1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * main.c - Multi purpose firmware loading support 4 * 5 * Copyright (c) 2003 Manuel Estrada Sainz 6 * 7 * Please see Documentation/driver-api/firmware/ for more information. 8 * 9 */ 10 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 13 #include <linux/capability.h> 14 #include <linux/device.h> 15 #include <linux/kernel_read_file.h> 16 #include <linux/module.h> 17 #include <linux/init.h> 18 #include <linux/initrd.h> 19 #include <linux/timer.h> 20 #include <linux/vmalloc.h> 21 #include <linux/interrupt.h> 22 #include <linux/bitops.h> 23 #include <linux/mutex.h> 24 #include <linux/workqueue.h> 25 #include <linux/highmem.h> 26 #include <linux/firmware.h> 27 #include <linux/slab.h> 28 #include <linux/sched.h> 29 #include <linux/file.h> 30 #include <linux/list.h> 31 #include <linux/fs.h> 32 #include <linux/async.h> 33 #include <linux/pm.h> 34 #include <linux/suspend.h> 35 #include <linux/syscore_ops.h> 36 #include <linux/reboot.h> 37 #include <linux/security.h> 38 #include <linux/zstd.h> 39 #include <linux/xz.h> 40 41 #include <generated/utsrelease.h> 42 43 #include "../base.h" 44 #include "firmware.h" 45 #include "fallback.h" 46 47 MODULE_AUTHOR("Manuel Estrada Sainz"); 48 MODULE_DESCRIPTION("Multi purpose firmware loading support"); 49 MODULE_LICENSE("GPL"); 50 51 struct firmware_cache { 52 /* firmware_buf instance will be added into the below list */ 53 spinlock_t lock; 54 struct list_head head; 55 int state; 56 57 #ifdef CONFIG_FW_CACHE 58 /* 59 * Names of firmware images which have been cached successfully 60 * will be added into the below list so that device uncache 61 * helper can trace which firmware images have been cached 62 * before. 63 */ 64 spinlock_t name_lock; 65 struct list_head fw_names; 66 67 struct delayed_work work; 68 69 struct notifier_block pm_notify; 70 #endif 71 }; 72 73 struct fw_cache_entry { 74 struct list_head list; 75 const char *name; 76 }; 77 78 struct fw_name_devm { 79 unsigned long magic; 80 const char *name; 81 }; 82 83 static inline struct fw_priv *to_fw_priv(struct kref *ref) 84 { 85 return container_of(ref, struct fw_priv, ref); 86 } 87 88 #define FW_LOADER_NO_CACHE 0 89 #define FW_LOADER_START_CACHE 1 90 91 /* fw_lock could be moved to 'struct fw_sysfs' but since it is just 92 * guarding for corner cases a global lock should be OK */ 93 DEFINE_MUTEX(fw_lock); 94 95 struct firmware_cache fw_cache; 96 bool fw_load_abort_all; 97 98 void fw_state_init(struct fw_priv *fw_priv) 99 { 100 struct fw_state *fw_st = &fw_priv->fw_st; 101 102 init_completion(&fw_st->completion); 103 fw_st->status = FW_STATUS_UNKNOWN; 104 } 105 106 static inline int fw_state_wait(struct fw_priv *fw_priv) 107 { 108 return __fw_state_wait_common(fw_priv, MAX_SCHEDULE_TIMEOUT); 109 } 110 111 static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv); 112 113 static struct fw_priv *__allocate_fw_priv(const char *fw_name, 114 struct firmware_cache *fwc, 115 void *dbuf, 116 size_t size, 117 size_t offset, 118 u32 opt_flags) 119 { 120 struct fw_priv *fw_priv; 121 122 /* For a partial read, the buffer must be preallocated. */ 123 if ((opt_flags & FW_OPT_PARTIAL) && !dbuf) 124 return NULL; 125 126 /* Only partial reads are allowed to use an offset. */ 127 if (offset != 0 && !(opt_flags & FW_OPT_PARTIAL)) 128 return NULL; 129 130 fw_priv = kzalloc_obj(*fw_priv, GFP_ATOMIC); 131 if (!fw_priv) 132 return NULL; 133 134 fw_priv->fw_name = kstrdup_const(fw_name, GFP_ATOMIC); 135 if (!fw_priv->fw_name) { 136 kfree(fw_priv); 137 return NULL; 138 } 139 140 kref_init(&fw_priv->ref); 141 fw_priv->fwc = fwc; 142 fw_priv->data = dbuf; 143 fw_priv->allocated_size = size; 144 fw_priv->offset = offset; 145 fw_priv->opt_flags = opt_flags; 146 fw_state_init(fw_priv); 147 #ifdef CONFIG_FW_LOADER_USER_HELPER 148 INIT_LIST_HEAD(&fw_priv->pending_list); 149 #endif 150 151 pr_debug("%s: fw-%s fw_priv=%p\n", __func__, fw_name, fw_priv); 152 153 return fw_priv; 154 } 155 156 static struct fw_priv *__lookup_fw_priv(const char *fw_name) 157 { 158 struct fw_priv *tmp; 159 struct firmware_cache *fwc = &fw_cache; 160 161 list_for_each_entry(tmp, &fwc->head, list) 162 if (!strcmp(tmp->fw_name, fw_name)) 163 return tmp; 164 return NULL; 165 } 166 167 /* Returns 1 for batching firmware requests with the same name */ 168 int alloc_lookup_fw_priv(const char *fw_name, struct firmware_cache *fwc, 169 struct fw_priv **fw_priv, void *dbuf, size_t size, 170 size_t offset, u32 opt_flags) 171 { 172 struct fw_priv *tmp; 173 174 spin_lock(&fwc->lock); 175 /* 176 * Do not merge requests that are marked to be non-cached or 177 * are performing partial reads. 178 */ 179 if (!(opt_flags & (FW_OPT_NOCACHE | FW_OPT_PARTIAL))) { 180 tmp = __lookup_fw_priv(fw_name); 181 if (tmp) { 182 kref_get(&tmp->ref); 183 spin_unlock(&fwc->lock); 184 *fw_priv = tmp; 185 pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n"); 186 return 1; 187 } 188 } 189 190 tmp = __allocate_fw_priv(fw_name, fwc, dbuf, size, offset, opt_flags); 191 if (tmp) { 192 INIT_LIST_HEAD(&tmp->list); 193 if (!(opt_flags & FW_OPT_NOCACHE)) 194 list_add(&tmp->list, &fwc->head); 195 } 196 spin_unlock(&fwc->lock); 197 198 *fw_priv = tmp; 199 200 return tmp ? 0 : -ENOMEM; 201 } 202 203 static void __free_fw_priv(struct kref *ref) 204 __releases(&fwc->lock) 205 { 206 struct fw_priv *fw_priv = to_fw_priv(ref); 207 struct firmware_cache *fwc = fw_priv->fwc; 208 209 pr_debug("%s: fw-%s fw_priv=%p data=%p size=%u\n", 210 __func__, fw_priv->fw_name, fw_priv, fw_priv->data, 211 (unsigned int)fw_priv->size); 212 213 list_del(&fw_priv->list); 214 spin_unlock(&fwc->lock); 215 216 if (fw_is_paged_buf(fw_priv)) 217 fw_free_paged_buf(fw_priv); 218 else if (!fw_priv->allocated_size) 219 vfree(fw_priv->data); 220 221 kfree_const(fw_priv->fw_name); 222 kfree(fw_priv); 223 } 224 225 void free_fw_priv(struct fw_priv *fw_priv) 226 { 227 struct firmware_cache *fwc = fw_priv->fwc; 228 spin_lock(&fwc->lock); 229 if (!kref_put(&fw_priv->ref, __free_fw_priv)) 230 spin_unlock(&fwc->lock); 231 } 232 233 #ifdef CONFIG_FW_LOADER_PAGED_BUF 234 bool fw_is_paged_buf(struct fw_priv *fw_priv) 235 { 236 return fw_priv->is_paged_buf; 237 } 238 239 void fw_free_paged_buf(struct