firmware loader: fix one reqeust_firmware race
[platform/adaptation/renesas_rcar/renesas_kernel.git] / drivers / base / firmware_class.c
1 /*
2  * firmware_class.c - Multi purpose firmware loading support
3  *
4  * Copyright (c) 2003 Manuel Estrada Sainz
5  *
6  * Please see Documentation/firmware_class/ for more information.
7  *
8  */
9
10 #include <linux/capability.h>
11 #include <linux/device.h>
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/timer.h>
15 #include <linux/vmalloc.h>
16 #include <linux/interrupt.h>
17 #include <linux/bitops.h>
18 #include <linux/mutex.h>
19 #include <linux/workqueue.h>
20 #include <linux/highmem.h>
21 #include <linux/firmware.h>
22 #include <linux/slab.h>
23 #include <linux/sched.h>
24 #include <linux/file.h>
25 #include <linux/list.h>
26 #include <linux/async.h>
27 #include <linux/pm.h>
28 #include <linux/suspend.h>
29 #include <linux/syscore_ops.h>
30
31 #include <generated/utsrelease.h>
32
33 #include "base.h"
34
35 MODULE_AUTHOR("Manuel Estrada Sainz");
36 MODULE_DESCRIPTION("Multi purpose firmware loading support");
37 MODULE_LICENSE("GPL");
38
39 static const char *fw_path[] = {
40         "/lib/firmware/updates/" UTS_RELEASE,
41         "/lib/firmware/updates",
42         "/lib/firmware/" UTS_RELEASE,
43         "/lib/firmware"
44 };
45
46 /* Don't inline this: 'struct kstat' is biggish */
47 static noinline long fw_file_size(struct file *file)
48 {
49         struct kstat st;
50         if (vfs_getattr(file->f_path.mnt, file->f_path.dentry, &st))
51                 return -1;
52         if (!S_ISREG(st.mode))
53                 return -1;
54         if (st.size != (long)st.size)
55                 return -1;
56         return st.size;
57 }
58
59 static bool fw_read_file_contents(struct file *file, struct firmware *fw)
60 {
61         long size;
62         char *buf;
63
64         size = fw_file_size(file);
65         if (size < 0)
66                 return false;
67         buf = vmalloc(size);
68         if (!buf)
69                 return false;
70         if (kernel_read(file, 0, buf, size) != size) {
71                 vfree(buf);
72                 return false;
73         }
74         fw->data = buf;
75         fw->size = size;
76         return true;
77 }
78
79 static bool fw_get_filesystem_firmware(struct firmware *fw, const char *name)
80 {
81         int i;
82         bool success = false;
83         char *path = __getname();
84
85         for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
86                 struct file *file;
87                 snprintf(path, PATH_MAX, "%s/%s", fw_path[i], name);
88
89                 file = filp_open(path, O_RDONLY, 0);
90                 if (IS_ERR(file))
91                         continue;
92                 success = fw_read_file_contents(file, fw);
93                 fput(file);
94                 if (success)
95                         break;
96         }
97         __putname(path);
98         return success;
99 }
100
101 /* Builtin firmware support */
102
103 #ifdef CONFIG_FW_LOADER
104
105 extern struct builtin_fw __start_builtin_fw[];
106 extern struct builtin_fw __end_builtin_fw[];
107
108 static bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
109 {
110         struct builtin_fw *b_fw;
111
112         for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++) {
113                 if (strcmp(name, b_fw->name) == 0) {
114                         fw->size = b_fw->size;
115                         fw->data = b_fw->data;
116                         return true;
117                 }
118         }
119
120         return false;
121 }
122
123 static bool fw_is_builtin_firmware(const struct firmware *fw)
124 {
125         struct builtin_fw *b_fw;
126
127         for (b_fw = __start_builtin_fw; b_fw != __end_builtin_fw; b_fw++)
128                 if (fw->data == b_fw->data)
129                         return true;
130
131         return false;
132 }
133
134 #else /* Module case - no builtin firmware support */
135
136 static inline bool fw_get_builtin_firmware(struct firmware *fw, const char *name)
137 {
138         return false;
139 }
140
141 static inline bool fw_is_builtin_firmware(const struct firmware *fw)
142 {
143         return false;
144 }
145 #endif
146
147 enum {
148         FW_STATUS_LOADING,
149         FW_STATUS_DONE,
150         FW_STATUS_ABORT,
151 };
152
153 static int loading_timeout = 60;        /* In seconds */
154
155 static inline long firmware_loading_timeout(void)
156 {
157         return loading_timeout > 0 ? loading_timeout * HZ : MAX_SCHEDULE_TIMEOUT;
158 }
159
160 struct firmware_cache {
161         /* firmware_buf instance will be added into the below list */
162         spinlock_t lock;
163         struct list_head head;
164         int state;
165
166 #ifdef CONFIG_PM_SLEEP
167         /*
168          * Names of firmware images which have been cached successfully
169          * will be added into the below list so that device uncache
170          * helper can trace which firmware images have been cached
171          * before.
