firmware_class.c 41.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 * firmware_class.c - Multi purpose firmware loading support
 *
4
 * Copyright (c) 2003 Manuel Estrada Sainz
L
Linus Torvalds 已提交
5 6 7 8 9
 *
 * Please see Documentation/firmware_class/ for more information.
 *
 */

10
#include <linux/capability.h>
L
Linus Torvalds 已提交
11 12 13 14 15 16 17
#include <linux/device.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/timer.h>
#include <linux/vmalloc.h>
#include <linux/interrupt.h>
#include <linux/bitops.h>
18
#include <linux/mutex.h>
19
#include <linux/workqueue.h>
20
#include <linux/highmem.h>
L
Linus Torvalds 已提交
21
#include <linux/firmware.h>
22
#include <linux/slab.h>
23
#include <linux/sched.h>
24
#include <linux/file.h>
25
#include <linux/list.h>
26
#include <linux/fs.h>
27 28
#include <linux/async.h>
#include <linux/pm.h>
29
#include <linux/suspend.h>
30
#include <linux/syscore_ops.h>
31
#include <linux/reboot.h>
32
#include <linux/security.h>
33

34 35
#include <generated/utsrelease.h>

36
#include "base.h"
L
Linus Torvalds 已提交
37

38
MODULE_AUTHOR("Manuel Estrada Sainz");
L
Linus Torvalds 已提交
39 40 41
MODULE_DESCRIPTION("Multi purpose firmware loading support");
MODULE_LICENSE("GPL");

42 43 44 45 46 47 48
/* Builtin firmware support */

#ifdef CONFIG_FW_LOADER

extern struct builtin_fw __start_builtin_fw[];
extern struct builtin_fw __end_builtin_fw[];

49 50
static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
				    void *buf, size_t size)
51 52 53 54 55 56 57
{
	struct builtin_fw *b_fw;

	for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
		if (strcmp(name, b_fw->name) == 0) {
			fw->size = b_fw->size;
			fw->data = b_fw->data;
58 59 60

			if (buf && fw->size <= size)
				memcpy(buf, fw->data, fw->size);
61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
			return true;
		}
	}

	return false;
}

static bool fw_is_builtin_firmware(const struct firmware *fw)
{
	struct builtin_fw *b_fw;

	for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
		if (fw->data == b_fw->data)
			return true;

	return false;
}

#else /* Module case - no builtin firmware support */

81 82 83
static inline bool fw_get_builtin_firmware(struct firmware *fw,
					   const char *name, void *buf,
					   size_t size)
84 85 86 87 88 89 90 91 92 93
{
	return false;
}

static inline bool fw_is_builtin_firmware(const struct firmware *fw)
{
	return false;
}
#endif

L
Linus Torvalds 已提交
94 95 96 97 98 99
enum {
	FW_STATUS_LOADING,
	FW_STATUS_DONE,
	FW_STATUS_ABORT,
};

100
static int loading_timeout = 60;	/* In seconds */
L
Linus Torvalds 已提交
101

102 103
static inline long firmware_loading_timeout(void)
{
104
	return loading_timeout > 0 ? loading_timeout * HZ : MAX_JIFFY_OFFSET;
105 106
}

107 108 109
/* firmware behavior options */
#define FW_OPT_UEVENT	(1U << 0)
#define FW_OPT_NOWAIT	(1U << 1)
110
#ifdef CONFIG_FW_LOADER_USER_HELPER
111
#define FW_OPT_USERHELPER	(1U << 2)
112
#else
113 114 115 116 117 118
#define FW_OPT_USERHELPER	0
#endif
#ifdef CONFIG_FW_LOADER_USER_HELPER_FALLBACK
#define FW_OPT_FALLBACK		FW_OPT_USERHELPER
#else
#define FW_OPT_FALLBACK		0
119
#endif
120
#define FW_OPT_NO_WARN	(1U << 3)
121
#define FW_OPT_NOCACHE	(1U << 4)
122

123 124 125 126
struct firmware_cache {
	/* firmware_buf instance will be added into the below list */
	spinlock_t lock;
	struct list_head head;
127
	int state;
128

129
#ifdef CONFIG_PM_SLEEP
130 131 132 133 134 135 136 137 138 139
	/*
	 * Names of firmware images which have been cached successfully
	 * will be added into the below list so that device uncache
	 * helper can trace which firmware images have been cached
	 * before.
	 */
	spinlock_t name_lock;
	struct list_head fw_names;

	struct delayed_work work;
140 141

	struct notifier_block   pm_notify;
142
#endif
143
};
L
Linus Torvalds 已提交
144

145
struct firmware_buf {
146 147
	struct kref ref;
	struct list_head list;
L
Linus Torvalds 已提交
148
	struct completion completion;
149
	struct firmware_cache *fwc;
L
Linus Torvalds 已提交
150
	unsigned long status;
151 152
	void *data;
	size_t size;
153
	size_t allocated_size;
154
#ifdef CONFIG_FW_LOADER_USER_HELPER
155
	bool is_paged_buf;
156
	bool need_uevent;
157 158 159
	struct page **pages;
	int nr_pages;
	int page_array_size;
160
	struct list_head pending_list;
161
#endif
162
	const char *fw_id;
163 164
};

165 166
struct fw_cache_entry {
	struct list_head list;
167
	const char *name;
168 169
};

170 171
struct fw_name_devm {
	unsigned long magic;
172
	const char *name;
173 174
};

175 176
#define to_fwbuf(d) container_of(d, struct firmware_buf, ref)

177 178 179 180 181
#define	FW_LOADER_NO_CACHE	0
#define	FW_LOADER_START_CACHE	1

static int fw_cache_piggyback_on_request(const char *name);

182 183 184 185 186 187 188
/* fw_lock could be moved to 'struct firmware_priv' but since it is just
 * guarding for corner cases a global lock should be OK */
static DEFINE_MUTEX(fw_lock);

static struct firmware_cache fw_cache;

static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
189 190
					      struct firmware_cache *fwc,
					      void *dbuf, size_t size)
191 192 193
{
	struct firmware_buf *buf;

194
	buf = kzalloc(sizeof(*buf), GFP_ATOMIC);
195
	if (!buf)
196 197 198 199 200 201 202
		return NULL;

	buf->fw_id = kstrdup_const(fw_name, GFP_ATOMIC);
	if (!buf->fw_id) {
		kfree(buf);
		return NULL;
	}
203 204 205

	kref_init(&buf->ref);
	buf->fwc = fwc;
206 207
	buf->data = dbuf;
	buf->allocated_size = size;
208
	init_completion(&buf->completion);
209 210 211
#ifdef CONFIG_FW_LOADER_USER_HELPER
	INIT_LIST_HEAD(&buf->pending_list);
#endif
212 213 214 215 216 217

	pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);

	return buf;
}

218 219 220 221 222 223 224 225 226 227 228
static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
{
	struct firmware_buf *tmp;
	struct firmware_cache *fwc = &fw_cache;

	list_for_each_entry(tmp, &fwc->head, list)
		if (!strcmp(tmp->fw_id, fw_name))
			return tmp;
	return NULL;
}

229 230
static int fw_lookup_and_allocate_buf(const char *fw_name,
				      struct firmware_cache *fwc,
231 232
				      struct firmware_buf **buf, void *dbuf,
				      size_t size)
233 234 235 236
{
	struct firmware_buf *tmp;

	spin_lock(&fwc->lock);
237 238 239 240 241 242 243
	tmp = __fw_lookup_buf(fw_name);
	if (tmp) {
		kref_get(&tmp->ref);
		spin_unlock(&fwc->lock);
		*buf = tmp;
		return 1;
	}
244
	tmp = __allocate_fw_buf(fw_name, fwc, dbuf, size);
245 246 247 248 249 250 251 252 253 254
	if (tmp)
		list_add(&tmp->list, &fwc->head);
	spin_unlock(&fwc->lock);

