Loading...
1/*
2 * firmware_class.c - Multi purpose firmware loading support
3 *
4 * Copyright (c) 2003 Manuel Estrada Sainz
5 *
6 * Please see Documentation/firmware_class/ for more information.
7 *
8 */
9
10#include <linux/capability.h>
11#include <linux/device.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/timer.h>
15#include <linux/vmalloc.h>
16#include <linux/interrupt.h>
17#include <linux/bitops.h>
18#include <linux/mutex.h>
19#include <linux/workqueue.h>
20#include <linux/highmem.h>
21#include <linux/firmware.h>
22#include <linux/slab.h>
23#include <linux/sched.h>
24#include <linux/file.h>
25#include <linux/list.h>
26#include <linux/fs.h>
27#include <linux/async.h>
28#include <linux/pm.h>
29#include <linux/suspend.h>
30#include <linux/syscore_ops.h>
31#include <linux/reboot.h>
32#include <linux/security.h>
33
34#include <generated/utsrelease.h>
35
36#include "base.h"
37
38MODULE_AUTHOR("Manuel Estrada Sainz");
39MODULE_DESCRIPTION("Multi purpose firmware loading support");
40MODULE_LICENSE("GPL");
41
42/* Builtin firmware support */
43
44#ifdef CONFIG_FW_LOADER
45
46extern struct builtin_fw __start_builtin_fw[];
47extern struct builtin_fw __end_builtin_fw[];
48
49static bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
50{
51 struct builtin_fw *b_fw;
52
53 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
54 if (strcmp(name, b_fw->name) == 0) {
55 fw->size = b_fw->size;
56 fw->data = b_fw->data;
57 return true;
58 }
59 }
60
61 return false;
62}
63
64static bool fw_is_builtin_firmware(const struct firmware *fw)
65{
66 struct builtin_fw *b_fw;
67
68 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
69 if (fw->data == b_fw->data)
70 return true;
71
72 return false;
73}
74
75#else /* Module case - no builtin firmware support */
76
77static inline bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
78{
79 return false;
80}
81
82static inline bool fw_is_builtin_firmware(const struct firmware *fw)
83{
84 return false;
85}
86#endif
87
88enum {
89 FW_STATUS_LOADING,
90 FW_STATUS_DONE,
91 FW_STATUS_ABORT,
92};
93
94static int loading_timeout = 60; /* In seconds */
95
96static inline long firmware_loading_timeout(void)
97{
98 return loading_timeout > 0 ? loading_timeout * HZ : MAX_JIFFY_OFFSET;
99}
100
101/* firmware behavior options */
102#define FW_OPT_UEVENT (1U << 0)
103#define FW_OPT_NOWAIT (1U << 1)
104#ifdef CONFIG_FW_LOADER_USER_HELPER
105#define FW_OPT_USERHELPER (1U << 2)
106#else
107#define FW_OPT_USERHELPER 0
108#endif
109#ifdef CONFIG_FW_LOADER_USER_HELPER_FALLBACK
110#define FW_OPT_FALLBACK FW_OPT_USERHELPER
111#else
112#define FW_OPT_FALLBACK 0
113#endif
114#define FW_OPT_NO_WARN (1U << 3)
115
116struct firmware_cache {
117 /* firmware_buf instance will be added into the below list */
118 spinlock_t lock;
119 struct list_head head;
120 int state;
121
122#ifdef CONFIG_PM_SLEEP
123 /*
124 * Names of firmware images which have been cached successfully
125 * will be added into the below list so that device uncache
126 * helper can trace which firmware images have been cached
127 * before.
128 */
129 spinlock_t name_lock;
130 struct list_head fw_names;
131
132 struct delayed_work work;
133
134 struct notifier_block pm_notify;
135#endif
136};
137
138struct firmware_buf {
139 struct kref ref;
140 struct list_head list;
141 struct completion completion;
142 struct firmware_cache *fwc;
143 unsigned long status;
144 void *data;
145 size_t size;
146#ifdef CONFIG_FW_LOADER_USER_HELPER
147 bool is_paged_buf;
148 bool need_uevent;
149 struct page **pages;
150 int nr_pages;
151 int page_array_size;
152 struct list_head pending_list;
153#endif
154 const char *fw_id;
155};
156
157struct fw_cache_entry {
158 struct list_head list;
159 const char *name;
160};
161
162struct fw_name_devm {
163 unsigned long magic;
164 const char *name;
165};
166
167#define to_fwbuf(d) container_of(d, struct firmware_buf, ref)
168
169#define FW_LOADER_NO_CACHE 0
170#define FW_LOADER_START_CACHE 1
171
172static int fw_cache_piggyback_on_request(const char *name);
173
174/* fw_lock could be moved to 'struct firmware_priv' but since it is just
175 * guarding for corner cases a global lock should be OK */
176static DEFINE_MUTEX(fw_lock);
177
178static struct firmware_cache fw_cache;
179
180static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
181 struct firmware_cache *fwc)
182{
183 struct firmware_buf *buf;
184
185 buf = kzalloc(sizeof(*buf), GFP_ATOMIC);
186 if (!buf)
187 return NULL;
188
189 buf->fw_id = kstrdup_const(fw_name, GFP_ATOMIC);
190 if (!buf->fw_id) {
191 kfree(buf);
192 return NULL;
193 }
194
195 kref_init(&buf->ref);
196 buf->fwc = fwc;
197 init_completion(&buf->completion);
198#ifdef CONFIG_FW_LOADER_USER_HELPER
199 INIT_LIST_HEAD(&buf->pending_list);
200#endif
201
202 pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
203
204 return buf;
205}
206
207static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
208{
209 struct firmware_buf *tmp;
210 struct firmware_cache *fwc = &fw_cache;
211
212 list_for_each_entry(tmp, &fwc->head, list)
213 if (!strcmp(tmp->fw_id, fw_name))
214 return tmp;
215 return NULL;
216}
217
218static int fw_lookup_and_allocate_buf(const char *fw_name,
219 struct firmware_cache *fwc,
220 struct firmware_buf **buf)
221{
222 struct firmware_buf *tmp;
223
224 spin_lock(&fwc->lock);
225 tmp = __fw_lookup_buf(fw_name);
226 if (tmp) {
227 kref_get(&tmp->ref);
228 spin_unlock(&fwc->lock);
229 *buf = tmp;
230 return 1;
231 }
232 tmp = __allocate_fw_buf(fw_name, fwc);
233 if (tmp)
234 list_add(&tmp->list, &fwc->head);
235 spin_unlock(&fwc->lock);
236
237 *buf = tmp;
238
239 return tmp ? 0 : -ENOMEM;
240}
241
242static void __fw_free_buf(struct kref *ref)
243 __releases(&fwc->lock)
244{
245 struct firmware_buf *buf = to_fwbuf(ref);
246 struct firmware_cache *fwc = buf->fwc;
247
248 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
249 __func__, buf->fw_id, buf, buf->data,
250 (unsigned int)buf->size);
251
252 list_del(&buf->list);
253 spin_unlock(&fwc->lock);
254
255#ifdef CONFIG_FW_LOADER_USER_HELPER
256 if (buf->is_paged_buf) {
257 int i;
258 vunmap(buf->data);
259 for (i = 0; i < buf->nr_pages; i++)
260 __free_page(buf->pages[i]);
261 vfree(buf->pages);
262 } else
263#endif
264 vfree(buf->data);
265 kfree_const(buf->fw_id);
266 kfree(buf);
267}
268
269static void fw_free_buf(struct firmware_buf *buf)
270{
271 struct firmware_cache *fwc = buf->fwc;
272 spin_lock(&fwc->lock);
273 if (!kref_put(&buf->ref, __fw_free_buf))
274 spin_unlock(&fwc->lock);
275}
276
277/* direct firmware loading support */
278static char fw_path_para[256];
279static const char * const fw_path[] = {
280 fw_path_para,
281 "/lib/firmware/updates/" UTS_RELEASE,
282 "/lib/firmware/updates",
283 "/lib/firmware/" UTS_RELEASE,
284 "/lib/firmware"
285};
286
287/*
288 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
289 * from kernel command line because firmware_class is generally built in
290 * kernel instead of module.
291 */
292module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644);
293MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path");
294
295static void fw_finish_direct_load(struct device *device,
296 struct firmware_buf *buf)
297{
298 mutex_lock(&fw_lock);
299 set_bit(FW_STATUS_DONE, &buf->status);
300 complete_all(&buf->completion);
301 mutex_unlock(&fw_lock);
302}
303
304static int fw_get_filesystem_firmware(struct device *device,
305 struct firmware_buf *buf)
306{
307 loff_t size;
308 int i, len;
309 int rc = -ENOENT;
310 char *path;
311
312 path = __getname();
313 if (!path)
314 return -ENOMEM;
315
316 for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
317 /* skip the unset customized path */
318 if (!fw_path[i][0])
319 continue;
320
321 len = snprintf(path, PATH_MAX, "%s/%s",
322 fw_path[i], buf->fw_id);
323 if (len >= PATH_MAX) {
324 rc = -ENAMETOOLONG;
325 break;
326 }
327
328 buf->size = 0;
329 rc = kernel_read_file_from_path(path, &buf->data, &size,
330 INT_MAX, READING_FIRMWARE);
331 if (rc) {
332 if (rc == -ENOENT)
333 dev_dbg(device, "loading %s failed with error %d\n",
334 path, rc);
335 else
336 dev_warn(device, "loading %s failed with error %d\n",
337 path, rc);
338 continue;
339 }
340 dev_dbg(device, "direct-loading %s\n", buf->fw_id);
341 buf->size = size;
342 fw_finish_direct_load(device, buf);
343 break;
344 }
345 __putname(path);
346
347 return rc;
348}
349
350/* firmware holds the ownership of pages */
351static void firmware_free_data(const struct firmware *fw)
352{
353 /* Loaded directly? */
354 if (!fw->priv) {
355 vfree(fw->data);
356 return;
357 }
358 fw_free_buf(fw->priv);
359}
360
361/* store the pages buffer info firmware from buf */
362static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
363{
364 fw->priv = buf;
365#ifdef CONFIG_FW_LOADER_USER_HELPER
366 fw->pages = buf->pages;
367#endif
368 fw->size = buf->size;
369 fw->data = buf->data;
370
371 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
372 __func__, buf->fw_id, buf, buf->data,
373 (unsigned int)buf->size);
374}
375
376#ifdef CONFIG_PM_SLEEP
377static void fw_name_devm_release(struct device *dev, void *res)
378{
379 struct fw_name_devm *fwn = res;
380
381 if (fwn->magic == (unsigned long)&fw_cache)
382 pr_debug("%s: fw_name-%s devm-%p released\n",
383 __func__, fwn->name, res);
384 kfree_const(fwn->name);
385}
386
387static int fw_devm_match(struct device *dev, void *res,
388 void *match_data)
389{
390 struct fw_name_devm *fwn = res;
391
392 return (fwn->magic == (unsigned long)&fw_cache) &&
393 !strcmp(fwn->name, match_data);
394}
395
396static struct fw_name_devm *fw_find_devm_name(struct device *dev,
397 const char *name)
398{
399 struct fw_name_devm *fwn;
400
401 fwn = devres_find(dev, fw_name_devm_release,
402 fw_devm_match, (void *)name);
403 return fwn;
404}
405
406/* add firmware name into devres list */
407static int fw_add_devm_name(struct device *dev, const char *name)
408{
409 struct fw_name_devm *fwn;
410
411 fwn = fw_find_devm_name(dev, name);
412 if (fwn)
413 return 1;
414
415 fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm),
416 GFP_KERNEL);
417 if (!fwn)
418 return -ENOMEM;
419 fwn->name = kstrdup_const(name, GFP_KERNEL);
420 if (!fwn->name) {
421 devres_free(fwn);
422 return -ENOMEM;
423 }
424
425 fwn->magic = (unsigned long)&fw_cache;
426 devres_add(dev, fwn);
427
428 return 0;
429}
430#else
431static int fw_add_devm_name(struct device *dev, const char *name)
432{
433 return 0;
434}
435#endif
436
437
438/*
439 * user-mode helper code
440 */
441#ifdef CONFIG_FW_LOADER_USER_HELPER
442struct firmware_priv {
443 bool nowait;
444 struct device dev;
445 struct firmware_buf *buf;
446 struct firmware *fw;
447};
448
449static struct firmware_priv *to_firmware_priv(struct device *dev)
450{
451 return container_of(dev, struct firmware_priv, dev);
452}
453
454static void __fw_load_abort(struct firmware_buf *buf)
455{
456 /*
457 * There is a small window in which user can write to 'loading'
458 * between loading done and disappearance of 'loading'
459 */
460 if (test_bit(FW_STATUS_DONE, &buf->status))
461 return;
462
463 list_del_init(&buf->pending_list);
464 set_bit(FW_STATUS_ABORT, &buf->status);
465 complete_all(&buf->completion);
466}
467
468static void fw_load_abort(struct firmware_priv *fw_priv)
469{
470 struct firmware_buf *buf = fw_priv->buf;
471
472 __fw_load_abort(buf);
473
474 /* avoid user action after loading abort */
475 fw_priv->buf = NULL;
476}
477
478#define is_fw_load_aborted(buf) \
479 test_bit(FW_STATUS_ABORT, &(buf)->status)
480
481static LIST_HEAD(pending_fw_head);
482
483/* reboot notifier for avoid deadlock with usermode_lock */
484static int fw_shutdown_notify(struct notifier_block *unused1,
485 unsigned long unused2, void *unused3)
486{
487 mutex_lock(&fw_lock);
488 while (!list_empty(&pending_fw_head))
489 __fw_load_abort(list_first_entry(&pending_fw_head,
490 struct firmware_buf,
491 pending_list));
492 mutex_unlock(&fw_lock);
493 return NOTIFY_DONE;
494}
495
496static struct notifier_block fw_shutdown_nb = {
497 .notifier_call = fw_shutdown_notify,
498};
499
500static ssize_t timeout_show(struct class *class, struct class_attribute *attr,
501 char *buf)
502{
503 return sprintf(buf, "%d\n", loading_timeout);
504}
505
506/**
507 * firmware_timeout_store - set number of seconds to wait for firmware
508 * @class: device class pointer
509 * @attr: device attribute pointer
510 * @buf: buffer to scan for timeout value
511 * @count: number of bytes in @buf
512 *
513 * Sets the number of seconds to wait for the firmware. Once
514 * this expires an error will be returned to the driver and no
515 * firmware will be provided.