172          */
173         spinlock_t name_lock;
174         struct list_head fw_names;
175
176         wait_queue_head_t wait_queue;
177         int cnt;
178         struct delayed_work work;
179
180         struct notifier_block   pm_notify;
181 #endif
182 };
183
184 struct firmware_buf {
185         struct kref ref;
186         struct list_head list;
187         struct completion completion;
188         struct firmware_cache *fwc;
189         unsigned long status;
190         void *data;
191         size_t size;
192         struct page **pages;
193         int nr_pages;
194         int page_array_size;
195         char fw_id[];
196 };
197
198 struct fw_cache_entry {
199         struct list_head list;
200         char name[];
201 };
202
203 struct firmware_priv {
204         struct timer_list timeout;
205         bool nowait;
206         struct device dev;
207         struct firmware_buf *buf;
208         struct firmware *fw;
209 };
210
211 struct fw_name_devm {
212         unsigned long magic;
213         char name[];
214 };
215
216 #define to_fwbuf(d) container_of(d, struct firmware_buf, ref)
217
218 #define FW_LOADER_NO_CACHE      0
219 #define FW_LOADER_START_CACHE   1
220
221 static int fw_cache_piggyback_on_request(const char *name);
222
223 /* fw_lock could be moved to 'struct firmware_priv' but since it is just
224  * guarding for corner cases a global lock should be OK */
225 static DEFINE_MUTEX(fw_lock);
226
227 static struct firmware_cache fw_cache;
228
229 static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
230                                               struct firmware_cache *fwc)
231 {
232         struct firmware_buf *buf;
233
234         buf = kzalloc(sizeof(*buf) + strlen(fw_name) + 1 , GFP_ATOMIC);
235
236         if (!buf)
237                 return buf;
238
239         kref_init(&buf->ref);
240         strcpy(buf->fw_id, fw_name);
241         buf->fwc = fwc;
242         init_completion(&buf->completion);
243
244         pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
245
246         return buf;
247 }
248
249 static struct firmware_buf *__fw_lookup_buf(const char *fw_name)
250 {
251         struct firmware_buf *tmp;
252         struct firmware_cache *fwc = &fw_cache;
253
254         list_for_each_entry(tmp, &fwc->head, list)
255                 if (!strcmp(tmp->fw_id, fw_name))
256                         return tmp;
257         return NULL;
258 }
259
260 static int fw_lookup_and_allocate_buf(const char *fw_name,
261                                       struct firmware_cache *fwc,
262                                       struct firmware_buf **buf)
263 {
264         struct firmware_buf *tmp;
265
266         spin_lock(&fwc->lock);
267         tmp = __fw_lookup_buf(fw_name);
268         if (tmp) {
269                 kref_get(&tmp->ref);
270                 spin_unlock(&fwc->lock);
271                 *buf = tmp;
272                 return 1;
273         }
274         tmp = __allocate_fw_buf(fw_name, fwc);
275         if (tmp)
276                 list_add(&tmp->list, &fwc->head);
277         spin_unlock(&fwc->lock);
278
279         *buf = tmp;
280
281         return tmp ? 0 : -ENOMEM;
282 }
283
284 static struct firmware_buf *fw_lookup_buf(const char *fw_name)
285 {
286         struct firmware_buf *tmp;
287         struct firmware_cache *fwc = &fw_cache;
288
289         spin_lock(&fwc->lock);
290         tmp = __fw_lookup_buf(fw_name);
291         spin_unlock(&fwc->lock);
292
293         return tmp;
294 }
295
296 static void __fw_free_buf(struct kref *ref)
297 {
298         struct firmware_buf *buf = to_fwbuf(ref);
299         struct firmware_cache *fwc = buf->fwc;
300         int i;
301
302         pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
303                  __func__, buf->fw_id, buf, buf->data,
304                  (unsigned int)buf->size);
305
306         spin_lock(&fwc->lock);
307         list_del(&buf->list);
308         spin_unlock(&fwc->lock);
309
310         vunmap(buf->data);
311         for (i = 0; i < buf->nr_pages; i++)
312                 __free_page(buf->pages[i]);
313         kfree(buf->pages);
314         kfree(buf);
315 }
316
317 static void fw_free_buf(struct firmware_buf *buf)
318 {
319         kref_put(&buf->ref, __fw_free_buf);
320 }
321
322 static struct firmware_priv *to_firmware_priv(struct device *dev)
323 {
324         return container_of(dev, struct firmware_priv, dev);
325 }
326
327 static void fw_load_abort(struct firmware_priv *fw_priv)
328 {
329         struct firmware_buf *buf = fw_priv->buf;
330
331         set_bit(FW_STATUS_ABORT, &buf->status);
332         complete_all(&buf->completion);
333 }
334
335 static ssize_t firmware_timeout_show(struct class *class,
336                                      struct class_attribute *attr,
337                                      char *buf)
338 {
339         return sprintf(buf, "%d\n", loading_timeout);
340 }
341
342 /**
343  * firmware_timeout_store - set number of seconds to wait for firmware
344  * @class: device class pointer
345  * @attr: device attribute pointer
346  * @buf: buffer to scan for timeout value
347  * @count: number of bytes in @buf
348  *
349  *      Sets the number of seconds to wait for the firmware.  Once
350  *      this expires an error will be returned to the driver and no
351  *      firmware will be provided.
352  *
353  *      Note: zero means 'wait forever'.
354  **/
355 static ssize_t firmware_timeout_store(struct class *class,
356                                       struct class_attribute *attr,
357                                       const char *buf, size_t count)
358 {
359         loading_timeout = simple_strtol(buf, NULL, 10);
360         if (loading_timeout < 0)
361                 loading_timeout = 0;
362
363         return count;
364 }
365
366 static struct class_attribute firmware_class_attrs[] = {
367         __ATTR(timeout, S_IWUSR | S_IRUGO,
368                 firmware_timeout_show, firmware_timeout_store),
369         __ATTR_NULL
370 };
371
372 static void fw_dev_release(struct device *dev)
373 {
374         struct firmware_priv *fw_priv = to_firmware_priv(dev);
375
376         kfree(fw_priv);
377
378         module_put(THIS_MODULE);
379 }
380
381 static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
382 {
383         struct firmware_priv *fw_priv = to_firmware_priv(dev);
384
385         if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
386                 return -ENOMEM;
387         if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
388                 return -ENOMEM;
389         if (add_uevent_var(env, "ASYNC=%d", fw_priv->nowait))
390                 return -ENOMEM;
391
392         return 0;
393 }
394
395 static struct class firmware_class = {
396         .name           = "firmware",
397         .class_attrs    = firmware_class_attrs,
398         .dev_uevent     = firmware_uevent,
399         .dev_release    = fw_dev_release,
400 };
401
402 static ssize_t firmware_loading_show(struct device *dev,
403                                      struct device_attribute *attr, char *buf)
404 {
405         struct firmware_priv *fw_priv = to_firmware_priv(dev);
406         int loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
407
408         return sprintf(buf, "%d\n", loading);
409 }
410
411 /* firmware holds the ownership of pages */
412 static void firmware_free_data(const struct firmware *fw)
413 {
414         /* Loaded directly? */
415         if (!fw->priv) {
416                 vfree(fw->data);
417                 return;
418         }
419         fw_free_buf(fw->priv);
420 }
421
422 /* Some architectures don't have PAGE_KERNEL_RO */
423 #ifndef PAGE_KERNEL_RO
424 #define PAGE_KERNEL_RO PAGE_KERNEL
425 #endif
426
427 /* one pages buffer should be mapped/unmapped only once */
428 static int fw_map_pages_buf(struct firmware_buf *buf)
429 {
430         if (buf->data)
431                 vunmap(buf->data);
432         buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
433         if (!buf->data)
434                 return -ENOMEM;
435         return 0;
436 }
437
438 /**
439  * firmware_loading_store - set value in the 'loading' control file
440  * @dev: device pointer
441  * @attr: device attribute pointer
442  * @buf: buffer to scan for loading control value
443  * @count: number of bytes in @buf
444  *
445  *      The relevant values are:
446  *
447  *       1: Start a load, discarding any previous partial load.