	*buf = tmp;

	return tmp ? 0 : -ENOMEM;
}

static void __fw_free_buf(struct kref *ref)
255
	__releases(&fwc->lock)
256 257 258 259 260 261 262 263 264 265 266
{
	struct firmware_buf *buf = to_fwbuf(ref);
	struct firmware_cache *fwc = buf->fwc;

	pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
		 __func__, buf->fw_id, buf, buf->data,
		 (unsigned int)buf->size);

	list_del(&buf->list);
	spin_unlock(&fwc->lock);

267
#ifdef CONFIG_FW_LOADER_USER_HELPER
268
	if (buf->is_paged_buf) {
269
		int i;
270 271 272
		vunmap(buf->data);
		for (i = 0; i < buf->nr_pages; i++)
			__free_page(buf->pages[i]);
273
		vfree(buf->pages);
274
	} else
275
#endif
276
	if (!buf->allocated_size)
277
		vfree(buf->data);
278
	kfree_const(buf->fw_id);
279 280 281 282 283
	kfree(buf);
}

static void fw_free_buf(struct firmware_buf *buf)
{
284 285 286 287
	struct firmware_cache *fwc = buf->fwc;
	spin_lock(&fwc->lock);
	if (!kref_put(&buf->ref, __fw_free_buf))
		spin_unlock(&fwc->lock);
288 289
}

290
/* direct firmware loading support */
291 292 293
static char fw_path_para[256];
static const char * const fw_path[] = {
	fw_path_para,
294 295 296 297 298 299
	"/lib/firmware/updates/" UTS_RELEASE,
	"/lib/firmware/updates",
	"/lib/firmware/" UTS_RELEASE,
	"/lib/firmware"
};

300 301 302 303 304 305 306 307
/*
 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
 * from kernel command line because firmware_class is generally built in
 * kernel instead of module.
 */
module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644);
MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path");

308 309 310 311 312 313 314 315 316
static void fw_finish_direct_load(struct device *device,
				  struct firmware_buf *buf)
{
	mutex_lock(&fw_lock);
	set_bit(FW_STATUS_DONE, &buf->status);
	complete_all(&buf->completion);
	mutex_unlock(&fw_lock);
}

317 318
static int
fw_get_filesystem_firmware(struct device *device, struct firmware_buf *buf)
319
{
320
	loff_t size;
321
	int i, len;
322
	int rc = -ENOENT;
323
	char *path;
324 325 326 327 328 329 330 331
	enum kernel_read_file_id id = READING_FIRMWARE;
	size_t msize = INT_MAX;

	/* Already populated data member means we're loading into a buffer */
	if (buf->data) {
		id = READING_FIRMWARE_PREALLOC_BUFFER;
		msize = buf->allocated_size;
	}
332 333 334 335

	path = __getname();
	if (!path)
		return -ENOMEM;
336 337

	for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
338 339 340 341
		/* skip the unset customized path */
		if (!fw_path[i][0])
			continue;

342 343 344 345 346 347
		len = snprintf(path, PATH_MAX, "%s/%s",
			       fw_path[i], buf->fw_id);
		if (len >= PATH_MAX) {
			rc = -ENAMETOOLONG;
			break;
		}
348

349
		buf->size = 0;
350 351
		rc = kernel_read_file_from_path(path, &buf->data, &size, msize,
						id);
352
		if (rc) {
353 354 355 356 357 358
			if (rc == -ENOENT)
				dev_dbg(device, "loading %s failed with error %d\n",
					 path, rc);
			else
				dev_warn(device, "loading %s failed with error %d\n",
					 path, rc);
359 360
			continue;
		}
361 362
		dev_dbg(device, "direct-loading %s\n", buf->fw_id);
		buf->size = size;
363
		fw_finish_direct_load(device, buf);
364
		break;
365
	}
366
	__putname(path);
367

368
	return rc;
369 370
}

371 372 373 374 375 376 377 378 379 380 381
/* firmware holds the ownership of pages */
static void firmware_free_data(const struct firmware *fw)
{
	/* Loaded directly? */
	if (!fw->priv) {
		vfree(fw->data);
		return;
	}
	fw_free_buf(fw->priv);
}

382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404
/* store the pages buffer info firmware from buf */
static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
{
	fw->priv = buf;
#ifdef CONFIG_FW_LOADER_USER_HELPER
	fw->pages = buf->pages;
#endif
	fw->size = buf->size;
	fw->data = buf->data;

	pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
		 __func__, buf->fw_id, buf, buf->data,
		 (unsigned int)buf->size);
}

#ifdef CONFIG_PM_SLEEP
static void fw_name_devm_release(struct device *dev, void *res)
{
	struct fw_name_devm *fwn = res;

	if (fwn->magic == (unsigned long)&fw_cache)
		pr_debug("%s: fw_name-%s devm-%p released\n",
				__func__, fwn->name, res);
405
	kfree_const(fwn->name);
406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435
}

static int fw_devm_match(struct device *dev, void *res,
		void *match_data)
{
	struct fw_name_devm *fwn = res;

	return (fwn->magic == (unsigned long)&fw_cache) &&
		!strcmp(fwn->name, match_data);
}

static struct fw_name_devm *fw_find_devm_name(struct device *dev,
		const char *name)
{
	struct fw_name_devm *fwn;

	fwn = devres_find(dev, fw_name_devm_release,
			  fw_devm_match, (void *)name);
	return fwn;
}

/* add firmware name into devres list */
static int fw_add_devm_name(struct device *dev, const char *name)
{
	struct fw_name_devm *fwn;

	fwn = fw_find_devm_name(dev, name);
	if (fwn)
		return 1;

436 437
	fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm),
			   GFP_KERNEL);
438 439
	if (!fwn)
		return -ENOMEM;
440 441
	fwn->name = kstrdup_const(name, GFP_KERNEL);
	if (!fwn->name) {
442
		devres_free(fwn);
443 444
		return -ENOMEM;
	}
445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461

	fwn->magic = (unsigned long)&fw_cache;
	devres_add(dev, fwn);

	return 0;
}
#else
static int fw_add_devm_name(struct device *dev, const char *name)
{
	return 0;
}
#endif


/*
 * user-mode helper code
 */
462
#ifdef CONFIG_FW_LOADER_USER_HELPER
463 464 465 466 467 468
struct firmware_priv {
	bool nowait;
	struct device dev;
	struct firmware_buf *buf;
	struct firmware *fw;
};
469

470 471 472 473 474
static struct firmware_priv *to_firmware_priv(struct device *dev)
{
	return container_of(dev, struct firmware_priv, dev);
}

475
static void __fw_load_abort(struct firmware_buf *buf)
L
Linus Torvalds 已提交
476
{
477 478 479 480 481 482 483
	/*
	 * There is a small window in which user can write to 'loading'
	 * between loading done and disappearance of 'loading'
	 */
	if (test_bit(FW_STATUS_DONE, &buf->status))
		return;

484
	list_del_init(&buf->pending_list);
485
	set_bit(FW_STATUS_ABORT, &buf->status);
486
	complete_all(&buf->completion);
L
Linus Torvalds 已提交
487 488
}

489 490 491 492 493
static void fw_load_abort(struct firmware_priv *fw_priv)
{
	struct firmware_buf *buf = fw_priv->buf;