516 *
517 * Note: zero means 'wait forever'.
518 **/
519static ssize_t timeout_store(struct class *class, struct class_attribute *attr,
520 const char *buf, size_t count)
521{
522 loading_timeout = simple_strtol(buf, NULL, 10);
523 if (loading_timeout < 0)
524 loading_timeout = 0;
525
526 return count;
527}
528
529static struct class_attribute firmware_class_attrs[] = {
530 __ATTR_RW(timeout),
531 __ATTR_NULL
532};
533
534static void fw_dev_release(struct device *dev)
535{
536 struct firmware_priv *fw_priv = to_firmware_priv(dev);
537
538 kfree(fw_priv);
539}
540
541static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
542{
543 if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
544 return -ENOMEM;
545 if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
546 return -ENOMEM;
547 if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
548 return -ENOMEM;
549
550 return 0;
551}
552
553static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
554{
555 struct firmware_priv *fw_priv = to_firmware_priv(dev);
556 int err = 0;
557
558 mutex_lock(&fw_lock);
559 if (fw_priv->buf)
560 err = do_firmware_uevent(fw_priv, env);
561 mutex_unlock(&fw_lock);
562 return err;
563}
564
565static struct class firmware_class = {
566 .name = "firmware",
567 .class_attrs = firmware_class_attrs,
568 .dev_uevent = firmware_uevent,
569 .dev_release = fw_dev_release,
570};
571
572static ssize_t firmware_loading_show(struct device *dev,
573 struct device_attribute *attr, char *buf)
574{
575 struct firmware_priv *fw_priv = to_firmware_priv(dev);
576 int loading = 0;
577
578 mutex_lock(&fw_lock);
579 if (fw_priv->buf)
580 loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
581 mutex_unlock(&fw_lock);
582
583 return sprintf(buf, "%d\n", loading);
584}
585
586/* Some architectures don't have PAGE_KERNEL_RO */
587#ifndef PAGE_KERNEL_RO
588#define PAGE_KERNEL_RO PAGE_KERNEL
589#endif
590
591/* one pages buffer should be mapped/unmapped only once */
592static int fw_map_pages_buf(struct firmware_buf *buf)
593{
594 if (!buf->is_paged_buf)
595 return 0;
596
597 vunmap(buf->data);
598 buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
599 if (!buf->data)
600 return -ENOMEM;
601 return 0;
602}
603
604/**
605 * firmware_loading_store - set value in the 'loading' control file
606 * @dev: device pointer
607 * @attr: device attribute pointer
608 * @buf: buffer to scan for loading control value
609 * @count: number of bytes in @buf
610 *
611 * The relevant values are:
612 *
613 * 1: Start a load, discarding any previous partial load.
614 * 0: Conclude the load and hand the data to the driver code.
615 * -1: Conclude the load with an error and discard any written data.
616 **/
617static ssize_t firmware_loading_store(struct device *dev,
618 struct device_attribute *attr,
619 const char *buf, size_t count)
620{
621 struct firmware_priv *fw_priv = to_firmware_priv(dev);
622 struct firmware_buf *fw_buf;
623 ssize_t written = count;
624 int loading = simple_strtol(buf, NULL, 10);
625 int i;
626
627 mutex_lock(&fw_lock);
628 fw_buf = fw_priv->buf;
629 if (!fw_buf)
630 goto out;
631
632 switch (loading) {
633 case 1:
634 /* discarding any previous partial load */
635 if (!test_bit(FW_STATUS_DONE, &fw_buf->status)) {
636 for (i = 0; i < fw_buf->nr_pages; i++)
637 __free_page(fw_buf->pages[i]);
638 vfree(fw_buf->pages);
639 fw_buf->pages = NULL;
640 fw_buf->page_array_size = 0;
641 fw_buf->nr_pages = 0;
642 set_bit(FW_STATUS_LOADING, &fw_buf->status);
643 }
644 break;
645 case 0:
646 if (test_bit(FW_STATUS_LOADING, &fw_buf->status)) {
647 int rc;
648
649 set_bit(FW_STATUS_DONE, &fw_buf->status);
650 clear_bit(FW_STATUS_LOADING, &fw_buf->status);
651
652 /*
653 * Several loading requests may be pending on
654 * one same firmware buf, so let all requests
655 * see the mapped 'buf->data' once the loading
656 * is completed.
657 * */
658 rc = fw_map_pages_buf(fw_buf);
659 if (rc)
660 dev_err(dev, "%s: map pages failed\n",
661 __func__);
662 else
663 rc = security_kernel_post_read_file(NULL,
664 fw_buf->data, fw_buf->size,
665 READING_FIRMWARE);
666
667 /*
668 * Same logic as fw_load_abort, only the DONE bit
669 * is ignored and we set ABORT only on failure.
670 */
671 list_del_init(&fw_buf->pending_list);
672 if (rc) {
673 set_bit(FW_STATUS_ABORT, &fw_buf->status);
674 written = rc;
675 }
676 complete_all(&fw_buf->completion);
677 break;
678 }
679 /* fallthrough */
680 default:
681 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
682 /* fallthrough */
683 case -1:
684 fw_load_abort(fw_priv);
685 break;
686 }
687out:
688 mutex_unlock(&fw_lock);
689 return written;
690}
691
692static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
693
694static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
695 struct bin_attribute *bin_attr,
696 char *buffer, loff_t offset, size_t count)
697{
698 struct device *dev = kobj_to_dev(kobj);
699 struct firmware_priv *fw_priv = to_firmware_priv(dev);
700 struct firmware_buf *buf;
701 ssize_t ret_count;
702
703 mutex_lock(&fw_lock);
704 buf = fw_priv->buf;
705 if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
706 ret_count = -ENODEV;
707 goto out;
708 }
709 if (offset > buf->size) {
710 ret_count = 0;
711 goto out;
712 }
713 if (count > buf->size - offset)
714 count = buf->size - offset;
715
716 ret_count = count;
717
718 while (count) {
719 void *page_data;
720 int page_nr = offset >> PAGE_SHIFT;
721 int page_ofs = offset & (PAGE_SIZE-1);
722 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
723
724 page_data = kmap(buf->pages[page_nr]);
725
726 memcpy(buffer, page_data + page_ofs, page_cnt);
727
728 kunmap(buf->pages[page_nr]);
729 buffer += page_cnt;
730 offset += page_cnt;
731 count -= page_cnt;
732 }
733out:
734 mutex_unlock(&fw_lock);
735 return ret_count;
736}
737
738static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
739{
740 struct firmware_buf *buf = fw_priv->buf;
741 int pages_needed = PAGE_ALIGN(min_size) >> PAGE_SHIFT;
742
743 /* If the array of pages is too small, grow it... */
744 if (buf->page_array_size < pages_needed) {
745 int new_array_size = max(pages_needed,
746 buf->page_array_size * 2);
747 struct page **new_pages;
748
749 new_pages = vmalloc(new_array_size * sizeof(void *));
750 if (!new_pages) {
751 fw_load_abort(fw_priv);
752 return -ENOMEM;
753 }
754 memcpy(new_pages, buf->pages,
755 buf->page_array_size * sizeof(void *));
756 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
757 (new_array_size - buf->page_array_size));
758 vfree(buf->pages);
759 buf->pages = new_pages;
760 buf->page_array_size = new_array_size;
761 }
762
763 while (buf->nr_pages < pages_needed) {
764 buf->pages[buf->nr_pages] =
765 alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
766
767 if (!buf->pages[buf->nr_pages]) {
768 fw_load_abort(fw_priv);
769 return -ENOMEM;
770 }
771 buf->nr_pages++;
772 }
773 return 0;
774}
775
776/**
777 * firmware_data_write - write method for firmware
778 * @filp: open sysfs file
779 * @kobj: kobject for the device
780 * @bin_attr: bin_attr structure
781 * @buffer: buffer being written
782 * @offset: buffer offset for write in total data store area
783 * @count: buffer size
784 *
785 * Data written to the 'data' attribute will be later handed to
786 * the driver as a firmware image.
787 **/
788static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
789 struct bin_attribute *bin_attr,
790 char *buffer, loff_t offset, size_t count)
791{
792 struct device *dev = kobj_to_dev(kobj);
793 struct firmware_priv *fw_priv = to_firmware_priv(dev);
794 struct firmware_buf *buf;
795 ssize_t retval;
796
797 if (!capable(CAP_SYS_RAWIO))
798 return -EPERM;
799
800 mutex_lock(&fw_lock);
801 buf = fw_priv->buf;
802 if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
803 retval = -ENODEV;
804 goto out;
805 }
806
807 retval = fw_realloc_buffer(fw_priv, offset + count);
808 if (retval)
809 goto out;
810
811 retval = count;
812
813 while (count) {
814 void *page_data;
815 int page_nr = offset >> PAGE_SHIFT;
816 int page_ofs = offset & (PAGE_SIZE - 1);
817 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
818
819 page_data = kmap(buf->pages[page_nr]);
820
821 memcpy(page_data + page_ofs, buffer, page_cnt);
822
823 kunmap(buf->pages[page_nr]);
824 buffer += page_cnt;
825 offset += page_cnt;
826 count -= page_cnt;
827 }
828
829 buf->size = max_t(size_t, offset, buf->size);
830out:
831 mutex_unlock(&fw_lock);
832 return retval;
833}
834
835static struct bin_attribute firmware_attr_data = {
836 .attr = { .name = "data", .mode = 0644 },
837 .size = 0,
838 .read = firmware_data_read,
839 .write = firmware_data_write,
840};
841
842static struct attribute *fw_dev_attrs[] = {
843 &dev_attr_loading.attr,
844 NULL
845};
846
847static struct bin_attribute *fw_dev_bin_attrs[] = {
848 &firmware_attr_data,
849 NULL
850};
851
852static const struct attribute_group fw_dev_attr_group = {
853 .attrs = fw_dev_attrs,
854 .bin_attrs = fw_dev_bin_attrs,
855};
856
857static const struct attribute_group *fw_dev_attr_groups[] = {
858 &fw_dev_attr_group,
859 NULL
860};
861
862static struct firmware_priv *
863fw_create_instance(struct firmware *firmware, const char *fw_name,
864 struct device *device, unsigned int opt_flags)
865{
866 struct firmware_priv *fw_priv;
867 struct device *f_dev;
868
869 fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
870 if (!fw_priv) {
871 fw_priv = ERR_PTR(-ENOMEM);
872 goto exit;
873 }
874
875 fw_priv->nowait = !!(opt_flags & FW_OPT_NOWAIT);
876 fw_priv->fw = firmware;
877 f_dev = &fw_priv->dev;
878
879 device_initialize(f_dev);
880 dev_set_name(f_dev, "%s", fw_name);
881 f_dev->parent = device;
882 f_dev->class = &firmware_class;
883 f_dev->groups = fw_dev_attr_groups;
884exit:
885 return fw_priv;
886}
887
888/* load a firmware via user helper */
889static int _request_firmware_load(struct firmware_priv *fw_priv,
890 unsigned int opt_flags, long timeout)
891{
892 int retval = 0;
893 struct device *f_dev = &fw_priv->dev;
894 struct firmware_buf *buf = fw_priv->buf;
895
896 /* fall back on userspace loading */
897 buf->is_paged_buf = true;
898
899 dev_set_uevent_suppress(f_dev, true);
900
901 retval = device_add(f_dev);
902 if (retval) {
903 dev_err(f_dev, "%s: device_register failed\n", __func__);
904 goto err_put_dev;
905 }
906
907 mutex_lock(&fw_lock);
908 list_add(&buf->pending_list, &pending_fw_head);
909 mutex_unlock(&fw_lock);
910
911 if (opt_flags & FW_OPT_UEVENT) {
912 buf->need_uevent = true;
913 dev_set_uevent_suppress(f_dev, false);
914 dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
915 kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
916 } else {
917 timeout = MAX_JIFFY_OFFSET;
918 }
919
920 retval = wait_for_completion_interruptible_timeout(&buf->completion,
921 timeout);
922 if (retval == -ERESTARTSYS || !retval) {
923 mutex_lock(&fw_lock);
924 fw_load_abort(fw_priv);
925 mutex_unlock(&fw_lock);
926 } else if (retval > 0) {
927 retval = 0;
928 }
929
930 if (is_fw_load_aborted(buf))
931 retval = -EAGAIN;
932 else if (!buf->data)
933 retval = -ENOMEM;
934
935 device_del(f_dev);
936err_put_dev:
937 put_device(f_dev);
938 return retval;
939}
940
941static int fw_load_from_user_helper(struct firmware *firmware,
942 const char *name, struct device *device,
943 unsigned int opt_flags, long timeout)
944{
945 struct firmware_priv *fw_priv;
946
947 fw_priv = fw_create_instance(firmware, name, device, opt_flags);
948 if (IS_ERR(fw_priv))
949 return PTR_ERR(fw_priv);
950
951 fw_priv->buf = firmware->priv;
952 return _request_firmware_load(fw_priv, opt_flags, timeout);
953}
954
955#ifdef CONFIG_PM_SLEEP
956/* kill pending requests without uevent to avoid blocking suspend */
957static void kill_requests_without_uevent(void)
958{
959 struct firmware_buf *buf;
960 struct firmware_buf *next;
961
962 mutex_lock(&fw_lock);
963 list_for_each_entry_safe(buf, next, &pending_fw_head, pending_list) {
964 if (!buf->need_uevent)
965 __fw_load_abort(buf);
966 }
967 mutex_unlock(&fw_lock);
968}
969#endif
970
971#else /* CONFIG_FW_LOADER_USER_HELPER */
972static inline int
973fw_load_from_user_helper(struct firmware *firmware, const char *name,
974 struct device *device, unsigned int opt_flags,
975 long timeout)
976{
977 return -ENOENT;
978}
979
980/* No abort during direct loading */
981#define is_fw_load_aborted(buf) false
982
983#ifdef CONFIG_PM_SLEEP
984static inline void kill_requests_without_uevent(void) { }
985#endif
986
987#endif /* CONFIG_FW_LOADER_USER_HELPER */
988
989
990/* wait until the shared firmware_buf becomes ready (or error) */
991static int sync_cached_firmware_buf(struct firmware_buf *buf)
992{
993 int ret = 0;
994
995 mutex_lock(&fw_lock);
996 while (!test_bit(FW_STATUS_DONE, &buf->status)) {
997 if (is_fw_load_aborted(buf)) {
998 ret = -ENOENT;
999 break;
1000 }
1001 mutex_unlock(&fw_lock);
1002 ret = wait_for_completion_interruptible(&buf->completion);
1003 mutex_lock(&fw_lock);
1004 }
1005 mutex_unlock(&fw_lock);
1006 return ret;
1007}
1008
1009/* prepare firmware and firmware_buf structs;
1010 * return 0 if a firmware is already assigned, 1 if need to load one,
1011 * or a negative error code
1012 */
1013static int
1014_request_firmware_prepare(struct firmware **firmware_p, const char *name,
1015 struct device *device)
1016{
1017 struct firmware *firmware;
1018 struct firmware_buf *buf;
1019 int ret;
1020
1021 *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
1022 if (!firmware) {
1023 dev_err(device, "%s: kmalloc(struct firmware) failed\n",
1024 __func__);
1025 return -ENOMEM;
1026 }
1027
1028 if (fw_get_builtin_firmware(firmware, name)) {
1029 dev_dbg(device, "using built-in %s\n", name);
1030 return 0; /* assigned */
1031 }
1032
1033 ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf);
1034
1035 /*
1036 * bind with 'buf' now to avoid warning in failure path
1037 * of requesting firmware.