448  *       0: Conclude the load and hand the data to the driver code.
449  *      -1: Conclude the load with an error and discard any written data.
450  **/
451 static ssize_t firmware_loading_store(struct device *dev,
452                                       struct device_attribute *attr,
453                                       const char *buf, size_t count)
454 {
455         struct firmware_priv *fw_priv = to_firmware_priv(dev);
456         struct firmware_buf *fw_buf = fw_priv->buf;
457         int loading = simple_strtol(buf, NULL, 10);
458         int i;
459
460         mutex_lock(&fw_lock);
461
462         if (!fw_buf)
463                 goto out;
464
465         switch (loading) {
466         case 1:
467                 /* discarding any previous partial load */
468                 if (!test_bit(FW_STATUS_DONE, &fw_buf->status)) {
469                         for (i = 0; i < fw_buf->nr_pages; i++)
470                                 __free_page(fw_buf->pages[i]);
471                         kfree(fw_buf->pages);
472                         fw_buf->pages = NULL;
473                         fw_buf->page_array_size = 0;
474                         fw_buf->nr_pages = 0;
475                         set_bit(FW_STATUS_LOADING, &fw_buf->status);
476                 }
477                 break;
478         case 0:
479                 if (test_bit(FW_STATUS_LOADING, &fw_buf->status)) {
480                         set_bit(FW_STATUS_DONE, &fw_buf->status);
481                         clear_bit(FW_STATUS_LOADING, &fw_buf->status);
482
483                         /*
484                          * Several loading requests may be pending on
485                          * one same firmware buf, so let all requests
486                          * see the mapped 'buf->data' once the loading
487                          * is completed.
488                          * */
489                         fw_map_pages_buf(fw_buf);
490                         complete_all(&fw_buf->completion);
491                         break;
492                 }
493                 /* fallthrough */
494         default:
495                 dev_err(dev, "%s: unexpected value (%d)\n", __func__, loading);
496                 /* fallthrough */
497         case -1:
498                 fw_load_abort(fw_priv);
499                 break;
500         }
501 out:
502         mutex_unlock(&fw_lock);
503         return count;
504 }
505
506 static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
507
508 static ssize_t firmware_data_read(struct file *filp, struct kobject *kobj,
509                                   struct bin_attribute *bin_attr,
510                                   char *buffer, loff_t offset, size_t count)
511 {
512         struct device *dev = kobj_to_dev(kobj);
513         struct firmware_priv *fw_priv = to_firmware_priv(dev);
514         struct firmware_buf *buf;
515         ssize_t ret_count;
516
517         mutex_lock(&fw_lock);
518         buf = fw_priv->buf;
519         if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
520                 ret_count = -ENODEV;
521                 goto out;
522         }
523         if (offset > buf->size) {
524                 ret_count = 0;
525                 goto out;
526         }
527         if (count > buf->size - offset)
528                 count = buf->size - offset;
529
530         ret_count = count;
531
532         while (count) {
533                 void *page_data;
534                 int page_nr = offset >> PAGE_SHIFT;
535                 int page_ofs = offset & (PAGE_SIZE-1);
536                 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
537
538                 page_data = kmap(buf->pages[page_nr]);
539
540                 memcpy(buffer, page_data + page_ofs, page_cnt);
541
542                 kunmap(buf->pages[page_nr]);
543                 buffer += page_cnt;
544                 offset += page_cnt;
545                 count -= page_cnt;
546         }
547 out:
548         mutex_unlock(&fw_lock);
549         return ret_count;
550 }
551
552 static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
553 {
554         struct firmware_buf *buf = fw_priv->buf;
555         int pages_needed = ALIGN(min_size, PAGE_SIZE) >> PAGE_SHIFT;
556
557         /* If the array of pages is too small, grow it... */
558         if (buf->page_array_size < pages_needed) {
559                 int new_array_size = max(pages_needed,
560                                          buf->page_array_size * 2);
561                 struct page **new_pages;
562
563                 new_pages = kmalloc(new_array_size * sizeof(void *),
564                                     GFP_KERNEL);
565                 if (!new_pages) {
566                         fw_load_abort(fw_priv);
567                         return -ENOMEM;
568                 }
569                 memcpy(new_pages, buf->pages,
570                        buf->page_array_size * sizeof(void *));
571                 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
572                        (new_array_size - buf->page_array_size));
573                 kfree(buf->pages);
574                 buf->pages = new_pages;
575                 buf->page_array_size = new_array_size;
576         }
577
578         while (buf->nr_pages < pages_needed) {
579                 buf->pages[buf->nr_pages] =
580                         alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
581
582                 if (!buf->pages[buf->nr_pages]) {
583                         fw_load_abort(fw_priv);
584                         return -ENOMEM;
585                 }
586                 buf->nr_pages++;
587         }
588         return 0;
589 }
590
591 /**
592  * firmware_data_write - write method for firmware
593  * @filp: open sysfs file
594  * @kobj: kobject for the device
595  * @bin_attr: bin_attr structure
596  * @buffer: buffer being written
597  * @offset: buffer offset for write in total data store area
598  * @count: buffer size
599  *
600  *      Data written to the 'data' attribute will be later handed to
601  *      the driver as a firmware image.