	__fw_load_abort(buf);
494 495 496

	/* avoid user action after loading abort */
	fw_priv->buf = NULL;
L
Linus Torvalds 已提交
497 498
}

499 500 501
#define is_fw_load_aborted(buf)	\
	test_bit(FW_STATUS_ABORT, &(buf)->status)

502 503 504 505 506 507 508 509
static LIST_HEAD(pending_fw_head);

/* reboot notifier for avoid deadlock with usermode_lock */
static int fw_shutdown_notify(struct notifier_block *unused1,
			      unsigned long unused2, void *unused3)
{
	mutex_lock(&fw_lock);
	while (!list_empty(&pending_fw_head))
510
		__fw_load_abort(list_first_entry(&pending_fw_head,
511 512 513 514 515 516 517 518 519 520
					       struct firmware_buf,
					       pending_list));
	mutex_unlock(&fw_lock);
	return NOTIFY_DONE;
}

static struct notifier_block fw_shutdown_nb = {
	.notifier_call = fw_shutdown_notify,
};

521 522
static ssize_t timeout_show(struct class *class, struct class_attribute *attr,
			    char *buf)
L
Linus Torvalds 已提交
523 524 525 526 527
{
	return sprintf(buf, "%d\n", loading_timeout);
}

/**
528 529
 * firmware_timeout_store - set number of seconds to wait for firmware
 * @class: device class pointer
530
 * @attr: device attribute pointer
531 532 533
 * @buf: buffer to scan for timeout value
 * @count: number of bytes in @buf
 *
L
Linus Torvalds 已提交
534
 *	Sets the number of seconds to wait for the firmware.  Once
535
 *	this expires an error will be returned to the driver and no
L
Linus Torvalds 已提交
536 537
 *	firmware will be provided.
 *
538
 *	Note: zero means 'wait forever'.
L
Linus Torvalds 已提交
539
 **/
540 541
static ssize_t timeout_store(struct class *class, struct class_attribute *attr,
			     const char *buf, size_t count)
L
Linus Torvalds 已提交
542 543
{
	loading_timeout = simple_strtol(buf, NULL, 10);
544 545
	if (loading_timeout < 0)
		loading_timeout = 0;
546

L
Linus Torvalds 已提交
547 548 549
	return count;
}

550
static struct class_attribute firmware_class_attrs[] = {
551
	__ATTR_RW(timeout),
552 553
	__ATTR_NULL
};
L
Linus Torvalds 已提交
554

555 556 557
static void fw_dev_release(struct device *dev)
{
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
558

559 560
	kfree(fw_priv);
}
L
Linus Torvalds 已提交
561

562
static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
L
Linus Torvalds 已提交
563
{
564
	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
L
Linus Torvalds 已提交
565
		return -ENOMEM;
566
	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
567
		return -ENOMEM;
568 569
	if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
		return -ENOMEM;
L
Linus Torvalds 已提交
570 571 572 573

	return 0;
}

574 575 576 577 578 579 580 581 582 583 584 585
static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
{
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
	int err = 0;

	mutex_lock(&fw_lock);
	if (fw_priv->buf)
		err = do_firmware_uevent(fw_priv, env);
	mutex_unlock(&fw_lock);
	return err;
}

586 587
static struct class firmware_class = {
	.name		= "firmware",
588
	.class_attrs	= firmware_class_attrs,
589 590
	.dev_uevent	= firmware_uevent,
	.dev_release	= fw_dev_release,
591 592
};

593 594
static ssize_t firmware_loading_show(struct device *dev,
				     struct device_attribute *attr, char *buf)
L
Linus Torvalds 已提交
595
{
596
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
597 598 599 600 601 602
	int loading = 0;

	mutex_lock(&fw_lock);
	if (fw_priv->buf)
		loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
	mutex_unlock(&fw_lock);
603

L
Linus Torvalds 已提交
604 605 606
	return sprintf(buf, "%d\n", loading);
}

607 608 609 610
/* Some architectures don't have PAGE_KERNEL_RO */
#ifndef PAGE_KERNEL_RO
#define PAGE_KERNEL_RO PAGE_KERNEL
#endif
611 612 613 614

/* one pages buffer should be mapped/unmapped only once */
static int fw_map_pages_buf(struct firmware_buf *buf)
{
615
	if (!buf->is_paged_buf)
616 617
		return 0;

618
	vunmap(buf->data);
619 620 621 622 623 624
	buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
	if (!buf->data)
		return -ENOMEM;
	return 0;
}

L
Linus Torvalds 已提交
625
/**
626
 * firmware_loading_store - set value in the 'loading' control file
627
 * @dev: device pointer
628
 * @attr: device attribute pointer
629 630 631
 * @buf: buffer to scan for loading control value
 * @count: number of bytes in @buf
 *
L
Linus Torvalds 已提交
632 633 634
 *	The relevant values are:
 *
 *	 1: Start a load, discarding any previous partial load.
635
 *	 0: Conclude the load and hand the data to the driver code.
L
Linus Torvalds 已提交
636 637
 *	-1: Conclude the load with an error and discard any written data.
 **/
638 639 640
static ssize_t firmware_loading_store(struct device *dev,
				      struct device_attribute *attr,
				      const char *buf, size_t count)
L
Linus Torvalds 已提交
641
{
642
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
643
	struct firmware_buf *fw_buf;
644
	ssize_t written = count;
L
Linus Torvalds 已提交
645
	int loading = simple_strtol(buf, NULL, 10);
646
	int i;
L
Linus Torvalds 已提交
647

648
	mutex_lock(&fw_lock);
649
	fw_buf = fw_priv->buf;
650
	if (!fw_buf)
651 652
		goto out;

L
Linus Torvalds 已提交
653 654
	switch (loading) {
	case 1:
655
		/* discarding any previous partial load */
656 657 658
		if (!test_bit(FW_STATUS_DONE, &fw_buf->status)) {
			for (i = 0; i < fw_buf->nr_pages; i++)
				__free_page(fw_buf->pages[i]);
659
			vfree(fw_buf->pages);
660 661 662 663
			fw_buf->pages = NULL;
			fw_buf->page_array_size = 0;
			fw_buf->nr_pages = 0;
			set_bit(FW_STATUS_LOADING, &fw_buf->status);
664
		}
L
Linus Torvalds 已提交
665 666
		break;
	case 0:
667
		if (test_bit(FW_STATUS_LOADING, &fw_buf->status)) {
668 669
			int rc;

670 671
			set_bit(FW_STATUS_DONE, &fw_buf->status);
			clear_bit(FW_STATUS_LOADING, &fw_buf->status);
672 673 674 675 676 677 678

			/*
			 * Several loading requests may be pending on
			 * one same firmware buf, so let all requests
			 * see the mapped 'buf->data' once the loading
			 * is completed.
			 * */
679 680
			rc = fw_map_pages_buf(fw_buf);
			if (rc)
681 682
				dev_err(dev, "%s: map pages failed\n",
					__func__);
683
			else
684 685 686
				rc = security_kernel_post_read_file(NULL,
						fw_buf->data, fw_buf->size,
						READING_FIRMWARE);
687 688 689 690 691

