[PATCH] firmware: fix BUG: in fw_realloc_buffer
[safe/jmp/linux-2.6] / drivers / base / firmware_class.c
1 /*
2  * firmware_class.c - Multi purpose firmware loading support
3  *
4  * Copyright (c) 2003 Manuel Estrada Sainz <ranty@debian.org>
5  *
6  * Please see Documentation/firmware_class/ for more information.
7  *
8  */
9
10 #include <linux/capability.h>
11 #include <linux/device.h>
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/timer.h>
15 #include <linux/vmalloc.h>
16 #include <linux/interrupt.h>
17 #include <linux/bitops.h>
18 #include <asm/semaphore.h>
19
20 #include <linux/firmware.h>
21 #include "base.h"
22
23 MODULE_AUTHOR("Manuel Estrada Sainz <ranty@debian.org>");
24 MODULE_DESCRIPTION("Multi purpose firmware loading support");
25 MODULE_LICENSE("GPL");
26
27 enum {
28         FW_STATUS_LOADING,
29         FW_STATUS_DONE,
30         FW_STATUS_ABORT,
31         FW_STATUS_READY,
32         FW_STATUS_READY_NOHOTPLUG,
33 };
34
35 static int loading_timeout = 10;        /* In seconds */
36
37 /* fw_lock could be moved to 'struct firmware_priv' but since it is just
38  * guarding for corner cases a global lock should be OK */
39 static DECLARE_MUTEX(fw_lock);
40
41 struct firmware_priv {
42         char fw_id[FIRMWARE_NAME_MAX];
43         struct completion completion;
44         struct bin_attribute attr_data;
45         struct firmware *fw;
46         unsigned long status;
47         int alloc_size;
48         struct timer_list timeout;
49 };
50
51 static void
52 fw_load_abort(struct firmware_priv *fw_priv)
53 {
54         set_bit(FW_STATUS_ABORT, &fw_priv->status);
55         wmb();
56         complete(&fw_priv->completion);
57 }
58
59 static ssize_t
60 firmware_timeout_show(struct class *class, char *buf)
61 {
62         return sprintf(buf, "%d\n", loading_timeout);
63 }
64
65 /**
66  * firmware_timeout_store - set number of seconds to wait for firmware
67  * @class: device class pointer
68  * @buf: buffer to scan for timeout value
69  * @count: number of bytes in @buf
70  *
71  *      Sets the number of seconds to wait for the firmware.  Once
72  *      this expires an error will be returned to the driver and no
73  *      firmware will be provided.
74  *
75  *      Note: zero means 'wait forever'.
76  **/
77 static ssize_t
78 firmware_timeout_store(struct class *class, const char *buf, size_t count)
79 {
80         loading_timeout = simple_strtol(buf, NULL, 10);
81         if (loading_timeout < 0)
82                 loading_timeout = 0;
83         return count;
84 }
85
86 static CLASS_ATTR(timeout, 0644, firmware_timeout_show, firmware_timeout_store);
87
88 static void  fw_class_dev_release(struct class_device *class_dev);
89 int firmware_class_uevent(struct class_device *dev, char **envp,
90                            int num_envp, char *buffer, int buffer_size);
91
92 static struct class firmware_class = {
93         .name           = "firmware",
94         .uevent = firmware_class_uevent,
95         .release        = fw_class_dev_release,
96 };
97
98 int
99 firmware_class_uevent(struct class_device *class_dev, char **envp,
100                        int num_envp, char *buffer, int buffer_size)
101 {
102         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
103         int i = 0, len = 0;
104
105         if (!test_bit(FW_STATUS_READY, &fw_priv->status))
106                 return -ENODEV;
107
108         if (add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
109                            "FIRMWARE=%s", fw_priv->fw_id))
110                 return -ENOMEM;
111         if (add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
112                            "TIMEOUT=%i", loading_timeout))
113                 return -ENOMEM;
114         envp[i] = NULL;
115
116         return 0;
117 }
118
119 static ssize_t
120 firmware_loading_show(struct class_device *class_dev, char *buf)
121 {
122         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
123         int loading = test_bit(FW_STATUS_LOADING, &fw_priv->status);
124         return sprintf(buf, "%d\n", loading);
125 }
126
127 /**
128  * firmware_loading_store - set value in the 'loading' control file
129  * @class_dev: class_device pointer
130  * @buf: buffer to scan for loading control value
131  * @count: number of bytes in @buf
132  *
133  *      The relevant values are:
134  *
135  *       1: Start a load, discarding any previous partial load.