602  **/
603 static ssize_t firmware_data_write(struct file *filp, struct kobject *kobj,
604                                    struct bin_attribute *bin_attr,
605                                    char *buffer, loff_t offset, size_t count)
606 {
607         struct device *dev = kobj_to_dev(kobj);
608         struct firmware_priv *fw_priv = to_firmware_priv(dev);
609         struct firmware_buf *buf;
610         ssize_t retval;
611
612         if (!capable(CAP_SYS_RAWIO))
613                 return -EPERM;
614
615         mutex_lock(&fw_lock);
616         buf = fw_priv->buf;
617         if (!buf || test_bit(FW_STATUS_DONE, &buf->status)) {
618                 retval = -ENODEV;
619                 goto out;
620         }
621
622         retval = fw_realloc_buffer(fw_priv, offset + count);
623         if (retval)
624                 goto out;
625
626         retval = count;
627
628         while (count) {
629                 void *page_data;
630                 int page_nr = offset >> PAGE_SHIFT;
631                 int page_ofs = offset & (PAGE_SIZE - 1);
632                 int page_cnt = min_t(size_t, PAGE_SIZE - page_ofs, count);
633
634                 page_data = kmap(buf->pages[page_nr]);
635
636                 memcpy(page_data + page_ofs, buffer, page_cnt);
637
638                 kunmap(buf->pages[page_nr]);
639                 buffer += page_cnt;
640                 offset += page_cnt;
641                 count -= page_cnt;
642         }
643
644         buf->size = max_t(size_t, offset, buf->size);
645 out:
646         mutex_unlock(&fw_lock);
647         return retval;
648 }
649
650 static struct bin_attribute firmware_attr_data = {
651         .attr = { .name = "data", .mode = 0644 },
652         .size = 0,
653         .read = firmware_data_read,
654         .write = firmware_data_write,
655 };
656
657 static void firmware_class_timeout(u_long data)
658 {
659         struct firmware_priv *fw_priv = (struct firmware_priv *) data;
660
661         fw_load_abort(fw_priv);
662 }
663
664 static struct firmware_priv *
665 fw_create_instance(struct firmware *firmware, const char *fw_name,
666                    struct device *device, bool uevent, bool nowait)
667 {
668         struct firmware_priv *fw_priv;
669         struct device *f_dev;
670
671         fw_priv = kzalloc(sizeof(*fw_priv), GFP_KERNEL);
672         if (!fw_priv) {
673                 dev_err(device, "%s: kmalloc failed\n", __func__);
674                 fw_priv = ERR_PTR(-ENOMEM);
675                 goto exit;
676         }
677
678         fw_priv->nowait = nowait;
679         fw_priv->fw = firmware;
680         setup_timer(&fw_priv->timeout,
681                     firmware_class_timeout, (u_long) fw_priv);
682
683         f_dev = &fw_priv->dev;
684
685         device_initialize(f_dev);
686         dev_set_name(f_dev, "%s", fw_name);
687         f_dev->parent = device;
688         f_dev->class = &firmware_class;
689 exit:
690         return fw_priv;
691 }
692
693 /* store the pages buffer info firmware from buf */
694 static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
695 {
696         fw->priv = buf;
697         fw->pages = buf->pages;
698         fw->size = buf->size;
699         fw->data = buf->data;
700
701         pr_debug("%s: fw-%s buf=%p data=%p size=%u\n",
702                  __func__, buf->fw_id, buf, buf->data,
703                  (unsigned int)buf->size);
704 }
705
706 #ifdef CONFIG_PM_SLEEP
707 static void fw_name_devm_release(struct device *dev, void *res)
708 {
709         struct fw_name_devm *fwn = res;
710
711         if (fwn->magic == (unsigned long)&fw_cache)
712                 pr_debug("%s: fw_name-%s devm-%p released\n",
713                                 __func__, fwn->name, res);
714 }
715
716 static int fw_devm_match(struct device *dev, void *res,
717                 void *match_data)
718 {
719         struct fw_name_devm *fwn = res;
720
721         return (fwn->magic == (unsigned long)&fw_cache) &&
722                 !strcmp(fwn->name, match_data);
723 }
724
725 static struct fw_name_devm *fw_find_devm_name(struct device *dev,
726                 const char *name)
727 {
728         struct fw_name_devm *fwn;
729
730         fwn = devres_find(dev, fw_name_devm_release,
731                           fw_devm_match, (void *)name);
732         return fwn;
733 }
734
735 /* add firmware name into devres list */
736 static int fw_add_devm_name(struct device *dev, const char *name)
737 {
738         struct fw_name_devm *fwn;
739
740         fwn = fw_find_devm_name(dev, name);
741         if (fwn)
742                 return 1;
743
744         fwn = devres_alloc(fw_name_devm_release, sizeof(struct fw_name_devm) +
745                            strlen(name) + 1, GFP_KERNEL);
746         if (!fwn)
747                 return -ENOMEM;
748
749         fwn->magic = (unsigned long)&fw_cache;
750         strcpy(fwn->name, name);
751         devres_add(dev, fwn);
752
753         return 0;
754 }
755 #else
756 static int fw_add_devm_name(struct device *dev, const char *name)
757 {
758         return 0;
759 }
760 #endif
761
762 static void _request_firmware_cleanup(const struct firmware **firmware_p)
763 {
764         release_firmware(*firmware_p);
765         *firmware_p = NULL;
766 }
767
768 static struct firmware_priv *
769 _request_firmware_prepare(const struct firmware **firmware_p, const char *name,
770                           struct device *device, bool uevent, bool nowait)
771 {
772         struct firmware *firmware;
773         struct firmware_priv *fw_priv = NULL;
774         struct firmware_buf *buf;
775         int ret;
776
777         if (!firmware_p)
778                 return ERR_PTR(-EINVAL);
779
780         *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
781         if (!firmware) {
782                 dev_err(device, "%s: kmalloc(struct firmware) failed\n",
783                         __func__);
784                 return ERR_PTR(-ENOMEM);
785         }
786
787         if (fw_get_builtin_firmware(firmware, name)) {
788                 dev_dbg(device, "firmware: using built-in firmware %s\n", name);
789                 return NULL;
790         }
791
792         if (fw_get_filesystem_firmware(firmware, name)) {
793                 dev_dbg(device, "firmware: direct-loading firmware %s\n", name);
794                 return NULL;
795         }
796
797         ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf);
798         if (!ret)
799                 fw_priv = fw_create_instance(firmware, name, device,
800                                 uevent, nowait);
801
802         if (IS_ERR(fw_priv) || ret < 0) {
803                 kfree(firmware);
804                 *firmware_p = NULL;
805                 return ERR_PTR(-ENOMEM);
806         } else if (fw_priv) {
807                 fw_priv->buf = buf;
808
809                 /*
810                  * bind with 'buf' now to avoid warning in failure path
811                  * of requesting firmware.