			/*
			 * Same logic as fw_load_abort, only the DONE bit
			 * is ignored and we set ABORT only on failure.
			 */
692
			list_del_init(&fw_buf->pending_list);
693 694 695 696
			if (rc) {
				set_bit(FW_STATUS_ABORT, &fw_buf->status);
				written = rc;
			}
697
			complete_all(&fw_buf->completion);
L
Linus Torvalds 已提交
698 699 700 701
			break;
		}
		/* fallthrough */
	default:
702
		dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
L
Linus Torvalds 已提交
703 704 705 706 707
		/* fallthrough */
	case -1:
		fw_load_abort(fw_priv);
		break;
	}
708 709
out:
	mutex_unlock(&fw_lock);
710
	return written;
L
Linus Torvalds 已提交
711 712
}

713
static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
L
Linus Torvalds 已提交
714

715 716 717 718 719 720 721 722 723
static void firmware_rw_buf(struct firmware_buf *buf, char *buffer,
			   loff_t offset, size_t count, bool read)
{
	if (read)
		memcpy(buffer, buf->data + offset, count);
	else
		memcpy(buf->data + offset, buffer, count);
}

724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746
static void firmware_rw(struct firmware_buf *buf, char *buffer,
			loff_t offset, size_t count, bool read)
{
	while (count) {
		void *page_data;
		int page_nr = offset >> PAGE_SHIFT;
		int page_ofs = offset & (PAGE_SIZE-1);
		int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);

		page_data = kmap(buf->pages[page_nr]);

		if (read)
			memcpy(buffer, page_data + page_ofs, page_cnt);
		else
			memcpy(page_data + page_ofs, buffer, page_cnt);

		kunmap(buf->pages[page_nr]);
		buffer += page_cnt;
		offset += page_cnt;
		count -= page_cnt;
	}
}

747 748 749
static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
				  struct bin_attribute *bin_attr,
				  char *buffer, loff_t offset, size_t count)
L
Linus Torvalds 已提交
750
{
751
	struct device *dev = kobj_to_dev(kobj);
752
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
753
	struct firmware_buf *buf;
754
	ssize_t ret_count;
L
Linus Torvalds 已提交
755

756
	mutex_lock(&fw_lock);
757 758
	buf = fw_priv->buf;
	if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
L
Linus Torvalds 已提交
759 760 761
		ret_count = -ENODEV;
		goto out;
	}
762
	if (offset > buf->size) {
763 764 765
		ret_count = 0;
		goto out;
	}
766 767
	if (count > buf->size - offset)
		count = buf->size - offset;
768 769 770

	ret_count = count;

771 772 773 774
	if (buf->data)
		firmware_rw_buf(buf, buffer, offset, count, true);
	else
		firmware_rw(buf, buffer, offset, count, true);
775

L
Linus Torvalds 已提交
776
out:
777
	mutex_unlock(&fw_lock);
L
Linus Torvalds 已提交
778 779
	return ret_count;
}
780

781
static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
L
Linus Torvalds 已提交
782
{
783
	struct firmware_buf *buf = fw_priv->buf;
784
	int pages_needed = PAGE_ALIGN(min_size) >> PAGE_SHIFT;
785 786

	/* If the array of pages is too small, grow it... */
787
	if (buf->page_array_size < pages_needed) {
788
		int new_array_size = max(pages_needed,
789
					 buf->page_array_size * 2);
790 791
		struct page **new_pages;

792
		new_pages = vmalloc(new_array_size * sizeof(void *));
793 794 795 796
		if (!new_pages) {
			fw_load_abort(fw_priv);
			return -ENOMEM;
		}
797 798 799 800
		memcpy(new_pages, buf->pages,
		       buf->page_array_size * sizeof(void *));
		memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
		       (new_array_size - buf->page_array_size));
801
		vfree(buf->pages);
802 803
		buf->pages = new_pages;
		buf->page_array_size = new_array_size;
804
	}
L
Linus Torvalds 已提交
805

806 807
	while (buf->nr_pages < pages_needed) {
		buf->pages[buf->nr_pages] =
808
			alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
L
Linus Torvalds 已提交
809

810
		if (!buf->pages[buf->nr_pages]) {
811 812 813
			fw_load_abort(fw_priv);
			return -ENOMEM;
		}
814
		buf->nr_pages++;
L
Linus Torvalds 已提交
815 816 817 818 819
	}
	return 0;
}

/**
820
 * firmware_data_write - write method for firmware
821
 * @filp: open sysfs file
822
 * @kobj: kobject for the device
823
 * @bin_attr: bin_attr structure
824 825 826
 * @buffer: buffer being written
 * @offset: buffer offset for write in total data store area
 * @count: buffer size
L
Linus Torvalds 已提交
827
 *
828
 *	Data written to the 'data' attribute will be later handed to
L
Linus Torvalds 已提交
829 830
 *	the driver as a firmware image.
 **/
831 832 833
static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
				   struct bin_attribute *bin_attr,
				   char *buffer, loff_t offset, size_t count)
L
Linus Torvalds 已提交
834
{
835
	struct device *dev = kobj_to_dev(kobj);
836
	struct firmware_priv *fw_priv = to_firmware_priv(dev);
837
	struct firmware_buf *buf;
L
Linus Torvalds 已提交
838 839 840 841
	ssize_t retval;

	if (!capable(CAP_SYS_RAWIO))
		return -EPERM;
842

843
	mutex_lock(&fw_lock);
844 845
	buf = fw_priv->buf;
	if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
L
Linus Torvalds 已提交
846 847 848
		retval = -ENODEV;
		goto out;
	}
849

850 851 852 853 854 855 856 857 858 859 860
	if (buf->data) {
		if (offset + count > buf->allocated_size) {
			retval = -ENOMEM;
			goto out;
		}
		firmware_rw_buf(buf, buffer, offset, count, false);
		retval = count;
	} else {
		retval = fw_realloc_buffer(fw_priv, offset + count);
		if (retval)
			goto out;
L
Linus Torvalds 已提交
861

862 863 864
		retval = count;
		firmware_rw(buf, buffer, offset, count, false);
	}
865

866
	buf->size = max_t(size_t, offset + count, buf->size);
L
Linus Torvalds 已提交
867
out:
868
	mutex_unlock(&fw_lock);
L
Linus Torvalds 已提交
869 870
	return retval;
}
871

872 873
static struct bin_attribute firmware_attr_data = {
	.attr = { .name = "data", .mode = 0644 },
L
Linus Torvalds 已提交
874 875 876 877 878
	.size = 0,
	.read = firmware_data_read,
	.write = firmware_data_write,
};

879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898
static struct attribute *fw_dev_attrs[] = {
	&dev_attr_loading.attr,
	NULL
};

static struct bin_attribute *fw_dev_bin_attrs[] = {
	&firmware_attr_data,
	NULL
};

static const struct attribute_group fw_dev_attr_group = {
	.attrs = fw_dev_attrs,
	.bin_attrs = fw_dev_bin_attrs,
};

static const struct attribute_group *fw_dev_attr_groups[] = {
	&fw_dev_attr_group,
	NULL
};

899
static struct firmware_priv *
900
fw_create_instance(struct firmware *firmware, const char *fw_name,
901
		   struct device *device, unsigned int opt_flags)
L
Linus Torvalds 已提交
902
{
903 904
	struct firmware_priv *fw_priv;
	struct device *f_dev;
L
Linus Torvalds 已提交
905

906
	fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
907
	if (!fw_priv) {
908 909 910 911
		fw_priv = ERR_PTR(-ENOMEM);
		goto exit;
	}

912
	fw_priv->nowait = !!(opt_flags & FW_OPT_NOWAIT);
913
	fw_priv->fw = firmware;
914 915 916
	f_dev = &fw_priv->dev;

	device_initialize(f_dev);
917
	dev_set_name(f_dev, "%s", fw_name);
918 919
	f_dev->parent = device;
	f_dev->class = &firmware_class;
920
	f_dev->groups = fw_dev_attr_groups;
921
exit:
922
	return fw_priv;
L
Linus Torvalds 已提交
923 924
}

