use small loading timeout for caching devices' firmware
1532 * because all these firmware images have been loaded
1533 * successfully at lease once, also system is ready for
1534 * completing firmware loading now. The maximum size of
1535 * firmware in current distributions is about 2M bytes,
1536 * so 10 secs should be enough.
1537 */
1538 old_timeout = loading_timeout;
1539 loading_timeout = 10;
1540
1541 mutex_lock(&fw_lock);
1542 fwc->state = FW_LOADER_START_CACHE;
1543 dpm_for_each_dev(NULL, dev_cache_fw_image);
1544 mutex_unlock(&fw_lock);
1545
1546 /* wait for completion of caching firmware for all devices */
1547 async_synchronize_full_domain(&fw_cache_domain);
1548
1549 loading_timeout = old_timeout;
1550}
1551
1552/**
1553 * device_uncache_fw_images - uncache devices' firmware
1554 *
1555 * uncache all firmwares which have been cached successfully
1556 * by device_uncache_fw_images earlier
1557 */
1558static void device_uncache_fw_images(void)
1559{
1560 pr_debug("%s\n", __func__);
1561 __device_uncache_fw_images();
1562}
1563
1564static void device_uncache_fw_images_work(struct work_struct *work)
1565{
1566 device_uncache_fw_images();
1567}
1568
1569/**
1570 * device_uncache_fw_images_delay - uncache devices firmwares
1571 * @delay: number of milliseconds to delay uncache device firmwares
1572 *
1573 * uncache all devices's firmwares which has been cached successfully
1574 * by device_cache_fw_images after @delay milliseconds.
1575 */
1576static void device_uncache_fw_images_delay(unsigned long delay)
1577{
1578 queue_delayed_work(system_power_efficient_wq, &fw_cache.work,
1579 msecs_to_jiffies(delay));
1580}
1581
1582static int fw_pm_notify(struct notifier_block *notify_block,
1583 unsigned long mode, void *unused)
1584{
1585 switch (mode) {
1586 case PM_HIBERNATION_PREPARE:
1587 case PM_SUSPEND_PREPARE:
1588 case PM_RESTORE_PREPARE:
1589 kill_requests_without_uevent();
1590 device_cache_fw_images();
1591 break;
1592
1593 case PM_POST_SUSPEND:
1594 case PM_POST_HIBERNATION:
1595 case PM_POST_RESTORE:
1596 /*
1597 * In case that system sleep failed and syscore_suspend is
1598 * not called.
1599 */
1600 mutex_lock(&fw_lock);
1601 fw_cache.state = FW_LOADER_NO_CACHE;
1602 mutex_unlock(&fw_lock);
1603
1604 device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
1605 break;
1606 }
1607
1608 return 0;
1609}
1610
1611/* stop caching firmware once syscore_suspend is reached */
1612static int fw_suspend(void)
1613{
1614 fw_cache.state = FW_LOADER_NO_CACHE;
1615 return 0;
1616}
1617
1618static struct syscore_ops fw_syscore_ops = {
1619 .suspend = fw_suspend,
1620};
1621#else
1622static int fw_cache_piggyback_on_request(const char *name)
1623{
1624 return 0;
1625}
1626#endif
1627
1628static void __init fw_cache_init(void)
1629{
1630 spin_lock_init(&fw_cache.lock);
1631 INIT_LIST_HEAD(&fw_cache.head);
1632 fw_cache.state = FW_LOADER_NO_CACHE;
1633
1634#ifdef CONFIG_PM_SLEEP
1635 spin_lock_init(&fw_cache.name_lock);
1636 INIT_LIST_HEAD(&fw_cache.fw_names);
1637
1638 INIT_DELAYED_WORK(&fw_cache.work,
1639 device_uncache_fw_images_work);
1640
1641 fw_cache.pm_notify.notifier_call = fw_pm_notify;
1642 register_pm_notifier(&fw_cache.pm_notify);
1643
1644 register_syscore_ops(&fw_syscore_ops);
1645#endif
1646}
1647
1648static int __init firmware_class_init(void)
1649{
1650 fw_cache_init();
1651#ifdef CONFIG_FW_LOADER_USER_HELPER
1652 register_reboot_notifier(&fw_shutdown_nb);
1653 return class_register(&firmware_class);
1654#else
1655 return 0;
1656#endif
1657}
1658
1659static void __exit firmware_class_exit(void)
1660{
1661#ifdef CONFIG_PM_SLEEP
1662 unregister_syscore_ops(&fw_syscore_ops);
1663 unregister_pm_notifier(&fw_cache.pm_notify);
1664#endif
1665#ifdef CONFIG_FW_LOADER_USER_HELPER
1666 unregister_reboot_notifier(&fw_shutdown_nb);
1667 class_unregister(&firmware_class);
1668#endif
1669}
1670
1671fs_initcall(firmware_class_init);
1672module_exit(firmware_class_exit);
1/*
2 * firmware_class.c - Multi purpose firmware loading support
3 *
4 * Copyright (c) 2003 Manuel Estrada Sainz
5 *
6 * Please see Documentation/firmware_class/ for more information.
7 *
8 */
9
10#include <linux/capability.h>
11#include <linux/device.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/timer.h>
15#include <linux/vmalloc.h>
16#include <linux/interrupt.h>
17#include <linux/bitops.h>
18#include <linux/mutex.h>
19#include <linux/workqueue.h>
20#include <linux/highmem.h>
21#include <linux/firmware.h>
22#include <linux/slab.h>
23#include <linux/sched.h>
24#include <linux/file.h>
25#include <linux/list.h>
26#include <linux/fs.h>
27#include <linux/async.h>
28#include <linux/pm.h>
29#include <linux/suspend.h>
30#include <linux/syscore_ops.h>
31#include <linux/reboot.h>
32#include <linux/security.h>
33#include <linux/swait.h>
34
35#include <generated/utsrelease.h>
36
37#include "base.h"
38
39MODULE_AUTHOR("Manuel Estrada Sainz");
40MODULE_DESCRIPTION("Multi purpose firmware loading support");
41MODULE_LICENSE("GPL");
42
43/* Builtin firmware support */
44
45#ifdef CONFIG_FW_LOADER
46
47extern struct builtin_fw __start_builtin_fw[];
48extern struct builtin_fw __end_builtin_fw[];
49
50static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
51 void *buf, size_t size)
52{
53 struct builtin_fw *b_fw;
54
55 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
56 if (strcmp(name, b_fw->name) == 0) {
57 fw->size = b_fw->size;
58 fw->data = b_fw->data;
59
60 if (buf && fw->size <= size)
61 memcpy(buf, fw->data, fw->size);
62 return true;
63 }
64 }
65
66 return false;
67}
68
69static bool fw_is_builtin_firmware(const struct firmware *fw)
70{
71 struct builtin_fw *b_fw;
72
73 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
74 if (fw->data == b_fw->data)
75 return true;
76
77 return false;
78}
79
80#else /* Module case - no builtin firmware support */
81
82static inline bool fw_get_builtin_firmware(struct firmware *fw,
83 const char *name, void *buf,
84 size_t size)
85{
86 return false;
87}
88
89static inline bool fw_is_builtin_firmware(const struct firmware *fw)
90{
91 return false;
92}
93#endif
94
95enum fw_status {
96 FW_STATUS_UNKNOWN,
97 FW_STATUS_LOADING,
98 FW_STATUS_DONE,
99 FW_STATUS_ABORTED,
100};
101
102static int loading_timeout = 60; /* In seconds */
103
104static inline long firmware_loading_timeout(void)
105{
106 return loading_timeout > 0 ? loading_timeout * HZ : MAX_JIFFY_OFFSET;
107}
108
109/*
110 * Concurrent request_firmware() for the same firmware need to be
111 * serialized. struct fw_state is simple state machine which hold the
112 * state of the firmware loading.