812                  */
813                 firmware->priv = buf;
814                 return fw_priv;
815         }
816
817         /* share the cached buf, which is inprogessing or completed */
818  check_status:
819         mutex_lock(&fw_lock);
820         if (test_bit(FW_STATUS_ABORT, &buf->status)) {
821                 fw_priv = ERR_PTR(-ENOENT);
822                 firmware->priv = buf;
823                 _request_firmware_cleanup(firmware_p);
824                 goto exit;
825         } else if (test_bit(FW_STATUS_DONE, &buf->status)) {
826                 fw_priv = NULL;
827                 fw_set_page_data(buf, firmware);
828                 goto exit;
829         }
830         mutex_unlock(&fw_lock);
831         wait_for_completion(&buf->completion);
832         goto check_status;
833
834 exit:
835         mutex_unlock(&fw_lock);
836         return fw_priv;
837 }
838
839 static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
840                                   long timeout)
841 {
842         int retval = 0;
843         struct device *f_dev = &fw_priv->dev;
844         struct firmware_buf *buf = fw_priv->buf;
845         struct firmware_cache *fwc = &fw_cache;
846
847         dev_set_uevent_suppress(f_dev, true);
848
849         /* Need to pin this module until class device is destroyed */
850         __module_get(THIS_MODULE);
851
852         retval = device_add(f_dev);
853         if (retval) {
854                 dev_err(f_dev, "%s: device_register failed\n", __func__);
855                 goto err_put_dev;
856         }
857
858         retval = device_create_bin_file(f_dev, &firmware_attr_data);
859         if (retval) {
860                 dev_err(f_dev, "%s: sysfs_create_bin_file failed\n", __func__);
861                 goto err_del_dev;
862         }
863
864         retval = device_create_file(f_dev, &dev_attr_loading);
865         if (retval) {
866                 dev_err(f_dev, "%s: device_create_file failed\n", __func__);
867                 goto err_del_bin_attr;
868         }
869
870         if (uevent) {
871                 dev_set_uevent_suppress(f_dev, false);
872                 dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);
873                 if (timeout != MAX_SCHEDULE_TIMEOUT)
874                         mod_timer(&fw_priv->timeout,
875                                   round_jiffies_up(jiffies + timeout));
876
877                 kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);
878         }
879
880         wait_for_completion(&buf->completion);
881
882         del_timer_sync(&fw_priv->timeout);
883
884         mutex_lock(&fw_lock);
885         if (!buf->size || test_bit(FW_STATUS_ABORT, &buf->status))
886                 retval = -ENOENT;
887
888         /*
889          * add firmware name into devres list so that we can auto cache
890          * and uncache firmware for device.
891          *
892          * f_dev->parent may has been deleted already, but the problem
893          * should be fixed in devres or driver core.
894          */
895         if (!retval && f_dev->parent)
896                 fw_add_devm_name(f_dev->parent, buf->fw_id);
897
898         /*
899          * After caching firmware image is started, let it piggyback
900          * on request firmware.
901          */
902         if (!retval && fwc->state == FW_LOADER_START_CACHE) {
903                 if (fw_cache_piggyback_on_request(buf->fw_id))
904                         kref_get(&buf->ref);
905         }
906
907         /* pass the pages buffer to driver at the last minute */
908         fw_set_page_data(buf, fw_priv->fw);
909
910         fw_priv->buf = NULL;
911         mutex_unlock(&fw_lock);
912
913         device_remove_file(f_dev, &dev_attr_loading);
914 err_del_bin_attr:
915         device_remove_bin_file(f_dev, &firmware_attr_data);
916 err_del_dev:
917         device_del(f_dev);
918 err_put_dev:
919         put_device(f_dev);
920         return retval;
921 }
922
923 /**
924  * request_firmware: - send firmware request and wait for it
925  * @firmware_p: pointer to firmware image
926  * @name: name of firmware file
927  * @device: device for which firmware is being loaded
928  *
929  *      @firmware_p will be used to return a firmware image by the name
930  *      of @name for device @device.
931  *
932  *      Should be called from user context where sleeping is allowed.
933  *
934  *      @name will be used as $FIRMWARE in the uevent environment and
935  *      should be distinctive enough not to be confused with any other
936  *      firmware image for this or any other device.
937  *
938  *      Caller must hold the reference count of @device.