fw_priv *fw_priv) 240 { 241 int i; 242 243 if (!fw_priv->pages) 244 return; 245 246 vunmap(fw_priv->data); 247 248 for (i = 0; i < fw_priv->nr_pages; i++) 249 __free_page(fw_priv->pages[i]); 250 kvfree(fw_priv->pages); 251 fw_priv->pages = NULL; 252 fw_priv->page_array_size = 0; 253 fw_priv->nr_pages = 0; 254 fw_priv->data = NULL; 255 fw_priv->size = 0; 256 } 257 258 int fw_grow_paged_buf(struct fw_priv *fw_priv, int pages_needed) 259 { 260 /* If the array of pages is too small, grow it */ 261 if (fw_priv->page_array_size < pages_needed) { 262 int new_array_size = max(pages_needed, 263 fw_priv->page_array_size * 2); 264 struct page **new_pages; 265 266 new_pages = kvmalloc_array(new_array_size, sizeof(void *), 267 GFP_KERNEL); 268 if (!new_pages) 269 return -ENOMEM; 270 memcpy(new_pages, fw_priv->pages, 271 fw_priv->page_array_size * sizeof(void *)); 272 memset(&new_pages[fw_priv->page_array_size], 0, sizeof(void *) * 273 (new_array_size - fw_priv->page_array_size)); 274 kvfree(fw_priv->pages); 275 fw_priv->pages = new_pages; 276 fw_priv->page_array_size = new_array_size; 277 } 278 279 while (fw_priv->nr_pages < pages_needed) { 280 fw_priv->pages[fw_priv->nr_pages] = 281 alloc_page(GFP_KERNEL | __GFP_HIGHMEM); 282 283 if (!fw_priv->pages[fw_priv->nr_pages]) 284 return -ENOMEM; 285 fw_priv->nr_pages++; 286 } 287 288 return 0; 289 } 290 291 int fw_map_paged_buf(struct fw_priv *fw_priv) 292 { 293 /* one pages buffer should be mapped/unmapped only once */ 294 if (!fw_priv->pages) 295 return 0; 296 297 vunmap(fw_priv->data); 298 fw_priv->data = vmap(fw_priv->pages, fw_priv->nr_pages, 0, 299 PAGE_KERNEL_RO); 300 if (!fw_priv->data) 301 return -ENOMEM; 302 303 return 0; 304 } 305 #endif 306 307 /* 308 * ZSTD-compressed firmware support 309 */ 310 #ifdef CONFIG_FW_LOADER_COMPRESS_ZSTD 311 static int fw_decompress_zstd(struct device *dev, struct fw_priv *fw_priv, 312 size_t in_size, const void *in_buffer) 313 { 314 size_t len, out_size, workspace_size; 315 void *workspace, *out_buf; 316 zstd_dctx *ctx; 317 int err; 318 319 if (fw_priv->allocated_size) { 320 out_size = fw_priv->allocated_size; 321 out_buf = fw_priv->data; 322 } else { 323 zstd_frame_header params; 324 325 if (zstd_get_frame_header(¶ms, in_buffer, in_size) || 326 params.frameContentSize == ZSTD_CONTENTSIZE_UNKNOWN) { 327 dev_dbg(dev, "%s: invalid zstd header\n", __func__); 328 return -EINVAL; 329 } 330 out_size = params.frameContentSize; 331 out_buf = vzalloc(out_size); 332 if (!out_buf) 333 return -ENOMEM; 334 } 335 336 workspace_size = zstd_dctx_workspace_bound(); 337 workspace = kvzalloc(workspace_size, GFP_KERNEL); 338 if (!workspace) { 339 err = -ENOMEM; 340 goto error; 341 } 342 343 ctx = zstd_init_dctx(workspace, workspace_size); 344 if (!ctx) { 345 dev_dbg(dev, "%s: failed to initialize context\n", __func__); 346 err = -EINVAL; 347 goto error; 348 } 349 350 len = zstd_decompress_dctx(ctx, out_buf, out_size, in_buffer, in_size); 351 if (zstd_is_error(len)) { 352 dev_dbg(dev, "%s: failed to decompress: %d\n", __func__, 353 zstd_get_error_code(len)); 354 err = -EINVAL; 355 goto error; 356 } 357 358 if (!fw_priv->allocated_size) 359 fw_priv->data = out_buf; 360 fw_priv->size = len; 361 err = 0; 362 363 error: 364 kvfree(workspace); 365 if (err && !fw_priv->allocated_size) 366 vfree(out_buf); 367 return err; 368 } 369 #endif /* CONFIG_FW_LOADER_COMPRESS_ZSTD */ 370 371 /* 372 * XZ-compressed firmware support 373 */ 374 #ifdef CONFIG_FW_LOADER_COMPRESS_XZ 375 /* show an error and return the standard error code */ 376 static int fw_decompress_xz_error(struct device *dev, enum xz_ret xz_ret) 377 { 378 if (xz_ret != XZ_STREAM_END) { 379 dev_warn(dev, "xz decompression failed (xz_ret=%d)\n", xz_ret); 380 return xz_ret == XZ_MEM_ERROR ? -ENOMEM : -EINVAL; 381 } 382 return 0; 383 } 384 385 /* single-shot decompression onto the pre-allocated buffer */ 386 static int fw_decompress_xz_single(struct device *dev, struct fw_priv *fw_priv, 387 size_t in_size, const void *in_buffer) 388 { 389 struct xz_dec *xz_dec; 390 struct xz_buf xz_buf; 391 enum xz_ret xz_ret; 392 393 xz_dec = xz_dec_init(XZ_SINGLE, (u32)-1); 394 if (!xz_dec) 395 return -ENOMEM; 396 397 xz_buf.in_size = in_size; 398 xz_buf.in = in_buffer; 399 xz_buf.in_pos = 0; 400 xz_buf.out_size = fw_priv->allocated_size; 401 xz_buf.out = fw_priv->data; 402 xz_buf.out_pos = 0; 403 404 xz_ret = xz_dec_run(xz_dec, &xz_buf); 405 xz_dec_end(xz_dec); 406 407 fw_priv->size = xz_buf.out_pos; 408 return fw_decompress_xz_error(dev, xz_ret); 409 } 410 411 /* decompression on paged buffer and map it */ 412 static int fw_decompress_xz_pages(struct device *dev, struct fw_priv *fw_priv, 413 size_t in_size, const void *in_buffer) 414 { 415 struct xz_dec *xz_dec; 416 struct xz_buf xz_buf; 417 enum xz_ret xz_ret; 418 struct page *page; 419 int err = 0; 420 421 xz_dec = xz_dec_init(XZ_DYNALLOC, (u32)-1); 422 if (!xz_dec) 423 return -ENOMEM; 424 425 xz_buf.in_size = in_size; 426 xz_buf.in = in_buffer; 427 xz_buf.in_pos = 0; 428 429 fw_priv->is_paged_buf = true; 430 fw_priv->size = 0; 431 do { 432 if (fw_grow_paged_buf(fw_priv, fw_priv->nr_pages + 1)) { 433 err = -ENOMEM; 434 goto out; 435 } 436 437 /* decompress onto the new allocated page */ 438 page = fw_priv->pages[fw_priv->nr_pages - 1]; 439 xz_buf.out = kmap_local_page(page); 440 xz_buf.out_pos = 0; 441 xz_buf.out_size = PAGE_SIZE; 442 xz_ret = xz_dec_run(xz_dec, &xz_buf); 443 kunmap_local(xz_buf.out); 444 fw_priv->size += xz_buf.out_pos; 445 /* partial decompression means either end or error */ 446 if (xz_buf.out_pos != PAGE_SIZE) 447 break; 448 } while (xz_ret == XZ_OK); 449 450 err = fw_decompress_xz_error(dev, xz_ret); 451 if (!err) 452 err = fw_map_paged_buf(fw_priv); 453 454 out: 455 xz_dec_end(xz_dec); 456 return err; 457 } 458 459 static int fw_decompress_xz(struct device *dev, struct fw_priv *fw_priv, 460 size_t in_size, const void *in_buffer) 461 { 462 /* if the buffer is pre-allocated, we can perform in single-shot mode */ 463 if (fw_priv->data) 464 return fw_decompress_xz_single(dev, fw_priv, in_size, in_buffer); 465 else 466 return fw_decompress_xz_pages(dev, fw_priv, in_size, in_buffer); 467 } 468 #endif /* CONFIG_FW_LOADER_COMPRESS_XZ */ 469 470 /* direct firmware loading support */ 471 static char fw_path_para[256]; 472 static const char * const fw_path[] = { 473 fw_path_para, 474 "/lib/firmware/updates/" UTS_RELEASE, 475 "/lib/firmware/updates", 476 "/lib/firmware/" UTS_RELEASE, 477 "/lib/firmware" 478 }; 479 480 /* 481 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH' 482 * from kernel command line because firmware_class is generally built in 483 * kernel instead of module. 