925
/* load a firmware via user helper */
926 927
static int _request_firmware_load(struct firmware_priv *fw_priv,
				  unsigned int opt_flags, long timeout)
928
{
929 930 931
	int retval = 0;
	struct device *f_dev = &fw_priv->dev;
	struct firmware_buf *buf = fw_priv->buf;
932

933
	/* fall back on userspace loading */
934 935
	if (!buf->data)
		buf->is_paged_buf = true;
936

937
	dev_set_uevent_suppress(f_dev, true);
938

939 940 941 942 943
	retval = device_add(f_dev);
	if (retval) {
		dev_err(f_dev, "%s: device_register failed\n", __func__);
		goto err_put_dev;
	}
944

945 946 947 948
	mutex_lock(&fw_lock);
	list_add(&buf->pending_list, &pending_fw_head);
	mutex_unlock(&fw_lock);

949
	if (opt_flags & FW_OPT_UEVENT) {
950
		buf->need_uevent = true;
951 952 953
		dev_set_uevent_suppress(f_dev, false);
		dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
		kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
954 955
	} else {
		timeout = MAX_JIFFY_OFFSET;
956
	}
957

958 959 960
	retval = wait_for_completion_interruptible_timeout(&buf->completion,
			timeout);
	if (retval == -ERESTARTSYS || !retval) {
961 962 963
		mutex_lock(&fw_lock);
		fw_load_abort(fw_priv);
		mutex_unlock(&fw_lock);
964 965
	} else if (retval > 0) {
		retval = 0;
966
	}
967

968 969
	if (is_fw_load_aborted(buf))
		retval = -EAGAIN;
970
	else if (buf->is_paged_buf && !buf->data)
971
		retval = -ENOMEM;
972

973 974 975 976
	device_del(f_dev);
err_put_dev:
	put_device(f_dev);
	return retval;
977
}
978 979 980

static int fw_load_from_user_helper(struct firmware *firmware,
				    const char *name, struct device *device,
981
				    unsigned int opt_flags, long timeout)
982
{
983 984
	struct firmware_priv *fw_priv;

985
	fw_priv = fw_create_instance(firmware, name, device, opt_flags);
986 987 988 989
	if (IS_ERR(fw_priv))
		return PTR_ERR(fw_priv);

	fw_priv->buf = firmware->priv;
990
	return _request_firmware_load(fw_priv, opt_flags, timeout);
991
}
992

M
Ming Lei 已提交
993
#ifdef CONFIG_PM_SLEEP
994 995 996 997 998 999 1000 1001 1002
/* kill pending requests without uevent to avoid blocking suspend */
static void kill_requests_without_uevent(void)
{
	struct firmware_buf *buf;
	struct firmware_buf *next;

	mutex_lock(&fw_lock);
	list_for_each_entry_safe(buf, next, &pending_fw_head, pending_list) {
		if (!buf->need_uevent)
1003
			 __fw_load_abort(buf);
1004 1005 1006
	}
	mutex_unlock(&fw_lock);
}
M
Ming Lei 已提交
1007
#endif
1008

1009 1010 1011
#else /* CONFIG_FW_LOADER_USER_HELPER */
static inline int
fw_load_from_user_helper(struct firmware *firmware, const char *name,
1012
			 struct device *device, unsigned int opt_flags,
1013 1014 1015 1016
			 long timeout)
{
	return -ENOENT;
}
1017 1018 1019 1020

/* No abort during direct loading */
#define is_fw_load_aborted(buf) false

M
Ming Lei 已提交
1021
#ifdef CONFIG_PM_SLEEP
1022
static inline void kill_requests_without_uevent(void) { }
M
Ming Lei 已提交
1023
#endif
1024

1025 1026
#endif /* CONFIG_FW_LOADER_USER_HELPER */

1027

1028 1029
/* wait until the shared firmware_buf becomes ready (or error) */
static int sync_cached_firmware_buf(struct firmware_buf *buf)
1030
{
1031 1032 1033 1034
	int ret = 0;

	mutex_lock(&fw_lock);
	while (!test_bit(FW_STATUS_DONE, &buf->status)) {
1035
		if (is_fw_load_aborted(buf)) {
1036 1037 1038 1039
			ret = -ENOENT;
			break;
		}
		mutex_unlock(&fw_lock);
1040
		ret = wait_for_completion_interruptible(&buf->completion);
1041 1042 1043 1044
		mutex_lock(&fw_lock);
	}
	mutex_unlock(&fw_lock);
	return ret;
1045 1046
}

1047 1048 1049 1050 1051 1052
/* prepare firmware and firmware_buf structs;
 * return 0 if a firmware is already assigned, 1 if need to load one,
 * or a negative error code
 */
static int
_request_firmware_prepare(struct firmware **firmware_p, const char *name,
1053
			  struct device *device, void *dbuf, size_t size)
L
Linus Torvalds 已提交
1054 1055
{
	struct firmware *firmware;
1056 1057
	struct firmware_buf *buf;
	int ret;
L
Linus Torvalds 已提交
1058

1059
	*firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
L
Linus Torvalds 已提交
1060
	if (!firmware) {
1061 1062
		dev_err(device, "%s: kmalloc(struct firmware) failed\n",
			__func__);
1063
		return -ENOMEM;
L
Linus Torvalds 已提交
1064 1065
	}

1066
	if (fw_get_builtin_firmware(firmware, name, dbuf, size)) {
1067
		dev_dbg(device, "using built-in %s\n", name);
1068
		return 0; /* assigned */
1069 1070
	}

1071
	ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf, dbuf, size);
1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084

	/*
	 * bind with 'buf' now to avoid warning in failure path
	 * of requesting firmware.
	 */
	firmware->priv = buf;

	if (ret > 0) {
		ret = sync_cached_firmware_buf(buf);
		if (!ret) {
			fw_set_page_data(buf, firmware);
			return 0; /* assigned */
		}
1085
	}
1086

1087 1088 1089 1090 1091
	if (ret < 0)
		return ret;
	return 1; /* need to load */
}

1092
static int assign_firmware_buf(struct firmware *fw, struct device *device,
1093
			       unsigned int opt_flags)
1094 1095 1096
{
	struct firmware_buf *buf = fw->priv;

1097
	mutex_lock(&fw_lock);
1098
	if (!buf->size || is_fw_load_aborted(buf)) {
1099 1100
		mutex_unlock(&fw_lock);
		return -ENOENT;
1101
	}
1102

1103 1104 1105 1106 1107 1108 1109
	/*
	 * add firmware name into devres list so that we can auto cache
	 * and uncache firmware for device.
	 *
	 * device may has been deleted already, but the problem
	 * should be fixed in devres or driver core.
	 */
1110
	/* don't cache firmware handled without uevent */
1111 1112
	if (device && (opt_flags & FW_OPT_UEVENT) &&
	    !(opt_flags & FW_OPT_NOCACHE))
1113 1114 1115 1116 1117 1118
		fw_add_devm_name(device, buf->fw_id);

	/*
	 * After caching firmware image is started, let it piggyback
	 * on request firmware.
	 */
1119 1120
	if (!(opt_flags & FW_OPT_NOCACHE) &&
	    buf->fwc->state == FW_LOADER_START_CACHE) {
1121 1122 1123 1124 1125 1126
		if (fw_cache_piggyback_on_request(buf->fw_id))
			kref_get(&buf->ref);
	}