1038 */
1039 firmware->priv = buf;
1040
1041 if (ret > 0) {
1042 ret = sync_cached_firmware_buf(buf);
1043 if (!ret) {
1044 fw_set_page_data(buf, firmware);
1045 return 0; /* assigned */
1046 }
1047 }
1048
1049 if (ret < 0)
1050 return ret;
1051 return 1; /* need to load */
1052}
1053
1054static int assign_firmware_buf(struct firmware *fw, struct device *device,
1055 unsigned int opt_flags)
1056{
1057 struct firmware_buf *buf = fw->priv;
1058
1059 mutex_lock(&fw_lock);
1060 if (!buf->size || is_fw_load_aborted(buf)) {
1061 mutex_unlock(&fw_lock);
1062 return -ENOENT;
1063 }
1064
1065 /*
1066 * add firmware name into devres list so that we can auto cache
1067 * and uncache firmware for device.
1068 *
1069 * device may has been deleted already, but the problem
1070 * should be fixed in devres or driver core.
1071 */
1072 /* don't cache firmware handled without uevent */
1073 if (device && (opt_flags & FW_OPT_UEVENT))
1074 fw_add_devm_name(device, buf->fw_id);
1075
1076 /*
1077 * After caching firmware image is started, let it piggyback
1078 * on request firmware.
1079 */
1080 if (buf->fwc->state == FW_LOADER_START_CACHE) {
1081 if (fw_cache_piggyback_on_request(buf->fw_id))
1082 kref_get(&buf->ref);
1083 }
1084
1085 /* pass the pages buffer to driver at the last minute */
1086 fw_set_page_data(buf, fw);
1087 mutex_unlock(&fw_lock);
1088 return 0;
1089}
1090
1091/* called from request_firmware() and request_firmware_work_func() */
1092static int
1093_request_firmware(const struct firmware **firmware_p, const char *name,
1094 struct device *device, unsigned int opt_flags)
1095{
1096 struct firmware *fw = NULL;
1097 long timeout;
1098 int ret;
1099
1100 if (!firmware_p)
1101 return -EINVAL;
1102
1103 if (!name || name[0] == '\0') {
1104 ret = -EINVAL;
1105 goto out;
1106 }
1107
1108 ret = _request_firmware_prepare(&fw, name, device);
1109 if (ret <= 0) /* error or already assigned */
1110 goto out;
1111
1112 ret = 0;
1113 timeout = firmware_loading_timeout();
1114 if (opt_flags & FW_OPT_NOWAIT) {
1115 timeout = usermodehelper_read_lock_wait(timeout);
1116 if (!timeout) {
1117 dev_dbg(device, "firmware: %s loading timed out\n",
1118 name);
1119 ret = -EBUSY;
1120 goto out;
1121 }
1122 } else {
1123 ret = usermodehelper_read_trylock();
1124 if (WARN_ON(ret)) {
1125 dev_err(device, "firmware: %s will not be loaded\n",
1126 name);
1127 goto out;
1128 }
1129 }
1130
1131 ret = fw_get_filesystem_firmware(device, fw->priv);
1132 if (ret) {
1133 if (!(opt_flags & FW_OPT_NO_WARN))
1134 dev_warn(device,
1135 "Direct firmware load for %s failed with error %d\n",
1136 name, ret);
1137 if (opt_flags & FW_OPT_USERHELPER) {
1138 dev_warn(device, "Falling back to user helper\n");
1139 ret = fw_load_from_user_helper(fw, name, device,
1140 opt_flags, timeout);
1141 }
1142 }
1143
1144 if (!ret)
1145 ret = assign_firmware_buf(fw, device, opt_flags);
1146
1147 usermodehelper_read_unlock();
1148
1149 out:
1150 if (ret < 0) {
1151 release_firmware(fw);
1152 fw = NULL;
1153 }
1154
1155 *firmware_p = fw;
1156 return ret;
1157}
1158
1159/**
1160 * request_firmware: - send firmware request and wait for it
1161 * @firmware_p: pointer to firmware image
1162 * @name: name of firmware file
1163 * @device: device for which firmware is being loaded
1164 *
1165 * @firmware_p will be used to return a firmware image by the name
1166 * of @name for device @device.
1167 *
1168 * Should be called from user context where sleeping is allowed.
1169 *
1170 * @name will be used as $FIRMWARE in the uevent environment and
1171 * should be distinctive enough not to be confused with any other
1172 * firmware image for this or any other device.
1173 *
1174 * Caller must hold the reference count of @device.
1175 *
1176 * The function can be called safely inside device's suspend and
1177 * resume callback.
1178 **/
1179int
1180request_firmware(const struct firmware **firmware_p, const char *name,
1181 struct device *device)
1182{
1183 int ret;
1184
1185 /* Need to pin this module until return */
1186 __module_get(THIS_MODULE);
1187 ret = _request_firmware(firmware_p, name, device,
1188 FW_OPT_UEVENT | FW_OPT_FALLBACK);
1189 module_put(THIS_MODULE);
1190 return ret;
1191}
1192EXPORT_SYMBOL(request_firmware);
1193
1194/**
1195 * request_firmware_direct: - load firmware directly without usermode helper
1196 * @firmware_p: pointer to firmware image
1197 * @name: name of firmware file
1198 * @device: device for which firmware is being loaded
1199 *
1200 * This function works pretty much like request_firmware(), but this doesn't
1201 * fall back to usermode helper even if the firmware couldn't be loaded
1202 * directly from fs. Hence it's useful for loading optional firmwares, which
1203 * aren't always present, without extra long timeouts of udev.
1204 **/
1205int request_firmware_direct(const struct firmware **firmware_p,
1206 const char *name, struct device *device)
1207{
1208 int ret;
1209
1210 __module_get(THIS_MODULE);
1211 ret = _request_firmware(firmware_p, name, device,
1212 FW_OPT_UEVENT | FW_OPT_NO_WARN);
1213 module_put(THIS_MODULE);
1214 return ret;
1215}
1216EXPORT_SYMBOL_GPL(request_firmware_direct);
1217
1218/**
1219 * release_firmware: - release the resource associated with a firmware image
1220 * @fw: firmware resource to release
1221 **/
1222void release_firmware(const struct firmware *fw)
1223{
1224 if (fw) {
1225 if (!fw_is_builtin_firmware(fw))
1226 firmware_free_data(fw);
1227 kfree(fw);
1228 }
1229}
1230EXPORT_SYMBOL(release_firmware);
1231
1232/* Async support */
1233struct firmware_work {
1234 struct work_struct work;
1235 struct module *module;
1236 const char *name;
1237 struct device *device;
1238 void *context;
1239 void (*cont)(const struct firmware *fw, void *context);
1240 unsigned int opt_flags;
1241};
1242
1243static void request_firmware_work_func(struct work_struct *work)
1244{
1245 struct firmware_work *fw_work;
1246 const struct firmware *fw;
1247
1248 fw_work = container_of(work, struct firmware_work, work);
1249
1250 _request_firmware(&fw, fw_work->name, fw_work->device,
1251 fw_work->opt_flags);
1252 fw_work->cont(fw, fw_work->context);
1253 put_device(fw_work->device); /* taken in request_firmware_nowait() */
1254
1255 module_put(fw_work->module);
1256 kfree_const(fw_work->name);
1257 kfree(fw_work);
1258}
1259
1260/**
1261 * request_firmware_nowait - asynchronous version of request_firmware
1262 * @module: module requesting the firmware
1263 * @uevent: sends uevent to copy the firmware image if this flag
1264 * is non-zero else the firmware copy must be done manually.
1265 * @name: name of firmware file
1266 * @device: device for which firmware is being loaded
1267 * @gfp: allocation flags
1268 * @context: will be passed over to @cont, and
1269 * @fw may be %NULL if firmware request fails.
1270 * @cont: function will be called asynchronously when the firmware
1271 * request is over.
1272 *
1273 * Caller must hold the reference count of @device.
1274 *
1275 * Asynchronous variant of request_firmware() for user contexts:
1276 * - sleep for as small periods as possible since it may
1277 * increase kernel boot time of built-in device drivers
1278 * requesting firmware in their ->probe() methods, if
1279 * @gfp is GFP_KERNEL.
1280 *
1281 * - can't sleep at all if @gfp is GFP_ATOMIC.
1282 **/
1283int
1284request_firmware_nowait(
1285 struct module *module, bool uevent,
1286 const char *name, struct device *device, gfp_t gfp, void *context,
1287 void (*cont)(const struct firmware *fw, void *context))
1288{
1289 struct firmware_work *fw_work;
1290
1291 fw_work = kzalloc(sizeof(struct firmware_work), gfp);
1292 if (!fw_work)
1293 return -ENOMEM;
1294
1295 fw_work->module = module;
1296 fw_work->name = kstrdup_const(name, gfp);
1297 if (!fw_work->name) {
1298 kfree(fw_work);
1299 return -ENOMEM;
1300 }
1301 fw_work->device = device;
1302 fw_work->context = context;
1303 fw_work->cont = cont;
1304 fw_work->opt_flags = FW_OPT_NOWAIT | FW_OPT_FALLBACK |
1305 (uevent ? FW_OPT_UEVENT : FW_OPT_USERHELPER);
1306
1307 if (!try_module_get(module)) {
1308 kfree_const(fw_work->name);
1309 kfree(fw_work);
1310 return -EFAULT;
1311 }
1312
1313 get_device(fw_work->device);
1314 INIT_WORK(&fw_work->work, request_firmware_work_func);
1315 schedule_work(&fw_work->work);
1316 return 0;
1317}
1318EXPORT_SYMBOL(request_firmware_nowait);
1319
1320#ifdef CONFIG_PM_SLEEP
1321static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);
1322
1323/**
1324 * cache_firmware - cache one firmware image in kernel memory space
1325 * @fw_name: the firmware image name
1326 *
1327 * Cache firmware in kernel memory so that drivers can use it when
1328 * system isn't ready for them to request firmware image from userspace.
1329 * Once it returns successfully, driver can use request_firmware or its
1330 * nowait version to get the cached firmware without any interacting
1331 * with userspace
1332 *
1333 * Return 0 if the firmware image has been cached successfully
1334 * Return !0 otherwise
1335 *
1336 */
1337static int cache_firmware(const char *fw_name)
1338{
1339 int ret;
1340 const struct firmware *fw;
1341
1342 pr_debug("%s: %s\n", __func__, fw_name);
1343
1344 ret = request_firmware(&fw, fw_name, NULL);
1345 if (!ret)
1346 kfree(fw);
1347
1348 pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);
1349
1350 return ret;
1351}
1352
1353static struct firmware_buf *fw_lookup_buf(const char *fw_name)
1354{
1355 struct firmware_buf *tmp;
1356 struct firmware_cache *fwc = &fw_cache;
1357
1358 spin_lock(&fwc->lock);
1359 tmp = __fw_lookup_buf(fw_name);
1360 spin_unlock(&fwc->lock);
1361
1362 return tmp;
1363}
1364
1365/**
1366 * uncache_firmware - remove one cached firmware image
1367 * @fw_name: the firmware image name
1368 *
1369 * Uncache one firmware image which has been cached successfully
1370 * before.