939  **/
940 int
941 request_firmware(const struct firmware **firmware_p, const char *name,
942                  struct device *device)
943 {
944         struct firmware_priv *fw_priv;
945         int ret;
946
947         fw_priv = _request_firmware_prepare(firmware_p, name, device, true,
948                                             false);
949         if (IS_ERR_OR_NULL(fw_priv))
950                 return PTR_RET(fw_priv);
951
952         ret = usermodehelper_read_trylock();
953         if (WARN_ON(ret)) {
954                 dev_err(device, "firmware: %s will not be loaded\n", name);
955         } else {
956                 ret = _request_firmware_load(fw_priv, true,
957                                         firmware_loading_timeout());
958                 usermodehelper_read_unlock();
959         }
960         if (ret)
961                 _request_firmware_cleanup(firmware_p);
962
963         return ret;
964 }
965
966 /**
967  * release_firmware: - release the resource associated with a firmware image
968  * @fw: firmware resource to release
969  **/
970 void release_firmware(const struct firmware *fw)
971 {
972         if (fw) {
973                 if (!fw_is_builtin_firmware(fw))
974                         firmware_free_data(fw);
975                 kfree(fw);
976         }
977 }
978
979 /* Async support */
980 struct firmware_work {
981         struct work_struct work;
982         struct module *module;
983         const char *name;
984         struct device *device;
985         void *context;
986         void (*cont)(const struct firmware *fw, void *context);
987         bool uevent;
988 };
989
990 static void request_firmware_work_func(struct work_struct *work)
991 {
992         struct firmware_work *fw_work;
993         const struct firmware *fw;
994         struct firmware_priv *fw_priv;
995         long timeout;
996         int ret;
997
998         fw_work = container_of(work, struct firmware_work, work);
999         fw_priv = _request_firmware_prepare(&fw, fw_work->name, fw_work->device,
1000                         fw_work->uevent, true);
1001         if (IS_ERR_OR_NULL(fw_priv)) {
1002                 ret = PTR_RET(fw_priv);
1003                 goto out;
1004         }
1005
1006         timeout = usermodehelper_read_lock_wait(firmware_loading_timeout());
1007         if (timeout) {
1008                 ret = _request_firmware_load(fw_priv, fw_work->uevent, timeout);
1009                 usermodehelper_read_unlock();
1010         } else {
1011                 dev_dbg(fw_work->device, "firmware: %s loading timed out\n",
1012                         fw_work->name);
1013                 ret = -EAGAIN;
1014         }
1015         if (ret)
1016                 _request_firmware_cleanup(&fw);
1017
1018  out:
1019         fw_work->cont(fw, fw_work->context);
1020         put_device(fw_work->device);
1021
1022         module_put(fw_work->module);
1023         kfree(fw_work);
1024 }
1025
1026 /**
1027  * request_firmware_nowait - asynchronous version of request_firmware
1028  * @module: module requesting the firmware
1029  * @uevent: sends uevent to copy the firmware image if this flag
1030  *      is non-zero else the firmware copy must be done manually.
1031  * @name: name of firmware file
1032  * @device: device for which firmware is being loaded
1033  * @gfp: allocation flags
1034  * @context: will be passed over to @cont, and
1035  *      @fw may be %NULL if firmware request fails.
1036  * @cont: function will be called asynchronously when the firmware
1037  *      request is over.
1038  *
1039  *      Caller must hold the reference count of @device.
1040  *
1041  *      Asynchronous variant of request_firmware() for user contexts:
1042  *              - sleep for as small periods as possible since it may
1043  *              increase kernel boot time of built-in device drivers
1044  *              requesting firmware in their ->probe() methods, if
1045  *              @gfp is GFP_KERNEL.
1046  *
1047  *              - can't sleep at all if @gfp is GFP_ATOMIC.
1048  **/
1049 int
1050 request_firmware_nowait(
1051         struct module *module, bool uevent,
1052         const char *name, struct device *device, gfp_t gfp, void *context,
1053         void (*cont)(const struct firmware *fw, void *context))
1054 {
1055         struct firmware_work *fw_work;
1056
1057         fw_work = kzalloc(sizeof (struct firmware_work), gfp);
1058         if (!fw_work)
1059                 return -ENOMEM;
1060
1061         fw_work->module = module;
1062         fw_work->name = name;
1063         fw_work->device = device;
1064         fw_work->context = context;
1065         fw_work->cont = cont;
1066         fw_work->uevent = uevent;
1067
1068         if (!try_module_get(module)) {
1069                 kfree(fw_work);
1070                 return -EFAULT;
1071         }
1072
1073         get_device(fw_work->device);
1074         INIT_WORK(&fw_work->work, request_firmware_work_func);
1075         schedule_work(&fw_work->work);
1076         return 0;
1077 }
1078
1079 /**
1080  * cache_firmware - cache one firmware image in kernel memory space
1081  * @fw_name: the firmware image name
1082  *
1083  * Cache firmware in kernel memory so that drivers can use it when
1084  * system isn't ready for them to request firmware image from userspace.
1085  * Once it returns successfully, driver can use request_firmware or its
1086  * nowait version to get the cached firmware without any interacting
1087  * with userspace
1088  *
1089  * Return 0 if the firmware image has been cached successfully
1090  * Return !0 otherwise
1091  *
1092  */
1093 int cache_firmware(const char *fw_name)
1094 {
1095         int ret;
1096         const struct firmware *fw;
1097
1098         pr_debug("%s: %s\n", __func__, fw_name);
1099
1100         ret = request_firmware(&fw, fw_name, NULL);
1101         if (!ret)
1102                 kfree(fw);
1103
1104         pr_debug("%s: %s ret=%d\n", __func__, fw_name, ret);
1105
1106         return ret;
1107 }
1108
1109 /**
1110  * uncache_firmware - remove one cached firmware image
1111  * @fw_name: the firmware image name
1112  *
1113  * Uncache one firmware image which has been cached successfully
1114  * before.