113 */
114struct fw_state {
115 struct swait_queue_head wq;
116 enum fw_status status;
117};
118
119static void fw_state_init(struct fw_state *fw_st)
120{
121 init_swait_queue_head(&fw_st->wq);
122 fw_st->status = FW_STATUS_UNKNOWN;
123}
124
125static inline bool __fw_state_is_done(enum fw_status status)
126{
127 return status == FW_STATUS_DONE || status == FW_STATUS_ABORTED;
128}
129
130static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
131{
132 long ret;
133
134 ret = swait_event_interruptible_timeout(fw_st->wq,
135 __fw_state_is_done(READ_ONCE(fw_st->status)),
136 timeout);
137 if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
138 return -ENOENT;
139 if (!ret)
140 return -ETIMEDOUT;
141
142 return ret < 0 ? ret : 0;
143}
144
145static void __fw_state_set(struct fw_state *fw_st,
146 enum fw_status status)
147{
148 WRITE_ONCE(fw_st->status, status);
149
150 if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
151 swake_up(&fw_st->wq);
152}
153
154#define fw_state_start(fw_st) \
155 __fw_state_set(fw_st, FW_STATUS_LOADING)
156#define fw_state_done(fw_st) \
157 __fw_state_set(fw_st, FW_STATUS_DONE)
158#define fw_state_wait(fw_st) \
159 __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
160
161#ifndef CONFIG_FW_LOADER_USER_HELPER
162
163#define fw_state_is_aborted(fw_st) false
164
165#else /* CONFIG_FW_LOADER_USER_HELPER */
166
167static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
168{
169 return fw_st->status == status;
170}
171
172#define fw_state_aborted(fw_st) \
173 __fw_state_set(fw_st, FW_STATUS_ABORTED)
174#define fw_state_is_done(fw_st) \
175 __fw_state_check(fw_st, FW_STATUS_DONE)
176#define fw_state_is_loading(fw_st) \
177 __fw_state_check(fw_st, FW_STATUS_LOADING)
178#define fw_state_is_aborted(fw_st) \
179 __fw_state_check(fw_st, FW_STATUS_ABORTED)
180#define fw_state_wait_timeout(fw_st, timeout) \
181 __fw_state_wait_common(fw_st, timeout)
182
183#endif /* CONFIG_FW_LOADER_USER_HELPER */
184
185/* firmware behavior options */
186#define FW_OPT_UEVENT (1U << 0)
187#define FW_OPT_NOWAIT (1U << 1)
188#ifdef CONFIG_FW_LOADER_USER_HELPER
189#define FW_OPT_USERHELPER (1U << 2)
190#else
191#define FW_OPT_USERHELPER 0
192#endif
193#ifdef CONFIG_FW_LOADER_USER_HELPER_FALLBACK
194#define FW_OPT_FALLBACK FW_OPT_USERHELPER
195#else
196#define FW_OPT_FALLBACK 0
197#endif
198#define FW_OPT_NO_WARN (1U << 3)
199#define FW_OPT_NOCACHE (1U << 4)
200
201struct firmware_cache {
202 /* firmware_buf instance will be added into the below list */
203 spinlock_t lock;
204 struct list_head head;
205 int state;
206
207#ifdef CONFIG_PM_SLEEP
208 /*
209 * Names of firmware images which have been cached successfully
210 * will be added into the below list so that device uncache
211 * helper can trace which firmware images have been cached
212 * before.
213 */
214 spinlock_t name_lock;
215 struct list_head fw_names;
216
217 struct delayed_work work;
218
219 struct notifier_block pm_notify;
220#endif
221};
222
223struct firmware_buf {
224 struct kref ref;
225 struct list_head list;
226 struct firmware_cache *fwc;
227 struct fw_state fw_st;
228 void *data;
229 size_t size;
230 size_t allocated_size;
231#ifdef CONFIG_FW_LOADER_USER_HELPER
232 bool is_paged_buf;
233 bool need_uevent;
234 struct page **pages;
235 int nr_pages;
236 int page_array_size;
237 struct list_head pending_list;
238#endif
239 const char *fw_id;
240};
241
242struct fw_cache_entry {
243 struct list_head list;
244 const char *name;
245};
246
247struct fw_name_devm {
248 unsigned long magic;
249 const char *name;
250};
251
252#define to_fwbuf(d) container_of(d, struct firmware_buf, ref)
253
254#define FW_LOADER_NO_CACHE 0
255#define FW_LOADER_START_CACHE 1
256
257static int fw_cache_piggyback_on_request(const char *name);
258
259/* fw_lock could be moved to 'struct firmware_priv' but since it is just
260 * guarding for corner cases a global lock should be OK */
261static DEFINE_MUTEX(fw_lock);
262
263static struct firmware_cache fw_cache;
264
265static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
266 struct firmware_cache *fwc,
267 void *dbuf, size_t size)
268{
269 struct firmware_buf *buf;
270
271 buf = kzalloc(sizeof(*buf), GFP_ATOMIC);
272 if (!buf)
273 return NULL;
274
275 buf->fw_id = kstrdup_const(fw_name, GFP_ATOMIC);
276 if (!buf->fw_id) {
277 kfree(buf);
278 return NULL;
279 }
280
281 kref_init(&buf->ref);
282 buf->fwc = fwc;
283 buf->data = dbuf;
284 buf->allocated_size = size;
285 fw_state_init(&buf->fw_st);
286#ifdef CONFIG_FW_LOADER_USER_HELPER
287 INIT_LIST_HEAD(&buf->pending_list);
288#endif
289
290 pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
291
292 return buf;
293}
294
295static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
296{
297 struct firmware_buf *tmp;
298 struct firmware_cache *fwc = &fw_cache;
299
300 list_for_each_entry(tmp, &fwc->head, list)
301 if (!strcmp(tmp->fw_id, fw_name))
302 return tmp;
303 return NULL;
304}
305
306static int fw_lookup_and_allocate_buf(const char *fw_name,
307 struct firmware_cache *fwc,
308 struct firmware_buf **buf, void *dbuf,
309 size_t size)
310{
311 struct firmware_buf *tmp;
312
313 spin_lock(&fwc->lock);
314 tmp = __fw_lookup_buf(fw_name);
315 if (tmp) {
316 kref_get(&tmp->ref);
317 spin_unlock(&fwc->lock);
318 *buf = tmp;
319 return 1;
320 }
321 tmp = __allocate_fw_buf(fw_name, fwc, dbuf, size);
322 if (tmp)
323 list_add(&tmp->list, &fwc->head);
324 spin_unlock(&fwc->lock);
325
326 *buf = tmp;
327
328 return tmp ? 0 : -ENOMEM;
329}
330
331static void __fw_free_buf(struct kref *ref)
332 __releases(&fwc->lock)
333{
334 struct firmware_buf *buf = to_fwbuf(ref);
335 struct firmware_cache *fwc = buf->fwc;
336
337 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
338 __func__, buf->fw_id, buf, buf->data,
339 (unsigned int)buf->size);
340
341 list_del(&buf->list);
342 spin_unlock(&fwc->lock);
343
344#ifdef CONFIG_FW_LOADER_USER_HELPER
345 if (buf->is_paged_buf) {
346 int i;
347 vunmap(buf->data);
348 for (i = 0; i < buf->nr_pages; i++)
349 __free_page(buf->pages[i]);
350 vfree(buf->pages);
351 } else
352#endif
353 if (!buf->allocated_size)
354 vfree(buf->data);
355 kfree_const(buf->fw_id);
356 kfree(buf);
357}
358
359static void fw_free_buf(struct firmware_buf *buf)
360{
361 struct firmware_cache *fwc = buf->fwc;
362 spin_lock(&fwc->lock);
363 if (!kref_put(&buf->ref, __fw_free_buf))
364 spin_unlock(&fwc->lock);
365}
366
367/* direct firmware loading support */
368static char fw_path_para[256];
369static const char * const fw_path[] = {
370 fw_path_para,
371 "/lib/firmware/updates/" UTS_RELEASE,
372 "/lib/firmware/updates",
373 "/lib/firmware/" UTS_RELEASE,
374 "/lib/firmware"
375};
376
377/*
378 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
379 * from kernel command line because firmware_class is generally built in
380 * kernel instead of module.