136  *       0: Conclude the load and hand the data to the driver code.
137  *      -1: Conclude the load with an error and discard any written data.
138  **/
139 static ssize_t
140 firmware_loading_store(struct class_device *class_dev,
141                        const char *buf, size_t count)
142 {
143         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
144         int loading = simple_strtol(buf, NULL, 10);
145
146         switch (loading) {
147         case 1:
148                 down(&fw_lock);
149                 if (!fw_priv->fw) {
150                         up(&fw_lock);
151                         break;
152                 }
153                 vfree(fw_priv->fw->data);
154                 fw_priv->fw->data = NULL;
155                 fw_priv->fw->size = 0;
156                 fw_priv->alloc_size = 0;
157                 set_bit(FW_STATUS_LOADING, &fw_priv->status);
158                 up(&fw_lock);
159                 break;
160         case 0:
161                 if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
162                         complete(&fw_priv->completion);
163                         clear_bit(FW_STATUS_LOADING, &fw_priv->status);
164                         break;
165                 }
166                 /* fallthrough */
167         default:
168                 printk(KERN_ERR "%s: unexpected value (%d)\n", __FUNCTION__,
169                        loading);
170                 /* fallthrough */
171         case -1:
172                 fw_load_abort(fw_priv);
173                 break;
174         }
175
176         return count;
177 }
178
179 static CLASS_DEVICE_ATTR(loading, 0644,
180                         firmware_loading_show, firmware_loading_store);
181
182 static ssize_t
183 firmware_data_read(struct kobject *kobj,
184                    char *buffer, loff_t offset, size_t count)
185 {
186         struct class_device *class_dev = to_class_dev(kobj);
187         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
188         struct firmware *fw;
189         ssize_t ret_count = count;
190
191         down(&fw_lock);
192         fw = fw_priv->fw;
193         if (!fw || test_bit(FW_STATUS_DONE, &fw_priv->status)) {
194                 ret_count = -ENODEV;
195                 goto out;
196         }
197         if (offset > fw->size) {
198                 ret_count = 0;
199                 goto out;
200         }
201         if (offset + ret_count > fw->size)
202                 ret_count = fw->size - offset;
203
204         memcpy(buffer, fw->data + offset, ret_count);
205 out:
206         up(&fw_lock);
207         return ret_count;
208 }
209
210 static int
211 fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
212 {
213         u8 *new_data;
214         int new_size = fw_priv->alloc_size;
215
216         if (min_size <= fw_priv->alloc_size)
217                 return 0;
218
219         new_size = ALIGN(min_size, PAGE_SIZE);
220         new_data = vmalloc(new_size);
221         if (!new_data) {
222                 printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
223                 /* Make sure that we don't keep incomplete data */
224                 fw_load_abort(fw_priv);
225                 return -ENOMEM;
226         }
227         fw_priv->alloc_size = new_size;
228         if (fw_priv->fw->data) {
229                 memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
230                 vfree(fw_priv->fw->data);
231         }
232         fw_priv->fw->data = new_data;
233         BUG_ON(min_size > fw_priv->alloc_size);
234         return 0;
235 }
236
237 /**
238  * firmware_data_write - write method for firmware
239  * @kobj: kobject for the class_device
240  * @buffer: buffer being written
241  * @offset: buffer offset for write in total data store area
242  * @count: buffer size
243  *
244  *      Data written to the 'data' attribute will be later handed to
245  *      the driver as a firmware image.