	/* pass the pages buffer to driver at the last minute */
	fw_set_page_data(buf, fw);
1127
	mutex_unlock(&fw_lock);
1128
	return 0;
1129 1130
}

1131 1132 1133
/* called from request_firmware() and request_firmware_work_func() */
static int
_request_firmware(const struct firmware **firmware_p, const char *name,
1134 1135
		  struct device *device, void *buf, size_t size,
		  unsigned int opt_flags)
1136
{
1137
	struct firmware *fw = NULL;
1138 1139 1140 1141 1142 1143
	long timeout;
	int ret;

	if (!firmware_p)
		return -EINVAL;

1144 1145 1146 1147
	if (!name || name[0] == '\0') {
		ret = -EINVAL;
		goto out;
	}
1148

1149
	ret = _request_firmware_prepare(&fw, name, device, buf, size);
1150 1151 1152 1153 1154
	if (ret <= 0) /* error or already assigned */
		goto out;

	ret = 0;
	timeout = firmware_loading_timeout();
1155
	if (opt_flags & FW_OPT_NOWAIT) {
1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171
		timeout = usermodehelper_read_lock_wait(timeout);
		if (!timeout) {
			dev_dbg(device, "firmware: %s loading timed out\n",
				name);
			ret = -EBUSY;
			goto out;
		}
	} else {
		ret = usermodehelper_read_trylock();
		if (WARN_ON(ret)) {
			dev_err(device, "firmware: %s will not be loaded\n",
				name);
			goto out;
		}
	}

1172 1173
	ret = fw_get_filesystem_firmware(device, fw->priv);
	if (ret) {
1174
		if (!(opt_flags & FW_OPT_NO_WARN))
1175
			dev_warn(device,
1176 1177 1178
				 "Direct firmware load for %s failed with error %d\n",
				 name, ret);
		if (opt_flags & FW_OPT_USERHELPER) {
1179 1180
			dev_warn(device, "Falling back to user helper\n");
			ret = fw_load_from_user_helper(fw, name, device,
1181
						       opt_flags, timeout);
1182
		}
1183
	}
1184

1185
	if (!ret)
1186
		ret = assign_firmware_buf(fw, device, opt_flags);
1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199

	usermodehelper_read_unlock();

 out:
	if (ret < 0) {
		release_firmware(fw);
		fw = NULL;
	}

	*firmware_p = fw;
	return ret;
}

1200
/**
1201
 * request_firmware: - send firmware request and wait for it
1202 1203 1204 1205 1206
 * @firmware_p: pointer to firmware image
 * @name: name of firmware file
 * @device: device for which firmware is being loaded
 *
 *      @firmware_p will be used to return a firmware image by the name
1207 1208 1209 1210
 *      of @name for device @device.
 *
 *      Should be called from user context where sleeping is allowed.
 *
1211
 *      @name will be used as $FIRMWARE in the uevent environment and
1212 1213
 *      should be distinctive enough not to be confused with any other
 *      firmware image for this or any other device.
M
Ming Lei 已提交
1214 1215
 *
 *	Caller must hold the reference count of @device.
1216 1217 1218
 *
 *	The function can be called safely inside device's suspend and
 *	resume callback.
1219 1220 1221
 **/
int
request_firmware(const struct firmware **firmware_p, const char *name,
1222
		 struct device *device)
1223
{
1224 1225 1226 1227
	int ret;

	/* Need to pin this module until return */
	__module_get(THIS_MODULE);
1228
	ret = _request_firmware(firmware_p, name, device, NULL, 0,
1229
				FW_OPT_UEVENT | FW_OPT_FALLBACK);
1230 1231
	module_put(THIS_MODULE);
	return ret;
1232
}
1233
EXPORT_SYMBOL(request_firmware);
1234

1235
/**
1236
 * request_firmware_direct: - load firmware directly without usermode helper
1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249
 * @firmware_p: pointer to firmware image
 * @name: name of firmware file
 * @device: device for which firmware is being loaded
 *
 * This function works pretty much like request_firmware(), but this doesn't
 * fall back to usermode helper even if the firmware couldn't be loaded
 * directly from fs.  Hence it's useful for loading optional firmwares, which
 * aren't always present, without extra long timeouts of udev.
 **/
int request_firmware_direct(const struct firmware **firmware_p,
			    const char *name, struct device *device)
{
	int ret;
1250

1251
	__module_get(THIS_MODULE);
1252
	ret = _request_firmware(firmware_p, name, device, NULL, 0,
1253
				FW_OPT_UEVENT | FW_OPT_NO_WARN);
1254 1255 1256 1257 1258
	module_put(THIS_MODULE);
	return ret;
}
EXPORT_SYMBOL_GPL(request_firmware_direct);

1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288
/**
 * request_firmware_into_buf - load firmware into a previously allocated buffer
 * @firmware_p: pointer to firmware image
 * @name: name of firmware file
 * @device: device for which firmware is being loaded and DMA region allocated
 * @buf: address of buffer to load firmware into
 * @size: size of buffer
 *
 * This function works pretty much like request_firmware(), but it doesn't
 * allocate a buffer to hold the firmware data. Instead, the firmware
 * is loaded directly into the buffer pointed to by @buf and the @firmware_p
 * data member is pointed at @buf.
 *
 * This function doesn't cache firmware either.
 */
int
request_firmware_into_buf(const struct firmware **firmware_p, const char *name,
			  struct device *device, void *buf, size_t size)
{
	int ret;

	__module_get(THIS_MODULE);
	ret = _request_firmware(firmware_p, name, device, buf, size,
				FW_OPT_UEVENT | FW_OPT_FALLBACK |
				FW_OPT_NOCACHE);
	module_put(THIS_MODULE);
	return ret;
}
EXPORT_SYMBOL(request_firmware_into_buf);

L
Linus Torvalds 已提交
1289 1290
/**
 * release_firmware: - release the resource associated with a firmware image
1291
 * @fw: firmware resource to release
L
Linus Torvalds 已提交
1292
 **/
1293
void release_firmware(const struct firmware *fw)
L
Linus Torvalds 已提交
1294 1295
{
	if (fw) {
1296 1297
		if (!fw_is_builtin_firmware(fw))
			firmware_free_data(fw);
L
Linus Torvalds 已提交
1298 1299 1300
		kfree(fw);
	}
}
1301
EXPORT_SYMBOL(release_firmware);
L
Linus Torvalds 已提交
1302 1303 1304 1305 1306 1307 1308 1309 1310

/* Async support */
struct firmware_work {
	struct work_struct work;
	struct module *module;
	const char *name;
	struct device *device;
	void *context;
	void (*cont)(const struct firmware *fw, void *context);
1311
	unsigned int opt_flags;
L
Linus Torvalds 已提交
1312 1313
};

1314
static void request_firmware_work_func(struct work_struct *work)
L
Linus Torvalds 已提交
1315
{
1316
	struct firmware_work *fw_work;
L
Linus Torvalds 已提交
1317
	const struct firmware *fw;
1318

1319
	fw_work = container_of(work, struct firmware_work, work);
1320

1321
	_request_firmware(&fw, fw_work->name, fw_work->device, NULL, 0,
1322
			  fw_work->opt_flags);
1323
	fw_work->cont(fw, fw_work->context);
1324
	put_device(fw_work->device); /* taken in request_firmware_nowait() */
1325

L
Linus Torvalds 已提交
1326
	module_put(fw_work->module);
1327
	kfree_const(fw_work->name);
L
Linus Torvalds 已提交
1328 1329 1330 1331
	kfree(fw_work);
}