1371 *
1372 * Return 0 if the firmware cache has been removed successfully
1373 * Return !0 otherwise
1374 *
1375 */
1376static int uncache_firmware(const char *fw_name)
1377{
1378 struct firmware_buf *buf;
1379 struct firmware fw;
1380
1381 pr_debug("%s: %s\n", __func__, fw_name);
1382
1383 if (fw_get_builtin_firmware(&fw, fw_name))
1384 return 0;
1385
1386 buf = fw_lookup_buf(fw_name);
1387 if (buf) {
1388 fw_free_buf(buf);
1389 return 0;
1390 }
1391
1392 return -EINVAL;
1393}
1394
1395static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
1396{
1397 struct fw_cache_entry *fce;
1398
1399 fce = kzalloc(sizeof(*fce), GFP_ATOMIC);
1400 if (!fce)
1401 goto exit;
1402
1403 fce->name = kstrdup_const(name, GFP_ATOMIC);
1404 if (!fce->name) {
1405 kfree(fce);
1406 fce = NULL;
1407 goto exit;
1408 }
1409exit:
1410 return fce;
1411}
1412
1413static int __fw_entry_found(const char *name)
1414{
1415 struct firmware_cache *fwc = &fw_cache;
1416 struct fw_cache_entry *fce;
1417
1418 list_for_each_entry(fce, &fwc->fw_names, list) {
1419 if (!strcmp(fce->name, name))
1420 return 1;
1421 }
1422 return 0;
1423}
1424
1425static int fw_cache_piggyback_on_request(const char *name)
1426{
1427 struct firmware_cache *fwc = &fw_cache;
1428 struct fw_cache_entry *fce;
1429 int ret = 0;
1430
1431 spin_lock(&fwc->name_lock);
1432 if (__fw_entry_found(name))
1433 goto found;
1434
1435 fce = alloc_fw_cache_entry(name);
1436 if (fce) {
1437 ret = 1;
1438 list_add(&fce->list, &fwc->fw_names);
1439 pr_debug("%s: fw: %s\n", __func__, name);
1440 }
1441found:
1442 spin_unlock(&fwc->name_lock);
1443 return ret;
1444}
1445
1446static void free_fw_cache_entry(struct fw_cache_entry *fce)
1447{
1448 kfree_const(fce->name);
1449 kfree(fce);
1450}
1451
1452static void __async_dev_cache_fw_image(void *fw_entry,
1453 async_cookie_t cookie)
1454{
1455 struct fw_cache_entry *fce = fw_entry;
1456 struct firmware_cache *fwc = &fw_cache;
1457 int ret;
1458
1459 ret = cache_firmware(fce->name);
1460 if (ret) {
1461 spin_lock(&fwc->name_lock);
1462 list_del(&fce->list);
1463 spin_unlock(&fwc->name_lock);
1464
1465 free_fw_cache_entry(fce);
1466 }
1467}
1468
1469/* called with dev->devres_lock held */
1470static void dev_create_fw_entry(struct device *dev, void *res,
1471 void *data)
1472{
1473 struct fw_name_devm *fwn = res;
1474 const char *fw_name = fwn->name;
1475 struct list_head *head = data;
1476 struct fw_cache_entry *fce;
1477
1478 fce = alloc_fw_cache_entry(fw_name);
1479 if (fce)
1480 list_add(&fce->list, head);
1481}
1482
1483static int devm_name_match(struct device *dev, void *res,
1484 void *match_data)
1485{
1486 struct fw_name_devm *fwn = res;
1487 return (fwn->magic == (unsigned long)match_data);
1488}
1489
1490static void dev_cache_fw_image(struct device *dev, void *data)
1491{
1492 LIST_HEAD(todo);
1493 struct fw_cache_entry *fce;
1494 struct fw_cache_entry *fce_next;
1495 struct firmware_cache *fwc = &fw_cache;
1496
1497 devres_for_each_res(dev, fw_name_devm_release,
1498 devm_name_match, &fw_cache,
1499 dev_create_fw_entry, &todo);
1500
1501 list_for_each_entry_safe(fce, fce_next, &todo, list) {
1502 list_del(&fce->list);
1503
1504 spin_lock(&fwc->name_lock);
1505 /* only one cache entry for one firmware */
1506 if (!__fw_entry_found(fce->name)) {
1507 list_add(&fce->list, &fwc->fw_names);
1508 } else {
1509 free_fw_cache_entry(fce);
1510 fce = NULL;
1511 }
1512 spin_unlock(&fwc->name_lock);
1513
1514 if (fce)
1515 async_schedule_domain(__async_dev_cache_fw_image,
1516 (void *)fce,
1517 &fw_cache_domain);
1518 }
1519}
1520
1521static void __device_uncache_fw_images(void)
1522{
1523 struct firmware_cache *fwc = &fw_cache;
1524 struct fw_cache_entry *fce;
1525
1526 spin_lock(&fwc->name_lock);
1527 while (!list_empty(&fwc->fw_names)) {
1528 fce = list_entry(fwc->fw_names.next,
1529 struct fw_cache_entry, list);
1530 list_del(&fce->list);
1531 spin_unlock(&fwc->name_lock);
1532
1533 uncache_firmware(fce->name);
1534 free_fw_cache_entry(fce);
1535
1536 spin_lock(&fwc->name_lock);
1537 }
1538 spin_unlock(&fwc->name_lock);
1539}
1540
1541/**
1542 * device_cache_fw_images - cache devices' firmware
1543 *
1544 * If one device called request_firmware or its nowait version
1545 * successfully before, the firmware names are recored into the
1546 * device's devres link list, so device_cache_fw_images can call
1547 * cache_firmware() to cache these firmwares for the device,
1548 * then the device driver can load its firmwares easily at
1549 * time when system is not ready to complete loading firmware.
1550 */
1551static void device_cache_fw_images(void)
1552{
1553 struct firmware_cache *fwc = &fw_cache;
1554 int old_timeout;
1555 DEFINE_WAIT(wait);
1556
1557 pr_debug("%s\n", __func__);
1558
1559 /* cancel uncache work */
1560 cancel_delayed_work_sync(&fwc->work);
1561
1562 /*
1563 * use small loading timeout for caching devices' firmware
1564 * because all these firmware images have been loaded
1565 * successfully at lease once, also system is ready for
1566 * completing firmware loading now. The maximum size of
1567 * firmware in current distributions is about 2M bytes,
1568 * so 10 secs should be enough.
1569 */
1570 old_timeout = loading_timeout;
1571 loading_timeout = 10;
1572
1573 mutex_lock(&fw_lock);
1574 fwc->state = FW_LOADER_START_CACHE;
1575 dpm_for_each_dev(NULL, dev_cache_fw_image);
1576 mutex_unlock(&fw_lock);
1577
1578 /* wait for completion of caching firmware for all devices */
1579 async_synchronize_full_domain(&fw_cache_domain);
1580
1581 loading_timeout = old_timeout;
1582}
1583
1584/**
1585 * device_uncache_fw_images - uncache devices' firmware
1586 *
1587 * uncache all firmwares which have been cached successfully
1588 * by device_uncache_fw_images earlier
1589 */
1590static void device_uncache_fw_images(void)
1591{
1592 pr_debug("%s\n", __func__);
1593 __device_uncache_fw_images();
1594}
1595
1596static void device_uncache_fw_images_work(struct work_struct *work)
1597{
1598 device_uncache_fw_images();
1599}
1600
1601/**
1602 * device_uncache_fw_images_delay - uncache devices firmwares
1603 * @delay: number of milliseconds to delay uncache device firmwares
1604 *
1605 * uncache all devices's firmwares which has been cached successfully
1606 * by device_cache_fw_images after @delay milliseconds.
1607 */
1608static void device_uncache_fw_images_delay(unsigned long delay)
1609{
1610 queue_delayed_work(system_power_efficient_wq, &fw_cache.work,
1611 msecs_to_jiffies(delay));
1612}
1613
1614static int fw_pm_notify(struct notifier_block *notify_block,
1615 unsigned long mode, void *unused)
1616{
1617 switch (mode) {
1618 case PM_HIBERNATION_PREPARE:
1619 case PM_SUSPEND_PREPARE:
1620 case PM_RESTORE_PREPARE:
1621 kill_requests_without_uevent();
1622 device_cache_fw_images();
1623 break;
1624
1625 case PM_POST_SUSPEND:
1626 case PM_POST_HIBERNATION:
1627 case PM_POST_RESTORE:
1628 /*
1629 * In case that system sleep failed and syscore_suspend is
1630 * not called.
1631 */
1632 mutex_lock(&fw_lock);
1633 fw_cache.state = FW_LOADER_NO_CACHE;
1634 mutex_unlock(&fw_lock);
1635
1636 device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
1637 break;
1638 }
1639
1640 return 0;
1641}
1642
1643/* stop caching firmware once syscore_suspend is reached */
1644static int fw_suspend(void)
1645{
1646 fw_cache.state = FW_LOADER_NO_CACHE;
1647 return 0;
1648}
1649
1650static struct syscore_ops fw_syscore_ops = {
1651 .suspend = fw_suspend,
1652};
1653#else
1654static int fw_cache_piggyback_on_request(const char *name)
1655{
1656 return 0;
1657}
1658#endif
1659
1660static void __init fw_cache_init(void)
1661{
1662 spin_lock_init(&fw_cache.lock);
1663 INIT_LIST_HEAD(&fw_cache.head);
1664 fw_cache.state = FW_LOADER_NO_CACHE;
1665
1666#ifdef CONFIG_PM_SLEEP
1667 spin_lock_init(&fw_cache.name_lock);
1668 INIT_LIST_HEAD(&fw_cache.fw_names);
1669
1670 INIT_DELAYED_WORK(&fw_cache.work,
1671 device_uncache_fw_images_work);
1672
1673 fw_cache.pm_notify.notifier_call = fw_pm_notify;
1674 register_pm_notifier(&fw_cache.pm_notify);
1675
1676 register_syscore_ops(&fw_syscore_ops);
1677#endif
1678}
1679
1680static int __init firmware_class_init(void)
1681{
1682 fw_cache_init();
1683#ifdef CONFIG_FW_LOADER_USER_HELPER
1684 register_reboot_notifier(&fw_shutdown_nb);
1685 return class_register(&firmware_class);
1686#else
1687 return 0;
1688#endif
1689}
1690
1691static void __exit firmware_class_exit(void)
1692{
1693#ifdef CONFIG_PM_SLEEP
1694 unregister_syscore_ops(&fw_syscore_ops);
1695 unregister_pm_notifier(&fw_cache.pm_notify);
1696#endif
1697#ifdef CONFIG_FW_LOADER_USER_HELPER
1698 unregister_reboot_notifier(&fw_shutdown_nb);
1699 class_unregister(&firmware_class);
1700#endif
1701}
1702
1703fs_initcall(firmware_class_init);
1704module_exit(firmware_class_exit);
1/*
2 * firmware_class.c - Multi purpose firmware loading support
3 *
4 * Copyright (c) 2003 Manuel Estrada Sainz
5 *
6 * Please see Documentation/firmware_class/ for more information.
7 *
8 */
9
10#include <linux/capability.h>
11#include <linux/device.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/timer.h>
15#include <linux/vmalloc.h>
16#include <linux/interrupt.h>
17#include <linux/bitops.h>
18#include <linux/mutex.h>
19#include <linux/workqueue.h>
20#include <linux/highmem.h>
21#include <linux/firmware.h>
22#include <linux/slab.h>
23#include <linux/sched.h>
24#include <linux/file.h>
25#include <linux/list.h>
26#include <linux/fs.h>
27#include <linux/async.h>
28#include <linux/pm.h>
29#include <linux/suspend.h>
30#include <linux/syscore_ops.h>
31#include <linux/reboot.h>
32#include <linux/security.h>
33#include <linux/swait.h>
34
35#include <generated/utsrelease.h>
36
37#include "base.h"
38
39MODULE_AUTHOR("Manuel Estrada Sainz");
40MODULE_DESCRIPTION("Multi purpose firmware loading support");
41MODULE_LICENSE("GPL");
42
43/* Builtin firmware support */
44
45#ifdef CONFIG_FW_LOADER
46
47extern struct builtin_fw __start_builtin_fw[];
48extern struct builtin_fw __end_builtin_fw[];
49
50static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
51 void *buf, size_t size)
52{
53 struct builtin_fw *b_fw;
54
55 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
56 if (strcmp(name, b_fw->name) == 0) {
57 fw->size = b_fw->size;
58 fw->data = b_fw->data;
59
60 if (buf && fw->size <= size)
61 memcpy(buf, fw->data, fw->size);
62 return true;
63 }
64 }
65
66 return false;
67}
68
69static bool fw_is_builtin_firmware(const struct firmware *fw)
70{
71 struct builtin_fw *b_fw;
72
73 for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
74 if (fw->data == b_fw->data)
75 return true;
76
77 return false;
78}
79
80#else /* Module case - no builtin firmware support */
81
82static inline bool fw_get_builtin_firmware(struct firmware *fw,
83 const char *name, void *buf,
84 size_t size)
85{
86 return false;
87}
88
89static inline bool fw_is_builtin_firmware(const struct firmware *fw)
90{
91 return false;
92}
93#endif
94
95enum fw_status {
96 FW_STATUS_UNKNOWN,
97 FW_STATUS_LOADING,
98 FW_STATUS_DONE,
99 FW_STATUS_ABORTED,
100};
101
102static int loading_timeout = 60; /* In seconds */
103
104static inline long firmware_loading_timeout(void)
105{
106 return loading_timeout > 0 ? loading_timeout * HZ : MAX_JIFFY_OFFSET;
107}
108
109/*
110 * Concurrent request_firmware() for the same firmware need to be
111 * serialized. struct fw_state is simple state machine which hold the
112 * state of the firmware loading.