246  **/
247 static ssize_t
248 firmware_data_write(struct kobject *kobj,
249                     char *buffer, loff_t offset, size_t count)
250 {
251         struct class_device *class_dev = to_class_dev(kobj);
252         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
253         struct firmware *fw;
254         ssize_t retval;
255
256         if (!capable(CAP_SYS_RAWIO))
257                 return -EPERM;
258
259         down(&fw_lock);
260         fw = fw_priv->fw;
261         if (!fw || test_bit(FW_STATUS_DONE, &fw_priv->status)) {
262                 retval = -ENODEV;
263                 goto out;
264         }
265         retval = fw_realloc_buffer(fw_priv, offset + count);
266         if (retval)
267                 goto out;
268
269         memcpy(fw->data + offset, buffer, count);
270
271         fw->size = max_t(size_t, offset + count, fw->size);
272         retval = count;
273 out:
274         up(&fw_lock);
275         return retval;
276 }
277
278 static struct bin_attribute firmware_attr_data_tmpl = {
279         .attr = {.name = "data", .mode = 0644, .owner = THIS_MODULE},
280         .size = 0,
281         .read = firmware_data_read,
282         .write = firmware_data_write,
283 };
284
285 static void
286 fw_class_dev_release(struct class_device *class_dev)
287 {
288         struct firmware_priv *fw_priv = class_get_devdata(class_dev);
289
290         kfree(fw_priv);
291         kfree(class_dev);
292
293         module_put(THIS_MODULE);
294 }
295
296 static void
297 firmware_class_timeout(u_long data)
298 {
299         struct firmware_priv *fw_priv = (struct firmware_priv *) data;
300         fw_load_abort(fw_priv);
301 }
302
303 static inline void
304 fw_setup_class_device_id(struct class_device *class_dev, struct device *dev)
305 {
306         /* XXX warning we should watch out for name collisions */
307         strlcpy(class_dev->class_id, dev->bus_id, BUS_ID_SIZE);
308 }
309
310 static int
311 fw_register_class_device(struct class_device **class_dev_p,
312                          const char *fw_name, struct device *device)
313 {
314         int retval;
315         struct firmware_priv *fw_priv = kzalloc(sizeof(*fw_priv),
316                                                 GFP_KERNEL);
317         struct class_device *class_dev = kzalloc(sizeof(*class_dev),
318                                                  GFP_KERNEL);
319
320         *class_dev_p = NULL;
321
322         if (!fw_priv || !class_dev) {
323                 printk(KERN_ERR "%s: kmalloc failed\n", __FUNCTION__);
324                 retval = -ENOMEM;
325                 goto error_kfree;
326         }
327
328         init_completion(&fw_priv->completion);
329         fw_priv->attr_data = firmware_attr_data_tmpl;
330         strlcpy(fw_priv->fw_id, fw_name, FIRMWARE_NAME_MAX);
331
332         fw_priv->timeout.function = firmware_class_timeout;
333         fw_priv->timeout.data = (u_long) fw_priv;
334         init_timer(&fw_priv->timeout);
335
336         fw_setup_class_device_id(class_dev, device);
337         class_dev->dev = device;
338         class_dev->class = &firmware_class;
339         class_set_devdata(class_dev, fw_priv);
340         retval = class_device_register(class_dev);
341         if (retval) {
342                 printk(KERN_ERR "%s: class_device_register failed\n",
343                        __FUNCTION__);
344                 goto error_kfree;
345         }
346         *class_dev_p = class_dev;
347         return 0;
348
349 error_kfree:
350         kfree(fw_priv);
351         kfree(class_dev);
352         return retval;
353 }
354
355 static int
356 fw_setup_class_device(struct firmware *fw, struct class_device **class_dev_p,
357                       const char *fw_name, struct device *device, int uevent)
358 {
359         struct class_device *class_dev;
360         struct firmware_priv *fw_priv;
361         int retval;
362
363         *class_dev_p = NULL;
364         retval = fw_register_class_device(&class_dev, fw_name, device);
365         if (retval)
366                 goto out;
367
368         /* Need to pin this module until class device is destroyed */
369         __module_get(THIS_MODULE);
370
371         fw_priv = class_get_devdata(class_dev);
372
373         fw_priv->fw = fw;
374         retval = sysfs_create_bin_file(&class_dev->kobj, &fw_priv->attr_data);
375         if (retval) {