/**
1332
 * request_firmware_nowait - asynchronous version of request_firmware
1333
 * @module: module requesting the firmware
1334
 * @uevent: sends uevent to copy the firmware image if this flag
1335 1336 1337
 *	is non-zero else the firmware copy must be done manually.
 * @name: name of firmware file
 * @device: device for which firmware is being loaded
1338
 * @gfp: allocation flags
1339 1340 1341 1342
 * @context: will be passed over to @cont, and
 *	@fw may be %NULL if firmware request fails.
 * @cont: function will be called asynchronously when the firmware
 *	request is over.
L
Linus Torvalds 已提交
1343
 *
M
Ming Lei 已提交
1344 1345
 *	Caller must hold the reference count of @device.
 *
1346 1347 1348 1349 1350 1351 1352
 *	Asynchronous variant of request_firmware() for user contexts:
 *		- sleep for as small periods as possible since it may
 *		increase kernel boot time of built-in device drivers
 *		requesting firmware in their ->probe() methods, if
 *		@gfp is GFP_KERNEL.
 *
 *		- can't sleep at all if @gfp is GFP_ATOMIC.
L
Linus Torvalds 已提交
1353 1354 1355
 **/
int
request_firmware_nowait(
1356
	struct module *module, bool uevent,
1357
	const char *name, struct device *device, gfp_t gfp, void *context,
L
Linus Torvalds 已提交
1358 1359
	void (*cont)(const struct firmware *fw, void *context))
{
1360
	struct firmware_work *fw_work;
L
Linus Torvalds 已提交
1361

1362
	fw_work = kzalloc(sizeof(struct firmware_work), gfp);
L
Linus Torvalds 已提交
1363 1364
	if (!fw_work)
		return -ENOMEM;
1365 1366

	fw_work->module = module;
1367
	fw_work->name = kstrdup_const(name, gfp);
1368 1369
	if (!fw_work->name) {
		kfree(fw_work);
1370
		return -ENOMEM;
1371
	}
1372 1373 1374
	fw_work->device = device;
	fw_work->context = context;
	fw_work->cont = cont;
1375
	fw_work->opt_flags = FW_OPT_NOWAIT | FW_OPT_FALLBACK |
1376
		(uevent ? FW_OPT_UEVENT : FW_OPT_USERHELPER);
1377

L
Linus Torvalds 已提交
1378
	if (!try_module_get(module)) {
1379
		kfree_const(fw_work->name);
L
Linus Torvalds 已提交
1380 1381 1382 1383
		kfree(fw_work);
		return -EFAULT;
	}

M
Ming Lei 已提交
1384
	get_device(fw_work->device);
1385 1386
	INIT_WORK(&fw_work->work, request_firmware_work_func);
	schedule_work(&fw_work->work);
L
Linus Torvalds 已提交
1387 1388
	return 0;
}
1389
EXPORT_SYMBOL(request_firmware_nowait);
L
Linus Torvalds 已提交
1390

1391 1392 1393
#ifdef CONFIG_PM_SLEEP
static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);

1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407
/**
 * cache_firmware - cache one firmware image in kernel memory space
 * @fw_name: the firmware image name
 *
 * Cache firmware in kernel memory so that drivers can use it when
 * system isn't ready for them to request firmware image from userspace.
 * Once it returns successfully, driver can use request_firmware or its
 * nowait version to get the cached firmware without any interacting
 * with userspace
 *
 * Return 0 if the firmware image has been cached successfully
 * Return !0 otherwise
 *
 */
1408
static int cache_firmware(const char *fw_name)
1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423
{
	int ret;
	const struct firmware *fw;

	pr_debug("%s: %s\n", __func__, fw_name);

	ret = request_firmware(&fw, fw_name, NULL);
	if (!ret)
		kfree(fw);

	pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);

	return ret;
}

1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435
static struct firmware_buf *fw_lookup_buf(const char *fw_name)
{
	struct firmware_buf *tmp;
	struct firmware_cache *fwc = &fw_cache;

	spin_lock(&fwc->lock);
	tmp = __fw_lookup_buf(fw_name);
	spin_unlock(&fwc->lock);

	return tmp;
}

1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446
/**
 * uncache_firmware - remove one cached firmware image
 * @fw_name: the firmware image name
 *
 * Uncache one firmware image which has been cached successfully
 * before.
 *
 * Return 0 if the firmware cache has been removed successfully
 * Return !0 otherwise
 *
 */
1447
static int uncache_firmware(const char *fw_name)
1448 1449 1450 1451 1452 1453
{
	struct firmware_buf *buf;
	struct firmware fw;

	pr_debug("%s: %s\n", __func__, fw_name);

1454
	if (fw_get_builtin_firmware(&fw, fw_name, NULL, 0))
1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465
		return 0;

	buf = fw_lookup_buf(fw_name);
	if (buf) {
		fw_free_buf(buf);
		return 0;
	}

	return -EINVAL;
}

1466 1467 1468 1469
static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
{
	struct fw_cache_entry *fce;

1470
	fce = kzalloc(sizeof(*fce), GFP_ATOMIC);
1471 1472 1473
	if (!fce)
		goto exit;

1474 1475 1476 1477 1478 1479
	fce->name = kstrdup_const(name, GFP_ATOMIC);
	if (!fce->name) {
		kfree(fce);
		fce = NULL;
		goto exit;
	}
1480 1481 1482 1483
exit:
	return fce;
}

1484
static int __fw_entry_found(const char *name)
1485 1486 1487 1488 1489 1490
{
	struct firmware_cache *fwc = &fw_cache;
	struct fw_cache_entry *fce;

	list_for_each_entry(fce, &fwc->fw_names, list) {
		if (!strcmp(fce->name, name))
1491
			return 1;
1492
	}
1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504
	return 0;
}

static int fw_cache_piggyback_on_request(const char *name)
{
	struct firmware_cache *fwc = &fw_cache;
	struct fw_cache_entry *fce;
	int ret = 0;

	spin_lock(&fwc->name_lock);
	if (__fw_entry_found(name))
		goto found;
1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516

	fce = alloc_fw_cache_entry(name);
	if (fce) {
		ret = 1;
		list_add(&fce->list, &fwc->fw_names);
		pr_debug("%s: fw: %s\n", __func__, name);
	}
found:
	spin_unlock(&fwc->name_lock);
	return ret;
}

1517 1518
static void free_fw_cache_entry(struct fw_cache_entry *fce)
{
1519
	kfree_const(fce->name);
1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530
	kfree(fce);
}

static void __async_dev_cache_fw_image(void *fw_entry,
				       async_cookie_t cookie)
{
	struct fw_cache_entry *fce = fw_entry;
	struct firmware_cache *fwc = &fw_cache;
	int ret;

	ret = cache_firmware(fce->name);
1531 1532 1533 1534
	if (ret) {
		spin_lock(&fwc->name_lock);
		list_del(&fce->list);
		spin_unlock(&fwc->name_lock);
1535

1536 1537
		free_fw_cache_entry(fce);
	}
1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560
}

/* called with dev->devres_lock held */
static void dev_create_fw_entry(struct device *dev, void *res,
				void *data)
{
	struct fw_name_devm *fwn = res;
	const char *fw_name = fwn->name;
	struct list_head *head = data;
	struct fw_cache_entry *fce;

	fce = alloc_fw_cache_entry(fw_name);
	if (fce)
		list_add(&fce->list, head);
}

static int devm_name_match(struct device *dev, void *res,
			   void *match_data)
{
	struct fw_name_devm *fwn = res;
	return (fwn->magic == (unsigned long)match_data);
}