113 */
114struct fw_state {
115 struct swait_queue_head wq;
116 enum fw_status status;
117};
118
119static void fw_state_init(struct fw_state *fw_st)
120{
121 init_swait_queue_head(&fw_st->wq);
122 fw_st->status = FW_STATUS_UNKNOWN;
123}
124
125static inline bool __fw_state_is_done(enum fw_status status)
126{
127 return status == FW_STATUS_DONE || status == FW_STATUS_ABORTED;
128}
129
130static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
131{
132 long ret;
133
134 ret = swait_event_interruptible_timeout(fw_st->wq,
135 __fw_state_is_done(READ_ONCE(fw_st->status)),
136 timeout);
137 if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
138 return -ENOENT;
139 if (!ret)
140 return -ETIMEDOUT;
141
142 return ret < 0 ? ret : 0;
143}
144
145static void __fw_state_set(struct fw_state *fw_st,
146 enum fw_status status)
147{
148 WRITE_ONCE(fw_st->status, status);
149
150 if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
151 swake_up(&fw_st->wq);
152}
153
154#define fw_state_start(fw_st) \
155 __fw_state_set(fw_st, FW_STATUS_LOADING)
156#define fw_state_done(fw_st) \
157 __fw_state_set(fw_st, FW_STATUS_DONE)
158#define fw_state_wait(fw_st) \
159 __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
160
161#ifndef CONFIG_FW_LOADER_USER_HELPER
162
163#define fw_state_is_aborted(fw_st) false
164
165#else /* CONFIG_FW_LOADER_USER_HELPER */
166
167static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
168{
169 return fw_st->status == status;
170}
171
172#define fw_state_aborted(fw_st) \
173 __fw_state_set(fw_st, FW_STATUS_ABORTED)
174#define fw_state_is_done(fw_st) \
175 __fw_state_check(fw_st, FW_STATUS_DONE)
176#define fw_state_is_loading(fw_st) \
177 __fw_state_check(fw_st, FW_STATUS_LOADING)
178#define fw_state_is_aborted(fw_st) \
179 __fw_state_check(fw_st, FW_STATUS_ABORTED)
180#define fw_state_wait_timeout(fw_st, timeout) \
181 __fw_state_wait_common(fw_st, timeout)
182
183#endif /* CONFIG_FW_LOADER_USER_HELPER */
184
185/* firmware behavior options */
186#define FW_OPT_UEVENT (1U << 0)
187#define FW_OPT_NOWAIT (1U << 1)
188#ifdef CONFIG_FW_LOADER_USER_HELPER
189#define FW_OPT_USERHELPER (1U << 2)
190#else
191#define FW_OPT_USERHELPER 0
192#endif
193#ifdef CONFIG_FW_LOADER_USER_HELPER_FALLBACK
194#define FW_OPT_FALLBACK FW_OPT_USERHELPER
195#else
196#define FW_OPT_FALLBACK 0
197#endif
198#define FW_OPT_NO_WARN (1U << 3)
199#define FW_OPT_NOCACHE (1U << 4)
200
201struct firmware_cache {
202 /* firmware_buf instance will be added into the below list */
203 spinlock_t lock;
204 struct list_head head;
205 int state;
206
207#ifdef CONFIG_PM_SLEEP
208 /*
209 * Names of firmware images which have been cached successfully
210 * will be added into the below list so that device uncache
211 * helper can trace which firmware images have been cached
212 * before.
213 */
214 spinlock_t name_lock;
215 struct list_head fw_names;
216
217 struct delayed_work work;
218
219 struct notifier_block pm_notify;
220#endif
221};
222
223struct firmware_buf {
224 struct kref ref;
225 struct list_head list;
226 struct firmware_cache *fwc;
227 struct fw_state fw_st;
228 void *data;
229 size_t size;
230 size_t allocated_size;
231#ifdef CONFIG_FW_LOADER_USER_HELPER
232 bool is_paged_buf;
233 bool need_uevent;
234 struct page **pages;
235 int nr_pages;
236 int page_array_size;
237 struct list_head pending_list;
238#endif
239 const char *fw_id;
240};
241
242struct fw_cache_entry {
243 struct list_head list;
244 const char *name;
245};
246
247struct fw_name_devm {
248 unsigned long magic;
249 const char *name;
250};
251
252#define to_fwbuf(d) container_of(d, struct firmware_buf, ref)
253
254#define FW_LOADER_NO_CACHE 0
255#define FW_LOADER_START_CACHE 1
256
257static int fw_cache_piggyback_on_request(const char *name);
258
259/* fw_lock could be moved to 'struct firmware_priv' but since it is just
260 * guarding for corner cases a global lock should be OK */
261static DEFINE_MUTEX(fw_lock);
262
263static struct firmware_cache fw_cache;
264
265static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
266 struct firmware_cache *fwc,
267 void *dbuf, size_t size)
268{
269 struct firmware_buf *buf;
270
271 buf = kzalloc(sizeof(*buf), GFP_ATOMIC);
272 if (!buf)
273 return NULL;
274
275 buf->fw_id = kstrdup_const(fw_name, GFP_ATOMIC);
276 if (!buf->fw_id) {
277 kfree(buf);
278 return NULL;
279 }
280
281 kref_init(&buf->ref);
282 buf->fwc = fwc;
283 buf->data = dbuf;
284 buf->allocated_size = size;
285 fw_state_init(&buf->fw_st);
286#ifdef CONFIG_FW_LOADER_USER_HELPER
287 INIT_LIST_HEAD(&buf->pending_list);
288#endif
289
290 pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
291
292 return buf;
293}
294
295static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
296{
297 struct firmware_buf *tmp;
298 struct firmware_cache *fwc = &fw_cache;
299
300 list_for_each_entry(tmp, &fwc->head, list)
301 if (!strcmp(tmp->fw_id, fw_name))
302 return tmp;
303 return NULL;
304}
305
306static int fw_lookup_and_allocate_buf(const char *fw_name,
307 struct firmware_cache *fwc,
308 struct firmware_buf **buf, void *dbuf,
309 size_t size)
310{
311 struct firmware_buf *tmp;
312
313 spin_lock(&fwc->lock);
314 tmp = __fw_lookup_buf(fw_name);
315 if (tmp) {
316 kref_get(&tmp->ref);
317 spin_unlock(&fwc->lock);
318 *buf = tmp;
319 return 1;
320 }
321 tmp = __allocate_fw_buf(fw_name, fwc, dbuf, size);
322 if (tmp)
323 list_add(&tmp->list, &fwc->head);
324 spin_unlock(&fwc->lock);
325
326 *buf = tmp;
327
328 return tmp ? 0 : -ENOMEM;
329}
330
331static void __fw_free_buf(struct kref *ref)
332 __releases(&fwc->lock)
333{
334 struct firmware_buf *buf = to_fwbuf(ref);
335 struct firmware_cache *fwc = buf->fwc;
336
337 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
338 __func__, buf->fw_id, buf, buf->data,
339 (unsigned int)buf->size);
340
341 list_del(&buf->list);
342 spin_unlock(&fwc->lock);
343
344#ifdef CONFIG_FW_LOADER_USER_HELPER
345 if (buf->is_paged_buf) {
346 int i;
347 vunmap(buf->data);
348 for (i = 0; i < buf->nr_pages; i++)
349 __free_page(buf->pages[i]);
350 vfree(buf->pages);
351 } else
352#endif
353 if (!buf->allocated_size)
354 vfree(buf->data);
355 kfree_const(buf->fw_id);
356 kfree(buf);
357}
358
359static void fw_free_buf(struct firmware_buf *buf)
360{
361 struct firmware_cache *fwc = buf->fwc;
362 spin_lock(&fwc->lock);
363 if (!kref_put(&buf->ref, __fw_free_buf))
364 spin_unlock(&fwc->lock);
365}
366
367/* direct firmware loading support */
368static char fw_path_para[256];
369static const char * const fw_path[] = {
370 fw_path_para,
371 "/lib/firmware/updates/" UTS_RELEASE,
372 "/lib/firmware/updates",
373 "/lib/firmware/" UTS_RELEASE,
374 "/lib/firmware"
375};
376
377/*
378 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
379 * from kernel command line because firmware_class is generally built in
380 * kernel instead of module.
381 */
382module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644);
383MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path");
384
385static int
386fw_get_filesystem_firmware(struct device *device, struct firmware_buf *buf)
387{
388 loff_t size;
389 int i, len;
390 int rc = -ENOENT;
391 char *path;
392 enum kernel_read_file_id id = READING_FIRMWARE;
393 size_t msize = INT_MAX;
394
395 /* Already populated data member means we're loading into a buffer */
396 if (buf->data) {
397 id = READING_FIRMWARE_PREALLOC_BUFFER;
398 msize = buf->allocated_size;
399 }
400
401 path = __getname();
402 if (!path)
403 return -ENOMEM;
404
405 for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
406 /* skip the unset customized path */
407 if (!fw_path[i][0])
408 continue;
409
410 len = snprintf(path, PATH_MAX, "%s/%s",
411 fw_path[i], buf->fw_id);
412 if (len >= PATH_MAX) {
413 rc = -ENAMETOOLONG;
414 break;
415 }
416
417 buf->size = 0;
418 rc = kernel_read_file_from_path(path, &buf->data, &size, msize,
419 id);
420 if (rc) {
421 if (rc == -ENOENT)
422 dev_dbg(device, "loading %s failed with error %d\n",
423 path, rc);
424 else
425 dev_warn(device, "loading %s failed with error %d\n",
426 path, rc);
427 continue;
428 }
429 dev_dbg(device, "direct-loading %s\n", buf->fw_id);
430 buf->size = size;
431 fw_state_done(&buf->fw_st);
432 break;
433 }
434 __putname(path);
435
436 return rc;
437}
438
439/* firmware holds the ownership of pages */
440static void firmware_free_data(const struct firmware *fw)
441{
442 /* Loaded directly? */
443 if (!fw->priv) {
444 vfree(fw->data);
445 return;
446 }
447 fw_free_buf(fw->priv);
448}
449
450/* store the pages buffer info firmware from buf */
451static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
452{
453 fw->priv = buf;
454#ifdef CONFIG_FW_LOADER_USER_HELPER
455 fw->pages = buf->pages;
456#endif
457 fw->size = buf->size;
458 fw->data = buf->data;
459
460 pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
461 __func__, buf->fw_id, buf, buf->data,
462 (unsigned int)buf->size);
463}
464
465#ifdef CONFIG_PM_SLEEP
466static void fw_name_devm_release(struct device *dev, void *res)
467{
468 struct fw_name_devm *fwn = res;
469
470 if (fwn->magic == (unsigned long)&fw_cache)
471 pr_debug("%s: fw_name-%s devm-%p released\n",
472 __func__, fwn->name, res);
473 kfree_const(fwn->name);
474}
475
476static int fw_devm_match(struct device *dev, void *res,
477 void *match_data)
478{
479 struct fw_name_devm *fwn = res;
480
481 return (fwn->magic == (unsigned long)&fw_cache) &&
482 !strcmp(fwn->name, match_data);
483}
484
485static struct fw_name_devm *fw_find_devm_name(struct device *dev,
486 const char *name)
487{
488 struct fw_name_devm *fwn;
489
490 fwn = devres_find(dev, fw_name_devm_release,
491 fw_devm_match, (void *)name);
492 return fwn;
493}
494
495/* add firmware name into devres list */
496static int fw_add_devm_name(struct device *dev, const char *name)
497{
498 struct fw_name_devm *fwn;
499
500 fwn = fw_find_devm_name(dev, name);
501 if (fwn)
502 return 1;
503
504 fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm),
505 GFP_KERNEL);
506 if (!fwn)
507 return -ENOMEM;
508 fwn->name = kstrdup_const(name, GFP_KERNEL);
509 if (!fwn->name) {
510 devres_free(fwn);
511 return -ENOMEM;
512 }
513
514 fwn->magic = (unsigned long)&fw_cache;
515 devres_add(dev, fwn);
516
517 return 0;
518}
519#else
520static int fw_add_devm_name(struct device *dev, const char *name)
521{
522 return 0;
523}
524#endif
525
526
527/*
528 * user-mode helper code
529 */
530#ifdef CONFIG_FW_LOADER_USER_HELPER
531struct firmware_priv {
532 bool nowait;
533 struct device dev;
534 struct firmware_buf *buf;
535 struct firmware *fw;
536};
537
538static struct firmware_priv *to_firmware_priv(struct device *dev)
539{
540 return container_of(dev, struct firmware_priv, dev);
541}
542
543static void __fw_load_abort(struct firmware_buf *buf)
544{
545 /*
546 * There is a small window in which user can write to 'loading'
547 * between loading done and disappearance of 'loading'
548 */
549 if (fw_state_is_done(&buf->fw_st))
550 return;
551
552 list_del_init(&buf->pending_list);
553 fw_state_aborted(&buf->fw_st);
554}
555
556static void fw_load_abort(struct firmware_priv *fw_priv)
557{
558 struct firmware_buf *buf = fw_priv->buf;
559
560 __fw_load_abort(buf);
561}
562
563static LIST_HEAD(pending_fw_head);
564
565/* reboot notifier for avoid deadlock with usermode_lock */
566static int fw_shutdown_notify(struct notifier_block *unused1,
567 unsigned long unused2, void *unused3)
568{
569 mutex_lock(&fw_lock);
570 while (!list_empty(&pending_fw_head))
571 __fw_load_abort(list_first_entry(&pending_fw_head,
572 struct firmware_buf,
573 pending_list));
574 mutex_unlock(&fw_lock);
575 return NOTIFY_DONE;
576}
577
578static struct notifier_block fw_shutdown_nb = {
579 .notifier_call = fw_shutdown_notify,
580};
581
582static ssize_t timeout_show(struct class *class, struct class_attribute *attr,
583 char *buf)
584{
585 return sprintf(buf, "%d\n", loading_timeout);
586}
587
588/**
589 * firmware_timeout_store - set number of seconds to wait for firmware
590 * @class: device class pointer
591 * @attr: device attribute pointer
592 * @buf: buffer to scan for timeout value
593 * @count: number of bytes in @buf
594 *
595 * Sets the number of seconds to wait for the firmware. Once
596 * this expires an error will be returned to the driver and no
597 * firmware will be provided.