376                 printk(KERN_ERR "%s: sysfs_create_bin_file failed\n",
377                        __FUNCTION__);
378                 goto error_unreg;
379         }
380
381         retval = class_device_create_file(class_dev,
382                                           &class_device_attr_loading);
383         if (retval) {
384                 printk(KERN_ERR "%s: class_device_create_file failed\n",
385                        __FUNCTION__);
386                 goto error_unreg;
387         }
388
389         if (uevent)
390                 set_bit(FW_STATUS_READY, &fw_priv->status);
391         else
392                 set_bit(FW_STATUS_READY_NOHOTPLUG, &fw_priv->status);
393         *class_dev_p = class_dev;
394         goto out;
395
396 error_unreg:
397         class_device_unregister(class_dev);
398 out:
399         return retval;
400 }
401
402 static int
403 _request_firmware(const struct firmware **firmware_p, const char *name,
404                  struct device *device, int uevent)
405 {
406         struct class_device *class_dev;
407         struct firmware_priv *fw_priv;
408         struct firmware *firmware;
409         int retval;
410
411         if (!firmware_p)
412                 return -EINVAL;
413
414         *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
415         if (!firmware) {
416                 printk(KERN_ERR "%s: kmalloc(struct firmware) failed\n",
417                        __FUNCTION__);
418                 retval = -ENOMEM;
419                 goto out;
420         }
421
422         retval = fw_setup_class_device(firmware, &class_dev, name, device,
423                                        uevent);
424         if (retval)
425                 goto error_kfree_fw;
426
427         fw_priv = class_get_devdata(class_dev);
428
429         if (uevent) {
430                 if (loading_timeout > 0) {
431                         fw_priv->timeout.expires = jiffies + loading_timeout * HZ;
432                         add_timer(&fw_priv->timeout);
433                 }
434
435                 kobject_uevent(&class_dev->kobj, KOBJ_ADD);
436                 wait_for_completion(&fw_priv->completion);
437                 set_bit(FW_STATUS_DONE, &fw_priv->status);
438                 del_timer_sync(&fw_priv->timeout);
439         } else
440                 wait_for_completion(&fw_priv->completion);
441
442         down(&fw_lock);
443         if (!fw_priv->fw->size || test_bit(FW_STATUS_ABORT, &fw_priv->status)) {
444                 retval = -ENOENT;
445                 release_firmware(fw_priv->fw);
446                 *firmware_p = NULL;
447         }
448         fw_priv->fw = NULL;
449         up(&fw_lock);
450         class_device_unregister(class_dev);
451         goto out;
452
453 error_kfree_fw:
454         kfree(firmware);
455         *firmware_p = NULL;
456 out:
457         return retval;
458 }
459
460 /**
461  * request_firmware: - send firmware request and wait for it
462  * @firmware_p: pointer to firmware image
463  * @name: name of firmware file
464  * @device: device for which firmware is being loaded
465  *
466  *      @firmware_p will be used to return a firmware image by the name
467  *      of @name for device @device.
468  *
469  *      Should be called from user context where sleeping is allowed.
470  *
471  *      @name will be used as $FIRMWARE in the uevent environment and
472  *      should be distinctive enough not to be confused with any other
473  *      firmware image for this or any other device.
474  **/
475 int
476 request_firmware(const struct firmware **firmware_p, const char *name,
477                  struct device *device)
478 {
479         int uevent = 1;
480         return _request_firmware(firmware_p, name, device, uevent);
481 }
482
483 /**
484  * release_firmware: - release the resource associated with a firmware image
485  * @fw: firmware resource to release
486  **/
487 void
488 release_firmware(const struct firmware *fw)
489 {
490         if (fw) {
491                 vfree(fw->data);
492                 kfree(fw);
493         }
494 }
495
496 /**
497  * register_firmware: - provide a firmware image for later usage
498  * @name: name of firmware image file
499  * @data: buffer pointer for the firmware image
500  * @size: size of the data buffer area
501  *
502  *      Make sure that @data will be available by requesting firmware @name.