484 */ 485 module_param_string(path, fw_path_para, sizeof(fw_path_para), 0644); 486 MODULE_PARM_DESC(path, "customized firmware image search path with a higher priority than default path"); 487 488 static int 489 fw_get_filesystem_firmware(struct device *device, struct fw_priv *fw_priv, 490 const char *suffix, 491 int (*decompress)(struct device *dev, 492 struct fw_priv *fw_priv, 493 size_t in_size, 494 const void *in_buffer)) 495 { 496 size_t size; 497 int i, len, maxlen = 0; 498 int rc = -ENOENT; 499 char *path, *nt = NULL; 500 size_t msize = INT_MAX; 501 void *buffer = NULL; 502 503 /* Already populated data member means we're loading into a buffer */ 504 if (!decompress && fw_priv->data) { 505 buffer = fw_priv->data; 506 msize = fw_priv->allocated_size; 507 } 508 509 path = __getname(); 510 if (!path) 511 return -ENOMEM; 512 513 wait_for_initramfs(); 514 for (i = 0; i < ARRAY_SIZE(fw_path); i++) { 515 size_t file_size = 0; 516 size_t *file_size_ptr = NULL; 517 518 /* skip the unset customized path */ 519 if (!fw_path[i][0]) 520 continue; 521 522 /* strip off \n from customized path */ 523 maxlen = strlen(fw_path[i]); 524 if (i == 0) { 525 nt = strchr(fw_path[i], '\n'); 526 if (nt) 527 maxlen = nt - fw_path[i]; 528 } 529 530 len = snprintf(path, PATH_MAX, "%.*s/%s%s", 531 maxlen, fw_path[i], 532 fw_priv->fw_name, suffix); 533 if (len >= PATH_MAX) { 534 rc = -ENAMETOOLONG; 535 break; 536 } 537 538 fw_priv->size = 0; 539 540 /* 541 * The total file size is only examined when doing a partial 542 * read; the "full read" case needs to fail if the whole 543 * firmware was not completely loaded. 544 */ 545 if ((fw_priv->opt_flags & FW_OPT_PARTIAL) && buffer) 546 file_size_ptr = &file_size; 547 548 /* load firmware files from the mount namespace of init */ 549 rc = kernel_read_file_from_path_initns(path, fw_priv->offset, 550 &buffer, msize, 551 file_size_ptr, 552 READING_FIRMWARE); 553 if (rc < 0) { 554 if (!(fw_priv->opt_flags & FW_OPT_NO_WARN)) { 555 if (rc != -ENOENT) 556 dev_warn(device, 557 "loading %s failed with error %d\n", 558 path, rc); 559 else 560 dev_dbg(device, 561 "loading %s failed for no such file or directory.\n", 562 path); 563 } 564 continue; 565 } 566 size = rc; 567 rc = 0; 568 569 dev_dbg(device, "Loading firmware from %s\n", path); 570 if (decompress) { 571 dev_dbg(device, "f/w decompressing %s\n", 572 fw_priv->fw_name); 573 rc = decompress(device, fw_priv, size, buffer); 574 /* discard the superfluous original content */ 575 vfree(buffer); 576 buffer = NULL; 577 if (rc) { 578 fw_free_paged_buf(fw_priv); 579 continue; 580 } 581 } else { 582 dev_dbg(device, "direct-loading %s\n", 583 fw_priv->fw_name); 584 if (!fw_priv->data) 585 fw_priv->data = buffer; 586 fw_priv->size = size; 587 } 588 fw_state_done(fw_priv); 589 break; 590 } 591 __putname(path); 592 593 return rc; 594 } 595 596 /* firmware holds the ownership of pages */ 597 static void firmware_free_data(const struct firmware *fw) 598 { 599 /* Loaded directly? */ 600 if (!fw->priv) { 601 vfree(fw->data); 602 return; 603 } 604 free_fw_priv(fw->priv); 605 } 606 607 /* store the pages buffer info firmware from buf */ 608 static void fw_set_page_data(struct fw_priv *fw_priv, struct firmware *fw) 609 { 610 fw->priv = fw_priv; 611 fw->size = fw_priv->size; 612 fw->data = fw_priv->data; 613 614 pr_debug("%s: fw-%s fw_priv=%p data=%p size=%u\n", 615 __func__, fw_priv->fw_name, fw_priv, fw_priv->data, 616 (unsigned int)fw_priv->size); 617 } 618 619 #ifdef CONFIG_FW_CACHE 620 static void fw_name_devm_release(struct device *dev, void *res) 621 { 622 struct fw_name_devm *fwn = res; 623 624 if (fwn->magic == (unsigned long)&fw_cache) 625 pr_debug("%s: fw_name-%s devm-%p released\n", 626 __func__, fwn->name, res); 627 kfree_const(fwn->name); 628 } 629 630 static int fw_devm_match(struct device *dev, void *res, 631 void *match_data) 632 { 633 struct fw_name_devm *fwn = res; 634 635 return (fwn->magic == (unsigned long)&fw_cache) && 636 !strcmp(fwn->name, match_data); 637 } 638 639 static struct fw_name_devm *fw_find_devm_name(struct device *dev, 640 const char *name) 641 { 642 struct fw_name_devm *fwn; 643 644 fwn = devres_find(dev, fw_name_devm_release, 645 fw_devm_match, (void *)name); 646 return fwn; 647 } 648 649 static bool fw_cache_is_setup(struct device *dev, const char *name) 650 { 651 struct fw_name_devm *fwn; 652 653 fwn = fw_find_devm_name(dev, name); 654 if (fwn) 655 return true; 656 657 return false; 658 } 659 660 /* add firmware name into devres list */ 661 static int fw_add_devm_name(struct device *dev, const char *name) 662 { 663 struct fw_name_devm *fwn; 664 665 if (fw_cache_is_setup(dev, name)) 666 return 0; 667 668 fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm), 669 GFP_KERNEL); 670 if (!fwn) 671 return -ENOMEM; 672 fwn->name = kstrdup_const(name, GFP_KERNEL); 673 if (!fwn->name) { 674 devres_free(fwn); 675 return -ENOMEM; 676 } 677 678 fwn->magic = (unsigned long)&fw_cache; 679 devres_add(dev, fwn); 680 681 return 0; 682 } 683 #else 684 static bool fw_cache_is_setup(struct device *dev, const char *name) 685 { 686 return false; 687 } 688 689 static int fw_add_devm_name(struct device *dev, const char *name) 690 { 691 return 0; 692 } 693 #endif 694 695 int assign_fw(struct firmware *fw, struct device *device) 696 { 697 struct fw_priv *fw_priv = fw->priv; 698 int ret; 699 700 mutex_lock(&fw_lock); 701 if (!fw_priv->size || fw_state_is_aborted(fw_priv)) { 702 mutex_unlock(&fw_lock); 703 return -ENOENT; 704 } 705 706 /* 707 * add firmware name into devres list so that we can auto cache 708 * and uncache firmware for device. 709 * 710 * device may has been deleted already, but the problem 711 * should be fixed in devres or driver core. 712 */ 713 /* don't cache firmware handled without uevent */ 714 if (device && (fw_priv->opt_flags & FW_OPT_UEVENT) && 715 !