1115  *
1116  * Return 0 if the firmware cache has been removed successfully
1117  * Return !0 otherwise
1118  *
1119  */
1120 int uncache_firmware(const char *fw_name)
1121 {
1122         struct firmware_buf *buf;
1123         struct firmware fw;
1124
1125         pr_debug("%s: %s\n", __func__, fw_name);
1126
1127         if (fw_get_builtin_firmware(&fw, fw_name))
1128                 return 0;
1129
1130         buf = fw_lookup_buf(fw_name);
1131         if (buf) {
1132                 fw_free_buf(buf);
1133                 return 0;
1134         }
1135
1136         return -EINVAL;
1137 }
1138
1139 #ifdef CONFIG_PM_SLEEP
1140 static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
1141 {
1142         struct fw_cache_entry *fce;
1143
1144         fce = kzalloc(sizeof(*fce) + strlen(name) + 1, GFP_ATOMIC);
1145         if (!fce)
1146                 goto exit;
1147
1148         strcpy(fce->name, name);
1149 exit:
1150         return fce;
1151 }
1152
1153 static int __fw_entry_found(const char *name)
1154 {
1155         struct firmware_cache *fwc = &fw_cache;
1156         struct fw_cache_entry *fce;
1157
1158         list_for_each_entry(fce, &fwc->fw_names, list) {
1159                 if (!strcmp(fce->name, name))
1160                         return 1;
1161         }
1162         return 0;
1163 }
1164
1165 static int fw_cache_piggyback_on_request(const char *name)
1166 {
1167         struct firmware_cache *fwc = &fw_cache;
1168         struct fw_cache_entry *fce;
1169         int ret = 0;
1170
1171         spin_lock(&fwc->name_lock);
1172         if (__fw_entry_found(name))
1173                 goto found;
1174
1175         fce = alloc_fw_cache_entry(name);
1176         if (fce) {
1177                 ret = 1;
1178                 list_add(&fce->list, &fwc->fw_names);
1179                 pr_debug("%s: fw: %s\n", __func__, name);
1180         }
1181 found:
1182         spin_unlock(&fwc->name_lock);
1183         return ret;
1184 }
1185
1186 static void free_fw_cache_entry(struct fw_cache_entry *fce)
1187 {
1188         kfree(fce);
1189 }
1190
1191 static void __async_dev_cache_fw_image(void *fw_entry,
1192                                        async_cookie_t cookie)
1193 {
1194         struct fw_cache_entry *fce = fw_entry;
1195         struct firmware_cache *fwc = &fw_cache;
1196         int ret;
1197
1198         ret = cache_firmware(fce->name);
1199         if (ret) {
1200                 spin_lock(&fwc->name_lock);
1201                 list_del(&fce->list);
1202                 spin_unlock(&fwc->name_lock);
1203
1204                 free_fw_cache_entry(fce);
1205         }
1206
1207         spin_lock(&fwc->name_lock);
1208         fwc->cnt--;
1209         spin_unlock(&fwc->name_lock);
1210
1211         wake_up(&fwc->wait_queue);
1212 }
1213
1214 /* called with dev->devres_lock held */
1215 static void dev_create_fw_entry(struct device *dev, void *res,
1216                                 void *data)
1217 {
1218         struct fw_name_devm *fwn = res;
1219         const char *fw_name = fwn->name;
1220         struct list_head *head = data;
1221         struct fw_cache_entry *fce;
1222
1223         fce = alloc_fw_cache_entry(fw_name);
1224         if (fce)
1225                 list_add(&fce->list, head);
1226 }
1227
1228 static int devm_name_match(struct device *dev, void *res,
1229                            void *match_data)
1230 {
1231         struct fw_name_devm *fwn = res;
1232         return (fwn->magic == (unsigned long)match_data);
1233 }
1234
1235 static void dev_cache_fw_image(struct device *dev, void *data)
1236 {
1237         LIST_HEAD(todo);
1238         struct fw_cache_entry *fce;
1239         struct fw_cache_entry *fce_next;
1240         struct firmware_cache *fwc = &fw_cache;
1241
1242         devres_for_each_res(dev, fw_name_devm_release,
1243                             devm_name_match, &fw_cache,
1244                             dev_create_fw_entry, &todo);
1245
1246         list_for_each_entry_safe(fce, fce_next, &todo, list) {
1247                 list_del(&fce->list);
1248
1249                 spin_lock(&fwc->name_lock);
1250                 /* only one cache entry for one firmware */
1251                 if (!__fw_entry_found(fce->name)) {
1252                         fwc->cnt++;
1253                         list_add(&fce->list, &fwc->fw_names);
1254                 } else {
1255                         free_fw_cache_entry(fce);
1256                         fce = NULL;
1257                 }
1258                 spin_unlock(&fwc->name_lock);
1259
1260                 if (fce)
1261                         async_schedule(__async_dev_cache_fw_image,
1262                                        (void *)fce);
1263         }
1264 }
1265
1266 static void __device_uncache_fw_images(void)
1267 {
1268         struct firmware_cache *fwc = &fw_cache;
1269         struct fw_cache_entry *fce;
1270
1271         spin_lock(&fwc->name_lock);
1272         while (!list_empty(&fwc->fw_names)) {
1273                 fce = list_entry(fwc->fw_names.next,
1274                                 struct fw_cache_entry, list);
1275                 list_del(&fce->list);
1276                 spin_unlock(&fwc->name_lock);
1277
1278                 uncache_firmware(fce->name);
1279                 free_fw_cache_entry(fce);
1280
1281                 spin_lock(&fwc->name_lock);
1282         }
1283         spin_unlock(&fwc->name_lock);
1284 }
1285
1286 /**
1287  * device_cache_fw_images - cache devices' firmware
1288  *
1289  * If one device called request_firmware or its nowait version
1290  * successfully before, the firmware names are recored into the
1291  * device's devres link list, so device_cache_fw_images can call
1292  * cache_firmware() to cache these firmwares for the device,
1293  * then the device driver can load its firmwares easily at
1294  * time when system is not ready to complete loading firmware.