381 */
382module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644);
383MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path");
384
385static int
386fw_get_filesystem_firmware(struct device *device, struct firmware_buf *buf)
387{
388 loff_t size;
389 int i, len;
390 int rc = -ENOENT;
391 char *path;
392 enum kernel_read_file_id id = READING_FIRMWARE;
393 size_t msize = INT_MAX;
394
395 /* Already populated data member means we're loading into a buffer */
396 if (buf->data) {
397 id = READING_FIRMWARE_PREALLOC_BUFFER;
398 msize = buf->allocated_size;
399 }
400
401 path = __getname();
402 if (!path)
403 return -ENOMEM;
404
405 for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
406 /* skip the unset customized path */
407 if (!fw_path[i][0])
408 continue;
409
410 len = snprintf(path, PATH_MAX, "%s/%s",
411 fw_path[i], buf->fw_id);
412 if (len >= PATH_MAX) {
413 rc = -ENAMETOOLONG;
414 break;
415 }
416
417 buf->size = 0;
418 rc = kernel_read_file_from_path(path, &buf->data, &size, msize,
419 id);
420 if (rc) {
421 if (rc == -ENOENT)
422 dev_dbg(device, "loading %s failed with error %d\n",
423 path, rc);
424 else
425 dev_warn(device, "loading %s failed with error %d\n",
426 path, rc);
427 continue;
428 }
429 dev_dbg(device, "direct-loading %s\n", buf->fw_id);
430 buf->size = size;
431 fw_state_done(&buf->fw_st);
432 break;
433 }
434 __putname(path);
435
436 return rc;
437}
438
439/* firmware holds the ownership of pages */
440static void firmware_free_data(const struct firmware *fw)
441{
442 /* Loaded directly? */
443 if (!fw->priv) {
444 vfree(fw->data);
445 return;
446 }
447 fw_free_buf(fw->priv);
448}
449
450/* store the pages buffer info firmware from buf */
451static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
452{
453 fw->priv = buf;
454#ifdef CONFIG_FW_LOADER_USER_HELPER
455 fw->pages = buf->pages;
456#endif
457 fw->size = buf->size;
458 fw->data = buf->data;
459
460 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
461 __func__, buf->fw_id, buf, buf->data,
462 (unsigned int)buf->size);
463}
464
465#ifdef CONFIG_PM_SLEEP
466static void fw_name_devm_release(struct device *dev, void *res)
467{
468 struct fw_name_devm *fwn = res;
469
470 if (fwn->magic == (unsigned long)&fw_cache)
471 pr_debug("%s: fw_name-%s devm-%p released\n",
472 __func__, fwn->name, res);
473 kfree_const(fwn->name);
474}
475
476static int fw_devm_match(struct device *dev, void *res,
477 void *match_data)
478{
479 struct fw_name_devm *fwn = res;
480
481 return (fwn->magic == (unsigned long)&fw_cache) &&
482 !strcmp(fwn->name, match_data);
483}
484
485static struct fw_name_devm *fw_find_devm_name(struct device *dev,
486 const char *name)
487{
488 struct fw_name_devm *fwn;
489
490 fwn = devres_find(dev, fw_name_devm_release,
491 fw_devm_match, (void *)name);
492 return fwn;
493}
494
495/* add firmware name into devres list */
496static int fw_add_devm_name(struct device *dev, const char *name)
497{
498 struct fw_name_devm *fwn;
499
500 fwn = fw_find_devm_name(dev, name);
501 if (fwn)
502 return 1;
503
504 fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm),
505 GFP_KERNEL);
506 if (!fwn)
507 return -ENOMEM;
508 fwn->name = kstrdup_const(name, GFP_KERNEL);
509 if (!fwn->name) {
510 devres_free(fwn);
511 return -ENOMEM;
512 }
513
514 fwn->magic = (unsigned long)&fw_cache;
515 devres_add(dev, fwn);
516
517 return 0;
518}
519#else
520static int fw_add_devm_name(struct device *dev, const char *name)
521{
522 return 0;
523}
524#endif
525
526
527/*
528 * user-mode helper code
529 */
530#ifdef CONFIG_FW_LOADER_USER_HELPER
531struct firmware_priv {
532 bool nowait;
533 struct device dev;
534 struct firmware_buf *buf;
535 struct firmware *fw;
536};
537
538static struct firmware_priv *to_firmware_priv(struct device *dev)
539{
540 return container_of(dev, struct firmware_priv, dev);
541}
542
543static void __fw_load_abort(struct firmware_buf *buf)
544{
545 /*
546 * There is a small window in which user can write to 'loading'
547 * between loading done and disappearance of 'loading'
548 */
549 if (fw_state_is_done(&buf->fw_st))
550 return;
551
552 list_del_init(&buf->pending_list);
553 fw_state_aborted(&buf->fw_st);
554}
555
556static void fw_load_abort(struct firmware_priv *fw_priv)
557{
558 struct firmware_buf *buf = fw_priv->buf;
559
560 __fw_load_abort(buf);
561}
562
563static LIST_HEAD(pending_fw_head);
564
565/* reboot notifier for avoid deadlock with usermode_lock */
566static int fw_shutdown_notify(struct notifier_block *unused1,
567 unsigned long unused2, void *unused3)
568{
569 mutex_lock(&fw_lock);
570 while (!list_empty(&pending_fw_head))
571 __fw_load_abort(list_first_entry(&pending_fw_head,
572 struct firmware_buf,
573 pending_list));
574 mutex_unlock(&fw_lock);
575 return NOTIFY_DONE;
576}
577
578static struct notifier_block fw_shutdown_nb = {
579 .notifier_call = fw_shutdown_notify,
580};
581
582static ssize_t timeout_show(struct class *class, struct class_attribute *attr,
583 char *buf)
584{
585 return sprintf(buf, "%d\n", loading_timeout);
586}
587
588/**
589 * firmware_timeout_store - set number of seconds to wait for firmware
590 * @class: device class pointer
591 * @attr: device attribute pointer
592 * @buf: buffer to scan for timeout value
593 * @count: number of bytes in @buf
594 *
595 * Sets the number of seconds to wait for the firmware. Once
596 * this expires an error will be returned to the driver and no
597 * firmware will be provided.
598 *
599 * Note: zero means 'wait forever'.