(fw_priv->opt_flags & FW_OPT_NOCACHE)) { 716 ret = fw_add_devm_name(device, fw_priv->fw_name); 717 if (ret) { 718 mutex_unlock(&fw_lock); 719 return ret; 720 } 721 } 722 723 /* 724 * After caching firmware image is started, let it piggyback 725 * on request firmware. 726 */ 727 if (!(fw_priv->opt_flags & FW_OPT_NOCACHE) && 728 fw_priv->fwc->state == FW_LOADER_START_CACHE) 729 fw_cache_piggyback_on_request(fw_priv); 730 731 /* pass the pages buffer to driver at the last minute */ 732 fw_set_page_data(fw_priv, fw); 733 mutex_unlock(&fw_lock); 734 return 0; 735 } 736 737 /* prepare firmware and firmware_buf structs; 738 * return 0 if a firmware is already assigned, 1 if need to load one, 739 * or a negative error code 740 */ 741 static int 742 _request_firmware_prepare(struct firmware **firmware_p, const char *name, 743 struct device *device, void *dbuf, size_t size, 744 size_t offset, u32 opt_flags) 745 { 746 struct firmware *firmware; 747 struct fw_priv *fw_priv; 748 int ret; 749 750 *firmware_p = firmware = kzalloc_obj(*firmware); 751 if (!firmware) { 752 dev_err(device, "%s: kmalloc(struct firmware) failed\n", 753 __func__); 754 return -ENOMEM; 755 } 756 757 if (firmware_request_builtin_buf(firmware, name, dbuf, size)) { 758 dev_dbg(device, "using built-in %s\n", name); 759 return 0; /* assigned */ 760 } 761 762 ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, dbuf, size, 763 offset, opt_flags); 764 765 /* 766 * bind with 'priv' now to avoid warning in failure path 767 * of requesting firmware. 768 */ 769 firmware->priv = fw_priv; 770 771 if (ret > 0) { 772 ret = fw_state_wait(fw_priv); 773 if (!ret) { 774 fw_set_page_data(fw_priv, firmware); 775 return 0; /* assigned */ 776 } 777 } 778 779 if (ret < 0) 780 return ret; 781 return 1; /* need to load */ 782 } 783 784 /* 785 * Batched requests need only one wake, we need to do this step last due to the 786 * fallback mechanism. The buf is protected with kref_get(), and it won't be 787 * released until the last user calls release_firmware(). 788 * 789 * Failed batched requests are possible as well, in such cases we just share 790 * the struct fw_priv and won't release it until all requests are woken 791 * and have gone through this same path. 792 */ 793 static void fw_abort_batch_reqs(struct firmware *fw) 794 { 795 struct fw_priv *fw_priv; 796 797 /* Loaded directly? */ 798 if (!fw || !fw->priv) 799 return; 800 801 fw_priv = fw->priv; 802 mutex_lock(&fw_lock); 803 if (!fw_state_is_aborted(fw_priv)) 804 fw_state_aborted(fw_priv); 805 mutex_unlock(&fw_lock); 806 } 807 808 #if defined(CONFIG_FW_LOADER_DEBUG) 809 #include <crypto/sha2.h> 810 811 static void fw_log_firmware_info(const struct firmware *fw, const char *name, struct device *device) 812 { 813 u8 digest[SHA256_DIGEST_SIZE]; 814 815 sha256(fw->data, fw->size, digest); 816 dev_dbg(device, "Loaded FW: %s, sha256: %*phN\n", 817 name, SHA256_DIGEST_SIZE, digest); 818 } 819 #else 820 static void fw_log_firmware_info(const struct firmware *fw, const char *name, 821 struct device *device) 822 {} 823 #endif 824 825 /* called from request_firmware() and request_firmware_work_func() */ 826 static int 827 _request_firmware(const struct firmware **firmware_p, const char *name, 828 struct device *device, void *buf, size_t size, 829 size_t offset, u32 opt_flags) 830 { 831 struct firmware *fw = NULL; 832 bool nondirect = false; 833 int ret; 834 835 if (!firmware_p) 836 return -EINVAL; 837 838 if (!name || name[0] == '\0') { 839 ret = -EINVAL; 840 goto out; 841 } 842 843 844 /* 845 * Reject firmware file names with ".." path components. 846 * There are drivers that construct firmware file names from 847 * device-supplied strings, and we don't want some device to be 848 * able to tell us "I would like to be sent my firmware from 849 * ../../../etc/shadow, please". 850 * 851 * This intentionally only looks at the firmware name, not at 852 * the firmware base directory or at symlink contents. 853 */ 854 if (name_contains_dotdot(name)) { 855 dev_warn(device, 856 "Firmware load for '%s' refused, path contains '..' component\n", 857 name); 858 ret = -EINVAL; 859 goto out; 860 } 861 862 ret = _request_firmware_prepare(&fw, name, device, buf, size, 863 offset, opt_flags); 864 if (ret <= 0) /* error or already assigned */ 865 goto out; 866 867 /* 868 * We are about to try to access the firmware file. Because we may have been 869 * called by a driver when serving an unrelated request from userland, we use 870 * the kernel credentials to read the file. 871 */ 872 scoped_with_kernel_creds() { 873 ret = fw_get_filesystem_firmware(device, fw->priv, "", NULL); 874 875 /* Only full reads can support decompression, platform, and sysfs. */ 876 if (!(opt_flags & FW_OPT_PARTIAL)) 877 nondirect = true; 878 879 #ifdef CONFIG_FW_LOADER_COMPRESS_ZSTD 880 if (ret == -ENOENT && nondirect) 881 ret = fw_get_filesystem_firmware(device, fw->priv, ".zst", 882 fw_decompress_zstd); 883 #endif 884 #ifdef CONFIG_FW_LOADER_COMPRESS_XZ 885 if (ret == -ENOENT && nondirect) 886 ret = fw_get_filesystem_firmware(device, fw->priv, ".xz", 887 fw_decompress_xz); 888 #endif 889 if (ret == -ENOENT && nondirect) 890 ret = firmware_fallback_platform(fw->priv); 891 892 if (ret) { 893 if (!(opt_flags & FW_OPT_NO_WARN)) 894 dev_warn(device, 895 "Direct firmware load for %s failed with error %d\n", 896 name, ret); 897 if (nondirect) 898 ret = firmware_fallback_sysfs(fw, name, device, 899 opt_flags, ret); 900 } else { 901 ret = assign_fw(fw, device); 902 } 903 } 904 905 out: 906 if (ret < 0) { 907 fw_abort_batch_reqs(fw); 908 release_firmware(fw); 909 fw = NULL; 910 } else { 911 fw_log_firmware_info(fw, name, device); 912 } 913 914 *firmware_p = fw; 915 return ret; 916 } 917 918 /** 919 * request_firmware() - send firmware request and wait for it 920 * @firmware_p: pointer to firmware image 921 * @name: name of firmware file 922 * @device: device for which firmware is being loaded 923 * 924 * @firmware_p will be used to return a firmware image by the name 925 * of @name for device @device. 926 * 927 * Should be called from user context where sleeping is allowed. 