1561
static void dev_cache_fw_image(struct device *dev, void *data)
1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575
{
	LIST_HEAD(todo);
	struct fw_cache_entry *fce;
	struct fw_cache_entry *fce_next;
	struct firmware_cache *fwc = &fw_cache;

	devres_for_each_res(dev, fw_name_devm_release,
			    devm_name_match, &fw_cache,
			    dev_create_fw_entry, &todo);

	list_for_each_entry_safe(fce, fce_next, &todo, list) {
		list_del(&fce->list);

		spin_lock(&fwc->name_lock);
1576 1577 1578 1579 1580 1581 1582
		/* only one cache entry for one firmware */
		if (!__fw_entry_found(fce->name)) {
			list_add(&fce->list, &fwc->fw_names);
		} else {
			free_fw_cache_entry(fce);
			fce = NULL;
		}
1583 1584
		spin_unlock(&fwc->name_lock);

1585
		if (fce)
1586 1587 1588
			async_schedule_domain(__async_dev_cache_fw_image,
					      (void *)fce,
					      &fw_cache_domain);
1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624
	}
}

static void __device_uncache_fw_images(void)
{
	struct firmware_cache *fwc = &fw_cache;
	struct fw_cache_entry *fce;

	spin_lock(&fwc->name_lock);
	while (!list_empty(&fwc->fw_names)) {
		fce = list_entry(fwc->fw_names.next,
				struct fw_cache_entry, list);
		list_del(&fce->list);
		spin_unlock(&fwc->name_lock);

		uncache_firmware(fce->name);
		free_fw_cache_entry(fce);

		spin_lock(&fwc->name_lock);
	}
	spin_unlock(&fwc->name_lock);
}

/**
 * device_cache_fw_images - cache devices' firmware
 *
 * If one device called request_firmware or its nowait version
 * successfully before, the firmware names are recored into the
 * device's devres link list, so device_cache_fw_images can call
 * cache_firmware() to cache these firmwares for the device,
 * then the device driver can load its firmwares easily at
 * time when system is not ready to complete loading firmware.
 */
static void device_cache_fw_images(void)
{
	struct firmware_cache *fwc = &fw_cache;
1625
	int old_timeout;
1626 1627 1628 1629
	DEFINE_WAIT(wait);

	pr_debug("%s\n", __func__);

1630 1631 1632
	/* cancel uncache work */
	cancel_delayed_work_sync(&fwc->work);

1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643
	/*
	 * use small loading timeout for caching devices' firmware
	 * because all these firmware images have been loaded
	 * successfully at lease once, also system is ready for
	 * completing firmware loading now. The maximum size of
	 * firmware in current distributions is about 2M bytes,
	 * so 10 secs should be enough.
	 */
	old_timeout = loading_timeout;
	loading_timeout = 10;

1644 1645
	mutex_lock(&fw_lock);
	fwc->state = FW_LOADER_START_CACHE;
1646
	dpm_for_each_dev(NULL, dev_cache_fw_image);
1647
	mutex_unlock(&fw_lock);
1648 1649

	/* wait for completion of caching firmware for all devices */
1650
	async_synchronize_full_domain(&fw_cache_domain);
1651 1652

	loading_timeout = old_timeout;
1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680
}

/**
 * device_uncache_fw_images - uncache devices' firmware
 *
 * uncache all firmwares which have been cached successfully
 * by device_uncache_fw_images earlier
 */
static void device_uncache_fw_images(void)
{
	pr_debug("%s\n", __func__);
	__device_uncache_fw_images();
}

static void device_uncache_fw_images_work(struct work_struct *work)
{
	device_uncache_fw_images();
}

/**
 * device_uncache_fw_images_delay - uncache devices firmwares
 * @delay: number of milliseconds to delay uncache device firmwares
 *
 * uncache all devices's firmwares which has been cached successfully
 * by device_cache_fw_images after @delay milliseconds.
 */
static void device_uncache_fw_images_delay(unsigned long delay)
{
1681 1682
	queue_delayed_work(system_power_efficient_wq, &fw_cache.work,
			   msecs_to_jiffies(delay));
1683 1684
}

1685 1686 1687 1688 1689 1690
static int fw_pm_notify(struct notifier_block *notify_block,
			unsigned long mode, void *unused)
{
	switch (mode) {
	case PM_HIBERNATION_PREPARE:
	case PM_SUSPEND_PREPARE:
1691
	case PM_RESTORE_PREPARE:
1692
		kill_requests_without_uevent();
1693 1694 1695 1696 1697 1698
		device_cache_fw_images();
		break;

	case PM_POST_SUSPEND:
	case PM_POST_HIBERNATION:
	case PM_POST_RESTORE:
1699 1700 1701 1702 1703 1704 1705 1706
		/*
		 * In case that system sleep failed and syscore_suspend is
		 * not called.
		 */
		mutex_lock(&fw_lock);
		fw_cache.state = FW_LOADER_NO_CACHE;
		mutex_unlock(&fw_lock);

1707 1708 1709 1710 1711 1712 1713
		device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
		break;
	}

	return 0;
}

1714 1715 1716 1717 1718 1719 1720 1721 1722 1723
/* stop caching firmware once syscore_suspend is reached */
static int fw_suspend(void)
{
	fw_cache.state = FW_LOADER_NO_CACHE;
	return 0;
}

static struct syscore_ops fw_syscore_ops = {
	.suspend = fw_suspend,
};
1724 1725 1726 1727 1728 1729
#else
static int fw_cache_piggyback_on_request(const char *name)
{
	return 0;
}
#endif
1730

1731 1732 1733 1734
static void __init fw_cache_init(void)
{
	spin_lock_init(&fw_cache.lock);
	INIT_LIST_HEAD(&fw_cache.head);
1735
	fw_cache.state = FW_LOADER_NO_CACHE;
1736

1737
#ifdef CONFIG_PM_SLEEP
1738 1739 1740 1741 1742
	spin_lock_init(&fw_cache.name_lock);
	INIT_LIST_HEAD(&fw_cache.fw_names);

	INIT_DELAYED_WORK(&fw_cache.work,
			  device_uncache_fw_images_work);
1743 1744 1745

	fw_cache.pm_notify.notifier_call = fw_pm_notify;
	register_pm_notifier(&fw_cache.pm_notify);
1746 1747

	register_syscore_ops(&fw_syscore_ops);
1748
#endif
1749 1750
}

1751
static int __init firmware_class_init(void)
L
Linus Torvalds 已提交
1752
{
1753
	fw_cache_init();
1754
#ifdef CONFIG_FW_LOADER_USER_HELPER
1755
	register_reboot_notifier(&fw_shutdown_nb);
1756
	return class_register(&firmware_class);
1757 1758 1759
#else
	return 0;
#endif
L
Linus Torvalds 已提交
1760
}
1761 1762

static void __exit firmware_class_exit(void)
L
Linus Torvalds 已提交
1763
{
1764
#ifdef CONFIG_PM_SLEEP
1765
	unregister_syscore_ops(&fw_syscore_ops);
1766
	unregister_pm_notifier(&fw_cache.pm_notify);
1767
#endif
1768
#ifdef CONFIG_FW_LOADER_USER_HELPER
1769
	unregister_reboot_notifier(&fw_shutdown_nb);
L
Linus Torvalds 已提交
1770
	class_unregister(&firmware_class);
1771
#endif
L
Linus Torvalds 已提交
1772 1773
}

1774
fs_initcall(firmware_class_init);
L
Linus Torvalds 已提交
1775
module_exit(firmware_class_exit);