600 **/
601static ssize_t timeout_store(struct class *class, struct class_attribute *attr,
602 const char *buf, size_t count)
603{
604 loading_timeout = simple_strtol(buf, NULL, 10);
605 if (loading_timeout < 0)
606 loading_timeout = 0;
607
608 return count;
609}
610static CLASS_ATTR_RW(timeout);
611
612static struct attribute *firmware_class_attrs[] = {
613 &class_attr_timeout.attr,
614 NULL,
615};
616ATTRIBUTE_GROUPS(firmware_class);
617
618static void fw_dev_release(struct device *dev)
619{
620 struct firmware_priv *fw_priv = to_firmware_priv(dev);
621
622 kfree(fw_priv);
623}
624
625static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
626{
627 if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
628 return -ENOMEM;
629 if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
630 return -ENOMEM;
631 if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
632 return -ENOMEM;
633
634 return 0;
635}
636
637static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
638{
639 struct firmware_priv *fw_priv = to_firmware_priv(dev);
640 int err = 0;
641
642 mutex_lock(&fw_lock);
643 if (fw_priv->buf)
644 err = do_firmware_uevent(fw_priv, env);
645 mutex_unlock(&fw_lock);
646 return err;
647}
648
649static struct class firmware_class = {
650 .name = "firmware",
651 .class_groups = firmware_class_groups,
652 .dev_uevent = firmware_uevent,
653 .dev_release = fw_dev_release,
654};
655
656static ssize_t firmware_loading_show(struct device *dev,
657 struct device_attribute *attr, char *buf)
658{
659 struct firmware_priv *fw_priv = to_firmware_priv(dev);
660 int loading = 0;
661
662 mutex_lock(&fw_lock);
663 if (fw_priv->buf)
664 loading = fw_state_is_loading(&fw_priv->buf->fw_st);
665 mutex_unlock(&fw_lock);
666
667 return sprintf(buf, "%d\n", loading);
668}
669
670/* Some architectures don't have PAGE_KERNEL_RO */
671#ifndef PAGE_KERNEL_RO
672#define PAGE_KERNEL_RO PAGE_KERNEL
673#endif
674
675/* one pages buffer should be mapped/unmapped only once */
676static int fw_map_pages_buf(struct firmware_buf *buf)
677{
678 if (!buf->is_paged_buf)
679 return 0;
680
681 vunmap(buf->data);
682 buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
683 if (!buf->data)
684 return -ENOMEM;
685 return 0;
686}
687
688/**
689 * firmware_loading_store - set value in the 'loading' control file
690 * @dev: device pointer
691 * @attr: device attribute pointer
692 * @buf: buffer to scan for loading control value
693 * @count: number of bytes in @buf
694 *
695 * The relevant values are:
696 *
697 * 1: Start a load, discarding any previous partial load.
698 * 0: Conclude the load and hand the data to the driver code.
699 * -1: Conclude the load with an error and discard any written data.
700 **/
701static ssize_t firmware_loading_store(struct device *dev,
702 struct device_attribute *attr,
703 const char *buf, size_t count)
704{
705 struct firmware_priv *fw_priv = to_firmware_priv(dev);
706 struct firmware_buf *fw_buf;
707 ssize_t written = count;
708 int loading = simple_strtol(buf, NULL, 10);
709 int i;
710
711 mutex_lock(&fw_lock);
712 fw_buf = fw_priv->buf;
713 if (fw_state_is_aborted(&fw_buf->fw_st))
714 goto out;
715
716 switch (loading) {
717 case 1:
718 /* discarding any previous partial load */
719 if (!fw_state_is_done(&fw_buf->fw_st)) {
720 for (i = 0; i < fw_buf->nr_pages; i++)
721 __free_page(fw_buf->pages[i]);
722 vfree(fw_buf->pages);
723 fw_buf->pages = NULL;
724 fw_buf->page_array_size = 0;
725 fw_buf->nr_pages = 0;
726 fw_state_start(&fw_buf->fw_st);
727 }
728 break;
729 case 0:
730 if (fw_state_is_loading(&fw_buf->fw_st)) {
731 int rc;
732
733 /*
734 * Several loading requests may be pending on
735 * one same firmware buf, so let all requests
736 * see the mapped 'buf->data' once the loading
737 * is completed.
738 * */
739 rc = fw_map_pages_buf(fw_buf);
740 if (rc)
741 dev_err(dev, "%s: map pages failed\n",
742 __func__);
743 else
744 rc = security_kernel_post_read_file(NULL,
745 fw_buf->data, fw_buf->size,
746 READING_FIRMWARE);
747
748 /*
749 * Same logic as fw_load_abort, only the DONE bit
750 * is ignored and we set ABORT only on failure.
751 */
752 list_del_init(&fw_buf->pending_list);
753 if (rc) {
754 fw_state_aborted(&fw_buf->fw_st);
755 written = rc;
756 } else {
757 fw_state_done(&fw_buf->fw_st);
758 }
759 break;
760 }
761 /* fallthrough */
762 default:
763 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
764 /* fallthrough */
765 case -1:
766 fw_load_abort(fw_priv);
767 break;
768 }
769out:
770 mutex_unlock(&fw_lock);
771 return written;
772}
773
774static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
775
776static void firmware_rw_buf(struct firmware_buf *buf, char *buffer,
777 loff_t offset, size_t count, bool read)
778{
779 if (read)
780 memcpy(buffer, buf->data + offset, count);
781 else
782 memcpy(buf->data + offset, buffer, count);
783}
784
785static void firmware_rw(struct firmware_buf *buf, char *buffer,
786 loff_t offset, size_t count, bool read)
787{
788 while (count) {
789 void *page_data;
790 int page_nr = offset >> PAGE_SHIFT;
791 int page_ofs = offset & (PAGE_SIZE-1);
792 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
793
794 page_data = kmap(buf->pages[page_nr]);
795
796 if (read)
797 memcpy(buffer, page_data + page_ofs, page_cnt);
798 else
799 memcpy(page_data + page_ofs, buffer, page_cnt);
800
801 kunmap(buf->pages[page_nr]);
802 buffer += page_cnt;
803 offset += page_cnt;
804 count -= page_cnt;
805 }
806}
807
808static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
809 struct bin_attribute *bin_attr,
810 char *buffer, loff_t offset, size_t count)
811{
812 struct device *dev = kobj_to_dev(kobj);
813 struct firmware_priv *fw_priv = to_firmware_priv(dev);
814 struct firmware_buf *buf;
815 ssize_t ret_count;
816
817 mutex_lock(&fw_lock);
818 buf = fw_priv->buf;
819 if (!buf || fw_state_is_done(&buf->fw_st)) {
820 ret_count = -ENODEV;
821 goto out;
822 }
823 if (offset > buf->size) {
824 ret_count = 0;
825 goto out;
826 }
827 if (count > buf->size - offset)
828 count = buf->size - offset;
829
830 ret_count = count;
831
832 if (buf->data)
833 firmware_rw_buf(buf, buffer, offset, count, true);
834 else
835 firmware_rw(buf, buffer, offset, count, true);
836
837out:
838 mutex_unlock(&fw_lock);
839 return ret_count;
840}
841
842static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
843{
844 struct firmware_buf *buf = fw_priv->buf;
845 int pages_needed = PAGE_ALIGN(min_size) >> PAGE_SHIFT;
846
847 /* If the array of pages is too small, grow it... */
848 if (buf->page_array_size < pages_needed) {
849 int new_array_size = max(pages_needed,
850 buf->page_array_size * 2);
851 struct page **new_pages;
852
853 new_pages = vmalloc(new_array_size * sizeof(void *));
854 if (!new_pages) {
855 fw_load_abort(fw_priv);
856 return -ENOMEM;
857 }
858 memcpy(new_pages, buf->pages,
859 buf->page_array_size * sizeof(void *));
860 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
861 (new_array_size - buf->page_array_size));
862 vfree(buf->pages);
863 buf->pages = new_pages;
864 buf->page_array_size = new_array_size;
865 }
866
867 while (buf->nr_pages < pages_needed) {
868 buf->pages[buf->nr_pages] =
869 alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
870
871 if (!buf->pages[buf->nr_pages]) {
872 fw_load_abort(fw_priv);
873 return -ENOMEM;
874 }
875 buf->nr_pages++;
876 }
877 return 0;
878}
879
880/**
881 * firmware_data_write - write method for firmware
882 * @filp: open sysfs file
883 * @kobj: kobject for the device
884 * @bin_attr: bin_attr structure
885 * @buffer: buffer being written
886 * @offset: buffer offset for write in total data store area
887 * @count: buffer size
888 *
889 * Data written to the 'data' attribute will be later handed to
890 * the driver as a firmware image.