598 *
599 * Note: zero means 'wait forever'.
600 **/
601static ssize_t timeout_store(struct class *class, struct class_attribute *attr,
602 const char *buf, size_t count)
603{
604 loading_timeout = simple_strtol(buf, NULL, 10);
605 if (loading_timeout < 0)
606 loading_timeout = 0;
607
608 return count;
609}
610static CLASS_ATTR_RW(timeout);
611
612static struct attribute *firmware_class_attrs[] = {
613 &class_attr_timeout.attr,
614 NULL,
615};
616ATTRIBUTE_GROUPS(firmware_class);
617
618static void fw_dev_release(struct device *dev)
619{
620 struct firmware_priv *fw_priv = to_firmware_priv(dev);
621
622 kfree(fw_priv);
623}
624
625static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
626{
627 if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
628 return -ENOMEM;
629 if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
630 return -ENOMEM;
631 if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
632 return -ENOMEM;
633
634 return 0;
635}
636
637static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
638{
639 struct firmware_priv *fw_priv = to_firmware_priv(dev);
640 int err = 0;
641
642 mutex_lock(&fw_lock);
643 if (fw_priv->buf)
644 err = do_firmware_uevent(fw_priv, env);
645 mutex_unlock(&fw_lock);
646 return err;
647}
648
649static struct class firmware_class = {
650 .name = "firmware",
651 .class_groups = firmware_class_groups,
652 .dev_uevent = firmware_uevent,
653 .dev_release = fw_dev_release,
654};
655
656static ssize_t firmware_loading_show(struct device *dev,
657 struct device_attribute *attr, char *buf)
658{
659 struct firmware_priv *fw_priv = to_firmware_priv(dev);
660 int loading = 0;
661
662 mutex_lock(&fw_lock);
663 if (fw_priv->buf)
664 loading = fw_state_is_loading(&fw_priv->buf->fw_st);
665 mutex_unlock(&fw_lock);
666
667 return sprintf(buf, "%d\n", loading);
668}
669
670/* Some architectures don't have PAGE_KERNEL_RO */
671#ifndef PAGE_KERNEL_RO
672#define PAGE_KERNEL_RO PAGE_KERNEL
673#endif
674
675/* one pages buffer should be mapped/unmapped only once */
676static int fw_map_pages_buf(struct firmware_buf *buf)
677{
678 if (!buf->is_paged_buf)
679 return 0;
680
681 vunmap(buf->data);
682 buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
683 if (!buf->data)
684 return -ENOMEM;
685 return 0;
686}
687
688/**
689 * firmware_loading_store - set value in the 'loading' control file
690 * @dev: device pointer
691 * @attr: device attribute pointer
692 * @buf: buffer to scan for loading control value
693 * @count: number of bytes in @buf
694 *
695 * The relevant values are:
696 *
697 * 1: Start a load, discarding any previous partial load.
698 * 0: Conclude the load and hand the data to the driver code.
699 * -1: Conclude the load with an error and discard any written data.
700 **/
701static ssize_t firmware_loading_store(struct device *dev,
702 struct device_attribute *attr,
703 const char *buf, size_t count)
704{
705 struct firmware_priv *fw_priv = to_firmware_priv(dev);
706 struct firmware_buf *fw_buf;
707 ssize_t written = count;
708 int loading = simple_strtol(buf, NULL, 10);
709 int i;
710
711 mutex_lock(&fw_lock);
712 fw_buf = fw_priv->buf;
713 if (fw_state_is_aborted(&fw_buf->fw_st))
714 goto out;
715
716 switch (loading) {
717 case 1:
718 /* discarding any previous partial load */
719 if (!fw_state_is_done(&fw_buf->fw_st)) {
720 for (i = 0; i < fw_buf->nr_pages; i++)
721 __free_page(fw_buf->pages[i]);
722 vfree(fw_buf->pages);
723 fw_buf->pages = NULL;
724 fw_buf->page_array_size = 0;
725 fw_buf->nr_pages = 0;
726 fw_state_start(&fw_buf->fw_st);
727 }
728 break;
729 case 0:
730 if (fw_state_is_loading(&fw_buf->fw_st)) {
731 int rc;
732
733 /*
734 * Several loading requests may be pending on
735 * one same firmware buf, so let all requests
736 * see the mapped 'buf->data' once the loading
737 * is completed.
738 * */
739 rc = fw_map_pages_buf(fw_buf);
740 if (rc)
741 dev_err(dev, "%s: map pages failed\n",
742 __func__);
743 else
744 rc = security_kernel_post_read_file(NULL,
745 fw_buf->data, fw_buf->size,
746 READING_FIRMWARE);
747
748 /*
749 * Same logic as fw_load_abort, only the DONE bit
750 * is ignored and we set ABORT only on failure.
751 */
752 list_del_init(&fw_buf->pending_list);
753 if (rc) {
754 fw_state_aborted(&fw_buf->fw_st);
755 written = rc;
756 } else {
757 fw_state_done(&fw_buf->fw_st);
758 }
759 break;
760 }
761 /* fallthrough */
762 default:
763 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
764 /* fallthrough */
765 case -1:
766 fw_load_abort(fw_priv);
767 break;
768 }
769out:
770 mutex_unlock(&fw_lock);
771 return written;
772}
773
774static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
775
776static void firmware_rw_buf(struct firmware_buf *buf, char *buffer,
777 loff_t offset, size_t count, bool read)
778{
779 if (read)
780 memcpy(buffer, buf->data + offset, count);
781 else
782 memcpy(buf->data + offset, buffer, count);
783}
784
785static void firmware_rw(struct firmware_buf *buf, char *buffer,
786 loff_t offset, size_t count, bool read)
787{
788 while (count) {
789 void *page_data;
790 int page_nr = offset >> PAGE_SHIFT;
791 int page_ofs = offset & (PAGE_SIZE-1);
792 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
793
794 page_data = kmap(buf->pages[page_nr]);
795
796 if (read)
797 memcpy(buffer, page_data + page_ofs, page_cnt);
798 else
799 memcpy(page_data + page_ofs, buffer, page_cnt);
800
801 kunmap(buf->pages[page_nr]);
802 buffer += page_cnt;
803 offset += page_cnt;
804 count -= page_cnt;
805 }
806}
807
808static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
809 struct bin_attribute *bin_attr,
810 char *buffer, loff_t offset, size_t count)
811{
812 struct device *dev = kobj_to_dev(kobj);
813 struct firmware_priv *fw_priv = to_firmware_priv(dev);
814 struct firmware_buf *buf;
815 ssize_t ret_count;
816
817 mutex_lock(&fw_lock);
818 buf = fw_priv->buf;
819 if (!buf || fw_state_is_done(&buf->fw_st)) {
820 ret_count = -ENODEV;
821 goto out;
822 }
823 if (offset > buf->size) {
824 ret_count = 0;
825 goto out;
826 }
827 if (count > buf->size - offset)
828 count = buf->size - offset;
829
830 ret_count = count;
831
832 if (buf->data)
833 firmware_rw_buf(buf, buffer, offset, count, true);
834 else
835 firmware_rw(buf, buffer, offset, count, true);
836
837out:
838 mutex_unlock(&fw_lock);
839 return ret_count;
840}
841
842static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
843{
844 struct firmware_buf *buf = fw_priv->buf;
845 int pages_needed = PAGE_ALIGN(min_size) >> PAGE_SHIFT;
846
847 /* If the array of pages is too small, grow it... */
848 if (buf->page_array_size < pages_needed) {
849 int new_array_size = max(pages_needed,
850 buf->page_array_size * 2);
851 struct page **new_pages;
852
853 new_pages = vmalloc(new_array_size * sizeof(void *));
854 if (!new_pages) {
855 fw_load_abort(fw_priv);
856 return -ENOMEM;
857 }
858 memcpy(new_pages, buf->pages,
859 buf->page_array_size * sizeof(void *));
860 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
861 (new_array_size - buf->page_array_size));
862 vfree(buf->pages);
863 buf->pages = new_pages;
864 buf->page_array_size = new_array_size;
865 }
866
867 while (buf->nr_pages < pages_needed) {
868 buf->pages[buf->nr_pages] =
869 alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
870
871 if (!buf->pages[buf->nr_pages]) {
872 fw_load_abort(fw_priv);
873 return -ENOMEM;
874 }
875 buf->nr_pages++;
876 }
877 return 0;
878}
879
880/**
881 * firmware_data_write - write method for firmware
882 * @filp: open sysfs file
883 * @kobj: kobject for the device
884 * @bin_attr: bin_attr structure
885 * @buffer: buffer being written
886 * @offset: buffer offset for write in total data store area
887 * @count: buffer size
888 *
889 * Data written to the 'data' attribute will be later handed to
890 * the driver as a firmware image.