928 * 929 * @name will be used as $FIRMWARE in the uevent environment and 930 * should be distinctive enough not to be confused with any other 931 * firmware image for this or any other device. 932 * It must not contain any ".." path components - "foo/bar..bin" is 933 * allowed, but "foo/../bar.bin" is not. 934 * 935 * Caller must hold the reference count of @device. 936 * 937 * The function can be called safely inside device's suspend and 938 * resume callback. 939 **/ 940 int 941 request_firmware(const struct firmware **firmware_p, const char *name, 942 struct device *device) 943 { 944 int ret; 945 946 /* Need to pin this module until return */ 947 __module_get(THIS_MODULE); 948 ret = _request_firmware(firmware_p, name, device, NULL, 0, 0, 949 FW_OPT_UEVENT); 950 module_put(THIS_MODULE); 951 return ret; 952 } 953 EXPORT_SYMBOL(request_firmware); 954 955 /** 956 * firmware_request_nowarn() - request for an optional fw module 957 * @firmware: pointer to firmware image 958 * @name: name of firmware file 959 * @device: device for which firmware is being loaded 960 * 961 * This function is similar in behaviour to request_firmware(), except it 962 * doesn't produce warning messages when the file is not found. The sysfs 963 * fallback mechanism is enabled if direct filesystem lookup fails. However, 964 * failures to find the firmware file with it are still suppressed. It is 965 * therefore up to the driver to check for the return value of this call and to 966 * decide when to inform the users of errors. 967 **/ 968 int firmware_request_nowarn(const struct firmware **firmware, const char *name, 969 struct device *device) 970 { 971 int ret; 972 973 /* Need to pin this module until return */ 974 __module_get(THIS_MODULE); 975 ret = _request_firmware(firmware, name, device, NULL, 0, 0, 976 FW_OPT_UEVENT | FW_OPT_NO_WARN); 977 module_put(THIS_MODULE); 978 return ret; 979 } 980 EXPORT_SYMBOL_GPL(firmware_request_nowarn); 981 982 /** 983 * request_firmware_direct() - load firmware directly without usermode helper 984 * @firmware_p: pointer to firmware image 985 * @name: name of firmware file 986 * @device: device for which firmware is being loaded 987 * 988 * This function works pretty much like request_firmware(), but this doesn't 989 * fall back to usermode helper even if the firmware couldn't be loaded 990 * directly from fs. Hence it's useful for loading optional firmwares, which 991 * aren't always present, without extra long timeouts of udev. 992 **/ 993 int request_firmware_direct(const struct firmware **firmware_p, 994 const char *name, struct device *device) 995 { 996 int ret; 997 998 __module_get(THIS_MODULE); 999 ret = _request_firmware(firmware_p, name, device, NULL, 0, 0, 1000 FW_OPT_UEVENT | FW_OPT_NO_WARN | 1001 FW_OPT_NOFALLBACK_SYSFS); 1002 module_put(THIS_MODULE); 1003 return ret; 1004 } 1005 EXPORT_SYMBOL_GPL(request_firmware_direct); 1006 1007 /** 1008 * firmware_request_platform() - request firmware with platform-fw fallback 1009 * @firmware: pointer to firmware image 1010 * @name: name of firmware file 1011 * @device: device for which firmware is being loaded 1012 * 1013 * This function is similar in behaviour to request_firmware, except that if 1014 * direct filesystem lookup fails, it will fallback to looking for a copy of the 1015 * requested firmware embedded in the platform's main (e.g. UEFI) firmware. 1016 **/ 1017 int firmware_request_platform(const struct firmware **firmware, 1018 const char *name, struct device *device) 1019 { 1020 int ret; 1021 1022 /* Need to pin this module until return */ 1023 __module_get(THIS_MODULE); 1024 ret = _request_firmware(firmware, name, device, NULL, 0, 0, 1025 FW_OPT_UEVENT | FW_OPT_FALLBACK_PLATFORM); 1026 module_put(THIS_MODULE); 1027 return ret; 1028 } 1029 EXPORT_SYMBOL_GPL(firmware_request_platform); 1030 1031 /** 1032 * firmware_request_cache() - cache firmware for suspend so resume can use it 1033 * @device: device for which firmware should be cached for 1034 * @name: name of firmware file 1035 * 1036 * There are some devices with an optimization that enables the device to not 1037 * require loading firmware on system reboot. This optimization may still 1038 * require the firmware present on resume from suspend. This routine can be 1039 * used to ensure the firmware is present on resume from suspend in these 1040 * situations. This helper is not compatible with drivers which use 1041 * request_firmware_into_buf() or request_firmware_nowait() with no uevent set. 1042 **/ 1043 int firmware_request_cache(struct device *device, const char *name) 1044 { 1045 int ret; 1046 1047 mutex_lock(&fw_lock); 1048 ret = fw_add_devm_name(device, name); 1049 mutex_unlock(&fw_lock); 1050 1051 return ret; 1052 } 1053 EXPORT_SYMBOL_GPL(firmware_request_cache); 1054 1055 /** 1056 * request_firmware_into_buf() - load firmware into a previously allocated buffer 1057 * @firmware_p: pointer to firmware image 1058 * @name: name of firmware file 1059 * @device: device for which firmware is being loaded and DMA region allocated 1060 * @buf: address of buffer to load firmware into 1061 * @size: size of buffer 1062 * 1063 * This function works pretty much like request_firmware(), but it doesn't 1064 * allocate a buffer to hold the firmware data. Instead, the firmware 1065 * is loaded directly into the buffer pointed to by @buf and the @firmware_p 1066 * data member is pointed at @buf. 1067 * 1068 * This function doesn't cache firmware either. 