891 **/
892static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
893 struct bin_attribute *bin_attr,
894 char *buffer, loff_t offset, size_t count)
895{
896 struct device *dev = kobj_to_dev(kobj);
897 struct firmware_priv *fw_priv = to_firmware_priv(dev);
898 struct firmware_buf *buf;
899 ssize_t retval;
900
901 if (!capable(CAP_SYS_RAWIO))
902 return -EPERM;
903
904 mutex_lock(&fw_lock);
905 buf = fw_priv->buf;
906 if (!buf || fw_state_is_done(&buf->fw_st)) {
907 retval = -ENODEV;
908 goto out;
909 }
910
911 if (buf->data) {
912 if (offset + count > buf->allocated_size) {
913 retval = -ENOMEM;
914 goto out;
915 }
916 firmware_rw_buf(buf, buffer, offset, count, false);
917 retval = count;
918 } else {
919 retval = fw_realloc_buffer(fw_priv, offset + count);
920 if (retval)
921 goto out;
922
923 retval = count;
924 firmware_rw(buf, buffer, offset, count, false);
925 }
926
927 buf->size = max_t(size_t, offset + count, buf->size);
928out:
929 mutex_unlock(&fw_lock);
930 return retval;
931}
932
933static struct bin_attribute firmware_attr_data = {
934 .attr = { .name = "data", .mode = 0644 },
935 .size = 0,
936 .read = firmware_data_read,
937 .write = firmware_data_write,
938};
939
940static struct attribute *fw_dev_attrs[] = {
941 &dev_attr_loading.attr,
942 NULL
943};
944
945static struct bin_attribute *fw_dev_bin_attrs[] = {
946 &firmware_attr_data,
947 NULL
948};
949
950static const struct attribute_group fw_dev_attr_group = {
951 .attrs = fw_dev_attrs,
952 .bin_attrs = fw_dev_bin_attrs,
953};
954
955static const struct attribute_group *fw_dev_attr_groups[] = {
956 &fw_dev_attr_group,
957 NULL
958};
959
960static struct firmware_priv *
961fw_create_instance(struct firmware *firmware, const char *fw_name,
962 struct device *device, unsigned int opt_flags)
963{
964 struct firmware_priv *fw_priv;
965 struct device *f_dev;
966
967 fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
968 if (!fw_priv) {
969 fw_priv = ERR_PTR(-ENOMEM);
970 goto exit;
971 }
972
973 fw_priv->nowait = !!(opt_flags & FW_OPT_NOWAIT);
974 fw_priv->fw = firmware;
975 f_dev = &fw_priv->dev;
976
977 device_initialize(f_dev);
978 dev_set_name(f_dev, "%s", fw_name);
979 f_dev->parent = device;
980 f_dev->class = &firmware_class;
981 f_dev->groups = fw_dev_attr_groups;
982exit:
983 return fw_priv;
984}
985
986/* load a firmware via user helper */
987static int _request_firmware_load(struct firmware_priv *fw_priv,
988 unsigned int opt_flags, long timeout)
989{
990 int retval = 0;
991 struct device *f_dev = &fw_priv->dev;
992 struct firmware_buf *buf = fw_priv->buf;
993
994 /* fall back on userspace loading */
995 if (!buf->data)
996 buf->is_paged_buf = true;
997
998 dev_set_uevent_suppress(f_dev, true);
999
1000 retval = device_add(f_dev);
1001 if (retval) {
1002 dev_err(f_dev, "%s: device_register failed\n", __func__);
1003 goto err_put_dev;
1004 }
1005
1006 mutex_lock(&fw_lock);
1007 list_add(&buf->pending_list, &pending_fw_head);
1008 mutex_unlock(&fw_lock);
1009
1010 if (opt_flags & FW_OPT_UEVENT) {
1011 buf->need_uevent = true;
1012 dev_set_uevent_suppress(f_dev, false);
1013 dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
1014 kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
1015 } else {
1016 timeout = MAX_JIFFY_OFFSET;
1017 }
1018
1019 retval = fw_state_wait_timeout(&buf->fw_st, timeout);
1020 if (retval < 0) {
1021 mutex_lock(&fw_lock);
1022 fw_load_abort(fw_priv);
1023 mutex_unlock(&fw_lock);
1024 }
1025
1026 if (fw_state_is_aborted(&buf->fw_st))
1027 retval = -EAGAIN;
1028 else if (buf->is_paged_buf && !buf->data)
1029 retval = -ENOMEM;
1030
1031 device_del(f_dev);
1032err_put_dev:
1033 put_device(f_dev);
1034 return retval;
1035}
1036
1037static int fw_load_from_user_helper(struct firmware *firmware,
1038 const char *name, struct device *device,
1039 unsigned int opt_flags, long timeout)
1040{
1041 struct firmware_priv *fw_priv;
1042
1043 fw_priv = fw_create_instance(firmware, name, device, opt_flags);
1044 if (IS_ERR(fw_priv))
1045 return PTR_ERR(fw_priv);
1046
1047 fw_priv->buf = firmware->priv;
1048 return _request_firmware_load(fw_priv, opt_flags, timeout);
1049}
1050
1051#ifdef CONFIG_PM_SLEEP
1052/* kill pending requests without uevent to avoid blocking suspend */
1053static void kill_requests_without_uevent(void)
1054{
1055 struct firmware_buf *buf;
1056 struct firmware_buf *next;
1057
1058 mutex_lock(&fw_lock);
1059 list_for_each_entry_safe(buf, next, &pending_fw_head, pending_list) {
1060 if (!buf->need_uevent)
1061 __fw_load_abort(buf);
1062 }
1063 mutex_unlock(&fw_lock);
1064}
1065#endif
1066
1067#else /* CONFIG_FW_LOADER_USER_HELPER */
1068static inline int
1069fw_load_from_user_helper(struct firmware *firmware, const char *name,
1070 struct device *device, unsigned int opt_flags,
1071 long timeout)
1072{
1073 return -ENOENT;
1074}
1075
1076#ifdef CONFIG_PM_SLEEP
1077static inline void kill_requests_without_uevent(void) { }
1078#endif
1079
1080#endif /* CONFIG_FW_LOADER_USER_HELPER */
1081
1082/* prepare firmware and firmware_buf structs;
1083 * return 0 if a firmware is already assigned, 1 if need to load one,
1084 * or a negative error code
1085 */
1086static int
1087_request_firmware_prepare(struct firmware **firmware_p, const char *name,
1088 struct device *device, void *dbuf, size_t size)
1089{
1090 struct firmware *firmware;
1091 struct firmware_buf *buf;
1092 int ret;
1093
1094 *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
1095 if (!firmware) {
1096 dev_err(device, "%s: kmalloc(struct firmware) failed\n",
1097 __func__);
1098 return -ENOMEM;
1099 }
1100
1101 if (fw_get_builtin_firmware(firmware, name, dbuf, size)) {
1102 dev_dbg(device, "using built-in %s\n", name);
1103 return 0; /* assigned */
1104 }
1105
1106 ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf, dbuf, size);
1107
1108 /*
1109 * bind with 'buf' now to avoid warning in failure path
1110 * of requesting firmware.
1111 */
1112 firmware->priv = buf;
1113
1114 if (ret > 0) {
1115 ret = fw_state_wait(&buf->fw_st);
1116 if (!ret) {
1117 fw_set_page_data(buf, firmware);
1118 return 0; /* assigned */
1119 }
1120 }
1121
1122 if (ret < 0)
1123 return ret;
1124 return 1; /* need to load */
1125}
1126
1127static int assign_firmware_buf(struct firmware *fw, struct device *device,
1128 unsigned int opt_flags)
1129{
1130 struct firmware_buf *buf = fw->priv;
1131
1132 mutex_lock(&fw_lock);
1133 if (!buf->size || fw_state_is_aborted(&buf->fw_st)) {
1134 mutex_unlock(&fw_lock);
1135 return -ENOENT;
1136 }
1137
1138 /*
1139 * add firmware name into devres list so that we can auto cache
1140 * and uncache firmware for device.