1295  */
1296 static void device_cache_fw_images(void)
1297 {
1298         struct firmware_cache *fwc = &fw_cache;
1299         int old_timeout;
1300         DEFINE_WAIT(wait);
1301
1302         pr_debug("%s\n", __func__);
1303
1304         /* cancel uncache work */
1305         cancel_delayed_work_sync(&fwc->work);
1306
1307         /*
1308          * use small loading timeout for caching devices' firmware
1309          * because all these firmware images have been loaded
1310          * successfully at lease once, also system is ready for
1311          * completing firmware loading now. The maximum size of
1312          * firmware in current distributions is about 2M bytes,
1313          * so 10 secs should be enough.
1314          */
1315         old_timeout = loading_timeout;
1316         loading_timeout = 10;
1317
1318         mutex_lock(&fw_lock);
1319         fwc->state = FW_LOADER_START_CACHE;
1320         dpm_for_each_dev(NULL, dev_cache_fw_image);
1321         mutex_unlock(&fw_lock);
1322
1323         /* wait for completion of caching firmware for all devices */
1324         spin_lock(&fwc->name_lock);
1325         for (;;) {
1326                 prepare_to_wait(&fwc->wait_queue, &wait,
1327                                 TASK_UNINTERRUPTIBLE);
1328                 if (!fwc->cnt)
1329                         break;
1330
1331                 spin_unlock(&fwc->name_lock);
1332
1333                 schedule();
1334
1335                 spin_lock(&fwc->name_lock);
1336         }
1337         spin_unlock(&fwc->name_lock);
1338         finish_wait(&fwc->wait_queue, &wait);
1339
1340         loading_timeout = old_timeout;
1341 }
1342
1343 /**
1344  * device_uncache_fw_images - uncache devices' firmware
1345  *
1346  * uncache all firmwares which have been cached successfully
1347  * by device_uncache_fw_images earlier
1348  */
1349 static void device_uncache_fw_images(void)
1350 {
1351         pr_debug("%s\n", __func__);
1352         __device_uncache_fw_images();
1353 }
1354
1355 static void device_uncache_fw_images_work(struct work_struct *work)
1356 {
1357         device_uncache_fw_images();
1358 }
1359
1360 /**
1361  * device_uncache_fw_images_delay - uncache devices firmwares
1362  * @delay: number of milliseconds to delay uncache device firmwares
1363  *
1364  * uncache all devices's firmwares which has been cached successfully
1365  * by device_cache_fw_images after @delay milliseconds.
1366  */
1367 static void device_uncache_fw_images_delay(unsigned long delay)
1368 {
1369         schedule_delayed_work(&fw_cache.work,
1370                         msecs_to_jiffies(delay));
1371 }
1372
1373 static int fw_pm_notify(struct notifier_block *notify_block,
1374                         unsigned long mode, void *unused)
1375 {
1376         switch (mode) {
1377         case PM_HIBERNATION_PREPARE:
1378         case PM_SUSPEND_PREPARE:
1379                 device_cache_fw_images();
1380                 break;
1381
1382         case PM_POST_SUSPEND:
1383         case PM_POST_HIBERNATION:
1384         case PM_POST_RESTORE:
1385                 /*
1386                  * In case that system sleep failed and syscore_suspend is
1387                  * not called.
1388                  */
1389                 mutex_lock(&fw_lock);
1390                 fw_cache.state = FW_LOADER_NO_CACHE;
1391                 mutex_unlock(&fw_lock);
1392
1393                 device_uncache_fw_images_delay(10 * MSEC_PER_SEC);
1394                 break;
1395         }
1396
1397         return 0;
1398 }
1399
1400 /* stop caching firmware once syscore_suspend is reached */
1401 static int fw_suspend(void)
1402 {
1403         fw_cache.state = FW_LOADER_NO_CACHE;
1404         return 0;
1405 }
1406
1407 static struct syscore_ops fw_syscore_ops = {
1408         .suspend = fw_suspend,
1409 };
1410 #else
1411 static int fw_cache_piggyback_on_request(const char *name)
1412 {
1413         return 0;
1414 }
1415 #endif
1416
1417 static void __init fw_cache_init(void)
1418 {
1419         spin_lock_init(&fw_cache.lock);
1420         INIT_LIST_HEAD(&fw_cache.head);
1421         fw_cache.state = FW_LOADER_NO_CACHE;
1422
1423 #ifdef CONFIG_PM_SLEEP
1424         spin_lock_init(&fw_cache.name_lock);
1425         INIT_LIST_HEAD(&fw_cache.fw_names);
1426         fw_cache.cnt = 0;
1427
1428         init_waitqueue_head(&fw_cache.wait_queue);
1429         INIT_DELAYED_WORK(&fw_cache.work,
1430                           device_uncache_fw_images_work);
1431
1432         fw_cache.pm_notify.notifier_call = fw_pm_notify;
1433         register_pm_notifier(&fw_cache.pm_notify);
1434
1435         register_syscore_ops(&fw_syscore_ops);
1436 #endif
1437 }
1438
1439 static int __init firmware_class_init(void)
1440 {
1441         fw_cache_init();
1442         return class_register(&firmware_class);
1443 }
1444
1445 static void __exit firmware_class_exit(void)
1446 {
1447 #ifdef CONFIG_PM_SLEEP
1448         unregister_syscore_ops(&fw_syscore_ops);
1449         unregister_pm_notifier(&fw_cache.pm_notify);
1450 #endif
1451         class_unregister(&firmware_class);
1452 }
1453
1454 fs_initcall(firmware_class_init);
1455 module_exit(firmware_class_exit);
1456
1457 EXPORT_SYMBOL(release_firmware);
1458 EXPORT_SYMBOL(request_firmware);
1459 EXPORT_SYMBOL(request_firmware_nowait);
1460 EXPORT_SYMBOL_GPL(cache_firmware);
1461 EXPORT_SYMBOL_GPL(uncache_firmware);