1069 */ 1070 int 1071 request_firmware_into_buf(const struct firmware **firmware_p, const char *name, 1072 struct device *device, void *buf, size_t size) 1073 { 1074 int ret; 1075 1076 if (fw_cache_is_setup(device, name)) 1077 return -EOPNOTSUPP; 1078 1079 __module_get(THIS_MODULE); 1080 ret = _request_firmware(firmware_p, name, device, buf, size, 0, 1081 FW_OPT_UEVENT | FW_OPT_NOCACHE); 1082 module_put(THIS_MODULE); 1083 return ret; 1084 } 1085 EXPORT_SYMBOL(request_firmware_into_buf); 1086 1087 /** 1088 * request_partial_firmware_into_buf() - load partial firmware into a previously allocated buffer 1089 * @firmware_p: pointer to firmware image 1090 * @name: name of firmware file 1091 * @device: device for which firmware is being loaded and DMA region allocated 1092 * @buf: address of buffer to load firmware into 1093 * @size: size of buffer 1094 * @offset: offset into file to read 1095 * 1096 * This function works pretty much like request_firmware_into_buf except 1097 * it allows a partial read of the file. 1098 */ 1099 int 1100 request_partial_firmware_into_buf(const struct firmware **firmware_p, 1101 const char *name, struct device *device, 1102 void *buf, size_t size, size_t offset) 1103 { 1104 int ret; 1105 1106 if (fw_cache_is_setup(device, name)) 1107 return -EOPNOTSUPP; 1108 1109 __module_get(THIS_MODULE); 1110 ret = _request_firmware(firmware_p, name, device, buf, size, offset, 1111 FW_OPT_UEVENT | FW_OPT_NOCACHE | 1112 FW_OPT_PARTIAL); 1113 module_put(THIS_MODULE); 1114 return ret; 1115 } 1116 EXPORT_SYMBOL(request_partial_firmware_into_buf); 1117 1118 /** 1119 * release_firmware() - release the resource associated with a firmware image 1120 * @fw: firmware resource to release 1121 **/ 1122 void release_firmware(const struct firmware *fw) 1123 { 1124 if (fw) { 1125 if (!firmware_is_builtin(fw)) 1126 firmware_free_data(fw); 1127 kfree(fw); 1128 } 1129 } 1130 EXPORT_SYMBOL(release_firmware); 1131 1132 /* Async support */ 1133 struct firmware_work { 1134 struct work_struct work; 1135 struct list_head list; 1136 struct module *module; 1137 const char *name; 1138 struct device *device; 1139 void *context; 1140 void (*cont)(const struct firmware *fw, void *context); 1141 u32 opt_flags; 1142 }; 1143 1144 static LIST_HEAD(firmware_work_list); 1145 static DEFINE_SPINLOCK(firmware_work_lock); 1146 1147 static void firmware_work_free(struct firmware_work *fw_work) 1148 { 1149 put_device(fw_work->device); /* taken in request_firmware_nowait() */ 1150 module_put(fw_work->module); 1151 kfree_const(fw_work->name); 1152 kfree(fw_work); 1153 } 1154 1155 static void request_firmware_work_func(struct work_struct *work) 1156 { 1157 struct firmware_work *fw_work; 1158 const struct firmware *fw; 1159 1160 fw_work = container_of(work, struct firmware_work, work); 1161 1162 _request_firmware(&fw, fw_work->name, fw_work->device, NULL, 0, 0, 1163 fw_work->opt_flags); 1164 fw_work->cont(fw, fw_work->context); 1165 1166 spin_lock_irq(&firmware_work_lock); 1167 if (!list_empty(&fw_work->list)) { 1168 list_del_init(&fw_work->list); 1169 spin_unlock_irq(&firmware_work_lock); 1170 firmware_work_free(fw_work); 1171 return; 1172 } 1173 spin_unlock_irq(&firmware_work_lock); 1174 } 1175 1176 1177 static int _request_firmware_nowait( 1178 struct module *module, bool uevent, 1179 const char *name, struct device *device, gfp_t gfp, void *context, 1180 void (*cont)(const struct firmware *fw, void *context), bool nowarn) 1181 { 1182 struct firmware_work *fw_work; 1183 unsigned long flags; 1184 1185 fw_work = kzalloc_obj(struct firmware_work, gfp); 1186 if (!fw_work) 1187 return -ENOMEM; 1188 1189 fw_work->module = module; 1190 fw_work->name = kstrdup_const(name, gfp); 1191 if (!fw_work->name) { 1192 kfree(fw_work); 1193 return -ENOMEM; 1194 } 1195 fw_work->device = device; 1196 fw_work->context = context; 1197 fw_work->cont = cont; 1198 fw_work->opt_flags = FW_OPT_NOWAIT | 1199 (uevent ? FW_OPT_UEVENT : FW_OPT_USERHELPER) | 1200 (nowarn ? FW_OPT_NO_WARN : 0); 1201 1202 if (!uevent && fw_cache_is_setup(device, name)) { 1203 kfree_const(fw_work->name); 1204 kfree(fw_work); 1205 return -EOPNOTSUPP; 1206 } 1207 1208 if (!try_module_get(module)) { 1209 kfree_const(fw_work->name); 1210 kfree(fw_work); 1211 return -EFAULT; 1212 } 1213 1214 get_device(fw_work->device); 1215 INIT_WORK(&fw_work->work, request_firmware_work_func); 1216 1217 spin_lock_irqsave(&firmware_work_lock, flags); 1218 list_add_tail(&fw_work->list, &firmware_work_list); 1219 schedule_work(&fw_work->work); 1220 spin_unlock_irqrestore(&firmware_work_lock, flags); 1221 1222 return 0; 1223 } 1224 1225 /** 1226 * request_firmware_nowait() - asynchronous version of request_firmware 1227 * @module: module requesting the firmware 1228 * @uevent: sends uevent to copy the firmware image if this flag 1229 * is non-zero else the firmware copy must be done manually. 1230 * @name: name of firmware file 1231 * @device: device for which firmware is being loaded 1232 * @gfp: allocation flags 1233 * @context: will be passed over to @cont, and 1234 * @fw may be %NULL if firmware request fails. 1235 * @cont: function will be called asynchronously when the firmware 1236 * request is over. 1237 * 1238 * Caller must hold the reference count of @device. 1239 * 1240 * Asynchronous variant of request_firmware() for user contexts: 1241 * - sleep for as small periods as possible since it may 1242 * increase kernel boot time of built-in device drivers 1243 * requesting firmware in their ->probe() methods, if 1244 * @gfp is GFP_KERNEL. 1245 * 1246 * - can't sleep at all if @gfp is GFP_ATOMIC. 1247 **/ 1248 int request_firmware_nowait( 1249 struct module *module, bool uevent, 1250 const char *name, struct device *device, gfp_t gfp, void *context, 1251 void (*cont)(const struct firmware *fw, void *context)) 1252 { 1253 return _request_firmware_nowait(module, uevent, name, device, gfp, 1254 context, cont, false); 1255 1256 } 1257 EXPORT_SYMBOL(request_firmware_nowait); 1258 1259 /** 1260 * firmware_request_nowait_nowarn() - async version of request_firmware_nowarn 1261 * @module: module requesting the firmware 1262 * @name: name of firmware file 1263 * @device: device for which firmware is being loaded 1264 * @gfp: allocation flags 1265 * @context: will be passed over to @cont, and 1266 * @fw may be %NULL if firmware request fails. 1267 * @cont: function will be called asynchronously when the firmware 1268 * request is over. 1269 * 1270 * Similar in function to request_firmware_nowait(), but doesn't print a warning 1271 * when the firmware file could not be found and always sends a uevent to copy 1272 * the firmware image. 