1141 *
1142 * device may has been deleted already, but the problem
1143 * should be fixed in devres or driver core.
1144 */
1145 /* don't cache firmware handled without uevent */
1146 if (device && (opt_flags & FW_OPT_UEVENT) &&
1147 !(opt_flags & FW_OPT_NOCACHE))
1148 fw_add_devm_name(device, buf->fw_id);
1149
1150 /*
1151 * After caching firmware image is started, let it piggyback
1152 * on request firmware.
1153 */
1154 if (!(opt_flags & FW_OPT_NOCACHE) &&
1155 buf->fwc->state == FW_LOADER_START_CACHE) {
1156 if (fw_cache_piggyback_on_request(buf->fw_id))
1157 kref_get(&buf->ref);
1158 }
1159
1160 /* pass the pages buffer to driver at the last minute */
1161 fw_set_page_data(buf, fw);
1162 mutex_unlock(&fw_lock);
1163 return 0;
1164}
1165
1166/* called from request_firmware() and request_firmware_work_func() */
1167static int
1168_request_firmware(const struct firmware **firmware_p, const char *name,
1169 struct device *device, void *buf, size_t size,
1170 unsigned int opt_flags)
1171{
1172 struct firmware *fw = NULL;
1173 long timeout;
1174 int ret;
1175
1176 if (!firmware_p)
1177 return -EINVAL;
1178
1179 if (!name || name[0] == '\0') {
1180 ret = -EINVAL;
1181 goto out;
1182 }
1183
1184 ret = _request_firmware_prepare(&fw, name, device, buf, size);
1185 if (ret <= 0) /* error or already assigned */
1186 goto out;
1187
1188 ret = 0;
1189 timeout = firmware_loading_timeout();
1190 if (opt_flags & FW_OPT_NOWAIT) {
1191 timeout = usermodehelper_read_lock_wait(timeout);
1192 if (!timeout) {
1193 dev_dbg(device, "firmware: %s loading timed out\n",
1194 name);
1195 ret = -EBUSY;
1196 goto out;
1197 }
1198 } else {
1199 ret = usermodehelper_read_trylock();
1200 if (WARN_ON(ret)) {
1201 dev_err(device, "firmware: %s will not be loaded\n",
1202 name);
1203 goto out;
1204 }
1205 }
1206
1207 ret = fw_get_filesystem_firmware(device, fw->priv);
1208 if (ret) {
1209 if (!(opt_flags & FW_OPT_NO_WARN))
1210 dev_warn(device,
1211 "Direct firmware load for %s failed with error %d\n",
1212 name, ret);
1213 if (opt_flags & FW_OPT_USERHELPER) {
1214 dev_warn(device, "Falling back to user helper\n");
1215 ret = fw_load_from_user_helper(fw, name, device,
1216 opt_flags, timeout);
1217 }
1218 }
1219
1220 if (!ret)
1221 ret = assign_firmware_buf(fw, device, opt_flags);
1222
1223 usermodehelper_read_unlock();
1224
1225 out:
1226 if (ret < 0) {
1227 release_firmware(fw);
1228 fw = NULL;
1229 }
1230
1231 *firmware_p = fw;
1232 return ret;
1233}
1234
1235/**
1236 * request_firmware: - send firmware request and wait for it
1237 * @firmware_p: pointer to firmware image
1238 * @name: name of firmware file
1239 * @device: device for which firmware is being loaded
1240 *
1241 * @firmware_p will be used to return a firmware image by the name
1242 * of @name for device @device.
1243 *
1244 * Should be called from user context where sleeping is allowed.
1245 *
1246 * @name will be used as $FIRMWARE in the uevent environment and
1247 * should be distinctive enough not to be confused with any other
1248 * firmware image for this or any other device.
1249 *
1250 * Caller must hold the reference count of @device.
1251 *
1252 * The function can be called safely inside device's suspend and
1253 * resume callback.
1254 **/
1255int
1256request_firmware(const struct firmware **firmware_p, const char *name,
1257 struct device *device)
1258{
1259 int ret;
1260
1261 /* Need to pin this module until return */
1262 __module_get(THIS_MODULE);
1263 ret = _request_firmware(firmware_p, name, device, NULL, 0,
1264 FW_OPT_UEVENT | FW_OPT_FALLBACK);
1265 module_put(THIS_MODULE);
1266 return ret;
1267}
1268EXPORT_SYMBOL(request_firmware);
1269
1270/**
1271 * request_firmware_direct: - load firmware directly without usermode helper
1272 * @firmware_p: pointer to firmware image
1273 * @name: name of firmware file
1274 * @device: device for which firmware is being loaded
1275 *
1276 * This function works pretty much like request_firmware(), but this doesn't
1277 * fall back to usermode helper even if the firmware couldn't be loaded
1278 * directly from fs. Hence it's useful for loading optional firmwares, which
1279 * aren't always present, without extra long timeouts of udev.
1280 **/
1281int request_firmware_direct(const struct firmware **firmware_p,
1282 const char *name, struct device *device)
1283{
1284 int ret;
1285
1286 __module_get(THIS_MODULE);
1287 ret = _request_firmware(firmware_p, name, device, NULL, 0,
1288 FW_OPT_UEVENT | FW_OPT_NO_WARN);
1289 module_put(THIS_MODULE);
1290 return ret;
1291}
1292EXPORT_SYMBOL_GPL(request_firmware_direct);
1293
1294/**
1295 * request_firmware_into_buf - load firmware into a previously allocated buffer
1296 * @firmware_p: pointer to firmware image
1297 * @name: name of firmware file
1298 * @device: device for which firmware is being loaded and DMA region allocated
1299 * @buf: address of buffer to load firmware into
1300 * @size: size of buffer
1301 *
1302 * This function works pretty much like request_firmware(), but it doesn't
1303 * allocate a buffer to hold the firmware data. Instead, the firmware
1304 * is loaded directly into the buffer pointed to by @buf and the @firmware_p
1305 * data member is pointed at @buf.
1306 *
1307 * This function doesn't cache firmware either.
1308 */
1309int
1310request_firmware_into_buf(const struct firmware **firmware_p, const char *name,
1311 struct device *device, void *buf, size_t size)
1312{
1313 int ret;
1314
1315 __module_get(THIS_MODULE);
1316 ret = _request_firmware(firmware_p, name, device, buf, size,
1317 FW_OPT_UEVENT | FW_OPT_FALLBACK |
1318 FW_OPT_NOCACHE);
1319 module_put(THIS_MODULE);
1320 return ret;
1321}
1322EXPORT_SYMBOL(request_firmware_into_buf);
1323
1324/**
1325 * release_firmware: - release the resource associated with a firmware image
1326 * @fw: firmware resource to release
1327 **/
1328void release_firmware(const struct firmware *fw)
1329{
1330 if (fw) {
1331 if (!fw_is_builtin_firmware(fw))
1332 firmware_free_data(fw);
1333 kfree(fw);
1334 }
1335}
1336EXPORT_SYMBOL(release_firmware);
1337
1338/* Async support */
1339struct firmware_work {
1340 struct work_struct work;
1341 struct module *module;
1342 const char *name;
1343 struct device *device;
1344 void *context;
1345 void (*cont)(const struct firmware *fw, void *context);
1346 unsigned int opt_flags;
1347};
1348
1349static void request_firmware_work_func(struct work_struct *work)
1350{
1351 struct firmware_work *fw_work;
1352 const struct firmware *fw;
1353
1354 fw_work = container_of(work, struct firmware_work, work);
1355
1356 _request_firmware(&fw, fw_work->name, fw_work->device, NULL, 0,
1357 fw_work->opt_flags);
1358 fw_work->cont(fw, fw_work->context);
1359 put_device(fw_work->device); /* taken in request_firmware_nowait() */
1360
1361 module_put(fw_work->module);
1362 kfree_const(fw_work->name);
1363 kfree(fw_work);
1364}
1365
1366/**
1367 * request_firmware_nowait - asynchronous version of request_firmware
1368 * @module: module requesting the firmware
1369 * @uevent: sends uevent to copy the firmware image if this flag
1370 * is non-zero else the firmware copy must be done manually.