503  *
504  *      Note: This will not be possible until some kind of persistence
505  *      is available.
506  **/
507 void
508 register_firmware(const char *name, const u8 *data, size_t size)
509 {
510         /* This is meaningless without firmware caching, so until we
511          * decide if firmware caching is reasonable just leave it as a
512          * noop */
513 }
514
515 /* Async support */
516 struct firmware_work {
517         struct work_struct work;
518         struct module *module;
519         const char *name;
520         struct device *device;
521         void *context;
522         void (*cont)(const struct firmware *fw, void *context);
523         int uevent;
524 };
525
526 static int
527 request_firmware_work_func(void *arg)
528 {
529         struct firmware_work *fw_work = arg;
530         const struct firmware *fw;
531         int ret;
532         if (!arg) {
533                 WARN_ON(1);
534                 return 0;
535         }
536         daemonize("%s/%s", "firmware", fw_work->name);
537         ret = _request_firmware(&fw, fw_work->name, fw_work->device,
538                 fw_work->uevent);
539         if (ret < 0)
540                 fw_work->cont(NULL, fw_work->context);
541         else {
542                 fw_work->cont(fw, fw_work->context);
543                 release_firmware(fw);
544         }
545         module_put(fw_work->module);
546         kfree(fw_work);
547         return ret;
548 }
549
550 /**
551  * request_firmware_nowait: asynchronous version of request_firmware
552  * @module: module requesting the firmware
553  * @uevent: sends uevent to copy the firmware image if this flag
554  *      is non-zero else the firmware copy must be done manually.
555  * @name: name of firmware file
556  * @device: device for which firmware is being loaded
557  * @context: will be passed over to @cont, and
558  *      @fw may be %NULL if firmware request fails.
559  * @cont: function will be called asynchronously when the firmware
560  *      request is over.
561  *
562  *      Asynchronous variant of request_firmware() for contexts where
563  *      it is not possible to sleep.
564  **/
565 int
566 request_firmware_nowait(
567         struct module *module, int uevent,
568         const char *name, struct device *device, void *context,
569         void (*cont)(const struct firmware *fw, void *context))
570 {
571         struct firmware_work *fw_work = kmalloc(sizeof (struct firmware_work),
572                                                 GFP_ATOMIC);
573         int ret;
574
575         if (!fw_work)
576                 return -ENOMEM;
577         if (!try_module_get(module)) {
578                 kfree(fw_work);
579                 return -EFAULT;
580         }
581
582         *fw_work = (struct firmware_work) {
583                 .module = module,
584                 .name = name,
585                 .device = device,
586                 .context = context,
587                 .cont = cont,
588                 .uevent = uevent,
589         };
590
591         ret = kernel_thread(request_firmware_work_func, fw_work,
592                             CLONE_FS | CLONE_FILES);
593
594         if (ret < 0) {
595                 fw_work->cont(NULL, fw_work->context);
596                 module_put(fw_work->module);
597                 kfree(fw_work);
598                 return ret;
599         }
600         return 0;
601 }
602
603 static int __init
604 firmware_class_init(void)
605 {
606         int error;
607         error = class_register(&firmware_class);
608         if (error) {
609                 printk(KERN_ERR "%s: class_register failed\n", __FUNCTION__);
610                 return error;
611         }
612         error = class_create_file(&firmware_class, &class_attr_timeout);
613         if (error) {
614                 printk(KERN_ERR "%s: class_create_file failed\n",
615                        __FUNCTION__);
616                 class_unregister(&firmware_class);
617         }
618         return error;
619
620 }
621 static void __exit
622 firmware_class_exit(void)
623 {
624         class_unregister(&firmware_class);
625 }
626
627 module_init(firmware_class_init);
628 module_exit(firmware_class_exit);
629
630 EXPORT_SYMBOL(release_firmware);
631 EXPORT_SYMBOL(request_firmware);
632 EXPORT_SYMBOL(request_firmware_nowait);
633 EXPORT_SYMBOL(register_firmware);