1273 */ 1274 int firmware_request_nowait_nowarn( 1275 struct module *module, const char *name, 1276 struct device *device, gfp_t gfp, void *context, 1277 void (*cont)(const struct firmware *fw, void *context)) 1278 { 1279 return _request_firmware_nowait(module, FW_ACTION_UEVENT, name, device, 1280 gfp, context, cont, true); 1281 } 1282 EXPORT_SYMBOL_GPL(firmware_request_nowait_nowarn); 1283 1284 /** 1285 * request_firmware_nowait_cancel() - cancel an async firmware request 1286 * @device: device for which the firmware is being loaded 1287 * @context: context passed to request_firmware_nowait() 1288 * @cont: callback passed to request_firmware_nowait() 1289 * 1290 * Cancel a pending request_firmware_nowait() request for @device, @context 1291 * and @cont. If the associated work has already started, this function waits 1292 * until the callback has returned. If the callback has already completed, this 1293 * function does nothing. 1294 * 1295 * This function may sleep. 1296 */ 1297 void request_firmware_nowait_cancel(struct device *device, void *context, 1298 void (*cont)(const struct firmware *fw, 1299 void *context)) 1300 { 1301 struct firmware_work *fw_work = NULL; 1302 struct firmware_work *tmp; 1303 1304 spin_lock_irq(&firmware_work_lock); 1305 list_for_each_entry_reverse(tmp, &firmware_work_list, list) { 1306 if (tmp->device == device && tmp->context == context && 1307 tmp->cont == cont) { 1308 fw_work = tmp; 1309 list_del_init(&fw_work->list); 1310 break; 1311 } 1312 } 1313 spin_unlock_irq(&firmware_work_lock); 1314 1315 if (!fw_work) 1316 return; 1317 cancel_work_sync(&fw_work->work); 1318 firmware_work_free(fw_work); 1319 } 1320 EXPORT_SYMBOL_GPL(request_firmware_nowait_cancel); 1321 1322 #ifdef CONFIG_FW_CACHE 1323 static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain); 1324 1325 /** 1326 * cache_firmware() - cache one firmware image in kernel memory space 1327 * @fw_name: the firmware image name 1328 * 1329 * Cache firmware in kernel memory so that drivers can use it when 1330 * system isn't ready for them to request firmware image from userspace. 1331 * Once it returns successfully, driver can use request_firmware or its 1332 * nowait version to get the cached firmware without any interacting 1333 * with userspace 1334 * 1335 * Return 0 if the firmware image has been cached successfully 1336 * Return !0 otherwise 1337 * 1338 */ 1339 static int cache_firmware(const char *fw_name) 1340 { 1341 int ret; 1342 const struct firmware *fw; 1343 1344 pr_debug("%s: %s\n", __func__, fw_name); 1345 1346 ret = request_firmware(&fw, fw_name, NULL); 1347 if (!ret) 1348 kfree(fw); 1349 1350 pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret); 1351 1352 return ret; 1353 } 1354 1355 static struct fw_priv *lookup_fw_priv(const char *fw_name) 1356 { 1357 struct fw_priv *tmp; 1358 struct firmware_cache *fwc = &fw_cache; 1359 1360 spin_lock(&fwc->lock); 1361 tmp = __lookup_fw_priv(fw_name); 1362 spin_unlock(&fwc->lock); 1363 1364 return tmp; 1365 } 1366 1367 /** 1368 * uncache_firmware() - remove one cached firmware image 1369 * @fw_name: the firmware image name 1370 * 1371 * Uncache one firmware image which has been cached successfully 1372 * before. 1373 * 1374 * Return 0 if the firmware cache has been removed successfully 1375 * Return !0 otherwise 1376 * 1377 */ 1378 static int uncache_firmware(const char *fw_name) 1379 { 1380 struct fw_priv *fw_priv; 1381 struct firmware fw; 1382 1383 pr_debug("%s: %s\n", __func__, fw_name); 1384 1385 if (firmware_request_builtin(&fw, fw_name)) 1386 return 0; 1387 1388 fw_priv = lookup_fw_priv(fw_name); 1389 if (fw_priv) { 1390 free_fw_priv(fw_priv); 1391 return 0; 1392 } 1393 1394 return -EINVAL; 1395 } 1396 1397 static struct fw_cache_entry *alloc_fw_cache_entry(const char *name) 1398 { 1399 struct fw_cache_entry *fce; 1400 1401 fce = kzalloc_obj(*fce, GFP_ATOMIC); 1402 if (!fce) 1403 goto exit; 1404 1405 fce->name = kstrdup_const(name, GFP_ATOMIC); 1406 if (!fce->name) { 1407 kfree(fce); 1408 fce = NULL; 1409 goto exit; 1410 } 1411 exit: 1412 return fce; 1413 } 1414 1415 static int __fw_entry_found(const char *name) 1416 { 1417 struct firmware_cache *fwc = &fw_cache; 1418 struct fw_cache_entry *fce; 1419 1420 list_for_each_entry(fce, &fwc->fw_names, list) { 1421 if (!strcmp(fce->name, name)) 1422 return 1; 1423 } 1424 return 0; 1425 } 1426 1427 static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv) 1428 { 1429 const char *name = fw_priv->fw_name; 1430 struct firmware_cache *fwc = fw_priv->fwc; 1431 struct fw_cache_entry *fce; 1432 1433 spin_lock(&fwc->name_lock); 1434 if (__fw_entry_found(name)) 1435 goto found; 1436 1437 fce = alloc_fw_cache_entry(name); 1438 if (fce) { 1439 list_add(&fce->list, &fwc->fw_names); 1440 kref_get(&fw_priv->ref); 1441 pr_debug("%s: fw: %s\n", __func__, name); 1442 } 1443 found: 1444 spin_unlock(&fwc->name_lock); 1445 } 1446 1447 static void free_fw_cache_entry(struct fw_cache_entry *fce) 1448 { 1449 kfree_const(fce->name); 1450 kfree(fce); 1451 } 1452 1453 static void __async_dev_cache_fw_image(void *fw_entry, 1454 async_cookie_t cookie) 1455 { 1456 struct fw_cache_entry *fce = fw_entry; 1457 struct firmware_cache *fwc = &fw_cache; 1458 int ret; 1459 1460 ret = cache_firmware(fce->name); 1461 if (ret) { 1462 spin_lock(&fwc->name_lock); 1463 list_del(&fce->list); 1464 spin_unlock(&fwc->name_lock); 1465 1466 free_fw_cache_entry(fce); 1467 } 1468 } 1469 1470 /* called with dev->devres_lock held */ 1471 static void dev_create_fw_entry(struct device *dev, void *res, 1472 void *data) 1473 { 1474 struct fw_name_devm *fwn = res; 1475 const char *fw_name = fwn->name; 1476 struct list_head *head = data; 1477 struct fw_cache_entry *fce; 1478 1479 fce = alloc_fw_cache_entry(fw_name); 1480 if (fce) 1481 list_add(&fce->list, head); 1482 } 1483 1484 static int devm_name_match(struct device *dev, void *res, 1485 void *match_data) 1486 { 1487 struct fw_name_devm *fwn = res; 1488 return (fwn->magic == (unsigned long)match_data); 1489 } 1490 1491 static void dev_cache_fw_image(struct device *dev, void *data) 1492 { 1493 LIST_HEAD(todo); 1494 struct fw_cache_entry *fce; 1495 struct fw_cache_entry *fce_next; 1496 struct firmware_cache *fwc = &fw_cache; 1497 1498 devres_for_each_res(dev, fw_name_devm_release, 1499 devm_name_match, &fw_cache, 1500 dev_create_fw_entry, &todo); 1501 1502 list_for_each_entry_safe(fce, fce_next, &todo, list) { 1503 list_del(&fce->list); 1504 1505 spin_lock(&fwc->name_lock); 1506 /* only one cache entry for one firmware */ 1507 if (!