1371 * @name: name of firmware file
1372 * @device: device for which firmware is being loaded
1373 * @gfp: allocation flags
1374 * @context: will be passed over to @cont, and
1375 * @fw may be %NULL if firmware request fails.
1376 * @cont: function will be called asynchronously when the firmware
1377 * request is over.
1378 *
1379 * Caller must hold the reference count of @device.
1380 *
1381 * Asynchronous variant of request_firmware() for user contexts:
1382 * - sleep for as small periods as possible since it may
1383 * increase kernel boot time of built-in device drivers
1384 * requesting firmware in their ->probe() methods, if
1385 * @gfp is GFP_KERNEL.
1386 *
1387 * - can't sleep at all if @gfp is GFP_ATOMIC.
1388 **/
1389int
1390request_firmware_nowait(
1391 struct module *module, bool uevent,
1392 const char *name, struct device *device, gfp_t gfp, void *context,
1393 void (*cont)(const struct firmware *fw, void *context))
1394{
1395 struct firmware_work *fw_work;
1396
1397 fw_work = kzalloc(sizeof(struct firmware_work), gfp);
1398 if (!fw_work)
1399 return -ENOMEM;
1400
1401 fw_work->module = module;
1402 fw_work->name = kstrdup_const(name, gfp);
1403 if (!fw_work->name) {
1404 kfree(fw_work);
1405 return -ENOMEM;
1406 }
1407 fw_work->device = device;
1408 fw_work->context = context;
1409 fw_work->cont = cont;
1410 fw_work->opt_flags = FW_OPT_NOWAIT | FW_OPT_FALLBACK |
1411 (uevent ? FW_OPT_UEVENT : FW_OPT_USERHELPER);
1412
1413 if (!try_module_get(module)) {
1414 kfree_const(fw_work->name);
1415 kfree(fw_work);
1416 return -EFAULT;
1417 }
1418
1419 get_device(fw_work->device);
1420 INIT_WORK(&fw_work->work, request_firmware_work_func);
1421 schedule_work(&fw_work->work);
1422 return 0;
1423}
1424EXPORT_SYMBOL(request_firmware_nowait);
1425
1426#ifdef CONFIG_PM_SLEEP
1427static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);
1428
1429/**
1430 * cache_firmware - cache one firmware image in kernel memory space
1431 * @fw_name: the firmware image name
1432 *
1433 * Cache firmware in kernel memory so that drivers can use it when
1434 * system isn't ready for them to request firmware image from userspace.
1435 * Once it returns successfully, driver can use request_firmware or its
1436 * nowait version to get the cached firmware without any interacting
1437 * with userspace
1438 *
1439 * Return 0 if the firmware image has been cached successfully
1440 * Return !0 otherwise
1441 *
1442 */
1443static int cache_firmware(const char *fw_name)
1444{
1445 int ret;
1446 const struct firmware *fw;
1447
1448 pr_debug("%s: %s\n", __func__, fw_name);
1449
1450 ret = request_firmware(&fw, fw_name, NULL);
1451 if (!ret)
1452 kfree(fw);
1453
1454 pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);
1455
1456 return ret;
1457}
1458
1459static struct firmware_buf *fw_lookup_buf(const char *fw_name)
1460{
1461 struct firmware_buf *tmp;
1462 struct firmware_cache *fwc = &fw_cache;
1463
1464 spin_lock(&fwc->lock);
1465 tmp = __fw_lookup_buf(fw_name);
1466 spin_unlock(&fwc->lock);
1467
1468 return tmp;
1469}
1470
1471/**
1472 * uncache_firmware - remove one cached firmware image
1473 * @fw_name: the firmware image name
1474 *
1475 * Uncache one firmware image which has been cached successfully
1476 * before.
1477 *
1478 * Return 0 if the firmware cache has been removed successfully
1479 * Return !0 otherwise
1480 *
1481 */
1482static int uncache_firmware(const char *fw_name)
1483{
1484 struct firmware_buf *buf;
1485 struct firmware fw;
1486
1487 pr_debug("%s: %s\n", __func__, fw_name);
1488
1489 if (fw_get_builtin_firmware(&fw, fw_name, NULL, 0))
1490 return 0;
1491
1492 buf = fw_lookup_buf(fw_name);
1493 if (buf) {
1494 fw_free_buf(buf);
1495 return 0;
1496 }
1497
1498 return -EINVAL;
1499}
1500
1501static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
1502{
1503 struct fw_cache_entry *fce;
1504
1505 fce = kzalloc(sizeof(*fce), GFP_ATOMIC);
1506 if (!fce)
1507 goto exit;
1508
1509 fce->name = kstrdup_const(name, GFP_ATOMIC);
1510 if (!fce->name) {
1511 kfree(fce);
1512 fce = NULL;
1513 goto exit;
1514 }
1515exit:
1516 return fce;
1517}
1518
1519static int __fw_entry_found(const char *name)
1520{
1521 struct firmware_cache *fwc = &fw_cache;
1522 struct fw_cache_entry *fce;
1523
1524 list_for_each_entry(fce, &fwc->fw_names, list) {
1525 if (!strcmp(fce->name, name))
1526 return 1;
1527 }
1528 return 0;
1529}
1530
1531static int fw_cache_piggyback_on_request(const char *name)
1532{
1533 struct firmware_cache *fwc = &fw_cache;
1534 struct fw_cache_entry *fce;
1535 int ret = 0;
1536
1537 spin_lock(&fwc->name_lock);
1538 if (__fw_entry_found(name))
1539 goto found;
1540
1541 fce = alloc_fw_cache_entry(name);
1542 if (fce) {
1543 ret = 1;
1544 list_add(&fce->list, &fwc->fw_names);
1545 pr_debug("%s: fw: %s\n", __func__, name);
1546 }
1547found:
1548 spin_unlock(&fwc->name_lock);
1549 return ret;
1550}
1551
1552static void free_fw_cache_entry(struct fw_cache_entry *fce)
1553{
1554 kfree_const(fce->name);
1555 kfree(fce);
1556}
1557
1558static void __async_dev_cache_fw_image(void *fw_entry,
1559 async_cookie_t cookie)
1560{
1561 struct fw_cache_entry *fce = fw_entry;
1562 struct firmware_cache *fwc = &fw_cache;
1563 int ret;
1564
1565 ret = cache_firmware(fce->name);
1566 if (ret) {
1567 spin_lock(&fwc->name_lock);
1568 list_del(&fce->list);
1569 spin_unlock(&fwc->name_lock);
1570
1571 free_fw_cache_entry(fce);
1572 }
1573}
1574
1575/* called with dev->devres_lock held */
1576static void dev_create_fw_entry(struct device *dev, void *res,
1577 void *data)
1578{
1579 struct fw_name_devm *fwn = res;
1580 const char *fw_name = fwn->name;
1581 struct list_head *head = data;
1582 struct fw_cache_entry *fce;
1583
1584 fce = alloc_fw_cache_entry(fw_name);
1585 if (fce)
1586 list_add(&fce->list, head);
1587}
1588
1589static int devm_name_match(struct device *dev, void *res,
1590 void *match_data)
1591{
1592 struct fw_name_devm *fwn = res;
1593 return (fwn->magic == (unsigned long)match_data);
1594}
1595