891 **/
892static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
893 struct bin_attribute *bin_attr,
894 char *buffer, loff_t offset, size_t count)
895{
896 struct device *dev = kobj_to_dev(kobj);
897 struct firmware_priv *fw_priv = to_firmware_priv(dev);
898 struct firmware_buf *buf;
899 ssize_t retval;
900
901 if (!capable(CAP_SYS_RAWIO))
902 return -EPERM;
903
904 mutex_lock(&fw_lock);
905 buf = fw_priv->buf;
906 if (!buf || fw_state_is_done(&buf->fw_st)) {
907 retval = -ENODEV;
908 goto out;
909 }
910
911 if (buf->data) {
912 if (offset + count > buf->allocated_size) {
913 retval = -ENOMEM;
914 goto out;
915 }
916 firmware_rw_buf(buf, buffer, offset, count, false);
917 retval = count;
918 } else {
919 retval = fw_realloc_buffer(fw_priv, offset + count);
920 if (retval)
921 goto out;
922
923 retval = count;
924 firmware_rw(buf, buffer, offset, count, false);
925 }
926
927 buf->size = max_t(size_t, offset + count, buf->size);
928out:
929 mutex_unlock(&fw_lock);
930 return retval;
931}
932
933static struct bin_attribute firmware_attr_data = {
934 .attr = { .name = "data", .mode = 0644 },
935 .size = 0,
936 .read = firmware_data_read,
937 .write = firmware_data_write,
938};
939
940static struct attribute *fw_dev_attrs[] = {
941 &dev_attr_loading.attr,
942 NULL
943};
944
945static struct bin_attribute *fw_dev_bin_attrs[] = {
946 &firmware_attr_data,
947 NULL
948};
949
950static const struct attribute_group fw_dev_attr_group = {
951 .attrs = fw_dev_attrs,
952 .bin_attrs = fw_dev_bin_attrs,
953};
954
955static const struct attribute_group *fw_dev_attr_groups[] = {
956 &fw_dev_attr_group,
957 NULL
958};
959
960static struct firmware_priv *
961fw_create_instance(struct firmware *firmware, const char *fw_name,
962 struct device *device, unsigned int opt_flags)
963{
964 struct firmware_priv *fw_priv;
965 struct device *f_dev;
966
967 fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
968 if (!fw_priv) {
969 fw_priv = ERR_PTR(-ENOMEM);
970 goto exit;
971 }
972
973 fw_priv->nowait = !!(opt_flags & FW_OPT_NOWAIT);
974 fw_priv->fw = firmware;
975 f_dev = &fw_priv->dev;
976
977 device_initialize(f_dev);
978 dev_set_name(f_dev, "%s", fw_name);
979 f_dev->parent = device;
980 f_dev->class = &firmware_class;
981 f_dev->groups = fw_dev_attr_groups;
982exit:
983 return fw_priv;
984}
985
986/* load a firmware via user helper */
987static int _request_firmware_load(struct firmware_priv *fw_priv,
988 unsigned int opt_flags, long timeout)
989{
990 int retval = 0;
991 struct device *f_dev = &fw_priv->dev;
992 struct firmware_buf *buf = fw_priv->buf;
993
994 /* fall back on userspace loading */
995 if (!buf->data)
996 buf->is_paged_buf = true;
997
998 dev_set_uevent_suppress(f_dev, true);
999
1000 retval = device_add(f_dev);
1001 if (retval) {
1002 dev_err(f_dev, "%s: device_register failed\n", __func__);
1003 goto err_put_dev;
1004 }
1005
1006 mutex_lock(&fw_lock);
1007 list_add(&buf->pending_list, &pending_fw_head);
1008 mutex_unlock(&fw_lock);
1009
1010 if (opt_flags & FW_OPT_UEVENT) {
1011 buf->need_uevent = true;
1012 dev_set_uevent_suppress(f_dev, false);
1013 dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
1014 kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
1015 } else {
1016 timeout = MAX_JIFFY_OFFSET;
1017 }
1018
1019 retval = fw_state_wait_timeout(&buf->fw_st, timeout);
1020 if (retval < 0) {
1021 mutex_lock(&fw_lock);
1022 fw_load_abort(fw_priv);
1023 mutex_unlock(&fw_lock);
1024 }
1025
1026 if (fw_state_is_aborted(&buf->fw_st))
1027 retval = -EAGAIN;
1028 else if (buf->is_paged_buf && !buf->data)
1029 retval = -ENOMEM;
1030
1031 device_del(f_dev);
1032err_put_dev:
1033 put_device(f_dev);
1034 return retval;
1035}
1036
1037static int fw_load_from_user_helper(struct firmware *firmware,
1038 const char *name, struct device *device,
1039 unsigned int opt_flags, long timeout)
1040{
1041 struct firmware_priv *fw_priv;
1042
1043 fw_priv = fw_create_instance(firmware, name, device, opt_flags);
1044 if (IS_ERR(fw_priv))
1045 return PTR_ERR(fw_priv);
1046
1047 fw_priv->buf = firmware->priv;
1048 return _request_firmware_load(fw_priv, opt_flags, timeout);
1049}
1050
1051#ifdef CONFIG_PM_SLEEP
1052/* kill pending requests without uevent to avoid blocking suspend */
1053static void kill_requests_without_uevent(void)
1054{
1055 struct firmware_buf *buf;
1056 struct firmware_buf *next;
1057
1058 mutex_lock(&fw_lock);
1059 list_for_each_entry_safe(buf, next, &pending_fw_head, pending_list) {
1060 if (!buf->need_uevent)
1061 __fw_load_abort(buf);
1062 }
1063 mutex_unlock(&fw_lock);
1064}
1065#endif
1066
1067#else /* CONFIG_FW_LOADER_USER_HELPER */
1068static inline int
1069fw_load_from_user_helper(struct firmware *firmware, const char *name,
1070 struct device *device, unsigned int opt_flags,
1071 long timeout)
1072{
1073 return -ENOENT;
1074}
1075
1076#ifdef CONFIG_PM_SLEEP
1077static inline void kill_requests_without_uevent(void) { }
1078#endif
1079
1080#endif /* CONFIG_FW_LOADER_USER_HELPER */
1081
1082/* prepare firmware and firmware_buf structs;
1083 * return 0 if a firmware is already assigned, 1 if need to load one,
1084 * or a negative error code
1085 */
1086static int
1087_request_firmware_prepare(struct firmware **firmware_p, const char *name,
1088 struct device *device, void *dbuf, size_t size)
1089{
1090 struct firmware *firmware;
1091 struct firmware_buf *buf;
1092 int ret;
1093
1094 *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
1095 if (!firmware) {
1096 dev_err(device, "%s: kmalloc(struct firmware) failed\n",
1097 __func__);
1098 return -ENOMEM;
1099 }
1100
1101 if (fw_get_builtin_firmware(firmware, name, dbuf, size)) {
1102 dev_dbg(device, "using built-in %s\n", name);
1103 return 0; /* assigned */
1104 }
1105
1106 ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf, dbuf, size);
1107
1108 /*
1109 * bind with 'buf' now to avoid warning in failure path
1110 * of requesting firmware.
1111 */
1112 firmware->priv = buf;
1113
1114 if (ret > 0) {
1115 ret = fw_state_wait(&buf->fw_st);
1116 if (!ret) {
1117 fw_set_page_data(buf, firmware);
1118 return 0; /* assigned */
1119 }
1120 }
1121
1122 if (ret < 0)
1123 return ret;
1124 return 1; /* need to load */
1125}
1126
1127static int assign_firmware_buf(struct firmware *fw, struct device *device,
1128 unsigned int opt_flags)
1129{
1130 struct firmware_buf *buf = fw->priv;
1131
1132 mutex_lock(&fw_lock);
1133 if (!buf->size || fw_state_is_aborted(&buf->fw_st)) {
1134 mutex_unlock(&fw_lock);
1135 return -ENOENT;
1136 }
1137
1138 /*
1139 * add firmware name into devres list so that we can auto cache
1140 * and uncache firmware for device.
1141 *
1142 * device may has been deleted already, but the problem
1143 * should be fixed in devres or driver core.
1144 */
1145 /* don't cache firmware handled without uevent */
1146 if (device && (opt_flags & FW_OPT_UEVENT) &&
1147 !(opt_flags & FW_OPT_NOCACHE))
1148 fw_add_devm_name(device, buf->fw_id);
1149
1150 /*
1151 * After caching firmware image is started, let it piggyback
1152 * on request firmware.
1153 */
1154 if (!(opt_flags & FW_OPT_NOCACHE) &&
1155 buf->fwc->state == FW_LOADER_START_CACHE) {
1156 if (fw_cache_piggyback_on_request(buf->fw_id))
1157 kref_get(&buf->ref);
1158 }
1159
1160 /* pass the pages buffer to driver at the last minute */
1161 fw_set_page_data(buf, fw);
1162 mutex_unlock(&fw_lock);
1163 return 0;
1164}
1165
1166/* called from request_firmware() and request_firmware_work_func() */
1167static int
1168_request_firmware(const struct firmware **firmware_p, const char *name,
1169 struct device *device, void *buf, size_t size,
1170 unsigned int opt_flags)
1171{
1172 struct firmware *fw = NULL;
1173 long timeout;
1174 int ret;
1175
1176 if (!firmware_p)
1177 return -EINVAL;
1178
1179 if (!name || name[0] == '\0') {
1180 ret = -EINVAL;
1181 goto out;
1182 }
1183
1184 ret = _request_firmware_prepare(&fw, name, device, buf, size);
1185 if (ret <= 0) /* error or already assigned */
1186 goto out;
1187
1188 ret = 0;
1189 timeout = firmware_loading_timeout();
1190 if (opt_flags & FW_OPT_NOWAIT) {
1191 timeout = usermodehelper_read_lock_wait(timeout);
1192 if (!timeout) {
1193 dev_dbg(device, "firmware: %s loading timed out\n",
1194 name);
1195 ret = -EBUSY;
1196 goto out;
1197 }
1198 } else {
1199 ret = usermodehelper_read_trylock();
1200 if (WARN_ON(ret)) {
1201 dev_err(device, "firmware: %s will not be loaded\n",
1202 name);
1203 goto out;
1204 }
1205 }
1206
1207 ret = fw_get_filesystem_firmware(device, fw->priv);
1208 if (ret) {
1209 if (!(opt_flags & FW_OPT_NO_WARN))
1210 dev_warn(device,
1211 "Direct firmware load for %s failed with error %d\n",
1212 name, ret);
1213 if (opt_flags & FW_OPT_USERHELPER) {
1214 dev_warn(device, "Falling back to user helper\n");
1215 ret = fw_load_from_user_helper(fw, name, device,
1216 opt_flags, timeout);
1217 }
1218 }
1219
1220 if (!ret)
1221 ret = assign_firmware_buf(fw, device, opt_flags);
1222
1223 usermodehelper_read_unlock();
1224
1225 out:
1226 if (ret < 0) {
1227 release_firmware(fw);
1228 fw = NULL;
1229 }
1230
1231 *firmware_p = fw;
1232 return ret;
1233}
1234
1235/**
1236 * request_firmware: - send firmware request and wait for it
1237 * @firmware_p: pointer to firmware image
1238 * @name: name of firmware file
1239 * @device: device for which firmware is being loaded
1240 *
1241 * @firmware_p will be used to return a firmware image by the name
1242 * of @name for device @device.
1243 *
1244 * Should be called from user context where sleeping is allowed.
1245 *
1246 * @name will be used as $FIRMWARE in the uevent environment and
1247 * should be distinctive enough not to be confused with any other
1248 * firmware image for this or any other device.
1249 *
1250 * Caller must hold the reference count of @device.
1251 *
1252 * The function can be called safely inside device's suspend and
1253 * resume callback.
1254 **/
1255int
1256request_firmware(const struct firmware **firmware_p, const char *name,
1257 struct device *device)
1258{
1259 int ret;
1260
1261 /* Need to pin this module until return */
1262 __module_get(THIS_MODULE);
1263 ret = _request_firmware(firmware_p, name, device, NULL, 0,
1264 FW_OPT_UEVENT | FW_OPT_FALLBACK);
1265 module_put(THIS_MODULE);
1266 return ret;
1267}
1268EXPORT_SYMBOL(request_firmware);
1269
1270/**
1271 * request_firmware_direct: - load firmware directly without usermode helper
1272 * @firmware_p: pointer to firmware image
1273 * @name: name of firmware file
1274 * @device: device for which firmware is being loaded
1275 *
1276 * This function works pretty much like request_firmware(), but this doesn't
1277 * fall back to usermode helper even if the firmware couldn't be loaded
1278 * directly from fs. Hence it's useful for loading optional firmwares, which
1279 * aren't always present, without extra long timeouts of udev.
1280 **/
1281int request_firmware_direct(const struct firmware **firmware_p,
1282 const char *name, struct device *device)
1283{
1284 int ret;
1285
1286 __module_get(THIS_MODULE);
1287 ret = _request_firmware(firmware_p, name, device, NULL, 0,
1288 FW_OPT_UEVENT | FW_OPT_NO_WARN);
1289 module_put(THIS_MODULE);
1290 return ret;
1291}
1292EXPORT_SYMBOL_GPL(request_firmware_direct);
1293
1294/**
1295 * request_firmware_into_buf - load firmware into a previously allocated buffer
1296 * @firmware_p: pointer to firmware image
1297 * @name: name of firmware file
1298 * @device: device for which firmware is being loaded and DMA region allocated
1299 * @buf: address of buffer to load firmware into
1300 * @size: size of buffer
1301 *
1302 * This function works pretty much like request_firmware(), but it doesn't
1303 * allocate a buffer to hold the firmware data. Instead, the firmware
1304 * is loaded directly into the buffer pointed to by @buf and the @firmware_p
1305 * data member is pointed at @buf.
1306 *
1307 * This function doesn't cache firmware either.
1308 */
1309int
1310request_firmware_into_buf(const struct firmware **firmware_p, const char *name,
1311 struct device *device, void *buf, size_t size)
1312{
1313 int ret;
1314
1315 __module_get(THIS_MODULE);
1316 ret = _request_firmware(firmware_p, name, device, buf, size,
1317 FW_OPT_UEVENT | FW_OPT_FALLBACK |
1318 FW_OPT_NOCACHE);
1319 module_put(THIS_MODULE);
1320 return ret;
1321}
1322EXPORT_SYMBOL(request_firmware_into_buf);
1323
1324/**
1325 * release_firmware: - release the resource associated with a firmware image
1326 * @fw: firmware resource to release
1327 **/
1328void release_firmware(const struct firmware *fw)
1329{
1330 if (fw) {
1331 if (!fw_is_builtin_firmware(fw))
1332 firmware_free_data(fw);
1333 kfree(fw);
1334 }
1335}
1336EXPORT_SYMBOL(release_firmware);
1337
1338/* Async support */
1339struct firmware_work {
1340 struct work_struct work;
1341 struct module *module;
1342 const char *name;
1343 struct device *device;
1344 void *context;
1345 void (*cont)(const struct firmware *fw, void *context);
1346 unsigned int opt_flags;
1347};
1348
1349static void request_firmware_work_func(struct work_struct *work)
1350{
1351 struct firmware_work *fw_work;
1352 const struct firmware *fw;
1353
1354 fw_work = container_of(work, struct firmware_work, work);
1355
1356 _request_firmware(&fw, fw_work->name, fw_work->device, NULL, 0,
1357 fw_work->opt_flags);
1358 fw_work->cont(fw, fw_work->context);
1359 put_device(fw_work->device); /* taken in request_firmware_nowait() */
1360
1361 module_put(fw_work->module);
1362 kfree_const(fw_work->name);
1363 kfree(fw_work);
1364}
1365
1366/**
1367 * request_firmware_nowait - asynchronous version of request_firmware
1368 * @module: module requesting the firmware
1369 * @uevent: sends uevent to copy the firmware image if this flag
1370 * is non-zero else the firmware copy must be done manually.
1371 * @name: name of firmware file
1372 * @device: device for which firmware is being loaded
1373 * @gfp: allocation flags
1374 * @context: will be passed over to @cont, and
1375 * @fw may be %NULL if firmware request fails.
1376 * @cont: function will be called asynchronously when the firmware
1377 * request is over.
1378 *
1379 * Caller must hold the reference count of @device.
1380 *
1381 * Asynchronous variant of request_firmware() for user contexts:
1382 * - sleep for as small periods as possible since it may
1383 * increase kernel boot time of built-in device drivers
1384 * requesting firmware in their ->probe() methods, if
1385 * @gfp is GFP_KERNEL.
1386 *
1387 * - can't sleep at all if @gfp is GFP_ATOMIC.