__fw_entry_found(fce->name)) { 1508 list_add(&fce->list, &fwc->fw_names); 1509 } else { 1510 free_fw_cache_entry(fce); 1511 fce = NULL; 1512 } 1513 spin_unlock(&fwc->name_lock); 1514 1515 if (fce) 1516 async_schedule_domain(__async_dev_cache_fw_image, 1517 (void *)fce, 1518 &fw_cache_domain); 1519 } 1520 } 1521 1522 static void __device_uncache_fw_images(void) 1523 { 1524 struct firmware_cache *fwc = &fw_cache; 1525 struct fw_cache_entry *fce; 1526 1527 spin_lock(&fwc->name_lock); 1528 while (!list_empty(&fwc->fw_names)) { 1529 fce = list_entry(fwc->fw_names.next, 1530 struct fw_cache_entry, list); 1531 list_del(&fce->list); 1532 spin_unlock(&fwc->name_lock); 1533 1534 uncache_firmware(fce->name); 1535 free_fw_cache_entry(fce); 1536 1537 spin_lock(&fwc->name_lock); 1538 } 1539 spin_unlock(&fwc->name_lock); 1540 } 1541 1542 /** 1543 * device_cache_fw_images() - cache devices' firmware 1544 * 1545 * If one device called request_firmware or its nowait version 1546 * successfully before, the firmware names are recored into the 1547 * device's devres link list, so device_cache_fw_images can call 1548 * cache_firmware() to cache these firmwares for the device, 1549 * then the device driver can load its firmwares easily at 1550 * time when system is not ready to complete loading firmware. 1551 */ 1552 static void device_cache_fw_images(void) 1553 { 1554 struct firmware_cache *fwc = &fw_cache; 1555 DEFINE_WAIT(wait); 1556 1557 pr_debug("%s\n", __func__); 1558 1559 /* cancel uncache work */ 1560 cancel_delayed_work_sync(&fwc->work); 1561 1562 fw_fallback_set_cache_timeout(); 1563 1564 mutex_lock(&fw_lock); 1565 fwc->state = FW_LOADER_START_CACHE; 1566 mutex_unlock(&fw_lock); 1567 1568 dpm_for_each_dev(NULL, dev_cache_fw_image); 1569 1570 /* wait for completion of caching firmware for all devices */ 1571 async_synchronize_full_domain(&fw_cache_domain); 1572 1573 fw_fallback_set_default_timeout(); 1574 } 1575 1576 /** 1577 * device_uncache_fw_images() - uncache devices' firmware 1578 * 1579 * uncache all firmwares which have been cached successfully 1580 * by device_uncache_fw_images earlier 1581 */ 1582 static void device_uncache_fw_images(void) 1583 { 1584 pr_debug("%s\n", __func__); 1585 __device_uncache_fw_images(); 1586 } 1587 1588 static void device_uncache_fw_images_work(struct work_struct *work) 1589 { 1590 device_uncache_fw_images(); 1591 } 1592 1593 /** 1594 * device_uncache_fw_images_delay() - uncache devices firmwares 1595 * @delay: number of milliseconds to delay uncache device firmwares 1596 * 1597 * uncache all devices's firmwares which has been cached successfully 1598 * by device_cache_fw_images after @delay milliseconds. 1599 */ 1600 static void device_uncache_fw_images_delay(unsigned long delay) 1601 { 1602 queue_delayed_work(system_power_efficient_wq, &fw_cache.work, 1603 msecs_to_jiffies(delay)); 1604 } 1605 1606 static int fw_pm_notify(struct notifier_block *notify_block, 1607 unsigned long mode, void *unused) 1608 { 1609 switch (mode) { 1610 case PM_HIBERNATION_PREPARE: 1611 case PM_SUSPEND_PREPARE: 1612 case PM_RESTORE_PREPARE: 1613 /* 1614 * Here, kill pending fallback requests will only kill 1615 * non-uevent firmware request to avoid stalling suspend. 1616 */ 1617 kill_pending_fw_fallback_reqs(false); 1618 device_cache_fw_images(); 1619 break; 1620 1621 case PM_POST_SUSPEND: 1622 case PM_POST_HIBERNATION: 1623 case PM_POST_RESTORE: 1624 /* 1625 * In case that system sleep failed and syscore_suspend is 1626 * not called. 1627 */ 1628 mutex_lock(&fw_lock); 1629 fw_cache.state = FW_LOADER_NO_CACHE; 1630 mutex_unlock(&fw_lock); 1631 1632 device_uncache_fw_images_delay(10 * MSEC_PER_SEC); 1633 break; 1634 } 1635 1636 return 0; 1637 } 1638 1639 /* stop caching firmware once syscore_suspend is reached */ 1640 static int fw_suspend(void *data) 1641 { 1642 fw_cache.state = FW_LOADER_NO_CACHE; 1643 return 0; 1644 } 1645 1646 static const struct syscore_ops fw_syscore_ops = { 1647 .suspend = fw_suspend, 1648 }; 1649 1650 static struct syscore fw_syscore = { 1651 .ops = &fw_syscore_ops, 1652 }; 1653 1654 static int __init register_fw_pm_ops(void) 1655 { 1656 int ret; 1657 1658 spin_lock_init(&fw_cache.name_lock); 1659 INIT_LIST_HEAD(&fw_cache.fw_names); 1660 1661 INIT_DELAYED_WORK(&fw_cache.work, 1662 device_uncache_fw_images_work); 1663 1664 fw_cache.pm_notify.notifier_call = fw_pm_notify; 1665 ret = register_pm_notifier(&fw_cache.pm_notify); 1666 if (ret) 1667 return ret; 1668 1669 register_syscore(&fw_syscore); 1670 1671 return ret; 1672 } 1673 1674 static inline void unregister_fw_pm_ops(void) 1675 { 1676 unregister_syscore(&fw_syscore); 1677 unregister_pm_notifier(&fw_cache.pm_notify); 1678 } 1679 #else 1680 static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv) 1681 { 1682 } 1683 static inline int register_fw_pm_ops(void) 1684 { 1685 return 0; 1686 } 1687 static inline void unregister_fw_pm_ops(void) 1688 { 1689 } 1690 #endif 1691 1692 static void __init fw_cache_init(void) 1693 { 1694 spin_lock_init(&fw_cache.lock); 1695 INIT_LIST_HEAD(&fw_cache.head); 1696 fw_cache.state = FW_LOADER_NO_CACHE; 1697 } 1698 1699 static int fw_shutdown_notify(struct notifier_block *unused1, 1700 unsigned long unused2, void *unused3) 1701 { 1702 /* 1703 * Kill all pending fallback requests to avoid both stalling shutdown, 1704 * and avoid a deadlock with the usermode_lock. 1705 */ 1706 kill_pending_fw_fallback_reqs(true); 1707 1708 return NOTIFY_DONE; 1709 } 1710 1711 static struct notifier_block fw_shutdown_nb = { 1712 .notifier_call = fw_shutdown_notify, 1713 }; 1714 1715 static int __init firmware_class_init(void) 1716 { 1717 int ret; 1718 1719 /* No need to unfold these on exit */ 1720 fw_cache_init(); 1721 1722 ret = register_fw_pm_ops(); 1723 if (ret) 1724 return ret; 1725 1726 ret = register_reboot_notifier(&fw_shutdown_nb); 1727 if (ret) 1728 goto out; 1729 1730 return register_sysfs_loader(); 1731 1732 out: 1733 unregister_fw_pm_ops(); 1734 return ret; 1735 } 1736 1737 static void __exit firmware_class_exit(void) 1738 { 1739 unregister_fw_pm_ops(); 1740 unregister_reboot_notifier(&fw_shutdown_nb); 1741 unregister_sysfs_loader(); 1742 } 1743 1744 fs_initcall(firmware_class_init); 1745 module_exit(firmware_class_exit); 1746