1596static void dev_cache_fw_image(struct device *dev, void *data)
1597{
1598 LIST_HEAD(todo);
1599 struct fw_cache_entry *fce;
1600 struct fw_cache_entry *fce_next;
1601 struct firmware_cache *fwc = &fw_cache;
1602
1603 devres_for_each_res(dev, fw_name_devm_release,
1604 devm_name_match, &fw_cache,
1605 dev_create_fw_entry, &todo);
1606
1607 list_for_each_entry_safe(fce, fce_next, &todo, list) {
1608 list_del(&fce->list);
1609
1610 spin_lock(&fwc->name_lock);
1611 /* only one cache entry for one firmware */
1612 if (!__fw_entry_found(fce->name)) {
1613 list_add(&fce->list, &fwc->fw_names);
1614 } else {
1615 free_fw_cache_entry(fce);
1616 fce = NULL;
1617 }
1618 spin_unlock(&fwc->name_lock);
1619
1620 if (fce)
1621 async_schedule_domain(__async_dev_cache_fw_image,
1622 (void *)fce,
1623 &fw_cache_domain);
1624 }
1625}
1626
1627static void __device_uncache_fw_images(void)
1628{
1629 struct firmware_cache *fwc = &fw_cache;
1630 struct fw_cache_entry *fce;
1631
1632 spin_lock(&fwc->name_lock);
1633 while (!list_empty(&fwc->fw_names)) {
1634 fce = list_entry(fwc->fw_names.next,
1635 struct fw_cache_entry, list);
1636 list_del(&fce->list);
1637 spin_unlock(&fwc->name_lock);
1638
1639 uncache_firmware(fce->name);
1640 free_fw_cache_entry(fce);
1641
1642 spin_lock(&fwc->name_lock);
1643 }
1644 spin_unlock(&fwc->name_lock);
1645}
1646
1647/**
1648 * device_cache_fw_images - cache devices' firmware
1649 *
1650 * If one device called request_firmware or its nowait version
1651 * successfully before, the firmware names are recored into the
1652 * device's devres link list, so device_cache_fw_images can call
1653 * cache_firmware() to cache these firmwares for the device,
1654 * then the device driver can load its firmwares easily at
1655 * time when system is not ready to complete loading firmware.
1656 */
1657static void device_cache_fw_images(void)
1658{
1659 struct firmware_cache *fwc = &fw_cache;
1660 int old_timeout;
1661 DEFINE_WAIT(wait);
1662
1663 pr_debug("%s\n", __func__);
1664
1665 /* cancel uncache work */
1666 cancel_delayed_work_sync(&fwc->work);
1667
1668 /*
1669 * use small loading timeout for caching devices' firmware
1670 * because all these firmware images have been loaded
1671 * successfully at lease once, also system is ready for
1672 * completing firmware loading now. The maximum size of
1673 * firmware in current distributions is about 2M bytes,
1674 * so 10 secs should be enough.
1675 */
1676 old_timeout = loading_timeout;
1677 loading_timeout = 10;
1678
1679 mutex_lock(&fw_lock);
1680 fwc->state = FW_LOADER_START_CACHE;
1681 dpm_for_each_dev(NULL, dev_cache_fw_image);
1682 mutex_unlock(&fw_lock);
1683
1684 /* wait for completion of caching firmware for all devices */
1685 async_synchronize_full_domain(&fw_cache_domain);
1686
1687 loading_timeout = old_timeout;
1688}
1689
1690/**
1691 * device_uncache_fw_images - uncache devices' firmware
1692 *
1693 * uncache all firmwares which have been cached successfully
1694 * by device_uncache_fw_images earlier
1695 */
1696static void device_uncache_fw_images(void)
1697{
1698 pr_debug("%s\n", __func__);
1699 __device_uncache_fw_images();
1700}
1701
1702static void device_uncache_fw_images_work(struct work_struct *work)
1703{
1704 device_uncache_fw_images();
1705}
1706
1707/**
1708 * device_uncache_fw_images_delay - uncache devices firmwares
1709 * @delay: number of milliseconds to delay uncache device firmwares
1710 *
1711 * uncache all devices's firmwares which has been cached successfully
1712 * by device_cache_fw_images after @delay milliseconds.
1713 */
1714static void device_uncache_fw_images_delay(unsigned long delay)
1715{
1716 queue_delayed_work(system_power_efficient_wq, &fw_cache.work,
1717 msecs_to_jiffies(delay));
1718}
1719
1720static int fw_pm_notify(struct notifier_block *notify_block,
1721 unsigned long mode, void *unused)
1722{
1723 switch (mode) {
1724 case PM_HIBERNATION_PREPARE:
1725 case PM_SUSPEND_PREPARE:
1726 case PM_RESTORE_PREPARE:
1727 kill_requests_without_uevent();
1728 device_cache_fw_images();
1729 break;
1730
1731 case PM_POST_SUSPEND:
1732 case PM_POST_HIBERNATION:
1733 case PM_POST_RESTORE:
1734 /*
1735 * In case that system sleep failed and syscore_suspend is
1736 * not called.
1737 */
1738 mutex_lock(&fw_lock);
1739 fw_cache.state = FW_LOADER_NO_CACHE;
1740 mutex_unlock(&fw_lock);
1741
1742 device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
1743 break;
1744 }
1745
1746 return 0;
1747}
1748
1749/* stop caching firmware once syscore_suspend is reached */
1750static int fw_suspend(void)
1751{
1752 fw_cache.state = FW_LOADER_NO_CACHE;
1753 return 0;
1754}
1755
1756static struct syscore_ops fw_syscore_ops = {
1757 .suspend = fw_suspend,
1758};
1759#else
1760static int fw_cache_piggyback_on_request(const char *name)
1761{
1762 return 0;
1763}
1764#endif
1765
1766static void __init fw_cache_init(void)
1767{
1768 spin_lock_init(&fw_cache.lock);
1769 INIT_LIST_HEAD(&fw_cache.head);
1770 fw_cache.state = FW_LOADER_NO_CACHE;
1771
1772#ifdef CONFIG_PM_SLEEP
1773 spin_lock_init(&fw_cache.name_lock);
1774 INIT_LIST_HEAD(&fw_cache.fw_names);
1775
1776 INIT_DELAYED_WORK(&fw_cache.work,
1777 device_uncache_fw_images_work);
1778
1779 fw_cache.pm_notify.notifier_call = fw_pm_notify;
1780 register_pm_notifier(&fw_cache.pm_notify);
1781
1782 register_syscore_ops(&fw_syscore_ops);
1783#endif
1784}
1785
1786static int __init firmware_class_init(void)
1787{
1788 fw_cache_init();
1789#ifdef CONFIG_FW_LOADER_USER_HELPER
1790 register_reboot_notifier(&fw_shutdown_nb);
1791 return class_register(&firmware_class);
1792#else
1793 return 0;
1794#endif
1795}
1796
1797static void __exit firmware_class_exit(void)
1798{
1799#ifdef CONFIG_PM_SLEEP
1800 unregister_syscore_ops(&fw_syscore_ops);
1801 unregister_pm_notifier(&fw_cache.pm_notify);
1802#endif
1803#ifdef CONFIG_FW_LOADER_USER_HELPER
1804 unregister_reboot_notifier(&fw_shutdown_nb);
1805 class_unregister(&firmware_class);
1806#endif
1807}
1808
1809fs_initcall(firmware_class_init);
1810module_exit(firmware_class_exit);