1388 **/
1389int
1390request_firmware_nowait(
1391 struct module *module, bool uevent,
1392 const char *name, struct device *device, gfp_t gfp, void *context,
1393 void (*cont)(const struct firmware *fw, void *context))
1394{
1395 struct firmware_work *fw_work;
1396
1397 fw_work = kzalloc(sizeof(struct firmware_work), gfp);
1398 if (!fw_work)
1399 return -ENOMEM;
1400
1401 fw_work->module = module;
1402 fw_work->name = kstrdup_const(name, gfp);
1403 if (!fw_work->name) {
1404 kfree(fw_work);
1405 return -ENOMEM;
1406 }
1407 fw_work->device = device;
1408 fw_work->context = context;
1409 fw_work->cont = cont;
1410 fw_work->opt_flags = FW_OPT_NOWAIT | FW_OPT_FALLBACK |
1411 (uevent ? FW_OPT_UEVENT : FW_OPT_USERHELPER);
1412
1413 if (!try_module_get(module)) {
1414 kfree_const(fw_work->name);
1415 kfree(fw_work);
1416 return -EFAULT;
1417 }
1418
1419 get_device(fw_work->device);
1420 INIT_WORK(&fw_work->work, request_firmware_work_func);
1421 schedule_work(&fw_work->work);
1422 return 0;
1423}
1424EXPORT_SYMBOL(request_firmware_nowait);
1425
1426#ifdef CONFIG_PM_SLEEP
1427static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);
1428
1429/**
1430 * cache_firmware - cache one firmware image in kernel memory space
1431 * @fw_name: the firmware image name
1432 *
1433 * Cache firmware in kernel memory so that drivers can use it when
1434 * system isn't ready for them to request firmware image from userspace.
1435 * Once it returns successfully, driver can use request_firmware or its
1436 * nowait version to get the cached firmware without any interacting
1437 * with userspace
1438 *
1439 * Return 0 if the firmware image has been cached successfully
1440 * Return !0 otherwise
1441 *
1442 */
1443static int cache_firmware(const char *fw_name)
1444{
1445 int ret;
1446 const struct firmware *fw;
1447
1448 pr_debug("%s: %s\n", __func__, fw_name);
1449
1450 ret = request_firmware(&fw, fw_name, NULL);
1451 if (!ret)
1452 kfree(fw);
1453
1454 pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);
1455
1456 return ret;
1457}
1458
1459static struct firmware_buf *fw_lookup_buf(const char *fw_name)
1460{
1461 struct firmware_buf *tmp;
1462 struct firmware_cache *fwc = &fw_cache;
1463
1464 spin_lock(&fwc->lock);
1465 tmp = __fw_lookup_buf(fw_name);
1466 spin_unlock(&fwc->lock);
1467
1468 return tmp;
1469}
1470
1471/**
1472 * uncache_firmware - remove one cached firmware image
1473 * @fw_name: the firmware image name
1474 *
1475 * Uncache one firmware image which has been cached successfully
1476 * before.
1477 *
1478 * Return 0 if the firmware cache has been removed successfully
1479 * Return !0 otherwise
1480 *
1481 */
1482static int uncache_firmware(const char *fw_name)
1483{
1484 struct firmware_buf *buf;
1485 struct firmware fw;
1486
1487 pr_debug("%s: %s\n", __func__, fw_name);
1488
1489 if (fw_get_builtin_firmware(&fw, fw_name, NULL, 0))
1490 return 0;
1491
1492 buf = fw_lookup_buf(fw_name);
1493 if (buf) {
1494 fw_free_buf(buf);
1495 return 0;
1496 }
1497
1498 return -EINVAL;
1499}
1500
1501static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
1502{
1503 struct fw_cache_entry *fce;
1504
1505 fce = kzalloc(sizeof(*fce), GFP_ATOMIC);
1506 if (!fce)
1507 goto exit;
1508
1509 fce->name = kstrdup_const(name, GFP_ATOMIC);
1510 if (!fce->name) {
1511 kfree(fce);
1512 fce = NULL;
1513 goto exit;
1514 }
1515exit:
1516 return fce;
1517}
1518
1519static int __fw_entry_found(const char *name)
1520{
1521 struct firmware_cache *fwc = &fw_cache;
1522 struct fw_cache_entry *fce;
1523
1524 list_for_each_entry(fce, &fwc->fw_names, list) {
1525 if (!strcmp(fce->name, name))
1526 return 1;
1527 }
1528 return 0;
1529}
1530
1531static int fw_cache_piggyback_on_request(const char *name)
1532{
1533 struct firmware_cache *fwc = &fw_cache;
1534 struct fw_cache_entry *fce;
1535 int ret = 0;
1536
1537 spin_lock(&fwc->name_lock);
1538 if (__fw_entry_found(name))
1539 goto found;
1540
1541 fce = alloc_fw_cache_entry(name);
1542 if (fce) {
1543 ret = 1;
1544 list_add(&fce->list, &fwc->fw_names);
1545 pr_debug("%s: fw: %s\n", __func__, name);
1546 }
1547found:
1548 spin_unlock(&fwc->name_lock);
1549 return ret;
1550}
1551
1552static void free_fw_cache_entry(struct fw_cache_entry *fce)
1553{
1554 kfree_const(fce->name);
1555 kfree(fce);
1556}
1557
1558static void __async_dev_cache_fw_image(void *fw_entry,
1559 async_cookie_t cookie)
1560{
1561 struct fw_cache_entry *fce = fw_entry;
1562 struct firmware_cache *fwc = &fw_cache;
1563 int ret;
1564
1565 ret = cache_firmware(fce->name);
1566 if (ret) {
1567 spin_lock(&fwc->name_lock);
1568 list_del(&fce->list);
1569 spin_unlock(&fwc->name_lock);
1570
1571 free_fw_cache_entry(fce);
1572 }
1573}
1574
1575/* called with dev->devres_lock held */
1576static void dev_create_fw_entry(struct device *dev, void *res,
1577 void *data)
1578{
1579 struct fw_name_devm *fwn = res;
1580 const char *fw_name = fwn->name;
1581 struct list_head *head = data;
1582 struct fw_cache_entry *fce;
1583
1584 fce = alloc_fw_cache_entry(fw_name);
1585 if (fce)
1586 list_add(&fce->list, head);
1587}
1588
1589static int devm_name_match(struct device *dev, void *res,
1590 void *match_data)
1591{
1592 struct fw_name_devm *fwn = res;
1593 return (fwn->magic == (unsigned long)match_data);
1594}
1595
1596static void dev_cache_fw_image(struct device *dev, void *data)
1597{
1598 LIST_HEAD(todo);
1599 struct fw_cache_entry *fce;
1600 struct fw_cache_entry *fce_next;
1601 struct firmware_cache *fwc = &fw_cache;
1602
1603 devres_for_each_res(dev, fw_name_devm_release,
1604 devm_name_match, &fw_cache,
1605 dev_create_fw_entry, &todo);
1606
1607 list_for_each_entry_safe(fce, fce_next, &todo, list) {
1608 list_del(&fce->list);
1609
1610 spin_lock(&fwc->name_lock);
1611 /* only one cache entry for one firmware */
1612 if (!__fw_entry_found(fce->name)) {
1613 list_add(&fce->list, &fwc->fw_names);
1614 } else {
1615 free_fw_cache_entry(fce);
1616 fce = NULL;
1617 }
1618 spin_unlock(&fwc->name_lock);
1619
1620 if (fce)
1621 async_schedule_domain(__async_dev_cache_fw_image,
1622 (void *)fce,
1623 &fw_cache_domain);
1624 }
1625}
1626
1627static void __device_uncache_fw_images(void)
1628{
1629 struct firmware_cache *fwc = &fw_cache;
1630 struct fw_cache_entry *fce;
1631
1632 spin_lock(&fwc->name_lock);
1633 while (!list_empty(&fwc->fw_names)) {
1634 fce = list_entry(fwc->fw_names.next,
1635 struct fw_cache_entry, list);
1636 list_del(&fce->list);
1637 spin_unlock(&fwc->name_lock);
1638
1639 uncache_firmware(fce->name);
1640 free_fw_cache_entry(fce);
1641
1642 spin_lock(&fwc->name_lock);
1643 }
1644 spin_unlock(&fwc->name_lock);
1645}
1646
1647/**
1648 * device_cache_fw_images - cache devices' firmware
1649 *
1650 * If one device called request_firmware or its nowait version
1651 * successfully before, the firmware names are recored into the
1652 * device's devres link list, so device_cache_fw_images can call
1653 * cache_firmware() to cache these firmwares for the device,
1654 * then the device driver can load its firmwares easily at
1655 * time when system is not ready to complete loading firmware.
1656 */
1657static void device_cache_fw_images(void)
1658{
1659 struct firmware_cache *fwc = &fw_cache;
1660 int old_timeout;
1661 DEFINE_WAIT(wait);
1662
1663 pr_debug("%s\n", __func__);
1664
1665 /* cancel uncache work */
1666 cancel_delayed_work_sync(&fwc->work);
1667
1668 /*
1669 * use small loading timeout for caching devices' firmware
1670 * because all these firmware images have been loaded
1671 * successfully at lease once, also system is ready for
1672 * completing firmware loading now. The maximum size of
1673 * firmware in current distributions is about 2M bytes,
1674 * so 10 secs should be enough.
1675 */
1676 old_timeout = loading_timeout;
1677 loading_timeout = 10;
1678
1679 mutex_lock(&fw_lock);
1680 fwc->state = FW_LOADER_START_CACHE;
1681 dpm_for_each_dev(NULL, dev_cache_fw_image);
1682 mutex_unlock(&fw_lock);
1683
1684 /* wait for completion of caching firmware for all devices */
1685 async_synchronize_full_domain(&fw_cache_domain);
1686
1687 loading_timeout = old_timeout;
1688}
1689
1690/**
1691 * device_uncache_fw_images - uncache devices' firmware
1692 *
1693 * uncache all firmwares which have been cached successfully
1694 * by device_uncache_fw_images earlier
1695 */
1696static void device_uncache_fw_images(void)
1697{
1698 pr_debug("%s\n", __func__);
1699 __device_uncache_fw_images();
1700}
1701
1702static void device_uncache_fw_images_work(struct work_struct *work)
1703{
1704 device_uncache_fw_images();
1705}
1706
1707/**
1708 * device_uncache_fw_images_delay - uncache devices firmwares
1709 * @delay: number of milliseconds to delay uncache device firmwares
1710 *
1711 * uncache all devices's firmwares which has been cached successfully
1712 * by device_cache_fw_images after @delay milliseconds.
1713 */
1714static void device_uncache_fw_images_delay(unsigned long delay)
1715{
1716 queue_delayed_work(system_power_efficient_wq, &fw_cache.work,
1717 msecs_to_jiffies(delay));
1718}
1719
1720static int fw_pm_notify(struct notifier_block *notify_block,
1721 unsigned long mode, void *unused)
1722{
1723 switch (mode) {
1724 case PM_HIBERNATION_PREPARE:
1725 case PM_SUSPEND_PREPARE:
1726 case PM_RESTORE_PREPARE:
1727 kill_requests_without_uevent();
1728 device_cache_fw_images();
1729 break;
1730
1731 case PM_POST_SUSPEND:
1732 case PM_POST_HIBERNATION:
1733 case PM_POST_RESTORE:
1734 /*
1735 * In case that system sleep failed and syscore_suspend is
1736 * not called.
1737 */
1738 mutex_lock(&fw_lock);
1739 fw_cache.state = FW_LOADER_NO_CACHE;
1740 mutex_unlock(&fw_lock);
1741
1742 device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
1743 break;
1744 }
1745
1746 return 0;
1747}
1748
1749/* stop caching firmware once syscore_suspend is reached */
1750static int fw_suspend(void)
1751{
1752 fw_cache.state = FW_LOADER_NO_CACHE;
1753 return 0;
1754}
1755
1756static struct syscore_ops fw_syscore_ops = {
1757 .suspend = fw_suspend,
1758};
1759#else
1760static int fw_cache_piggyback_on_request(const char *name)
1761{
1762 return 0;
1763}
1764#endif
1765
1766static void __init fw_cache_init(void)
1767{
1768 spin_lock_init(&fw_cache.lock);
1769 INIT_LIST_HEAD(&fw_cache.head);
1770 fw_cache.state = FW_LOADER_NO_CACHE;
1771
1772#ifdef CONFIG_PM_SLEEP
1773 spin_lock_init(&fw_cache.name_lock);
1774 INIT_LIST_HEAD(&fw_cache.fw_names);
1775
1776 INIT_DELAYED_WORK(&fw_cache.work,
1777 device_uncache_fw_images_work);
1778
1779 fw_cache.pm_notify.notifier_call = fw_pm_notify;
1780 register_pm_notifier(&fw_cache.pm_notify);
1781
1782 register_syscore_ops(&fw_syscore_ops);
1783#endif
1784}
1785
1786static int __init firmware_class_init(void)
1787{
1788 fw_cache_init();
1789#ifdef CONFIG_FW_LOADER_USER_HELPER
1790 register_reboot_notifier(&fw_shutdown_nb);
1791 return class_register(&firmware_class);
1792#else
1793 return 0;
1794#endif
1795}
1796
1797static void __exit firmware_class_exit(void)
1798{
1799#ifdef CONFIG_PM_SLEEP
1800 unregister_syscore_ops(&fw_syscore_ops);
1801 unregister_pm_notifier(&fw_cache.pm_notify);
1802#endif
1803#ifdef CONFIG_FW_LOADER_USER_HELPER
1804 unregister_reboot_notifier(&fw_shutdown_nb);
1805 class_unregister(&firmware_class);
1806#endif
1807}
1808
1809fs_initcall(firmware_class_init);
1810module_exit(firmware_class_exit);